@djangocfg/api 2.1.626 → 2.1.627

package/dist/auth.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/auth/constants.ts","../src/auth/trace.ts","../src/auth/context/AuthContext.tsx","../src/_api/generated/helpers/errors.ts","../src/_api/generated/helpers/keys.ts","../src/_api/generated/helpers/auth.ts","../src/_api/generated/helpers/logger.ts","../src/auth/utils/env.ts","../src/log-control.ts","../src/auth/hooks/useSession.ts","../src/auth/hooks/useTimezone.ts","../src/auth/hooks/useCfgRouter.ts","../src/auth/hooks/useQueryParams.ts","../src/auth/hooks/useAuthFormState.ts","../src/auth/hooks/useAuthValidation.ts","../src/auth/hooks/useAuthForm.ts","../src/auth/utils/logger.ts","../src/auth/hooks/useAutoAuth.ts","../src/auth/utils/path.ts","../src/auth/hooks/useTwoFactorChallenge.ts","../src/auth/hooks/useOAuthLogin.ts","../src/_api/generated/core/bodySerializer.gen.ts","../src/_api/generated/core/params.gen.ts","../src/_api/generated/core/serverSentEvents.gen.ts","../src/_api/generated/core/pathSerializer.gen.ts","../src/_api/generated/core/utils.gen.ts","../src/_api/generated/core/auth.gen.ts","../src/_api/generated/client/utils.gen.ts","../src/_api/generated/client/client.gen.ts","../src/_api/generated/client.gen.ts","../src/_api/generated/sdk.gen.ts","../src/auth/utils/analytics.ts","../src/_api/generated/types.gen.ts","../src/auth/utils/errors.ts","../src/auth/utils/oauthErrors.ts","../src/auth/hooks/useSessionStorage.ts","../src/auth/utils/storage.ts","../src/auth/hooks/useAuthRedirect.ts","../src/auth/hooks/useOAuthProviders.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthProvidersRetrieve.ts","../src/auth/hooks/useGithubAuth.ts","../src/auth/hooks/useTwoFactorVerify.ts","../src/auth/hooks/twoFactor.shared.ts","../src/auth/hooks/useTwoFactorSetup.ts","../src/auth/hooks/useTwoFactorStatus.ts","../src/auth/hooks/useTwoFactor.ts","../src/auth/hooks/useLocalStorage.ts","../src/auth/hooks/useBase64.ts","../src/auth/hooks/useProfileCache.ts","../src/auth/hooks/useDeleteAccount.ts","../src/auth/hooks/legacyStorage.ts","../src/auth/utils/authState.ts","../src/auth/context/AccountsContext.tsx","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRegenerateCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRetrieve.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRevealCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyTestCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthConnectionsList.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthDisconnectCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGithubAuthorizeCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGithubCallbackCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGoogleAuthorizeCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGoogleCallbackCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpConsentPolicyRetrieve.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpRequestCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpVerifyCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileAvatarCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileDeleteCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfilePartialPartialUpdate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfilePartialUpdate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileRetrieve.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileUpdatePartialUpdate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileUpdateUpdate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenBlacklistCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts","../src/auth/context/sharedContext.ts","../src/auth/utils/validation.ts","../src/auth/utils/guard.ts"],"sourcesContent":["/**\n * Auth-related constants shared across the frontend.\n * Single source of truth — do not redefine these elsewhere.\n */\n\nexport const AUTH_CONSTANTS = {\n  /** Email OTP code length (numeric). */\n  EMAIL_OTP_LENGTH: 4,\n  /** TOTP code length (RFC 6238 — authenticator apps). */\n  TOTP_LENGTH: 6,\n  /** Backup code max length. */\n  BACKUP_CODE_MAX_LENGTH: 12,\n  /** Resend cooldown (s) when the server does not state one. Mirrors the backend per-email cooldown. */\n  RESEND_COOLDOWN_SECONDS: 30,\n} as const;\n\n// Route conventions are NOT exported here on purpose. The '/auth' and '/'\n// defaults are applied in exactly one place — AuthProvider's route resolution\n// — and every consumer reads the resolved values from `useAuth().routes`.\n// Exporting route constants invites components to default to them directly,\n// which silently diverges from an app's AuthConfig.routes override.\n","/**\n * Auth trace: a persisted record of what the auth layer did, readable after any reload or redirect.\n *\n * Why storage and not `window`: a sign-in problem usually ends in a reload or a redirect, which throws away\n * everything held in memory and in the console. The events live in `localStorage` (falling back to\n * `sessionStorage`, then memory), so the next page can still print them. `window.__cfgAuth` is only the reader.\n *\n * Read it in the browser console, on any page of the origin, even after the redirect:\n *\n *   __cfgAuth.dump()    // copy-ready text with a header; paste it into the report\n *   __cfgAuth.trace()   // the raw array\n *   __cfgAuth.clear()   // empty it before reproducing\n *   __cfgAuth.copy()    // dump to the clipboard; __cfgAuth.download() saves the raw JSON\n *\n * What is recorded is the decision, never the secret: no token, code, address, cookie value or password.\n * Values are primitives, strings are cut, and keys that look sensitive are dropped (`SENSITIVE`).\n */\n\ntype Primitive = string | number | boolean | null;\nexport type TraceFields = Record<string, Primitive>;\n\nexport interface TraceEntry {\n  /** Wall clock, ms since epoch. */\n  t: number;\n  /** ms since this page started (`performance.now()`), so a reload shows as the counter restarting. */\n  p: number;\n  /** Short random id of this page load: one sequence, several loads, told apart by this. */\n  tab: string;\n  ev: string;\n  f?: TraceFields;\n  /** Times this exact event repeated back to back (absent = once). A loop must not push the start of the chain out of the buffer. */\n  n?: number;\n}\n\nconst KEY = 'cfg.auth.trace';\nconst MAX = 200;\nconst MAX_STRING = 120;\nconst SENSITIVE = /token|otp|code|email|password|secret|cookie|authorization|key|identifier/i;\n\n// One id per page load, shared by every copy of this module on the page (a second copy must not look like a second tab).\nconst TAB: string = (() => {\n  const g = globalThis as Record<string, unknown>;\n  return (g.__cfgAuthTab ??= Math.random().toString(36).slice(2, 6)) as string;\n})();\nconst hasWindow = typeof window !== 'undefined';\n\nlet memory: TraceEntry[] = [];\nlet loaded = false;\n\nfunction backend(): Storage | null {\n  if (!hasWindow) return null;\n  for (const name of ['localStorage', 'sessionStorage'] as const) {\n    try {\n      const s = window[name];\n      s.setItem('__cfg_probe', '1');\n      s.removeItem('__cfg_probe');\n      return s;\n    } catch {\n      /* try the next one */\n    }\n  }\n  return null;\n}\n\nfunction load(): TraceEntry[] {\n  if (loaded) return memory;\n  loaded = true;\n  try {\n    const raw = backend()?.getItem(KEY);\n    const parsed: unknown = raw ? JSON.parse(raw) : [];\n    if (Array.isArray(parsed)) memory = parsed.filter((e): e is TraceEntry => typeof e === 'object' && e !== null);\n  } catch {\n    memory = [];\n  }\n  return memory;\n}\n\nfunction persist(): void {\n  try {\n    backend()?.setItem(KEY, JSON.stringify(memory));\n  } catch {\n    /* quota or blocked storage: the in-memory copy still serves this page */\n  }\n}\n\nfunction clean(fields?: TraceFields): TraceFields | undefined {\n  if (!fields) return undefined;\n  const out: TraceFields = {};\n  for (const [k, v] of Object.entries(fields)) {\n    if (SENSITIVE.test(k)) continue;\n    if (typeof v === 'string') out[k] = v.length > MAX_STRING ? `${v.slice(0, MAX_STRING)}…` : v;\n    else if (typeof v === 'number' || typeof v === 'boolean' || v === null) out[k] = v;\n  }\n  return Object.keys(out).length ? out : undefined;\n}\n\n/** Re-read storage before every write: another tab (or another copy) may have appended since this one last looked. */\nfunction refresh(): void {\n  try {\n    const raw = backend()?.getItem(KEY);\n    const parsed: unknown = raw ? JSON.parse(raw) : null;\n    if (Array.isArray(parsed)) memory = parsed.filter((e): e is TraceEntry => typeof e === 'object' && e !== null);\n  } catch {\n    /* keep the in-memory copy */\n  }\n}\n\nfunction record(at: number, ev: string, fields?: TraceFields): void {\n  load();\n  refresh();\n  const entries = memory;\n  const p = hasWindow && typeof performance !== 'undefined' ? Math.round(performance.now()) : 0;\n  const f = clean(fields);\n  const last = entries[entries.length - 1];\n  if (last && last.tab === TAB && last.ev === ev && JSON.stringify(last.f) === JSON.stringify(f)) {\n    last.n = (last.n ?? 1) + 1;\n    last.t = at;\n    last.p = p;\n    persist();\n    return;\n  }\n  entries.push({ t: at, p, tab: TAB, ev, f });\n  if (entries.length > MAX) entries.splice(0, entries.length - MAX);\n  persist();\n}\n\n/** Record one auth event. Safe anywhere: it never throws and does nothing on the server. */\nexport function authTrace(ev: string, fields?: TraceFields): void {\n  if (!hasWindow) return;\n  try {\n    record(Date.now(), ev, fields);\n  } catch {\n    /* tracing never breaks auth */\n  }\n}\n\n/** The recorded events, oldest first. */\n/** @internal for tests */\nexport function resetAuthTraceForTests(): void {\n  memory = [];\n  loaded = true;\n}\n\nexport function readAuthTrace(): TraceEntry[] {\n  return load().slice();\n}\n\n/** Empty the trace. */\nexport function clearAuthTrace(): void {\n  memory = [];\n  loaded = true;\n  try {\n    backend()?.removeItem(KEY);\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction context(): string[] {\n  if (!hasWindow) return [];\n  const copies = (globalThis as Record<string, unknown>).__cfgAuthCopies ?? 1;\n  const lines = [`url: ${window.location.href.split('?')[0]}`, `copies: ${String(copies)}`, `online: ${navigator.onLine}`, `ua: ${navigator.userAgent}`];\n  try {\n    const auth = (globalThis as Record<string, unknown>).__cfgAuthNow as (() => TraceFields) | undefined;\n    const now = auth?.();\n    if (now) lines.push(`now: ${Object.entries(now).map(([k, v]) => `${k}=${String(v)}`).join(' ')}`);\n  } catch {\n    /* the live state is a courtesy */\n  }\n  return lines;\n}\n\n/** Copy-ready text: a short header, then one line per event. Reloads show as a new `[tab]`. */\nexport function dumpAuthTrace(): string {\n  const entries = load();\n  const first = entries[0]?.t ?? Date.now();\n  const rows = entries.map((e) => {\n    const fields = e.f ? ` ${Object.entries(e.f).map(([k, v]) => `${k}=${String(v)}`).join(' ')}` : '';\n    const at = new Date(e.t).toISOString().slice(11, 23);\n    return `${at} +${String(e.t - first).padStart(6)}ms [${e.tab} p${e.p}] ${e.ev}${fields}${e.n && e.n > 1 ? ` x${e.n}` : ''}`;\n  });\n  return [`# cfg auth trace, ${entries.length} events`, ...context(), '', ...rows].join('\\n');\n}\n\n/**\n * Install the reader. Called once from the package entry; idempotent across copies of this module.\n * The generated auth store forwards through `globalThis.__cfgAuthTrace` and queues until this runs.\n */\nexport function installAuthTrace(): void {\n  if (!hasWindow) return;\n  const g = globalThis as Record<string, unknown>;\n  g.__cfgAuthTrace = authTrace;\n  g.__cfgAuth = {\n    trace: readAuthTrace,\n    dump: () => {\n      const text = dumpAuthTrace();\n      // eslint-disable-next-line no-console\n      console.log(text);\n      return text;\n    },\n    clear: clearAuthTrace,\n    /** Put the dump on the clipboard (works when the console output is blocked or too long to select). */\n    copy: () => {\n      const text = dumpAuthTrace();\n      void navigator.clipboard?.writeText(text);\n      return `${text.split('\\n').length} lines copied`;\n    },\n    /** Download the raw trace as a JSON file. */\n    download: () => {\n      const blob = new Blob([JSON.stringify(readAuthTrace(), null, 1)], { type: 'application/json' });\n      const a = document.createElement('a');\n      a.href = URL.createObjectURL(blob);\n      a.download = `auth-trace-${Date.now()}.json`;\n      a.click();\n    },\n  };\n  const queued = g.__cfgAuthTraceQ;\n  if (Array.isArray(queued)) {\n    g.__cfgAuthTraceQ = [];\n    for (const item of queued) {\n      if (Array.isArray(item) && typeof item[1] === 'string') {\n        try {\n          record(Number(item[0]) || Date.now(), item[1], item[2] as TraceFields | undefined);\n        } catch {\n          /* ignore */\n        }\n      }\n    }\n  }\n}\n\n/**\n * Count the copies of this package in the page. More than one means the bundle holds duplicates (pnpm peer-set\n * variants, a dual ESM/CJS load): the contexts are shared (`sharedContext`), but the build should still be fixed.\n * Visible as `dup.copy` in the trace and once in the console.\n */\nfunction registerCopy(): void {\n  if (!hasWindow) return;\n  const g = globalThis as Record<string, unknown>;\n  const n = ((g.__cfgAuthCopies as number | undefined) ?? 0) + 1;\n  g.__cfgAuthCopies = n;\n  if (n > 1) {\n    authTrace('dup.copy', { copies: n });\n    if (n === 2) {\n      // eslint-disable-next-line no-console\n      console.warn('[@djangocfg/api] more than one copy of the auth package is loaded; see __cfgAuth.dump() (dup.copy). Align the peer set so pnpm installs one instance.');\n    }\n  }\n}\nregisterCopy();\n\n// The reader is installed as soon as the package loads, so a trace exists from the first event.\ninstallAuthTrace();\n","'use client';\n\n/**\n * AuthProvider — thin React layer over the generated auth store.\n *\n * Architecture rule (auth v2): the generated store (`_api/generated/helpers/auth`)\n * is the ONLY auth engine. It owns tokens, JWT-exp semantics, the reactive\n * session snapshot, 401→refresh→retry recovery (cross-store Web-Locks), and\n * the terminal-401 `onSessionExpired` event. React only:\n *   1. subscribes to the snapshot (`useSyncExternalStore`),\n *   2. loads the user profile when a session exists,\n *   3. routes to login when the store says the session died,\n *   4. exposes login/logout actions.\n *\n * Everything that used to live here — authTick, expiry timers, four parallel\n * 401 handlers, presence-vs-exp token checks — is the store's job now.\n */\n\nimport { usePathname } from 'next/navigation';\nimport React, {\n  memo,\n  useCallback,\n  useContext,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n} from 'react';\n\nimport { auth } from '../../_api/generated/helpers/auth';\nimport { APIError } from '../../_api/generated/helpers';\nimport { CFG_KEYS } from '../../_api/generated/helpers/keys';\nimport { applyRoleLogPolicy } from '../../log-control';\nimport { useCfgRouter, useLocalStorage, useQueryParams, useSession } from '../hooks';\nimport { clearProfileCache } from '../hooks/useProfileCache';\nimport { purgeLegacyTokenStorage } from '../hooks/legacyStorage';\nimport { useAuthRedirectManager } from '../hooks/useAuthRedirect';\nimport { Analytics, AnalyticsCategory, AnalyticsEvent } from '../utils/analytics';\nimport { formatAuthError, logAuthFailure } from '../utils/errors';\nimport { resolveAuthStatus } from '../utils/authState';\nimport { authTrace } from '../trace';\nimport { isDev, isBrowser } from '../utils/env';\nimport { authLogger } from '../utils/logger';\nimport { AccountsProvider, useAccountsContext } from './AccountsContext';\nimport { sharedContext } from './sharedContext';\n\nimport type { AuthContextType, AuthProviderProps, UserProfile } from './types';\nimport type {\n  OTPRequestConsent,\n  OTPRequestResult,\n  PasswordLoginOptions,\n  PasswordLoginResult,\n} from '../types';\nimport type { OtpRequestRequest } from '../../_api/generated/_cfg_accounts/types.gen';\n\n// The ONLY place route conventions are declared. '/auth' is the sign-in page\n// convention and '/private' is the default landing page after sign-in\n// (`defaultCallback`). Apps override via AuthConfig.routes;\n// everything downstream reads the RESOLVED values from `useAuth().routes`.\nconst defaultRoutes = {\n  auth: '/auth',\n  defaultCallback: '/private',\n  defaultAuthCallback: '/auth',\n};\n\n/** Resolve AuthConfig.routes against the conventions — applied exactly once. */\nexport const resolveAuthRoutes = (\n  routes?: { auth?: string; defaultCallback?: string; defaultAuthCallback?: string },\n) => ({\n  auth: routes?.auth || defaultRoutes.auth,\n  defaultCallback: routes?.defaultCallback || defaultRoutes.defaultCallback,\n  defaultAuthCallback: routes?.defaultAuthCallback || routes?.auth || defaultRoutes.defaultAuthCallback,\n});\n\nconst EMAIL_STORAGE_KEY = CFG_KEYS.email.key;\n\nconst AuthContext = sharedContext<AuthContextType | undefined>('auth', undefined);\n\nconst AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config }) => {\n  const accounts = useAccountsContext();\n  const session = useSession();\n  const isAuthenticated = session.status === 'authenticated';\n\n  const router = useCfgRouter();\n  const pathname = usePathname();\n  const queryParams = useQueryParams();\n  const [storedEmail, setStoredEmail, clearStoredEmail] = useLocalStorage<string | null>(\n    EMAIL_STORAGE_KEY,\n    null,\n  );\n\n  // Resolved once; every consumer below (and, via context, every component)\n  // reads these — never the raw config and never a module constant.\n  const routes = useMemo(() => resolveAuthRoutes(config?.routes), [config?.routes]);\n  const routesRef = useRef(routes);\n  useEffect(() => {\n    routesRef.current = routes;\n  }, [routes]);\n\n  const redirectManager = useAuthRedirectManager({\n    fallbackUrl: routes.defaultCallback,\n    clearOnUse: true,\n  });\n\n  const configRef = useRef(config);\n  useEffect(() => {\n    configRef.current = config;\n  }, [config]);\n\n  const accountsRef = useRef(accounts);\n  useEffect(() => {\n    accountsRef.current = accounts;\n  }, [accounts]);\n\n  // Set when a login flow opts out of automatic navigation (verifyOTP with\n  // skipRedirect — the AuthLayout success screen owns the final hardPush,\n  // including through a 2FA continuation). While set, the \"redirect\n  // authenticated users away from /auth\" effect must stand down, otherwise it\n  // races the success screen and eats the saved back-url.\n  const pendingManualNavRef = useRef(false);\n\n  // ── Bootstrap: settle the profile for the current session ─────────────────\n  // The session itself needs no async bootstrap — the store answers\n  // synchronously from token `exp`. The only async part is the profile fetch,\n  // and it re-runs automatically when a session appears later (e.g. iframe\n  // token delivery via postMessage → setSession → snapshot flips).\n  const [profileSettled, setProfileSettled] = useState(false);\n  const hasProfile = Boolean(accounts.profile);\n  const profileAttemptedRef = useRef(false);\n\n  useEffect(() => {\n    if (!isAuthenticated) {\n      profileAttemptedRef.current = false;\n      // Dead tokens may still sit in storage (access AND refresh both\n      // expired). Purge so the login form shows instantly instead of the app\n      // firing doomed API calls — the automated \"clear localStorage and the\n      // form appears\".\n      //\n      // CRITICAL: ask the STORE synchronously, never trust the React snapshot\n      // here. During hydration useSyncExternalStore serves the SERVER snapshot\n      // ('anonymous') for one commit even when perfectly live tokens sit in\n      // storage — purging on that stale value nuked fresh logins (user typed\n      // OTP → tokens saved → hardPush → hydration commit saw 'anonymous' →\n      // tokens cleared → bounced back to /auth).\n      const hasTokens = Boolean(auth.getToken() || auth.getRefreshToken());\n      if (hasTokens && !auth.isAuthenticated()) {\n        authLogger.warn('Dead session in storage — clearing');\n        authTrace('bootstrap.purge', { why: 'dead-tokens' });\n        auth.clearSession();\n        clearProfileCache();\n      } else if (!hasTokens && !auth.isAuthenticated()) {\n        // No session at all: a leftover profile cache and the old localStorage tokens (pre-cookie auth) must not keep\n        // the private UI alive. Drop them; the page's own guard then sends the user to /auth.\n        authTrace('bootstrap.purge', { why: 'no-session' });\n        clearProfileCache();\n        purgeLegacyTokenStorage();\n        if (accountsRef.current.profile) accountsRef.current.logout();\n      }\n      setProfileSettled(true);\n      return;\n    }\n    if (hasProfile || profileAttemptedRef.current) {\n      setProfileSettled(true);\n      return;\n    }\n    profileAttemptedRef.current = true;\n    authTrace('bootstrap.profile.start');\n    let cancelled = false;\n    accountsRef.current\n      .refreshProfile({ callerId: 'AuthProvider:bootstrap' })\n      .catch((error: unknown) => {\n        // A terminal 401 collapses the session via the store's\n        // onSessionExpired funnel below. Anything else (network, 5xx) keeps\n        // the session — the user can retry.\n        authLogger.warn('Profile load failed (session kept):', error);\n        authTrace('bootstrap.profile.failed', {\n          status: error instanceof APIError ? error.statusCode : 0,\n        });\n      })\n      .finally(() => {\n        if (!cancelled) setProfileSettled(true);\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [isAuthenticated, hasProfile]);\n\n  const isLoading = !profileSettled;\n\n  // ── The one linear state ───────────────────────────────────────────────────\n  // clientReady: the hydration commit is over (the server snapshot is always 'anonymous', so before this the\n  // snapshot proves nothing). timedOut: ONE safety timer, so 'resolving' always ends.\n  const [clientReady, setClientReady] = useState(false);\n  const [timedOut, setTimedOut] = useState(false);\n  useEffect(() => {\n    setClientReady(true);\n    const timer = setTimeout(() => setTimedOut(true), 8000);\n    return () => clearTimeout(timer);\n  }, []);\n  const status = resolveAuthStatus({\n    clientReady,\n    snapshotAuthenticated: isAuthenticated,\n    storeAuthenticated: isBrowser ? auth.isAuthenticated() : false,\n    profileSettled,\n    timedOut,\n  });\n  const lastStatusRef = useRef<string>('');\n  useEffect(() => {\n    if (lastStatusRef.current === status) return;\n    lastStatusRef.current = status;\n    authTrace('status', {\n      status,\n      snapshot: isAuthenticated,\n      store: auth.isAuthenticated(),\n      profileSettled,\n      timedOut,\n      path: pathname ?? '',\n    });\n  }, [status, isAuthenticated, profileSettled, timedOut, pathname]);\n  useEffect(() => {\n    (globalThis as Record<string, unknown>).__cfgAuthNow = () => ({\n      status,\n      snapshot: isAuthenticated,\n      store: auth.isAuthenticated(),\n      hasToken: Boolean(auth.getToken()),\n      hasRefresh: Boolean(auth.getRefreshToken()),\n      profileSettled,\n      timedOut,\n    });\n  }, [status, isAuthenticated, profileSettled, timedOut]);\n\n  // ── The ONE exit: terminal 401 → login ─────────────────────────────────────\n  // The store has already cleared the session before this fires (subscribers\n  // flipped to 'anonymous'), so the handler only routes. Registration returns\n  // its own unsubscribe — StrictMode double-mounts compose instead of racing.\n  // One hard navigation per page is enforced in useCfgRouter, so no per-handler dedupe flag is needed.\n  useEffect(() => {\n    const unsubscribe = auth.onSessionExpired(() => {\n      authTrace('expired.handler', { path: pathname ?? '' });\n      authLogger.warn('Session expired (terminal 401) — redirecting to login');\n      clearProfileCache();\n      Analytics.event(AnalyticsEvent.AUTH_SESSION_EXPIRED, {\n        category: AnalyticsCategory.AUTH,\n      });\n      router.hardReplace(routesRef.current.defaultAuthCallback);\n    });\n    return unsubscribe;\n  }, [router, pathname]);\n\n  // ── Redirect authenticated users away from the auth page ──────────────────\n  // Stands down while a login flow on this page owns navigation (success\n  // screen / 2FA continuation — see pendingManualNavRef). When it does fire\n  // (an already-authenticated user landing on /auth), it honors the saved\n  // back-url with the same priority rule as every other consumer.\n  useEffect(() => {\n    if (!isAuthenticated || pendingManualNavRef.current) return;\n    if (pathname === routes.auth && !queryParams.get('flow')) {\n      const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;\n      if (saved) redirectManager.clearRedirect();\n      authTrace('leave-auth', { to: saved || routes.defaultCallback, saved: Boolean(saved) });\n      router.push(saved || routes.defaultCallback);\n    }\n  }, [isAuthenticated, pathname, queryParams, routes, router, redirectManager]);\n\n  // ── Profile actions (delegated to AccountsContext) ─────────────────────────\n\n  const loadCurrentProfile = useCallback(async (callerId?: string): Promise<void> => {\n    if (!auth.isAuthenticated()) {\n      throw new Error('No valid authentication token');\n    }\n    await accountsRef.current.refreshProfile({\n      callerId: callerId || 'AuthContext.loadCurrentProfile',\n    });\n  }, []);\n\n  const checkAuthAndRedirect = useCallback(async (): Promise<void> => {\n    if (auth.isAuthenticated()) {\n      try {\n        await loadCurrentProfile('checkAuthAndRedirect');\n      } catch (error) {\n        authLogger.warn('checkAuthAndRedirect: profile load failed', error);\n      }\n      router.push(routesRef.current.defaultCallback);\n    } else {\n      router.push(routesRef.current.defaultAuthCallback);\n    }\n  }, [loadCurrentProfile, router]);\n\n  // ── OTP login flow ─────────────────────────────────────────────────────────\n\n  const requestOTP = useCallback(\n    async (identifier: string, sourceUrl?: string, consent?: OTPRequestConsent): Promise<OTPRequestResult> => {\n      // A login attempt invalidates whatever session was lying around.\n      authTrace('otp.request');\n      auth.clearSession();\n\n      try {\n        const body: OtpRequestRequest = {\n          identifier,\n          source_url: sourceUrl,\n          // Absent when the consuming app didn't enable the opt-in checkbox —\n          // the backend treats absent/null as \"not asked\".\n          ...(consent && {\n            marketing_consent: consent.marketingConsent,\n            consent_disclosure_version: consent.disclosureVersion,\n          }),\n        };\n        const result = await accountsRef.current.requestOTP(body);\n\n        Analytics.event(AnalyticsEvent.AUTH_OTP_REQUEST, {\n          category: AnalyticsCategory.AUTH,\n          label: 'email',\n        });\n\n        return {\n          success: true,\n          message: result.message || 'OTP code sent to your email address',\n          webmail: result.webmail ?? null,\n          resendIn: result.resend_in,\n        };\n      } catch (error) {\n        logAuthFailure(authLogger, 'Request OTP failed:', error);\n\n        if (error instanceof APIError) {\n          const body = error.response as\n            | { retry_after?: number; retryAfter?: number }\n            | undefined;\n          const retryAfter = body?.retry_after ?? body?.retryAfter;\n          return {\n            success: false,\n            statusCode: error.statusCode,\n            message: formatAuthError(error),\n            retryAfter: typeof retryAfter === 'number' ? retryAfter : undefined,\n          };\n        }\n        return { success: false, message: formatAuthError(error, 'Failed to send OTP') };\n      }\n    },\n    [],\n  );\n\n  const verifyOTP = useCallback(\n    async (\n      identifier: string,\n      otpCode: string,\n      sourceUrl?: string,\n      redirectUrl?: string,\n      skipRedirect?: boolean,\n    ): Promise<{\n      success: boolean;\n      message: string;\n      user?: UserProfile;\n      requires_2fa?: boolean;\n      session_id?: string | null;\n      should_prompt_2fa?: boolean;\n    }> => {\n      try {\n        // The caller opting out of redirect commits to handling ALL navigation\n        // for this login — including the 2FA continuation and success screen.\n        pendingManualNavRef.current = Boolean(skipRedirect);\n        authTrace('otp.verify', { skipRedirect: Boolean(skipRedirect) });\n\n        const result = await accountsRef.current.verifyOTP({\n          identifier,\n          otp: otpCode,\n          source_url: sourceUrl,\n        });\n\n        if (result.requires_2fa && result.session_id) {\n          authLogger.info('2FA required, session:', result.session_id);\n          return {\n            success: true,\n            message: 'OTP verified, 2FA required',\n            requires_2fa: true,\n            session_id: result.session_id,\n            should_prompt_2fa: result.should_prompt_2fa,\n          };\n        }\n\n        if (!result.access || !result.refresh) {\n          authLogger.error('Verify OTP returned invalid response:', result);\n          return { success: false, message: 'Invalid OTP verification response' };\n        }\n        if (identifier.includes('@')) {\n          setStoredEmail(identifier);\n        }\n\n        Analytics.event(AnalyticsEvent.AUTH_LOGIN_SUCCESS, {\n          category: AnalyticsCategory.AUTH,\n          label: 'email',\n        });\n        if (result.user?.id) {\n          Analytics.setUser(String(result.user.id));\n        }\n\n        if (!skipRedirect) {\n          // Priority: saved back-url (per-visit intent from the guard) >\n          // explicit redirectUrl (static app default) > config default.\n          // hardPush = full page load so every context reinitializes cleanly.\n          const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;\n          if (saved) redirectManager.clearRedirect();\n          const finalRedirectUrl = saved || redirectUrl || routesRef.current.defaultCallback;\n          authLogger.info('Redirecting after auth to:', finalRedirectUrl);\n          router.hardPush(finalRedirectUrl);\n        }\n\n        return {\n          success: true,\n          message: 'Login successful',\n          user: result.user as UserProfile,\n          should_prompt_2fa: result.should_prompt_2fa,\n        };\n      } catch (error) {\n        logAuthFailure(authLogger, 'Verify OTP failed:', error);\n        Analytics.event(AnalyticsEvent.AUTH_OTP_VERIFY_FAIL, {\n          category: AnalyticsCategory.AUTH,\n          label: 'email',\n        });\n        if (error instanceof APIError) {\n          return { success: false, message: formatAuthError(error) };\n        }\n        return { success: false, message: formatAuthError(error, 'Failed to verify OTP') };\n      }\n    },\n    [setStoredEmail, redirectManager, router],\n  );\n\n  // ── Password login flow ────────────────────────────────────────────────────\n\n  // Same envelope, same branches and the same single session owner as\n  // verifyOTP — only the credential differs. Anything that diverges here\n  // (a second token store, a bespoke fetch) forks the session.\n  const login = useCallback(\n    async (\n      email: string,\n      password: string,\n      options?: PasswordLoginOptions,\n    ): Promise<PasswordLoginResult> => {\n      const { redirectUrl, skipRedirect } = options || {};\n\n      try {\n        // The caller opting out of redirect commits to handling ALL navigation\n        // for this login — including the 2FA continuation and success screen.\n        pendingManualNavRef.current = Boolean(skipRedirect);\n        authTrace('password.login', { skipRedirect: Boolean(skipRedirect) });\n\n        const result = await accountsRef.current.loginWithPassword({\n          email,\n          password,\n        });\n\n        if (result.requires_2fa && result.session_id) {\n          authLogger.info('2FA required, session:', result.session_id);\n          return {\n            success: true,\n            message: 'Password verified, 2FA required',\n            requires_2fa: true,\n            session_id: result.session_id,\n            should_prompt_2fa: result.should_prompt_2fa,\n          };\n        }\n\n        if (!result.access || !result.refresh) {\n          authLogger.error('Password login returned invalid response:', result);\n          return { success: false, message: 'Invalid login response' };\n        }\n        setStoredEmail(email);\n\n        Analytics.event(AnalyticsEvent.AUTH_LOGIN_SUCCESS, {\n          category: AnalyticsCategory.AUTH,\n          label: 'password',\n        });\n        if (result.user?.id) {\n          Analytics.setUser(String(result.user.id));\n        }\n\n        if (!skipRedirect) {\n          // Priority: saved back-url (per-visit intent from the guard) >\n          // explicit redirectUrl (static app default) > config default.\n          // hardPush = full page load so every context reinitializes cleanly.\n          const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;\n          if (saved) redirectManager.clearRedirect();\n          const finalRedirectUrl = saved || redirectUrl || routesRef.current.defaultCallback;\n          authLogger.info('Redirecting after auth to:', finalRedirectUrl);\n          router.hardPush(finalRedirectUrl);\n        }\n\n        return {\n          success: true,\n          message: 'Login successful',\n          user: result.user as UserProfile,\n          should_prompt_2fa: result.should_prompt_2fa,\n        };\n      } catch (error) {\n        logAuthFailure(authLogger, 'Password login failed:', error);\n        Analytics.event(AnalyticsEvent.AUTH_PASSWORD_LOGIN_FAIL, {\n          category: AnalyticsCategory.AUTH,\n          label: 'password',\n        });\n        if (error instanceof APIError) {\n          // 429 carries `retry_after`; 401 carries only `error_code`. Both are\n          // surfaced so a form can show a countdown instead of a dead message.\n          const body = error.response as\n            | { error_code?: string; retry_after?: number }\n            | undefined;\n          return {\n            success: false,\n            statusCode: error.statusCode,\n            message: formatAuthError(error),\n            errorCode: body?.error_code,\n            retryAfter: typeof body?.retry_after === 'number' ? body.retry_after : undefined,\n          };\n        }\n        return { success: false, message: formatAuthError(error, 'Failed to sign in') };\n      }\n    },\n    [setStoredEmail, redirectManager, router],\n  );\n\n  // ── Session actions ────────────────────────────────────────────────────────\n\n  const refreshToken = useCallback(async (): Promise<{ success: boolean; message: string }> => {\n    // Same single-flight + Web-Locks path as the 401 interceptor — rotation,\n    // dedup and rotated-token persistence come for free.\n    const access = await auth.refreshNow();\n    if (access) {\n      Analytics.event(AnalyticsEvent.AUTH_TOKEN_REFRESH, {\n        category: AnalyticsCategory.AUTH,\n      });\n      return { success: true, message: 'Token refreshed' };\n    }\n    Analytics.event(AnalyticsEvent.AUTH_TOKEN_REFRESH_FAIL, {\n      category: AnalyticsCategory.AUTH,\n    });\n    return { success: false, message: 'Error refreshing token' };\n  }, []);\n\n  const logout = useCallback((): void => {\n    authTrace('logout');\n    Analytics.event(AnalyticsEvent.AUTH_LOGOUT, {\n      category: AnalyticsCategory.AUTH,\n    });\n    accountsRef.current.logout(); // clears session + profile + cache\n    // hardReplace = full reload + history replace, so contexts reinitialize\n    // and Back doesn't return to a protected page.\n    router.hardReplace(routesRef.current.defaultAuthCallback);\n  }, [router]);\n\n  // ── Derived state ──────────────────────────────────────────────────────────\n\n  const user = (accounts.profile as UserProfile | undefined) ?? null;\n  const isAdminUser = Boolean(user?.is_staff || user?.is_superuser);\n\n  // Role-aware console verbosity: admins (and dev) get debug logs, regular\n  // users in production get a clean console.\n  useEffect(() => {\n    applyRoleLogPolicy({ isAdmin: isAdminUser });\n  }, [isAdminUser]);\n\n  const updateProfile = useCallback(\n    async (data: {\n      first_name?: string;\n      last_name?: string;\n      username?: string;\n    }): Promise<UserProfile> => {\n      const result = await accountsRef.current.partialUpdateProfile(data);\n      return result as UserProfile;\n    },\n    [],\n  );\n\n  const uploadAvatar = useCallback(async (avatar: File | Blob): Promise<UserProfile> => {\n    const result = await accountsRef.current.uploadAvatar(avatar);\n    return result as UserProfile;\n  }, []);\n\n  const value = useMemo<AuthContextType>(\n    () => ({\n      user,\n      isLoading,\n      status,\n      // Reactive: flips via the store snapshot (token writes, refreshes,\n      // expiry timer, cross-tab/cross-store sync) — no ticks, no polling.\n      isAuthenticated,\n      isAdminUser,\n      routes,\n      loadCurrentProfile,\n      checkAuthAndRedirect,\n      getToken: () => auth.getToken(),\n      getRefreshToken: () => auth.getRefreshToken(),\n      getSavedEmail: () => storedEmail,\n      saveEmail: setStoredEmail,\n      clearSavedEmail: clearStoredEmail,\n      requestOTP,\n      verifyOTP,\n      login,\n      refreshToken,\n      logout,\n      saveRedirectUrl: redirectManager.setRedirect,\n      getRedirectUrl: redirectManager.getFinalRedirectUrl,\n      clearRedirectUrl: redirectManager.clearRedirect,\n      hasRedirectUrl: redirectManager.hasRedirect,\n      updateProfile,\n      uploadAvatar,\n    }),\n    [\n      user,\n      isLoading,\n      status,\n      isAuthenticated,\n      isAdminUser,\n      routes,\n      loadCurrentProfile,\n      checkAuthAndRedirect,\n      storedEmail,\n      setStoredEmail,\n      clearStoredEmail,\n      requestOTP,\n      verifyOTP,\n      login,\n      refreshToken,\n      logout,\n      redirectManager,\n      updateProfile,\n      uploadAvatar,\n    ],\n  );\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n};\n\n/**\n * AuthProvider — wraps AccountsProvider + AuthProviderInternal.\n *\n * Memoised: re-renders only when `config` reference or `children` change.\n */\nfunction AuthProviderRaw({ children, config, enabled = true }: AuthProviderProps) {\n  if (!enabled) return <>{children}</>;\n  return (\n    <AccountsProvider>\n      <AuthProviderInternal config={config}>{children}</AuthProviderInternal>\n    </AccountsProvider>\n  );\n}\n\nexport const AuthProvider = memo(AuthProviderRaw);\n\n/**\n * Default auth state for SSR/outside provider.\n * Safe defaults that read as \"not authenticated, not loading\".\n */\nconst defaultAuthState: AuthContextType = {\n  user: null,\n  isLoading: false,\n  status: 'anonymous',\n  isAuthenticated: false,\n  isAdminUser: false,\n  routes: resolveAuthRoutes(),\n  loadCurrentProfile: async () => {\n    authLogger.warn('useAuth: loadCurrentProfile called outside AuthProvider');\n  },\n  checkAuthAndRedirect: async () => {\n    authLogger.warn('useAuth: checkAuthAndRedirect called outside AuthProvider');\n  },\n  getToken: () => null,\n  getRefreshToken: () => null,\n  getSavedEmail: () => null,\n  saveEmail: () => {\n    authLogger.warn('useAuth: saveEmail called outside AuthProvider');\n  },\n  clearSavedEmail: () => {},\n  requestOTP: async () => {\n    authLogger.warn('useAuth: requestOTP called outside AuthProvider');\n    return { success: false, message: 'AuthProvider not available' };\n  },\n  verifyOTP: async () => {\n    authLogger.warn('useAuth: verifyOTP called outside AuthProvider');\n    return { success: false, message: 'AuthProvider not available' };\n  },\n  login: async () => {\n    authLogger.warn('useAuth: login called outside AuthProvider');\n    return { success: false, message: 'AuthProvider not available' };\n  },\n  refreshToken: async () => {\n    authLogger.warn('useAuth: refreshToken called outside AuthProvider');\n    return { success: false, message: 'AuthProvider not available' };\n  },\n  logout: () => {\n    authLogger.warn('useAuth: logout called outside AuthProvider');\n  },\n  saveRedirectUrl: () => {},\n  getRedirectUrl: () => '',\n  clearRedirectUrl: () => {},\n  hasRedirectUrl: () => false,\n  updateProfile: async () => {\n    authLogger.warn('useAuth: updateProfile called outside AuthProvider');\n    return {} as UserProfile;\n  },\n  uploadAvatar: async () => {\n    authLogger.warn('useAuth: uploadAvatar called outside AuthProvider');\n    return {} as UserProfile;\n  },\n};\n\n/**\n * Hook to access auth context.\n *\n * SSR-safe: returns default unauthenticated state when called outside\n * AuthProvider (e.g. during static page generation).\n */\nexport const useAuth = (): AuthContextType => {\n  const context = useContext(AuthContext);\n  if (context === undefined) {\n    if (isBrowser && isDev) {\n      authLogger.debug('useAuth called outside AuthProvider, returning default state');\n    }\n    return defaultAuthState;\n  }\n  return context;\n};\n\nexport default AuthContext;\n","// AUTO-GENERATED by django_generator / ts_extras.wrapper\n// Typed error classes with DRF field-error support.\n// DO NOT EDIT — re-run `make gen`.\n\n/**\n * HTTP API Error with DRF field-specific validation errors.\n */\nexport class APIError extends Error {\n  constructor(\n    public statusCode: number,\n    public statusText: string,\n    public response: any,\n    public url: string,\n    message?: string,\n  ) {\n    super(message || `HTTP ${statusCode}: ${statusText}`);\n    this.name = \"APIError\";\n  }\n\n  get details(): Record<string, any> | null {\n    if (typeof this.response === \"object\" && this.response !== null) {\n      return this.response;\n    }\n    return null;\n  }\n\n  get fieldErrors(): Record<string, string[]> | null {\n    const details = this.details;\n    if (!details) return null;\n    const fieldErrors: Record<string, string[]> = {};\n    for (const [key, value] of Object.entries(details)) {\n      if (Array.isArray(value)) fieldErrors[key] = value;\n    }\n    return Object.keys(fieldErrors).length > 0 ? fieldErrors : null;\n  }\n\n  get errorMessage(): string {\n    const details = this.details;\n    if (!details) return this.message;\n    if (details.detail) {\n      return Array.isArray(details.detail) ? details.detail.join(\", \") : String(details.detail);\n    }\n    if (details.error) return String(details.error);\n    if (details.message) return String(details.message);\n    const fieldErrors = this.fieldErrors;\n    if (fieldErrors) {\n      const firstField = Object.keys(fieldErrors)[0];\n      if (firstField) return `${firstField}: ${fieldErrors[firstField]?.join(\", \")}`;\n    }\n    return this.message;\n  }\n\n  get isValidationError(): boolean { return this.statusCode === 400; }\n  get isAuthError(): boolean { return this.statusCode === 401; }\n  get isPermissionError(): boolean { return this.statusCode === 403; }\n  get isNotFoundError(): boolean { return this.statusCode === 404; }\n  get isServerError(): boolean { return this.statusCode >= 500 && this.statusCode < 600; }\n}\n\n/** Network Error (connection failed, timeout, etc.) */\nexport class NetworkError extends Error {\n  constructor(\n    message: string,\n    public url: string,\n    public originalError?: Error,\n  ) {\n    super(message);\n    this.name = \"NetworkError\";\n  }\n}\n","// AUTO-GENERATED by django_generator / ts_extras.wrapper\n// Browser-storage key registry: one scheme, guarded access.\n// DO NOT EDIT — re-run `make gen`.\n//\n// Rules for agents and apps: @docs/STORAGE_KEYS.md in @djangocfg/api.\n//\n// Scheme: `<owner>.<area>.<name>` — lower case, dots between levels,\n// `snake_case` inside a level. The framework's owner is `cfg`; an app picks its\n// own with `createStorage('<owner>')`. Third-party keys (a library's own\n// prefix, `NEXT_LOCALE`) are not ours to rename and stay as they are.\n\nexport type KeyStore = 'local' | 'session' | 'cookie';\n\nexport interface KeySpec {\n  /** The canonical key. */\n  readonly key: string;\n  readonly store: KeyStore;\n  /** Removed by `clearAll()` (sign-out). Preferences are kept. */\n  readonly personal: boolean;\n}\n\nexport interface FamilySpec {\n  /** Canonical prefix ending in a dot; the id is appended in normalised form. */\n  readonly prefix: string;\n  readonly store: 'local' | 'session';\n  readonly personal: boolean;\n}\n\nconst k = (\n  key: string,\n  store: KeyStore,\n  personal: boolean,\n): KeySpec => ({ key, store, personal });\n\nconst f = (\n  prefix: string,\n  store: 'local' | 'session',\n  personal: boolean,\n): FamilySpec => ({ prefix, store, personal });\n\n/** Every key the framework writes. No legacy spellings are read: old keys are simply ignored. */\nexport const CFG_KEYS = {\n  accessToken: k('cfg.auth.access_token', 'cookie', true),\n  refreshToken: k('cfg.auth.refresh_token', 'cookie', true),\n  apiKey: k('cfg.auth.api_key', 'local', true),\n  email: k('cfg.auth.email', 'local', false),\n  emailTs: k('cfg.auth.email_ts', 'local', false),\n  redirectUrl: k('cfg.auth.redirect_url', 'session', true),\n  redirectUrlTs: k('cfg.auth.redirect_url_ts', 'session', true),\n  oauthState: k('cfg.auth.oauth_state', 'session', true),\n  oauthProvider: k('cfg.auth.oauth_provider', 'session', true),\n  oauthProviders: k('cfg.auth.oauth_providers', 'session', false),\n  profileCache: k('cfg.profile.cache', 'local', true),\n  monitorSessionId: k('cfg.monitor.session_id', 'local', false),\n  monitorSessionCookie: k('cfg.monitor.session_id', 'cookie', false),\n  monitorDebug: k('cfg.monitor.debug', 'local', false),\n  uiTabId: k('cfg.ui.tab_id', 'session', false),\n  uiRouterSerial: k('cfg.ui.router_serial', 'session', false),\n  uiState: k('cfg.ui.state', 'local', false),\n  chatSpeechLanguage: k('cfg.chat.speech_language', 'local', false),\n  chatRecentTools: k('cfg.chat.recent_tools', 'local', false),\n  formsSpeechDebug: k('cfg.forms.speech_debug', 'local', false),\n  formsSpeechPrefs: k('cfg.forms.speech_prefs', 'local', false),\n  agentPlaygroundApiKeyId: k('cfg.agent.playground_api_key_id', 'session', true),\n  agentPlaygroundBearer: k('cfg.agent.playground_bearer', 'session', true),\n  agentEndpointDoc: k('cfg.agent.endpoint_doc', 'session', false),\n} as const satisfies Record<string, KeySpec>;\n\n/** Keys with a caller-supplied id part: one per room, tree, endpoint. */\nexport const CFG_FAMILIES = {\n  chatDraft: f('cfg.chat.draft.', 'session', true),\n  dataTree: f('cfg.data.tree.', 'local', false),\n  agentEndpointDraft: f('cfg.agent.endpoint_draft.', 'local', false),\n} as const satisfies Record<string, FamilySpec>;\n\nconst OWNER_RE = /^[a-z][a-z0-9_]*$/;\n\n/** One segment of a key: lower case, `[a-z0-9_]`, anything else folded to `_`. */\nexport function normalizeSegment(raw: string): string {\n  return raw\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9_]+/g, '_')\n    .replace(/^_+|_+$/g, '');\n}\n\nexport interface StorageOptions {\n  /** Named keys of this owner. */\n  readonly keys?: Readonly<Record<string, KeySpec>>;\n  readonly families?: Readonly<Record<string, FamilySpec>>;\n  /** Cookie lifetime for the `cookie` store. Default 30 days. */\n  readonly cookieMaxAgeSeconds?: number;\n  /**\n   * Cookie `Domain`. `'auto'` (default): the registrable domain of the page, so every subdomain\n   * shares the cookie (`example.com` for `my.example.com`). A string forces a domain; `false`\n   * keeps cookies host-only.\n   */\n  readonly cookieDomain?: 'auto' | string | false;\n}\n\nexport interface WriteOptions {\n  /** Cookie store: lifetime of this write. Default: the owner's `cookieMaxAgeSeconds`. */\n  readonly maxAgeSeconds?: number;\n}\n\nexport interface GuardedStorage {\n  readonly owner: string;\n  /** Builds `<owner>.<part>.<part>` from free-form parts; throws if a part is empty. */\n  key(...parts: string[]): string;\n  /** Builds a family member key: the prefix plus the normalised id. */\n  familyKey(family: FamilySpec, id: string): string;\n  /** `^(cfg|<owner>)(\\.[a-z0-9_]+)+$`. */\n  isValid(key: string): boolean;\n  read(key: string, store?: KeyStore): string | null;\n  /** True when the value reached the browser's storage; false means it is held in memory for this page only. */\n  write(key: string, value: string, store?: KeyStore, options?: WriteOptions): boolean;\n  /** Removes the key. */\n  remove(key: string, store?: KeyStore): void;\n  readJSON<T>(key: string, store?: KeyStore): T | null;\n  writeJSON(key: string, value: unknown, store?: KeyStore): boolean;\n  /** Keys this owner holds in `store`. */\n  keys(store?: Exclude<KeyStore, 'cookie'>): string[];\n  /** Sign-out: removes the `personal` keys. `{ all: true }` removes everything under this owner. */\n  clearAll(options?: { all?: boolean }): void;\n  /** Cookie store: change the `Domain` policy (`'auto'`, a domain, or `false` for host-only cookies). */\n  setCookieDomain(domain: 'auto' | string | false): void;\n  /** The `Domain` cookies are written with right now; `null` means host-only. */\n  cookieDomain(): string | null;\n  /** Cross-tab: calls `listener` with the new value when ANOTHER tab changes `key`. Cookies fire no events. */\n  onChange(key: string, listener: (value: string | null) => void, store?: Exclude<KeyStore, 'cookie'>): () => void;\n}\n\nconst hasWindow = () => typeof window !== 'undefined';\n\nconst domainByHost = new Map<string, string | null>();\n\n/**\n * The broadest domain this page may set cookies on (`example.com` for `my.example.com`,\n * `example.co.uk` for `a.example.co.uk`), found by asking the browser: it refuses a cookie for a\n * public suffix, so no suffix list lives in our code. `null` for an IP, `localhost`, a single label\n * or when cookies are blocked (the cookie is then host-only).\n */\nfunction detectCookieDomain(): string | null {\n  if (!hasWindow() || typeof document === 'undefined') return null;\n  const host = window.location.hostname.toLowerCase();\n  if (!host || !host.includes('.') || host.includes(':') || /^[0-9.]+$/.test(host)) return null;\n  const cached = domainByHost.get(host);\n  if (cached !== undefined) return cached;\n  const labels = host.split('.');\n  const secure = window.location.protocol === 'https:' ? '; Secure' : '';\n  let found: string | null = null;\n  try {\n    for (let i = labels.length - 2; i >= 0 && found === null; i -= 1) {\n      const candidate = labels.slice(i).join('.');\n      const probe = 'cfg_probe_' + Math.random().toString(36).slice(2);\n      document.cookie = probe + '=1; Domain=' + candidate + '; Path=/; Max-Age=30; SameSite=Lax' + secure;\n      if (document.cookie.includes(probe + '=1')) found = candidate;\n      document.cookie = probe + '=; Domain=' + candidate + '; Path=/; Max-Age=0; SameSite=Lax' + secure;\n    }\n  } catch {\n    found = null;\n  }\n  domainByHost.set(host, found);\n  return found;\n}\n\nfunction nativeStorage(store: 'local' | 'session'): Storage | null {\n  if (!hasWindow()) return null;\n  try {\n    return store === 'session' ? window.sessionStorage : window.localStorage;\n  } catch {\n    return null;\n  }\n}\n\nfunction cookieNames(): string[] {\n  if (!hasWindow()) return [];\n  try {\n    return document.cookie\n      .split('; ')\n      .map((part) => decodeURIComponent(part.split('=')[0] ?? ''))\n      .filter(Boolean);\n  } catch {\n    return [];\n  }\n}\n\nexport function createStorage(owner: string, options: StorageOptions = {}): GuardedStorage {\n  if (!OWNER_RE.test(owner)) {\n    throw new TypeError(`createStorage: owner \"${owner}\" must match ${OWNER_RE}`);\n  }\n  const prefix = `${owner}.`;\n  const pattern = owner === 'cfg' ? /^cfg(\\.[a-z0-9_]+)+$/ : new RegExp(`^(cfg|${owner})(\\\\.[a-z0-9_]+)+$`);\n  const cookieMaxAge = options.cookieMaxAgeSeconds ?? 60 * 60 * 24 * 30;\n  let cookiePolicy: 'auto' | string | false = options.cookieDomain ?? 'auto';\n  const resolveCookieDomain = (): string | null =>\n    cookiePolicy === false ? null : cookiePolicy === 'auto' ? detectCookieDomain() : cookiePolicy;\n  // A cookie is identified by name AND Domain: expire the twin without a domain and the one with it.\n  const expireCookie = (key: string, domain: string | null) => {\n    const secure = window.location.protocol === 'https:' ? '; Secure' : '';\n    document.cookie =\n      encodeURIComponent(key) + '=; Path=/; Max-Age=0; SameSite=Lax' + (domain ? '; Domain=' + domain : '') + secure;\n  };\n  const specs = Object.values(options.keys ?? {});\n  const families = Object.values(options.families ?? {});\n  const specByKey = new Map<string, KeySpec[]>();\n  for (const spec of specs) specByKey.set(spec.key, [...(specByKey.get(spec.key) ?? []), spec]);\n  // Held in memory when the browser refuses a write (quota, private mode), so the page still works until reload.\n  const memory: Record<KeyStore, Map<string, string>> = {\n    local: new Map(),\n    session: new Map(),\n    cookie: new Map(),\n  };\n\n  const isValid = (key: string) => pattern.test(key);\n  const assertValid = (key: string) => {\n    if (!isValid(key)) throw new TypeError(`storage key \"${key}\" must match ${pattern}`);\n  };\n  const assertOwned = (key: string) => {\n    assertValid(key);\n    if (!key.startsWith(prefix)) throw new TypeError(`storage key \"${key}\" is not owned by \"${owner}\"`);\n  };\n\n  function rawGet(store: KeyStore, key: string): string | null {\n    if (!hasWindow()) return null;\n    if (store === 'cookie') {\n      try {\n        const escaped = encodeURIComponent(key).replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n        const match = document.cookie.match(new RegExp(`(?:^|;\\\\s*)${escaped}=([^;]*)`));\n        if (match?.[1] !== undefined) return decodeURIComponent(match[1]);\n      } catch {\n        /* fall through to memory */\n      }\n      return memory.cookie.get(key) ?? null;\n    }\n    try {\n      const value = nativeStorage(store)?.getItem(key) ?? null;\n      if (value !== null) return value;\n    } catch {\n      /* fall through to memory */\n    }\n    return memory[store].get(key) ?? null;\n  }\n\n  function rawSet(store: KeyStore, key: string, value: string, maxAgeSeconds?: number): boolean {\n    if (!hasWindow()) return false;\n    try {\n      if (store === 'cookie') {\n        const secure = window.location.protocol === 'https:' ? '; Secure' : '';\n        const domain = resolveCookieDomain();\n        const domainPart = domain ? `; Domain=${domain}` : '';\n        document.cookie = `${encodeURIComponent(key)}=${encodeURIComponent(value)}; Path=/; Max-Age=${Math.max(1, Math.floor(maxAgeSeconds ?? cookieMaxAge))}; SameSite=Lax${domainPart}${secure}`;\n        // A host-only cookie written earlier would shadow the shared one: drop that twin.\n        if (domain) expireCookie(key, null);\n        if (rawGet('cookie', key) === value && !memory.cookie.has(key)) return true;\n        memory.cookie.set(key, value);\n        return false;\n      }\n      const native = nativeStorage(store);\n      if (!native) throw new Error('storage unavailable');\n      native.setItem(key, value);\n      memory[store].delete(key);\n      return true;\n    } catch {\n      memory[store].set(key, value);\n      return false;\n    }\n  }\n\n  function rawRemove(store: KeyStore, key: string): void {\n    memory[store].delete(key);\n    if (!hasWindow()) return;\n    try {\n      if (store === 'cookie') {\n        expireCookie(key, null);\n        const domain = resolveCookieDomain();\n        if (domain) expireCookie(key, domain);\n      } else {\n        nativeStorage(store)?.removeItem(key);\n      }\n    } catch {\n      /* ignore */\n    }\n  }\n\n  function resolveStore(key: string, store?: KeyStore): KeyStore {\n    return store ?? specByKey.get(key)?.[0]?.store ?? 'local';\n  }\n\n  function listKeys(store: 'local' | 'session', startsWith: string): string[] {\n    const out: string[] = [];\n    try {\n      const native = nativeStorage(store);\n      if (native) {\n        for (let i = 0; i < native.length; i += 1) {\n          const name = native.key(i);\n          if (name?.startsWith(startsWith)) out.push(name);\n        }\n      }\n    } catch {\n      /* ignore */\n    }\n    for (const name of memory[store].keys()) if (name.startsWith(startsWith) && !out.includes(name)) out.push(name);\n    return out;\n  }\n\n  const familyKey = (family: FamilySpec, id: string) => {\n    const part = normalizeSegment(id);\n    if (!part) throw new TypeError('storage family id is empty after normalisation');\n    return family.prefix + part;\n  };\n\n  const api: GuardedStorage = {\n    owner,\n    key(...parts) {\n      const segments = parts.map(normalizeSegment);\n      if (segments.length === 0 || segments.some((segment) => !segment)) {\n        throw new TypeError(`storage key parts must be non-empty: ${JSON.stringify(parts)}`);\n      }\n      return `${prefix}${segments.join('.')}`;\n    },\n    familyKey,\n    isValid,\n    read(key, store) {\n      assertValid(key);\n      const target = resolveStore(key, store);\n      return rawGet(target, key);\n    },\n    write(key, value, store, writeOptions) {\n      assertOwned(key);\n      const target = resolveStore(key, store);\n      return rawSet(target, key, value, writeOptions?.maxAgeSeconds);\n    },\n    remove(key, store) {\n      assertOwned(key);\n      const target = resolveStore(key, store);\n      rawRemove(target, key);\n    },\n    readJSON<T>(key: string, store?: KeyStore): T | null {\n      const raw = api.read(key, store);\n      if (raw === null) return null;\n      try {\n        return JSON.parse(raw) as T;\n      } catch {\n        return null;\n      }\n    },\n    writeJSON(key, value, store) {\n      return api.write(key, JSON.stringify(value), store);\n    },\n    keys(store = 'local') {\n      return listKeys(store, prefix);\n    },\n    clearAll({ all = false } = {}) {\n      for (const spec of specs) {\n        if (!all && !spec.personal) continue;\n        rawRemove(spec.store, spec.key);\n      }\n      for (const family of families) {\n        if (!all && !family.personal) continue;\n        for (const name of listKeys(family.store, family.prefix)) rawRemove(family.store, name);\n      }\n      if (all) {\n        for (const store of ['local', 'session'] as const) {\n          for (const name of listKeys(store, prefix)) rawRemove(store, name);\n        }\n        for (const name of cookieNames()) if (name.startsWith(prefix)) rawRemove('cookie', name);\n      }\n    },\n    setCookieDomain(domain) {\n      cookiePolicy = domain;\n    },\n    cookieDomain: resolveCookieDomain,\n    onChange(key, listener, store = 'local') {\n      assertValid(key);\n      if (!hasWindow()) return () => {};\n      const handler = (event: StorageEvent) => {\n        if (event.storageArea !== nativeStorage(store)) return;\n        if (event.key === null || event.key === key) listener(event.key === null ? null : event.newValue);\n      };\n      window.addEventListener('storage', handler);\n      return () => window.removeEventListener('storage', handler);\n    },\n  };\n  return api;\n}\n\n/** The framework's own storage: every `cfg.*` key. */\nexport const cfgStorage: GuardedStorage = createStorage('cfg', {\n  keys: CFG_KEYS,\n  families: CFG_FAMILIES,\n});\n\n","// AUTO-GENERATED by django_generator / ts_extras.wrapper\n// Global auth store. Wired into the shared `client` from `client.gen.ts`\n// via `installAuthOnClient(client)` — called synchronously by the\n// post-processed bottom of client.gen.ts. No circular import here.\n// DO NOT EDIT — re-run `make gen`.\n\nimport { APIError } from './errors';\nimport { cfgStorage, createStorage, type KeyStore } from './keys';\n\nconst ACCESS_KEY = 'cfg.auth.access_token';\nconst REFRESH_KEY = 'cfg.auth.refresh_token';\nconst API_KEY_KEY = 'cfg.auth.api_key';\n\n// The framework's own keys use the shared registry; a custom owner gets the same guarded helpers.\nconst storage = 'cfg' === 'cfg' ? cfgStorage : createStorage('cfg');\n\nconst isBrowser = typeof window !== 'undefined';\n\n/**\n * Auth trace hook. The reader lives in `@djangocfg/api` (`auth/trace.ts`) and installs `globalThis.__cfgAuthTrace`;\n * until it does, events queue on `globalThis` so none are lost. Never pass a token, a code or an address.\n */\ntype TraceFields = Record<string, string | number | boolean | null>;\nfunction trace(ev: string, fields?: TraceFields): void {\n  try {\n    const g = globalThis as Record<string, unknown>;\n    const sink = g.__cfgAuthTrace as ((e: string, f?: TraceFields) => void) | undefined;\n    if (sink) { sink(ev, fields); return; }\n    const queue = (g.__cfgAuthTraceQ as unknown[] | undefined) ?? [];\n    g.__cfgAuthTraceQ = queue;\n    if (queue.length < 100) queue.push([Date.now(), ev, fields]);\n  } catch { /* tracing never breaks auth */ }\n}\nfunction pathOf(url: string): string {\n  try { return new URL(url, 'http://x').pathname; } catch { return ''; }\n}\n\nexport type StorageMode = 'localStorage' | 'sessionStorage' | 'cookie';\n\n// ── Storage backends (browser-only; server-side reads return null) ─────────\n\ninterface KVStore {\n  get(key: string): string | null;\n  set(key: string, value: string | null): void;\n}\n\n/** Seconds until a JWT's `exp`, for the cookie lifetime; undefined when it has none. */\nfunction secondsUntilExp(token: string): number | undefined {\n  const exp = jwtExpMs(token);\n  return exp === null ? undefined : Math.max(1, Math.floor((exp - Date.now()) / 1000));\n}\n\n// Every read and write goes through the registry's guarded storage: SSR-safe,\n// private-mode and quota safe, and a key written under an older spelling is\n// moved to its `cfg.auth.*` name on first read.\nconst STORE_OF: Record<StorageMode, KeyStore> = {\n  localStorage: 'local',\n  sessionStorage: 'session',\n  cookie: 'cookie',\n};\n\nfunction backendFor(mode: StorageMode): KVStore {\n  const store = STORE_OF[mode];\n  return {\n    get: (key) => storage.read(key, store),\n    set(key, value) {\n      if (value === null) storage.remove(key, store);\n      // The refresh cookie lives as long as the refresh token; everything else takes the default.\n      else storage.write(key, value, store, store === 'cookie' && key === REFRESH_KEY ? { maxAgeSeconds: secondsUntilExp(value) } : undefined);\n    },\n  };\n}\n\n/**\n * The session backend: a cookie shared by every subdomain of the registrable\n * domain (`Domain=example.com`, found by asking the browser), so signing in on\n * `my.example.com` signs in `example.com` and `studio.example.com`, and so\n * Next.js `cookies()` can read the token during SSR. Django never reads this\n * cookie (the API authenticates the `Authorization` header), so it is no CSRF\n * surface.\n *\n * `setStorageMode('localStorage')` opts a host out, once at bootstrap. It is NOT\n * a per-login switch: this value lives in module memory and\n * resets to the default on every page load, so tokens written to a non-default\n * backend after startup would be stranded — present in the browser, invisible\n * to the client, and every request would go out unauthenticated.\n *\n * Session LENGTH is therefore not a client concern. The server decides it when\n * minting the refresh token; the client just stores whatever it\n * was given, in one place.\n */\nlet _storageMode: StorageMode = 'cookie';\nlet _storage: KVStore = backendFor(_storageMode);\n// The API key is per browser, not per domain family: always localStorage.\nconst _apiKeyStore: KVStore = backendFor('localStorage');\n\n/** One-time move of a session an older build kept in localStorage into the shared cookie. */\nfunction adoptLegacySession(): void {\n  if (!isBrowser || _storageMode !== 'cookie') return;\n  try {\n    if (_storage.get(ACCESS_KEY) !== null || _storage.get(REFRESH_KEY) !== null) return;\n    const legacy = backendFor('localStorage');\n    const access = legacy.get(ACCESS_KEY);\n    const refresh = legacy.get(REFRESH_KEY);\n    if (access === null && refresh === null) return;\n    if (access !== null) _storage.set(ACCESS_KEY, access);\n    if (refresh !== null) _storage.set(REFRESH_KEY, refresh);\n    legacy.set(ACCESS_KEY, null);\n    legacy.set(REFRESH_KEY, null);\n  } catch {}\n}\nadoptLegacySession();\n\n/** Detect locale from `NEXT_LOCALE` cookie or `navigator.language`. */\nfunction detectLocale(): string | null {\n  try {\n    // BROWSER ONLY, and `document` is what decides that.\n    //\n    // `navigator` used to be the browser test and no longer is: Node 18+\n    // defines `navigator.language`, so on a server this returned the HOST's\n    // locale — `en-US` on most machines — and every server-rendered request\n    // carried `Accept-Language: en-US` no matter which locale the page was\n    // being rendered for. A valid header stating the wrong thing, which is\n    // worse than none: nothing looks broken.\n    //\n    // A server caller that knows its locale passes it explicitly with\n    // `setLocale()`. There is nothing here to detect it FROM — the request is\n    // the framework's, not this module's.\n    if (typeof document === 'undefined') return null;\n\n    const m = document.cookie.match(/(?:^|;\\s*)NEXT_LOCALE=([^;]*)/);\n    const locale = m?.[1];\n    if (locale !== undefined) return decodeURIComponent(locale);\n\n    if (typeof navigator !== 'undefined' && navigator.language) {\n      return navigator.language;\n    }\n  } catch {}\n  return null;\n}\n\n/** Default baseUrl.\n *\n * Browser: uses NEXT_PUBLIC_API_PROXY_URL if set (empty string = same-origin\n * Next.js proxy), otherwise falls back to NEXT_PUBLIC_API_URL directly.\n * Set NEXT_PUBLIC_API_PROXY_URL='' in apps that proxy /apix/* via Next.js\n * Route Handler; leave it unset in apps that hit Django directly.\n *\n * Server (SSR / RSC / Edge): use NEXT_PUBLIC_API_URL so server-side fetch\n * reaches Django directly (proxy is a same-origin HTTP round-trip on server).\n */\nfunction defaultBaseUrl(): string {\n  if (typeof window !== 'undefined') {\n    try {\n      if (typeof process !== 'undefined' && process.env) {\n        if (process.env.NEXT_PUBLIC_STATIC_BUILD === 'true') return '';\n        // NEXT_PUBLIC_API_PROXY_URL='' means same-origin proxy (e.g. /apix/* route handler).\n        // Next.js inlines defined vars as their value; undefined means the var was not set.\n        if (process.env.NEXT_PUBLIC_API_PROXY_URL !== undefined)\n          return process.env.NEXT_PUBLIC_API_PROXY_URL;\n        return process.env.NEXT_PUBLIC_API_URL || '';\n      }\n    } catch {}\n    return '';\n  }\n  try {\n    if (typeof process !== 'undefined' && process.env) {\n      if (process.env.NEXT_PUBLIC_STATIC_BUILD === 'true') return '';\n      return process.env.NEXT_PUBLIC_API_URL || '';\n    }\n  } catch {}\n  return '';\n}\n\n/** The browser's IANA zone; null where Intl cannot tell (e.g. a bare server runtime). */\nfunction detectTimezone(): string | null {\n  try {\n    return Intl.DateTimeFormat().resolvedOptions().timeZone || null;\n  } catch {\n    return null;\n  }\n}\n\n/** Default API key fallback from `NEXT_PUBLIC_API_KEY`.\n *\n * Both browser and server: if NEXT_PUBLIC_API_KEY is set it is used as a\n * global fallback (e.g. a public demo key). When not set, returns null so\n * per-request keys passed via options.headers take effect unobstructed.\n */\nfunction defaultApiKey(): string | null {\n  try {\n    if (typeof process !== 'undefined' && process.env?.NEXT_PUBLIC_API_KEY) {\n      return process.env.NEXT_PUBLIC_API_KEY;\n    }\n  } catch {}\n  return null;\n}\n\n// ── In-memory overrides (win over storage / env) ───────────────────────────\nlet _localeOverride: string | null = null;\nlet _timezoneOverride: string | null = null;\nlet _apiKeyOverride: string | null = null;\nlet _baseUrlOverride: string | null = null;\nlet _withCredentials = true;\nlet _onUnauthorized: ((response: Response) => void) | null = null;\n\n/**\n * User-supplied refresh handler. Receives the current refresh token,\n * must return a fresh access (and optional refresh) pair or null on failure.\n * Set once at app bootstrap via `auth.setRefreshHandler(...)`.\n */\ntype RefreshResult = { access: string; refresh?: string } | null;\ntype RefreshHandler = (refreshToken: string) => Promise<RefreshResult>;\nlet _refreshHandler: RefreshHandler | null = null;\n\n/** Single-flight: every concurrent 401 awaits the same refresh. */\nlet _refreshInflight: Promise<string | null> | null = null;\n\n/** Marker header — set on retried requests so we never loop on 401. */\nconst RETRY_MARKER = 'X-Auth-Retry';\n\n// ── Reactive session snapshot ───────────────────────────────────────────────\n//\n// The store is the single source of truth for \"am I logged in\". React (or any\n// listener) subscribes via `auth.subscribe` + `auth.getSnapshot` — designed to\n// plug straight into `useSyncExternalStore`. The snapshot flips automatically\n// on: token writes, refresh success/failure, cross-tab storage events, and an\n// internal timer armed to the next JWT `exp` boundary.\n\nexport type SessionStatus = 'authenticated' | 'anonymous';\n\nexport type SessionSnapshot = {\n  /** 'authenticated' = a live access token OR a live refresh token exists. */\n  status: SessionStatus;\n  /** ms-epoch expiry of the current access token (null: no token / no exp). */\n  accessExpiresAt: number | null;\n};\n\n/** Decode a JWT `exp` claim to ms epoch. Null on any malformed input. */\nfunction jwtExpMs(token: string): number | null {\n  try {\n    const payload = token.split('.')[1];\n    if (!payload) return null;\n    const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));\n    return typeof json.exp === 'number' ? json.exp * 1000 : null;\n  } catch { return null; }\n}\n\nfunction computeSnapshot(): SessionSnapshot {\n  const access = _storage.get(ACCESS_KEY);\n  const refresh = _storage.get(REFRESH_KEY);\n  const now = Date.now();\n  const accessExp = access ? jwtExpMs(access) : null;\n  const accessAlive = access !== null && (accessExp === null || accessExp > now);\n  const refreshExp = refresh ? jwtExpMs(refresh) : null;\n  const refreshAlive = refresh !== null && (refreshExp === null || refreshExp > now);\n  return {\n    status: accessAlive || refreshAlive ? 'authenticated' : 'anonymous',\n    accessExpiresAt: accessExp,\n  };\n}\n\n/** Stable object for SSR — `useSyncExternalStore` needs referential equality. */\nconst SERVER_SNAPSHOT: SessionSnapshot = { status: 'anonymous', accessExpiresAt: null };\n\n/** Same-tab, cross-store sync channel. An app can host several copies of this\n * generated store (separate JS modules) sharing the same storage keys; the\n * `storage` event only fires in OTHER tabs, so a window event bridges them\n * synchronously within the tab (login in one store flips all of them). */\nconst SESSION_SYNC_EVENT = `cfg-auth:changed:${ACCESS_KEY}`;\n\nlet _snapshot: SessionSnapshot = computeSnapshot();\nconst _sessionListeners = new Set<() => void>();\nlet _expiryTimer: ReturnType<typeof setTimeout> | null = null;\nlet _storageListenerInstalled = false;\n\n/** Re-arm the timer that flips the snapshot exactly when a token expires. */\nfunction scheduleExpiryFlip(): void {\n  if (!isBrowser) return;\n  if (_expiryTimer !== null) { clearTimeout(_expiryTimer); _expiryTimer = null; }\n  if (_sessionListeners.size === 0) return;\n  const now = Date.now();\n  const exps: number[] = [];\n  const access = _storage.get(ACCESS_KEY);\n  const refresh = _storage.get(REFRESH_KEY);\n  const accessExp = access ? jwtExpMs(access) : null;\n  const refreshExp = refresh ? jwtExpMs(refresh) : null;\n  if (accessExp !== null && accessExp > now) exps.push(accessExp);\n  if (refreshExp !== null && refreshExp > now) exps.push(refreshExp);\n  if (!exps.length) return;\n  // +250ms grace so the token is REALLY expired when we flip; clamp to the\n  // max signed-32-bit setTimeout delay (~24.8 days).\n  const delay = Math.min(Math.min(...exps) - now + 250, 0x7fffffff);\n  _expiryTimer = setTimeout(notifySessionChanged, delay);\n}\n\n/** Recompute the snapshot; notify subscribers only when it actually changed. */\nfunction notifySessionChanged(): void {\n  const next = computeSnapshot();\n  const changed =\n    next.status !== _snapshot.status ||\n    next.accessExpiresAt !== _snapshot.accessExpiresAt;\n  if (changed) { _snapshot = next; trace('store.snapshot', { status: next.status }); }\n  scheduleExpiryFlip();\n  if (!changed) return;\n  for (const listener of Array.from(_sessionListeners)) {\n    try { listener(); } catch {}\n  }\n  // Wake sibling stores in this tab. Re-entrant but convergent: a store that\n  // recomputes to the SAME snapshot doesn't re-dispatch, so the cascade stops\n  // after every store has caught up.\n  if (isBrowser) {\n    try { window.dispatchEvent(new Event(SESSION_SYNC_EVENT)); } catch {}\n  }\n}\n\n/** Cross-tab + cross-store sync — `storage` events only fire in OTHER tabs;\n * the window event covers sibling stores in THIS tab. Either way a login or\n * logout anywhere flips every snapshot reading the same keys. */\nfunction ensureStorageSync(): void {\n  if (!isBrowser || _storageListenerInstalled) return;\n  _storageListenerInstalled = true;\n  window.addEventListener('storage', (e) => {\n    if (e.key === null || e.key === ACCESS_KEY || e.key === REFRESH_KEY) {\n      notifySessionChanged();\n    }\n  });\n  window.addEventListener(SESSION_SYNC_EVENT, () => notifySessionChanged());\n  // Cookies fire no `storage` event: a sign-in or sign-out on another subdomain is\n  // picked up when this page is looked at again (or at once where `cookieStore` exists).\n  window.addEventListener('focus', () => notifySessionChanged());\n  document.addEventListener('visibilitychange', () => {\n    if (document.visibilityState === 'visible') notifySessionChanged();\n  });\n  try {\n    (window as unknown as { cookieStore?: EventTarget }).cookieStore?.addEventListener('change', () => notifySessionChanged());\n  } catch {}\n}\n\n/**\n * Terminal-401 subscribers. Unlike the single `onUnauthorized` slot these\n * compose: each registration returns its own unsubscribe, so StrictMode\n * double-mounts and multiple packages can't clobber each other.\n *\n * THE SET LIVES ON `globalThis`, and it has to.\n *\n * An app that generates its own SDK gets its own compiled copy of this file,\n * while `AuthProvider` comes from `@djangocfg/api/dist` — a second copy, with\n * its own module scope. Tokens survive that split because both copies read the\n * same storage keys and wake each other through `SESSION_SYNC_EVENT`; a plain\n * module-level `Set` does not. So the app's copy raised the terminal 401 into\n * an empty set while the provider sat subscribed to the other one, and the\n * redirect `AuthContext` calls \"the ONE exit\" never fired: the cabinet kept\n * polling a dead session and the customer watched the console fill with 401s\n * instead of being sent to sign in. Carapis reported ten of them.\n *\n * Keyed by `ACCESS_KEY` for the same reason `SESSION_SYNC_EVENT` is: two\n * stores configured against different token keys are different sessions and\n * must not share subscribers.\n */\ntype SessionExpiredHandler = (response: Response) => void;\n\nconst SESSION_EXPIRED_REGISTRY = `cfg-auth:expired-handlers:${ACCESS_KEY}`;\n\nconst _sessionExpiredHandlers: Set<SessionExpiredHandler> = (() => {\n  // No browser guard: Node/SSR has a `globalThis` too, the registry is\n  // per-realm either way, and a server render simply never fires.\n  const g = globalThis as Record<string, unknown>;\n  const existing = g[SESSION_EXPIRED_REGISTRY];\n  if (existing instanceof Set) return existing as Set<SessionExpiredHandler>;\n  const created = new Set<SessionExpiredHandler>();\n  g[SESSION_EXPIRED_REGISTRY] = created;\n  return created;\n})();\n\n/**\n * Captured reference to the shared Hey API client. Set exactly once by\n * `installAuthOnClient(client)` (called from client.gen.ts). All `auth.set*`\n * methods that mutate transport config (baseUrl / credentials) push through\n * this reference. Until installed, those mutations are silently buffered as\n * in-memory state — the next request after install will pick them up.\n */\ntype HeyClient = {\n  setConfig(opts: Record<string, unknown>): void;\n  interceptors: {\n    request: { use(fn: (req: Request) => Request | Promise<Request>): void };\n    response: { use(fn: (res: Response, req: Request) => Response | Promise<Response>): void };\n    error: { use(fn: (err: unknown, res: Response | undefined, req: Request | undefined, opts: unknown) => unknown): void };\n  };\n};\nlet _client: HeyClient | null = null;\n\nfunction pushClientConfig(): void {\n  if (!_client) return;\n  _client.setConfig({\n    baseUrl: auth.getBaseUrl(),\n    credentials: _withCredentials ? 'include' : 'same-origin',\n  });\n}\n\n/**\n * Global auth/config store. All getters read live state every call —\n * the interceptor below uses these to attach headers per-request.\n *\n * Default storage backend is `localStorage`. Switch to cookies (e.g.\n * for Next.js SSR cookie access) via `auth.setStorageMode('cookie')`\n * early in the app bootstrap.\n *\n * @example\n *   import { auth } from '@your/api';\n *   auth.setToken(jwt);\n *   auth.clearTokens();\n *   auth.setStorageMode('cookie');\n */\nexport const auth = {\n  // ── Storage mode ──────────────────────────────────────────────────\n  getStorageMode(): StorageMode { return _storageMode; },\n  /** Relocate the session backend. Call once at bootstrap, before any sign-in:\n   *  the mode is module state and resets on reload, so a later switch strands\n   *  whatever was written after it. */\n  setStorageMode(mode: StorageMode): void {\n    _storageMode = mode;\n    _storage = backendFor(mode);\n    notifySessionChanged();\n  },\n\n  // ── Shared cookie domain ──────────────────────────────────────────\n  /** `'auto'` (default): the registrable domain of the page. A domain forces it; `null` keeps\n   *  cookies host-only (no sign-in sharing between subdomains). Call before sign-in. */\n  setCookieDomain(domain: 'auto' | string | null): void {\n    storage.setCookieDomain(domain === null ? false : domain);\n    notifySessionChanged();\n  },\n  /** The `Domain` the session cookie is written with; `null` = host-only. */\n  getCookieDomain(): string | null { return storage.cookieDomain(); },\n\n  // ── Bearer token ──────────────────────────────────────────────────\n  getToken(): string | null { return _storage.get(ACCESS_KEY); },\n  setToken(token: string | null): void {\n    trace('store.setToken', { present: token !== null });\n    _storage.set(ACCESS_KEY, token);\n    notifySessionChanged();\n  },\n  getRefreshToken(): string | null { return _storage.get(REFRESH_KEY); },\n  setRefreshToken(token: string | null): void {\n    trace('store.setRefreshToken', { present: token !== null });\n    _storage.set(REFRESH_KEY, token);\n    notifySessionChanged();\n  },\n  clearTokens(): void {\n    trace('store.clearTokens');\n    // Clear every backend, not just the active one. Sign-out must leave nothing\n    // behind anywhere — including tokens an older build stranded in\n    // sessionStorage — or the next page load could resurrect a dead session.\n    for (const mode of ['localStorage', 'sessionStorage', 'cookie'] as const) {\n      const backend = backendFor(mode);\n      backend.set(ACCESS_KEY, null);\n      backend.set(REFRESH_KEY, null);\n    }\n    // The rest of the signed-in user's keys (profile cache, OAuth leftovers) go with the tokens.\n    storage.clearAll();\n    notifySessionChanged();\n  },\n  /** Session-aware: token PRESENT and not past its `exp` (or a live refresh\n   * token exists that can mint one). Prefer `getSnapshot().status` in React. */\n  isAuthenticated(): boolean { return computeSnapshot().status === 'authenticated'; },\n\n  // ── Session (the ONE write path for login/logout flows) ──────────\n  /**\n   * Persist a token pair atomically. Every login flow (OTP verify, 2FA,\n   * OAuth callback) and the refresh handler should end here — do NOT\n   * scatter `setToken`/`setRefreshToken` pairs through app code.\n   * `refresh: undefined` keeps the current refresh token (access-only\n   * rotation); `refresh: null` explicitly drops it.\n   */\n  setSession(tokens: { access: string; refresh?: string | null }): void {\n    trace('store.setSession', { refresh: tokens.refresh === undefined ? 'kept' : tokens.refresh === null ? 'dropped' : 'set' });\n    _storage.set(ACCESS_KEY, tokens.access);\n    if (tokens.refresh !== undefined) _storage.set(REFRESH_KEY, tokens.refresh);\n    notifySessionChanged();\n  },\n  clearSession(): void { auth.clearTokens(); },\n\n  // ── Reactive snapshot (for useSyncExternalStore) ──────────────────\n  /**\n   * @example React:\n   *   const session = useSyncExternalStore(\n   *     auth.subscribe, auth.getSnapshot, auth.getServerSnapshot,\n   *   );\n   *   const isAuthenticated = session.status === 'authenticated';\n   */\n  getSnapshot(): SessionSnapshot { return _snapshot; },\n  getServerSnapshot(): SessionSnapshot { return SERVER_SNAPSHOT; },\n  subscribe(listener: () => void): () => void {\n    ensureStorageSync();\n    _sessionListeners.add(listener);\n    // Sync state & arm the expiry timer now that someone is listening.\n    notifySessionChanged();\n    return () => {\n      _sessionListeners.delete(listener);\n      if (_sessionListeners.size === 0 && _expiryTimer !== null) {\n        clearTimeout(_expiryTimer);\n        _expiryTimer = null;\n      }\n    };\n  },\n\n  /**\n   * Fired on TERMINAL 401 — after the refresh+retry path is exhausted.\n   * The store has already cleared the session before calling back, so\n   * handlers only need to route to login (no clear-then-redirect\n   * ordering to get wrong). Returns an unsubscribe function; multiple\n   * handlers compose (unlike the legacy single-slot `onUnauthorized`).\n   */\n  onSessionExpired(cb: SessionExpiredHandler): () => void {\n    _sessionExpiredHandlers.add(cb);\n    return () => { _sessionExpiredHandlers.delete(cb); };\n  },\n\n  // ── API key ───────────────────────────────────────────────────────\n  getApiKey(): string | null {\n    return _apiKeyOverride ?? _apiKeyStore.get(API_KEY_KEY) ?? defaultApiKey();\n  },\n  setApiKey(key: string | null): void { _apiKeyOverride = key; },\n  setApiKeyPersist(key: string | null): void {\n    _apiKeyOverride = key;\n    _apiKeyStore.set(API_KEY_KEY, key);\n  },\n  clearApiKey(): void { _apiKeyOverride = null; _apiKeyStore.set(API_KEY_KEY, null); },\n\n  // ── Locale ────────────────────────────────────────────────────────\n  getLocale(): string | null { return _localeOverride ?? detectLocale(); },\n  setLocale(locale: string | null): void { _localeOverride = locale; },\n\n  // ── Time zone ─────────────────────────────────────────────────────\n  // IANA name sent as `X-Timezone`. `null` override = follow the browser.\n  getTimezone(): string | null { return _timezoneOverride ?? detectTimezone(); },\n  setTimezone(timezone: string | null): void { _timezoneOverride = timezone; },\n\n  // ── Base URL ──────────────────────────────────────────────────────\n  getBaseUrl(): string {\n    const url = (_baseUrlOverride ?? defaultBaseUrl());\n    return url.replace(/\\/$/, '');\n  },\n  setBaseUrl(url: string | null): void {\n    _baseUrlOverride = url ? url.replace(/\\/$/, '') : null;\n    pushClientConfig();\n  },\n\n  // ── Credentials toggle ────────────────────────────────────────────\n  getWithCredentials(): boolean { return _withCredentials; },\n  setWithCredentials(value: boolean): void {\n    _withCredentials = value;\n    pushClientConfig();\n  },\n\n  // ── 401 handler ───────────────────────────────────────────────────\n  /**\n   * Fired when the server returns 401 AND no refresh path recovers it\n   * (no refresh token, no refresh handler, refresh failed, or retry\n   * still 401). The app should clear local state and redirect to login.\n   *\n   * NOT fired for 401 that gets transparently recovered by the refresh\n   * handler — those are invisible to callers.\n   */\n  onUnauthorized(cb: ((response: Response) => void) | null): void {\n    _onUnauthorized = cb;\n  },\n\n  /**\n   * Register the refresh strategy. The handler receives the current\n   * refresh token and must call your refresh endpoint, returning\n   * `{ access, refresh? }` on success or `null` on failure.\n   *\n   * @example\n   *   auth.setRefreshHandler(async (refresh) => {\n   *     const { data } = await Auth.tokenRefreshCreate({ body: { refresh } });\n   *     return data ? { access: data.access, refresh: data.refresh } : null;\n   *   });\n   */\n  setRefreshHandler(fn: RefreshHandler | null): void {\n    _refreshHandler = fn;\n  },\n\n  /**\n   * Proactively run the registered refresh handler right now, reusing the\n   * SAME single-flight promise as the 401-recovery interceptor. Callers\n   * (e.g. an expiry timer / focus / reconnect) get token rotation,\n   * de-duplication and rotated-token persistence for free — they must NOT\n   * re-implement any of it. Returns the fresh access token, or null if\n   * there is no handler / no refresh token / the refresh failed.\n   */\n  refreshNow(): Promise<string | null> {\n    return tryRefresh();\n  },\n};\n\n/**\n * Run the user-supplied refresh handler, persist the rotated tokens, and\n * return the fresh access token (or null on any failure path).\n *\n * TWO layers of coordination, because a single app can host MULTIPLE copies of\n * this generated store (e.g. `@djangocfg/api` + a locally-generated client +\n * `@djangocfg/monitor`), all sharing the SAME refresh token in storage:\n *\n *   1. Per-store single-flight (`_refreshInflight`) — concurrent 401s WITHIN\n *      this module coalesce onto one promise. Fast path, no lock.\n *   2. Cross-store mutex (`navigator.locks`) keyed on the refresh-token storage\n *      key — serializes refreshes across EVERY store in the app. The refresh\n *      token is re-read INSIDE the lock, so if another store already rotated it\n *      (SimpleJWT `ROTATE_REFRESH_TOKENS` blacklists the old one), the loser\n *      picks up the fresh access token instead of re-POSTing a blacklisted\n *      refresh token and getting a spurious 401 → logout.\n *\n * Web Locks is browser-only; on SSR / older runtimes we degrade gracefully to\n * layer 1 alone (correct whenever at most one store refreshes).\n */\nasync function tryRefresh(): Promise<string | null> {\n  if (_refreshInflight) return _refreshInflight;\n  if (!_refreshHandler) return null;\n\n  // The critical section — re-reads the refresh token every time it runs, so a\n  // rotation performed by another store (or by us on a prior attempt) is always\n  // observed. Returns the fresh access token, or null on any failure.\n  const runRefresh = async (): Promise<string | null> => {\n    const refresh = auth.getRefreshToken();\n    if (!refresh) return null;\n    const result = await _refreshHandler!(refresh);\n    if (!result?.access) { trace('refresh', { ok: false, why: 'no-access' }); return null; }\n    trace('refresh', { ok: true, rotated: Boolean(result.refresh) });\n    auth.setToken(result.access);\n    if (result.refresh) auth.setRefreshToken(result.refresh);\n    return result.access;\n  };\n\n  _refreshInflight = (async () => {\n    try {\n      // Serialize across all stores in this app when Web Locks is available.\n      const locks =\n        typeof navigator !== 'undefined'\n          ? (navigator as Navigator & { locks?: LockManager }).locks\n          : undefined;\n      if (locks?.request) {\n        return await locks.request(`${REFRESH_KEY}:refresh`, runRefresh);\n      }\n      return await runRefresh();\n    } catch {\n      trace('refresh', { ok: false, why: 'threw' });\n      return null;\n    } finally {\n      _refreshInflight = null;\n    }\n  })();\n\n  return _refreshInflight;\n}\n\n/**\n * Terminal 401 — no refresh path can recover this session. The store clears\n * its own tokens FIRST (subscribers flip to 'anonymous' via the snapshot),\n * then notifies `onSessionExpired` subscribers and the legacy\n * `onUnauthorized` slot. Apps only route to login; they never own the\n * clear-before-redirect ordering.\n */\nfunction expireSession(response: Response, why: string): void {\n  trace('store.expire', { why, status: response.status, path: pathOf(response.url), handlers: _sessionExpiredHandlers.size });\n  auth.clearTokens();\n  for (const cb of Array.from(_sessionExpiredHandlers)) {\n    try { cb(response); } catch {}\n  }\n  if (_onUnauthorized) {\n    try { _onUnauthorized(response); } catch {}\n  }\n}\n\n/**\n * Wire the shared client to the global auth store. Called exactly\n * once from `client.gen.ts` (post-processed) right after\n * `createClient()`. Synchronous — no microtask, no TDZ races.\n *\n * Safe to call from server / SSR: storage backends short-circuit on\n * non-browser environments, so headers populated by the interceptor\n * are simply absent server-side (which is the correct behaviour\n * unless the caller explicitly sets a server-side token).\n *\n * ── How API key auth works ────────────────────────────────────────────────\n *\n * There are three ways to supply X-API-Key, in priority order:\n *\n *   1. Per-request header (highest priority, overrides everything):\n *        SomeApi.someEndpoint({ headers: { 'X-API-Key': userKey } })\n *      Use this in playgrounds or any context where the key comes from\n *      user input rather than app config.\n *\n *   2. Global override via auth.setApiKey(key) — applies to every request\n *      from this client until cleared. Good for single-user sessions.\n *\n *   3. NEXT_PUBLIC_API_KEY env var — read by defaultApiKey() on every request.\n *      Use as a public fallback key (e.g. a shared demo key for unauthenticated\n *      visitors). When not set, returns null so per-request keys work freely.\n *\n * ── baseUrl gotcha with proxy packages ───────────────────────────────────\n *\n * If another package (e.g. @carapis/catalog-api/client) calls\n * `auth.setBaseUrl('')` on import, ALL requests from this shared client\n * will go to relative paths (Next.js proxy) instead of hitting Django\n * directly. This is intentional for the public catalog — but breaks any\n * feature that needs to reach Django with a dynamic API key from the\n * browser (e.g. a playground).\n *\n * Fix: pass `baseUrl` explicitly per-call to override the global setting:\n *   SomeApi.someEndpoint({\n *     baseUrl: process.env.NEXT_PUBLIC_API_URL,\n *     headers: { 'X-API-Key': userKey },\n *   })\n */\n// ── DPoP (RFC 9449) — sender-constrained tokens ────────────────────────────\n//\n// When NEXT_PUBLIC_DPOP_ENABLED === 'true', the client holds a P-256 keypair\n// whose PRIVATE key is non-extractable (Web Crypto `extractable:false`) and\n// stored in IndexedDB. JS — including XSS — can sign with it but can NEVER read\n// it. Each request carries a fresh `DPoP` proof signed by that key; the backend\n// binds the token to the key (`cnf.jkt`) and rejects any request whose proof key\n// doesn't match. A stolen token is therefore useless to an attacker.\n//\n// Dormant unless the env flag is on — bearer-mode apps are unaffected.\n\nfunction dpopEnabled(): boolean {\n  try {\n    return typeof process !== 'undefined'\n      && process.env?.NEXT_PUBLIC_DPOP_ENABLED === 'true';\n  } catch { return false; }\n}\n\nconst _DPOP_DB = 'cfg.auth.dpop';\nconst _DPOP_STORE = 'keys';\nconst _DPOP_KEY_ID = 'dpop-ec-p256';\n\nfunction _idbOpen(): Promise<IDBDatabase> {\n  return new Promise((resolve, reject) => {\n    const req = indexedDB.open(_DPOP_DB, 1);\n    req.onupgradeneeded = () => req.result.createObjectStore(_DPOP_STORE);\n    req.onsuccess = () => resolve(req.result);\n    req.onerror = () => reject(req.error);\n  });\n}\n\nfunction _idbGet(key: string): Promise<CryptoKeyPair | undefined> {\n  return _idbOpen().then((db) => new Promise((resolve, reject) => {\n    const tx = db.transaction(_DPOP_STORE, 'readonly');\n    const req = tx.objectStore(_DPOP_STORE).get(key);\n    req.onsuccess = () => resolve(req.result);\n    req.onerror = () => reject(req.error);\n  }));\n}\n\nfunction _idbPut(key: string, value: CryptoKeyPair): Promise<void> {\n  return _idbOpen().then((db) => new Promise((resolve, reject) => {\n    const tx = db.transaction(_DPOP_STORE, 'readwrite');\n    tx.objectStore(_DPOP_STORE).put(value, key);\n    tx.oncomplete = () => resolve();\n    tx.onerror = () => reject(tx.error);\n  }));\n}\n\n/** Single-flight keypair init — the private key is created non-extractable. */\nlet _dpopKeyPromise: Promise<CryptoKeyPair> | null = null;\n\nfunction _getDpopKeyPair(): Promise<CryptoKeyPair> {\n  if (_dpopKeyPromise) return _dpopKeyPromise;\n  _dpopKeyPromise = (async () => {\n    const existing = await _idbGet(_DPOP_KEY_ID).catch(() => undefined);\n    if (existing) return existing;\n    const pair = await crypto.subtle.generateKey(\n      { name: 'ECDSA', namedCurve: 'P-256' },\n      false, // extractable:false — JS can sign but never export the private key\n      ['sign'],\n    );\n    // CryptoKey is structured-cloneable; IndexedDB persists it across reloads\n    // WITHOUT ever exposing raw key bytes to JS.\n    await _idbPut(_DPOP_KEY_ID, pair).catch(() => {});\n    return pair;\n  })();\n  return _dpopKeyPromise;\n}\n\nfunction _b64urlFromBytes(bytes: ArrayBuffer | Uint8Array): string {\n  const arr = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);\n  let s = '';\n  for (let i = 0; i < arr.length; i++) s += String.fromCharCode(arr[i] ?? 0);\n  return btoa(s).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\nfunction _b64urlFromString(str: string): string {\n  return _b64urlFromBytes(new TextEncoder().encode(str));\n}\n\n/** ECDSA raw signature (r||s) → JOSE base64url (Web Crypto already returns raw). */\nasync function _publicJwk(pub: CryptoKey): Promise<Record<string, string>> {\n  const jwk = await crypto.subtle.exportKey('jwk', pub);\n  // Public components only — required RFC 7638 members for EC.\n  return { kty: 'EC', crv: 'P-256', x: jwk.x as string, y: jwk.y as string };\n}\n\n/** Build a DPoP proof JWT for this request (htm/htu/iat/jti), signed in-key. */\nasync function _makeDpopProof(method: string, url: string): Promise<string | null> {\n  try {\n    const pair = await _getDpopKeyPair();\n    const jwk = await _publicJwk(pair.publicKey);\n    const header = { typ: 'dpop+jwt', alg: 'ES256', jwk };\n    // htu = scheme://authority/path without query/fragment.\n    const withoutFragment = url.split('#')[0] ?? url;\n    const htu = withoutFragment.split('?')[0] ?? withoutFragment;\n    const jti =\n      (crypto.randomUUID && crypto.randomUUID()) ||\n      _b64urlFromBytes(crypto.getRandomValues(new Uint8Array(16)));\n    const payload = { htm: method.toUpperCase(), htu, iat: Math.floor(Date.now() / 1000), jti };\n    const signingInput =\n      `${_b64urlFromString(JSON.stringify(header))}.${_b64urlFromString(JSON.stringify(payload))}`;\n    const sig = await crypto.subtle.sign(\n      { name: 'ECDSA', hash: 'SHA-256' },\n      pair.privateKey,\n      new TextEncoder().encode(signingInput),\n    );\n    return `${signingInput}.${_b64urlFromBytes(sig)}`;\n  } catch {\n    return null; // never break a request because proof generation failed\n  }\n}\n\nexport function installAuthOnClient(client: HeyClient): void {\n  if (_client) return; // idempotent\n  _client = client;\n\n  client.setConfig({\n    baseUrl: auth.getBaseUrl(),\n    credentials: _withCredentials ? 'include' : 'same-origin',\n  });\n\n  client.interceptors.request.use(async (request) => {\n    const token = auth.getToken();\n    if (token) request.headers.set('Authorization', `Bearer ${token}`);\n\n    const locale = auth.getLocale();\n    if (locale) request.headers.set('Accept-Language', locale);\n\n    // Only set X-API-Key from global store if NOT already present on the\n    // request — per-request headers take precedence.\n    const apiKey = auth.getApiKey();\n    if (apiKey && !request.headers.has('X-API-Key')) request.headers.set('X-API-Key', apiKey);\n\n    const tz = auth.getTimezone();\n    if (tz) request.headers.set('X-Timezone', tz);\n    request.headers.set('X-Client-Time', new Date().toISOString());\n\n    // DPoP proof — sign a fresh per-request proof with the non-extractable key.\n    // Only in a browser, only when enabled. Failure is non-fatal (proof null).\n    if (dpopEnabled() && typeof window !== 'undefined') {\n      const proof = await _makeDpopProof(request.method, request.url);\n      if (proof) request.headers.set('DPoP', proof);\n    }\n\n    return request;\n  });\n\n  client.interceptors.error.use((err, res, req) => {\n    if (err instanceof APIError) return err;\n    const url = (req as Request | undefined)?.url ?? '';\n    const status = (res as Response | undefined)?.status ?? 0;\n    const statusText = (res as Response | undefined)?.statusText ?? '';\n    return new APIError(status, statusText, err, url);\n  });\n\n\n  client.interceptors.response.use(async (response, request) => {\n    if (response.status !== 401) return response;\n\n    // A refusal from the sign-in endpoints themselves (wrong OTP / password, bad OAuth code) is a credential error, not\n    // a dead session: expiring here reloads the sign-in page and wipes the error the user is reading.\n    if (/\\/accounts\\/(otp|oauth|login|register|token)\\b/.test(request.url)) {\n      trace('401.passthrough', { path: pathOf(request.url) });\n      return response;\n    }\n\n    // Already retried once — give up to avoid loops.\n    if (request.headers.get(RETRY_MARKER)) {\n      expireSession(response, 'retry-marker');\n      return response;\n    }\n\n    const newToken = await tryRefresh();\n    if (!newToken) {\n      expireSession(response, 'refresh-failed');\n      return response;\n    }\n\n    // Retry the original request once with the new token. We mutate a\n    // clone so the original Request body (already consumed by the\n    // failed call) doesn't trip \"body already used\".\n    const retry = request.clone();\n    retry.headers.set('Authorization', `Bearer ${newToken}`);\n    retry.headers.set(RETRY_MARKER, '1');\n    // This retry uses raw fetch() and bypasses the request interceptor, so the\n    // DPoP proof must be re-attached here or a bound token would 401 on retry.\n    if (dpopEnabled() && typeof window !== 'undefined') {\n      const proof = await _makeDpopProof(retry.method, retry.url);\n      if (proof) retry.headers.set('DPoP', proof);\n    }\n    try {\n      const retried = await fetch(retry);\n      if (retried.status === 401) expireSession(retried, 'retry-401');\n      return retried;\n    } catch {\n      // Network error on the retry. The refresh SUCCEEDED (we hold a fresh\n      // token), so the session is alive — a transient network blip must NOT\n      // log the user out. Surface the original 401 to the caller only.\n      return response;\n    }\n  });\n}\n\n// ── Default refresh handler (auto-registered) ──────────────────────────────\n//\n// POSTs straight to the SimpleJWT refresh endpoint so a 401 transparently\n// refreshes and retries. Registered at import time; an app can override it\n// afterwards with `auth.setRefreshHandler(...)` (last write wins). Returns the\n// ROTATED refresh token so the store persists it — `ROTATE_REFRESH_TOKENS`\n// blacklists the old one, so reusing it would 401 on the next refresh.\n//\n// Raw fetch, NOT the SDK: the endpoint exists on the server even when this\n// target's sliced SDK doesn't include the accounts group, and importing\n// sdk.gen here would close the cycle auth.ts → sdk.gen → client.gen → auth.ts.\nconst REFRESH_ENDPOINT = '/cfg/accounts/token/refresh/';\n\nauth.setRefreshHandler(async (refresh) => {\n  try {\n    const url = `${auth.getBaseUrl()}${REFRESH_ENDPOINT}`;\n    const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n    // Bound tokens (`cnf.jkt`) require a DPoP proof on the refresh call too.\n    if (dpopEnabled() && typeof window !== 'undefined') {\n      const proof = await _makeDpopProof('POST', url);\n      if (proof) headers['DPoP'] = proof;\n    }\n    const res = await fetch(url, {\n      method: 'POST',\n      headers,\n      credentials: auth.getWithCredentials() ? 'include' : 'same-origin',\n      body: JSON.stringify({ refresh }),\n    });\n    if (!res.ok) return null;\n    const data = (await res.json()) as { access?: string; refresh?: string } | null;\n    return data?.access\n      ? { access: data.access, refresh: data.refresh ?? refresh }\n      : null;\n  } catch {\n    return null;\n  }\n});\n\nexport type Auth = typeof auth;\n","// AUTO-GENERATED by django_generator / ts_extras.wrapper\n// API logger built on consola. Optional dependency — install if you enable logging:\n//   npm install consola\n// DO NOT EDIT — re-run `make gen`.\n\nimport { type ConsolaInstance, createConsola } from \"consola\";\n\nexport interface RequestLog {\n  method: string;\n  url: string;\n  headers?: Record<string, string>;\n  body?: any;\n  timestamp: number;\n}\n\nexport interface ResponseLog {\n  status: number;\n  statusText: string;\n  data?: any;\n  duration: number;\n  timestamp: number;\n}\n\nexport interface ErrorLog {\n  message: string;\n  statusCode?: number;\n  fieldErrors?: Record<string, string[]>;\n  duration: number;\n  timestamp: number;\n}\n\nexport interface LoggerConfig {\n  enabled: boolean;\n  logRequests: boolean;\n  logResponses: boolean;\n  logErrors: boolean;\n  logBodies: boolean;\n  logHeaders: boolean;\n  consola?: ConsolaInstance;\n}\n\nconst DEFAULT_CONFIG: LoggerConfig = {\n  enabled: typeof process !== \"undefined\" && process.env?.NODE_ENV !== \"production\",\n  logRequests: true,\n  logResponses: true,\n  logErrors: true,\n  logBodies: true,\n  logHeaders: false,\n};\n\nconst SENSITIVE_HEADERS = [\n  \"authorization\",\n  \"cookie\",\n  \"set-cookie\",\n  \"x-api-key\",\n  \"x-csrf-token\",\n];\n\nexport class APILogger {\n  private config: LoggerConfig;\n  private consola: ConsolaInstance;\n\n  constructor(config: Partial<LoggerConfig> = {}) {\n    this.config = { ...DEFAULT_CONFIG, ...config };\n    this.consola = config.consola || createConsola({\n      level: this.config.enabled ? 4 : 0,\n    });\n  }\n\n  enable(): void { this.config.enabled = true; }\n  disable(): void { this.config.enabled = false; }\n  setConfig(config: Partial<LoggerConfig>): void {\n    this.config = { ...this.config, ...config };\n  }\n\n  private filterHeaders(headers?: Record<string, string>): Record<string, string> {\n    if (!headers) return {};\n    const filtered: Record<string, string> = {};\n    Object.keys(headers).forEach((key) => {\n      filtered[key] = SENSITIVE_HEADERS.includes(key.toLowerCase()) ? \"***\" : (headers[key] || \"\");\n    });\n    return filtered;\n  }\n\n  logRequest(request: RequestLog): void {\n    if (!this.config.enabled || !this.config.logRequests) return;\n    const { method, url, headers, body } = request;\n    this.consola.start(`${method} ${url}`);\n    if (this.config.logHeaders && headers) this.consola.debug(\"Headers:\", this.filterHeaders(headers));\n    if (this.config.logBodies && body) this.consola.debug(\"Body:\", body);\n  }\n\n  logResponse(request: RequestLog, response: ResponseLog): void {\n    if (!this.config.enabled || !this.config.logResponses) return;\n    const { method, url } = request;\n    const { status, statusText, data, duration } = response;\n    this.consola.success(`${method} ${url} ${status} ${statusText} (${duration}ms)`);\n    if (this.config.logBodies && data) this.consola.debug(\"Response:\", data);\n  }\n\n  logError(request: RequestLog, error: ErrorLog): void {\n    if (!this.config.enabled || !this.config.logErrors) return;\n    const { method, url } = request;\n    const { message, statusCode, fieldErrors, duration } = error;\n    this.consola.error(`${method} ${url} ${statusCode || \"Network\"} Error (${duration}ms)`);\n    this.consola.error(\"Message:\", message);\n    if (fieldErrors && Object.keys(fieldErrors).length > 0) {\n      this.consola.error(\"Field Errors:\");\n      Object.entries(fieldErrors).forEach(([field, errors]) => {\n        errors.forEach((err) => this.consola.error(`  • ${field}: ${err}`));\n      });\n    }\n  }\n\n  info(message: string, ...args: any[]): void { if (this.config.enabled) this.consola.info(message, ...args); }\n  warn(message: string, ...args: any[]): void { if (this.config.enabled) this.consola.warn(message, ...args); }\n  error(message: string, ...args: any[]): void { if (this.config.enabled) this.consola.error(message, ...args); }\n  debug(message: string, ...args: any[]): void { if (this.config.enabled) this.consola.debug(message, ...args); }\n  success(message: string, ...args: any[]): void { if (this.config.enabled) this.consola.success(message, ...args); }\n  withTag(tag: string): ConsolaInstance { return this.consola.withTag(tag); }\n}\n\nexport const defaultLogger = new APILogger();\n","export const isDev = process.env.NODE_ENV === 'development';\nexport const isProd = !isDev;\nexport const isBrowser = typeof window !== 'undefined';\n\n/**\n * Next.js static-export build (`output: 'export'`). Loggers treat it like dev\n * for visibility; some auth/SSR features behave differently under it.\n */\nexport const isStaticBuild = process.env.NEXT_PUBLIC_STATIC_BUILD === 'true';\n\n/**\n * DPoP (RFC 9449) sender-constrained tokens are enabled for this app.\n *\n * Set by `createBaseNextConfig({ dpop: true })` (inlines\n * `NEXT_PUBLIC_DPOP_ENABLED='true'`). When true: tokens are bound to a\n * non-extractable in-browser key, a copied Bearer token can't be replayed, and\n * the API client signs a per-request DPoP proof. This flag lives in\n * `@djangocfg/api` — the package that implements DPoP — so it is the single\n * source of truth, importable by every higher-level package.\n */\nexport const dpopEnabled = process.env.NEXT_PUBLIC_DPOP_ENABLED === 'true';\n","/**\n * Global runtime log-level control.\n *\n * One mutable level that every `@djangocfg/*` consola wrapper reads, so the\n * whole app's console verbosity can be changed at runtime (e.g. raised for an\n * admin, kept silent for a regular user in production) WITHOUT each package\n * hardcoding `isDev ? 4 : 1`.\n *\n * Lives in `@djangocfg/api` because it's the lowest shared package — api,\n * layouts, ui-core consumers can all import it without a cycle.\n *\n * consola levels: 0 silent · 1 error · 2 warn · 3 info · 4 debug · 5 trace.\n *\n * Default policy (before anyone calls setLogLevel):\n *   - dev / static build → 4 (debug)\n *   - production         → 1 (errors only)\n * App bootstrap should call `applyRoleLogPolicy({ isAdmin, isDev })` once auth\n * is known to raise verbosity for staff/superusers even in production.\n */\n\nimport { isDev, isStaticBuild } from './auth/utils/env';\n\nexport type ConsolaLevel = 0 | 1 | 2 | 3 | 4 | 5;\n\n/** Dev or a static export → show verbose logs by default. */\nconst verboseByDefault = isDev || isStaticBuild;\n\nconst DEFAULT_LEVEL: ConsolaLevel = verboseByDefault ? 4 : 1;\n\nlet _level: ConsolaLevel = DEFAULT_LEVEL;\n\n/** Subscribers (the wrapper loggers) notified when the level changes. */\nconst _subscribers = new Set<(level: ConsolaLevel) => void>();\n\n/** Current global log level. Wrappers read this when constructing/refreshing. */\nexport function getLogLevel(): ConsolaLevel {\n  return _level;\n}\n\n/** Set the global log level and notify all live loggers. */\nexport function setLogLevel(level: ConsolaLevel): void {\n  _level = level;\n  for (const fn of _subscribers) {\n    try {\n      fn(level);\n    } catch {\n      /* a bad subscriber must not break logging */\n    }\n  }\n}\n\n/**\n * Subscribe to level changes. Returns an unsubscribe fn. The callback fires\n * immediately with the current level so a logger can sync on registration.\n */\nexport function onLogLevelChange(fn: (level: ConsolaLevel) => void): () => void {\n  _subscribers.add(fn);\n  try {\n    fn(_level);\n  } catch {\n    /* ignore */\n  }\n  return () => _subscribers.delete(fn);\n}\n\n/**\n * Apply the role-aware policy. Call once at bootstrap and whenever auth changes.\n *\n *   - admin (is_staff / is_superuser): full verbosity (debug) everywhere, even\n *     in production — so support/devs can diagnose live without a redeploy.\n *   - dev (non-admin): debug.\n *   - production regular user: errors only — a clean console, like big SaaS apps.\n */\nexport function applyRoleLogPolicy(opts: { isAdmin: boolean; isDev?: boolean }): void {\n  const devMode = opts.isDev ?? verboseByDefault;\n  if (opts.isAdmin || devMode) {\n    setLogLevel(4);\n  } else {\n    setLogLevel(1);\n  }\n}\n","'use client';\n\n/**\n * useSession — reactive session snapshot from the generated auth store.\n *\n * The ONE way to answer \"am I logged in\" in React. The store owns the\n * semantics (JWT `exp`-aware, refresh-token-aware) and pushes changes on\n * token writes, refresh success/failure, expiry (internal timer), and\n * cross-tab / cross-store sync. No polling, no ticks.\n */\n\nimport { useSyncExternalStore } from 'react';\n\nimport { auth } from '../../_api/generated/helpers/auth';\n\nimport type { SessionSnapshot, SessionStatus } from '../../_api/generated/helpers/auth';\n\nexport type { SessionSnapshot, SessionStatus };\n\nexport function useSession(): SessionSnapshot {\n  return useSyncExternalStore(auth.subscribe, auth.getSnapshot, auth.getServerSnapshot);\n}\n","'use client';\n\nimport { useCallback, useSyncExternalStore } from 'react';\n\nimport { auth } from '../../_api/generated/helpers/auth';\n\n/**\n * Time zone preference. The choice lives on the device (localStorage) and is\n * pushed into the generated auth store, which sends it as `X-Timezone` on every\n * request; Django's TimezoneMiddleware then activates it and mirrors it onto\n * the profile. `null` = automatic (follow the browser).\n */\nconst STORAGE_KEY = 'djangocfg.timezone';\n\nconst listeners = new Set<() => void>();\n\nfunction read(): string | null {\n  try {\n    return localStorage.getItem(STORAGE_KEY) || null;\n  } catch {\n    return null;\n  }\n}\n\n/** Apply the stored choice to the transport before any request goes out. */\nfunction hydrate(): void {\n  if (typeof window === 'undefined') return;\n  auth.setTimezone(read());\n}\nhydrate();\n\nfunction write(timezone: string | null): void {\n  try {\n    if (timezone) localStorage.setItem(STORAGE_KEY, timezone);\n    else localStorage.removeItem(STORAGE_KEY);\n  } catch {\n    /* storage unavailable — the choice then lasts for this page only */\n  }\n  auth.setTimezone(timezone);\n  listeners.forEach((l) => l());\n}\n\nfunction subscribe(listener: () => void): () => void {\n  listeners.add(listener);\n  return () => listeners.delete(listener);\n}\n\nexport interface UseTimezoneReturn {\n  /** Zone in effect: the explicit choice, else the browser's. `null` only where Intl cannot tell. */\n  timezone: string | null;\n  /** The explicit choice; `null` = automatic. Feed this to `TimezoneSelect`. */\n  preference: string | null;\n  isAuto: boolean;\n  /** Pick a zone, or `null` for automatic. */\n  setTimezone: (timezone: string | null) => void;\n}\n\nexport function useTimezone(): UseTimezoneReturn {\n  const preference = useSyncExternalStore(subscribe, read, () => null);\n  const setTimezone = useCallback((tz: string | null) => write(tz), []);\n  return {\n    timezone: preference ?? auth.getTimezone(),\n    preference,\n    isAuto: preference === null,\n    setTimezone,\n  };\n}\n","/**\n * Universal Router Hook with BasePath Support\n *\n * Wrapper around Next.js useRouter that automatically handles basePath\n * for static builds served via iframe or subdirectory\n * \n * IMPORTANT: In Next.js 15 App Router, router.push() does NOT automatically\n * handle basePath (unlike Pages Router). This is a breaking change in App Router.\n * \n * This hook ensures basePath is always included when navigating, especially\n * important for static exports served via iframe where basePath is critical.\n * \n * @see https://nextjs.org/docs/app/building-your-application/upgrading/app-router-migration\n */\n\n'use client';\n\nimport { useRouter as useNextRouter } from 'next/navigation';\nimport { useCallback, useMemo } from 'react';\n\nimport { authTrace } from '../trace';\n\n/**\n * A hard navigation unloads the page. Once one is in flight, a second one (two 401s, the guard and an effect, a double\n * click) is dropped: the first decides. Reset when the page is restored from the back/forward cache.\n */\nlet hardNavigating = false;\nif (typeof window !== 'undefined') {\n  window.addEventListener('pageshow', (e) => {\n    if (e.persisted) hardNavigating = false;\n  });\n}\n\nfunction fromPath(): string {\n  return typeof window === 'undefined' ? '' : window.location.pathname;\n}\n\n/**\n * Get base path from environment variable\n */\nfunction getBasePath(): string {\n  if (typeof process === 'undefined') {\n    return '';\n  }\n  return process.env.NEXT_PUBLIC_BASE_PATH || '';\n}\n\n/**\n * Add base path to a route path\n */\nfunction withBasePath(path: string, basePath: string): string {\n  if (!basePath) {\n    return path;\n  }\n  // Ensure path starts with /\n  const normalizedPath = path.startsWith('/') ? path : `/${path}`;\n  // Remove trailing slash from basePath\n  const normalizedBasePath = basePath.replace(/\\/$/, '');\n  return `${normalizedBasePath}${normalizedPath}`;\n}\n\n/**\n * Router with basePath support\n *\n * Automatically adds basePath to all navigation methods when basePath is configured.\n * In Next.js 15 App Router, router.push() doesn't handle basePath automatically,\n * so this hook uses window.location to ensure basePath is always included.\n *\n * @example\n * ```tsx\n * const router = useCfgRouter();\n *\n * // With basePath='/cfg/admin':\n * router.push('/dashboard');     // Client-side navigation to '/cfg/admin/dashboard'\n * router.replace('/auth');       // Client-side replace with '/cfg/admin/auth'\n * router.hardPush('/dashboard'); // Full page reload to '/cfg/admin/dashboard'\n * router.hardReplace('/auth');   // Full page replace with '/cfg/admin/auth'\n * ```\n */\nexport function useCfgRouter() {\n  const router = useNextRouter();\n\n  // Get basePath\n  const basePath = useMemo(() => getBasePath(), []);\n\n  const push = useCallback((href: string, options?: { scroll?: boolean }) => {\n    authTrace('nav.push', { from: fromPath(), to: href });\n    if (basePath) {\n      // App Router doesn't handle basePath automatically, use window.location\n      window.location.href = withBasePath(href, basePath);\n    } else {\n      // No basePath configured, use standard router\n      router.push(href, options);\n    }\n  }, [router, basePath]);\n\n  const replace = useCallback((href: string, options?: { scroll?: boolean }) => {\n    authTrace('nav.replace', { from: fromPath(), to: href });\n    if (basePath) {\n      // App Router doesn't handle basePath automatically, use window.location\n      window.location.replace(withBasePath(href, basePath));\n    } else {\n      // No basePath configured, use standard router\n      router.replace(href, options);\n    }\n  }, [router, basePath]);\n\n  /**\n   * Hard push - always uses window.location.href for full page reload\n   *\n   * Use this for auth redirects where React contexts need to reinitialize.\n   * Unlike push(), this ALWAYS triggers a full page reload, ensuring all\n   * contexts are reinitialized with fresh state.\n   *\n   * @example\n   * ```tsx\n   * // After successful login - contexts need to reload with new auth state\n   * router.hardPush('/dashboard');\n   * ```\n   */\n  const hardPush = useCallback((href: string) => {\n    if (hardNavigating) {\n      authTrace('nav.hardPush.ignored', { from: fromPath(), to: href });\n      return;\n    }\n    hardNavigating = true;\n    authTrace('nav.hardPush', { from: fromPath(), to: href });\n    window.location.href = withBasePath(href, basePath);\n  }, [basePath]);\n\n  /**\n   * Hard replace - always uses window.location.replace for full page reload\n   *\n   * Same as hardPush but replaces current history entry.\n   * Use for auth redirects where you don't want back button to return to login.\n   *\n   * @example\n   * ```tsx\n   * // After logout - replace so back button doesn't go to protected page\n   * router.hardReplace('/auth');\n   * ```\n   */\n  const hardReplace = useCallback((href: string) => {\n    if (hardNavigating) {\n      authTrace('nav.hardReplace.ignored', { from: fromPath(), to: href });\n      return;\n    }\n    hardNavigating = true;\n    authTrace('nav.hardReplace', { from: fromPath(), to: href });\n    window.location.replace(withBasePath(href, basePath));\n  }, [basePath]);\n\n  const prefetch = useCallback((href: string) => {\n    // Prefetch doesn't need basePath handling, Next.js handles it\n    router.prefetch(href);\n  }, [router]);\n\n  const back = useCallback(() => {\n    router.back();\n  }, [router]);\n\n  const forward = useCallback(() => {\n    router.forward();\n  }, [router]);\n\n  const refresh = useCallback(() => {\n    router.refresh();\n  }, [router]);\n\n  return {\n    push,\n    replace,\n    hardPush,\n    hardReplace,\n    prefetch,\n    back,\n    forward,\n    refresh,\n  };\n}\n\n","/**\n * useQueryParams Hook\n * \n * Safe hook to access URL query parameters without requiring Suspense boundary.\n * Works on client-side only, returns empty URLSearchParams during SSR/prerendering.\n * \n * @example\n * ```tsx\n * const params = useQueryParams();\n * const flow = params.get('flow');\n * const hasFlow = params.has('flow');\n * const allTags = params.getAll('tags');\n * ```\n */\n\n'use client';\n\nimport { usePathname } from 'next/navigation';\nimport { useEffect, useRef, useState } from 'react';\n\n/**\n * Hook to safely access URL query parameters without useSearchParams()\n * \n * This hook reads query parameters directly from window.location.search,\n * avoiding the need for Suspense boundaries that useSearchParams() requires.\n * \n * Automatically updates when URL changes (navigation, back/forward, etc.)\n * Uses pathname from Next.js to detect route changes and polls for query param changes.\n * \n * Returns a URLSearchParams object with get(), getAll(), has(), etc.\n * \n * @returns URLSearchParams object (empty during SSR)\n */\nexport function useQueryParams(): URLSearchParams {\n  const pathname = usePathname();\n  const [queryParams, setQueryParams] = useState<URLSearchParams>(() => {\n    if (typeof window === 'undefined') {\n      return new URLSearchParams();\n    }\n    return new URLSearchParams(window.location.search);\n  });\n  const lastSearchRef = useRef<string>('');\n\n  useEffect(() => {\n    if (typeof window === 'undefined') return;\n\n    const updateQueryParams = () => {\n      const currentSearch = window.location.search;\n      if (currentSearch !== lastSearchRef.current) {\n        lastSearchRef.current = currentSearch;\n        setQueryParams(new URLSearchParams(currentSearch));\n      }\n    };\n\n    // Sync on mount / pathname change (Next.js navigation).\n    updateQueryParams();\n\n    // back/forward navigation fires popstate natively.\n    window.addEventListener('popstate', updateQueryParams);\n\n    // Next.js router.push/replace updates the URL via history.pushState/replaceState,\n    // which do NOT emit any event. Patch them to notify us, so we react to query-only\n    // changes (same pathname) without polling. This replaces the old setInterval(100ms),\n    // whose churning object reference helped drive the OTP auto-submit loop.\n    const origPush = window.history.pushState;\n    const origReplace = window.history.replaceState;\n    window.history.pushState = function (...args) {\n      const result = origPush.apply(this, args);\n      updateQueryParams();\n      return result;\n    };\n    window.history.replaceState = function (...args) {\n      const result = origReplace.apply(this, args);\n      updateQueryParams();\n      return result;\n    };\n\n    return () => {\n      window.removeEventListener('popstate', updateQueryParams);\n      window.history.pushState = origPush;\n      window.history.replaceState = origReplace;\n    };\n  }, [pathname]);\n\n  return queryParams;\n}\n\n","\"use client\"\n\nimport { useCallback, useEffect, useRef, useState } from 'react';\n\nimport type { AuthFormState, AuthFormStateHandlers, AuthStep, WebmailLink } from '../types';\n\nconst formatCountdown = (s: number): string => {\n  if (s <= 0) return '';\n  const m = Math.floor(s / 60);\n  return m > 0 ? `${m}:${String(s % 60).padStart(2, '0')}` : `${s}s`;\n};\n\nconst useCountdown = () => {\n  const [seconds, setSeconds] = useState(0);\n  const timerRef = useRef<ReturnType<typeof setInterval> | null>(null);\n\n  const start = useCallback((from: number) => {\n    if (timerRef.current) clearInterval(timerRef.current);\n    setSeconds(from);\n    timerRef.current = setInterval(() => {\n      setSeconds((prev) => {\n        if (prev <= 1) {\n          clearInterval(timerRef.current!);\n          timerRef.current = null;\n          return 0;\n        }\n        return prev - 1;\n      });\n    }, 1000);\n  }, []);\n\n  useEffect(() => () => {\n    if (timerRef.current) clearInterval(timerRef.current);\n  }, []);\n\n  return { seconds, start };\n};\n\nexport interface UseAuthFormStateReturn extends AuthFormState, AuthFormStateHandlers {}\n\n/**\n * Hook for auth form state management.\n * Pure state - no side effects, no API calls.\n */\nexport const useAuthFormState = (\n  initialIdentifier = '',\n): UseAuthFormStateReturn => {\n  const [identifier, setIdentifier] = useState(initialIdentifier);\n  const [otp, setOtp] = useState('');\n  const [password, setPassword] = useState('');\n  const [isLoading, setIsLoading] = useState(false);\n  const [acceptedTerms, setAcceptedTerms] = useState(true);\n  // null until the marketing-consent feature (if enabled) resolves its\n  // jurisdiction-aware default — the layout owns that decision.\n  const [marketingConsent, setMarketingConsent] = useState<boolean | null>(null);\n  const [step, setStep] = useState<AuthStep>('identifier');\n  const [error, setError] = useState('');\n  const [webmail, setWebmail] = useState<WebmailLink | null>(null);\n\n  const rateLimit = useCountdown();\n  const resend = useCountdown();\n\n  const clearError = useCallback(() => setError(''), []);\n\n  return {\n    // State\n    identifier,\n    otp,\n    password,\n    isLoading,\n    acceptedTerms,\n    marketingConsent,\n    step,\n    error,\n    rateLimitSeconds: rateLimit.seconds,\n    isRateLimited: rateLimit.seconds > 0,\n    rateLimitLabel: formatCountdown(rateLimit.seconds),\n    resendSeconds: resend.seconds,\n    resendLabel: formatCountdown(resend.seconds),\n    webmail,\n    // Handlers\n    setIdentifier,\n    setOtp,\n    setPassword,\n    setAcceptedTerms,\n    setMarketingConsent,\n    setError,\n    clearError,\n    setStep,\n    setIsLoading,\n    startRateLimitCountdown: rateLimit.start,\n    startResendCountdown: resend.start,\n    setWebmail,\n  };\n};\n","\"use client\"\n\nimport { useCallback } from 'react';\n\nimport type { AuthFormValidation } from '../types';\n\nconst EMAIL_REGEX = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n\nexport const useAuthValidation = (): AuthFormValidation => {\n  const validateIdentifier = useCallback((id: string): boolean => {\n    return EMAIL_REGEX.test(id);\n  }, []);\n\n  return { validateIdentifier };\n};\n\nexport const validateIdentifier = (id: string): boolean => EMAIL_REGEX.test(id);\n","\"use client\"\n\nimport { useCallback, useEffect, useRef } from 'react';\n\nimport { AUTH_CONSTANTS } from '../constants';\nimport { useAuth } from '../context';\nimport { authLogger } from '../utils/logger';\nimport { useAuthFormState } from './useAuthFormState';\nimport { useAuthValidation } from './useAuthValidation';\nimport { useAutoAuth } from './useAutoAuth';\nimport { beginTwoFactorChallenge } from './useTwoFactorChallenge';\n\nimport type { AuthFormReturn, UseAuthFormOptions } from '../types';\n/**\n * Complete auth form hook.\n * Composes smaller hooks for state, validation, and submission.\n */\nexport const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {\n  const {\n    onIdentifierSuccess,\n    onOTPSuccess,\n    onError,\n    sourceUrl,\n    redirectUrl,\n    requireTermsAcceptance = false,\n    marketingConsent: marketingConsentOption,\n    authPath = '/auth',\n  } = options;\n\n  // Compose smaller hooks\n  const formState = useAuthFormState();\n  const validation = useAuthValidation();\n\n  // Ref to track auto-submit from URL\n  const isAutoSubmitFromUrlRef = useRef(false);\n  // Remembers the exact `identifier:otp` we already attempted from a magic-link\n  // URL. We verify a given code at most ONCE — even if it turns out invalid or\n  // expired — so re-renders never re-fire the request. Without this, the auto\n  // submit loops and hammers /verify/ until the backend returns 429.\n  const processedOtpKeyRef = useRef<string | null>(null);\n\n  // Auth context for API calls and storage\n  const {\n    requestOTP,\n    verifyOTP,\n    login,\n    getSavedEmail,\n    saveEmail,\n  } = useAuth();\n\n  // Destructure for convenience\n  const {\n    identifier,\n    otp,\n    password,\n    acceptedTerms,\n    marketingConsent,\n    setIdentifier,\n    setOtp,\n    setStep,\n    setError,\n    setIsLoading,\n    clearError,\n    startRateLimitCountdown,\n    startResendCountdown,\n    setWebmail,\n  } = formState;\n\n  const { validateIdentifier } = validation;\n\n  // ─────────────────────────────────────────────────────────────────────────\n  // Storage Helper\n  // ─────────────────────────────────────────────────────────────────────────\n\n  const saveIdentifierToStorage = useCallback((id: string) => {\n    saveEmail(id);\n  }, [saveEmail]);\n\n  // ─────────────────────────────────────────────────────────────────────────\n  // Effects\n  // ─────────────────────────────────────────────────────────────────────────\n\n  // Load saved identifier on mount\n  useEffect(() => {\n    const savedEmail = getSavedEmail();\n    if (savedEmail) {\n      setIdentifier(savedEmail);\n    }\n  // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, []);\n\n  // ─────────────────────────────────────────────────────────────────────────\n  // Submit Handlers\n  // ─────────────────────────────────────────────────────────────────────────\n\n  const handleIdentifierSubmit = useCallback(async (e: React.FormEvent) => {\n    e.preventDefault();\n\n    if (!identifier) {\n      const msg = 'Please enter your email address';\n      setError(msg);\n      onError?.(msg);\n      return;\n    }\n\n    if (!validateIdentifier(identifier)) {\n      const msg = 'Please enter a valid email address';\n      setError(msg);\n      onError?.(msg);\n      return;\n    }\n\n    if (requireTermsAcceptance && !acceptedTerms) {\n      const msg = 'Please accept the Terms of Service and Privacy Policy';\n      setError(msg);\n      onError?.(msg);\n      return;\n    }\n\n    clearError();\n    setOtp('');\n    setWebmail(null);\n    // Optimistic: the code screen opens now; a failed request rolls back to the identifier step.\n    setStep('otp');\n\n    const rollBack = (msg: string) => {\n      setStep('identifier');\n      setError(msg);\n      onError?.(msg);\n    };\n\n    try {\n      // Only apps that opted in send consent fields — absent option ⇒ body unchanged.\n      const consent = marketingConsentOption\n        ? { marketingConsent: marketingConsent === true, disclosureVersion: marketingConsentOption.disclosureVersion }\n        : undefined;\n      const result = await requestOTP(identifier, sourceUrl, consent);\n\n      if (result.success) {\n        saveIdentifierToStorage(identifier);\n        setWebmail(result.webmail ?? null);\n        startResendCountdown(result.resendIn ?? AUTH_CONSTANTS.RESEND_COOLDOWN_SECONDS);\n        onIdentifierSuccess?.(identifier);\n      } else if (result.retryAfter) {\n        setStep('identifier');\n        startRateLimitCountdown(result.retryAfter);\n      } else {\n        rollBack(result.message);\n      }\n    } catch {\n      rollBack('An unexpected error occurred');\n    }\n  }, [\n    identifier, acceptedTerms, requireTermsAcceptance,\n    marketingConsent, marketingConsentOption,\n    validateIdentifier, requestOTP, saveIdentifierToStorage,\n    setError, setOtp, setStep, clearError, setWebmail,\n    startRateLimitCountdown, startResendCountdown, onIdentifierSuccess, onError, sourceUrl,\n  ]);\n\n  // Core OTP submit - accepts explicit values to avoid stale closures\n  const submitOTP = useCallback(async (\n    submitIdentifier: string,\n    submitOtp: string,\n  ): Promise<boolean> => {\n    if (!submitOtp || submitOtp.length < AUTH_CONSTANTS.EMAIL_OTP_LENGTH) {\n      const msg = `Please enter the ${AUTH_CONSTANTS.EMAIL_OTP_LENGTH}-digit verification code`;\n      setError(msg);\n      onError?.(msg);\n      return false;\n    }\n\n    setIsLoading(true);\n    clearError();\n\n    try {\n      // Skip redirect - we'll show success screen first\n      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true);\n\n      if (result.requires_2fa && result.session_id) {\n        authLogger.info('2FA required after OTP verification');\n        beginTwoFactorChallenge({ sessionId: result.session_id });\n        saveIdentifierToStorage(submitIdentifier);\n        return true; // OTP was successful, now need 2FA\n      }\n\n      if (result.success) {\n        saveIdentifierToStorage(submitIdentifier);\n\n        authLogger.info('OTP verification successful, showing success screen');\n        setStep('success');\n        onOTPSuccess?.();\n        return true;\n      } else {\n        setError(result.message);\n        onError?.(result.message);\n        return false;\n      }\n    } catch {\n      const msg = 'An unexpected error occurred';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    } finally {\n      setIsLoading(false);\n    }\n  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, setStep]);\n\n  const handleOTPSubmit = useCallback(async (e: React.FormEvent) => {\n    e.preventDefault();\n    await submitOTP(identifier, otp);\n  }, [identifier, otp, submitOTP]);\n\n  // ─────────────────────────────────────────────────────────────────────────\n  // Password Submit\n  // ─────────────────────────────────────────────────────────────────────────\n\n  // The password credential lands on the same outcomes as the OTP code:\n  // a 2FA challenge or 'success'.\n  const submitPassword = useCallback(async (\n    submitIdentifier: string,\n    submitPassword_: string,\n  ): Promise<boolean> => {\n    if (!submitIdentifier || !validateIdentifier(submitIdentifier)) {\n      const msg = 'Please enter a valid email address';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    }\n\n    if (!submitPassword_) {\n      const msg = 'Please enter your password';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    }\n\n    setIsLoading(true);\n    clearError();\n\n    try {\n      // Skip redirect - we'll show success screen first\n      const result = await login(submitIdentifier, submitPassword_, {\n        redirectUrl,\n        skipRedirect: true,\n      });\n\n      if (result.requires_2fa && result.session_id) {\n        authLogger.info('2FA required after password login');\n        beginTwoFactorChallenge({ sessionId: result.session_id });\n        saveIdentifierToStorage(submitIdentifier);\n        return true; // Password was accepted, now need 2FA\n      }\n\n      if (result.success) {\n        saveIdentifierToStorage(submitIdentifier);\n        authLogger.info('Password login successful, showing success screen');\n        setStep('success');\n        onOTPSuccess?.();\n        return true;\n      }\n\n      // A lockout (429) carries a retry-after; show the countdown instead of a\n      // message the user can only re-trigger.\n      if (result.retryAfter) {\n        startRateLimitCountdown(result.retryAfter);\n        clearError();\n      } else {\n        setError(result.message);\n        onError?.(result.message);\n      }\n      return false;\n    } catch {\n      const msg = 'An unexpected error occurred';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    } finally {\n      setIsLoading(false);\n    }\n  }, [\n    login, validateIdentifier, saveIdentifierToStorage, setError, setIsLoading,\n    clearError, startRateLimitCountdown, onOTPSuccess, onError, redirectUrl,\n    setStep,\n  ]);\n\n  const handlePasswordSubmit = useCallback(async (e: React.FormEvent) => {\n    e.preventDefault();\n    await submitPassword(identifier, password);\n  }, [identifier, password, submitPassword]);\n\n  const handleResendOTP = useCallback(async () => {\n    setIsLoading(true);\n    clearError();\n\n    try {\n      // Resend repeats the same OTP request — carry the same consent state so\n      // the backend never sees a consent-less duplicate of an opted-in request.\n      const consent = marketingConsentOption\n        ? { marketingConsent: marketingConsent === true, disclosureVersion: marketingConsentOption.disclosureVersion }\n        : undefined;\n      const result = await requestOTP(identifier, sourceUrl, consent);\n\n      if (result.success) {\n        saveIdentifierToStorage(identifier);\n        setWebmail(result.webmail ?? null);\n        startResendCountdown(result.resendIn ?? AUTH_CONSTANTS.RESEND_COOLDOWN_SECONDS);\n        setOtp('');\n      } else {\n        if (result.retryAfter) {\n          startRateLimitCountdown(result.retryAfter);\n          clearError(); // countdown in rateLimitLabel is enough feedback\n        } else {\n          setError(result.message);\n          onError?.(result.message);\n        }\n      }\n    } catch {\n      const msg = 'Failed to resend verification code';\n      setError(msg);\n      onError?.(msg);\n    } finally {\n      setIsLoading(false);\n    }\n  }, [identifier, marketingConsent, marketingConsentOption, requestOTP, saveIdentifierToStorage, setOtp, setError, setIsLoading, clearError, startRateLimitCountdown, startResendCountdown, setWebmail, onError, sourceUrl]);\n\n  const handleBackToIdentifier = useCallback(() => {\n    setStep('identifier');\n    clearError();\n  }, [setStep, clearError]);\n\n  const forceOTPStep = useCallback(() => {\n    setStep('otp');\n    clearError();\n  }, [setStep, clearError]);\n\n  // ─────────────────────────────────────────────────────────────────────────\n  // Auto-auth from URL\n  // ─────────────────────────────────────────────────────────────────────────\n\n  const handleOTPFromUrl = useCallback((detectedOtp: string, detectedEmail?: string) => {\n    // Prefer the email from the magic-link URL (works on a fresh browser/device),\n    // fall back to the one saved from a previous request on this browser.\n    const autoIdentifier = detectedEmail || getSavedEmail() || '';\n\n    if (!autoIdentifier) {\n      authLogger.warn('No identifier found for auto-submit (no email in URL or storage)');\n      return;\n    }\n\n    // Verify each magic-link code at most once. A re-render must never re-fire\n    // the request — a failed/expired code that retried in a loop is exactly what\n    // drove the /verify/ spam and the backend's 429 lockout.\n    const otpKey = `${autoIdentifier}:${detectedOtp}`;\n    if (processedOtpKeyRef.current === otpKey) return;\n    if (isAutoSubmitFromUrlRef.current) return;\n\n    processedOtpKeyRef.current = otpKey;\n    isAutoSubmitFromUrlRef.current = true;\n\n    authLogger.info('OTP detected from URL, auto-submitting');\n\n    // Update UI state\n    setIdentifier(autoIdentifier);\n    setOtp(detectedOtp);\n    setStep('otp');\n\n    // Submit with explicit values\n    setTimeout(async () => {\n      try {\n        await submitOTP(autoIdentifier, detectedOtp);\n      } finally {\n        isAutoSubmitFromUrlRef.current = false;\n      }\n    }, 100);\n  }, [getSavedEmail, setIdentifier, setOtp, setStep, submitOTP]);\n\n  useAutoAuth({\n    allowedPaths: [authPath],\n    onOTPDetected: handleOTPFromUrl,\n    cleanupUrl: true,\n  });\n\n  // ─────────────────────────────────────────────────────────────────────────\n  // Return\n  // ─────────────────────────────────────────────────────────────────────────\n\n  return {\n    // State\n    ...formState,\n\n    // Submit handlers\n    handleIdentifierSubmit,\n    handleOTPSubmit,\n    handlePasswordSubmit,\n    handleResendOTP,\n    handleBackToIdentifier,\n    forceOTPStep,\n\n    // Validation\n    ...validation,\n\n    // Auto-submit ref\n    isAutoSubmittingFromUrl: isAutoSubmitFromUrlRef,\n  };\n};\n\n// Re-export types for convenience\nexport type { AuthFormReturn, UseAuthFormOptions } from '../types';\n","import { createConsola } from 'consola';\n\n/**\n * Universal logger for @djangocfg/api/auth\n * Uses consola for beautiful console logging\n *\n * Log levels:\n * - 0: silent\n * - 1: fatal, error\n * - 2: warn\n * - 3: log, info\n * - 4: debug\n * - 5: trace, verbose\n *\n * The level is driven by the GLOBAL runtime controller (log-control), so an\n * admin can get verbose logs (even in prod) while regular users keep a clean\n * console. `applyRoleLogPolicy(...)` at app bootstrap sets the policy.\n */\nimport { getLogLevel, onLogLevelChange } from '../../log-control';\n\nexport const logger = createConsola({\n  level: getLogLevel(),\n}).withTag('api');\n\n// Keep the live logger's level in sync with the global controller.\nonLogLevelChange((level) => {\n  logger.level = level;\n});\n\n/**\n * Auth-specific logger\n */\nexport const authLogger = logger.withTag('auth');\n\nexport default logger;\n","'use client';\n\nimport { usePathname } from 'next/navigation';\nimport { useEffect, useRef } from 'react';\n\nimport { AUTH_CONSTANTS } from '../constants';\nimport { authLogger } from '../utils/logger';\nimport { isAllowedAuthPath } from '../utils/path';\nimport { useCfgRouter } from './useCfgRouter';\nimport { useQueryParams } from './useQueryParams';\n\nexport interface UseAutoAuthOptions {\n  /** Called with the OTP from the URL, plus the optional `email` query param if present. */\n  onOTPDetected?: (otp: string, email?: string) => void;\n  cleanupUrl?: boolean;\n  /** Paths where auto-auth should be active. Default: ['/auth'] */\n  allowedPaths?: string[];\n}\n\n/**\n * Hook for automatic authentication from URL query parameters\n * Detects OTP from URL and triggers callback.\n * (Path normalization / allow-list matching live in ../utils/path so they can\n * be unit-tested independently of the hook.)\n */\nexport const useAutoAuth = (options: UseAutoAuthOptions = {}) => {\n  const { onOTPDetected, cleanupUrl = true, allowedPaths = ['/auth'] } = options;\n  const queryParams = useQueryParams();\n  const pathname = usePathname();\n  const router = useCfgRouter();\n\n  // Check if current path is in allowed paths, ignoring the locale prefix\n  // (next-intl may keep it in the URL, e.g. /ru/auth) and trailing slashes.\n  const isAllowedPath = isAllowedAuthPath(pathname, allowedPaths);\n\n  const queryOtp = queryParams.get('otp') || '';\n  const queryEmail = queryParams.get('email') || undefined;\n  const hasOTP = !!queryOtp;\n  const isReady = !!pathname && hasOTP && isAllowedPath;\n  const otpValid = queryOtp.length === AUTH_CONSTANTS.EMAIL_OTP_LENGTH;\n\n  // Keep the latest callback in a ref so its (unstable) identity never lands in\n  // the effect deps below. Otherwise a parent that passes an inline function\n  // re-runs this effect on every render and re-fires the OTP submission.\n  const onOTPDetectedRef = useRef(onOTPDetected);\n  onOTPDetectedRef.current = onOTPDetected;\n\n  // Detect OTP and notify the parent. Keyed on the OTP *value* (a string), not\n  // on the `queryParams` object reference — so the effect fires once per code,\n  // not on every poll tick / re-render.\n  useEffect(() => {\n    if (!isReady || !otpValid) return;\n    // Only on allowed paths to avoid conflicts with other pages\n    // (e.g., /dashboard/device uses ?otp= for device authorization, not user auth)\n    authLogger.info('OTP detected in URL on auth page:', queryOtp);\n    onOTPDetectedRef.current?.(queryOtp, queryEmail);\n  }, [isReady, otpValid, queryOtp, queryEmail]);\n\n  // Clean up URL to remove sensitive params for security. Separate effect so it\n  // does not depend on `onOTPDetected` and cannot re-trigger the submission.\n  // Use window.location.pathname to preserve the locale prefix (e.g. /ru/auth)\n  // because usePathname() strips the locale, and router.push('/auth') would cause\n  // next-intl middleware to redirect back to /ru/auth — triggering a full page reload\n  // that loses the in-flight OTP submission.\n  useEffect(() => {\n    if (!isReady || !cleanupUrl || !queryOtp) return;\n    const cleanQuery = Object.fromEntries(queryParams.entries());\n    delete cleanQuery.otp;\n    delete cleanQuery.email;\n    const queryString = new URLSearchParams(cleanQuery).toString();\n    const realPathname = typeof window !== 'undefined' ? window.location.pathname : pathname;\n    router.replace(queryString ? `${realPathname}?${queryString}` : realPathname);\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [isReady, cleanupUrl, queryOtp]);\n\n  return {\n    isReady,\n    hasOTP,\n    isAllowedPath,\n  };\n};\n","/**\n * Path normalization for auth routing.\n *\n * next-intl may keep a 2-letter locale prefix in the URL (e.g. `/ru/auth`), and\n * paths arrive with or without trailing slashes. To match a pathname against a\n * fixed allow-list (like `['/auth']`) reliably, strip the locale segment and\n * trailing slashes first. Extracted from useAutoAuth so it can be unit-tested\n * and reused.\n */\n\n/**\n * Strip a leading 2-letter locale segment and trailing slashes.\n * '/ru/auth/' → '/auth', '/auth' → '/auth', '/' → '/', '' → ''.\n */\nexport const normalizePath = (path: string | null | undefined): string => {\n  if (!path) return '';\n  const withoutLocale = path.replace(/^\\/[a-z]{2}(?=\\/|$)/, '');\n  const trimmed = withoutLocale.replace(/\\/+$/, '');\n  return trimmed || '/';\n};\n\n/**\n * True when `pathname` (after locale/slash normalization) is one of the allowed\n * paths, or nested under one of them (`/auth` matches `/auth/callback`).\n */\nexport const isAllowedAuthPath = (\n  pathname: string | null | undefined,\n  allowedPaths: string[],\n): boolean => {\n  const normalized = normalizePath(pathname);\n  return allowedPaths.some(\n    (p) => normalized === p || normalized.startsWith(p + '/'),\n  );\n};\n","'use client';\n\nimport { useSyncExternalStore } from 'react';\n\n/** A pending login that needs a TOTP or backup code before tokens are issued. */\nexport interface TwoFactorChallenge {\n  sessionId: string;\n}\n\n// Module-scoped on purpose: one sign-in is in flight per page, and the sign-in\n// form and the challenge dialog share it without either importing the other.\nlet current: TwoFactorChallenge | null = null;\nconst listeners = new Set<() => void>();\n\nconst set = (next: TwoFactorChallenge | null): void => {\n  current = next;\n  for (const listener of [...listeners]) listener();\n};\n\nconst subscribe = (listener: () => void): (() => void) => {\n  listeners.add(listener);\n  return () => {\n    listeners.delete(listener);\n  };\n};\n\n/** Called by whichever step received `requires_2fa` (OTP, password, OAuth callback). */\nexport const beginTwoFactorChallenge = (challenge: TwoFactorChallenge): void => set(challenge);\n\n/** Called when the challenge is verified or abandoned. */\nexport const endTwoFactorChallenge = (): void => set(null);\n\n/** The pending challenge, or null. */\nexport const useTwoFactorChallenge = (): TwoFactorChallenge | null =>\n  useSyncExternalStore(subscribe, () => current, () => null);\n","'use client';\n\nimport { useCallback, useEffect, useRef, useState } from 'react';\n\nimport { auth } from '../../_api/generated/helpers/auth';\nimport { CFG_KEYS, cfgStorage } from '../../_api/generated/helpers/keys';\nimport { CfgAccountsOauth } from '../../_api/generated/sdk.gen';\nimport type {\n  OAuthAuthorizeRequestRequest,\n  OAuthAuthorizeResponse,\n  OAuthCallbackRequestRequest,\n  OAuthTokenResponse,\n} from '../../_api/generated/types.gen';\nimport { Analytics, AnalyticsCategory, AnalyticsEvent } from '../utils/analytics';\nimport { authLogger } from '../utils/logger';\nimport { type OAuthFailureCode, type OAuthProviderId, readOAuthFailure } from '../utils/oauthErrors';\nimport { consumeSavedRedirect } from './useAuthRedirect';\nimport { useCfgRouter } from './useCfgRouter';\nimport { authTrace } from '../trace';\n\n/**\n * The user payload as the OAuth endpoint declares it.\n *\n * Derived from the generated response rather than restated, so a schema change\n * reaches callers through `make generate` instead of drifting silently.\n */\nexport type OAuthUser = NonNullable<OAuthTokenResponse['user']>;\n\ninterface OAuthAdapter {\n  authorize: (body: OAuthAuthorizeRequestRequest) => Promise<OAuthAuthorizeResponse>;\n  callback: (body: OAuthCallbackRequestRequest) => Promise<OAuthTokenResponse>;\n}\n\n/**\n * One entry per provider the backend can offer. Keyed by the generated enum:\n * when the backend adds a provider, this stops compiling until it is wired.\n */\nconst ADAPTERS: Record<OAuthProviderId, OAuthAdapter> = {\n  github: {\n    authorize: async (body) =>\n      (await CfgAccountsOauth.cfgAccountsOauthGithubAuthorizeCreate({ body, throwOnError: true })).data,\n    callback: async (body) =>\n      (await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({ body, throwOnError: true })).data,\n  },\n  google: {\n    authorize: async (body) =>\n      (await CfgAccountsOauth.cfgAccountsOauthGoogleAuthorizeCreate({ body, throwOnError: true })).data,\n    callback: async (body) =>\n      (await CfgAccountsOauth.cfgAccountsOauthGoogleCallbackCreate({ body, throwOnError: true })).data,\n  },\n};\n\n/** Provider ids this client can run, in the order the adapters are declared. */\nexport const OAUTH_PROVIDER_IDS = Object.keys(ADAPTERS) as OAuthProviderId[];\n\nexport const isOAuthProviderId = (value: unknown): value is OAuthProviderId =>\n  typeof value === 'string' && Object.hasOwn(ADAPTERS, value);\n\nconst STATE_KEY = CFG_KEYS.oauthState.key;\nconst PROVIDER_KEY = CFG_KEYS.oauthProvider.key;\n\n/** Forget the stored state: the attempt is over without an exchange (Cancel, a provider error). */\nexport const clearOAuthAttempt = (): void => {\n  cfgStorage.remove(STATE_KEY);\n  cfgStorage.remove(PROVIDER_KEY);\n};\n\nexport interface UseOAuthLoginOptions {\n  sourceUrl?: string;\n  /** The endpoint types `user` as a free-form object; narrow it at the call site. */\n  onSuccess?: (user: OAuthUser, isNewUser: boolean, provider: OAuthProviderId) => void;\n  /** `message` is server prose or an English fallback; `code` lets the caller choose its own copy. */\n  onError?: (message: string, code?: OAuthFailureCode) => void;\n  /** Called when 2FA is required instead of a session. */\n  onRequires2FA?: (sessionId: string, shouldPrompt2FA: boolean) => void;\n  redirectUrl?: string;\n  /** Skip the automatic redirect after success (the caller navigates). */\n  skipRedirect?: boolean;\n}\n\nexport interface UseOAuthLoginReturn {\n  /** True from the click until the page leaves (start) or the exchange settles (complete). */\n  isLoading: boolean;\n  /** The provider whose flow is in flight; disable the other buttons, show progress on this one. */\n  loadingProvider: OAuthProviderId | null;\n  error: string | null;\n  errorCode: OAuthFailureCode | null;\n  /** Redirects the tab to the provider. Resolves only if it failed to start. */\n  start: (provider: OAuthProviderId) => Promise<void>;\n  /** Exchanges the `code` the provider returned. The stored `state` must match; there is no unchecked path. */\n  complete: (provider: OAuthProviderId, code: string, state: string) => Promise<void>;\n}\n\n/**\n * Sign in with a third-party provider: one hook for every provider.\n *\n * Flow, full page in the same tab so the saved return URL survives:\n * `start(provider)` stores the server's `state`, then navigates to the provider.\n * The provider returns to `/auth?provider=<id>&code&state`; `complete(...)`\n * verifies that `state` against the stored one (login CSRF defence), exchanges\n * the code and writes the session.\n */\nexport const useOAuthLogin = (options: UseOAuthLoginOptions = {}): UseOAuthLoginReturn => {\n  const router = useCfgRouter();\n\n  const optionsRef = useRef(options);\n  optionsRef.current = options;\n  const routerRef = useRef(router);\n  routerRef.current = router;\n\n  const [loadingProvider, setLoadingProvider] = useState<OAuthProviderId | null>(null);\n  const [error, setError] = useState<string | null>(null);\n  const [errorCode, setErrorCode] = useState<OAuthFailureCode | null>(null);\n\n  // Coming back with the back button restores this page from the bfcache with\n  // the spinner still on; the provider page was left, so the flow is over.\n  useEffect(() => {\n    const onShow = (event: PageTransitionEvent) => {\n      if (event.persisted) setLoadingProvider(null);\n    };\n    window.addEventListener('pageshow', onShow);\n    return () => window.removeEventListener('pageshow', onShow);\n  }, []);\n\n  const fail = useCallback((provider: OAuthProviderId, message: string, code?: OAuthFailureCode) => {\n    setError(message);\n    setErrorCode(code ?? null);\n    setLoadingProvider(null);\n    optionsRef.current.onError?.(message, code);\n    Analytics.event(AnalyticsEvent.AUTH_OAUTH_FAIL, {\n      category: AnalyticsCategory.AUTH,\n      label: provider,\n    });\n  }, []);\n\n  const start = useCallback(async (provider: OAuthProviderId) => {\n    setLoadingProvider(provider);\n    setError(null);\n    setErrorCode(null);\n    // Match the OTP flow: a new login must not leave an older persistent\n    // session available after this browser is intentionally made session-only.\n    authTrace('oauth.start');\n    auth.clearSession();\n\n    try {\n      Analytics.event(AnalyticsEvent.AUTH_OAUTH_START, {\n        category: AnalyticsCategory.AUTH,\n        label: provider,\n      });\n\n      // No `redirect_uri`: the server derives it from the request origin.\n      const sourceUrl = optionsRef.current.sourceUrl || window.location.href;\n      const response = await ADAPTERS[provider].authorize({ source_url: sourceUrl });\n      if (!response.authorization_url || !response.state) {\n        throw new Error('Failed to get authorization URL');\n      }\n\n      cfgStorage.write(STATE_KEY, response.state);\n      cfgStorage.write(PROVIDER_KEY, provider);\n      authLogger.info(`Redirecting to ${provider}...`);\n      // Loading stays on: the tab is leaving.\n      window.location.href = response.authorization_url;\n    } catch (err) {\n      authLogger.error(`${provider} OAuth start error:`, err);\n      const failure = readOAuthFailure(err, 'Failed to start authentication');\n      fail(provider, failure.message, failure.code);\n    }\n  }, [fail]);\n\n  const complete = useCallback(async (provider: OAuthProviderId, code: string, state: string) => {\n    setLoadingProvider(provider);\n    setError(null);\n    setErrorCode(null);\n\n    // The stored state is the proof that THIS browser started the flow. A\n    // missing one is as wrong as a different one: an attacker's link carries a\n    // valid code and state for the attacker's account. Spent before any await.\n    const storedState = cfgStorage.read(STATE_KEY);\n    const storedProvider = cfgStorage.read(PROVIDER_KEY);\n    clearOAuthAttempt();\n    if (!storedState || storedState !== state || (storedProvider && storedProvider !== provider)) {\n      authLogger.warn(`${provider} OAuth callback rejected: state does not match this browser`);\n      fail(provider, 'Invalid sign-in attempt. Please try again.', 'invalid_state');\n      return;\n    }\n\n    try {\n      const response = await ADAPTERS[provider].callback({ code, state });\n\n      if (response.requires_2fa && response.session_id) {\n        Analytics.event(AnalyticsEvent.AUTH_OAUTH_START, {\n          category: AnalyticsCategory.AUTH,\n          label: `${provider}-2fa-required`,\n        });\n        optionsRef.current.onRequires2FA?.(response.session_id, response.should_prompt_2fa || false);\n        setLoadingProvider(null);\n        return;\n      }\n\n      if (!response.access || !response.refresh) {\n        throw new Error('Invalid response from OAuth callback');\n      }\n\n      // The ONE write path — atomic pair + session notification.\n      authTrace('oauth.session');\n      auth.setSession({ access: response.access, refresh: response.refresh });\n\n      Analytics.event(AnalyticsEvent.AUTH_LOGIN_SUCCESS, {\n        category: AnalyticsCategory.AUTH,\n        label: provider,\n      });\n      if (response.user?.id) {\n        Analytics.setUser(String(response.user.id));\n      }\n      if (response.user) {\n        optionsRef.current.onSuccess?.(response.user, response.is_new_user || false, provider);\n      }\n\n      setLoadingProvider(null);\n      if (!optionsRef.current.skipRedirect) {\n        // Full reload so every React context reinitialises with the new session.\n        // The saved back-url (where a guard bounced the visitor from) comes first.\n        routerRef.current.hardPush(consumeSavedRedirect() || optionsRef.current.redirectUrl || '/private');\n      }\n    } catch (err) {\n      authLogger.error(`${provider} OAuth callback error:`, err);\n      const failure = readOAuthFailure(err, 'Authentication failed');\n      fail(provider, failure.message, failure.code);\n    }\n  }, [fail]);\n\n  return {\n    isLoading: loadingProvider !== null,\n    loadingProvider,\n    error,\n    errorCode,\n    start,\n    complete,\n  };\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport type { ArrayStyle, ObjectStyle, SerializerOptions } from './pathSerializer.gen';\n\nexport type QuerySerializer = (query: Record<string, unknown>) => string;\n\nexport type BodySerializer = (body: unknown) => unknown;\n\ntype QuerySerializerOptionsObject = {\n  allowReserved?: boolean;\n  array?: Partial<SerializerOptions<ArrayStyle>>;\n  object?: Partial<SerializerOptions<ObjectStyle>>;\n};\n\nexport type QuerySerializerOptions = QuerySerializerOptionsObject & {\n  /**\n   * Per-parameter serialization overrides. When provided, these settings\n   * override the global array/object settings for specific parameter names.\n   */\n  parameters?: Record<string, QuerySerializerOptionsObject>;\n};\n\nconst serializeFormDataPair = (data: FormData, key: string, value: unknown): void => {\n  if (typeof value === 'string' || value instanceof Blob) {\n    data.append(key, value);\n  } else if (value instanceof Date) {\n    data.append(key, value.toISOString());\n  } else {\n    data.append(key, JSON.stringify(value));\n  }\n};\n\nconst serializeUrlSearchParamsPair = (data: URLSearchParams, key: string, value: unknown): void => {\n  if (typeof value === 'string') {\n    data.append(key, value);\n  } else {\n    data.append(key, JSON.stringify(value));\n  }\n};\n\nexport const formDataBodySerializer = {\n  bodySerializer: (body: unknown): FormData => {\n    const data = new FormData();\n\n    Object.entries(body as Record<string, unknown>).forEach(([key, value]) => {\n      if (value === undefined || value === null) {\n        return;\n      }\n      if (Array.isArray(value)) {\n        value.forEach((v) => serializeFormDataPair(data, key, v));\n      } else {\n        serializeFormDataPair(data, key, value);\n      }\n    });\n\n    return data;\n  },\n};\n\nexport const jsonBodySerializer = {\n  bodySerializer: (body: unknown): string =>\n    JSON.stringify(body, (_key, value) => (typeof value === 'bigint' ? value.toString() : value)),\n};\n\nexport const urlSearchParamsBodySerializer = {\n  bodySerializer: (body: unknown): string => {\n    const data = new URLSearchParams();\n\n    Object.entries(body as Record<string, unknown>).forEach(([key, value]) => {\n      if (value === undefined || value === null) {\n        return;\n      }\n      if (Array.isArray(value)) {\n        value.forEach((v) => serializeUrlSearchParamsPair(data, key, v));\n      } else {\n        serializeUrlSearchParamsPair(data, key, value);\n      }\n    });\n\n    return data.toString();\n  },\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\ntype Slot = 'body' | 'headers' | 'path' | 'query';\n\nexport type Field =\n  | {\n      in: Exclude<Slot, 'body'>;\n      /**\n       * Field name. This is the name we want the user to see and use.\n       */\n      key: string;\n      /**\n       * Field mapped name. This is the name we want to use in the request.\n       * If omitted, we use the same value as `key`.\n       */\n      map?: string;\n    }\n  | {\n      in: Extract<Slot, 'body'>;\n      /**\n       * Key isn't required for bodies.\n       */\n      key?: string;\n      map?: string;\n    }\n  | {\n      /**\n       * Field name. This is the name we want the user to see and use.\n       */\n      key: string;\n      /**\n       * Field mapped name. This is the name we want to use in the request.\n       * If `in` is omitted, `map` aliases `key` to the transport layer.\n       */\n      map: Slot;\n    };\n\nexport interface Fields {\n  allowExtra?: Partial<Record<Slot, boolean>>;\n  args?: ReadonlyArray<Field>;\n}\n\nexport type FieldsConfig = ReadonlyArray<Field | Fields>;\n\nconst extraPrefixesMap: Record<string, Slot> = {\n  $body_: 'body',\n  $headers_: 'headers',\n  $path_: 'path',\n  $query_: 'query',\n};\nconst extraPrefixes = Object.entries(extraPrefixesMap);\n\ntype KeyMap = Map<\n  string,\n  | {\n      in: Slot;\n      map?: string;\n    }\n  | {\n      in?: never;\n      map: Slot;\n    }\n>;\n\nfunction buildKeyMap(fields: FieldsConfig, map?: KeyMap): KeyMap {\n  if (!map) {\n    map = new Map();\n  }\n\n  for (const config of fields) {\n    if ('in' in config) {\n      if (config.key) {\n        map.set(config.key, {\n          in: config.in,\n          map: config.map,\n        });\n      }\n    } else if ('key' in config) {\n      map.set(config.key, {\n        map: config.map,\n      });\n    } else if (config.args) {\n      buildKeyMap(config.args, map);\n    }\n  }\n\n  return map;\n}\n\ninterface Params {\n  body?: unknown;\n  headers: Record<string, unknown>;\n  path: Record<string, unknown>;\n  query: Record<string, unknown>;\n}\n\nfunction stripEmptySlots(params: Params): void {\n  for (const [slot, value] of Object.entries(params)) {\n    if (slot === 'body') continue;\n    if (value && typeof value === 'object' && !Array.isArray(value) && !Object.keys(value).length) {\n      delete params[slot as Slot];\n    }\n  }\n}\n\nexport function buildClientParams(args: ReadonlyArray<unknown>, fields: FieldsConfig): Params {\n  const params: Params = {\n    headers: Object.create(null),\n    path: Object.create(null),\n    query: Object.create(null),\n  };\n\n  const map = buildKeyMap(fields);\n\n  function writeSlot(slot: Slot, key: string, value: unknown): void {\n    let record = params[slot] as Record<string, unknown> | undefined;\n    if (record === undefined) {\n      record = Object.create(null) as Record<string, unknown>;\n      params[slot] = record;\n    }\n    record[key] = value;\n  }\n\n  let config: FieldsConfig[number] | undefined;\n\n  for (const [index, arg] of args.entries()) {\n    if (fields[index]) {\n      config = fields[index];\n    }\n\n    if (!config) {\n      continue;\n    }\n\n    if ('in' in config) {\n      if (config.key) {\n        const field = map.get(config.key)!;\n        const name = field.map || config.key;\n        if (field.in) {\n          writeSlot(field.in, name, arg);\n        }\n      } else {\n        params.body = arg;\n      }\n    } else {\n      for (const [key, value] of Object.entries(arg ?? {})) {\n        const field = map.get(key);\n\n        if (field) {\n          if (field.in) {\n            const name = field.map || key;\n            writeSlot(field.in, name, value);\n          } else {\n            params[field.map] = value;\n          }\n        } else {\n          const extra = extraPrefixes.find(([prefix]) => key.startsWith(prefix));\n\n          if (extra) {\n            const [prefix, slot] = extra;\n            writeSlot(slot, key.slice(prefix.length), value);\n          } else if ('allowExtra' in config && config.allowExtra) {\n            for (const [slot, allowed] of Object.entries(config.allowExtra)) {\n              if (allowed) {\n                writeSlot(slot as Slot, key, value);\n                break;\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n\n  stripEmptySlots(params);\n\n  return params;\n}\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport type { Config } from './types.gen';\n\nexport type ServerSentEventsOptions<TData = unknown> = Omit<RequestInit, 'method'> &\n  Pick<Config, 'method' | 'responseTransformer' | 'responseValidator'> & {\n    /**\n     * Fetch API implementation. You can use this option to provide a custom\n     * fetch instance.\n     *\n     * @default globalThis.fetch\n     */\n    fetch?: typeof fetch;\n    /**\n     * Implementing clients can call request interceptors inside this hook.\n     */\n    onRequest?: (url: string, init: RequestInit) => Promise<Request>;\n    /**\n     * Callback invoked when a network or parsing error occurs during streaming.\n     *\n     * This option applies only if the endpoint returns a stream of events.\n     *\n     * @param error The error that occurred.\n     */\n    onSseError?: (error: unknown) => void;\n    /**\n     * Callback invoked when an event is streamed from the server.\n     *\n     * This option applies only if the endpoint returns a stream of events.\n     *\n     * @param event Event streamed from the server.\n     * @returns Nothing (void).\n     */\n    onSseEvent?: (event: StreamEvent<TData>) => void;\n    serializedBody?: RequestInit['body'];\n    /**\n     * Default retry delay in milliseconds.\n     *\n     * This option applies only if the endpoint returns a stream of events.\n     *\n     * @default 3000\n     */\n    sseDefaultRetryDelay?: number;\n    /**\n     * Maximum number of retry attempts before giving up.\n     */\n    sseMaxRetryAttempts?: number;\n    /**\n     * Maximum retry delay in milliseconds.\n     *\n     * Applies only when exponential backoff is used.\n     *\n     * This option applies only if the endpoint returns a stream of events.\n     *\n     * @default 30000\n     */\n    sseMaxRetryDelay?: number;\n    /**\n     * Optional sleep function for retry backoff.\n     *\n     * Defaults to using `setTimeout`.\n     */\n    sseSleepFn?: (ms: number) => Promise<void>;\n    url: string;\n  };\n\nexport interface StreamEvent<TData = unknown> {\n  data: TData;\n  event?: string;\n  id?: string;\n  retry?: number;\n}\n\nexport type ServerSentEventsResult<TData = unknown, TReturn = void, TNext = unknown> = {\n  stream: AsyncGenerator<\n    TData extends Record<string, unknown> ? TData[keyof TData] : TData,\n    TReturn,\n    TNext\n  >;\n};\n\nexport function createSseClient<TData = unknown>({\n  onRequest,\n  onSseError,\n  onSseEvent,\n  responseTransformer,\n  responseValidator,\n  sseDefaultRetryDelay,\n  sseMaxRetryAttempts,\n  sseMaxRetryDelay,\n  sseSleepFn,\n  url,\n  ...options\n}: ServerSentEventsOptions): ServerSentEventsResult<TData> {\n  let lastEventId: string | undefined;\n\n  const sleep = sseSleepFn ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n\n  const createStream = async function* () {\n    let retryDelay: number = sseDefaultRetryDelay ?? 3000;\n    let attempt = 0;\n    const signal = options.signal ?? new AbortController().signal;\n\n    while (true) {\n      if (signal.aborted) break;\n\n      attempt++;\n\n      const headers =\n        options.headers instanceof Headers\n          ? options.headers\n          : new Headers(options.headers as Record<string, string> | undefined);\n\n      if (lastEventId !== undefined) {\n        headers.set('Last-Event-ID', lastEventId);\n      }\n\n      try {\n        const requestInit: RequestInit = {\n          redirect: 'follow',\n          ...options,\n          body: options.serializedBody,\n          headers,\n          signal,\n        };\n        let request = new Request(url, requestInit);\n        if (onRequest) {\n          request = await onRequest(url, requestInit);\n        }\n        // fetch must be assigned here, otherwise it would throw the error:\n        // TypeError: Failed to execute 'fetch' on 'Window': Illegal invocation\n        const _fetch = options.fetch ?? globalThis.fetch;\n        const response = await _fetch(request);\n\n        if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);\n\n        if (!response.body) throw new Error('No body in SSE response');\n\n        const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();\n\n        let buffer = '';\n\n        const abortHandler = () => {\n          try {\n            reader.cancel();\n          } catch {\n            // noop\n          }\n        };\n\n        signal.addEventListener('abort', abortHandler);\n\n        try {\n          while (true) {\n            const { done, value } = await reader.read();\n            if (done) break;\n            buffer += value;\n            buffer = buffer.replace(/\\r\\n?/g, '\\n'); // normalize line endings\n\n            const chunks = buffer.split('\\n\\n');\n            buffer = chunks.pop() ?? '';\n\n            for (const chunk of chunks) {\n              const lines = chunk.split('\\n');\n              const dataLines: Array<string> = [];\n              let eventName: string | undefined;\n\n              for (const line of lines) {\n                if (line.startsWith('data:')) {\n                  dataLines.push(line.replace(/^data:\\s*/, ''));\n                } else if (line.startsWith('event:')) {\n                  eventName = line.replace(/^event:\\s*/, '');\n                } else if (line.startsWith('id:')) {\n                  lastEventId = line.replace(/^id:\\s*/, '');\n                } else if (line.startsWith('retry:')) {\n                  const parsed = Number.parseInt(line.replace(/^retry:\\s*/, ''), 10);\n                  if (!Number.isNaN(parsed)) {\n                    retryDelay = parsed;\n                  }\n                }\n              }\n\n              let data: unknown;\n              let parsedJson = false;\n\n              if (dataLines.length) {\n                const rawData = dataLines.join('\\n');\n                try {\n                  data = JSON.parse(rawData);\n                  parsedJson = true;\n                } catch {\n                  data = rawData;\n                }\n              }\n\n              if (parsedJson) {\n                if (responseValidator) {\n                  await responseValidator(data);\n                }\n\n                if (responseTransformer) {\n                  data = await responseTransformer(data);\n                }\n              }\n\n              onSseEvent?.({\n                data,\n                event: eventName,\n                id: lastEventId,\n                retry: retryDelay,\n              });\n\n              if (dataLines.length) {\n                yield data as any;\n              }\n            }\n          }\n        } finally {\n          signal.removeEventListener('abort', abortHandler);\n          reader.releaseLock();\n        }\n\n        break; // exit loop on normal completion\n      } catch (error) {\n        // connection failed or aborted; retry after delay\n        onSseError?.(error);\n\n        if (sseMaxRetryAttempts !== undefined && attempt >= sseMaxRetryAttempts) {\n          break; // stop after firing error\n        }\n\n        // exponential backoff: double retry each attempt, cap at 30s\n        const backoff = Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 30000);\n        await sleep(backoff);\n      }\n    }\n  };\n\n  const stream = createStream();\n\n  return { stream };\n}\n","// This file is auto-generated by @hey-api/openapi-ts\n\ninterface SerializeOptions<T> extends SerializePrimitiveOptions, SerializerOptions<T> {}\n\ninterface SerializePrimitiveOptions {\n  allowReserved?: boolean;\n  name: string;\n}\n\nexport interface SerializerOptions<T> {\n  /**\n   * @default true\n   */\n  explode: boolean;\n  style: T;\n}\n\nexport type ArrayStyle = 'form' | 'spaceDelimited' | 'pipeDelimited';\nexport type ArraySeparatorStyle = ArrayStyle | MatrixStyle;\ntype MatrixStyle = 'label' | 'matrix' | 'simple';\nexport type ObjectStyle = 'form' | 'deepObject';\ntype ObjectSeparatorStyle = ObjectStyle | MatrixStyle;\n\ninterface SerializePrimitiveParam extends SerializePrimitiveOptions {\n  value: string;\n}\n\nexport const separatorArrayExplode = (style: ArraySeparatorStyle): '.' | ';' | ',' | '&' => {\n  switch (style) {\n    case 'label':\n      return '.';\n    case 'matrix':\n      return ';';\n    case 'simple':\n      return ',';\n    default:\n      return '&';\n  }\n};\n\nexport const separatorArrayNoExplode = (style: ArraySeparatorStyle): ',' | '|' | '%20' => {\n  switch (style) {\n    case 'form':\n      return ',';\n    case 'pipeDelimited':\n      return '|';\n    case 'spaceDelimited':\n      return '%20';\n    default:\n      return ',';\n  }\n};\n\nexport const separatorObjectExplode = (style: ObjectSeparatorStyle): '.' | ';' | ',' | '&' => {\n  switch (style) {\n    case 'label':\n      return '.';\n    case 'matrix':\n      return ';';\n    case 'simple':\n      return ',';\n    default:\n      return '&';\n  }\n};\n\nexport const serializeArrayParam = ({\n  allowReserved,\n  explode,\n  name,\n  style,\n  value,\n}: SerializeOptions<ArraySeparatorStyle> & {\n  value: unknown[];\n}): string => {\n  if (!explode) {\n    const joinedValues = (\n      allowReserved ? value : value.map((v) => encodeURIComponent(v as string))\n    ).join(separatorArrayNoExplode(style));\n    switch (style) {\n      case 'label':\n        return `.${joinedValues}`;\n      case 'matrix':\n        return `;${name}=${joinedValues}`;\n      case 'simple':\n        return joinedValues;\n      default:\n        return `${name}=${joinedValues}`;\n    }\n  }\n\n  const separator = separatorArrayExplode(style);\n  const joinedValues = value\n    .map((v) => {\n      if (style === 'label' || style === 'simple') {\n        return allowReserved ? v : encodeURIComponent(v as string);\n      }\n\n      return serializePrimitiveParam({\n        allowReserved,\n        name,\n        value: v as string,\n      });\n    })\n    .join(separator);\n  return style === 'label' || style === 'matrix' ? separator + joinedValues : joinedValues;\n};\n\nexport const serializePrimitiveParam = ({\n  allowReserved,\n  name,\n  value,\n}: SerializePrimitiveParam): string => {\n  if (value === undefined || value === null) {\n    return '';\n  }\n\n  if (typeof value === 'object') {\n    throw new Error(\n      'Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.',\n    );\n  }\n\n  return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;\n};\n\nexport const serializeObjectParam = ({\n  allowReserved,\n  explode,\n  name,\n  style,\n  value,\n  valueOnly,\n}: SerializeOptions<ObjectSeparatorStyle> & {\n  value: Record<string, unknown> | Date;\n  valueOnly?: boolean;\n}): string => {\n  if (value instanceof Date) {\n    return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;\n  }\n\n  if (style !== 'deepObject' && !explode) {\n    let values: string[] = [];\n    Object.entries(value).forEach(([key, v]) => {\n      values = [...values, key, allowReserved ? (v as string) : encodeURIComponent(v as string)];\n    });\n    const joinedValues = values.join(',');\n    switch (style) {\n      case 'form':\n        return `${name}=${joinedValues}`;\n      case 'label':\n        return `.${joinedValues}`;\n      case 'matrix':\n        return `;${name}=${joinedValues}`;\n      default:\n        return joinedValues;\n    }\n  }\n\n  const separator = separatorObjectExplode(style);\n  const joinedValues = Object.entries(value)\n    .map(([key, v]) =>\n      serializePrimitiveParam({\n        allowReserved,\n        name: style === 'deepObject' ? `${name}[${key}]` : key,\n        value: v as string,\n      }),\n    )\n    .join(separator);\n  return style === 'label' || style === 'matrix' ? separator + joinedValues : joinedValues;\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport type { BodySerializer, QuerySerializer } from './bodySerializer.gen';\nimport {\n  type ArraySeparatorStyle,\n  serializeArrayParam,\n  serializeObjectParam,\n  serializePrimitiveParam,\n} from './pathSerializer.gen';\n\nexport interface PathSerializer {\n  path: Record<string, unknown>;\n  url: string;\n}\n\nexport const PATH_PARAM_RE: RegExp = /\\{[^{}]+\\}/g;\n\nexport const defaultPathSerializer = ({ path, url: _url }: PathSerializer): string => {\n  let url = _url;\n  const matches = _url.match(PATH_PARAM_RE);\n  if (matches) {\n    for (const match of matches) {\n      let explode = false;\n      let name = match.substring(1, match.length - 1);\n      let style: ArraySeparatorStyle = 'simple';\n\n      if (name.endsWith('*')) {\n        explode = true;\n        name = name.substring(0, name.length - 1);\n      }\n\n      if (name.startsWith('.')) {\n        name = name.substring(1);\n        style = 'label';\n      } else if (name.startsWith(';')) {\n        name = name.substring(1);\n        style = 'matrix';\n      }\n\n      const value = path[name];\n\n      if (value === undefined || value === null) {\n        continue;\n      }\n\n      if (Array.isArray(value)) {\n        url = url.replace(match, serializeArrayParam({ explode, name, style, value }));\n        continue;\n      }\n\n      if (typeof value === 'object') {\n        url = url.replace(\n          match,\n          serializeObjectParam({\n            explode,\n            name,\n            style,\n            value: value as Record<string, unknown>,\n            valueOnly: true,\n          }),\n        );\n        continue;\n      }\n\n      if (style === 'matrix') {\n        url = url.replace(\n          match,\n          `;${serializePrimitiveParam({\n            name,\n            value: value as string,\n          })}`,\n        );\n        continue;\n      }\n\n      const replaceValue = encodeURIComponent(\n        style === 'label' ? `.${value as string}` : (value as string),\n      );\n      url = url.replace(match, replaceValue);\n    }\n  }\n  return url;\n};\n\nexport const getUrl = ({\n  baseUrl,\n  path,\n  query,\n  querySerializer,\n  url: _url,\n}: {\n  baseUrl?: string;\n  path?: Record<string, unknown>;\n  query?: Record<string, unknown>;\n  querySerializer: QuerySerializer;\n  url: string;\n}): string => {\n  const pathUrl = _url.startsWith('/') ? _url : `/${_url}`;\n  let url = (baseUrl ?? '') + pathUrl;\n  if (path) {\n    url = defaultPathSerializer({ path, url });\n  }\n  let search = query ? querySerializer(query) : '';\n  if (search.startsWith('?')) {\n    search = search.substring(1);\n  }\n  if (search) {\n    url += `?${search}`;\n  }\n  return url;\n};\n\nexport function getValidRequestBody(options: {\n  body?: unknown;\n  bodySerializer?: BodySerializer | null;\n  serializedBody?: unknown;\n}): unknown {\n  const hasBody = options.body !== undefined;\n  const isSerializedBody = hasBody && options.bodySerializer;\n\n  if (isSerializedBody) {\n    if ('serializedBody' in options) {\n      const hasSerializedBody =\n        options.serializedBody !== undefined && options.serializedBody !== '';\n\n      return hasSerializedBody ? options.serializedBody : null;\n    }\n\n    // not all clients implement a serializedBody property (i.e., client-axios)\n    return options.body !== '' ? options.body : null;\n  }\n\n  // plain/text body\n  if (hasBody) {\n    return options.body;\n  }\n\n  // no body was provided\n  return undefined;\n}\n","// This file is auto-generated by @hey-api/openapi-ts\n\nexport type AuthToken = string | undefined;\n\nexport interface Auth {\n  /**\n   * Which part of the request do we use to send the auth?\n   *\n   * @default 'header'\n   */\n  in?: 'header' | 'query' | 'cookie';\n  /**\n   * A unique identifier for the security scheme.\n   *\n   * Defined only when there are multiple security schemes whose `Auth`\n   * shape would otherwise be identical.\n   */\n  key?: string;\n  /**\n   * Header or query parameter name.\n   *\n   * @default 'Authorization'\n   */\n  name?: string;\n  scheme?: 'basic' | 'bearer';\n  type: 'apiKey' | 'http';\n}\n\nexport const getAuthToken = async (\n  auth: Auth,\n  callback: ((auth: Auth) => Promise<AuthToken> | AuthToken) | AuthToken,\n): Promise<string | undefined> => {\n  const token = typeof callback === 'function' ? await callback(auth) : callback;\n\n  if (!token) {\n    return;\n  }\n\n  if (auth.scheme === 'bearer') {\n    return `Bearer ${token}`;\n  }\n\n  if (auth.scheme === 'basic') {\n    return `Basic ${btoa(token)}`;\n  }\n\n  return token;\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport { getAuthToken } from '../core/auth.gen';\nimport type { QuerySerializerOptions } from '../core/bodySerializer.gen';\nimport { jsonBodySerializer } from '../core/bodySerializer.gen';\nimport {\n  serializeArrayParam,\n  serializeObjectParam,\n  serializePrimitiveParam,\n} from '../core/pathSerializer.gen';\nimport { getUrl } from '../core/utils.gen';\nimport type { Client, ClientOptions, Config, RequestOptions } from './types.gen';\n\nexport const createQuerySerializer = <T = unknown>({\n  parameters = {},\n  ...args\n}: QuerySerializerOptions = {}): ((queryParams: T) => string) => {\n  const querySerializer = (queryParams: T): string => {\n    const search: string[] = [];\n    if (queryParams && typeof queryParams === 'object') {\n      for (const name in queryParams) {\n        const value = queryParams[name];\n\n        if (value === undefined || value === null) {\n          continue;\n        }\n\n        const options = parameters[name] || args;\n\n        if (Array.isArray(value)) {\n          const serializedArray = serializeArrayParam({\n            allowReserved: options.allowReserved,\n            explode: true,\n            name,\n            style: 'form',\n            value,\n            ...options.array,\n          });\n          if (serializedArray) search.push(serializedArray);\n        } else if (typeof value === 'object') {\n          const serializedObject = serializeObjectParam({\n            allowReserved: options.allowReserved,\n            explode: true,\n            name,\n            style: 'deepObject',\n            value: value as Record<string, unknown>,\n            ...options.object,\n          });\n          if (serializedObject) search.push(serializedObject);\n        } else {\n          const serializedPrimitive = serializePrimitiveParam({\n            allowReserved: options.allowReserved,\n            name,\n            value: value as string,\n          });\n          if (serializedPrimitive) search.push(serializedPrimitive);\n        }\n      }\n    }\n    return search.join('&');\n  };\n  return querySerializer;\n};\n\n/**\n * Infers parseAs value from provided Content-Type header.\n */\nexport const getParseAs = (contentType: string | null): Exclude<Config['parseAs'], 'auto'> => {\n  if (!contentType) {\n    // If no Content-Type header is provided, the best we can do is return the raw response body,\n    // which is effectively the same as the 'stream' option.\n    return 'stream';\n  }\n\n  const cleanContent = contentType.split(';')[0]?.trim();\n\n  if (!cleanContent) {\n    return;\n  }\n\n  if (cleanContent.startsWith('application/json') || cleanContent.endsWith('+json')) {\n    return 'json';\n  }\n\n  if (cleanContent === 'multipart/form-data') {\n    return 'formData';\n  }\n\n  if (\n    ['application/', 'audio/', 'image/', 'video/'].some((type) => cleanContent.startsWith(type))\n  ) {\n    return 'blob';\n  }\n\n  if (cleanContent.startsWith('text/')) {\n    return 'text';\n  }\n\n  return;\n};\n\nconst checkForExistence = (\n  options: Pick<RequestOptions, 'auth' | 'query'> & {\n    headers: Headers;\n  },\n  name?: string,\n): boolean => {\n  if (!name) {\n    return false;\n  }\n  if (\n    options.headers.has(name) ||\n    options.query?.[name] ||\n    options.headers.get('Cookie')?.includes(`${name}=`)\n  ) {\n    return true;\n  }\n  return false;\n};\n\nexport async function setAuthParams(\n  options: Pick<RequestOptions, 'auth' | 'query' | 'security'> & {\n    headers: Headers;\n  },\n): Promise<void> {\n  for (const auth of options.security ?? []) {\n    if (checkForExistence(options, auth.name)) {\n      continue;\n    }\n\n    const token = await getAuthToken(auth, options.auth);\n\n    if (!token) {\n      continue;\n    }\n\n    const name = auth.name ?? 'Authorization';\n\n    switch (auth.in) {\n      case 'query':\n        if (!options.query) {\n          options.query = {};\n        }\n        options.query[name] = token;\n        break;\n      case 'cookie':\n        options.headers.append('Cookie', `${name}=${token}`);\n        break;\n      case 'header':\n      default:\n        options.headers.set(name, token);\n        break;\n    }\n  }\n}\n\nexport const buildUrl: Client['buildUrl'] = (options) =>\n  getUrl({\n    baseUrl: options.baseUrl as string,\n    path: options.path,\n    query: options.query,\n    querySerializer:\n      typeof options.querySerializer === 'function'\n        ? options.querySerializer\n        : createQuerySerializer(options.querySerializer),\n    url: options.url,\n  });\n\nexport const mergeConfigs = (a: Config, b: Config): Config => {\n  const config = { ...a, ...b };\n  if (config.baseUrl?.endsWith('/')) {\n    config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);\n  }\n  config.headers = mergeHeaders(a.headers, b.headers);\n  return config;\n};\n\nconst headersEntries = (headers: Headers): Array<[string, string]> => {\n  const entries: Array<[string, string]> = [];\n  headers.forEach((value, key) => {\n    entries.push([key, value]);\n  });\n  return entries;\n};\n\nexport const mergeHeaders = (\n  ...headers: Array<Required<Config>['headers'] | undefined>\n): Headers => {\n  const mergedHeaders = new Headers();\n  for (const header of headers) {\n    if (!header) {\n      continue;\n    }\n\n    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);\n\n    for (const [key, value] of iterator) {\n      if (value === null) {\n        mergedHeaders.delete(key);\n      } else if (Array.isArray(value)) {\n        for (const v of value) {\n          mergedHeaders.append(key, v as string);\n        }\n      } else if (value !== undefined) {\n        // assume object headers are meant to be JSON stringified, i.e., their\n        // content value in OpenAPI specification is 'application/json'\n        mergedHeaders.set(\n          key,\n          typeof value === 'object' ? JSON.stringify(value) : (value as string),\n        );\n      }\n    }\n  }\n  return mergedHeaders;\n};\n\ntype ErrInterceptor<Err, Res, Req, Options> = (\n  error: Err,\n  /** response may be undefined due to a network error where no response object is produced */\n  response: Res | undefined,\n  /** request may be undefined, because error may be from building the request object itself */\n  request: Req | undefined,\n  options: Options,\n) => Err | Promise<Err>;\n\ntype ReqInterceptor<Req, Options> = (request: Req, options: Options) => Req | Promise<Req>;\n\ntype ResInterceptor<Res, Req, Options> = (\n  response: Res,\n  request: Req,\n  options: Options,\n) => Res | Promise<Res>;\n\nclass Interceptors<Interceptor> {\n  fns: Array<Interceptor | null> = [];\n\n  clear(): void {\n    this.fns = [];\n  }\n\n  eject(id: number | Interceptor): void {\n    const index = this.getInterceptorIndex(id);\n    if (this.fns[index]) {\n      this.fns[index] = null;\n    }\n  }\n\n  exists(id: number | Interceptor): boolean {\n    const index = this.getInterceptorIndex(id);\n    return Boolean(this.fns[index]);\n  }\n\n  getInterceptorIndex(id: number | Interceptor): number {\n    if (typeof id === 'number') {\n      return this.fns[id] ? id : -1;\n    }\n    return this.fns.indexOf(id);\n  }\n\n  update(id: number | Interceptor, fn: Interceptor): number | Interceptor | false {\n    const index = this.getInterceptorIndex(id);\n    if (this.fns[index]) {\n      this.fns[index] = fn;\n      return id;\n    }\n    return false;\n  }\n\n  use(fn: Interceptor): number {\n    this.fns.push(fn);\n    return this.fns.length - 1;\n  }\n}\n\nexport interface Middleware<Req, Res, Err, Options> {\n  error: Interceptors<ErrInterceptor<Err, Res, Req, Options>>;\n  request: Interceptors<ReqInterceptor<Req, Options>>;\n  response: Interceptors<ResInterceptor<Res, Req, Options>>;\n}\n\nexport const createInterceptors = <Req, Res, Err, Options>(): Middleware<\n  Req,\n  Res,\n  Err,\n  Options\n> => ({\n  error: new Interceptors<ErrInterceptor<Err, Res, Req, Options>>(),\n  request: new Interceptors<ReqInterceptor<Req, Options>>(),\n  response: new Interceptors<ResInterceptor<Res, Req, Options>>(),\n});\n\nconst defaultQuerySerializer = createQuerySerializer({\n  allowReserved: false,\n  array: {\n    explode: true,\n    style: 'form',\n  },\n  object: {\n    explode: true,\n    style: 'deepObject',\n  },\n});\n\nconst defaultHeaders = {\n  'Content-Type': 'application/json',\n};\n\nexport const createConfig = <T extends ClientOptions = ClientOptions>(\n  override: Config<Omit<ClientOptions, keyof T> & T> = {},\n): Config<Omit<ClientOptions, keyof T> & T> => ({\n  ...jsonBodySerializer,\n  headers: defaultHeaders,\n  parseAs: 'auto',\n  querySerializer: defaultQuerySerializer,\n  ...override,\n});\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport { createSseClient } from '../core/serverSentEvents.gen';\nimport type { HttpMethod } from '../core/types.gen';\nimport { getValidRequestBody } from '../core/utils.gen';\nimport type { Client, Config, RequestOptions, ResolvedRequestOptions } from './types.gen';\nimport {\n  buildUrl,\n  createConfig,\n  createInterceptors,\n  getParseAs,\n  mergeConfigs,\n  mergeHeaders,\n  setAuthParams,\n} from './utils.gen';\n\ntype ReqInit = Omit<RequestInit, 'body' | 'headers'> & {\n  body?: any;\n  headers: ReturnType<typeof mergeHeaders>;\n};\n\nexport const createClient = (config: Config = {}): Client => {\n  let _config = mergeConfigs(createConfig(), config);\n\n  const getConfig = (): Config => ({ ..._config });\n\n  const setConfig = (config: Config): Config => {\n    _config = mergeConfigs(_config, config);\n    return getConfig();\n  };\n\n  const interceptors = createInterceptors<Request, Response, unknown, ResolvedRequestOptions>();\n\n  const beforeRequest = async <\n    TData = unknown,\n    TResponseStyle extends 'data' | 'fields' = 'fields',\n    ThrowOnError extends boolean = boolean,\n    Url extends string = string,\n  >(\n    options: RequestOptions<TData, TResponseStyle, ThrowOnError, Url>,\n  ) => {\n    const opts = {\n      ..._config,\n      ...options,\n      fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,\n      headers: mergeHeaders(_config.headers, options.headers),\n      serializedBody: undefined as string | undefined,\n    };\n\n    if (opts.security) {\n      await setAuthParams(opts);\n    }\n\n    if (opts.requestValidator) {\n      await opts.requestValidator(opts);\n    }\n\n    if (opts.body !== undefined && opts.bodySerializer) {\n      opts.serializedBody = opts.bodySerializer(opts.body) as string | undefined;\n    }\n\n    // remove Content-Type header if body is empty to avoid sending invalid requests\n    if (opts.body === undefined || opts.serializedBody === '') {\n      opts.headers.delete('Content-Type');\n    }\n\n    const resolvedOpts = opts as typeof opts &\n      ResolvedRequestOptions<TResponseStyle, ThrowOnError, Url>;\n    const url = buildUrl(resolvedOpts);\n\n    return { opts: resolvedOpts, url };\n  };\n\n  const request: Client['request'] = async (options) => {\n    const throwOnError = options.throwOnError ?? _config.throwOnError;\n    const responseStyle = options.responseStyle ?? _config.responseStyle;\n\n    let request: Request | undefined;\n    let response: Response | undefined;\n\n    try {\n      const { opts, url } = await beforeRequest(options);\n      const requestInit: ReqInit = {\n        redirect: 'follow',\n        ...opts,\n        body: getValidRequestBody(opts),\n      };\n\n      request = new Request(url, requestInit);\n\n      for (const fn of interceptors.request.fns) {\n        if (fn) {\n          request = await fn(request, opts);\n        }\n      }\n\n      // fetch must be assigned here, otherwise it would throw the error:\n      // TypeError: Failed to execute 'fetch' on 'Window': Illegal invocation\n      const _fetch = opts.fetch!;\n\n      response = await _fetch(request);\n\n      for (const fn of interceptors.response.fns) {\n        if (fn) {\n          response = await fn(response, request, opts);\n        }\n      }\n\n      const result = {\n        request,\n        response,\n      };\n\n      if (response.ok) {\n        const parseAs =\n          (opts.parseAs === 'auto'\n            ? getParseAs(response.headers.get('Content-Type'))\n            : opts.parseAs) ?? 'json';\n\n        if (response.status === 204 || response.headers.get('Content-Length') === '0') {\n          let emptyData: any;\n          switch (parseAs) {\n            case 'arrayBuffer':\n            case 'blob':\n            case 'text':\n              emptyData = await response[parseAs]();\n              break;\n            case 'formData':\n              emptyData = new FormData();\n              break;\n            case 'stream':\n              emptyData = response.body;\n              break;\n            case 'json':\n            default:\n              emptyData = {};\n              break;\n          }\n          return opts.responseStyle === 'data'\n            ? emptyData\n            : {\n                data: emptyData,\n                ...result,\n              };\n        }\n\n        let data: any;\n        switch (parseAs) {\n          case 'arrayBuffer':\n          case 'blob':\n          case 'formData':\n          case 'text':\n            data = await response[parseAs]();\n            break;\n          case 'json': {\n            // Some servers return 200 with no Content-Length and empty body.\n            // response.json() would throw; read as text and parse if non-empty.\n            const text = await response.text();\n            data = text ? JSON.parse(text) : {};\n            break;\n          }\n          case 'stream':\n            return opts.responseStyle === 'data'\n              ? response.body\n              : {\n                  data: response.body,\n                  ...result,\n                };\n        }\n\n        if (parseAs === 'json') {\n          if (opts.responseValidator) {\n            await opts.responseValidator(data);\n          }\n\n          if (opts.responseTransformer) {\n            data = await opts.responseTransformer(data);\n          }\n        }\n\n        return opts.responseStyle === 'data'\n          ? data\n          : {\n              data,\n              ...result,\n            };\n      }\n\n      const textError = await response.text();\n      let jsonError: unknown;\n\n      try {\n        jsonError = JSON.parse(textError);\n      } catch {\n        // noop\n      }\n\n      throw jsonError ?? textError;\n    } catch (error) {\n      let finalError = error;\n\n      for (const fn of interceptors.error.fns) {\n        if (fn) {\n          finalError = await fn(finalError, response, request, options as ResolvedRequestOptions);\n        }\n      }\n\n      finalError = finalError || {};\n\n      if (throwOnError) {\n        throw finalError;\n      }\n\n      // TODO: we probably want to return error and improve types\n      return responseStyle === 'data'\n        ? undefined\n        : {\n            error: finalError,\n            request,\n            response,\n          };\n    }\n  };\n\n  const makeMethodFn = (method: Uppercase<HttpMethod>) => (options: RequestOptions) =>\n    request({ ...options, method });\n\n  const makeSseFn = (method: Uppercase<HttpMethod>) => async (options: RequestOptions) => {\n    const { opts, url } = await beforeRequest(options);\n    return createSseClient({\n      ...opts,\n      body: opts.body as BodyInit | null | undefined,\n      method,\n      onRequest: async (url, init) => {\n        let request = new Request(url, init);\n        for (const fn of interceptors.request.fns) {\n          if (fn) {\n            request = await fn(request, opts);\n          }\n        }\n        return request;\n      },\n      serializedBody: getValidRequestBody(opts) as BodyInit | null | undefined,\n      url,\n    });\n  };\n\n  const _buildUrl: Client['buildUrl'] = (options) => buildUrl({ ..._config, ...options });\n\n  return {\n    buildUrl: _buildUrl,\n    connect: makeMethodFn('CONNECT'),\n    delete: makeMethodFn('DELETE'),\n    get: makeMethodFn('GET'),\n    getConfig,\n    head: makeMethodFn('HEAD'),\n    interceptors,\n    options: makeMethodFn('OPTIONS'),\n    patch: makeMethodFn('PATCH'),\n    post: makeMethodFn('POST'),\n    put: makeMethodFn('PUT'),\n    request,\n    setConfig,\n    sse: {\n      connect: makeSseFn('CONNECT'),\n      delete: makeSseFn('DELETE'),\n      get: makeSseFn('GET'),\n      head: makeSseFn('HEAD'),\n      options: makeSseFn('OPTIONS'),\n      patch: makeSseFn('PATCH'),\n      post: makeSseFn('POST'),\n      put: makeSseFn('PUT'),\n      trace: makeSseFn('TRACE'),\n    },\n    trace: makeMethodFn('TRACE'),\n  } as Client;\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport { type Client, type ClientOptions, type Config, createClient, createConfig } from './client';\nimport type { ClientOptions as ClientOptions2 } from './types.gen';\n\n/**\n * The `createClientConfig()` function will be called on client initialization\n * and the returned object will become the client's initial configuration.\n *\n * You may want to initialize your client this way instead of calling\n * `setConfig()`. This is useful for example if you're using Next.js\n * to ensure your client always has the correct values.\n */\nexport type CreateClientConfig<T extends ClientOptions = ClientOptions2> = (override?: Config<ClientOptions & T>) => Config<Required<ClientOptions> & T>;\n\nexport const client: Client = createClient(createConfig<ClientOptions2>({ baseUrl: 'http://localhost:8000' }));\n\n// auto-init: install auth on client\nimport { installAuthOnClient } from './helpers/auth';\ninstallAuthOnClient(client);\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport { type Client, type ClientMeta, formDataBodySerializer, type Options as Options2, type RequestResult, type TDataShape } from './client';\nimport { client } from './client.gen';\nimport type { CfgAccountsApiKeyRegenerateCreateData, CfgAccountsApiKeyRegenerateCreateErrors, CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRetrieveData, CfgAccountsApiKeyRetrieveErrors, CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRevealCreateData, CfgAccountsApiKeyRevealCreateErrors, CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyTestCreateData, CfgAccountsApiKeyTestCreateResponses, CfgAccountsOauthConnectionsListData, CfgAccountsOauthConnectionsListResponses, CfgAccountsOauthDisconnectCreateData, CfgAccountsOauthDisconnectCreateErrors, CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthGithubAuthorizeCreateData, CfgAccountsOauthGithubAuthorizeCreateErrors, CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubCallbackCreateData, CfgAccountsOauthGithubCallbackCreateErrors, CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthGoogleAuthorizeCreateData, CfgAccountsOauthGoogleAuthorizeCreateErrors, CfgAccountsOauthGoogleAuthorizeCreateResponses, CfgAccountsOauthGoogleCallbackCreateData, CfgAccountsOauthGoogleCallbackCreateErrors, CfgAccountsOauthGoogleCallbackCreateResponses, CfgAccountsOauthProvidersRetrieveData, CfgAccountsOauthProvidersRetrieveResponses, CfgAccountsOtpConsentPolicyRetrieveData, CfgAccountsOtpConsentPolicyRetrieveResponses, CfgAccountsOtpRequestCreateData, CfgAccountsOtpRequestCreateErrors, CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpVerifyCreateData, CfgAccountsOtpVerifyCreateErrors, CfgAccountsOtpVerifyCreateResponses, CfgAccountsProfileAvatarCreateData, CfgAccountsProfileAvatarCreateErrors, CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileDeleteCreateData, CfgAccountsProfileDeleteCreateErrors, CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfilePartialPartialUpdateData, CfgAccountsProfilePartialPartialUpdateErrors, CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialUpdateData, CfgAccountsProfilePartialUpdateErrors, CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfileRetrieveData, CfgAccountsProfileRetrieveErrors, CfgAccountsProfileRetrieveResponses, CfgAccountsProfileUpdatePartialUpdateData, CfgAccountsProfileUpdatePartialUpdateErrors, CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdateUpdateData, CfgAccountsProfileUpdateUpdateErrors, CfgAccountsProfileUpdateUpdateResponses, CfgAccountsTokenBlacklistCreateData, CfgAccountsTokenBlacklistCreateResponses, CfgAccountsTokenCreateData, CfgAccountsTokenCreateErrors, CfgAccountsTokenCreateResponses, CfgAccountsTokenRefreshCreateData, CfgAccountsTokenRefreshCreateResponses, CfgTotpBackupCodesRegenerateCreateData, CfgTotpBackupCodesRegenerateCreateErrors, CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRetrieveData, CfgTotpBackupCodesRetrieveResponses, CfgTotpDevicesDestroyData, CfgTotpDevicesDestroyResponses, CfgTotpDevicesRetrieveData, CfgTotpDevicesRetrieveResponses, CfgTotpDisableCreateData, CfgTotpDisableCreateErrors, CfgTotpDisableCreateResponses, CfgTotpSetupConfirmCreateData, CfgTotpSetupConfirmCreateErrors, CfgTotpSetupConfirmCreateResponses, CfgTotpSetupCreateData, CfgTotpSetupCreateErrors, CfgTotpSetupCreateResponses, CfgTotpVerifyBackupCreateData, CfgTotpVerifyBackupCreateErrors, CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyCreateData, CfgTotpVerifyCreateErrors, CfgTotpVerifyCreateResponses } from './types.gen';\n\nexport type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {\n    /**\n     * You can provide a client instance returned by `createClient()` instead of\n     * individual options. This might be also useful if you want to implement a\n     * custom client.\n     */\n    client?: Client;\n    /**\n     * You can pass arbitrary values through the `meta` object. This can be\n     * used to access values that aren't defined as part of the SDK function.\n     */\n    meta?: keyof ClientMeta extends never ? Record<string, unknown> : ClientMeta;\n};\n\nexport class CfgAccountsApiKey {\n    /**\n     * Get API key details\n     *\n     * Retrieve the current user's API key (masked) and metadata.\n     */\n    public static cfgAccountsApiKeyRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsApiKeyRetrieveData, ThrowOnError>): RequestResult<CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRetrieveErrors, ThrowOnError> {\n        return (options?.client ?? client).get<CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRetrieveErrors, ThrowOnError>({\n            security: [\n                { scheme: 'bearer', type: 'http' },\n                {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                },\n                { name: 'X-API-Key', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/api-key/',\n            ...options\n        });\n    }\n\n    /**\n     * Regenerate API key\n     *\n     * Generate a new API key. The full key is returned only once.\n     */\n    public static cfgAccountsApiKeyRegenerateCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsApiKeyRegenerateCreateData, ThrowOnError>): RequestResult<CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRegenerateCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRegenerateCreateErrors, ThrowOnError>({\n            security: [\n                { scheme: 'bearer', type: 'http' },\n                {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                },\n                { name: 'X-API-Key', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/api-key/regenerate/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Reveal API key\n     *\n     * Return the current full API key WITHOUT rotating it. The same durable value every one of the user's agents uses — for the signed-in user to copy and paste into agent onboarding. Default GET stays masked; this is the explicit reveal action.\n     */\n    public static cfgAccountsApiKeyRevealCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsApiKeyRevealCreateData, ThrowOnError>): RequestResult<CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyRevealCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyRevealCreateErrors, ThrowOnError>({\n            security: [\n                { scheme: 'bearer', type: 'http' },\n                {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                },\n                { name: 'X-API-Key', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/api-key/reveal/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Test API key\n     *\n     * Test whether an API key is valid without consuming it.\n     */\n    public static cfgAccountsApiKeyTestCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsApiKeyTestCreateData, ThrowOnError>): RequestResult<CfgAccountsApiKeyTestCreateResponses, unknown, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsApiKeyTestCreateResponses, unknown, ThrowOnError>({\n            security: [\n                { scheme: 'bearer', type: 'http' },\n                {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                },\n                { name: 'X-API-Key', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/api-key/test/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n}\n\nexport class CfgAccountsOauth {\n    /**\n     * List OAuth connections\n     *\n     * Get all OAuth connections for the current user.\n     */\n    public static cfgAccountsOauthConnectionsList<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthConnectionsListData, ThrowOnError>): RequestResult<CfgAccountsOauthConnectionsListResponses, unknown, ThrowOnError> {\n        return (options?.client ?? client).get<CfgAccountsOauthConnectionsListResponses, unknown, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/oauth/connections/',\n            ...options\n        });\n    }\n\n    /**\n     * Disconnect OAuth provider\n     *\n     * Remove OAuth connection for the specified provider.\n     */\n    public static cfgAccountsOauthDisconnectCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOauthDisconnectCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthDisconnectCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthDisconnectCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/oauth/disconnect/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Start GitHub OAuth\n     *\n     * Generate the GitHub authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.\n     */\n    public static cfgAccountsOauthGithubAuthorizeCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthGithubAuthorizeCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubAuthorizeCreateErrors, ThrowOnError> {\n        return (options?.client ?? client).post<CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubAuthorizeCreateErrors, ThrowOnError>({\n            url: '/cfg/accounts/oauth/github/authorize/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options?.headers\n            }\n        });\n    }\n\n    /**\n     * Complete GitHub OAuth\n     *\n     * Exchange the authorization code for JWT tokens. Call this after GitHub redirects back with a code. The state is single use.\n     */\n    public static cfgAccountsOauthGithubCallbackCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOauthGithubCallbackCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthGithubCallbackCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthGithubCallbackCreateErrors, ThrowOnError>({\n            url: '/cfg/accounts/oauth/github/callback/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Start Google OAuth\n     *\n     * Generate the Google authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.\n     */\n    public static cfgAccountsOauthGoogleAuthorizeCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthGoogleAuthorizeCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGoogleAuthorizeCreateResponses, CfgAccountsOauthGoogleAuthorizeCreateErrors, ThrowOnError> {\n        return (options?.client ?? client).post<CfgAccountsOauthGoogleAuthorizeCreateResponses, CfgAccountsOauthGoogleAuthorizeCreateErrors, ThrowOnError>({\n            url: '/cfg/accounts/oauth/google/authorize/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options?.headers\n            }\n        });\n    }\n\n    /**\n     * Complete Google OAuth\n     *\n     * Exchange the authorization code for JWT tokens. Call this after Google redirects back with a code. The state is single use.\n     */\n    public static cfgAccountsOauthGoogleCallbackCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOauthGoogleCallbackCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGoogleCallbackCreateResponses, CfgAccountsOauthGoogleCallbackCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsOauthGoogleCallbackCreateResponses, CfgAccountsOauthGoogleCallbackCreateErrors, ThrowOnError>({\n            url: '/cfg/accounts/oauth/google/callback/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * List OAuth providers\n     *\n     * Providers that are configured, in display order. The login screen shows exactly these buttons.\n     */\n    public static cfgAccountsOauthProvidersRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthProvidersRetrieveData, ThrowOnError>): RequestResult<CfgAccountsOauthProvidersRetrieveResponses, unknown, ThrowOnError> {\n        return (options?.client ?? client).get<CfgAccountsOauthProvidersRetrieveResponses, unknown, ThrowOnError>({ url: '/cfg/accounts/oauth/providers/', ...options });\n    }\n}\n\nexport class CfgAccountsOtp {\n    /**\n     * Marketing-consent checkbox policy for the caller's jurisdiction.\n     *\n     * Derived from the edge-provided CF-IPCountry — the same signal stored\n     * as consent evidence at request time. Unknown country fails safe to\n     * \"unchecked\".\n     */\n    public static cfgAccountsOtpConsentPolicyRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOtpConsentPolicyRetrieveData, ThrowOnError>): RequestResult<CfgAccountsOtpConsentPolicyRetrieveResponses, unknown, ThrowOnError> {\n        return (options?.client ?? client).get<CfgAccountsOtpConsentPolicyRetrieveResponses, unknown, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/otp/consent-policy/',\n            ...options\n        });\n    }\n\n    /**\n     * Request OTP code to email.\n     */\n    public static cfgAccountsOtpRequestCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOtpRequestCreateData, ThrowOnError>): RequestResult<CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpRequestCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpRequestCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/otp/request/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Verify OTP code and return JWT tokens or 2FA session.\n     *\n     * If user has 2FA enabled:\n     * - Returns requires_2fa=True with session_id\n     * - Client must complete 2FA verification at /cfg/totp/verify/\n     *\n     * If user has no 2FA:\n     * - Returns JWT tokens and user data directly\n     */\n    public static cfgAccountsOtpVerifyCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOtpVerifyCreateData, ThrowOnError>): RequestResult<CfgAccountsOtpVerifyCreateResponses, CfgAccountsOtpVerifyCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsOtpVerifyCreateResponses, CfgAccountsOtpVerifyCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/otp/verify/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n}\n\nexport class CfgAccountsProfile {\n    /**\n     * Get current user profile\n     *\n     * Retrieve the current authenticated user's profile information.\n     */\n    public static cfgAccountsProfileRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileRetrieveData, ThrowOnError>): RequestResult<CfgAccountsProfileRetrieveResponses, CfgAccountsProfileRetrieveErrors, ThrowOnError> {\n        return (options?.client ?? client).get<CfgAccountsProfileRetrieveResponses, CfgAccountsProfileRetrieveErrors, ThrowOnError>({\n            security: [{ scheme: 'bearer', type: 'http' }, {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                }],\n            url: '/cfg/accounts/profile/',\n            ...options\n        });\n    }\n\n    /**\n     * Upload user avatar\n     *\n     * Upload avatar image for the current authenticated user. Accepts multipart/form-data with 'avatar' field.\n     */\n    public static cfgAccountsProfileAvatarCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileAvatarCreateData, ThrowOnError>): RequestResult<CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileAvatarCreateErrors, ThrowOnError> {\n        return (options?.client ?? client).post<CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileAvatarCreateErrors, ThrowOnError>({\n            ...formDataBodySerializer,\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/profile/avatar/',\n            ...options,\n            headers: {\n                'Content-Type': null,\n                ...options?.headers\n            }\n        });\n    }\n\n    /**\n     * Delete user account\n     *\n     *\n     * Permanently delete the current user's account.\n     *\n     * This operation:\n     * - Deactivates the account (user cannot log in)\n     * - Anonymizes personal data (GDPR compliance)\n     * - Frees up the email address for re-registration\n     * - Preserves audit trail\n     *\n     * The account can be restored by an administrator if needed.\n     *\n     */\n    public static cfgAccountsProfileDeleteCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileDeleteCreateData, ThrowOnError>): RequestResult<CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfileDeleteCreateErrors, ThrowOnError> {\n        return (options?.client ?? client).post<CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfileDeleteCreateErrors, ThrowOnError>({\n            security: [{ scheme: 'bearer', type: 'http' }, {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                }],\n            url: '/cfg/accounts/profile/delete/',\n            ...options\n        });\n    }\n\n    /**\n     * Partial update user profile\n     *\n     * Partially update the current authenticated user's profile information. Supports avatar upload.\n     */\n    public static cfgAccountsProfilePartialPartialUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfilePartialPartialUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialPartialUpdateErrors, ThrowOnError> {\n        return (options?.client ?? client).patch<CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialPartialUpdateErrors, ThrowOnError>({\n            security: [{ scheme: 'bearer', type: 'http' }, {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                }],\n            url: '/cfg/accounts/profile/partial/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options?.headers\n            }\n        });\n    }\n\n    /**\n     * Partial update user profile\n     *\n     * Partially update the current authenticated user's profile information. Supports avatar upload.\n     */\n    public static cfgAccountsProfilePartialUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfilePartialUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfilePartialUpdateErrors, ThrowOnError> {\n        return (options?.client ?? client).put<CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfilePartialUpdateErrors, ThrowOnError>({\n            security: [{ scheme: 'bearer', type: 'http' }, {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                }],\n            url: '/cfg/accounts/profile/partial/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options?.headers\n            }\n        });\n    }\n\n    /**\n     * Update user profile\n     *\n     * Update the current authenticated user's profile information.\n     */\n    public static cfgAccountsProfileUpdatePartialUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileUpdatePartialUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdatePartialUpdateErrors, ThrowOnError> {\n        return (options?.client ?? client).patch<CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdatePartialUpdateErrors, ThrowOnError>({\n            security: [{ scheme: 'bearer', type: 'http' }, {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                }],\n            url: '/cfg/accounts/profile/update/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options?.headers\n            }\n        });\n    }\n\n    /**\n     * Update user profile\n     *\n     * Update the current authenticated user's profile information.\n     */\n    public static cfgAccountsProfileUpdateUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileUpdateUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfileUpdateUpdateResponses, CfgAccountsProfileUpdateUpdateErrors, ThrowOnError> {\n        return (options?.client ?? client).put<CfgAccountsProfileUpdateUpdateResponses, CfgAccountsProfileUpdateUpdateErrors, ThrowOnError>({\n            security: [{ scheme: 'bearer', type: 'http' }, {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                }],\n            url: '/cfg/accounts/profile/update/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options?.headers\n            }\n        });\n    }\n}\n\nexport class CfgAccountsAuth {\n    /**\n     * Obtain a JWT pair with email + password.\n     *\n     * Returns the same envelope as OTP verify: either ``requires_2fa=True`` with\n     * a session id, or the token pair plus the user object. Failures are uniform\n     * (401 ``invalid_credentials``) whether the email is unknown, the password is\n     * wrong, or the account is inactive/soft-deleted — no enumeration.\n     */\n    public static cfgAccountsTokenCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsTokenCreateData, ThrowOnError>): RequestResult<CfgAccountsTokenCreateResponses, CfgAccountsTokenCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsTokenCreateResponses, CfgAccountsTokenCreateErrors, ThrowOnError>({\n            url: '/cfg/accounts/token/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Revoke a refresh token (logout).\n     *\n     * Blacklists the posted refresh token so it can never mint another access\n     * token. Called best-effort by the client's logout — without it, \"logout\"\n     * is purely client-side and a stolen refresh token survives until expiry.\n     */\n    public static cfgAccountsTokenBlacklistCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsTokenBlacklistCreateData, ThrowOnError>): RequestResult<CfgAccountsTokenBlacklistCreateResponses, unknown, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsTokenBlacklistCreateResponses, unknown, ThrowOnError>({\n            url: '/cfg/accounts/token/blacklist/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Refresh JWT token.\n     *\n     * DPoP-aware: when the incoming refresh token is key-bound (`cnf.jkt`), the\n     * rotated access/refresh in the response are re-stamped with the same `cnf`\n     * (stock SimpleJWT drops it from the derived access), and a matching DPoP\n     * proof is required on the refresh request — so a stolen refresh token can't\n     * be used to mint fresh tokens.\n     */\n    public static cfgAccountsTokenRefreshCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsTokenRefreshCreateData, ThrowOnError>): RequestResult<CfgAccountsTokenRefreshCreateResponses, unknown, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsTokenRefreshCreateResponses, unknown, ThrowOnError>({\n            url: '/cfg/accounts/token/refresh/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n}\n\nexport class CfgTotpBackupCodes {\n    /**\n     * Get backup codes status for user.\n     */\n    public static cfgTotpBackupCodesRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgTotpBackupCodesRetrieveData, ThrowOnError>): RequestResult<CfgTotpBackupCodesRetrieveResponses, unknown, ThrowOnError> {\n        return (options?.client ?? client).get<CfgTotpBackupCodesRetrieveResponses, unknown, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/backup-codes/',\n            ...options\n        });\n    }\n\n    /**\n     * Regenerate backup codes.\n     *\n     * Requires TOTP code for verification.\n     * Invalidates all existing codes.\n     */\n    public static cfgTotpBackupCodesRegenerateCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpBackupCodesRegenerateCreateData, ThrowOnError>): RequestResult<CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRegenerateCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRegenerateCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/backup-codes/regenerate/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n}\n\nexport class CfgTotp {\n    /**\n     * List all TOTP devices for user.\n     */\n    public static cfgTotpDevicesRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgTotpDevicesRetrieveData, ThrowOnError>): RequestResult<CfgTotpDevicesRetrieveResponses, unknown, ThrowOnError> {\n        return (options?.client ?? client).get<CfgTotpDevicesRetrieveResponses, unknown, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/devices/',\n            ...options\n        });\n    }\n\n    /**\n     * Delete a TOTP device.\n     *\n     * Requires verification code if removing the last/primary device.\n     */\n    public static cfgTotpDevicesDestroy<ThrowOnError extends boolean = false>(options: Options<CfgTotpDevicesDestroyData, ThrowOnError>): RequestResult<CfgTotpDevicesDestroyResponses, unknown, ThrowOnError> {\n        return (options.client ?? client).delete<CfgTotpDevicesDestroyResponses, unknown, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/devices/{id}/',\n            ...options\n        });\n    }\n\n    /**\n     * Completely disable 2FA for account.\n     *\n     * Requires verification code.\n     */\n    public static cfgTotpDisableCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpDisableCreateData, ThrowOnError>): RequestResult<CfgTotpDisableCreateResponses, CfgTotpDisableCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgTotpDisableCreateResponses, CfgTotpDisableCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/disable/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n}\n\nexport class CfgTotpSetup {\n    /**\n     * Start 2FA setup process.\n     *\n     * Creates a new TOTP device and returns QR code for scanning.\n     */\n    public static cfgTotpSetupCreate<ThrowOnError extends boolean = false>(options?: Options<CfgTotpSetupCreateData, ThrowOnError>): RequestResult<CfgTotpSetupCreateResponses, CfgTotpSetupCreateErrors, ThrowOnError> {\n        return (options?.client ?? client).post<CfgTotpSetupCreateResponses, CfgTotpSetupCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/setup/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options?.headers\n            }\n        });\n    }\n\n    /**\n     * Confirm 2FA setup with first valid code.\n     *\n     * Activates the device and generates backup codes.\n     */\n    public static cfgTotpSetupConfirmCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpSetupConfirmCreateData, ThrowOnError>): RequestResult<CfgTotpSetupConfirmCreateResponses, CfgTotpSetupConfirmCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgTotpSetupConfirmCreateResponses, CfgTotpSetupConfirmCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/setup/confirm/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n}\n\nexport class CfgTotpVerify {\n    /**\n     * Verify TOTP code for 2FA session.\n     *\n     * Completes authentication and returns JWT tokens on success.\n     */\n    public static cfgTotpVerifyCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpVerifyCreateData, ThrowOnError>): RequestResult<CfgTotpVerifyCreateResponses, CfgTotpVerifyCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgTotpVerifyCreateResponses, CfgTotpVerifyCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/verify/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Verify backup recovery code for 2FA session.\n     *\n     * Alternative verification method when TOTP device unavailable.\n     */\n    public static cfgTotpVerifyBackupCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpVerifyBackupCreateData, ThrowOnError>): RequestResult<CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyBackupCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyBackupCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/verify/backup/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n}\n","import { isDev } from \"./env\";\n/**\n * Auth analytics — a dependency-free SINK, not an implementation.\n *\n * `@djangocfg/api` cannot depend on `@djangocfg/analytics`: analytics reads auth\n * state (to attribute events to a signed-in user), so importing it here would\n * close a dependency cycle. Instead this module owns the *interface* and lets a\n * real implementation be injected at runtime — `@djangocfg/analytics` calls\n * `setAnalyticsSink()` when its provider mounts.\n *\n * Before this, the object below was a hardcoded stub that console.logged in dev\n * and did NOTHING in production. Every auth event it \"tracked\" —\n * AUTH_LOGIN_SUCCESS, AUTH_OAUTH_FAIL, AUTH_SESSION_EXPIRED — was silently\n * discarded. The events were fired, the calls looked right, and nothing ever\n * arrived anywhere.\n */\n\nexport enum AnalyticsEvent {\n  AUTH_OTP_REQUEST = 'auth_otp_request',\n  AUTH_LOGIN_SUCCESS = 'auth_login_success',\n  AUTH_OTP_VERIFY_FAIL = 'auth_otp_verify_fail',\n  AUTH_PASSWORD_LOGIN_FAIL = 'auth_password_login_fail',\n  AUTH_SESSION_EXPIRED = 'auth_session_expired',\n  AUTH_TOKEN_REFRESH = 'auth_token_refresh',\n  AUTH_TOKEN_REFRESH_FAIL = 'auth_token_refresh_fail',\n  AUTH_LOGOUT = 'auth_logout',\n  AUTH_OAUTH_START = 'auth_oauth_start',\n  AUTH_OAUTH_FAIL = 'auth_oauth_fail',\n}\n\nexport enum AnalyticsCategory {\n  AUTH = 'auth',\n}\n\nexport type AnalyticsEventType = `${AnalyticsEvent}`;\nexport type AnalyticsCategoryType = `${AnalyticsCategory}`;\n\n/**\n * What an analytics backend can actually carry.\n *\n * GA4 and OpenPanel serialise a property to a scalar; an object or a function\n * arrives as \"[object Object]\" without erroring anywhere. Declaring the wider\n * `unknown` here promised a forwarding guarantee no implementation keeps, and\n * it made this sink incompatible with `AnalyticsEventProperties` in\n * `@djangocfg/analytics` — the two describe the same channel and must agree.\n * Kept as a local declaration rather than an import: `api` does not depend on\n * `analytics`, and one shared four-member union is not worth that edge.\n */\nexport type AnalyticsPropertyValue = string | number | boolean | null;\n\ninterface AnalyticsEventParams {\n  category?: AnalyticsCategoryType;\n  label?: string;\n  value?: number;\n  // Extra dimensions vary per event; the sink only forwards them.\n  [key: string]: AnalyticsPropertyValue | undefined;\n}\n\n/** What an analytics implementation must provide to receive auth events. */\nexport interface AnalyticsSink {\n  // `| undefined` in the value: an optional dimension that was not supplied\n  // reaches the sink as an explicit `undefined`, which every backend already\n  // treats as absent. Excluding it would reject the caller below.\n  event(\n    name: string,\n    params?: Record<string, AnalyticsPropertyValue | undefined>,\n  ): void;\n  setUser(userId: string | null): void;\n}\n\nlet sink: AnalyticsSink | null = null;\n\n/**\n * Install the real analytics implementation.\n *\n * Called by `@djangocfg/analytics` when its provider mounts. Pass `null` to\n * uninstall (on unmount), so a torn-down provider does not keep receiving events.\n */\nexport function setAnalyticsSink(next: AnalyticsSink | null): void {\n  sink = next;\n}\n\nexport const Analytics = {\n  /** Track an auth event. Delivered to the installed sink, if any. */\n  event(eventName: AnalyticsEventType, params?: AnalyticsEventParams) {\n    if (sink) {\n      sink.event(eventName, params);\n      return;\n    }\n    // No sink installed: the app is not using @djangocfg/analytics. Say so in\n    // dev rather than pretending the event went somewhere.\n    if (isDev) {\n      console.log('[Analytics:no-sink]', eventName, params);\n    }\n  },\n\n  /** Attach the signed-in user. Pass null on logout. */\n  setUser(userId: string | null) {\n    if (sink) {\n      sink.setUser(userId);\n      return;\n    }\n    if (isDev) {\n      console.log('[Analytics:no-sink] Set user:', userId);\n    }\n  },\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\nexport type ClientOptions = {\n    baseUrl: 'http://localhost:8000' | (string & {});\n};\n\n/**\n * Serializer for API key response (masked).\n */\nexport type ApiKey = {\n    /**\n     * Masked API key\n     */\n    key: string;\n    /**\n     * When the key was last regenerated\n     */\n    reissued_at: string | null;\n    /**\n     * When the key was created\n     */\n    created_at: string;\n};\n\n/**\n * Serializer for API key regeneration response (full key shown once).\n */\nexport type ApiKeyRegenerate = {\n    /**\n     * New API key (shown only once)\n     */\n    key: string;\n    /**\n     * When the key was regenerated\n     */\n    reissued_at: string;\n};\n\n/**\n * Serializer for API key response (masked).\n */\nexport type ApiKeyRequest = {\n    /**\n     * Masked API key\n     */\n    key: string;\n    /**\n     * When the key was last regenerated\n     */\n    reissued_at: string | null;\n    /**\n     * When the key was created\n     */\n    created_at: string;\n};\n\n/**\n * Serializer for revealing the current (unrotated) full API key.\n */\nexport type ApiKeyReveal = {\n    /**\n     * Full API key (current value, not rotated)\n     */\n    key: string;\n    /**\n     * When the key was created\n     */\n    created_at: string;\n    /**\n     * When the key was last regenerated\n     */\n    reissued_at: string | null;\n};\n\n/**\n * Serializer for testing an API key.\n */\nexport type ApiKeyTestRequest = {\n    /**\n     * API key to test\n     */\n    key: string;\n};\n\n/**\n * Serializer for API key test result.\n */\nexport type ApiKeyTestResult = {\n    /**\n     * Whether the key is valid\n     */\n    valid: boolean;\n    /**\n     * User ID if valid, null otherwise\n     */\n    user_id: string | null;\n};\n\n/**\n * Response serializer for account deletion.\n */\nexport type AccountDeleteResponse = {\n    /**\n     * Whether the account was successfully deleted\n     */\n    success: boolean;\n    /**\n     * Human-readable message about the deletion\n     */\n    message: string;\n};\n\n/**\n * Serializer for regenerating backup codes.\n */\nexport type BackupCodesRegenerateRequest = {\n    /**\n     * TOTP code for verification\n     */\n    code: string;\n};\n\n/**\n * Response serializer for backup codes regeneration.\n */\nexport type BackupCodesRegenerateResponse = {\n    /**\n     * List of new backup codes (save these!)\n     */\n    backup_codes: Array<string>;\n    /**\n     * Warning about previous codes being invalidated\n     */\n    warning: string;\n};\n\n/**\n * Serializer for backup codes status.\n */\nexport type BackupCodesStatus = {\n    /**\n     * Number of unused backup codes\n     */\n    remaining_count: number;\n    /**\n     * Total number of codes generated\n     */\n    total_generated: number;\n    /**\n     * Warning if running low on codes\n     */\n    warning?: string | null;\n};\n\n/**\n * Serializer for updating user profile.\n */\nexport type CfgUserUpdateRequest = {\n    first_name?: string;\n    last_name?: string;\n    company?: string;\n    phone?: string;\n    position?: string;\n    language?: string;\n    /**\n     * IANA timezone name (e.g. 'Asia/Seoul'). Auto-detected from browser via X-Timezone header.\n     */\n    timezone?: string;\n};\n\n/**\n * Serializer for confirming 2FA setup with first code.\n */\nexport type ConfirmSetupRequest = {\n    /**\n     * Device ID from setup response\n     */\n    device_id: string;\n    /**\n     * 6-digit TOTP code from authenticator app\n     */\n    code: string;\n};\n\n/**\n * Response serializer for setup confirmation.\n */\nexport type ConfirmSetupResponse = {\n    message: string;\n    /**\n     * List of backup recovery codes (save these!)\n     */\n    backup_codes: Array<string>;\n    /**\n     * Warning message about backup codes\n     */\n    backup_codes_warning: string;\n};\n\n/**\n * Marketing-consent UI policy derived from the request's geo context.\n */\nexport type ConsentPolicy = {\n    /**\n     * Country code seen by the edge (CF-IPCountry), '' if unknown\n     */\n    country: string;\n    /**\n     * Default state for the marketing-consent checkbox\n     *\n     * * `checked` - checked\n     * * `unchecked` - unchecked\n     */\n    marketing_consent_default: MarketingConsentDefaultEnum;\n};\n\n/**\n * Serializer for listing TOTP devices.\n */\nexport type DeviceList = {\n    readonly id: string;\n    /**\n     * Device name for identification\n     */\n    readonly name: string;\n    /**\n     * Primary device used for verification\n     */\n    readonly is_primary: boolean;\n    readonly status: DeviceStatusEnum;\n    readonly created_at: string;\n    /**\n     * When device setup was confirmed\n     */\n    readonly confirmed_at: string | null;\n    /**\n     * Last successful verification\n     */\n    readonly last_used_at: string | null;\n};\n\n/**\n * Response serializer for device list endpoint.\n */\nexport type DeviceListResponse = {\n    devices: Array<DeviceList>;\n    has_2fa_enabled: boolean;\n};\n\n/**\n * * `pending` - Pending Confirmation\n * * `active` - Active\n * * `disabled` - Disabled\n */\nexport enum DeviceStatusEnum {\n    PENDING = 'pending',\n    ACTIVE = 'active',\n    DISABLED = 'disabled'\n}\n\n/**\n * Serializer for completely disabling 2FA.\n */\nexport type DisableRequest = {\n    /**\n     * TOTP code for verification\n     */\n    code: string;\n};\n\n/**\n * * `checked` - checked\n * * `unchecked` - unchecked\n */\nexport enum MarketingConsentDefaultEnum {\n    CHECKED = 'checked',\n    UNCHECKED = 'unchecked'\n}\n\n/**\n * Request to start OAuth flow.\n */\nexport type OAuthAuthorizeRequestRequest = {\n    /**\n     * Optional. Must be `<origin>/auth?provider=<id>` for an origin of the resolved site; anything else is rejected with `origin_not_allowed`. Omit it: the server derives it from the request Origin.\n     */\n    redirect_uri?: string;\n    /**\n     * Optional source URL for registration tracking\n     */\n    source_url?: string;\n};\n\n/**\n * Response with OAuth authorization URL.\n */\nexport type OAuthAuthorizeResponse = {\n    /**\n     * Full URL to redirect user to OAuth provider\n     */\n    authorization_url: string;\n    /**\n     * State token for CSRF protection. Store this and verify on callback.\n     */\n    state: string;\n};\n\n/**\n * Request to complete OAuth flow (callback handler).\n */\nexport type OAuthCallbackRequestRequest = {\n    /**\n     * Authorization code from OAuth provider callback\n     */\n    code: string;\n    /**\n     * State token from the authorize response; single use\n     */\n    state: string;\n    /**\n     * Ignored. The server reuses the redirect URI stored with the state.\n     */\n    redirect_uri?: string;\n};\n\n/**\n * Serializer for OAuth connection info (user-facing).\n */\nexport type OAuthConnection = {\n    readonly id: number;\n    /**\n     * OAuth provider name (github, google, etc.)\n     *\n     * * `github` - GitHub\n     * * `google` - Google\n     */\n    readonly provider: OAuthProviderEnum;\n    readonly provider_display: string;\n    /**\n     * Username on the OAuth provider platform\n     */\n    readonly provider_username: string;\n    /**\n     * Email from OAuth provider (may differ from user.email)\n     */\n    readonly provider_email: string;\n    /**\n     * Avatar URL from OAuth provider\n     */\n    readonly provider_avatar_url: string;\n    /**\n     * When this OAuth connection was created\n     */\n    readonly connected_at: string;\n    /**\n     * Last time this OAuth connection was used for login\n     */\n    readonly last_login_at: string;\n};\n\n/**\n * Request to disconnect OAuth provider.\n */\nexport type OAuthDisconnectRequestRequest = {\n    /**\n     * OAuth provider to disconnect\n     *\n     * * `github` - GitHub\n     * * `google` - Google\n     */\n    provider: OAuthProviderEnum;\n};\n\n/**\n * Error response for OAuth endpoints.\n */\nexport type OAuthError = {\n    /**\n     * Error code (closed set)\n     *\n     * * `oauth_disabled` - oauth_disabled\n     * * `github_oauth_disabled` - github_oauth_disabled\n     * * `origin_not_allowed` - origin_not_allowed\n     * * `missing_redirect_uri` - missing_redirect_uri\n     * * `invalid_state` - invalid_state\n     * * `oauth_exchange_failed` - oauth_exchange_failed\n     * * `invalid_id_token` - invalid_id_token\n     * * `email_missing` - email_missing\n     * * `email_not_verified` - email_not_verified\n     * * `hosted_domain_not_allowed` - hosted_domain_not_allowed\n     * * `account_inactive` - account_inactive\n     * * `link_not_allowed` - link_not_allowed\n     * * `rate_limited` - rate_limited\n     * * `provider_unavailable` - provider_unavailable\n     * * `server_error` - server_error\n     * * `not_found` - not_found\n     */\n    error: OAuthErrorCodeEnum;\n    /**\n     * Human-readable error description\n     */\n    error_description?: string;\n};\n\n/**\n * * `oauth_disabled` - oauth_disabled\n * * `github_oauth_disabled` - github_oauth_disabled\n * * `origin_not_allowed` - origin_not_allowed\n * * `missing_redirect_uri` - missing_redirect_uri\n * * `invalid_state` - invalid_state\n * * `oauth_exchange_failed` - oauth_exchange_failed\n * * `invalid_id_token` - invalid_id_token\n * * `email_missing` - email_missing\n * * `email_not_verified` - email_not_verified\n * * `hosted_domain_not_allowed` - hosted_domain_not_allowed\n * * `account_inactive` - account_inactive\n * * `link_not_allowed` - link_not_allowed\n * * `rate_limited` - rate_limited\n * * `provider_unavailable` - provider_unavailable\n * * `server_error` - server_error\n * * `not_found` - not_found\n */\nexport enum OAuthErrorCodeEnum {\n    OAUTH_DISABLED = 'oauth_disabled',\n    GITHUB_OAUTH_DISABLED = 'github_oauth_disabled',\n    ORIGIN_NOT_ALLOWED = 'origin_not_allowed',\n    MISSING_REDIRECT_URI = 'missing_redirect_uri',\n    INVALID_STATE = 'invalid_state',\n    OAUTH_EXCHANGE_FAILED = 'oauth_exchange_failed',\n    INVALID_ID_TOKEN = 'invalid_id_token',\n    EMAIL_MISSING = 'email_missing',\n    EMAIL_NOT_VERIFIED = 'email_not_verified',\n    HOSTED_DOMAIN_NOT_ALLOWED = 'hosted_domain_not_allowed',\n    ACCOUNT_INACTIVE = 'account_inactive',\n    LINK_NOT_ALLOWED = 'link_not_allowed',\n    RATE_LIMITED = 'rate_limited',\n    PROVIDER_UNAVAILABLE = 'provider_unavailable',\n    SERVER_ERROR = 'server_error',\n    NOT_FOUND = 'not_found'\n}\n\n/**\n * * `github` - GitHub\n * * `google` - Google\n */\nexport enum OAuthProviderEnum {\n    GITHUB = 'github',\n    GOOGLE = 'google'\n}\n\n/**\n * One enabled sign-in provider.\n */\nexport type OAuthProviderInfo = {\n    /**\n     * Provider id\n     *\n     * * `github` - GitHub\n     * * `google` - Google\n     */\n    id: OAuthProviderEnum;\n    /**\n     * Display name\n     */\n    name: string;\n    /**\n     * Icon key\n     */\n    icon: string;\n};\n\n/**\n * Response with available OAuth providers.\n */\nexport type OAuthProvidersResponse = {\n    /**\n     * Providers that are configured, in display order. The login screen shows exactly these.\n     */\n    providers: Array<OAuthProviderInfo>;\n};\n\n/**\n * Response with JWT tokens after OAuth authentication.\n *\n * When 2FA is required:\n * - requires_2fa: True\n * - session_id: UUID of 2FA verification session\n * - access/refresh/user: null\n *\n * When 2FA is not required:\n * - requires_2fa: False\n * - session_id: null\n * - access/refresh/user: populated\n */\nexport type OAuthTokenResponse = {\n    /**\n     * True if 2FA verification is required\n     */\n    requires_2fa?: boolean;\n    /**\n     * 2FA session ID (only when requires_2fa=True)\n     */\n    session_id?: string | null;\n    /**\n     * JWT access token (null when requires_2fa=True)\n     */\n    access?: string | null;\n    /**\n     * JWT refresh token (null when requires_2fa=True)\n     */\n    refresh?: string | null;\n    /**\n     * Authenticated user info (null when requires_2fa=True)\n     */\n    user?: {\n        [key: string]: unknown;\n    } | null;\n    /**\n     * True if a new user was created during this OAuth flow\n     */\n    is_new_user?: boolean;\n    /**\n     * True if a new OAuth connection was created\n     */\n    is_new_connection?: boolean;\n    /**\n     * True if user should be prompted to enable 2FA\n     */\n    should_prompt_2fa?: boolean;\n};\n\n/**\n * Typed error response for OTP operations.\n *\n * error_code values:\n * - invalid_identifier   — malformed email\n * - cooldown             — too soon after last request (retry_after = seconds)\n * - hourly_limit         — hourly quota exceeded   (retry_after = seconds until reset)\n * - daily_limit          — daily quota exceeded    (retry_after = seconds until reset)\n * - rate_limited         — IP-level rate limit hit (no retry_after)\n * - user_creation_failed — internal error creating account\n * - send_failed          — transport error (email / SMS)\n * - internal_error       — unexpected server error\n */\nexport type OtpErrorResponse = {\n    /**\n     * Human-readable error message\n     */\n    error: string;\n    /**\n     * Machine-readable error code\n     */\n    error_code?: string | null;\n    /**\n     * Seconds until the client may retry (present only for rate-limit errors)\n     */\n    retry_after?: number | null;\n};\n\n/**\n * Serializer for OTP request.\n */\nexport type OtpRequestRequest = {\n    /**\n     * Email address for OTP delivery\n     */\n    identifier: string;\n    /**\n     * Source URL for tracking registration (e.g., https://my.djangocfg.com)\n     */\n    source_url?: string;\n    /**\n     * Marketing-consent choice made at signup (absent/null = not asked, false = declined)\n     */\n    marketing_consent?: boolean | null;\n    /**\n     * Version of the consent disclosure text shown (e.g. product-updates-reg-v1)\n     */\n    consent_disclosure_version?: string;\n};\n\n/**\n * OTP request response.\n */\nexport type OtpRequestResponse = {\n    /**\n     * Success message\n     */\n    message: string;\n    /**\n     * Webmail deep-link for the recipient's provider, or null if the domain is unknown.\n     */\n    webmail?: WebmailLink | null;\n    /**\n     * Seconds until a new code may be requested for this email.\n     */\n    resend_in?: number;\n    /**\n     * Seconds the code stays valid.\n     */\n    expires_in?: number;\n};\n\n/**\n * Serializer for OTP verification.\n */\nexport type OtpVerifyRequest = {\n    /**\n     * Email address used for OTP request\n     */\n    identifier: string;\n    otp: string;\n    /**\n     * Source URL for tracking login (e.g., https://my.djangocfg.com)\n     */\n    source_url?: string;\n};\n\n/**\n * OTP verification response.\n *\n * When 2FA is required:\n * - requires_2fa: True\n * - session_id: UUID of 2FA verification session\n * - refresh/access/user: null\n *\n * When 2FA is not required:\n * - requires_2fa: False\n * - session_id: null\n * - refresh/access/user: populated\n */\nexport type OtpVerifyResponse = {\n    /**\n     * Whether 2FA verification is required\n     */\n    requires_2fa?: boolean;\n    /**\n     * 2FA session ID (if requires_2fa is True)\n     */\n    session_id?: string | null;\n    /**\n     * JWT refresh token (if requires_2fa is False)\n     */\n    refresh?: string | null;\n    /**\n     * JWT access token (if requires_2fa is False)\n     */\n    access?: string | null;\n    /**\n     * User information (if requires_2fa is False)\n     */\n    user?: User | null;\n    /**\n     * Whether user should be prompted to enable 2FA\n     */\n    should_prompt_2fa?: boolean;\n};\n\n/**\n * Typed error response for password login.\n *\n * error_code values:\n * - invalid_credentials — wrong email/password, inactive or deleted account\n * - rate_limited        — IP rate limit hit\n * - locked_out          — too many failed attempts for this email\n */\nexport type PasswordLoginError = {\n    /**\n     * Human-readable error message\n     */\n    error: string;\n    /**\n     * Machine-readable error code\n     */\n    error_code: string;\n    /**\n     * Seconds until the caller may retry (throttled responses only)\n     */\n    retry_after?: number | null;\n};\n\n/**\n * Validate email+password against live accounts only.\n *\n * Subclasses SimpleJWT so the field/validation contract stays theirs, but\n * replaces ``validate()`` — the token pair itself is minted by the view via\n * ``mint_tokens_for_request`` so the DPoP binding and token\n * lifetime match OTP, OAuth and TOTP exactly.\n */\nexport type PasswordLoginRequest = {\n    email: string;\n    password: string;\n};\n\n/**\n * Password-login response.\n *\n * Mirrors the OTP verify response so a client can treat every login flow\n * identically. ``requires_2fa=True`` carries a session id instead of tokens.\n */\nexport type PasswordLoginResponse = {\n    /**\n     * Whether 2FA verification is required\n     */\n    requires_2fa?: boolean;\n    /**\n     * 2FA session ID (if requires_2fa is True)\n     */\n    session_id?: string | null;\n    /**\n     * JWT refresh token (if requires_2fa is False)\n     */\n    refresh?: string | null;\n    /**\n     * JWT access token (if requires_2fa is False)\n     */\n    access?: string | null;\n    /**\n     * User information (if requires_2fa is False)\n     */\n    user?: User | null;\n    /**\n     * Whether user should be prompted to enable 2FA\n     */\n    should_prompt_2fa?: boolean;\n};\n\n/**\n * Serializer for updating user profile.\n */\nexport type PatchedCfgUserUpdateRequest = {\n    first_name?: string;\n    last_name?: string;\n    company?: string;\n    phone?: string;\n    position?: string;\n    language?: string;\n    /**\n     * IANA timezone name (e.g. 'Asia/Seoul'). Auto-detected from browser via X-Timezone header.\n     */\n    timezone?: string;\n};\n\n/**\n * Serializer for starting 2FA setup.\n */\nexport type SetupRequest = {\n    /**\n     * Device name for identification (e.g., 'My iPhone')\n     */\n    device_name?: string;\n};\n\n/**\n * Response serializer for setup initiation.\n */\nexport type SetupResponse = {\n    /**\n     * Device ID to use for confirmation\n     */\n    device_id: string;\n    /**\n     * Base32-encoded TOTP secret (for manual entry)\n     */\n    secret: string;\n    /**\n     * otpauth:// URI for QR code generation\n     */\n    provisioning_uri: string;\n    /**\n     * Base64-encoded QR code image (data URI)\n     */\n    qr_code_base64: string;\n    /**\n     * Seconds until setup expires (typically 600 = 10 minutes)\n     */\n    expires_in: number;\n};\n\nexport type TokenBlacklistRequest = {\n    refresh: string;\n};\n\nexport type TokenRefresh = {\n    readonly access: string;\n    refresh: string;\n};\n\nexport type TokenRefreshRequest = {\n    refresh: string;\n};\n\n/**\n * User data returned after 2FA verification.\n */\nexport type TotpVerifyUser = {\n    readonly id: number;\n    readonly email: string;\n    first_name?: string | null;\n    last_name?: string | null;\n    /**\n     * Get user's full name.\n     */\n    readonly full_name: string;\n    /**\n     * Get user's initials for avatar fallback.\n     */\n    readonly initials: string;\n    /**\n     * Get formatted username for display.\n     */\n    readonly display_username: string;\n    company?: string | null;\n    phone?: string | null;\n    position?: string | null;\n    language?: string | null;\n    timezone?: string | null;\n    readonly avatar: string | null;\n    /**\n     * Staff status\n     *\n     * Designates whether the user can log into this admin site.\n     */\n    readonly is_staff: boolean;\n    /**\n     * Superuser status\n     *\n     * Designates that this user has all permissions without explicitly assigning them.\n     */\n    readonly is_superuser: boolean;\n    readonly date_joined: string;\n    readonly last_login: string | null;\n    readonly unanswered_messages_count: number;\n    readonly api_key: string | null;\n};\n\n/**\n * Serializer for user details.\n */\nexport type User = {\n    readonly id: number;\n    readonly email: string;\n    first_name?: string | null;\n    last_name?: string | null;\n    /**\n     * Get user's full name.\n     */\n    readonly full_name: string;\n    /**\n     * Get user's initials for avatar fallback.\n     */\n    readonly initials: string;\n    /**\n     * Get formatted username for display.\n     */\n    readonly display_username: string;\n    company?: string | null;\n    phone?: string | null;\n    position?: string | null;\n    language?: string | null;\n    timezone?: string | null;\n    readonly avatar: string | null;\n    /**\n     * Staff status\n     *\n     * Designates whether the user can log into this admin site.\n     */\n    readonly is_staff: boolean;\n    /**\n     * Superuser status\n     *\n     * Designates that this user has all permissions without explicitly assigning them.\n     */\n    readonly is_superuser: boolean;\n    readonly date_joined: string;\n    readonly last_login: string | null;\n    readonly unanswered_messages_count: number;\n    readonly api_key: string | null;\n};\n\n/**\n * Serializer for backup code verification during login.\n */\nexport type VerifyBackupRequest = {\n    /**\n     * 2FA session ID from login response\n     */\n    session_id: string;\n    /**\n     * 8-character backup recovery code\n     */\n    backup_code: string;\n};\n\n/**\n * Serializer for TOTP code verification during login.\n */\nexport type VerifyRequest = {\n    /**\n     * 2FA session ID from login response\n     */\n    session_id: string;\n    /**\n     * 6-digit TOTP code from authenticator app\n     */\n    code: string;\n};\n\n/**\n * Response serializer for successful 2FA verification.\n */\nexport type VerifyResponse = {\n    message: string;\n    /**\n     * JWT access token\n     */\n    access_token: string;\n    /**\n     * JWT refresh token\n     */\n    refresh_token: string;\n    /**\n     * User profile data\n     */\n    user: TotpVerifyUser;\n    /**\n     * Number of remaining backup codes (if backup code was used)\n     */\n    remaining_backup_codes?: number;\n    /**\n     * Warning message (e.g., low backup codes)\n     */\n    warning?: string;\n};\n\n/**\n * Deep-link that opens the user's webmail on a search for our login email.\n *\n * Present only when the recipient's email domain maps to a known webmail\n * provider (Gmail, Outlook, Mail.ru, Yandex, iCloud, …). For unknown/corporate\n * domains this whole object is null and the frontend shows no button.\n */\nexport type WebmailLink = {\n    /**\n     * Provider slug (e.g. 'gmail', 'outlook', 'mail_ru'). Also selects the brand icon on the frontend.\n     *\n     * * `gmail` - gmail\n     * * `outlook` - outlook\n     * * `yahoo` - yahoo\n     * * `icloud` - icloud\n     * * `proton` - proton\n     * * `zoho` - zoho\n     * * `aol` - aol\n     * * `fastmail` - fastmail\n     * * `gmx` - gmx\n     * * `mailcom` - mailcom\n     * * `mail_ru` - mail_ru\n     * * `yandex` - yandex\n     * * `rambler` - rambler\n     * * `qq` - qq\n     * * `netease` - netease\n     * * `sina` - sina\n     * * `aliyun` - aliyun\n     * * `naver` - naver\n     * * `daum` - daum\n     * * `web_de` - web_de\n     * * `tonline` - tonline\n     * * `seznam` - seznam\n     * * `wp_pl` - wp_pl\n     * * `o2_pl` - o2_pl\n     * * `interia` - interia\n     * * `libero` - libero\n     * * `virgilio` - virgilio\n     * * `orange` - orange\n     * * `laposte` - laposte\n     * * `free_fr` - free_fr\n     * * `sfr` - sfr\n     */\n    provider: WebmailLinkProviderEnum;\n    /**\n     * Human-facing provider name, e.g. 'Gmail'.\n     */\n    provider_name: string;\n    /**\n     * Absolute URL to open in a new tab (a sender-filtered search, or the inbox as fallback).\n     */\n    url: string;\n    /**\n     * True if the URL opens a search filtered to our sender; False if it only opens the inbox.\n     */\n    is_search: boolean;\n};\n\n/**\n * * `gmail` - gmail\n * * `outlook` - outlook\n * * `yahoo` - yahoo\n * * `icloud` - icloud\n * * `proton` - proton\n * * `zoho` - zoho\n * * `aol` - aol\n * * `fastmail` - fastmail\n * * `gmx` - gmx\n * * `mailcom` - mailcom\n * * `mail_ru` - mail_ru\n * * `yandex` - yandex\n * * `rambler` - rambler\n * * `qq` - qq\n * * `netease` - netease\n * * `sina` - sina\n * * `aliyun` - aliyun\n * * `naver` - naver\n * * `daum` - daum\n * * `web_de` - web_de\n * * `tonline` - tonline\n * * `seznam` - seznam\n * * `wp_pl` - wp_pl\n * * `o2_pl` - o2_pl\n * * `interia` - interia\n * * `libero` - libero\n * * `virgilio` - virgilio\n * * `orange` - orange\n * * `laposte` - laposte\n * * `free_fr` - free_fr\n * * `sfr` - sfr\n */\nexport enum WebmailLinkProviderEnum {\n    GMAIL = 'gmail',\n    OUTLOOK = 'outlook',\n    YAHOO = 'yahoo',\n    ICLOUD = 'icloud',\n    PROTON = 'proton',\n    ZOHO = 'zoho',\n    AOL = 'aol',\n    FASTMAIL = 'fastmail',\n    GMX = 'gmx',\n    MAILCOM = 'mailcom',\n    MAIL_RU = 'mail_ru',\n    YANDEX = 'yandex',\n    RAMBLER = 'rambler',\n    QQ = 'qq',\n    NETEASE = 'netease',\n    SINA = 'sina',\n    ALIYUN = 'aliyun',\n    NAVER = 'naver',\n    DAUM = 'daum',\n    WEB_DE = 'web_de',\n    TONLINE = 'tonline',\n    SEZNAM = 'seznam',\n    WP_PL = 'wp_pl',\n    O2_PL = 'o2_pl',\n    INTERIA = 'interia',\n    LIBERO = 'libero',\n    VIRGILIO = 'virgilio',\n    ORANGE = 'orange',\n    LAPOSTE = 'laposte',\n    FREE_FR = 'free_fr',\n    SFR = 'sfr'\n}\n\nexport type CfgAccountsOauthConnectionsResponse200AutoRef = Array<OAuthConnection>;\n\nexport type CfgAccountsOauthDisconnectResponse200AutoRef = {\n    message?: string;\n};\n\n/**\n * 2FA disabled successfully\n */\nexport type CfgTotpDisableResponse200AutoRef = unknown;\n\n/**\n * Response serializer for device list endpoint.\n */\nexport type DeviceListResponseWritable = {\n    devices: Array<unknown>;\n    has_2fa_enabled: boolean;\n};\n\n/**\n * OTP verification response.\n *\n * When 2FA is required:\n * - requires_2fa: True\n * - session_id: UUID of 2FA verification session\n * - refresh/access/user: null\n *\n * When 2FA is not required:\n * - requires_2fa: False\n * - session_id: null\n * - refresh/access/user: populated\n */\nexport type OtpVerifyResponseWritable = {\n    /**\n     * Whether 2FA verification is required\n     */\n    requires_2fa?: boolean;\n    /**\n     * 2FA session ID (if requires_2fa is True)\n     */\n    session_id?: string | null;\n    /**\n     * JWT refresh token (if requires_2fa is False)\n     */\n    refresh?: string | null;\n    /**\n     * JWT access token (if requires_2fa is False)\n     */\n    access?: string | null;\n    /**\n     * User information (if requires_2fa is False)\n     */\n    user?: UserWritable | null;\n    /**\n     * Whether user should be prompted to enable 2FA\n     */\n    should_prompt_2fa?: boolean;\n};\n\n/**\n * Password-login response.\n *\n * Mirrors the OTP verify response so a client can treat every login flow\n * identically. ``requires_2fa=True`` carries a session id instead of tokens.\n */\nexport type PasswordLoginResponseWritable = {\n    /**\n     * Whether 2FA verification is required\n     */\n    requires_2fa?: boolean;\n    /**\n     * 2FA session ID (if requires_2fa is True)\n     */\n    session_id?: string | null;\n    /**\n     * JWT refresh token (if requires_2fa is False)\n     */\n    refresh?: string | null;\n    /**\n     * JWT access token (if requires_2fa is False)\n     */\n    access?: string | null;\n    /**\n     * User information (if requires_2fa is False)\n     */\n    user?: UserWritable | null;\n    /**\n     * Whether user should be prompted to enable 2FA\n     */\n    should_prompt_2fa?: boolean;\n};\n\nexport type TokenRefreshWritable = {\n    refresh: string;\n};\n\n/**\n * User data returned after 2FA verification.\n */\nexport type TotpVerifyUserWritable = {\n    first_name?: string | null;\n    last_name?: string | null;\n    company?: string | null;\n    phone?: string | null;\n    position?: string | null;\n    language?: string | null;\n    timezone?: string | null;\n};\n\n/**\n * Serializer for user details.\n */\nexport type UserWritable = {\n    first_name?: string | null;\n    last_name?: string | null;\n    company?: string | null;\n    phone?: string | null;\n    position?: string | null;\n    language?: string | null;\n    timezone?: string | null;\n};\n\n/**\n * Response serializer for successful 2FA verification.\n */\nexport type VerifyResponseWritable = {\n    message: string;\n    /**\n     * JWT access token\n     */\n    access_token: string;\n    /**\n     * JWT refresh token\n     */\n    refresh_token: string;\n    /**\n     * User profile data\n     */\n    user: TotpVerifyUserWritable;\n    /**\n     * Number of remaining backup codes (if backup code was used)\n     */\n    remaining_backup_codes?: number;\n    /**\n     * Warning message (e.g., low backup codes)\n     */\n    warning?: string;\n};\n\nexport type CfgAccountsApiKeyRetrieveData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/api-key/';\n};\n\nexport type CfgAccountsApiKeyRetrieveErrors = {\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsApiKeyRetrieveResponses = {\n    200: ApiKey;\n};\n\nexport type CfgAccountsApiKeyRetrieveResponse = CfgAccountsApiKeyRetrieveResponses[keyof CfgAccountsApiKeyRetrieveResponses];\n\nexport type CfgAccountsApiKeyRegenerateCreateData = {\n    body: ApiKeyRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/api-key/regenerate/';\n};\n\nexport type CfgAccountsApiKeyRegenerateCreateErrors = {\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsApiKeyRegenerateCreateResponses = {\n    200: ApiKeyRegenerate;\n};\n\nexport type CfgAccountsApiKeyRegenerateCreateResponse = CfgAccountsApiKeyRegenerateCreateResponses[keyof CfgAccountsApiKeyRegenerateCreateResponses];\n\nexport type CfgAccountsApiKeyRevealCreateData = {\n    body: ApiKeyRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/api-key/reveal/';\n};\n\nexport type CfgAccountsApiKeyRevealCreateErrors = {\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsApiKeyRevealCreateResponses = {\n    200: ApiKeyReveal;\n};\n\nexport type CfgAccountsApiKeyRevealCreateResponse = CfgAccountsApiKeyRevealCreateResponses[keyof CfgAccountsApiKeyRevealCreateResponses];\n\nexport type CfgAccountsApiKeyTestCreateData = {\n    body: ApiKeyTestRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/api-key/test/';\n};\n\nexport type CfgAccountsApiKeyTestCreateResponses = {\n    200: ApiKeyTestResult;\n};\n\nexport type CfgAccountsApiKeyTestCreateResponse = CfgAccountsApiKeyTestCreateResponses[keyof CfgAccountsApiKeyTestCreateResponses];\n\nexport type CfgAccountsOauthConnectionsListData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/oauth/connections/';\n};\n\nexport type CfgAccountsOauthConnectionsListResponses = {\n    200: CfgAccountsOauthConnectionsResponse200AutoRef;\n};\n\nexport type CfgAccountsOauthConnectionsListResponse = CfgAccountsOauthConnectionsListResponses[keyof CfgAccountsOauthConnectionsListResponses];\n\nexport type CfgAccountsOauthDisconnectCreateData = {\n    body: OAuthDisconnectRequestRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/oauth/disconnect/';\n};\n\nexport type CfgAccountsOauthDisconnectCreateErrors = {\n    400: OAuthError;\n    404: OAuthError;\n};\n\nexport type CfgAccountsOauthDisconnectCreateError = CfgAccountsOauthDisconnectCreateErrors[keyof CfgAccountsOauthDisconnectCreateErrors];\n\nexport type CfgAccountsOauthDisconnectCreateResponses = {\n    200: CfgAccountsOauthDisconnectResponse200AutoRef;\n};\n\nexport type CfgAccountsOauthDisconnectCreateResponse = CfgAccountsOauthDisconnectCreateResponses[keyof CfgAccountsOauthDisconnectCreateResponses];\n\nexport type CfgAccountsOauthGithubAuthorizeCreateData = {\n    body?: OAuthAuthorizeRequestRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/oauth/github/authorize/';\n};\n\nexport type CfgAccountsOauthGithubAuthorizeCreateErrors = {\n    400: OAuthError;\n    503: OAuthError;\n};\n\nexport type CfgAccountsOauthGithubAuthorizeCreateError = CfgAccountsOauthGithubAuthorizeCreateErrors[keyof CfgAccountsOauthGithubAuthorizeCreateErrors];\n\nexport type CfgAccountsOauthGithubAuthorizeCreateResponses = {\n    200: OAuthAuthorizeResponse;\n};\n\nexport type CfgAccountsOauthGithubAuthorizeCreateResponse = CfgAccountsOauthGithubAuthorizeCreateResponses[keyof CfgAccountsOauthGithubAuthorizeCreateResponses];\n\nexport type CfgAccountsOauthGithubCallbackCreateData = {\n    body: OAuthCallbackRequestRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/oauth/github/callback/';\n};\n\nexport type CfgAccountsOauthGithubCallbackCreateErrors = {\n    400: OAuthError;\n    403: OAuthError;\n    429: OAuthError;\n    502: OAuthError;\n    503: OAuthError;\n};\n\nexport type CfgAccountsOauthGithubCallbackCreateError = CfgAccountsOauthGithubCallbackCreateErrors[keyof CfgAccountsOauthGithubCallbackCreateErrors];\n\nexport type CfgAccountsOauthGithubCallbackCreateResponses = {\n    200: OAuthTokenResponse;\n};\n\nexport type CfgAccountsOauthGithubCallbackCreateResponse = CfgAccountsOauthGithubCallbackCreateResponses[keyof CfgAccountsOauthGithubCallbackCreateResponses];\n\nexport type CfgAccountsOauthGoogleAuthorizeCreateData = {\n    body?: OAuthAuthorizeRequestRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/oauth/google/authorize/';\n};\n\nexport type CfgAccountsOauthGoogleAuthorizeCreateErrors = {\n    400: OAuthError;\n    503: OAuthError;\n};\n\nexport type CfgAccountsOauthGoogleAuthorizeCreateError = CfgAccountsOauthGoogleAuthorizeCreateErrors[keyof CfgAccountsOauthGoogleAuthorizeCreateErrors];\n\nexport type CfgAccountsOauthGoogleAuthorizeCreateResponses = {\n    200: OAuthAuthorizeResponse;\n};\n\nexport type CfgAccountsOauthGoogleAuthorizeCreateResponse = CfgAccountsOauthGoogleAuthorizeCreateResponses[keyof CfgAccountsOauthGoogleAuthorizeCreateResponses];\n\nexport type CfgAccountsOauthGoogleCallbackCreateData = {\n    body: OAuthCallbackRequestRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/oauth/google/callback/';\n};\n\nexport type CfgAccountsOauthGoogleCallbackCreateErrors = {\n    400: OAuthError;\n    403: OAuthError;\n    429: OAuthError;\n    502: OAuthError;\n    503: OAuthError;\n};\n\nexport type CfgAccountsOauthGoogleCallbackCreateError = CfgAccountsOauthGoogleCallbackCreateErrors[keyof CfgAccountsOauthGoogleCallbackCreateErrors];\n\nexport type CfgAccountsOauthGoogleCallbackCreateResponses = {\n    200: OAuthTokenResponse;\n};\n\nexport type CfgAccountsOauthGoogleCallbackCreateResponse = CfgAccountsOauthGoogleCallbackCreateResponses[keyof CfgAccountsOauthGoogleCallbackCreateResponses];\n\nexport type CfgAccountsOauthProvidersRetrieveData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/oauth/providers/';\n};\n\nexport type CfgAccountsOauthProvidersRetrieveResponses = {\n    200: OAuthProvidersResponse;\n};\n\nexport type CfgAccountsOauthProvidersRetrieveResponse = CfgAccountsOauthProvidersRetrieveResponses[keyof CfgAccountsOauthProvidersRetrieveResponses];\n\nexport type CfgAccountsOtpConsentPolicyRetrieveData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/otp/consent-policy/';\n};\n\nexport type CfgAccountsOtpConsentPolicyRetrieveResponses = {\n    200: ConsentPolicy;\n};\n\nexport type CfgAccountsOtpConsentPolicyRetrieveResponse = CfgAccountsOtpConsentPolicyRetrieveResponses[keyof CfgAccountsOtpConsentPolicyRetrieveResponses];\n\nexport type CfgAccountsOtpRequestCreateData = {\n    body: OtpRequestRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/otp/request/';\n};\n\nexport type CfgAccountsOtpRequestCreateErrors = {\n    400: OtpErrorResponse;\n    429: OtpErrorResponse;\n    500: OtpErrorResponse;\n};\n\nexport type CfgAccountsOtpRequestCreateError = CfgAccountsOtpRequestCreateErrors[keyof CfgAccountsOtpRequestCreateErrors];\n\nexport type CfgAccountsOtpRequestCreateResponses = {\n    200: OtpRequestResponse;\n};\n\nexport type CfgAccountsOtpRequestCreateResponse = CfgAccountsOtpRequestCreateResponses[keyof CfgAccountsOtpRequestCreateResponses];\n\nexport type CfgAccountsOtpVerifyCreateData = {\n    body: OtpVerifyRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/otp/verify/';\n};\n\nexport type CfgAccountsOtpVerifyCreateErrors = {\n    401: OtpErrorResponse;\n    429: OtpErrorResponse;\n};\n\nexport type CfgAccountsOtpVerifyCreateError = CfgAccountsOtpVerifyCreateErrors[keyof CfgAccountsOtpVerifyCreateErrors];\n\nexport type CfgAccountsOtpVerifyCreateResponses = {\n    200: OtpVerifyResponse;\n};\n\nexport type CfgAccountsOtpVerifyCreateResponse = CfgAccountsOtpVerifyCreateResponses[keyof CfgAccountsOtpVerifyCreateResponses];\n\nexport type CfgAccountsProfileRetrieveData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/profile/';\n};\n\nexport type CfgAccountsProfileRetrieveErrors = {\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsProfileRetrieveResponses = {\n    200: User;\n};\n\nexport type CfgAccountsProfileRetrieveResponse = CfgAccountsProfileRetrieveResponses[keyof CfgAccountsProfileRetrieveResponses];\n\nexport type CfgAccountsProfileAvatarCreateData = {\n    body?: {\n        /**\n         * Avatar image file (JPEG, PNG, GIF, WebP, max 5MB)\n         */\n        avatar: Blob | File;\n    };\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/profile/avatar/';\n};\n\nexport type CfgAccountsProfileAvatarCreateErrors = {\n    /**\n     * Invalid file or validation error.\n     */\n    400: unknown;\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsProfileAvatarCreateResponses = {\n    200: User;\n};\n\nexport type CfgAccountsProfileAvatarCreateResponse = CfgAccountsProfileAvatarCreateResponses[keyof CfgAccountsProfileAvatarCreateResponses];\n\nexport type CfgAccountsProfileDeleteCreateData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/profile/delete/';\n};\n\nexport type CfgAccountsProfileDeleteCreateErrors = {\n    /**\n     * Account is already deleted.\n     */\n    400: unknown;\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsProfileDeleteCreateResponses = {\n    200: AccountDeleteResponse;\n};\n\nexport type CfgAccountsProfileDeleteCreateResponse = CfgAccountsProfileDeleteCreateResponses[keyof CfgAccountsProfileDeleteCreateResponses];\n\nexport type CfgAccountsProfilePartialPartialUpdateData = {\n    body?: PatchedCfgUserUpdateRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/profile/partial/';\n};\n\nexport type CfgAccountsProfilePartialPartialUpdateErrors = {\n    /**\n     * Invalid data provided.\n     */\n    400: unknown;\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsProfilePartialPartialUpdateResponses = {\n    200: User;\n};\n\nexport type CfgAccountsProfilePartialPartialUpdateResponse = CfgAccountsProfilePartialPartialUpdateResponses[keyof CfgAccountsProfilePartialPartialUpdateResponses];\n\nexport type CfgAccountsProfilePartialUpdateData = {\n    body?: CfgUserUpdateRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/profile/partial/';\n};\n\nexport type CfgAccountsProfilePartialUpdateErrors = {\n    /**\n     * Invalid data provided.\n     */\n    400: unknown;\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsProfilePartialUpdateResponses = {\n    200: User;\n};\n\nexport type CfgAccountsProfilePartialUpdateResponse = CfgAccountsProfilePartialUpdateResponses[keyof CfgAccountsProfilePartialUpdateResponses];\n\nexport type CfgAccountsProfileUpdatePartialUpdateData = {\n    body?: PatchedCfgUserUpdateRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/profile/update/';\n};\n\nexport type CfgAccountsProfileUpdatePartialUpdateErrors = {\n    /**\n     * Invalid data provided.\n     */\n    400: unknown;\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsProfileUpdatePartialUpdateResponses = {\n    200: User;\n};\n\nexport type CfgAccountsProfileUpdatePartialUpdateResponse = CfgAccountsProfileUpdatePartialUpdateResponses[keyof CfgAccountsProfileUpdatePartialUpdateResponses];\n\nexport type CfgAccountsProfileUpdateUpdateData = {\n    body?: CfgUserUpdateRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/profile/update/';\n};\n\nexport type CfgAccountsProfileUpdateUpdateErrors = {\n    /**\n     * Invalid data provided.\n     */\n    400: unknown;\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsProfileUpdateUpdateResponses = {\n    200: User;\n};\n\nexport type CfgAccountsProfileUpdateUpdateResponse = CfgAccountsProfileUpdateUpdateResponses[keyof CfgAccountsProfileUpdateUpdateResponses];\n\nexport type CfgAccountsTokenCreateData = {\n    body: PasswordLoginRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/token/';\n};\n\nexport type CfgAccountsTokenCreateErrors = {\n    401: PasswordLoginError;\n    429: PasswordLoginError;\n};\n\nexport type CfgAccountsTokenCreateError = CfgAccountsTokenCreateErrors[keyof CfgAccountsTokenCreateErrors];\n\nexport type CfgAccountsTokenCreateResponses = {\n    200: PasswordLoginResponse;\n};\n\nexport type CfgAccountsTokenCreateResponse = CfgAccountsTokenCreateResponses[keyof CfgAccountsTokenCreateResponses];\n\nexport type CfgAccountsTokenBlacklistCreateData = {\n    body: TokenBlacklistRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/token/blacklist/';\n};\n\nexport type CfgAccountsTokenBlacklistCreateResponses = {\n    /**\n     * No response body\n     */\n    200: unknown;\n};\n\nexport type CfgAccountsTokenRefreshCreateData = {\n    body: TokenRefreshRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/token/refresh/';\n};\n\nexport type CfgAccountsTokenRefreshCreateResponses = {\n    200: TokenRefresh;\n};\n\nexport type CfgAccountsTokenRefreshCreateResponse = CfgAccountsTokenRefreshCreateResponses[keyof CfgAccountsTokenRefreshCreateResponses];\n\nexport type CfgTotpBackupCodesRetrieveData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/backup-codes/';\n};\n\nexport type CfgTotpBackupCodesRetrieveResponses = {\n    200: BackupCodesStatus;\n};\n\nexport type CfgTotpBackupCodesRetrieveResponse = CfgTotpBackupCodesRetrieveResponses[keyof CfgTotpBackupCodesRetrieveResponses];\n\nexport type CfgTotpBackupCodesRegenerateCreateData = {\n    body: BackupCodesRegenerateRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/backup-codes/regenerate/';\n};\n\nexport type CfgTotpBackupCodesRegenerateCreateErrors = {\n    /**\n     * Invalid code or 2FA not enabled\n     */\n    400: unknown;\n};\n\nexport type CfgTotpBackupCodesRegenerateCreateResponses = {\n    200: BackupCodesRegenerateResponse;\n};\n\nexport type CfgTotpBackupCodesRegenerateCreateResponse = CfgTotpBackupCodesRegenerateCreateResponses[keyof CfgTotpBackupCodesRegenerateCreateResponses];\n\nexport type CfgTotpDevicesRetrieveData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/devices/';\n};\n\nexport type CfgTotpDevicesRetrieveResponses = {\n    200: DeviceListResponse;\n};\n\nexport type CfgTotpDevicesRetrieveResponse = CfgTotpDevicesRetrieveResponses[keyof CfgTotpDevicesRetrieveResponses];\n\nexport type CfgTotpDevicesDestroyData = {\n    body?: never;\n    path: {\n        id: string;\n    };\n    query?: never;\n    url: '/cfg/totp/devices/{id}/';\n};\n\nexport type CfgTotpDevicesDestroyResponses = {\n    /**\n     * No response body\n     */\n    204: void;\n};\n\nexport type CfgTotpDevicesDestroyResponse = CfgTotpDevicesDestroyResponses[keyof CfgTotpDevicesDestroyResponses];\n\nexport type CfgTotpDisableCreateData = {\n    body: DisableRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/disable/';\n};\n\nexport type CfgTotpDisableCreateErrors = {\n    /**\n     * Invalid code\n     */\n    400: unknown;\n};\n\nexport type CfgTotpDisableCreateResponses = {\n    200: CfgTotpDisableResponse200AutoRef;\n};\n\nexport type CfgTotpDisableCreateResponse = CfgTotpDisableCreateResponses[keyof CfgTotpDisableCreateResponses];\n\nexport type CfgTotpSetupCreateData = {\n    body?: SetupRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/setup/';\n};\n\nexport type CfgTotpSetupCreateErrors = {\n    /**\n     * 2FA already enabled or invalid request\n     */\n    400: unknown;\n};\n\nexport type CfgTotpSetupCreateResponses = {\n    200: SetupResponse;\n};\n\nexport type CfgTotpSetupCreateResponse = CfgTotpSetupCreateResponses[keyof CfgTotpSetupCreateResponses];\n\nexport type CfgTotpSetupConfirmCreateData = {\n    body: ConfirmSetupRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/setup/confirm/';\n};\n\nexport type CfgTotpSetupConfirmCreateErrors = {\n    /**\n     * Invalid code or setup expired\n     */\n    400: unknown;\n};\n\nexport type CfgTotpSetupConfirmCreateResponses = {\n    200: ConfirmSetupResponse;\n};\n\nexport type CfgTotpSetupConfirmCreateResponse = CfgTotpSetupConfirmCreateResponses[keyof CfgTotpSetupConfirmCreateResponses];\n\nexport type CfgTotpVerifyCreateData = {\n    body: VerifyRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/verify/';\n};\n\nexport type CfgTotpVerifyCreateErrors = {\n    /**\n     * Invalid code or session\n     */\n    400: unknown;\n    /**\n     * Too many attempts\n     */\n    403: unknown;\n};\n\nexport type CfgTotpVerifyCreateResponses = {\n    200: VerifyResponse;\n};\n\nexport type CfgTotpVerifyCreateResponse = CfgTotpVerifyCreateResponses[keyof CfgTotpVerifyCreateResponses];\n\nexport type CfgTotpVerifyBackupCreateData = {\n    body: VerifyBackupRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/verify/backup/';\n};\n\nexport type CfgTotpVerifyBackupCreateErrors = {\n    /**\n     * Invalid backup code or session\n     */\n    400: unknown;\n};\n\nexport type CfgTotpVerifyBackupCreateResponses = {\n    200: VerifyResponse;\n};\n\nexport type CfgTotpVerifyBackupCreateResponse = CfgTotpVerifyBackupCreateResponses[keyof CfgTotpVerifyBackupCreateResponses];\n","/** Read a property off an unknown value without asserting its shape. */\nconst prop = (value: unknown, key: string): unknown =>\n  typeof value === 'object' && value !== null\n    ? (value as Record<string, unknown>)[key]\n    : undefined;\n\n/**\n * The transport's own fallback message, e.g. `HTTP 404: ` or `HTTP 500: Boom`.\n *\n * `APIError` builds this when the caller supplies no message of its own\n * (`_api/generated/helpers/errors.ts`), so it is never server prose — it is the\n * status line restated. Under HTTP/2 `statusText` is empty, which is how a bare\n * `HTTP 404:` (and `HTTP 0:` for a response that never arrived) reached a sign-in form and told the user nothing at all.\n */\nconst TRANSPORT_FALLBACK = /^HTTP \\d{1,3}:\\s*/;\n\n/**\n * Translation keys for the copy this module can choose.\n *\n * Every one already exists, translated, in all 17 locales of `@djangocfg/i18n`\n * — `api.errors.*` for transport conditions and `ui.errors.*` for the ones a\n * person can act on. Nothing is added here: a second key saying \"Server is\n * unavailable\" in a namespace of its own would be a second owner of the same\n * sentence, and the one that loses is whichever the caller did not use.\n *\n * A 404 maps to `serverUnavailable`, not to `ui.errors.notFound` (\"Not found\"):\n * on a sign-in POST the missing thing is the ENDPOINT, which tells the visitor\n * nothing about a page and everything about the service being down.\n */\nexport const AUTH_ERROR_KEYS = {\n  invalidCredentials: 'ui.errors.unauthorized',\n  rateLimited: 'api.errors.rateLimited',\n  serverUnavailable: 'api.errors.serverUnavailable',\n  networkError: 'api.errors.networkError',\n  generic: 'ui.errors.generic',\n} as const;\n\nexport type AuthErrorKey = (typeof AUTH_ERROR_KEYS)[keyof typeof AUTH_ERROR_KEYS];\n\n/**\n * English copy for each key, so a caller without a translator still renders a\n * sentence. The catalogue is authoritative; this is the offline twin.\n */\nconst FALLBACK_COPY: Record<AuthErrorKey, string> = {\n  [AUTH_ERROR_KEYS.invalidCredentials]: 'Please sign in to continue',\n  [AUTH_ERROR_KEYS.rateLimited]: 'Too many requests. Please wait.',\n  [AUTH_ERROR_KEYS.serverUnavailable]: 'Server is unavailable',\n  [AUTH_ERROR_KEYS.networkError]: 'Network error',\n  [AUTH_ERROR_KEYS.generic]: 'Something went wrong',\n};\n\n/** Map a status code to the key whose copy explains it. */\nconst keyForStatus = (status: number | undefined): AuthErrorKey => {\n  if (status === undefined) return AUTH_ERROR_KEYS.generic;\n  // 0 is \"no response at all\": the network dropped, CORS refused (a proxy answering 404 while the API restarts carries\n  // no CORS headers, so the browser reports it as 0), or the request was blocked. Not a server verdict.\n  if (status === 0) return AUTH_ERROR_KEYS.networkError;\n  if (status === 401 || status === 403) return AUTH_ERROR_KEYS.invalidCredentials;\n  // A 404 here is a missing endpoint, not a missing page — see AUTH_ERROR_KEYS.\n  if (status === 404) return AUTH_ERROR_KEYS.serverUnavailable;\n  if (status === 429) return AUTH_ERROR_KEYS.rateLimited;\n  if (status >= 500) return AUTH_ERROR_KEYS.serverUnavailable;\n  return AUTH_ERROR_KEYS.generic;\n};\n\n/** What the auth layer decided to show, and why. */\nexport interface AuthErrorCopy {\n  /** Ready-to-render text: server prose, or this module's English fallback. */\n  message: string;\n  /**\n   * Set only when `message` came from `FALLBACK_COPY`. A caller holding a\n   * translator renders `t(key)` instead; server prose carries no key because\n   * the backend already chose the words and the locale.\n   */\n  key?: AuthErrorKey;\n}\n\n/**\n * Decide what a failed auth call should say.\n *\n * Order: text the SERVER wrote, then copy chosen from the status code, then a\n * generic sentence. Server prose wins because the backend knows the specific\n * reason (\"This code has expired\") that a status code cannot express.\n *\n * Each candidate is checked to be a string before it is returned. Under the\n * previous `any` the check was only that the property was truthy, so a DRF\n * field-error object (`{detail: {email: [...]}}`) reached the UI as\n * \"[object Object]\" — an error message that tells the user nothing.\n *\n * `HTTP <code>:` strings are rejected on the way through. They are the\n * transport restating its own status line, not prose anyone wrote to be read,\n * and treating them as a message is what put a bare `HTTP 404:` under a\n * sign-in field. The code itself stays useful — `logAuthFailure` puts it in\n * the console, where diagnosis belongs.\n */\nexport const resolveAuthError = (error: unknown, fallback?: string): AuthErrorCopy => {\n  if (typeof error === 'string' && error && !TRANSPORT_FALLBACK.test(error)) {\n    return { message: error };\n  }\n\n  const candidates = [\n    prop(error, 'message'),\n    prop(error, 'detail'),\n    prop(prop(error, 'response'), 'error'),\n    prop(prop(error, 'response'), 'detail'),\n    prop(prop(error, 'response'), 'message'),\n    prop(prop(prop(error, 'response'), 'data'), 'detail'),\n  ];\n\n  for (const candidate of candidates) {\n    if (typeof candidate === 'string' && candidate && !TRANSPORT_FALLBACK.test(candidate)) {\n      return { message: candidate };\n    }\n  }\n\n  // Both spellings are read: `statusCode` is what `APIError` declares, while a\n  // Response-shaped rejection reaching here from outside the interceptor\n  // carries `status`.\n  const rawStatus = prop(error, 'statusCode') ?? prop(error, 'status');\n  const status = typeof rawStatus === 'number' ? rawStatus : undefined;\n\n  // A caller's own fallback only applies where the status says nothing; a 404\n  // must not be reported as \"Failed to send the code\".\n  if (status === undefined && fallback) {\n    return { message: fallback };\n  }\n\n  const key = keyForStatus(status);\n  return { message: FALLBACK_COPY[key], key };\n};\n\n/**\n * `resolveAuthError` for callers that only want the string.\n *\n * Kept because most call sites store a plain `error` string in form state and\n * have no translator to hand.\n */\nexport const formatAuthError = (error: unknown, fallback?: string): string =>\n  resolveAuthError(error, fallback).message;\n\n/**\n * Log a failed auth call at the level its cause deserves.\n *\n * A 4xx on an auth endpoint is the USER getting it wrong — a mistyped OTP, an\n * expired code, a bad password. It is the endpoint working. Logged through\n * `console.error` it became a production alert: `@djangocfg/devtools` captures\n * `console.error` as an `ERROR` event, so every typo raised \"❌ Error\" in\n * Telegram, complete with consola's `%c` CSS in the message body. Real faults\n * drown in that.\n *\n * 5xx, a network failure and a broken response contract stay at `error`:\n * nobody can fix those by retyping, and they are what the alert is for.\n *\n * Both `statusCode` (what `APIError` declares) and `status` are read, because\n * a Response-shaped rejection can reach here from code that does not go\n * through the interceptor.\n */\nexport const logAuthFailure = (\n  log: { warn: (...args: unknown[]) => void; error: (...args: unknown[]) => void },\n  message: string,\n  error: unknown,\n): void => {\n  const code = prop(error, 'statusCode') ?? prop(error, 'status');\n  const isClientError = typeof code === 'number' && code >= 400 && code < 500;\n  if (isClientError) {\n    log.warn(message, error);\n    return;\n  }\n  log.error(message, error);\n};\n","import { OAuthErrorCodeEnum, type OAuthProviderEnum } from '../../_api/generated/types.gen';\nimport { formatAuthError } from './errors';\n\n/** A provider the server can offer. Derived from the generated enum, so a new backend provider is a type error until it gets an adapter. */\nexport type OAuthProviderId = `${OAuthProviderEnum}`;\n\n/** Every `error` value the OAuth endpoints can return (closed set from the OpenAPI schema). */\nexport type OAuthErrorCode = `${OAuthErrorCodeEnum}`;\n\n/** Failures the browser detects itself, before or instead of a server answer. */\nexport type OAuthClientErrorCode = 'cancelled' | 'unknown_provider';\n\nexport type OAuthFailureCode = OAuthErrorCode | OAuthClientErrorCode;\n\nexport interface OAuthFailure {\n  /** Set when the cause is one the UI can explain; absent for transport faults. */\n  code?: OAuthFailureCode;\n  /** English text for callers without a translator: server prose, else a generic sentence. */\n  message: string;\n}\n\n// Read from the generated enum: a code the backend adds arrives with `make generate`.\nconst SERVER_CODES: ReadonlySet<string> = new Set<string>(Object.values(OAuthErrorCodeEnum));\n\nconst record = (value: unknown): Record<string, unknown> | null =>\n  typeof value === 'object' && value !== null ? (value as Record<string, unknown>) : null;\n\n/**\n * Read `{error, error_description}` off a thrown API error.\n *\n * The transport keeps the parsed body on `response`; `formatAuthError` alone\n * would surface the machine code (`invalid_state`) as if it were prose.\n */\nexport const readOAuthFailure = (err: unknown, fallback: string): OAuthFailure => {\n  const body = record(record(err)?.response);\n  const code = body?.error;\n  if (typeof code === 'string' && SERVER_CODES.has(code)) {\n    const description = body?.error_description;\n    return {\n      code: code as OAuthErrorCode,\n      message: typeof description === 'string' && description ? description : fallback,\n    };\n  }\n  return { message: formatAuthError(err, fallback) };\n};\n","'use client';\n\nimport { useState } from 'react';\n\nimport { authLogger } from '../utils/logger';\nimport { isQuotaExceededError, isWithinSizeLimit } from '../utils/storage';\n\n/**\n * Simple sessionStorage hook with better error handling\n * @param key - Storage key\n * @param initialValue - Default value if key doesn't exist\n * @returns [value, setValue, removeValue] - Current value, setter function, and remove function\n */\nexport function useSessionStorage<T>(key: string, initialValue: T) {\n  // Get initial value from sessionStorage or use provided initialValue\n  const [storedValue, setStoredValue] = useState<T>(() => {\n    if (typeof window === 'undefined') {\n      return initialValue;\n    }\n\n    try {\n      const item = window.sessionStorage.getItem(key);\n      return item ? JSON.parse(item) : initialValue;\n    } catch (error) {\n      authLogger.error(`Error reading sessionStorage key \"${key}\":`, error);\n      return initialValue;\n    }\n  });\n\n  // Clear old data when sessionStorage is full\n  const clearOldData = () => {\n    try {\n      const keys = Object.keys(sessionStorage).filter(key => key && typeof key === 'string');\n      // Remove oldest items if we have more than 50 items\n      if (keys.length > 50) {\n        const itemsToRemove = Math.ceil(keys.length * 0.2);\n        for (let i = 0; i < itemsToRemove; i++) {\n          try {\n            const key = keys[i];\n            if (key) {\n              sessionStorage.removeItem(key);\n              sessionStorage.removeItem(`${key}_ts`);\n            }\n          } catch {\n            // Ignore errors when removing items\n          }\n        }\n      }\n    } catch (error) {\n      authLogger.error('Error clearing old sessionStorage data:', error);\n    }\n  };\n\n  // Force clear all data if quota is exceeded\n  const forceClearAll = () => {\n    try {\n      const keys = Object.keys(sessionStorage);\n      for (const key of keys) {\n        try {\n          sessionStorage.removeItem(key);\n        } catch {\n          // Ignore errors when removing items\n        }\n      }\n    } catch (error) {\n      authLogger.error('Error force clearing sessionStorage:', error);\n    }\n  };\n\n  // Update sessionStorage when value changes\n  const setValue = (value: T | ((val: T) => T)) => {\n    try {\n      const valueToStore = value instanceof Function ? value(storedValue) : value;\n      \n      // Check data size before attempting to save\n      if (!isWithinSizeLimit(valueToStore, key)) {\n        authLogger.warn(`Data size too large for key \"${key}\", removing key`);\n        // Remove the key if data is too large\n        try {\n          window.sessionStorage.removeItem(key);\n          window.sessionStorage.removeItem(`${key}_ts`);\n        } catch {\n          // Ignore errors when removing\n        }\n        // Still update the state\n        setStoredValue(valueToStore);\n        return;\n      }\n      \n      setStoredValue(valueToStore);\n\n      if (typeof window !== 'undefined') {\n        // Try to set the value\n        try {\n          window.sessionStorage.setItem(key, JSON.stringify(valueToStore));\n          // Add timestamp for cleanup\n          window.sessionStorage.setItem(`${key}_ts`, Date.now().toString());\n        } catch (storageError: unknown) {\n          // If quota exceeded, clear old data and try again\n          if (isQuotaExceededError(storageError)) {\n            authLogger.warn('sessionStorage quota exceeded, clearing old data...');\n            clearOldData();\n            \n            // Try again after clearing\n            try {\n              window.sessionStorage.setItem(key, JSON.stringify(valueToStore));\n              window.sessionStorage.setItem(`${key}_ts`, Date.now().toString());\n            } catch (retryError) {\n              authLogger.error(`Failed to set sessionStorage key \"${key}\" after clearing old data:`, retryError);\n              // If still fails, force clear all and try one more time\n              try {\n                forceClearAll();\n                window.sessionStorage.setItem(key, JSON.stringify(valueToStore));\n                window.sessionStorage.setItem(`${key}_ts`, Date.now().toString());\n              } catch (finalError) {\n                authLogger.error(`Failed to set sessionStorage key \"${key}\" after force clearing:`, finalError);\n                // If still fails, just update the state without sessionStorage\n                setStoredValue(valueToStore);\n              }\n            }\n          } else {\n            throw storageError;\n          }\n        }\n      }\n    } catch (error) {\n      authLogger.error(`Error setting sessionStorage key \"${key}\":`, error);\n      // Still update the state even if sessionStorage fails\n      const valueToStore = value instanceof Function ? value(storedValue) : value;\n      setStoredValue(valueToStore);\n    }\n  };\n\n  // Remove value from sessionStorage\n  const removeValue = () => {\n    try {\n      setStoredValue(initialValue);\n      if (typeof window !== 'undefined') {\n        try {\n          window.sessionStorage.removeItem(key);\n          window.sessionStorage.removeItem(`${key}_ts`);\n        } catch (removeError: unknown) {\n          // If removal fails due to quota, try to clear some data first\n          if (isQuotaExceededError(removeError)) {\n            authLogger.warn('sessionStorage quota exceeded during removal, clearing old data...');\n            clearOldData();\n            \n            try {\n              window.sessionStorage.removeItem(key);\n              window.sessionStorage.removeItem(`${key}_ts`);\n            } catch (retryError) {\n              authLogger.error(`Failed to remove sessionStorage key \"${key}\" after clearing:`, retryError);\n              // If still fails, force clear all\n              forceClearAll();\n            }\n          } else {\n            throw removeError;\n          }\n        }\n      }\n    } catch (error) {\n      authLogger.error(`Error removing sessionStorage key \"${key}\":`, error);\n    }\n  };\n\n  return [storedValue, setValue, removeValue] as const;\n}\n","/**\n * Web Storage helpers shared by `useLocalStorage` and `useSessionStorage`.\n *\n * Both hooks carried byte-identical copies of `checkDataSize`, and the quota\n * check was written out four times — twice per hook, on write and on remove.\n * Every copy typed its caught error `any` and then read three properties off\n * it, which is exactly the read `unknown` makes you justify.\n */\n\nimport { authLogger } from './logger';\n\n/** Per-item ceiling. Browsers cap the whole origin near 5MB. */\nconst MAX_ITEM_KB = 1024;\n\n/**\n * Whether a caught error means the storage quota is full.\n *\n * Browsers disagree on how to say it: modern engines throw a `DOMException`\n * named `QuotaExceededError`, older WebKit used code 22, and some report it\n * only in the message. All three are checked because all three are still met\n * in the wild — and because the caller's response (drop old data, retry) is\n * the same for each.\n */\nexport function isQuotaExceededError(error: unknown): boolean {\n  if (typeof error !== 'object' || error === null) return false;\n\n  const { name, code, message } = error as {\n    name?: unknown;\n    code?: unknown;\n    message?: unknown;\n  };\n\n  return (\n    name === 'QuotaExceededError' ||\n    code === 22 ||\n    (typeof message === 'string' && message.includes('quota'))\n  );\n}\n\n/**\n * Whether `data` serialises to something small enough to store.\n *\n * `unknown` rather than a type parameter: this only serialises, so it needs no\n * knowledge of the shape, and a parameter would invite callers to read one.\n * Returns false on a value that cannot be serialised at all — a circular\n * reference is not storable either, and the caller's response is identical.\n */\nexport function isWithinSizeLimit(data: unknown, key: string): boolean {\n  try {\n    const sizeInKB = new Blob([JSON.stringify(data)]).size / 1024;\n\n    if (sizeInKB > MAX_ITEM_KB) {\n      authLogger.warn(\n        `Data size (${sizeInKB.toFixed(2)}KB) exceeds 1MB limit for key \"${key}\"`,\n      );\n      return false;\n    }\n\n    return true;\n  } catch (error) {\n    authLogger.error(`Error checking data size for key \"${key}\":`, error);\n    return false;\n  }\n}\n","import { CFG_KEYS } from '../../_api/generated/helpers/keys';\nimport { useSessionStorage } from './useSessionStorage';\n\nconst AUTH_REDIRECT_KEY = CFG_KEYS.redirectUrl.key;\n\nexport interface AuthRedirectOptions {\n  fallbackUrl?: string;\n  clearOnUse?: boolean;\n}\n\n/**\n * Read redirect URL directly from sessionStorage (bypasses React state)\n * This is needed because different component instances have different React states\n */\nconst getRedirectFromStorage = (): string => {\n  if (typeof window === 'undefined') return '';\n  try {\n    const item = window.sessionStorage.getItem(AUTH_REDIRECT_KEY);\n    return item ? JSON.parse(item) : '';\n  } catch {\n    return '';\n  }\n};\n\n/**\n * Clear redirect URL directly from sessionStorage\n */\nconst clearRedirectFromStorage = (): void => {\n  if (typeof window === 'undefined') return;\n  try {\n    window.sessionStorage.removeItem(AUTH_REDIRECT_KEY);\n    window.sessionStorage.removeItem(`${AUTH_REDIRECT_KEY}_ts`);\n  } catch {\n    // Ignore errors\n  }\n};\n\n/**\n * Read the saved back-url without clearing it. Null when nothing saved —\n * unlike getFinalRedirectUrl, never substitutes a fallback.\n */\nexport const peekSavedRedirect = (): string | null => getRedirectFromStorage() || null;\n\n/**\n * Read AND clear the saved back-url (single-use intent). Null when nothing\n * saved. This is the one primitive every post-auth navigator uses to honor\n * \"return the user to where the guard bounced them from\".\n */\nexport const consumeSavedRedirect = (): string | null => {\n  const stored = getRedirectFromStorage();\n  if (stored) clearRedirectFromStorage();\n  return stored || null;\n};\n\nexport const useAuthRedirectManager = (options: AuthRedirectOptions = {}) => {\n  const { fallbackUrl = '/private', clearOnUse = true } = options;\n  const [redirectUrl, setRedirectUrl, removeRedirectUrl] = useSessionStorage<string>(AUTH_REDIRECT_KEY, '');\n\n  const setRedirect = (url: string) => {\n    setRedirectUrl(url);\n  };\n\n  const getRedirect = () => {\n    // Read directly from storage to get latest value across components\n    return getRedirectFromStorage() || redirectUrl;\n  };\n\n  const clearRedirect = () => {\n    removeRedirectUrl();\n    clearRedirectFromStorage();\n  };\n\n  const hasRedirect = () => {\n    const stored = getRedirectFromStorage();\n    return stored.length > 0 || redirectUrl.length > 0;\n  };\n\n  const getFinalRedirectUrl = () => {\n    // Read directly from storage to get latest value across components\n    const stored = getRedirectFromStorage();\n    return stored || redirectUrl || fallbackUrl;\n  };\n\n  const useAndClearRedirect = () => {\n    // Read directly from storage to ensure we get the latest saved URL\n    // even if it was saved by a different component instance\n    const stored = getRedirectFromStorage();\n    const finalUrl = stored || redirectUrl || fallbackUrl;\n\n    if (clearOnUse) {\n      clearRedirect();\n    }\n    return finalUrl;\n  };\n\n  return {\n    redirectUrl,\n    setRedirect,\n    getRedirect,\n    clearRedirect,\n    hasRedirect,\n    getFinalRedirectUrl,\n    useAndClearRedirect\n  };\n}; \n","'use client';\n\nimport { useMemo, useState, useSyncExternalStore } from 'react';\n\nimport { useCfgAccountsOauthProvidersRetrieve } from '../../_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthProvidersRetrieve';\nimport { CFG_KEYS, cfgStorage } from '../../_api/generated/helpers/keys';\nimport type { OAuthProviderInfo } from '../../_api/generated/types.gen';\nimport { OAUTH_PROVIDER_IDS } from './useOAuthLogin';\n\nexport interface UseOAuthProvidersReturn {\n  /** Providers the server has configured, in the server's display order. Empty until ready and on failure. */\n  providers: OAuthProviderInfo[];\n  /** False only while the first request is in flight and nothing is cached. */\n  isReady: boolean;\n}\n\nconst EMPTY: OAuthProviderInfo[] = [];\nconst CACHE_KEY = CFG_KEYS.oauthProviders.key;\n\n/** A failed request is tried again this many times before the list is given up as empty. */\nexport const OAUTH_PROVIDERS_MAX_RETRIES = 2;\n/** Base wait before a retry; grows linearly (1s, then 2s), so a flaky mobile network has ~3s to recover. */\nexport const OAUTH_PROVIDERS_RETRY_MS = 1000;\n\nconst isInfo = (value: unknown): value is OAuthProviderInfo =>\n  typeof value === 'object' && value !== null && typeof (value as { id?: unknown }).id === 'string';\n\n// useSyncExternalStore needs a stable snapshot: parse again only when the stored text changed.\nlet lastRaw: string | null = null;\nlet lastParsed: OAuthProviderInfo[] | undefined;\n\n/** The list the previous page of this tab fetched; `undefined` when none or unreadable. */\nconst readCached = (): OAuthProviderInfo[] | undefined => {\n  const raw = cfgStorage.read(CACHE_KEY);\n  if (raw === lastRaw) return lastParsed;\n  lastRaw = raw;\n  try {\n    const parsed: unknown = raw === null ? null : JSON.parse(raw);\n    lastParsed = Array.isArray(parsed) && parsed.every(isInfo) ? parsed : undefined;\n  } catch {\n    lastParsed = undefined;\n  }\n  return lastParsed;\n};\n\nconst subscribe = () => () => {};\nconst serverSnapshot = () => undefined;\n\n/**\n * The sign-in providers the server offers (`GET /cfg/accounts/oauth/providers/`).\n *\n * Fetched once per page session and kept in `sessionStorage`, so a reload or\n * \"Try again\" after a failed callback shows the buttons at once; the server\n * answer always wins. A failed request is retried twice (a dropped mobile\n * connection or a gateway 502 must not hide the buttons for the whole visit);\n * only when the retries fail too does the hook yield the cached list, else\n * `[]`, with `isReady: true`: the email form never waits on, or breaks\n * because of, this list. Ids this client has no adapter for (a newer backend) are dropped.\n */\nexport const useOAuthProviders = (): UseOAuthProvidersReturn => {\n  // Server and first client render see `undefined`, so hydration matches.\n  const cached = useSyncExternalStore(subscribe, readCached, serverSnapshot);\n\n  const [failed, setFailed] = useState(false);\n\n  const { data } = useCfgAccountsOauthProvidersRetrieve(undefined, {\n    revalidateOnFocus: false,\n    revalidateOnReconnect: false,\n    revalidateOnMount: true,\n    shouldRetryOnError: true,\n    onErrorRetry: (_error, _key, _config, revalidate, opts) => {\n      // `opts.retryCount` is 1 for the first failure.\n      if (opts.retryCount > OAUTH_PROVIDERS_MAX_RETRIES) {\n        setFailed(true);\n        return;\n      }\n      setTimeout(() => void revalidate(opts), OAUTH_PROVIDERS_RETRY_MS * opts.retryCount);\n    },\n    dedupingInterval: 60 * 60 * 1000,\n    fallbackData: cached && { providers: cached },\n    onSuccess: (response) => {\n      setFailed(false);\n      cfgStorage.writeJSON(CACHE_KEY, response.providers);\n    },\n  });\n\n  const providers = useMemo(\n    () => data?.providers.filter((p) => OAUTH_PROVIDER_IDS.includes(p.id)) ?? EMPTY,\n    [data],\n  );\n\n  // Ready on an answer, on a cached list (usable at once), or when the retries gave up.\n  // Not `isLoading`: it is off in the wait between a failure and its retry.\n  return { providers, isReady: data !== undefined || failed || cached !== undefined };\n};\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// List OAuth providers\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWR from \"swr\";\nimport type { SWRConfiguration, SWRResponse } from \"swr\";\nimport { CfgAccountsOauth } from \"../../sdk.gen\";\nimport type { CfgAccountsOauthProvidersRetrieveData, CfgAccountsOauthProvidersRetrieveResponses } from \"../../types.gen\";\n\n\ntype Result = CfgAccountsOauthProvidersRetrieveResponses[keyof CfgAccountsOauthProvidersRetrieveResponses];\n\n/**\n * Optional `enabled` flag — when `false`, the SWR key becomes `null` and\n * no request is made. Use for gated endpoints (auth-required, feature\n * flags, \"fetch only when X is selected\"). The flag is stripped before\n * being forwarded to `useSWR` so the underlying SWR config stays pristine.\n */\ntype HookConfig = SWRConfiguration<Result> & { enabled?: boolean };\n\n// The return type is ANNOTATED, not inferred. Left to inference, tsc reaches\n// into swr's internal `dist/types-*` module to name the result and fails with\n// TS2742 (\"cannot be named without a reference to ... not portable\") in every\n// consumer that has swr hoisted to a different node_modules depth. Naming\n// SWRResponse here keeps the public surface expressible from the package's own\n// imports.\nexport function useCfgAccountsOauthProvidersRetrieve(\n  args?: Omit<CfgAccountsOauthProvidersRetrieveData, \"url\" | \"body\">,\n  config?: HookConfig,\n): SWRResponse<Result> {\n  const { enabled = true, ...swrConfig } = config ?? {};\n  const key = enabled ? [\"cfg_accounts_oauth_providers_retrieve\", args ?? {}] as const : null;\n  return useSWR<Result>(\n    key,\n    async () => {\n      const res = await CfgAccountsOauth.cfgAccountsOauthProvidersRetrieve({ ...(args ?? {}), throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/OAuthProvidersResponse\")\n        .then(({ OAuthProvidersResponseSchema }) => {\n          const parsed = OAuthProvidersResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_oauth_providers_retrieve\",\n              method: \"GET\",\n              path: \"/cfg/accounts/oauth/providers/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_oauth_providers_retrieve\",\n                    method: \"GET\",\n                    path: \"/cfg/accounts/oauth/providers/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    swrConfig,\n  );\n}\n","'use client';\n\nimport { useCallback } from 'react';\n\nimport { type UseOAuthLoginOptions, useOAuthLogin } from './useOAuthLogin';\n\nexport type { OAuthUser } from './useOAuthLogin';\n\n/** @deprecated Use `UseOAuthLoginOptions`. */\nexport type UseGithubAuthOptions = UseOAuthLoginOptions;\n\n/** @deprecated Use `UseOAuthLoginReturn`. */\nexport interface UseGithubAuthReturn {\n  isLoading: boolean;\n  error: string | null;\n  startGithubAuth: () => Promise<void>;\n  handleGithubCallback: (code: string, state: string) => Promise<void>;\n}\n\n/**\n * @deprecated Use `useOAuthLogin` (`start('github')`, `complete('github', code, state)`).\n * Kept for one minor release; behaviour is `useOAuthLogin` with the provider fixed.\n */\nexport const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuthReturn => {\n  const { isLoading, error, start, complete } = useOAuthLogin(options);\n  const startGithubAuth = useCallback(() => start('github'), [start]);\n  const handleGithubCallback = useCallback(\n    (code: string, state: string) => complete('github', code, state),\n    [complete],\n  );\n  return { isLoading, error, startGithubAuth, handleGithubCallback };\n};\n","'use client';\n\nimport { useCallback, useState } from 'react';\n\nimport { auth } from '../../_api/generated/helpers/auth';\nimport { CfgTotpVerify } from '../../_api/generated/sdk.gen';\nimport type { TotpVerifyUser, VerifyResponse } from '../../_api/generated/types.gen';\nimport { Analytics, AnalyticsCategory, AnalyticsEvent } from '../utils/analytics';\nimport { authLogger } from '../utils/logger';\nimport { formatAuthError, logAuthFailure } from '../utils/errors';\nimport { consumeSavedRedirect } from './useAuthRedirect';\nimport { useCfgRouter } from './useCfgRouter';\nimport { extractAttemptsRemaining, isValidTotpCode } from './twoFactor.shared';\nimport { authTrace } from '../trace';\n\nexport interface UseTwoFactorVerifyOptions {\n  /** Callback on successful 2FA verification */\n  onSuccess?: (user: TotpVerifyUser) => void;\n  /** Callback on error */\n  onError?: (error: string) => void;\n  /** URL to redirect after successful verification */\n  redirectUrl?: string;\n  /** Skip automatic redirect after success (caller handles navigation) */\n  skipRedirect?: boolean;\n}\n\nexport interface UseTwoFactorVerifyReturn {\n  /** Loading state */\n  isLoading: boolean;\n  /** Error message */\n  error: string | null;\n  /** Warning message (e.g., low backup codes) */\n  warning: string | null;\n  /** Remaining backup codes (if backup code was used) */\n  remainingBackupCodes: number | null;\n  /** Remaining verification attempts before lockout */\n  attemptsRemaining: number | null;\n  /** Verify TOTP code */\n  verifyTOTP: (sessionId: string, code: string) => Promise<boolean>;\n  /** Verify backup code */\n  verifyBackupCode: (sessionId: string, backupCode: string) => Promise<boolean>;\n  /** Clear error */\n  clearError: () => void;\n}\n\n/**\n * 2FA verification during login (internal — composed by {@link useTwoFactor}).\n *\n * After OTP/OAuth verification returns requires_2fa=true and a session_id,\n * collect the TOTP (or backup) code and call verifyTOTP/verifyBackupCode to\n * complete authentication.\n */\nexport const useTwoFactorVerify = (\n  options: UseTwoFactorVerifyOptions = {},\n): UseTwoFactorVerifyReturn => {\n  const { onSuccess, onError, redirectUrl, skipRedirect = false } = options;\n  const router = useCfgRouter();\n\n  const [isLoading, setIsLoading] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [warning, setWarning] = useState<string | null>(null);\n  const [remainingBackupCodes, setRemainingBackupCodes] = useState<number | null>(null);\n  const [attemptsRemaining, setAttemptsRemaining] = useState<number | null>(null);\n\n  const clearError = useCallback(() => {\n    setError(null);\n  }, []);\n\n  // `VerifyResponse` is the generated shape of this endpoint, so the hand-written\n  // copy it replaces cannot drift from the server contract any more.\n  const handleSuccess = useCallback((response: VerifyResponse) => {\n    // Save tokens — the ONE write path (atomic pair + session notification).\n    // Storage is always localStorage; session length is the server's call.\n    // See AccountsContext.verifyOTP.\n    authTrace('2fa.session');\n    auth.setSession({ access: response.access_token, refresh: response.refresh_token });\n\n    if (response.warning) {\n      setWarning(response.warning);\n    }\n    if (response.remaining_backup_codes !== undefined) {\n      setRemainingBackupCodes(response.remaining_backup_codes);\n    }\n\n    Analytics.event(AnalyticsEvent.AUTH_LOGIN_SUCCESS, {\n      category: AnalyticsCategory.AUTH,\n      label: '2fa',\n    });\n    if (response.user?.id) {\n      Analytics.setUser(String(response.user.id));\n    }\n\n    onSuccess?.(response.user);\n\n    // Redirect (unless skipRedirect). Priority: saved back-url > option > default.\n    if (!skipRedirect) {\n      const finalRedirectUrl = consumeSavedRedirect() || redirectUrl || '/private';\n      authLogger.info('2FA successful, redirecting to:', finalRedirectUrl);\n      router.hardPush(finalRedirectUrl);\n    }\n  }, [onSuccess, redirectUrl, router, skipRedirect]);\n\n  const verifyTOTP = useCallback(async (sessionId: string, code: string): Promise<boolean> => {\n    if (!sessionId) {\n      const msg = 'Missing 2FA session ID';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    }\n    if (!isValidTotpCode(code)) {\n      const msg = 'Please enter a 6-digit code';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    }\n\n    setIsLoading(true);\n    setError(null);\n\n    try {\n      authLogger.info('Verifying TOTP code...');\n\n      const result = await CfgTotpVerify.cfgTotpVerifyCreate({\n        body: { session_id: sessionId, code },\n        throwOnError: true,\n      });\n      const response = result.data;\n\n      if (!response.access_token || !response.refresh_token) {\n        throw new Error('Invalid response from 2FA verification');\n      }\n\n      handleSuccess(response);\n      return true;\n    } catch (err) {\n      logAuthFailure(authLogger, '2FA TOTP verification failed:', err);\n      const errorMessage = formatAuthError(err, 'Invalid verification code');\n      const attempts = extractAttemptsRemaining(err);\n      if (attempts !== null) setAttemptsRemaining(attempts);\n      setError(errorMessage);\n      onError?.(errorMessage);\n\n      Analytics.event(AnalyticsEvent.AUTH_OTP_VERIFY_FAIL, {\n        category: AnalyticsCategory.AUTH,\n        label: '2fa-totp',\n      });\n      return false;\n    } finally {\n      setIsLoading(false);\n    }\n  }, [handleSuccess, onError]);\n\n  const verifyBackupCode = useCallback(async (sessionId: string, backupCode: string): Promise<boolean> => {\n    if (!sessionId) {\n      const msg = 'Missing 2FA session ID';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    }\n    if (!backupCode || backupCode.length < 8) {\n      const msg = 'Please enter your backup code';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    }\n\n    setIsLoading(true);\n    setError(null);\n\n    try {\n      authLogger.info('Verifying backup code...');\n\n      const result = await CfgTotpVerify.cfgTotpVerifyBackupCreate({\n        body: {\n          session_id: sessionId,\n          backup_code: backupCode.replace(/\\s+/g, ''),\n        },\n        throwOnError: true,\n      });\n      const response = result.data;\n\n      if (!response.access_token || !response.refresh_token) {\n        throw new Error('Invalid response from backup code verification');\n      }\n\n      handleSuccess(response);\n      return true;\n    } catch (err) {\n      logAuthFailure(authLogger, '2FA backup code verification failed:', err);\n      const errorMessage = formatAuthError(err, 'Invalid backup code');\n      const attempts = extractAttemptsRemaining(err);\n      if (attempts !== null) setAttemptsRemaining(attempts);\n      setError(errorMessage);\n      onError?.(errorMessage);\n\n      Analytics.event(AnalyticsEvent.AUTH_OTP_VERIFY_FAIL, {\n        category: AnalyticsCategory.AUTH,\n        label: '2fa-backup',\n      });\n      return false;\n    } finally {\n      setIsLoading(false);\n    }\n  }, [handleSuccess, onError]);\n\n  return {\n    isLoading,\n    error,\n    warning,\n    remainingBackupCodes,\n    attemptsRemaining,\n    verifyTOTP,\n    verifyBackupCode,\n    clearError,\n  };\n};\n","'use client';\n\nimport { APIError } from '../../_api/generated/helpers';\n\n/**\n * Shared internals for the 2FA hook family (verify / setup / status).\n *\n * Before consolidation each of the three hooks re-implemented error extraction\n * and 6-digit validation slightly differently — three copies that drifted. This\n * module is the single source for both, so every 2FA verb reports errors and\n * validates codes identically.\n *\n * Error extraction itself now lives one level up, in `utils/errors`: this\n * module's own copy was the second of three spellings of the same chain across\n * the auth layer, and the one that could not tell a status code from prose.\n */\n\nconst TOTP_CODE_LENGTH = 6;\n\n/** The one field the shared resolver does not read for us. */\ninterface TwoFactorErrorBody {\n  attempts_remaining?: unknown;\n}\n\n/** Pull `attempts_remaining` off an APIError body, or null if absent. */\nexport function extractAttemptsRemaining(err: unknown): number | null {\n  if (err instanceof APIError) {\n    const body = (err.response ?? null) as TwoFactorErrorBody | null;\n    if (typeof body?.attempts_remaining === 'number') return body.attempts_remaining;\n  }\n  return null;\n}\n\n/** True when `code` is a well-formed 6-digit TOTP code. */\nexport function isValidTotpCode(code: string): boolean {\n  return !!code && code.length === TOTP_CODE_LENGTH;\n}\n\nexport { TOTP_CODE_LENGTH };\n","'use client';\n\nimport { useCallback, useState } from 'react';\n\nimport { CfgTotpSetup } from '../../_api/generated/sdk.gen';\nimport { authLogger } from '../utils/logger';\nimport { formatAuthError, logAuthFailure } from '../utils/errors';\nimport { isValidTotpCode } from './twoFactor.shared';\n\nexport interface TwoFactorSetupData {\n  /** Device ID to use for confirmation */\n  deviceId: string;\n  /** Base32-encoded TOTP secret (for manual entry) */\n  secret: string;\n  /** otpauth:// URI for QR code generation */\n  provisioningUri: string;\n  /** Base64-encoded QR code image (data URI) */\n  qrCodeBase64: string;\n  /** Seconds until setup expires */\n  expiresIn: number;\n}\n\nexport interface UseTwoFactorSetupOptions {\n  /** Callback when setup is confirmed and backup codes are generated */\n  onComplete?: (backupCodes: string[]) => void;\n  /** Callback on error */\n  onError?: (error: string) => void;\n}\n\nexport interface UseTwoFactorSetupReturn {\n  /** Loading state */\n  isLoading: boolean;\n  /** Error message */\n  error: string | null;\n  /** Setup data (QR code, secret, etc.) */\n  setupData: TwoFactorSetupData | null;\n  /** Backup codes after confirmation */\n  backupCodes: string[] | null;\n  /** Warning message about backup codes */\n  backupCodesWarning: string | null;\n  /** Current setup step */\n  setupStep: 'idle' | 'scanning' | 'confirming' | 'complete';\n  /** Start 2FA setup - returns QR code data */\n  startSetup: (deviceName?: string) => Promise<TwoFactorSetupData | null>;\n  /** Confirm setup with TOTP code - returns backup codes */\n  confirmSetup: (code: string) => Promise<string[] | null>;\n  /** Reset setup state */\n  resetSetup: () => void;\n  /** Clear error */\n  clearError: () => void;\n}\n\n/**\n * 2FA setup — enabling TOTP (internal, composed by {@link useTwoFactor}).\n *\n * Flow: startSetup() → user scans QR → confirmSetup(code) → show backup codes.\n */\nexport const useTwoFactorSetup = (\n  options: UseTwoFactorSetupOptions = {},\n): UseTwoFactorSetupReturn => {\n  const { onComplete, onError } = options;\n\n  const [isLoading, setIsLoading] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [setupData, setSetupData] = useState<TwoFactorSetupData | null>(null);\n  const [backupCodes, setBackupCodes] = useState<string[] | null>(null);\n  const [backupCodesWarning, setBackupCodesWarning] = useState<string | null>(null);\n  const [setupStep, setSetupStep] = useState<'idle' | 'scanning' | 'confirming' | 'complete'>('idle');\n\n  const clearError = useCallback(() => {\n    setError(null);\n  }, []);\n\n  const resetSetup = useCallback(() => {\n    setSetupData(null);\n    setBackupCodes(null);\n    setBackupCodesWarning(null);\n    setSetupStep('idle');\n    setError(null);\n  }, []);\n\n  const startSetup = useCallback(async (deviceName?: string): Promise<TwoFactorSetupData | null> => {\n    setIsLoading(true);\n    setError(null);\n    setSetupStep('scanning');\n\n    try {\n      authLogger.info('Starting 2FA setup...');\n\n      const result = await CfgTotpSetup.cfgTotpSetupCreate({\n        body: { device_name: deviceName },\n        throwOnError: true,\n      });\n      const response = result.data;\n\n      const data: TwoFactorSetupData = {\n        deviceId: response.device_id,\n        secret: response.secret,\n        provisioningUri: response.provisioning_uri,\n        qrCodeBase64: response.qr_code_base64,\n        expiresIn: response.expires_in,\n      };\n\n      setSetupData(data);\n      authLogger.info('2FA setup initiated, expires in:', data.expiresIn, 'seconds');\n\n      return data;\n    } catch (err) {\n      const errorMessage = formatAuthError(err, 'Failed to start 2FA setup');\n      logAuthFailure(authLogger, '2FA setup failed:', err);\n      setError(errorMessage);\n      setSetupStep('idle');\n      onError?.(errorMessage);\n      return null;\n    } finally {\n      setIsLoading(false);\n    }\n  }, [onError]);\n\n  const confirmSetup = useCallback(async (code: string): Promise<string[] | null> => {\n    if (!setupData) {\n      const msg = 'Setup not started. Call startSetup() first.';\n      setError(msg);\n      onError?.(msg);\n      return null;\n    }\n    if (!isValidTotpCode(code)) {\n      const msg = 'Please enter a 6-digit code';\n      setError(msg);\n      onError?.(msg);\n      return null;\n    }\n\n    setIsLoading(true);\n    setError(null);\n    setSetupStep('confirming');\n\n    try {\n      authLogger.info('Confirming 2FA setup...');\n\n      const result = await CfgTotpSetup.cfgTotpSetupConfirmCreate({\n        body: { device_id: setupData.deviceId, code },\n        throwOnError: true,\n      });\n      const response = result.data;\n\n      const codes = response.backup_codes;\n      setBackupCodes(codes);\n      setBackupCodesWarning(response.backup_codes_warning);\n      setSetupStep('complete');\n\n      authLogger.info('2FA setup confirmed, backup codes generated:', codes.length);\n\n      onComplete?.(codes);\n      return codes;\n    } catch (err) {\n      const errorMessage = formatAuthError(err, 'Invalid code. Please try again.');\n      logAuthFailure(authLogger, '2FA setup confirmation failed:', err);\n      setError(errorMessage);\n      setSetupStep('scanning'); // Go back to scanning step\n      onError?.(errorMessage);\n      return null;\n    } finally {\n      setIsLoading(false);\n    }\n  }, [setupData, onComplete, onError]);\n\n  return {\n    isLoading,\n    error,\n    setupData,\n    backupCodes,\n    backupCodesWarning,\n    setupStep,\n    startSetup,\n    confirmSetup,\n    resetSetup,\n    clearError,\n  };\n};\n","'use client';\n\nimport { useCallback, useState } from 'react';\n\nimport { CfgTotp } from '../../_api/generated/sdk.gen';\nimport { authLogger } from '../utils/logger';\nimport { formatAuthError, logAuthFailure } from '../utils/errors';\nimport { isValidTotpCode } from './twoFactor.shared';\n\nexport interface TwoFactorDevice {\n  id: string;\n  name: string;\n  createdAt: string;\n  lastUsedAt: string | null;\n  isPrimary: boolean;\n}\n\nexport interface UseTwoFactorStatusReturn {\n  /** Loading state */\n  isLoading: boolean;\n  /** Error message */\n  error: string | null;\n  /** Whether 2FA is enabled for user */\n  has2FAEnabled: boolean | null;\n  /** List of TOTP devices */\n  devices: TwoFactorDevice[];\n  /** Fetch 2FA status */\n  fetchStatus: () => Promise<void>;\n  /** Disable 2FA (requires TOTP code) */\n  disable2FA: (code: string) => Promise<boolean>;\n  /** Clear error */\n  clearError: () => void;\n}\n\n/**\n * Read and manage 2FA status (internal, composed by {@link useTwoFactor}).\n *\n * Fetches the device list / enabled flag and disables 2FA.\n */\nexport const useTwoFactorStatus = (): UseTwoFactorStatusReturn => {\n  const [isLoading, setIsLoading] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [has2FAEnabled, setHas2FAEnabled] = useState<boolean | null>(null);\n  const [devices, setDevices] = useState<TwoFactorDevice[]>([]);\n\n  const clearError = useCallback(() => {\n    setError(null);\n  }, []);\n\n  const fetchStatus = useCallback(async (): Promise<void> => {\n    setIsLoading(true);\n    setError(null);\n\n    try {\n      authLogger.info('Fetching 2FA status...');\n\n      // API returns { devices: [...], has_2fa_enabled: bool }\n      const result = await CfgTotp.cfgTotpDevicesRetrieve({ throwOnError: true });\n      const response = result.data;\n\n      const mappedDevices: TwoFactorDevice[] = response.devices.map((device) => ({\n        id: device.id,\n        name: device.name,\n        createdAt: device.created_at,\n        lastUsedAt: device.last_used_at ?? null,\n        isPrimary: device.is_primary,\n      }));\n\n      setDevices(mappedDevices);\n      setHas2FAEnabled(response.has_2fa_enabled);\n\n      authLogger.info('2FA status:', response.has_2fa_enabled ? 'enabled' : 'disabled');\n    } catch (err) {\n      const errorMessage = formatAuthError(err, 'Failed to fetch 2FA status');\n      logAuthFailure(authLogger, 'Failed to fetch 2FA status:', err);\n      setError(errorMessage);\n    } finally {\n      setIsLoading(false);\n    }\n  }, []);\n\n  const disable2FA = useCallback(async (code: string): Promise<boolean> => {\n    if (!isValidTotpCode(code)) {\n      setError('Please enter a 6-digit code');\n      return false;\n    }\n\n    setIsLoading(true);\n    setError(null);\n\n    try {\n      authLogger.info('Disabling 2FA...');\n\n      await CfgTotp.cfgTotpDisableCreate({ body: { code }, throwOnError: true });\n\n      setHas2FAEnabled(false);\n      setDevices([]);\n\n      authLogger.info('2FA disabled successfully');\n      return true;\n    } catch (err: unknown) {\n      const errorMessage = formatAuthError(err, 'Invalid verification code');\n      logAuthFailure(authLogger, 'Failed to disable 2FA:', err);\n      setError(errorMessage);\n      return false;\n    } finally {\n      setIsLoading(false);\n    }\n  }, []);\n\n  return {\n    isLoading,\n    error,\n    has2FAEnabled,\n    devices,\n    fetchStatus,\n    disable2FA,\n    clearError,\n  };\n};\n","'use client';\n\nimport {\n  useTwoFactorVerify,\n  type UseTwoFactorVerifyOptions,\n  type UseTwoFactorVerifyReturn,\n} from './useTwoFactorVerify';\nimport {\n  useTwoFactorSetup,\n  type TwoFactorSetupData,\n  type UseTwoFactorSetupOptions,\n  type UseTwoFactorSetupReturn,\n} from './useTwoFactorSetup';\nimport {\n  useTwoFactorStatus,\n  type TwoFactorDevice,\n  type UseTwoFactorStatusReturn,\n} from './useTwoFactorStatus';\n\nexport interface UseTwoFactorOptions {\n  /** Options for the login-time verification namespace */\n  verify?: UseTwoFactorVerifyOptions;\n  /** Options for the setup (enable) namespace */\n  setup?: UseTwoFactorSetupOptions;\n}\n\nexport interface UseTwoFactorReturn {\n  /** Verify a 2FA challenge during login (TOTP / backup code). */\n  verify: UseTwoFactorVerifyReturn;\n  /** Enable 2FA — QR provisioning → confirm → backup codes. */\n  setup: UseTwoFactorSetupReturn;\n  /** Read device list / enabled flag and disable 2FA. */\n  status: UseTwoFactorStatusReturn;\n}\n\n/**\n * Single entry point for all two-factor authentication flows.\n *\n * The three concerns — **verify** (login), **setup** (enable) and **status**\n * (manage/disable) — are distinct verbs over the same `CfgTotp*` API, so each\n * is exposed as its own namespace with an independent loading/error surface:\n *\n * @example\n * ```tsx\n * const two = useTwoFactor({ verify: { redirectUrl: '/dashboard' } });\n *\n * await two.verify.verifyTOTP(sessionId, code); // login\n * await two.setup.startSetup('My iPhone');       // enable\n * await two.status.fetchStatus();                // manage\n * ```\n *\n * Consumers that only need one concern can compose the underlying hooks\n * directly (`useTwoFactorVerify` / `useTwoFactorSetup` / `useTwoFactorStatus`),\n * all re-exported alongside this one, to avoid mounting the others' state.\n */\nexport const useTwoFactor = (options: UseTwoFactorOptions = {}): UseTwoFactorReturn => {\n  const verify = useTwoFactorVerify(options.verify);\n  const setup = useTwoFactorSetup(options.setup);\n  const status = useTwoFactorStatus();\n\n  return { verify, setup, status };\n};\n\n// Namespaced sub-hooks — use directly when only one concern is needed.\nexport {\n  useTwoFactorVerify,\n  useTwoFactorSetup,\n  useTwoFactorStatus,\n  type UseTwoFactorVerifyOptions,\n  type UseTwoFactorVerifyReturn,\n  type UseTwoFactorSetupOptions,\n  type UseTwoFactorSetupReturn,\n  type UseTwoFactorStatusReturn,\n  type TwoFactorSetupData,\n  type TwoFactorDevice,\n};\n","'use client';\n\nimport { useState } from 'react';\n\nimport { authLogger } from '../utils/logger';\nimport { isQuotaExceededError, isWithinSizeLimit } from '../utils/storage';\n\n/**\n * Simple localStorage hook with better error handling\n * @param key - Storage key\n * @param initialValue - Default value if key doesn't exist\n * @returns [value, setValue, removeValue] - Current value, setter function, and remove function\n */\nexport function useLocalStorage<T>(key: string, initialValue: T) {\n  // Get initial value from localStorage or use provided initialValue\n  const [storedValue, setStoredValue] = useState<T>(() => {\n    if (typeof window === 'undefined') {\n      return initialValue;\n    }\n\n    try {\n      const item = window.localStorage.getItem(key);\n      if (item === null) {\n        return initialValue;\n      }\n      \n      // Try to parse as JSON first, fallback to string\n      try {\n        return JSON.parse(item);\n      } catch {\n        // If JSON.parse fails, return as string\n        return item as T;\n      }\n    } catch (error) {\n      authLogger.error(`Error reading localStorage key \"${key}\":`, error);\n      return initialValue;\n    }\n  });\n\n  // Clear old data when localStorage is full\n  const clearOldData = () => {\n    try {\n      const keys = Object.keys(localStorage).filter(key => key && typeof key === 'string');\n      // Remove oldest items if we have more than 50 items\n      if (keys.length > 50) {\n        const itemsToRemove = Math.ceil(keys.length * 0.2);\n        for (let i = 0; i < itemsToRemove; i++) {\n          try {\n            const key = keys[i];\n            if (key) {\n              localStorage.removeItem(key);\n              localStorage.removeItem(`${key}_ts`);\n            }\n          } catch {\n            // Ignore errors when removing items\n          }\n        }\n      }\n    } catch (error) {\n      authLogger.error('Error clearing old localStorage data:', error);\n    }\n  };\n\n  // Force clear all data if quota is exceeded\n  const forceClearAll = () => {\n    try {\n      const keys = Object.keys(localStorage);\n      for (const key of keys) {\n        try {\n          localStorage.removeItem(key);\n        } catch {\n          // Ignore errors when removing items\n        }\n      }\n    } catch (error) {\n      authLogger.error('Error force clearing localStorage:', error);\n    }\n  };\n\n  // Update localStorage when value changes\n  const setValue = (value: T | ((val: T) => T)) => {\n    try {\n      const valueToStore = value instanceof Function ? value(storedValue) : value;\n      \n      // Check data size before attempting to save\n      if (!isWithinSizeLimit(valueToStore, key)) {\n        authLogger.warn(`Data size too large for key \"${key}\", removing key`);\n        // Remove the key if data is too large\n        try {\n          window.localStorage.removeItem(key);\n          window.localStorage.removeItem(`${key}_ts`);\n        } catch {\n          // Ignore errors when removing\n        }\n        // Still update the state\n        setStoredValue(valueToStore);\n        return;\n      }\n      \n      setStoredValue(valueToStore);\n\n      if (typeof window !== 'undefined') {\n        // Try to set the value\n        try {\n          // For strings, store directly without JSON.stringify\n          if (typeof valueToStore === 'string') {\n            window.localStorage.setItem(key, valueToStore);\n          } else {\n            window.localStorage.setItem(key, JSON.stringify(valueToStore));\n          }\n          // Add timestamp for cleanup\n          window.localStorage.setItem(`${key}_ts`, Date.now().toString());\n        } catch (storageError: unknown) {\n          // If quota exceeded, clear old data and try again\n          if (isQuotaExceededError(storageError)) {\n            authLogger.warn('localStorage quota exceeded, clearing old data...');\n            clearOldData();\n            \n            // Try again after clearing\n            try {\n              // For strings, store directly without JSON.stringify\n              if (typeof valueToStore === 'string') {\n                window.localStorage.setItem(key, valueToStore);\n              } else {\n                window.localStorage.setItem(key, JSON.stringify(valueToStore));\n              }\n              window.localStorage.setItem(`${key}_ts`, Date.now().toString());\n            } catch (retryError) {\n              authLogger.error(`Failed to set localStorage key \"${key}\" after clearing old data:`, retryError);\n              // If still fails, force clear all and try one more time\n              try {\n                forceClearAll();\n                // For strings, store directly without JSON.stringify\n                if (typeof valueToStore === 'string') {\n                  window.localStorage.setItem(key, valueToStore);\n                } else {\n                  window.localStorage.setItem(key, JSON.stringify(valueToStore));\n                }\n                window.localStorage.setItem(`${key}_ts`, Date.now().toString());\n              } catch (finalError) {\n                authLogger.error(`Failed to set localStorage key \"${key}\" after force clearing:`, finalError);\n                // If still fails, just update the state without localStorage\n                setStoredValue(valueToStore);\n              }\n            }\n          } else {\n            throw storageError;\n          }\n        }\n      }\n    } catch (error) {\n      authLogger.error(`Error setting localStorage key \"${key}\":`, error);\n      // Still update the state even if localStorage fails\n      const valueToStore = value instanceof Function ? value(storedValue) : value;\n      setStoredValue(valueToStore);\n    }\n  };\n\n  // Remove value from localStorage\n  const removeValue = () => {\n    try {\n      setStoredValue(initialValue);\n      if (typeof window !== 'undefined') {\n        try {\n          window.localStorage.removeItem(key);\n          window.localStorage.removeItem(`${key}_ts`);\n        } catch (removeError: unknown) {\n          // If removal fails due to quota, try to clear some data first\n          if (isQuotaExceededError(removeError)) {\n            authLogger.warn('localStorage quota exceeded during removal, clearing old data...');\n            clearOldData();\n            \n            try {\n              window.localStorage.removeItem(key);\n              window.localStorage.removeItem(`${key}_ts`);\n            } catch (retryError) {\n              authLogger.error(`Failed to remove localStorage key \"${key}\" after clearing:`, retryError);\n              // If still fails, force clear all\n              forceClearAll();\n            }\n          } else {\n            throw removeError;\n          }\n        }\n      }\n    } catch (error) {\n      authLogger.error(`Error removing localStorage key \"${key}\":`, error);\n    }\n  };\n\n  return [storedValue, setValue, removeValue] as const;\n}\n","\"use client\"\n\n/**\n * Base64 Encoding/Decoding Hook\n *\n * Provides base64 encoding/decoding with dev mode detection:\n * - In production: encodes data to base64\n * - In development: returns data as-is (no encoding)\n */\n\nimport { isDev } from '../utils/env';\n\n/**\n * Encode string to base64\n * @param data - String data to encode\n * @returns Base64 encoded string (or original in dev mode)\n */\nexport function encodeBase64(data: string): string {\n  if (isDev) {\n    return data;\n  }\n\n  try {\n    // Browser-safe base64 encoding\n    if (typeof window !== 'undefined') {\n      return btoa(encodeURIComponent(data).replace(/%([0-9A-F]{2})/g, (_, p1) => {\n        return String.fromCharCode(parseInt(p1, 16));\n      }));\n    }\n    // Node.js fallback\n    return Buffer.from(data, 'utf-8').toString('base64');\n  } catch (error) {\n    console.error('Base64 encoding error:', error);\n    return data; // Return original on error\n  }\n}\n\n/**\n * Decode base64 to string\n * @param encoded - Base64 encoded string\n * @returns Decoded string (or original in dev mode)\n */\nexport function decodeBase64(encoded: string): string {\n  if (isDev) {\n    return encoded;\n  }\n\n  try {\n    // Browser-safe base64 decoding\n    if (typeof window !== 'undefined') {\n      const binary = atob(encoded);\n      const bytes = new Uint8Array(binary.length);\n      for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n      }\n      return decodeURIComponent(\n        Array.from(bytes)\n          .map(byte => '%' + ('00' + byte.toString(16)).slice(-2))\n          .join('')\n      );\n    }\n    // Node.js fallback\n    return Buffer.from(encoded, 'base64').toString('utf-8');\n  } catch (error) {\n    console.error('Base64 decoding error:', error);\n    return encoded; // Return original on error\n  }\n}\n\n/**\n * Hook for base64 encoding/decoding\n * @returns Object with encode and decode functions\n */\nexport function useBase64() {\n  return {\n    encode: encodeBase64,\n    decode: decodeBase64,\n    isDev,\n  };\n}\n","\"use client\"\n\n/**\n * Profile Cache Hook\n *\n * Provides localStorage-based caching for user profile with:\n * - TTL (Time To Live) - default 1 hour\n * - Version control for migrations\n * - Automatic invalidation on expiry\n */\n\nimport type { User } from '../../';\nimport { authLogger as profileLogger } from '../utils/logger';\nimport { CFG_KEYS } from '../../_api/generated/helpers/keys';\nimport { decodeBase64, encodeBase64 } from './useBase64';\n\n// Cache configuration\nconst CACHE_KEY = CFG_KEYS.profileCache.key;\nconst CACHE_VERSION = 1;\nconst DEFAULT_TTL = 14400000; // 4 hours in milliseconds (reduced API calls, more resilient)\n\nexport interface ProfileCacheOptions {\n  /** Time to live in milliseconds (default: 1 hour) */\n  ttl?: number;\n}\n\ninterface CachedProfile {\n  version: number;\n  data: User;\n  timestamp: number;\n  ttl: number;\n}\n\n/**\n * Get cached profile from localStorage\n * @returns User profile if valid cache exists, null otherwise\n */\nexport function getCachedProfile(): User | null {\n  try {\n    if (typeof window === 'undefined') return null;\n\n    const cached = localStorage.getItem(CACHE_KEY);\n    if (!cached) {\n      profileLogger.debug('No cached profile found');\n      return null;\n    }\n\n    // Decode from base64\n    const decoded = decodeBase64(cached);\n    const cachedData: CachedProfile = JSON.parse(decoded);\n\n    // Version check\n    if (cachedData.version !== CACHE_VERSION) {\n      profileLogger.warn('Cache version mismatch, clearing cache');\n      clearProfileCache();\n      return null;\n    }\n\n    // TTL check\n    const now = Date.now();\n    const age = now - cachedData.timestamp;\n    if (age > cachedData.ttl) {\n      profileLogger.info('Cache expired, clearing');\n      clearProfileCache();\n      return null;\n    }\n\n    profileLogger.debug('Cache hit, age:', Math.round(age / 1000), 'seconds');\n    return cachedData.data;\n  } catch (error) {\n    profileLogger.error('Error reading cache:', error);\n    clearProfileCache();\n    return null;\n  }\n}\n\n/**\n * Save profile to localStorage cache\n * @param profile - User profile to cache\n * @param options - Cache options (TTL)\n */\nexport function setCachedProfile(profile: User, options?: ProfileCacheOptions): void {\n  try {\n    if (typeof window === 'undefined') return;\n\n    const cachedData: CachedProfile = {\n      version: CACHE_VERSION,\n      data: profile,\n      timestamp: Date.now(),\n      ttl: options?.ttl || DEFAULT_TTL,\n    };\n\n    // Encode to base64\n    const encoded = encodeBase64(JSON.stringify(cachedData));\n    localStorage.setItem(CACHE_KEY, encoded);\n    profileLogger.debug('Profile cached, TTL:', cachedData.ttl / 1000, 'seconds');\n  } catch (error) {\n    profileLogger.error('Error writing cache:', error);\n  }\n}\n\n/**\n * Clear profile cache from localStorage\n */\nexport function clearProfileCache(): void {\n  try {\n    if (typeof window === 'undefined') return;\n    localStorage.removeItem(CACHE_KEY);\n    profileLogger.debug('Cache cleared');\n  } catch (error) {\n    profileLogger.error('Error clearing cache:', error);\n  }\n}\n\n/**\n * Check if cached profile is valid (exists and not expired)\n */\nexport function hasValidCache(): boolean {\n  return getCachedProfile() !== null;\n}\n\n/**\n * Get cache metadata (age, TTL, etc.)\n */\nexport function getCacheMetadata(): {\n  exists: boolean;\n  age?: number;\n  ttl?: number;\n  expiresIn?: number;\n} | null {\n  try {\n    if (typeof window === 'undefined') return null;\n\n    const cached = localStorage.getItem(CACHE_KEY);\n    if (!cached) return { exists: false };\n\n    // Decode from base64\n    const decoded = decodeBase64(cached);\n    const cachedData: CachedProfile = JSON.parse(decoded);\n    const now = Date.now();\n    const age = now - cachedData.timestamp;\n    const expiresIn = cachedData.ttl - age;\n\n    return {\n      exists: true,\n      age,\n      ttl: cachedData.ttl,\n      expiresIn: Math.max(0, expiresIn),\n    };\n  } catch (error) {\n    profileLogger.error('Error reading metadata:', error);\n    return null;\n  }\n}\n","'use client';\n\nimport { useCallback, useState } from 'react';\n\nimport { CfgAccountsProfile } from '../../_api/generated/sdk.gen';\nimport { useAuth } from '../context';\nimport { authLogger } from '../utils/logger';\n\nexport interface DeleteAccountResult {\n  success: boolean;\n  message: string;\n}\n\nexport interface UseDeleteAccountReturn {\n  /** Loading state */\n  isLoading: boolean;\n  /** Error message */\n  error: string | null;\n  /** Delete the account */\n  deleteAccount: () => Promise<DeleteAccountResult>;\n  /** Clear error */\n  clearError: () => void;\n}\n\n/**\n * Hook for deleting user account.\n *\n * This performs a soft delete - deactivates the account and anonymizes personal data.\n * The account can be restored by an administrator if needed.\n *\n * @example\n * ```tsx\n * const { deleteAccount, isLoading, error } = useDeleteAccount();\n *\n * const handleDelete = async () => {\n *   await deleteAccount(); // Signs out after a successful deletion.\n * };\n * ```\n */\nexport const useDeleteAccount = (): UseDeleteAccountReturn => {\n  const [isLoading, setIsLoading] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const { logout } = useAuth();\n\n  const clearError = useCallback(() => {\n    setError(null);\n  }, []);\n\n  /**\n   * Delete the user account (soft delete)\n   */\n  const deleteAccount = useCallback(async (): Promise<DeleteAccountResult> => {\n    setIsLoading(true);\n    setError(null);\n\n    try {\n      authLogger.info('Deleting account...');\n\n      const result = await CfgAccountsProfile.cfgAccountsProfileDeleteCreate({ throwOnError: true });\n      const response = result.data;\n\n      if (!response.success) {\n        authLogger.error('Failed to delete account:', response.message);\n        setError(response.message);\n        throw new Error(response.message);\n      }\n    } catch (error) {\n      authLogger.error('Failed to delete account:', error);\n      throw error;\n    } finally {\n      setIsLoading(false);\n    }\n\n    await logout();\n    return { success: true, message: 'Account deleted successfully' };\n  }, [logout]);\n\n  return {\n    isLoading,\n    error,\n    deleteAccount,\n    clearError,\n  };\n};\n","/**\n * One-time cleanup of what the pre-cookie auth left in the browser.\n *\n * Before 2.1.604 the session tokens lived in `localStorage`. They are cookies now (shared across subdomains), so the old\n * entries are never read again; left alone they are harmless but misleading, and the 4 h profile cache next to them used\n * to keep the UI looking signed in without any token (empty private pages). Cookies are untouched.\n */\n\nconst LEGACY_TOKEN_KEYS = [\n  'cfg.auth.access_token',\n  'cfg.auth.refresh_token',\n  'auth_token',\n  'refresh_token',\n  'access_token',\n] as const;\n\n/** Removes the old `localStorage` token entries. Safe on the server and with blocked storage. */\nexport function purgeLegacyTokenStorage(): string[] {\n  const removed: string[] = [];\n  try {\n    if (typeof window === 'undefined') return removed;\n    for (const key of LEGACY_TOKEN_KEYS) {\n      if (window.localStorage.getItem(key) !== null) {\n        window.localStorage.removeItem(key);\n        removed.push(key);\n      }\n    }\n  } catch {\n    /* storage blocked: nothing to purge */\n  }\n  return removed;\n}\n","/**\n * The one auth state: a single value answers \"may this page render?\".\n *\n *   resolving      the client has not read the session yet, or a live session is still loading its profile\n *   authenticated  a live session and its profile settled\n *   anonymous      no session (store and React snapshot agree)\n *\n * Every consumer (the page guard, the \"leave /auth\" effect, the trace) reads this and nothing else. The\n * inputs are plain booleans so the whole table is unit-tested.\n *\n * Termination: `resolving` is left in finite time. `timedOut` is set by one timer in the provider, and\n * when it fires the React snapshot decides. There is no input combination that stays `resolving` with\n * `timedOut` true.\n */\n\nexport type AuthStatus = 'resolving' | 'authenticated' | 'anonymous';\n\nexport interface AuthStateInput {\n  /** The first client effect has run (the hydration commit is over). */\n  clientReady: boolean;\n  /** `useSession()` says authenticated (the React snapshot; the server snapshot is always anonymous). */\n  snapshotAuthenticated: boolean;\n  /** `auth.isAuthenticated()` read straight from the store at this render. */\n  storeAuthenticated: boolean;\n  /** The profile for a live session has loaded, failed in a way that keeps the session, or was cached. */\n  profileSettled: boolean;\n  /** The provider's single safety timer fired. */\n  timedOut: boolean;\n}\n\nexport function resolveAuthStatus(s: AuthStateInput): AuthStatus {\n  if (!s.clientReady) return 'resolving';\n  if (s.snapshotAuthenticated) {\n    return s.profileSettled || s.timedOut ? 'authenticated' : 'resolving';\n  }\n  // Snapshot says signed out. If the store disagrees the snapshot is lagging: wait for it, but never forever.\n  if (s.storeAuthenticated && !s.timedOut) return 'resolving';\n  return 'anonymous';\n}\n","/**\n * CfgAccounts Context\n *\n * Manages user authentication and profile operations using generated SWR hooks.\n *\n * Features:\n * - OTP-based authentication\n * - User profile management\n * - Avatar upload\n * - Profile updates\n * - localStorage cache with TTL (1 hour)\n */\n\n\"use client\";\n\nimport {\n    ReactNode, useCallback, useContext, useEffect, useMemo, useRef, useState\n} from 'react';\n\nimport { auth } from '../../_api/generated/helpers/auth';\nimport { CfgAccountsAuth, CfgAccountsProfile } from '../../_api/generated/_cfg_accounts/sdk.gen';\nimport {\n    useCfgAccountsOtpRequestCreate,\n    useCfgAccountsOtpVerifyCreate,\n    useCfgAccountsProfileAvatarCreate,\n    useCfgAccountsProfilePartialUpdate,\n    useCfgAccountsProfileUpdateUpdate,\n    useCfgAccountsTokenCreate,\n} from '../../_api/generated/_cfg_accounts/hooks';\nimport { clearProfileCache, getCachedProfile, setCachedProfile } from '../hooks/useProfileCache';\nimport { authLogger } from '../utils/logger';\n\n/**\n * Whether this build has a usable API origin.\n *\n * `NEXT_PUBLIC_API_URL` is inlined at build time; when it is missing the\n * generated client falls back to `''`, and every request becomes relative to\n * whatever page the user is on. A static build is same-origin by design, so\n * relative paths ARE correct there.\n */\nfunction hasApiOrigin(): boolean {\n  try {\n    if (typeof process === 'undefined' || !process.env) return false;\n    if (process.env.NEXT_PUBLIC_STATIC_BUILD === 'true') return true;\n    if (process.env.NEXT_PUBLIC_API_PROXY_URL !== undefined) return true;\n    return Boolean(process.env.NEXT_PUBLIC_API_URL);\n  } catch {\n    return false;\n  }\n}\n\nimport type {\n    User,\n    CfgUserUpdateRequest,\n    PatchedCfgUserUpdateRequest,\n    OtpRequestRequest,\n    OtpVerifyRequest,\n    OtpRequestResponse,\n    OtpVerifyResponse,\n    PasswordLoginRequest,\n    PasswordLoginResponse,\n} from '../../_api/generated/_cfg_accounts/types.gen';\nimport { authTrace } from '../trace';\nimport { sharedContext } from './sharedContext';\n\nexport type { PatchedCfgUserUpdateRequest, User, CfgUserUpdateRequest as UserProfileUpdateRequest };\n\n// ─────────────────────────────────────────────────────────────────────────\n// Context Type\n// ─────────────────────────────────────────────────────────────────────────\n\nexport interface AccountsContextValue {\n  profile?: User;\n  isLoadingProfile: boolean;\n  profileError: Error | null;\n\n  updateProfile: (data: CfgUserUpdateRequest) => Promise<User>;\n  partialUpdateProfile: (data: PatchedCfgUserUpdateRequest) => Promise<User>;\n  uploadAvatar: (avatar: File | Blob) => Promise<User>;\n  refreshProfile: (options?: { callerId?: string; force?: boolean }) => Promise<User | undefined>;\n\n  requestOTP: (data: OtpRequestRequest) => Promise<OtpRequestResponse>;\n  verifyOTP: (data: OtpVerifyRequest) => Promise<OtpVerifyResponse>;\n  loginWithPassword: (data: PasswordLoginRequest) => Promise<PasswordLoginResponse>;\n  logout: () => void;\n}\n\nconst AccountsContext = sharedContext<AccountsContextValue | undefined>('accounts', undefined);\n\ninterface AccountsProviderProps {\n  children: ReactNode;\n}\n\nexport function AccountsProvider({ children }: AccountsProviderProps) {\n  const [profile, setProfile] = useState<User | undefined>(() => {\n    // A cached profile is only a head start for a live session; with no session (tokens gone after the move to cookies,\n    // or signed out elsewhere) it would render the private UI with nothing behind it.\n    if (!auth.isAuthenticated()) {\n      clearProfileCache();\n      return undefined;\n    }\n    const cached = getCachedProfile() as User | null;\n    return cached || undefined;\n  });\n  const [isLoadingProfile, setIsLoadingProfile] = useState(false);\n  const [profileError, setProfileError] = useState<Error | null>(null);\n\n  const profileRef = useRef<User | undefined>(profile);\n  const isLoadingRef = useRef(false);\n  // Monotonic id per fetch. A forced re-read can now overlap the bootstrap\n  // one, and the slower response must not overwrite the newer profile.\n  const fetchSeqRef = useRef(0);\n\n  useEffect(() => {\n    profileRef.current = profile;\n  }, [profile]);\n\n  useEffect(() => {\n    isLoadingRef.current = isLoadingProfile;\n  }, [isLoadingProfile]);\n\n  const { trigger: triggerProfileUpdate } = useCfgAccountsProfileUpdateUpdate();\n  const { trigger: triggerProfilePartialUpdate } = useCfgAccountsProfilePartialUpdate();\n  const { trigger: triggerAvatar } = useCfgAccountsProfileAvatarCreate();\n  const { trigger: triggerOtpRequest } = useCfgAccountsOtpRequestCreate();\n  const { trigger: triggerOtpVerify } = useCfgAccountsOtpVerifyCreate();\n  const { trigger: triggerPasswordLogin } = useCfgAccountsTokenCreate();\n\n  const refreshProfile = useCallback(async (options?: { callerId?: string; force?: boolean }): Promise<User | undefined> => {\n    const { callerId, force } = options || {};\n\n    // No API origin configured → skip the request instead of letting it resolve\n    // against the current page. A relative URL on an i18n-prefixed route turns\n    // `/cfg/accounts/profile` into `/<locale>/cfg/accounts/profile` on the\n    // site's own origin — a 404 that only ever shows up in production.\n    if (!hasApiOrigin()) {\n      authLogger.debug(`No API origin configured, skipping profile fetch (caller: ${callerId})`);\n      return undefined;\n    }\n\n    // `force` is how a write says \"I just changed the server, re-read it\".\n    // Honouring the in-flight guard there would hand the caller back the\n    // pre-write profile and never fetch again, so the UI keeps showing the\n    // old value indefinitely.\n    if (isLoadingRef.current && !force) {\n      authLogger.debug(`Profile loading in progress, skipping (caller: ${callerId})`);\n      return profileRef.current;\n    }\n\n    const seq = ++fetchSeqRef.current;\n    setIsLoadingProfile(true);\n    isLoadingRef.current = true;\n    setProfileError(null);\n    try {\n      authLogger.debug(`Fetching profile from API (caller: ${callerId}, force: ${force})`);\n      const res = await CfgAccountsProfile.cfgAccountsProfileRetrieve({ throwOnError: true });\n      const result = res.data;\n      // A newer fetch already landed — its profile is the current one, and\n      // this older response would roll it back.\n      if (seq !== fetchSeqRef.current) return result;\n      setProfile(result);\n      profileRef.current = result;\n      setCachedProfile(result);\n      return result;\n    } catch (error) {\n      const err = error instanceof Error ? error : new Error('Failed to fetch profile');\n      if (seq === fetchSeqRef.current) setProfileError(err);\n      throw err;\n    } finally {\n      if (seq === fetchSeqRef.current) {\n        setIsLoadingProfile(false);\n        isLoadingRef.current = false;\n      }\n    }\n  }, []);\n\n  // These five are `useCallback`ed because they are dependencies of the context\n  // `useMemo` below. Rebuilt each render, they made that memo return a new object\n  // every time — so every consumer of this root provider re-rendered on every\n  // render of it, and the memo bought nothing. SWR guarantees a stable `trigger`.\n  const updateProfile = useCallback(async (data: CfgUserUpdateRequest): Promise<User> => {\n    await triggerProfileUpdate({ body: data });\n    const user = await refreshProfile({ callerId: 'updateProfile', force: true });\n    return user as User;\n  }, [triggerProfileUpdate, refreshProfile]);\n\n  const partialUpdateProfile = useCallback(async (data: PatchedCfgUserUpdateRequest): Promise<User> => {\n    await triggerProfilePartialUpdate({ body: data });\n    const user = await refreshProfile({ callerId: 'partialUpdateProfile', force: true });\n    return user as User;\n  }, [triggerProfilePartialUpdate, refreshProfile]);\n\n  const uploadAvatar = useCallback(async (avatar: File | Blob): Promise<User> => {\n    await triggerAvatar({ body: { avatar } });\n    const user = await refreshProfile({ callerId: 'uploadAvatar', force: true });\n    return user as User;\n  }, [triggerAvatar, refreshProfile]);\n\n  const requestOTP = useCallback(async (data: OtpRequestRequest): Promise<OtpRequestResponse> => {\n    const result = await triggerOtpRequest({ body: data });\n    return result as OtpRequestResponse;\n  }, [triggerOtpRequest]);\n\n  // OTP verify and password login return the SAME envelope by design, so both\n  // settle it here — one 2FA branch, one token write, one profile refresh. A\n  // second copy of this is a second session owner.\n  const settleLoginEnvelope = useCallback(async (\n    result: OtpVerifyResponse | PasswordLoginResponse,\n    callerId: string,\n  ): Promise<void> => {\n    if (result.requires_2fa && result.session_id) {\n      authLogger.info('2FA required, session:', result.session_id);\n      return;\n    }\n\n    if (result.access && result.refresh) {\n      // The ONE write path — atomic pair, notifies every session subscriber.\n      // Storage is always localStorage: session length is the token lifetime\n      // the server chose. A sessionStorage switch would strand the tokens — the\n      // module reinitializes to localStorage on the next page load.\n      authTrace('accounts.otp.session');\n      auth.setSession({ access: result.access, refresh: result.refresh });\n      try {\n        await refreshProfile({ callerId, force: true });\n      } catch (profileError) {\n        authLogger.warn(`Profile refresh failed after ${callerId} (tokens are saved):`, profileError);\n      }\n    }\n  }, [refreshProfile]);\n\n  const verifyOTP = useCallback(async (data: OtpVerifyRequest): Promise<OtpVerifyResponse> => {\n    const result = (await triggerOtpVerify({ body: data })) as OtpVerifyResponse;\n    await settleLoginEnvelope(result, 'verifyOTP');\n    return result;\n  }, [triggerOtpVerify, settleLoginEnvelope]);\n\n  const loginWithPassword = useCallback(async (\n    data: PasswordLoginRequest,\n  ): Promise<PasswordLoginResponse> => {\n    // Errors propagate: the SWR trigger throws APIError for 401/429 and the\n    // caller maps them. Nothing is written to the session on a failure.\n    const result = (await triggerPasswordLogin({ body: data })) as PasswordLoginResponse;\n    await settleLoginEnvelope(result, 'loginWithPassword');\n    return result;\n  }, [triggerPasswordLogin, settleLoginEnvelope]);\n\n  const logout = useCallback(() => {\n    // Best-effort server-side revocation: without blacklisting, a stolen\n    // refresh token survives \"logout\" until it expires. Fire-and-forget —\n    // local logout must never block on the network.\n    const refresh = auth.getRefreshToken();\n    if (refresh) {\n      CfgAccountsAuth.cfgAccountsTokenBlacklistCreate({ body: { refresh } }).catch(() => {\n        authLogger.warn('Refresh-token blacklist failed (logged out locally anyway)');\n      });\n    }\n    authTrace('accounts.logout');\n    auth.clearSession();\n    setProfile(undefined);\n    setProfileError(null);\n    clearProfileCache();\n  }, []);\n\n  const value: AccountsContextValue = useMemo(() => ({\n    profile,\n    isLoadingProfile,\n    profileError,\n    updateProfile,\n    partialUpdateProfile,\n    uploadAvatar,\n    refreshProfile,\n    requestOTP,\n    verifyOTP,\n    loginWithPassword,\n    logout,\n  }), [\n    profile,\n    isLoadingProfile,\n    profileError,\n    updateProfile,\n    partialUpdateProfile,\n    uploadAvatar,\n    refreshProfile,\n    requestOTP,\n    verifyOTP,\n    loginWithPassword,\n    logout,\n  ]);\n\n  return (\n    <AccountsContext.Provider value={value}>\n      {children}\n    </AccountsContext.Provider>\n  );\n}\n\nexport function useAccountsContext(): AccountsContextValue {\n  const context = useContext(AccountsContext);\n  if (!context) {\n    throw new Error('useAccountsContext must be used within AccountsProvider');\n  }\n  return context;\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Regenerate API key\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsApiKey } from \"../../sdk.gen\";\nimport type { CfgAccountsApiKeyRegenerateCreateData, CfgAccountsApiKeyRegenerateCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsApiKeyRegenerateCreateData, \"url\">;\ntype Result = CfgAccountsApiKeyRegenerateCreateResponses[keyof CfgAccountsApiKeyRegenerateCreateResponses];\n\nexport function useCfgAccountsApiKeyRegenerateCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_api_key_regenerate_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_api_key_regenerate_create\"], Args>(\n    [\"cfg_accounts_api_key_regenerate_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsApiKey.cfgAccountsApiKeyRegenerateCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/APIKeyRegenerate\")\n        .then(({ APIKeyRegenerateSchema }) => {\n          const parsed = APIKeyRegenerateSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_api_key_regenerate_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/api-key/regenerate/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_api_key_regenerate_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/api-key/regenerate/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Get API key details\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWR from \"swr\";\nimport type { SWRConfiguration, SWRResponse } from \"swr\";\nimport { CfgAccountsApiKey } from \"../../sdk.gen\";\nimport type { CfgAccountsApiKeyRetrieveData, CfgAccountsApiKeyRetrieveResponses } from \"../../types.gen\";\n\n\ntype Result = CfgAccountsApiKeyRetrieveResponses[keyof CfgAccountsApiKeyRetrieveResponses];\n\n/**\n * Optional `enabled` flag — when `false`, the SWR key becomes `null` and\n * no request is made. Use for gated endpoints (auth-required, feature\n * flags, \"fetch only when X is selected\"). The flag is stripped before\n * being forwarded to `useSWR` so the underlying SWR config stays pristine.\n */\ntype HookConfig = SWRConfiguration<Result> & { enabled?: boolean };\n\n// The return type is ANNOTATED, not inferred. Left to inference, tsc reaches\n// into swr's internal `dist/types-*` module to name the result and fails with\n// TS2742 (\"cannot be named without a reference to ... not portable\") in every\n// consumer that has swr hoisted to a different node_modules depth. Naming\n// SWRResponse here keeps the public surface expressible from the package's own\n// imports.\nexport function useCfgAccountsApiKeyRetrieve(\n  args?: Omit<CfgAccountsApiKeyRetrieveData, \"url\" | \"body\">,\n  config?: HookConfig,\n): SWRResponse<Result> {\n  const { enabled = true, ...swrConfig } = config ?? {};\n  const key = enabled ? [\"cfg_accounts_api_key_retrieve\", args ?? {}] as const : null;\n  return useSWR<Result>(\n    key,\n    async () => {\n      const res = await CfgAccountsApiKey.cfgAccountsApiKeyRetrieve({ ...(args ?? {}), throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/APIKey\")\n        .then(({ APIKeySchema }) => {\n          const parsed = APIKeySchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_api_key_retrieve\",\n              method: \"GET\",\n              path: \"/cfg/accounts/api-key/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_api_key_retrieve\",\n                    method: \"GET\",\n                    path: \"/cfg/accounts/api-key/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    swrConfig,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Reveal API key\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsApiKey } from \"../../sdk.gen\";\nimport type { CfgAccountsApiKeyRevealCreateData, CfgAccountsApiKeyRevealCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsApiKeyRevealCreateData, \"url\">;\ntype Result = CfgAccountsApiKeyRevealCreateResponses[keyof CfgAccountsApiKeyRevealCreateResponses];\n\nexport function useCfgAccountsApiKeyRevealCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_api_key_reveal_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_api_key_reveal_create\"], Args>(\n    [\"cfg_accounts_api_key_reveal_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsApiKey.cfgAccountsApiKeyRevealCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/APIKeyReveal\")\n        .then(({ APIKeyRevealSchema }) => {\n          const parsed = APIKeyRevealSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_api_key_reveal_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/api-key/reveal/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_api_key_reveal_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/api-key/reveal/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Test API key\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsApiKey } from \"../../sdk.gen\";\nimport type { CfgAccountsApiKeyTestCreateData, CfgAccountsApiKeyTestCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsApiKeyTestCreateData, \"url\">;\ntype Result = CfgAccountsApiKeyTestCreateResponses[keyof CfgAccountsApiKeyTestCreateResponses];\n\nexport function useCfgAccountsApiKeyTestCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_api_key_test_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_api_key_test_create\"], Args>(\n    [\"cfg_accounts_api_key_test_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsApiKey.cfgAccountsApiKeyTestCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/APIKeyTestResult\")\n        .then(({ APIKeyTestResultSchema }) => {\n          const parsed = APIKeyTestResultSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_api_key_test_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/api-key/test/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_api_key_test_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/api-key/test/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// List OAuth connections\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWR from \"swr\";\nimport type { SWRConfiguration, SWRResponse } from \"swr\";\nimport { CfgAccountsOauth } from \"../../sdk.gen\";\nimport type { CfgAccountsOauthConnectionsListData, CfgAccountsOauthConnectionsListResponses } from \"../../types.gen\";\n\n\ntype Result = CfgAccountsOauthConnectionsListResponses[keyof CfgAccountsOauthConnectionsListResponses];\n\n/**\n * Optional `enabled` flag — when `false`, the SWR key becomes `null` and\n * no request is made. Use for gated endpoints (auth-required, feature\n * flags, \"fetch only when X is selected\"). The flag is stripped before\n * being forwarded to `useSWR` so the underlying SWR config stays pristine.\n */\ntype HookConfig = SWRConfiguration<Result> & { enabled?: boolean };\n\n// The return type is ANNOTATED, not inferred. Left to inference, tsc reaches\n// into swr's internal `dist/types-*` module to name the result and fails with\n// TS2742 (\"cannot be named without a reference to ... not portable\") in every\n// consumer that has swr hoisted to a different node_modules depth. Naming\n// SWRResponse here keeps the public surface expressible from the package's own\n// imports.\nexport function useCfgAccountsOauthConnectionsList(\n  args?: Omit<CfgAccountsOauthConnectionsListData, \"url\" | \"body\">,\n  config?: HookConfig,\n): SWRResponse<Result> {\n  const { enabled = true, ...swrConfig } = config ?? {};\n  const key = enabled ? [\"cfg_accounts_oauth_connections_list\", args ?? {}] as const : null;\n  return useSWR<Result>(\n    key,\n    async () => {\n      const res = await CfgAccountsOauth.cfgAccountsOauthConnectionsList({ ...(args ?? {}), throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/cfg_accounts_oauth_connections_response_200_AutoRef\")\n        .then(({ cfg_accounts_oauth_connections_response_200_AutoRefSchema }) => {\n          const parsed = cfg_accounts_oauth_connections_response_200_AutoRefSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_oauth_connections_list\",\n              method: \"GET\",\n              path: \"/cfg/accounts/oauth/connections/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_oauth_connections_list\",\n                    method: \"GET\",\n                    path: \"/cfg/accounts/oauth/connections/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    swrConfig,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Disconnect OAuth provider\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsOauth } from \"../../sdk.gen\";\nimport type { CfgAccountsOauthDisconnectCreateData, CfgAccountsOauthDisconnectCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsOauthDisconnectCreateData, \"url\">;\ntype Result = CfgAccountsOauthDisconnectCreateResponses[keyof CfgAccountsOauthDisconnectCreateResponses];\n\nexport function useCfgAccountsOauthDisconnectCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_oauth_disconnect_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_oauth_disconnect_create\"], Args>(\n    [\"cfg_accounts_oauth_disconnect_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsOauth.cfgAccountsOauthDisconnectCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/cfg_accounts_oauth_disconnect_response_200_AutoRef\")\n        .then(({ cfg_accounts_oauth_disconnect_response_200_AutoRefSchema }) => {\n          const parsed = cfg_accounts_oauth_disconnect_response_200_AutoRefSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_oauth_disconnect_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/oauth/disconnect/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_oauth_disconnect_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/oauth/disconnect/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Start GitHub OAuth\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsOauth } from \"../../sdk.gen\";\nimport type { CfgAccountsOauthGithubAuthorizeCreateData, CfgAccountsOauthGithubAuthorizeCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsOauthGithubAuthorizeCreateData, \"url\">;\ntype Result = CfgAccountsOauthGithubAuthorizeCreateResponses[keyof CfgAccountsOauthGithubAuthorizeCreateResponses];\n\nexport function useCfgAccountsOauthGithubAuthorizeCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_oauth_github_authorize_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_oauth_github_authorize_create\"], Args>(\n    [\"cfg_accounts_oauth_github_authorize_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsOauth.cfgAccountsOauthGithubAuthorizeCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/OAuthAuthorizeResponse\")\n        .then(({ OAuthAuthorizeResponseSchema }) => {\n          const parsed = OAuthAuthorizeResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_oauth_github_authorize_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/oauth/github/authorize/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_oauth_github_authorize_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/oauth/github/authorize/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Complete GitHub OAuth\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsOauth } from \"../../sdk.gen\";\nimport type { CfgAccountsOauthGithubCallbackCreateData, CfgAccountsOauthGithubCallbackCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsOauthGithubCallbackCreateData, \"url\">;\ntype Result = CfgAccountsOauthGithubCallbackCreateResponses[keyof CfgAccountsOauthGithubCallbackCreateResponses];\n\nexport function useCfgAccountsOauthGithubCallbackCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_oauth_github_callback_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_oauth_github_callback_create\"], Args>(\n    [\"cfg_accounts_oauth_github_callback_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/OAuthTokenResponse\")\n        .then(({ OAuthTokenResponseSchema }) => {\n          const parsed = OAuthTokenResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_oauth_github_callback_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/oauth/github/callback/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_oauth_github_callback_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/oauth/github/callback/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Start Google OAuth\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsOauth } from \"../../sdk.gen\";\nimport type { CfgAccountsOauthGoogleAuthorizeCreateData, CfgAccountsOauthGoogleAuthorizeCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsOauthGoogleAuthorizeCreateData, \"url\">;\ntype Result = CfgAccountsOauthGoogleAuthorizeCreateResponses[keyof CfgAccountsOauthGoogleAuthorizeCreateResponses];\n\nexport function useCfgAccountsOauthGoogleAuthorizeCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_oauth_google_authorize_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_oauth_google_authorize_create\"], Args>(\n    [\"cfg_accounts_oauth_google_authorize_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsOauth.cfgAccountsOauthGoogleAuthorizeCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/OAuthAuthorizeResponse\")\n        .then(({ OAuthAuthorizeResponseSchema }) => {\n          const parsed = OAuthAuthorizeResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_oauth_google_authorize_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/oauth/google/authorize/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_oauth_google_authorize_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/oauth/google/authorize/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Complete Google OAuth\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsOauth } from \"../../sdk.gen\";\nimport type { CfgAccountsOauthGoogleCallbackCreateData, CfgAccountsOauthGoogleCallbackCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsOauthGoogleCallbackCreateData, \"url\">;\ntype Result = CfgAccountsOauthGoogleCallbackCreateResponses[keyof CfgAccountsOauthGoogleCallbackCreateResponses];\n\nexport function useCfgAccountsOauthGoogleCallbackCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_oauth_google_callback_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_oauth_google_callback_create\"], Args>(\n    [\"cfg_accounts_oauth_google_callback_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsOauth.cfgAccountsOauthGoogleCallbackCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/OAuthTokenResponse\")\n        .then(({ OAuthTokenResponseSchema }) => {\n          const parsed = OAuthTokenResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_oauth_google_callback_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/oauth/google/callback/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_oauth_google_callback_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/oauth/google/callback/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// GET /cfg/accounts/otp/consent-policy/\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWR from \"swr\";\nimport type { SWRConfiguration, SWRResponse } from \"swr\";\nimport { CfgAccountsOtp } from \"../../sdk.gen\";\nimport type { CfgAccountsOtpConsentPolicyRetrieveData, CfgAccountsOtpConsentPolicyRetrieveResponses } from \"../../types.gen\";\n\n\ntype Result = CfgAccountsOtpConsentPolicyRetrieveResponses[keyof CfgAccountsOtpConsentPolicyRetrieveResponses];\n\n/**\n * Optional `enabled` flag — when `false`, the SWR key becomes `null` and\n * no request is made. Use for gated endpoints (auth-required, feature\n * flags, \"fetch only when X is selected\"). The flag is stripped before\n * being forwarded to `useSWR` so the underlying SWR config stays pristine.\n */\ntype HookConfig = SWRConfiguration<Result> & { enabled?: boolean };\n\n// The return type is ANNOTATED, not inferred. Left to inference, tsc reaches\n// into swr's internal `dist/types-*` module to name the result and fails with\n// TS2742 (\"cannot be named without a reference to ... not portable\") in every\n// consumer that has swr hoisted to a different node_modules depth. Naming\n// SWRResponse here keeps the public surface expressible from the package's own\n// imports.\nexport function useCfgAccountsOtpConsentPolicyRetrieve(\n  args?: Omit<CfgAccountsOtpConsentPolicyRetrieveData, \"url\" | \"body\">,\n  config?: HookConfig,\n): SWRResponse<Result> {\n  const { enabled = true, ...swrConfig } = config ?? {};\n  const key = enabled ? [\"cfg_accounts_otp_consent_policy_retrieve\", args ?? {}] as const : null;\n  return useSWR<Result>(\n    key,\n    async () => {\n      const res = await CfgAccountsOtp.cfgAccountsOtpConsentPolicyRetrieve({ ...(args ?? {}), throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/ConsentPolicy\")\n        .then(({ ConsentPolicySchema }) => {\n          const parsed = ConsentPolicySchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_otp_consent_policy_retrieve\",\n              method: \"GET\",\n              path: \"/cfg/accounts/otp/consent-policy/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_otp_consent_policy_retrieve\",\n                    method: \"GET\",\n                    path: \"/cfg/accounts/otp/consent-policy/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    swrConfig,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// POST /cfg/accounts/otp/request/\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsOtp } from \"../../sdk.gen\";\nimport type { CfgAccountsOtpRequestCreateData, CfgAccountsOtpRequestCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsOtpRequestCreateData, \"url\">;\ntype Result = CfgAccountsOtpRequestCreateResponses[keyof CfgAccountsOtpRequestCreateResponses];\n\nexport function useCfgAccountsOtpRequestCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_otp_request_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_otp_request_create\"], Args>(\n    [\"cfg_accounts_otp_request_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsOtp.cfgAccountsOtpRequestCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/OTPRequestResponse\")\n        .then(({ OTPRequestResponseSchema }) => {\n          const parsed = OTPRequestResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_otp_request_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/otp/request/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_otp_request_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/otp/request/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// POST /cfg/accounts/otp/verify/\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsOtp } from \"../../sdk.gen\";\nimport type { CfgAccountsOtpVerifyCreateData, CfgAccountsOtpVerifyCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsOtpVerifyCreateData, \"url\">;\ntype Result = CfgAccountsOtpVerifyCreateResponses[keyof CfgAccountsOtpVerifyCreateResponses];\n\nexport function useCfgAccountsOtpVerifyCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_otp_verify_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_otp_verify_create\"], Args>(\n    [\"cfg_accounts_otp_verify_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsOtp.cfgAccountsOtpVerifyCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/OTPVerifyResponse\")\n        .then(({ OTPVerifyResponseSchema }) => {\n          const parsed = OTPVerifyResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_otp_verify_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/otp/verify/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_otp_verify_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/otp/verify/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Upload user avatar\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsProfile } from \"../../sdk.gen\";\nimport type { CfgAccountsProfileAvatarCreateData, CfgAccountsProfileAvatarCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsProfileAvatarCreateData, \"url\">;\ntype Result = CfgAccountsProfileAvatarCreateResponses[keyof CfgAccountsProfileAvatarCreateResponses];\n\nexport function useCfgAccountsProfileAvatarCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_profile_avatar_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_profile_avatar_create\"], Args>(\n    [\"cfg_accounts_profile_avatar_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsProfile.cfgAccountsProfileAvatarCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/User\")\n        .then(({ UserSchema }) => {\n          const parsed = UserSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_profile_avatar_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/profile/avatar/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_profile_avatar_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/profile/avatar/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Delete user account\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsProfile } from \"../../sdk.gen\";\nimport type { CfgAccountsProfileDeleteCreateData, CfgAccountsProfileDeleteCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsProfileDeleteCreateData, \"url\">;\ntype Result = CfgAccountsProfileDeleteCreateResponses[keyof CfgAccountsProfileDeleteCreateResponses];\n\nexport function useCfgAccountsProfileDeleteCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_profile_delete_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_profile_delete_create\"], Args>(\n    [\"cfg_accounts_profile_delete_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsProfile.cfgAccountsProfileDeleteCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/AccountDeleteResponse\")\n        .then(({ AccountDeleteResponseSchema }) => {\n          const parsed = AccountDeleteResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_profile_delete_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/profile/delete/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_profile_delete_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/profile/delete/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Partial update user profile\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsProfile } from \"../../sdk.gen\";\nimport type { CfgAccountsProfilePartialPartialUpdateData, CfgAccountsProfilePartialPartialUpdateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsProfilePartialPartialUpdateData, \"url\">;\ntype Result = CfgAccountsProfilePartialPartialUpdateResponses[keyof CfgAccountsProfilePartialPartialUpdateResponses];\n\nexport function useCfgAccountsProfilePartialPartialUpdate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_profile_partial_partial_update\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_profile_partial_partial_update\"], Args>(\n    [\"cfg_accounts_profile_partial_partial_update\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsProfile.cfgAccountsProfilePartialPartialUpdate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/User\")\n        .then(({ UserSchema }) => {\n          const parsed = UserSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_profile_partial_partial_update\",\n              method: \"PATCH\",\n              path: \"/cfg/accounts/profile/partial/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_profile_partial_partial_update\",\n                    method: \"PATCH\",\n                    path: \"/cfg/accounts/profile/partial/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Partial update user profile\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsProfile } from \"../../sdk.gen\";\nimport type { CfgAccountsProfilePartialUpdateData, CfgAccountsProfilePartialUpdateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsProfilePartialUpdateData, \"url\">;\ntype Result = CfgAccountsProfilePartialUpdateResponses[keyof CfgAccountsProfilePartialUpdateResponses];\n\nexport function useCfgAccountsProfilePartialUpdate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_profile_partial_update\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_profile_partial_update\"], Args>(\n    [\"cfg_accounts_profile_partial_update\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsProfile.cfgAccountsProfilePartialUpdate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/User\")\n        .then(({ UserSchema }) => {\n          const parsed = UserSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_profile_partial_update\",\n              method: \"PUT\",\n              path: \"/cfg/accounts/profile/partial/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_profile_partial_update\",\n                    method: \"PUT\",\n                    path: \"/cfg/accounts/profile/partial/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Get current user profile\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWR from \"swr\";\nimport type { SWRConfiguration, SWRResponse } from \"swr\";\nimport { CfgAccountsProfile } from \"../../sdk.gen\";\nimport type { CfgAccountsProfileRetrieveData, CfgAccountsProfileRetrieveResponses } from \"../../types.gen\";\n\n\ntype Result = CfgAccountsProfileRetrieveResponses[keyof CfgAccountsProfileRetrieveResponses];\n\n/**\n * Optional `enabled` flag — when `false`, the SWR key becomes `null` and\n * no request is made. Use for gated endpoints (auth-required, feature\n * flags, \"fetch only when X is selected\"). The flag is stripped before\n * being forwarded to `useSWR` so the underlying SWR config stays pristine.\n */\ntype HookConfig = SWRConfiguration<Result> & { enabled?: boolean };\n\n// The return type is ANNOTATED, not inferred. Left to inference, tsc reaches\n// into swr's internal `dist/types-*` module to name the result and fails with\n// TS2742 (\"cannot be named without a reference to ... not portable\") in every\n// consumer that has swr hoisted to a different node_modules depth. Naming\n// SWRResponse here keeps the public surface expressible from the package's own\n// imports.\nexport function useCfgAccountsProfileRetrieve(\n  args?: Omit<CfgAccountsProfileRetrieveData, \"url\" | \"body\">,\n  config?: HookConfig,\n): SWRResponse<Result> {\n  const { enabled = true, ...swrConfig } = config ?? {};\n  const key = enabled ? [\"cfg_accounts_profile_retrieve\", args ?? {}] as const : null;\n  return useSWR<Result>(\n    key,\n    async () => {\n      const res = await CfgAccountsProfile.cfgAccountsProfileRetrieve({ ...(args ?? {}), throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/User\")\n        .then(({ UserSchema }) => {\n          const parsed = UserSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_profile_retrieve\",\n              method: \"GET\",\n              path: \"/cfg/accounts/profile/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_profile_retrieve\",\n                    method: \"GET\",\n                    path: \"/cfg/accounts/profile/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    swrConfig,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Update user profile\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsProfile } from \"../../sdk.gen\";\nimport type { CfgAccountsProfileUpdatePartialUpdateData, CfgAccountsProfileUpdatePartialUpdateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsProfileUpdatePartialUpdateData, \"url\">;\ntype Result = CfgAccountsProfileUpdatePartialUpdateResponses[keyof CfgAccountsProfileUpdatePartialUpdateResponses];\n\nexport function useCfgAccountsProfileUpdatePartialUpdate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_profile_update_partial_update\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_profile_update_partial_update\"], Args>(\n    [\"cfg_accounts_profile_update_partial_update\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsProfile.cfgAccountsProfileUpdatePartialUpdate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/User\")\n        .then(({ UserSchema }) => {\n          const parsed = UserSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_profile_update_partial_update\",\n              method: \"PATCH\",\n              path: \"/cfg/accounts/profile/update/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_profile_update_partial_update\",\n                    method: \"PATCH\",\n                    path: \"/cfg/accounts/profile/update/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Update user profile\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsProfile } from \"../../sdk.gen\";\nimport type { CfgAccountsProfileUpdateUpdateData, CfgAccountsProfileUpdateUpdateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsProfileUpdateUpdateData, \"url\">;\ntype Result = CfgAccountsProfileUpdateUpdateResponses[keyof CfgAccountsProfileUpdateUpdateResponses];\n\nexport function useCfgAccountsProfileUpdateUpdate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_profile_update_update\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_profile_update_update\"], Args>(\n    [\"cfg_accounts_profile_update_update\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsProfile.cfgAccountsProfileUpdateUpdate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/User\")\n        .then(({ UserSchema }) => {\n          const parsed = UserSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_profile_update_update\",\n              method: \"PUT\",\n              path: \"/cfg/accounts/profile/update/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_profile_update_update\",\n                    method: \"PUT\",\n                    path: \"/cfg/accounts/profile/update/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// POST /cfg/accounts/token/blacklist/\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsAuth } from \"../../sdk.gen\";\nimport type { CfgAccountsTokenBlacklistCreateData, CfgAccountsTokenBlacklistCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsTokenBlacklistCreateData, \"url\">;\ntype Result = CfgAccountsTokenBlacklistCreateResponses[keyof CfgAccountsTokenBlacklistCreateResponses];\n\nexport function useCfgAccountsTokenBlacklistCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_token_blacklist_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_token_blacklist_create\"], Args>(\n    [\"cfg_accounts_token_blacklist_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsAuth.cfgAccountsTokenBlacklistCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// POST /cfg/accounts/token/\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsAuth } from \"../../sdk.gen\";\nimport type { CfgAccountsTokenCreateData, CfgAccountsTokenCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsTokenCreateData, \"url\">;\ntype Result = CfgAccountsTokenCreateResponses[keyof CfgAccountsTokenCreateResponses];\n\nexport function useCfgAccountsTokenCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_token_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_token_create\"], Args>(\n    [\"cfg_accounts_token_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsAuth.cfgAccountsTokenCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/PasswordLoginResponse\")\n        .then(({ PasswordLoginResponseSchema }) => {\n          const parsed = PasswordLoginResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_token_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/token/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_token_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/token/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// POST /cfg/accounts/token/refresh/\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsAuth } from \"../../sdk.gen\";\nimport type { CfgAccountsTokenRefreshCreateData, CfgAccountsTokenRefreshCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsTokenRefreshCreateData, \"url\">;\ntype Result = CfgAccountsTokenRefreshCreateResponses[keyof CfgAccountsTokenRefreshCreateResponses];\n\nexport function useCfgAccountsTokenRefreshCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_token_refresh_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_token_refresh_create\"], Args>(\n    [\"cfg_accounts_token_refresh_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsAuth.cfgAccountsTokenRefreshCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/TokenRefresh\")\n        .then(({ TokenRefreshSchema }) => {\n          const parsed = TokenRefreshSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_token_refresh_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/token/refresh/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_token_refresh_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/token/refresh/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","import { createContext, type Context } from 'react';\n\n/**\n * A React context that stays ONE object even when the bundle holds several copies of this package.\n *\n * pnpm builds a separate physical copy of a package per distinct peer set, and a dual ESM/CJS load can do the same.\n * Each copy would call `createContext` itself: the provider mounted from copy A and a `useAuth()` called from copy B\n * would then never meet, B would read the empty default and the page guard would redirect a signed-in user forever\n * (hub.reforms.ai, 5 Nov 2026). Registering the context on `globalThis` makes every copy share it. React itself must\n * still be a single copy, which every Next.js app already requires.\n */\nexport function sharedContext<T>(key: string, initial: T): Context<T> {\n  const g = globalThis as Record<string, unknown>;\n  const registry = (g.__cfgAuthContexts ??= {}) as Record<string, Context<unknown>>;\n  return (registry[key] ??= createContext<unknown>(initial)) as Context<T>;\n}\n","/**\n * Email validation utility\n */\nexport const validateEmail = (email: string): boolean => {\n  const emailRegex = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n  return emailRegex.test(email);\n};\n","/**\n * Pure auth-guard state resolution.\n *\n * This is the decision that produced the \"stuck on Authenticating…\" bug: given\n * the auth state, should the UI show a preloader, redirect to login, or render\n * the protected content? Extracted from useAuthGuard (which lives in a package\n * with no test infra) so the branching can be unit-tested in isolation — the\n * hook just wires React state (mounted / isRedirecting) into these functions.\n *\n * Invariant that fixes the bug: once auth is resolved (`authLoading === false`)\n * and the user is unauthenticated, `isLoading` must become false so the guard\n * redirects to the form instead of spinning forever. The same invariant covers\n * the forbidden case: a signed-in user without the required privilege must stop\n * loading too, or the preloader spins on a state no redirect will ever clear.\n */\n\nexport interface GuardInput {\n  /** First client render matches SSR (preloader) until mounted, to avoid hydration mismatch. */\n  mounted: boolean;\n  /** Whether this route requires authentication. */\n  requireAuth: boolean;\n  /** AuthContext still resolving initial state. */\n  authLoading: boolean;\n  /** A redirect to the auth page is in flight. */\n  isRedirecting: boolean;\n  /** User currently has a (valid-looking) session. */\n  isAuthenticated: boolean;\n  /** Route requires staff/admin privileges, not just a session. */\n  requireStaff?: boolean;\n  /** `is_staff || is_superuser`, from `useAuth().isAdminUser`. */\n  isAdminUser?: boolean;\n}\n\n/**\n * True when the session is valid but lacks the required privilege.\n *\n * Distinct from unauthenticated: the fix is a different account, not signing\n * in, so this must never redirect to the auth form. Redirecting would also\n * loop — the guard saves the current URL first, so a successful re-login on\n * the same account returns straight to the wall.\n */\nexport function isForbidden(s: GuardInput): boolean {\n  return Boolean(\n    s.mounted &&\n    s.requireAuth &&\n    s.requireStaff &&\n    !s.authLoading &&\n    s.isAuthenticated &&\n    !s.isAdminUser\n  );\n}\n\n/**\n * True while the guard should render a preloader rather than the protected\n * content. Mirrors useAuthGuard's formula exactly.\n */\nexport function resolveGuardIsLoading(s: GuardInput): boolean {\n  if (!s.mounted) return true; // pre-hydration: always preloader\n  if (!s.requireAuth) return false; // public route: never blocks\n  if (isForbidden(s)) return false; // resolved: render the wall, don't spin\n  return s.authLoading || s.isRedirecting || !s.isAuthenticated;\n}\n\n/**\n * Whether the guard should trigger a redirect to the auth page. Only once\n * mounted, on a protected route, after auth resolved, when unauthenticated and\n * not already redirecting. This is the branch that must fire for a dead session.\n */\nexport function shouldRedirectToAuth(s: GuardInput): boolean {\n  return (\n    s.mounted &&\n    s.requireAuth &&\n    !s.authLoading &&\n    !s.isAuthenticated &&\n    !s.isRedirecting\n  );\n}\n\n/** The effective authenticated flag the guard exposes to consumers. */\nexport function resolveGuardIsAuthenticated(s: Pick<GuardInput, 'requireAuth' | 'isAuthenticated'>): boolean {\n  return !s.requireAuth || s.isAuthenticated;\n}\n\n"],"mappings":";;;;;;AAKO,IAAM,iBAAiB;AAAA;AAAA,EAE5B,kBAAkB;AAAA;AAAA,EAElB,aAAa;AAAA;AAAA,EAEb,wBAAwB;AAAA;AAAA,EAExB,yBAAyB;AAC3B;;;ACoBA,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,aAAa;AACnB,IAAM,YAAY;AAGlB,IAAM,OAAe,MAAM;AACzB,QAAM,IAAI;AACV,SAAQ,EAAE,iBAAiB,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC;AAClE,GAAG;AACH,IAAM,YAAY,OAAO,WAAW;AAEpC,IAAI,SAAuB,CAAC;AAC5B,IAAI,SAAS;AAEb,SAAS,UAA0B;AACjC,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,QAAQ,CAAC,gBAAgB,gBAAgB,GAAY;AAC9D,QAAI;AACF,YAAM,IAAI,OAAO,IAAI;AACrB,QAAE,QAAQ,eAAe,GAAG;AAC5B,QAAE,WAAW,aAAa;AAC1B,aAAO;AAAA,IACT,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAbS;AAeT,SAAS,OAAqB;AAC5B,MAAI,OAAQ,QAAO;AACnB,WAAS;AACT,MAAI;AACF,UAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG;AAClC,UAAM,SAAkB,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;AACjD,QAAI,MAAM,QAAQ,MAAM,EAAG,UAAS,OAAO,OAAO,CAAC,MAAuB,OAAO,MAAM,YAAY,MAAM,IAAI;AAAA,EAC/G,QAAQ;AACN,aAAS,CAAC;AAAA,EACZ;AACA,SAAO;AACT;AAXS;AAaT,SAAS,UAAgB;AACvB,MAAI;AACF,YAAQ,GAAG,QAAQ,KAAK,KAAK,UAAU,MAAM,CAAC;AAAA,EAChD,QAAQ;AAAA,EAER;AACF;AANS;AAQT,SAAS,MAAM,QAA+C;AAC5D,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,MAAmB,CAAC;AAC1B,aAAW,CAACA,IAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,QAAI,UAAU,KAAKA,EAAC,EAAG;AACvB,QAAI,OAAO,MAAM,SAAU,KAAIA,EAAC,IAAI,EAAE,SAAS,aAAa,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC,WAAM;AAAA,aAClF,OAAO,MAAM,YAAY,OAAO,MAAM,aAAa,MAAM,KAAM,KAAIA,EAAC,IAAI;AAAA,EACnF;AACA,SAAO,OAAO,KAAK,GAAG,EAAE,SAAS,MAAM;AACzC;AATS;AAYT,SAAS,UAAgB;AACvB,MAAI;AACF,UAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG;AAClC,UAAM,SAAkB,MAAM,KAAK,MAAM,GAAG,IAAI;AAChD,QAAI,MAAM,QAAQ,MAAM,EAAG,UAAS,OAAO,OAAO,CAAC,MAAuB,OAAO,MAAM,YAAY,MAAM,IAAI;AAAA,EAC/G,QAAQ;AAAA,EAER;AACF;AARS;AAUT,SAAS,OAAO,IAAY,IAAY,QAA4B;AAClE,OAAK;AACL,UAAQ;AACR,QAAM,UAAU;AAChB,QAAM,IAAI,aAAa,OAAO,gBAAgB,cAAc,KAAK,MAAM,YAAY,IAAI,CAAC,IAAI;AAC5F,QAAMC,KAAI,MAAM,MAAM;AACtB,QAAM,OAAO,QAAQ,QAAQ,SAAS,CAAC;AACvC,MAAI,QAAQ,KAAK,QAAQ,OAAO,KAAK,OAAO,MAAM,KAAK,UAAU,KAAK,CAAC,MAAM,KAAK,UAAUA,EAAC,GAAG;AAC9F,SAAK,KAAK,KAAK,KAAK,KAAK;AACzB,SAAK,IAAI;AACT,SAAK,IAAI;AACT,YAAQ;AACR;AAAA,EACF;AACA,UAAQ,KAAK,EAAE,GAAG,IAAI,GAAG,KAAK,KAAK,IAAI,GAAAA,GAAE,CAAC;AAC1C,MAAI,QAAQ,SAAS,IAAK,SAAQ,OAAO,GAAG,QAAQ,SAAS,GAAG;AAChE,UAAQ;AACV;AAjBS;AAoBF,SAAS,UAAU,IAAY,QAA4B;AAChE,MAAI,CAAC,UAAW;AAChB,MAAI;AACF,WAAO,KAAK,IAAI,GAAG,IAAI,MAAM;AAAA,EAC/B,QAAQ;AAAA,EAER;AACF;AAPgB;AAWT,SAAS,yBAA+B;AAC7C,WAAS,CAAC;AACV,WAAS;AACX;AAHgB;AAKT,SAAS,gBAA8B;AAC5C,SAAO,KAAK,EAAE,MAAM;AACtB;AAFgB;AAKT,SAAS,iBAAuB;AACrC,WAAS,CAAC;AACV,WAAS;AACT,MAAI;AACF,YAAQ,GAAG,WAAW,GAAG;AAAA,EAC3B,QAAQ;AAAA,EAER;AACF;AARgB;AAUhB,SAAS,UAAoB;AAC3B,MAAI,CAAC,UAAW,QAAO,CAAC;AACxB,QAAM,SAAU,WAAuC,mBAAmB;AAC1E,QAAM,QAAQ,CAAC,QAAQ,OAAO,SAAS,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,WAAW,OAAO,MAAM,CAAC,IAAI,WAAW,UAAU,MAAM,IAAI,OAAO,UAAU,SAAS,EAAE;AACrJ,MAAI;AACF,UAAMC,QAAQ,WAAuC;AACrD,UAAM,MAAMA,QAAO;AACnB,QAAI,IAAK,OAAM,KAAK,QAAQ,OAAO,QAAQ,GAAG,EAAE,IAAI,CAAC,CAACF,IAAG,CAAC,MAAM,GAAGA,EAAC,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,EAClG,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAZS;AAeF,SAAS,gBAAwB;AACtC,QAAM,UAAU,KAAK;AACrB,QAAM,QAAQ,QAAQ,CAAC,GAAG,KAAK,KAAK,IAAI;AACxC,QAAM,OAAO,QAAQ,IAAI,CAAC,MAAM;AAC9B,UAAM,SAAS,EAAE,IAAI,IAAI,OAAO,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,CAACA,IAAG,CAAC,MAAM,GAAGA,EAAC,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,KAAK;AAChG,UAAM,KAAK,IAAI,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,IAAI,EAAE;AACnD,WAAO,GAAG,EAAE,KAAK,OAAO,EAAE,IAAI,KAAK,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC,KAAK,EAAE;AAAA,EAC3H,CAAC;AACD,SAAO,CAAC,qBAAqB,QAAQ,MAAM,WAAW,GAAG,QAAQ,GAAG,IAAI,GAAG,IAAI,EAAE,KAAK,IAAI;AAC5F;AATgB;AAeT,SAAS,mBAAyB;AACvC,MAAI,CAAC,UAAW;AAChB,QAAM,IAAI;AACV,IAAE,iBAAiB;AACnB,IAAE,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,MAAM,6BAAM;AACV,YAAM,OAAO,cAAc;AAE3B,cAAQ,IAAI,IAAI;AAChB,aAAO;AAAA,IACT,GALM;AAAA,IAMN,OAAO;AAAA;AAAA,IAEP,MAAM,6BAAM;AACV,YAAM,OAAO,cAAc;AAC3B,WAAK,UAAU,WAAW,UAAU,IAAI;AACxC,aAAO,GAAG,KAAK,MAAM,IAAI,EAAE,MAAM;AAAA,IACnC,GAJM;AAAA;AAAA,IAMN,UAAU,6BAAM;AACd,YAAM,OAAO,IAAI,KAAK,CAAC,KAAK,UAAU,cAAc,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAC9F,YAAM,IAAI,SAAS,cAAc,GAAG;AACpC,QAAE,OAAO,IAAI,gBAAgB,IAAI;AACjC,QAAE,WAAW,cAAc,KAAK,IAAI,CAAC;AACrC,QAAE,MAAM;AAAA,IACV,GANU;AAAA,EAOZ;AACA,QAAM,SAAS,EAAE;AACjB,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,MAAE,kBAAkB,CAAC;AACrB,eAAW,QAAQ,QAAQ;AACzB,UAAI,MAAM,QAAQ,IAAI,KAAK,OAAO,KAAK,CAAC,MAAM,UAAU;AACtD,YAAI;AACF,iBAAO,OAAO,KAAK,CAAC,CAAC,KAAK,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,CAA4B;AAAA,QACnF,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAzCgB;AAgDhB,SAAS,eAAqB;AAC5B,MAAI,CAAC,UAAW;AAChB,QAAM,IAAI;AACV,QAAM,KAAM,EAAE,mBAA0C,KAAK;AAC7D,IAAE,kBAAkB;AACpB,MAAI,IAAI,GAAG;AACT,cAAU,YAAY,EAAE,QAAQ,EAAE,CAAC;AACnC,QAAI,MAAM,GAAG;AAEX,cAAQ,KAAK,uJAAuJ;AAAA,IACtK;AAAA,EACF;AACF;AAZS;AAaT,aAAa;AAGb,iBAAiB;;;AC1OjB,SAAS,eAAAG,oBAAmB;AAC5B;AAAA,EACE;AAAA,EACA,eAAAC;AAAA,EACA,cAAAC;AAAA,EACA,aAAAC;AAAA,EACA,WAAAC;AAAA,EACA,UAAAC;AAAA,EACA,YAAAC;AAAA,OACK;;;ACpBA,IAAM,WAAN,cAAuB,MAAM;AAAA,EAClC,YACS,YACA,YACA,UACA,KACP,SACA;AACA,UAAM,WAAW,QAAQ,UAAU,KAAK,UAAU,EAAE;AAN7C;AACA;AACA;AACA;AAIP,SAAK,OAAO;AAAA,EACd;AAAA,EARS;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAZX,OAOoC;AAAA;AAAA;AAAA,EAYlC,IAAI,UAAsC;AACxC,QAAI,OAAO,KAAK,aAAa,YAAY,KAAK,aAAa,MAAM;AAC/D,aAAO,KAAK;AAAA,IACd;AACA,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,cAA+C;AACjD,UAAM,UAAU,KAAK;AACrB,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,cAAwC,CAAC;AAC/C,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,UAAI,MAAM,QAAQ,KAAK,EAAG,aAAY,GAAG,IAAI;AAAA,IAC/C;AACA,WAAO,OAAO,KAAK,WAAW,EAAE,SAAS,IAAI,cAAc;AAAA,EAC7D;AAAA,EAEA,IAAI,eAAuB;AACzB,UAAM,UAAU,KAAK;AACrB,QAAI,CAAC,QAAS,QAAO,KAAK;AAC1B,QAAI,QAAQ,QAAQ;AAClB,aAAO,MAAM,QAAQ,QAAQ,MAAM,IAAI,QAAQ,OAAO,KAAK,IAAI,IAAI,OAAO,QAAQ,MAAM;AAAA,IAC1F;AACA,QAAI,QAAQ,MAAO,QAAO,OAAO,QAAQ,KAAK;AAC9C,QAAI,QAAQ,QAAS,QAAO,OAAO,QAAQ,OAAO;AAClD,UAAM,cAAc,KAAK;AACzB,QAAI,aAAa;AACf,YAAM,aAAa,OAAO,KAAK,WAAW,EAAE,CAAC;AAC7C,UAAI,WAAY,QAAO,GAAG,UAAU,KAAK,YAAY,UAAU,GAAG,KAAK,IAAI,CAAC;AAAA,IAC9E;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,oBAA6B;AAAE,WAAO,KAAK,eAAe;AAAA,EAAK;AAAA,EACnE,IAAI,cAAuB;AAAE,WAAO,KAAK,eAAe;AAAA,EAAK;AAAA,EAC7D,IAAI,oBAA6B;AAAE,WAAO,KAAK,eAAe;AAAA,EAAK;AAAA,EACnE,IAAI,kBAA2B;AAAE,WAAO,KAAK,eAAe;AAAA,EAAK;AAAA,EACjE,IAAI,gBAAyB;AAAE,WAAO,KAAK,cAAc,OAAO,KAAK,aAAa;AAAA,EAAK;AACzF;;;AC7BA,IAAM,IAAI,wBACR,KACA,OACA,cACa,EAAE,KAAK,OAAO,SAAS,IAJ5B;AAMV,IAAM,IAAI,wBACR,QACA,OACA,cACgB,EAAE,QAAQ,OAAO,SAAS,IAJlC;AAOH,IAAM,WAAW;AAAA,EACtB,aAAa,EAAE,yBAAyB,UAAU,IAAI;AAAA,EACtD,cAAc,EAAE,0BAA0B,UAAU,IAAI;AAAA,EACxD,QAAQ,EAAE,oBAAoB,SAAS,IAAI;AAAA,EAC3C,OAAO,EAAE,kBAAkB,SAAS,KAAK;AAAA,EACzC,SAAS,EAAE,qBAAqB,SAAS,KAAK;AAAA,EAC9C,aAAa,EAAE,yBAAyB,WAAW,IAAI;AAAA,EACvD,eAAe,EAAE,4BAA4B,WAAW,IAAI;AAAA,EAC5D,YAAY,EAAE,wBAAwB,WAAW,IAAI;AAAA,EACrD,eAAe,EAAE,2BAA2B,WAAW,IAAI;AAAA,EAC3D,gBAAgB,EAAE,4BAA4B,WAAW,KAAK;AAAA,EAC9D,cAAc,EAAE,qBAAqB,SAAS,IAAI;AAAA,EAClD,kBAAkB,EAAE,0BAA0B,SAAS,KAAK;AAAA,EAC5D,sBAAsB,EAAE,0BAA0B,UAAU,KAAK;AAAA,EACjE,cAAc,EAAE,qBAAqB,SAAS,KAAK;AAAA,EACnD,SAAS,EAAE,iBAAiB,WAAW,KAAK;AAAA,EAC5C,gBAAgB,EAAE,wBAAwB,WAAW,KAAK;AAAA,EAC1D,SAAS,EAAE,gBAAgB,SAAS,KAAK;AAAA,EACzC,oBAAoB,EAAE,4BAA4B,SAAS,KAAK;AAAA,EAChE,iBAAiB,EAAE,yBAAyB,SAAS,KAAK;AAAA,EAC1D,kBAAkB,EAAE,0BAA0B,SAAS,KAAK;AAAA,EAC5D,kBAAkB,EAAE,0BAA0B,SAAS,KAAK;AAAA,EAC5D,yBAAyB,EAAE,mCAAmC,WAAW,IAAI;AAAA,EAC7E,uBAAuB,EAAE,+BAA+B,WAAW,IAAI;AAAA,EACvE,kBAAkB,EAAE,0BAA0B,WAAW,KAAK;AAChE;AAGO,IAAM,eAAe;AAAA,EAC1B,WAAW,EAAE,mBAAmB,WAAW,IAAI;AAAA,EAC/C,UAAU,EAAE,kBAAkB,SAAS,KAAK;AAAA,EAC5C,oBAAoB,EAAE,6BAA6B,SAAS,KAAK;AACnE;AAEA,IAAM,WAAW;AAGV,SAAS,iBAAiB,KAAqB;AACpD,SAAO,IACJ,KAAK,EACL,YAAY,EACZ,QAAQ,gBAAgB,GAAG,EAC3B,QAAQ,YAAY,EAAE;AAC3B;AANgB;AAsDhB,IAAMC,aAAY,6BAAM,OAAO,WAAW,aAAxB;AAElB,IAAM,eAAe,oBAAI,IAA2B;AAQpD,SAAS,qBAAoC;AAC3C,MAAI,CAACA,WAAU,KAAK,OAAO,aAAa,YAAa,QAAO;AAC5D,QAAM,OAAO,OAAO,SAAS,SAAS,YAAY;AAClD,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,GAAG,KAAK,YAAY,KAAK,IAAI,EAAG,QAAO;AACzF,QAAM,SAAS,aAAa,IAAI,IAAI;AACpC,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAM,SAAS,OAAO,SAAS,aAAa,WAAW,aAAa;AACpE,MAAI,QAAuB;AAC3B,MAAI;AACF,aAAS,IAAI,OAAO,SAAS,GAAG,KAAK,KAAK,UAAU,MAAM,KAAK,GAAG;AAChE,YAAM,YAAY,OAAO,MAAM,CAAC,EAAE,KAAK,GAAG;AAC1C,YAAM,QAAQ,eAAe,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC;AAC/D,eAAS,SAAS,QAAQ,gBAAgB,YAAY,uCAAuC;AAC7F,UAAI,SAAS,OAAO,SAAS,QAAQ,IAAI,EAAG,SAAQ;AACpD,eAAS,SAAS,QAAQ,eAAe,YAAY,sCAAsC;AAAA,IAC7F;AAAA,EACF,QAAQ;AACN,YAAQ;AAAA,EACV;AACA,eAAa,IAAI,MAAM,KAAK;AAC5B,SAAO;AACT;AAtBS;AAwBT,SAAS,cAAc,OAA4C;AACjE,MAAI,CAACA,WAAU,EAAG,QAAO;AACzB,MAAI;AACF,WAAO,UAAU,YAAY,OAAO,iBAAiB,OAAO;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAPS;AAST,SAAS,cAAwB;AAC/B,MAAI,CAACA,WAAU,EAAG,QAAO,CAAC;AAC1B,MAAI;AACF,WAAO,SAAS,OACb,MAAM,IAAI,EACV,IAAI,CAAC,SAAS,mBAAmB,KAAK,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,EAC1D,OAAO,OAAO;AAAA,EACnB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAVS;AAYF,SAAS,cAAc,OAAe,UAA0B,CAAC,GAAmB;AACzF,MAAI,CAAC,SAAS,KAAK,KAAK,GAAG;AACzB,UAAM,IAAI,UAAU,yBAAyB,KAAK,gBAAgB,QAAQ,EAAE;AAAA,EAC9E;AACA,QAAM,SAAS,GAAG,KAAK;AACvB,QAAM,UAAU,UAAU,QAAQ,yBAAyB,IAAI,OAAO,SAAS,KAAK,oBAAoB;AACxG,QAAM,eAAe,QAAQ,uBAAuB,KAAK,KAAK,KAAK;AACnE,MAAI,eAAwC,QAAQ,gBAAgB;AACpE,QAAM,sBAAsB,6BAC1B,iBAAiB,QAAQ,OAAO,iBAAiB,SAAS,mBAAmB,IAAI,cADvD;AAG5B,QAAM,eAAe,wBAAC,KAAa,WAA0B;AAC3D,UAAM,SAAS,OAAO,SAAS,aAAa,WAAW,aAAa;AACpE,aAAS,SACP,mBAAmB,GAAG,IAAI,wCAAwC,SAAS,cAAc,SAAS,MAAM;AAAA,EAC5G,GAJqB;AAKrB,QAAM,QAAQ,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC;AAC9C,QAAM,WAAW,OAAO,OAAO,QAAQ,YAAY,CAAC,CAAC;AACrD,QAAM,YAAY,oBAAI,IAAuB;AAC7C,aAAW,QAAQ,MAAO,WAAU,IAAI,KAAK,KAAK,CAAC,GAAI,UAAU,IAAI,KAAK,GAAG,KAAK,CAAC,GAAI,IAAI,CAAC;AAE5F,QAAMC,UAAgD;AAAA,IACpD,OAAO,oBAAI,IAAI;AAAA,IACf,SAAS,oBAAI,IAAI;AAAA,IACjB,QAAQ,oBAAI,IAAI;AAAA,EAClB;AAEA,QAAM,UAAU,wBAAC,QAAgB,QAAQ,KAAK,GAAG,GAAjC;AAChB,QAAM,cAAc,wBAAC,QAAgB;AACnC,QAAI,CAAC,QAAQ,GAAG,EAAG,OAAM,IAAI,UAAU,gBAAgB,GAAG,gBAAgB,OAAO,EAAE;AAAA,EACrF,GAFoB;AAGpB,QAAM,cAAc,wBAAC,QAAgB;AACnC,gBAAY,GAAG;AACf,QAAI,CAAC,IAAI,WAAW,MAAM,EAAG,OAAM,IAAI,UAAU,gBAAgB,GAAG,sBAAsB,KAAK,GAAG;AAAA,EACpG,GAHoB;AAKpB,WAAS,OAAO,OAAiB,KAA4B;AAC3D,QAAI,CAACD,WAAU,EAAG,QAAO;AACzB,QAAI,UAAU,UAAU;AACtB,UAAI;AACF,cAAM,UAAU,mBAAmB,GAAG,EAAE,QAAQ,uBAAuB,MAAM;AAC7E,cAAM,QAAQ,SAAS,OAAO,MAAM,IAAI,OAAO,cAAc,OAAO,UAAU,CAAC;AAC/E,YAAI,QAAQ,CAAC,MAAM,OAAW,QAAO,mBAAmB,MAAM,CAAC,CAAC;AAAA,MAClE,QAAQ;AAAA,MAER;AACA,aAAOC,QAAO,OAAO,IAAI,GAAG,KAAK;AAAA,IACnC;AACA,QAAI;AACF,YAAM,QAAQ,cAAc,KAAK,GAAG,QAAQ,GAAG,KAAK;AACpD,UAAI,UAAU,KAAM,QAAO;AAAA,IAC7B,QAAQ;AAAA,IAER;AACA,WAAOA,QAAO,KAAK,EAAE,IAAI,GAAG,KAAK;AAAA,EACnC;AAnBS;AAqBT,WAAS,OAAO,OAAiB,KAAa,OAAe,eAAiC;AAC5F,QAAI,CAACD,WAAU,EAAG,QAAO;AACzB,QAAI;AACF,UAAI,UAAU,UAAU;AACtB,cAAM,SAAS,OAAO,SAAS,aAAa,WAAW,aAAa;AACpE,cAAM,SAAS,oBAAoB;AACnC,cAAM,aAAa,SAAS,YAAY,MAAM,KAAK;AACnD,iBAAS,SAAS,GAAG,mBAAmB,GAAG,CAAC,IAAI,mBAAmB,KAAK,CAAC,qBAAqB,KAAK,IAAI,GAAG,KAAK,MAAM,iBAAiB,YAAY,CAAC,CAAC,iBAAiB,UAAU,GAAG,MAAM;AAExL,YAAI,OAAQ,cAAa,KAAK,IAAI;AAClC,YAAI,OAAO,UAAU,GAAG,MAAM,SAAS,CAACC,QAAO,OAAO,IAAI,GAAG,EAAG,QAAO;AACvE,QAAAA,QAAO,OAAO,IAAI,KAAK,KAAK;AAC5B,eAAO;AAAA,MACT;AACA,YAAM,SAAS,cAAc,KAAK;AAClC,UAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qBAAqB;AAClD,aAAO,QAAQ,KAAK,KAAK;AACzB,MAAAA,QAAO,KAAK,EAAE,OAAO,GAAG;AACxB,aAAO;AAAA,IACT,QAAQ;AACN,MAAAA,QAAO,KAAK,EAAE,IAAI,KAAK,KAAK;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AAvBS;AAyBT,WAAS,UAAU,OAAiB,KAAmB;AACrD,IAAAA,QAAO,KAAK,EAAE,OAAO,GAAG;AACxB,QAAI,CAACD,WAAU,EAAG;AAClB,QAAI;AACF,UAAI,UAAU,UAAU;AACtB,qBAAa,KAAK,IAAI;AACtB,cAAM,SAAS,oBAAoB;AACnC,YAAI,OAAQ,cAAa,KAAK,MAAM;AAAA,MACtC,OAAO;AACL,sBAAc,KAAK,GAAG,WAAW,GAAG;AAAA,MACtC;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAdS;AAgBT,WAAS,aAAa,KAAa,OAA4B;AAC7D,WAAO,SAAS,UAAU,IAAI,GAAG,IAAI,CAAC,GAAG,SAAS;AAAA,EACpD;AAFS;AAIT,WAAS,SAAS,OAA4B,YAA8B;AAC1E,UAAM,MAAgB,CAAC;AACvB,QAAI;AACF,YAAM,SAAS,cAAc,KAAK;AAClC,UAAI,QAAQ;AACV,iBAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,GAAG;AACzC,gBAAM,OAAO,OAAO,IAAI,CAAC;AACzB,cAAI,MAAM,WAAW,UAAU,EAAG,KAAI,KAAK,IAAI;AAAA,QACjD;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AACA,eAAW,QAAQC,QAAO,KAAK,EAAE,KAAK,EAAG,KAAI,KAAK,WAAW,UAAU,KAAK,CAAC,IAAI,SAAS,IAAI,EAAG,KAAI,KAAK,IAAI;AAC9G,WAAO;AAAA,EACT;AAfS;AAiBT,QAAM,YAAY,wBAAC,QAAoB,OAAe;AACpD,UAAM,OAAO,iBAAiB,EAAE;AAChC,QAAI,CAAC,KAAM,OAAM,IAAI,UAAU,gDAAgD;AAC/E,WAAO,OAAO,SAAS;AAAA,EACzB,GAJkB;AAMlB,QAAM,MAAsB;AAAA,IAC1B;AAAA,IACA,OAAO,OAAO;AACZ,YAAM,WAAW,MAAM,IAAI,gBAAgB;AAC3C,UAAI,SAAS,WAAW,KAAK,SAAS,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG;AACjE,cAAM,IAAI,UAAU,wCAAwC,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,MACrF;AACA,aAAO,GAAG,MAAM,GAAG,SAAS,KAAK,GAAG,CAAC;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK,KAAK,OAAO;AACf,kBAAY,GAAG;AACf,YAAM,SAAS,aAAa,KAAK,KAAK;AACtC,aAAO,OAAO,QAAQ,GAAG;AAAA,IAC3B;AAAA,IACA,MAAM,KAAK,OAAO,OAAO,cAAc;AACrC,kBAAY,GAAG;AACf,YAAM,SAAS,aAAa,KAAK,KAAK;AACtC,aAAO,OAAO,QAAQ,KAAK,OAAO,cAAc,aAAa;AAAA,IAC/D;AAAA,IACA,OAAO,KAAK,OAAO;AACjB,kBAAY,GAAG;AACf,YAAM,SAAS,aAAa,KAAK,KAAK;AACtC,gBAAU,QAAQ,GAAG;AAAA,IACvB;AAAA,IACA,SAAY,KAAa,OAA4B;AACnD,YAAM,MAAM,IAAI,KAAK,KAAK,KAAK;AAC/B,UAAI,QAAQ,KAAM,QAAO;AACzB,UAAI;AACF,eAAO,KAAK,MAAM,GAAG;AAAA,MACvB,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,UAAU,KAAK,OAAO,OAAO;AAC3B,aAAO,IAAI,MAAM,KAAK,KAAK,UAAU,KAAK,GAAG,KAAK;AAAA,IACpD;AAAA,IACA,KAAK,QAAQ,SAAS;AACpB,aAAO,SAAS,OAAO,MAAM;AAAA,IAC/B;AAAA,IACA,SAAS,EAAE,MAAM,MAAM,IAAI,CAAC,GAAG;AAC7B,iBAAW,QAAQ,OAAO;AACxB,YAAI,CAAC,OAAO,CAAC,KAAK,SAAU;AAC5B,kBAAU,KAAK,OAAO,KAAK,GAAG;AAAA,MAChC;AACA,iBAAW,UAAU,UAAU;AAC7B,YAAI,CAAC,OAAO,CAAC,OAAO,SAAU;AAC9B,mBAAW,QAAQ,SAAS,OAAO,OAAO,OAAO,MAAM,EAAG,WAAU,OAAO,OAAO,IAAI;AAAA,MACxF;AACA,UAAI,KAAK;AACP,mBAAW,SAAS,CAAC,SAAS,SAAS,GAAY;AACjD,qBAAW,QAAQ,SAAS,OAAO,MAAM,EAAG,WAAU,OAAO,IAAI;AAAA,QACnE;AACA,mBAAW,QAAQ,YAAY,EAAG,KAAI,KAAK,WAAW,MAAM,EAAG,WAAU,UAAU,IAAI;AAAA,MACzF;AAAA,IACF;AAAA,IACA,gBAAgB,QAAQ;AACtB,qBAAe;AAAA,IACjB;AAAA,IACA,cAAc;AAAA,IACd,SAAS,KAAK,UAAU,QAAQ,SAAS;AACvC,kBAAY,GAAG;AACf,UAAI,CAACD,WAAU,EAAG,QAAO,MAAM;AAAA,MAAC;AAChC,YAAM,UAAU,wBAAC,UAAwB;AACvC,YAAI,MAAM,gBAAgB,cAAc,KAAK,EAAG;AAChD,YAAI,MAAM,QAAQ,QAAQ,MAAM,QAAQ,IAAK,UAAS,MAAM,QAAQ,OAAO,OAAO,MAAM,QAAQ;AAAA,MAClG,GAHgB;AAIhB,aAAO,iBAAiB,WAAW,OAAO;AAC1C,aAAO,MAAM,OAAO,oBAAoB,WAAW,OAAO;AAAA,IAC5D;AAAA,EACF;AACA,SAAO;AACT;AAtMgB;AAyMT,IAAM,aAA6B,cAAc,OAAO;AAAA,EAC7D,MAAM;AAAA,EACN,UAAU;AACZ,CAAC;;;AC9XD,IAAM,aAAa;AACnB,IAAM,cAAc;AACpB,IAAM,cAAc;AAGpB,IAAM,UAAU,OAAkB,aAAaE,eAAc,KAAK;AAElE,IAAM,YAAY,OAAO,WAAW;AAOpC,SAAS,MAAM,IAAY,QAA4B;AACrD,MAAI;AACF,UAAM,IAAI;AACV,UAAMC,QAAO,EAAE;AACf,QAAIA,OAAM;AAAE,MAAAA,MAAK,IAAI,MAAM;AAAG;AAAA,IAAQ;AACtC,UAAM,QAAS,EAAE,mBAA6C,CAAC;AAC/D,MAAE,kBAAkB;AACpB,QAAI,MAAM,SAAS,IAAK,OAAM,KAAK,CAAC,KAAK,IAAI,GAAG,IAAI,MAAM,CAAC;AAAA,EAC7D,QAAQ;AAAA,EAAkC;AAC5C;AATS;AAUT,SAAS,OAAO,KAAqB;AACnC,MAAI;AAAE,WAAO,IAAI,IAAI,KAAK,UAAU,EAAE;AAAA,EAAU,QAAQ;AAAE,WAAO;AAAA,EAAI;AACvE;AAFS;AAcT,SAAS,gBAAgB,OAAmC;AAC1D,QAAM,MAAM,SAAS,KAAK;AAC1B,SAAO,QAAQ,OAAO,SAAY,KAAK,IAAI,GAAG,KAAK,OAAO,MAAM,KAAK,IAAI,KAAK,GAAI,CAAC;AACrF;AAHS;AAQT,IAAM,WAA0C;AAAA,EAC9C,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,QAAQ;AACV;AAEA,SAAS,WAAW,MAA4B;AAC9C,QAAM,QAAQ,SAAS,IAAI;AAC3B,SAAO;AAAA,IACL,KAAK,wBAAC,QAAQ,QAAQ,KAAK,KAAK,KAAK,GAAhC;AAAA,IACL,IAAI,KAAK,OAAO;AACd,UAAI,UAAU,KAAM,SAAQ,OAAO,KAAK,KAAK;AAAA,UAExC,SAAQ,MAAM,KAAK,OAAO,OAAO,UAAU,YAAY,QAAQ,cAAc,EAAE,eAAe,gBAAgB,KAAK,EAAE,IAAI,MAAS;AAAA,IACzI;AAAA,EACF;AACF;AAVS;AA8BT,IAAI,eAA4B;AAChC,IAAI,WAAoB,WAAW,YAAY;AAE/C,IAAM,eAAwB,WAAW,cAAc;AAGvD,SAAS,qBAA2B;AAClC,MAAI,CAAC,aAAa,iBAAiB,SAAU;AAC7C,MAAI;AACF,QAAI,SAAS,IAAI,UAAU,MAAM,QAAQ,SAAS,IAAI,WAAW,MAAM,KAAM;AAC7E,UAAM,SAAS,WAAW,cAAc;AACxC,UAAM,SAAS,OAAO,IAAI,UAAU;AACpC,UAAMC,WAAU,OAAO,IAAI,WAAW;AACtC,QAAI,WAAW,QAAQA,aAAY,KAAM;AACzC,QAAI,WAAW,KAAM,UAAS,IAAI,YAAY,MAAM;AACpD,QAAIA,aAAY,KAAM,UAAS,IAAI,aAAaA,QAAO;AACvD,WAAO,IAAI,YAAY,IAAI;AAC3B,WAAO,IAAI,aAAa,IAAI;AAAA,EAC9B,QAAQ;AAAA,EAAC;AACX;AAbS;AAcT,mBAAmB;AAGnB,SAAS,eAA8B;AACrC,MAAI;AAaF,QAAI,OAAO,aAAa,YAAa,QAAO;AAE5C,UAAM,IAAI,SAAS,OAAO,MAAM,+BAA+B;AAC/D,UAAM,SAAS,IAAI,CAAC;AACpB,QAAI,WAAW,OAAW,QAAO,mBAAmB,MAAM;AAE1D,QAAI,OAAO,cAAc,eAAe,UAAU,UAAU;AAC1D,aAAO,UAAU;AAAA,IACnB;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AAzBS;AAqCT,SAAS,iBAAyB;AAChC,MAAI,OAAO,WAAW,aAAa;AACjC,QAAI;AACF,UAAI,OAAO,YAAY,eAAe,QAAQ,KAAK;AACjD,YAAI,QAAQ,IAAI,6BAA6B,OAAQ,QAAO;AAG5D,YAAI,QAAQ,IAAI,8BAA8B;AAC5C,iBAAO,QAAQ,IAAI;AACrB,eAAO,QAAQ,IAAI,uBAAuB;AAAA,MAC5C;AAAA,IACF,QAAQ;AAAA,IAAC;AACT,WAAO;AAAA,EACT;AACA,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,KAAK;AACjD,UAAI,QAAQ,IAAI,6BAA6B,OAAQ,QAAO;AAC5D,aAAO,QAAQ,IAAI,uBAAuB;AAAA,IAC5C;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AArBS;AAwBT,SAAS,iBAAgC;AACvC,MAAI;AACF,WAAO,KAAK,eAAe,EAAE,gBAAgB,EAAE,YAAY;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AANS;AAcT,SAAS,gBAA+B;AACtC,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,KAAK,qBAAqB;AACtE,aAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AAPS;AAUT,IAAI,kBAAiC;AACrC,IAAI,oBAAmC;AACvC,IAAI,kBAAiC;AACrC,IAAI,mBAAkC;AACtC,IAAI,mBAAmB;AACvB,IAAI,kBAAyD;AAS7D,IAAI,kBAAyC;AAG7C,IAAI,mBAAkD;AAGtD,IAAM,eAAe;AAoBrB,SAAS,SAAS,OAA8B;AAC9C,MAAI;AACF,UAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,OAAO,KAAK,MAAM,KAAK,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC,CAAC;AAC3E,WAAO,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM,MAAO;AAAA,EAC1D,QAAQ;AAAE,WAAO;AAAA,EAAM;AACzB;AAPS;AAST,SAAS,kBAAmC;AAC1C,QAAM,SAAS,SAAS,IAAI,UAAU;AACtC,QAAMA,WAAU,SAAS,IAAI,WAAW;AACxC,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,YAAY,SAAS,SAAS,MAAM,IAAI;AAC9C,QAAM,cAAc,WAAW,SAAS,cAAc,QAAQ,YAAY;AAC1E,QAAM,aAAaA,WAAU,SAASA,QAAO,IAAI;AACjD,QAAM,eAAeA,aAAY,SAAS,eAAe,QAAQ,aAAa;AAC9E,SAAO;AAAA,IACL,QAAQ,eAAe,eAAe,kBAAkB;AAAA,IACxD,iBAAiB;AAAA,EACnB;AACF;AAZS;AAeT,IAAM,kBAAmC,EAAE,QAAQ,aAAa,iBAAiB,KAAK;AAMtF,IAAM,qBAAqB,oBAAoB,UAAU;AAEzD,IAAI,YAA6B,gBAAgB;AACjD,IAAM,oBAAoB,oBAAI,IAAgB;AAC9C,IAAI,eAAqD;AACzD,IAAI,4BAA4B;AAGhC,SAAS,qBAA2B;AAClC,MAAI,CAAC,UAAW;AAChB,MAAI,iBAAiB,MAAM;AAAE,iBAAa,YAAY;AAAG,mBAAe;AAAA,EAAM;AAC9E,MAAI,kBAAkB,SAAS,EAAG;AAClC,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,OAAiB,CAAC;AACxB,QAAM,SAAS,SAAS,IAAI,UAAU;AACtC,QAAMA,WAAU,SAAS,IAAI,WAAW;AACxC,QAAM,YAAY,SAAS,SAAS,MAAM,IAAI;AAC9C,QAAM,aAAaA,WAAU,SAASA,QAAO,IAAI;AACjD,MAAI,cAAc,QAAQ,YAAY,IAAK,MAAK,KAAK,SAAS;AAC9D,MAAI,eAAe,QAAQ,aAAa,IAAK,MAAK,KAAK,UAAU;AACjE,MAAI,CAAC,KAAK,OAAQ;AAGlB,QAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,GAAG,IAAI,IAAI,MAAM,KAAK,UAAU;AAChE,iBAAe,WAAW,sBAAsB,KAAK;AACvD;AAjBS;AAoBT,SAAS,uBAA6B;AACpC,QAAM,OAAO,gBAAgB;AAC7B,QAAM,UACJ,KAAK,WAAW,UAAU,UAC1B,KAAK,oBAAoB,UAAU;AACrC,MAAI,SAAS;AAAE,gBAAY;AAAM,UAAM,kBAAkB,EAAE,QAAQ,KAAK,OAAO,CAAC;AAAA,EAAG;AACnF,qBAAmB;AACnB,MAAI,CAAC,QAAS;AACd,aAAW,YAAY,MAAM,KAAK,iBAAiB,GAAG;AACpD,QAAI;AAAE,eAAS;AAAA,IAAG,QAAQ;AAAA,IAAC;AAAA,EAC7B;AAIA,MAAI,WAAW;AACb,QAAI;AAAE,aAAO,cAAc,IAAI,MAAM,kBAAkB,CAAC;AAAA,IAAG,QAAQ;AAAA,IAAC;AAAA,EACtE;AACF;AAjBS;AAsBT,SAAS,oBAA0B;AACjC,MAAI,CAAC,aAAa,0BAA2B;AAC7C,8BAA4B;AAC5B,SAAO,iBAAiB,WAAW,CAAC,MAAM;AACxC,QAAI,EAAE,QAAQ,QAAQ,EAAE,QAAQ,cAAc,EAAE,QAAQ,aAAa;AACnE,2BAAqB;AAAA,IACvB;AAAA,EACF,CAAC;AACD,SAAO,iBAAiB,oBAAoB,MAAM,qBAAqB,CAAC;AAGxE,SAAO,iBAAiB,SAAS,MAAM,qBAAqB,CAAC;AAC7D,WAAS,iBAAiB,oBAAoB,MAAM;AAClD,QAAI,SAAS,oBAAoB,UAAW,sBAAqB;AAAA,EACnE,CAAC;AACD,MAAI;AACF,IAAC,OAAoD,aAAa,iBAAiB,UAAU,MAAM,qBAAqB,CAAC;AAAA,EAC3H,QAAQ;AAAA,EAAC;AACX;AAlBS;AA2CT,IAAM,2BAA2B,6BAA6B,UAAU;AAExE,IAAM,2BAAuD,MAAM;AAGjE,QAAM,IAAI;AACV,QAAM,WAAW,EAAE,wBAAwB;AAC3C,MAAI,oBAAoB,IAAK,QAAO;AACpC,QAAM,UAAU,oBAAI,IAA2B;AAC/C,IAAE,wBAAwB,IAAI;AAC9B,SAAO;AACT,GAAG;AAiBH,IAAI,UAA4B;AAEhC,SAAS,mBAAyB;AAChC,MAAI,CAAC,QAAS;AACd,UAAQ,UAAU;AAAA,IAChB,SAAS,KAAK,WAAW;AAAA,IACzB,aAAa,mBAAmB,YAAY;AAAA,EAC9C,CAAC;AACH;AANS;AAsBF,IAAM,OAAO;AAAA;AAAA,EAElB,iBAA8B;AAAE,WAAO;AAAA,EAAc;AAAA;AAAA;AAAA;AAAA,EAIrD,eAAe,MAAyB;AACtC,mBAAe;AACf,eAAW,WAAW,IAAI;AAC1B,yBAAqB;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,QAAsC;AACpD,YAAQ,gBAAgB,WAAW,OAAO,QAAQ,MAAM;AACxD,yBAAqB;AAAA,EACvB;AAAA;AAAA,EAEA,kBAAiC;AAAE,WAAO,QAAQ,aAAa;AAAA,EAAG;AAAA;AAAA,EAGlE,WAA0B;AAAE,WAAO,SAAS,IAAI,UAAU;AAAA,EAAG;AAAA,EAC7D,SAAS,OAA4B;AACnC,UAAM,kBAAkB,EAAE,SAAS,UAAU,KAAK,CAAC;AACnD,aAAS,IAAI,YAAY,KAAK;AAC9B,yBAAqB;AAAA,EACvB;AAAA,EACA,kBAAiC;AAAE,WAAO,SAAS,IAAI,WAAW;AAAA,EAAG;AAAA,EACrE,gBAAgB,OAA4B;AAC1C,UAAM,yBAAyB,EAAE,SAAS,UAAU,KAAK,CAAC;AAC1D,aAAS,IAAI,aAAa,KAAK;AAC/B,yBAAqB;AAAA,EACvB;AAAA,EACA,cAAoB;AAClB,UAAM,mBAAmB;AAIzB,eAAW,QAAQ,CAAC,gBAAgB,kBAAkB,QAAQ,GAAY;AACxE,YAAMC,WAAU,WAAW,IAAI;AAC/B,MAAAA,SAAQ,IAAI,YAAY,IAAI;AAC5B,MAAAA,SAAQ,IAAI,aAAa,IAAI;AAAA,IAC/B;AAEA,YAAQ,SAAS;AACjB,yBAAqB;AAAA,EACvB;AAAA;AAAA;AAAA,EAGA,kBAA2B;AAAE,WAAO,gBAAgB,EAAE,WAAW;AAAA,EAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlF,WAAW,QAA2D;AACpE,UAAM,oBAAoB,EAAE,SAAS,OAAO,YAAY,SAAY,SAAS,OAAO,YAAY,OAAO,YAAY,MAAM,CAAC;AAC1H,aAAS,IAAI,YAAY,OAAO,MAAM;AACtC,QAAI,OAAO,YAAY,OAAW,UAAS,IAAI,aAAa,OAAO,OAAO;AAC1E,yBAAqB;AAAA,EACvB;AAAA,EACA,eAAqB;AAAE,SAAK,YAAY;AAAA,EAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAU3C,cAA+B;AAAE,WAAO;AAAA,EAAW;AAAA,EACnD,oBAAqC;AAAE,WAAO;AAAA,EAAiB;AAAA,EAC/D,UAAU,UAAkC;AAC1C,sBAAkB;AAClB,sBAAkB,IAAI,QAAQ;AAE9B,yBAAqB;AACrB,WAAO,MAAM;AACX,wBAAkB,OAAO,QAAQ;AACjC,UAAI,kBAAkB,SAAS,KAAK,iBAAiB,MAAM;AACzD,qBAAa,YAAY;AACzB,uBAAe;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,iBAAiB,IAAuC;AACtD,4BAAwB,IAAI,EAAE;AAC9B,WAAO,MAAM;AAAE,8BAAwB,OAAO,EAAE;AAAA,IAAG;AAAA,EACrD;AAAA;AAAA,EAGA,YAA2B;AACzB,WAAO,mBAAmB,aAAa,IAAI,WAAW,KAAK,cAAc;AAAA,EAC3E;AAAA,EACA,UAAU,KAA0B;AAAE,sBAAkB;AAAA,EAAK;AAAA,EAC7D,iBAAiB,KAA0B;AACzC,sBAAkB;AAClB,iBAAa,IAAI,aAAa,GAAG;AAAA,EACnC;AAAA,EACA,cAAoB;AAAE,sBAAkB;AAAM,iBAAa,IAAI,aAAa,IAAI;AAAA,EAAG;AAAA;AAAA,EAGnF,YAA2B;AAAE,WAAO,mBAAmB,aAAa;AAAA,EAAG;AAAA,EACvE,UAAU,QAA6B;AAAE,sBAAkB;AAAA,EAAQ;AAAA;AAAA;AAAA,EAInE,cAA6B;AAAE,WAAO,qBAAqB,eAAe;AAAA,EAAG;AAAA,EAC7E,YAAY,UAA+B;AAAE,wBAAoB;AAAA,EAAU;AAAA;AAAA,EAG3E,aAAqB;AACnB,UAAM,MAAO,oBAAoB,eAAe;AAChD,WAAO,IAAI,QAAQ,OAAO,EAAE;AAAA,EAC9B;AAAA,EACA,WAAW,KAA0B;AACnC,uBAAmB,MAAM,IAAI,QAAQ,OAAO,EAAE,IAAI;AAClD,qBAAiB;AAAA,EACnB;AAAA;AAAA,EAGA,qBAA8B;AAAE,WAAO;AAAA,EAAkB;AAAA,EACzD,mBAAmB,OAAsB;AACvC,uBAAmB;AACnB,qBAAiB;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,eAAe,IAAiD;AAC9D,sBAAkB;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,kBAAkB,IAAiC;AACjD,sBAAkB;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,aAAqC;AACnC,WAAO,WAAW;AAAA,EACpB;AACF;AAsBA,eAAe,aAAqC;AAClD,MAAI,iBAAkB,QAAO;AAC7B,MAAI,CAAC,gBAAiB,QAAO;AAK7B,QAAM,aAAa,mCAAoC;AACrD,UAAMD,WAAU,KAAK,gBAAgB;AACrC,QAAI,CAACA,SAAS,QAAO;AACrB,UAAM,SAAS,MAAM,gBAAiBA,QAAO;AAC7C,QAAI,CAAC,QAAQ,QAAQ;AAAE,YAAM,WAAW,EAAE,IAAI,OAAO,KAAK,YAAY,CAAC;AAAG,aAAO;AAAA,IAAM;AACvF,UAAM,WAAW,EAAE,IAAI,MAAM,SAAS,QAAQ,OAAO,OAAO,EAAE,CAAC;AAC/D,SAAK,SAAS,OAAO,MAAM;AAC3B,QAAI,OAAO,QAAS,MAAK,gBAAgB,OAAO,OAAO;AACvD,WAAO,OAAO;AAAA,EAChB,GATmB;AAWnB,sBAAoB,YAAY;AAC9B,QAAI;AAEF,YAAM,QACJ,OAAO,cAAc,cAChB,UAAkD,QACnD;AACN,UAAI,OAAO,SAAS;AAClB,eAAO,MAAM,MAAM,QAAQ,GAAG,WAAW,YAAY,UAAU;AAAA,MACjE;AACA,aAAO,MAAM,WAAW;AAAA,IAC1B,QAAQ;AACN,YAAM,WAAW,EAAE,IAAI,OAAO,KAAK,QAAQ,CAAC;AAC5C,aAAO;AAAA,IACT,UAAE;AACA,yBAAmB;AAAA,IACrB;AAAA,EACF,GAAG;AAEH,SAAO;AACT;AAtCe;AA+Cf,SAAS,cAAc,UAAoB,KAAmB;AAC5D,QAAM,gBAAgB,EAAE,KAAK,QAAQ,SAAS,QAAQ,MAAM,OAAO,SAAS,GAAG,GAAG,UAAU,wBAAwB,KAAK,CAAC;AAC1H,OAAK,YAAY;AACjB,aAAW,MAAM,MAAM,KAAK,uBAAuB,GAAG;AACpD,QAAI;AAAE,SAAG,QAAQ;AAAA,IAAG,QAAQ;AAAA,IAAC;AAAA,EAC/B;AACA,MAAI,iBAAiB;AACnB,QAAI;AAAE,sBAAgB,QAAQ;AAAA,IAAG,QAAQ;AAAA,IAAC;AAAA,EAC5C;AACF;AATS;AA+DT,SAAS,cAAuB;AAC9B,MAAI;AACF,WAAO,OAAO,YAAY,eACrB,QAAQ,KAAK,6BAA6B;AAAA,EACjD,QAAQ;AAAE,WAAO;AAAA,EAAO;AAC1B;AALS;AAOT,IAAM,WAAW;AACjB,IAAM,cAAc;AACpB,IAAM,eAAe;AAErB,SAAS,WAAiC;AACxC,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,MAAM,UAAU,KAAK,UAAU,CAAC;AACtC,QAAI,kBAAkB,MAAM,IAAI,OAAO,kBAAkB,WAAW;AACpE,QAAI,YAAY,MAAM,QAAQ,IAAI,MAAM;AACxC,QAAI,UAAU,MAAM,OAAO,IAAI,KAAK;AAAA,EACtC,CAAC;AACH;AAPS;AAST,SAAS,QAAQ,KAAiD;AAChE,SAAO,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC9D,UAAM,KAAK,GAAG,YAAY,aAAa,UAAU;AACjD,UAAM,MAAM,GAAG,YAAY,WAAW,EAAE,IAAI,GAAG;AAC/C,QAAI,YAAY,MAAM,QAAQ,IAAI,MAAM;AACxC,QAAI,UAAU,MAAM,OAAO,IAAI,KAAK;AAAA,EACtC,CAAC,CAAC;AACJ;AAPS;AAST,SAAS,QAAQ,KAAa,OAAqC;AACjE,SAAO,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC9D,UAAM,KAAK,GAAG,YAAY,aAAa,WAAW;AAClD,OAAG,YAAY,WAAW,EAAE,IAAI,OAAO,GAAG;AAC1C,OAAG,aAAa,MAAM,QAAQ;AAC9B,OAAG,UAAU,MAAM,OAAO,GAAG,KAAK;AAAA,EACpC,CAAC,CAAC;AACJ;AAPS;AAUT,IAAI,kBAAiD;AAErD,SAAS,kBAA0C;AACjD,MAAI,gBAAiB,QAAO;AAC5B,qBAAmB,YAAY;AAC7B,UAAM,WAAW,MAAM,QAAQ,YAAY,EAAE,MAAM,MAAM,MAAS;AAClE,QAAI,SAAU,QAAO;AACrB,UAAM,OAAO,MAAM,OAAO,OAAO;AAAA,MAC/B,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,MACrC;AAAA;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AAGA,UAAM,QAAQ,cAAc,IAAI,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAChD,WAAO;AAAA,EACT,GAAG;AACH,SAAO;AACT;AAhBS;AAkBT,SAAS,iBAAiB,OAAyC;AACjE,QAAM,MAAM,iBAAiB,aAAa,QAAQ,IAAI,WAAW,KAAK;AACtE,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,MAAK,OAAO,aAAa,IAAI,CAAC,KAAK,CAAC;AACzE,SAAO,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC1E;AALS;AAOT,SAAS,kBAAkB,KAAqB;AAC9C,SAAO,iBAAiB,IAAI,YAAY,EAAE,OAAO,GAAG,CAAC;AACvD;AAFS;AAKT,eAAe,WAAW,KAAiD;AACzE,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,GAAG;AAEpD,SAAO,EAAE,KAAK,MAAM,KAAK,SAAS,GAAG,IAAI,GAAa,GAAG,IAAI,EAAY;AAC3E;AAJe;AAOf,eAAe,eAAe,QAAgB,KAAqC;AACjF,MAAI;AACF,UAAM,OAAO,MAAM,gBAAgB;AACnC,UAAM,MAAM,MAAM,WAAW,KAAK,SAAS;AAC3C,UAAM,SAAS,EAAE,KAAK,YAAY,KAAK,SAAS,IAAI;AAEpD,UAAM,kBAAkB,IAAI,MAAM,GAAG,EAAE,CAAC,KAAK;AAC7C,UAAM,MAAM,gBAAgB,MAAM,GAAG,EAAE,CAAC,KAAK;AAC7C,UAAM,MACH,OAAO,cAAc,OAAO,WAAW,KACxC,iBAAiB,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;AAC7D,UAAM,UAAU,EAAE,KAAK,OAAO,YAAY,GAAG,KAAK,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG,IAAI;AAC1F,UAAM,eACJ,GAAG,kBAAkB,KAAK,UAAU,MAAM,CAAC,CAAC,IAAI,kBAAkB,KAAK,UAAU,OAAO,CAAC,CAAC;AAC5F,UAAM,MAAM,MAAM,OAAO,OAAO;AAAA,MAC9B,EAAE,MAAM,SAAS,MAAM,UAAU;AAAA,MACjC,KAAK;AAAA,MACL,IAAI,YAAY,EAAE,OAAO,YAAY;AAAA,IACvC;AACA,WAAO,GAAG,YAAY,IAAI,iBAAiB,GAAG,CAAC;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAvBe;AAyBR,SAAS,oBAAoBE,SAAyB;AAC3D,MAAI,QAAS;AACb,YAAUA;AAEV,EAAAA,QAAO,UAAU;AAAA,IACf,SAAS,KAAK,WAAW;AAAA,IACzB,aAAa,mBAAmB,YAAY;AAAA,EAC9C,CAAC;AAED,EAAAA,QAAO,aAAa,QAAQ,IAAI,OAAO,YAAY;AACjD,UAAM,QAAQ,KAAK,SAAS;AAC5B,QAAI,MAAO,SAAQ,QAAQ,IAAI,iBAAiB,UAAU,KAAK,EAAE;AAEjE,UAAM,SAAS,KAAK,UAAU;AAC9B,QAAI,OAAQ,SAAQ,QAAQ,IAAI,mBAAmB,MAAM;AAIzD,UAAM,SAAS,KAAK,UAAU;AAC9B,QAAI,UAAU,CAAC,QAAQ,QAAQ,IAAI,WAAW,EAAG,SAAQ,QAAQ,IAAI,aAAa,MAAM;AAExF,UAAM,KAAK,KAAK,YAAY;AAC5B,QAAI,GAAI,SAAQ,QAAQ,IAAI,cAAc,EAAE;AAC5C,YAAQ,QAAQ,IAAI,kBAAiB,oBAAI,KAAK,GAAE,YAAY,CAAC;AAI7D,QAAI,YAAY,KAAK,OAAO,WAAW,aAAa;AAClD,YAAM,QAAQ,MAAM,eAAe,QAAQ,QAAQ,QAAQ,GAAG;AAC9D,UAAI,MAAO,SAAQ,QAAQ,IAAI,QAAQ,KAAK;AAAA,IAC9C;AAEA,WAAO;AAAA,EACT,CAAC;AAED,EAAAA,QAAO,aAAa,MAAM,IAAI,CAAC,KAAK,KAAK,QAAQ;AAC/C,QAAI,eAAe,SAAU,QAAO;AACpC,UAAM,MAAO,KAA6B,OAAO;AACjD,UAAM,SAAU,KAA8B,UAAU;AACxD,UAAM,aAAc,KAA8B,cAAc;AAChE,WAAO,IAAI,SAAS,QAAQ,YAAY,KAAK,GAAG;AAAA,EAClD,CAAC;AAGD,EAAAA,QAAO,aAAa,SAAS,IAAI,OAAO,UAAU,YAAY;AAC5D,QAAI,SAAS,WAAW,IAAK,QAAO;AAIpC,QAAI,iDAAiD,KAAK,QAAQ,GAAG,GAAG;AACtE,YAAM,mBAAmB,EAAE,MAAM,OAAO,QAAQ,GAAG,EAAE,CAAC;AACtD,aAAO;AAAA,IACT;AAGA,QAAI,QAAQ,QAAQ,IAAI,YAAY,GAAG;AACrC,oBAAc,UAAU,cAAc;AACtC,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,MAAM,WAAW;AAClC,QAAI,CAAC,UAAU;AACb,oBAAc,UAAU,gBAAgB;AACxC,aAAO;AAAA,IACT;AAKA,UAAM,QAAQ,QAAQ,MAAM;AAC5B,UAAM,QAAQ,IAAI,iBAAiB,UAAU,QAAQ,EAAE;AACvD,UAAM,QAAQ,IAAI,cAAc,GAAG;AAGnC,QAAI,YAAY,KAAK,OAAO,WAAW,aAAa;AAClD,YAAM,QAAQ,MAAM,eAAe,MAAM,QAAQ,MAAM,GAAG;AAC1D,UAAI,MAAO,OAAM,QAAQ,IAAI,QAAQ,KAAK;AAAA,IAC5C;AACA,QAAI;AACF,YAAM,UAAU,MAAM,MAAM,KAAK;AACjC,UAAI,QAAQ,WAAW,IAAK,eAAc,SAAS,WAAW;AAC9D,aAAO;AAAA,IACT,QAAQ;AAIN,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACH;AAzFgB;AAsGhB,IAAM,mBAAmB;AAEzB,KAAK,kBAAkB,OAAOF,aAAY;AACxC,MAAI;AACF,UAAM,MAAM,GAAG,KAAK,WAAW,CAAC,GAAG,gBAAgB;AACnD,UAAM,UAAkC,EAAE,gBAAgB,mBAAmB;AAE7E,QAAI,YAAY,KAAK,OAAO,WAAW,aAAa;AAClD,YAAM,QAAQ,MAAM,eAAe,QAAQ,GAAG;AAC9C,UAAI,MAAO,SAAQ,MAAM,IAAI;AAAA,IAC/B;AACA,UAAM,MAAM,MAAM,MAAM,KAAK;AAAA,MAC3B,QAAQ;AAAA,MACR;AAAA,MACA,aAAa,KAAK,mBAAmB,IAAI,YAAY;AAAA,MACrD,MAAM,KAAK,UAAU,EAAE,SAAAA,SAAQ,CAAC;AAAA,IAClC,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,WAAO,MAAM,SACT,EAAE,QAAQ,KAAK,QAAQ,SAAS,KAAK,WAAWA,SAAQ,IACxD;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF,CAAC;;;ACx7BD,SAA+B,qBAAqB;AAoCpD,IAAM,iBAA+B;AAAA,EACnC,SAAS,OAAO,YAAY,eAAe,yBAA0B;AAAA,EACrE,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX,WAAW;AAAA,EACX,YAAY;AACd;AAEA,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,YAAN,MAAgB;AAAA,EA1DvB,OA0DuB;AAAA;AAAA;AAAA,EACb;AAAA,EACA;AAAA,EAER,YAAY,SAAgC,CAAC,GAAG;AAC9C,SAAK,SAAS,EAAE,GAAG,gBAAgB,GAAG,OAAO;AAC7C,SAAK,UAAU,OAAO,WAAW,cAAc;AAAA,MAC7C,OAAO,KAAK,OAAO,UAAU,IAAI;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EAEA,SAAe;AAAE,SAAK,OAAO,UAAU;AAAA,EAAM;AAAA,EAC7C,UAAgB;AAAE,SAAK,OAAO,UAAU;AAAA,EAAO;AAAA,EAC/C,UAAU,QAAqC;AAC7C,SAAK,SAAS,EAAE,GAAG,KAAK,QAAQ,GAAG,OAAO;AAAA,EAC5C;AAAA,EAEQ,cAAc,SAA0D;AAC9E,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,UAAM,WAAmC,CAAC;AAC1C,WAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,eAAS,GAAG,IAAI,kBAAkB,SAAS,IAAI,YAAY,CAAC,IAAI,QAAS,QAAQ,GAAG,KAAK;AAAA,IAC3F,CAAC;AACD,WAAO;AAAA,EACT;AAAA,EAEA,WAAW,SAA2B;AACpC,QAAI,CAAC,KAAK,OAAO,WAAW,CAAC,KAAK,OAAO,YAAa;AACtD,UAAM,EAAE,QAAQ,KAAK,SAAS,KAAK,IAAI;AACvC,SAAK,QAAQ,MAAM,GAAG,MAAM,IAAI,GAAG,EAAE;AACrC,QAAI,KAAK,OAAO,cAAc,QAAS,MAAK,QAAQ,MAAM,YAAY,KAAK,cAAc,OAAO,CAAC;AACjG,QAAI,KAAK,OAAO,aAAa,KAAM,MAAK,QAAQ,MAAM,SAAS,IAAI;AAAA,EACrE;AAAA,EAEA,YAAY,SAAqB,UAA6B;AAC5D,QAAI,CAAC,KAAK,OAAO,WAAW,CAAC,KAAK,OAAO,aAAc;AACvD,UAAM,EAAE,QAAQ,IAAI,IAAI;AACxB,UAAM,EAAE,QAAQ,YAAY,MAAM,SAAS,IAAI;AAC/C,SAAK,QAAQ,QAAQ,GAAG,MAAM,IAAI,GAAG,IAAI,MAAM,IAAI,UAAU,KAAK,QAAQ,KAAK;AAC/E,QAAI,KAAK,OAAO,aAAa,KAAM,MAAK,QAAQ,MAAM,aAAa,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,SAAqB,OAAuB;AACnD,QAAI,CAAC,KAAK,OAAO,WAAW,CAAC,KAAK,OAAO,UAAW;AACpD,UAAM,EAAE,QAAQ,IAAI,IAAI;AACxB,UAAM,EAAE,SAAS,YAAY,aAAa,SAAS,IAAI;AACvD,SAAK,QAAQ,MAAM,GAAG,MAAM,IAAI,GAAG,IAAI,cAAc,SAAS,WAAW,QAAQ,KAAK;AACtF,SAAK,QAAQ,MAAM,YAAY,OAAO;AACtC,QAAI,eAAe,OAAO,KAAK,WAAW,EAAE,SAAS,GAAG;AACtD,WAAK,QAAQ,MAAM,eAAe;AAClC,aAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,OAAO,MAAM,MAAM;AACvD,eAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,MAAM,YAAO,KAAK,KAAK,GAAG,EAAE,CAAC;AAAA,MACpE,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,KAAK,YAAoB,MAAmB;AAAE,QAAI,KAAK,OAAO,QAAS,MAAK,QAAQ,KAAK,SAAS,GAAG,IAAI;AAAA,EAAG;AAAA,EAC5G,KAAK,YAAoB,MAAmB;AAAE,QAAI,KAAK,OAAO,QAAS,MAAK,QAAQ,KAAK,SAAS,GAAG,IAAI;AAAA,EAAG;AAAA,EAC5G,MAAM,YAAoB,MAAmB;AAAE,QAAI,KAAK,OAAO,QAAS,MAAK,QAAQ,MAAM,SAAS,GAAG,IAAI;AAAA,EAAG;AAAA,EAC9G,MAAM,YAAoB,MAAmB;AAAE,QAAI,KAAK,OAAO,QAAS,MAAK,QAAQ,MAAM,SAAS,GAAG,IAAI;AAAA,EAAG;AAAA,EAC9G,QAAQ,YAAoB,MAAmB;AAAE,QAAI,KAAK,OAAO,QAAS,MAAK,QAAQ,QAAQ,SAAS,GAAG,IAAI;AAAA,EAAG;AAAA,EAClH,QAAQ,KAA8B;AAAE,WAAO,KAAK,QAAQ,QAAQ,GAAG;AAAA,EAAG;AAC5E;AAEO,IAAM,gBAAgB,IAAI,UAAU;;;AC1HpC,IAAM,QAAQ,yBAAyB;AAEvC,IAAMG,aAAY,OAAO,WAAW;AAMpC,IAAM,gBAAgB,QAAQ,IAAI,6BAA6B;AAY/D,IAAMC,eAAc,QAAQ,IAAI,6BAA6B;;;ACKpE,IAAM,mBAAmB,SAAS;AAElC,IAAM,gBAA8B,mBAAmB,IAAI;AAE3D,IAAI,SAAuB;AAG3B,IAAM,eAAe,oBAAI,IAAmC;AAGrD,SAAS,cAA4B;AAC1C,SAAO;AACT;AAFgB;AAKT,SAAS,YAAY,OAA2B;AACrD,WAAS;AACT,aAAW,MAAM,cAAc;AAC7B,QAAI;AACF,SAAG,KAAK;AAAA,IACV,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AATgB;AAeT,SAAS,iBAAiB,IAA+C;AAC9E,eAAa,IAAI,EAAE;AACnB,MAAI;AACF,OAAG,MAAM;AAAA,EACX,QAAQ;AAAA,EAER;AACA,SAAO,MAAM,aAAa,OAAO,EAAE;AACrC;AARgB;AAkBT,SAAS,mBAAmB,MAAmD;AACpF,QAAM,UAAU,KAAK,SAAS;AAC9B,MAAI,KAAK,WAAW,SAAS;AAC3B,gBAAY,CAAC;AAAA,EACf,OAAO;AACL,gBAAY,CAAC;AAAA,EACf;AACF;AAPgB;;;AC9DhB,SAAS,4BAA4B;AAQ9B,SAAS,aAA8B;AAC5C,SAAO,qBAAqB,KAAK,WAAW,KAAK,aAAa,KAAK,iBAAiB;AACtF;AAFgB;;;ACjBhB,SAAS,aAAa,wBAAAC,6BAA4B;AAUlD,IAAM,cAAc;AAEpB,IAAM,YAAY,oBAAI,IAAgB;AAEtC,SAAS,OAAsB;AAC7B,MAAI;AACF,WAAO,aAAa,QAAQ,WAAW,KAAK;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AANS;AAST,SAAS,UAAgB;AACvB,MAAI,OAAO,WAAW,YAAa;AACnC,OAAK,YAAY,KAAK,CAAC;AACzB;AAHS;AAIT,QAAQ;AAER,SAAS,MAAM,UAA+B;AAC5C,MAAI;AACF,QAAI,SAAU,cAAa,QAAQ,aAAa,QAAQ;AAAA,QACnD,cAAa,WAAW,WAAW;AAAA,EAC1C,QAAQ;AAAA,EAER;AACA,OAAK,YAAY,QAAQ;AACzB,YAAU,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC9B;AATS;AAWT,SAAS,UAAU,UAAkC;AACnD,YAAU,IAAI,QAAQ;AACtB,SAAO,MAAM,UAAU,OAAO,QAAQ;AACxC;AAHS;AAeF,SAAS,cAAiC;AAC/C,QAAM,aAAaC,sBAAqB,WAAW,MAAM,MAAM,IAAI;AACnE,QAAM,cAAc,YAAY,CAAC,OAAsB,MAAM,EAAE,GAAG,CAAC,CAAC;AACpE,SAAO;AAAA,IACL,UAAU,cAAc,KAAK,YAAY;AAAA,IACzC;AAAA,IACA,QAAQ,eAAe;AAAA,IACvB;AAAA,EACF;AACF;AATgB;;;ACxChB,SAAS,aAAa,qBAAqB;AAC3C,SAAS,eAAAC,cAAa,eAAe;AAQrC,IAAI,iBAAiB;AACrB,IAAI,OAAO,WAAW,aAAa;AACjC,SAAO,iBAAiB,YAAY,CAAC,MAAM;AACzC,QAAI,EAAE,UAAW,kBAAiB;AAAA,EACpC,CAAC;AACH;AAEA,SAAS,WAAmB;AAC1B,SAAO,OAAO,WAAW,cAAc,KAAK,OAAO,SAAS;AAC9D;AAFS;AAOT,SAAS,cAAsB;AAC7B,MAAI,OAAO,YAAY,aAAa;AAClC,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,IAAI,yBAAyB;AAC9C;AALS;AAUT,SAAS,aAAa,MAAc,UAA0B;AAC5D,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AAEA,QAAM,iBAAiB,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AAE7D,QAAM,qBAAqB,SAAS,QAAQ,OAAO,EAAE;AACrD,SAAO,GAAG,kBAAkB,GAAG,cAAc;AAC/C;AATS;AA6BF,SAAS,eAAe;AAC7B,QAAM,SAAS,cAAc;AAG7B,QAAM,WAAW,QAAQ,MAAM,YAAY,GAAG,CAAC,CAAC;AAEhD,QAAM,OAAOC,aAAY,CAAC,MAAc,YAAmC;AACzE,cAAU,YAAY,EAAE,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;AACpD,QAAI,UAAU;AAEZ,aAAO,SAAS,OAAO,aAAa,MAAM,QAAQ;AAAA,IACpD,OAAO;AAEL,aAAO,KAAK,MAAM,OAAO;AAAA,IAC3B;AAAA,EACF,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAErB,QAAM,UAAUA,aAAY,CAAC,MAAc,YAAmC;AAC5E,cAAU,eAAe,EAAE,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;AACvD,QAAI,UAAU;AAEZ,aAAO,SAAS,QAAQ,aAAa,MAAM,QAAQ,CAAC;AAAA,IACtD,OAAO;AAEL,aAAO,QAAQ,MAAM,OAAO;AAAA,IAC9B;AAAA,EACF,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAerB,QAAM,WAAWA,aAAY,CAAC,SAAiB;AAC7C,QAAI,gBAAgB;AAClB,gBAAU,wBAAwB,EAAE,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;AAChE;AAAA,IACF;AACA,qBAAiB;AACjB,cAAU,gBAAgB,EAAE,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;AACxD,WAAO,SAAS,OAAO,aAAa,MAAM,QAAQ;AAAA,EACpD,GAAG,CAAC,QAAQ,CAAC;AAcb,QAAM,cAAcA,aAAY,CAAC,SAAiB;AAChD,QAAI,gBAAgB;AAClB,gBAAU,2BAA2B,EAAE,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;AACnE;AAAA,IACF;AACA,qBAAiB;AACjB,cAAU,mBAAmB,EAAE,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;AAC3D,WAAO,SAAS,QAAQ,aAAa,MAAM,QAAQ,CAAC;AAAA,EACtD,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,WAAWA,aAAY,CAAC,SAAiB;AAE7C,WAAO,SAAS,IAAI;AAAA,EACtB,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,OAAOA,aAAY,MAAM;AAC7B,WAAO,KAAK;AAAA,EACd,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,UAAUA,aAAY,MAAM;AAChC,WAAO,QAAQ;AAAA,EACjB,GAAG,CAAC,MAAM,CAAC;AAEX,QAAMC,WAAUD,aAAY,MAAM;AAChC,WAAO,QAAQ;AAAA,EACjB,GAAG,CAAC,MAAM,CAAC;AAEX,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAAC;AAAA,EACF;AACF;AApGgB;;;AC9DhB,SAAS,mBAAmB;AAC5B,SAAS,WAAW,QAAQ,gBAAgB;AAerC,SAAS,iBAAkC;AAChD,QAAM,WAAW,YAAY;AAC7B,QAAM,CAAC,aAAa,cAAc,IAAI,SAA0B,MAAM;AACpE,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,IAAI,gBAAgB;AAAA,IAC7B;AACA,WAAO,IAAI,gBAAgB,OAAO,SAAS,MAAM;AAAA,EACnD,CAAC;AACD,QAAM,gBAAgB,OAAe,EAAE;AAEvC,YAAU,MAAM;AACd,QAAI,OAAO,WAAW,YAAa;AAEnC,UAAM,oBAAoB,6BAAM;AAC9B,YAAM,gBAAgB,OAAO,SAAS;AACtC,UAAI,kBAAkB,cAAc,SAAS;AAC3C,sBAAc,UAAU;AACxB,uBAAe,IAAI,gBAAgB,aAAa,CAAC;AAAA,MACnD;AAAA,IACF,GAN0B;AAS1B,sBAAkB;AAGlB,WAAO,iBAAiB,YAAY,iBAAiB;AAMrD,UAAM,WAAW,OAAO,QAAQ;AAChC,UAAM,cAAc,OAAO,QAAQ;AACnC,WAAO,QAAQ,YAAY,YAAa,MAAM;AAC5C,YAAM,SAAS,SAAS,MAAM,MAAM,IAAI;AACxC,wBAAkB;AAClB,aAAO;AAAA,IACT;AACA,WAAO,QAAQ,eAAe,YAAa,MAAM;AAC/C,YAAM,SAAS,YAAY,MAAM,MAAM,IAAI;AAC3C,wBAAkB;AAClB,aAAO;AAAA,IACT;AAEA,WAAO,MAAM;AACX,aAAO,oBAAoB,YAAY,iBAAiB;AACxD,aAAO,QAAQ,YAAY;AAC3B,aAAO,QAAQ,eAAe;AAAA,IAChC;AAAA,EACF,GAAG,CAAC,QAAQ,CAAC;AAEb,SAAO;AACT;AApDgB;;;AC/BhB,SAAS,eAAAC,cAAa,aAAAC,YAAW,UAAAC,SAAQ,YAAAC,iBAAgB;AAIzD,IAAM,kBAAkB,wBAAC,MAAsB;AAC7C,MAAI,KAAK,EAAG,QAAO;AACnB,QAAM,IAAI,KAAK,MAAM,IAAI,EAAE;AAC3B,SAAO,IAAI,IAAI,GAAG,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC;AACjE,GAJwB;AAMxB,IAAM,eAAe,6BAAM;AACzB,QAAM,CAAC,SAAS,UAAU,IAAIC,UAAS,CAAC;AACxC,QAAM,WAAWC,QAA8C,IAAI;AAEnE,QAAM,QAAQC,aAAY,CAAC,SAAiB;AAC1C,QAAI,SAAS,QAAS,eAAc,SAAS,OAAO;AACpD,eAAW,IAAI;AACf,aAAS,UAAU,YAAY,MAAM;AACnC,iBAAW,CAAC,SAAS;AACnB,YAAI,QAAQ,GAAG;AACb,wBAAc,SAAS,OAAQ;AAC/B,mBAAS,UAAU;AACnB,iBAAO;AAAA,QACT;AACA,eAAO,OAAO;AAAA,MAChB,CAAC;AAAA,IACH,GAAG,GAAI;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,EAAAC,WAAU,MAAM,MAAM;AACpB,QAAI,SAAS,QAAS,eAAc,SAAS,OAAO;AAAA,EACtD,GAAG,CAAC,CAAC;AAEL,SAAO,EAAE,SAAS,MAAM;AAC1B,GAxBqB;AAgCd,IAAM,mBAAmB,wBAC9B,oBAAoB,OACO;AAC3B,QAAM,CAAC,YAAY,aAAa,IAAIH,UAAS,iBAAiB;AAC9D,QAAM,CAAC,KAAK,MAAM,IAAIA,UAAS,EAAE;AACjC,QAAM,CAAC,UAAU,WAAW,IAAIA,UAAS,EAAE;AAC3C,QAAM,CAAC,WAAW,YAAY,IAAIA,UAAS,KAAK;AAChD,QAAM,CAAC,eAAe,gBAAgB,IAAIA,UAAS,IAAI;AAGvD,QAAM,CAAC,kBAAkB,mBAAmB,IAAIA,UAAyB,IAAI;AAC7E,QAAM,CAAC,MAAM,OAAO,IAAIA,UAAmB,YAAY;AACvD,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAAS,EAAE;AACrC,QAAM,CAAC,SAAS,UAAU,IAAIA,UAA6B,IAAI;AAE/D,QAAM,YAAY,aAAa;AAC/B,QAAM,SAAS,aAAa;AAE5B,QAAM,aAAaE,aAAY,MAAM,SAAS,EAAE,GAAG,CAAC,CAAC;AAErD,SAAO;AAAA;AAAA,IAEL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,UAAU;AAAA,IAC5B,eAAe,UAAU,UAAU;AAAA,IACnC,gBAAgB,gBAAgB,UAAU,OAAO;AAAA,IACjD,eAAe,OAAO;AAAA,IACtB,aAAa,gBAAgB,OAAO,OAAO;AAAA,IAC3C;AAAA;AAAA,IAEA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,yBAAyB,UAAU;AAAA,IACnC,sBAAsB,OAAO;AAAA,IAC7B;AAAA,EACF;AACF,GAlDgC;;;AC1ChC,SAAS,eAAAE,oBAAmB;AAI5B,IAAM,cAAc;AAEb,IAAM,oBAAoB,6BAA0B;AACzD,QAAMC,sBAAqBC,aAAY,CAAC,OAAwB;AAC9D,WAAO,YAAY,KAAK,EAAE;AAAA,EAC5B,GAAG,CAAC,CAAC;AAEL,SAAO,EAAE,oBAAAD,oBAAmB;AAC9B,GANiC;AAQ1B,IAAM,qBAAqB,wBAAC,OAAwB,YAAY,KAAK,EAAE,GAA5C;;;ACdlC,SAAS,eAAAE,cAAa,aAAAC,YAAW,UAAAC,eAAc;;;ACF/C,SAAS,iBAAAC,sBAAqB;AAoBvB,IAAM,SAASC,eAAc;AAAA,EAClC,OAAO,YAAY;AACrB,CAAC,EAAE,QAAQ,KAAK;AAGhB,iBAAiB,CAAC,UAAU;AAC1B,SAAO,QAAQ;AACjB,CAAC;AAKM,IAAM,aAAa,OAAO,QAAQ,MAAM;;;AC9B/C,SAAS,eAAAC,oBAAmB;AAC5B,SAAS,aAAAC,YAAW,UAAAC,eAAc;;;ACW3B,IAAM,gBAAgB,wBAAC,SAA4C;AACxE,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,gBAAgB,KAAK,QAAQ,uBAAuB,EAAE;AAC5D,QAAM,UAAU,cAAc,QAAQ,QAAQ,EAAE;AAChD,SAAO,WAAW;AACpB,GAL6B;AAWtB,IAAM,oBAAoB,wBAC/B,UACA,iBACY;AACZ,QAAM,aAAa,cAAc,QAAQ;AACzC,SAAO,aAAa;AAAA,IAClB,CAAC,MAAM,eAAe,KAAK,WAAW,WAAW,IAAI,GAAG;AAAA,EAC1D;AACF,GARiC;;;ADA1B,IAAM,cAAc,wBAAC,UAA8B,CAAC,MAAM;AAC/D,QAAM,EAAE,eAAe,aAAa,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI;AACvE,QAAM,cAAc,eAAe;AACnC,QAAM,WAAWC,aAAY;AAC7B,QAAM,SAAS,aAAa;AAI5B,QAAM,gBAAgB,kBAAkB,UAAU,YAAY;AAE9D,QAAM,WAAW,YAAY,IAAI,KAAK,KAAK;AAC3C,QAAM,aAAa,YAAY,IAAI,OAAO,KAAK;AAC/C,QAAM,SAAS,CAAC,CAAC;AACjB,QAAM,UAAU,CAAC,CAAC,YAAY,UAAU;AACxC,QAAM,WAAW,SAAS,WAAW,eAAe;AAKpD,QAAM,mBAAmBC,QAAO,aAAa;AAC7C,mBAAiB,UAAU;AAK3B,EAAAC,WAAU,MAAM;AACd,QAAI,CAAC,WAAW,CAAC,SAAU;AAG3B,eAAW,KAAK,qCAAqC,QAAQ;AAC7D,qBAAiB,UAAU,UAAU,UAAU;AAAA,EACjD,GAAG,CAAC,SAAS,UAAU,UAAU,UAAU,CAAC;AAQ5C,EAAAA,WAAU,MAAM;AACd,QAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAU;AAC1C,UAAM,aAAa,OAAO,YAAY,YAAY,QAAQ,CAAC;AAC3D,WAAO,WAAW;AAClB,WAAO,WAAW;AAClB,UAAM,cAAc,IAAI,gBAAgB,UAAU,EAAE,SAAS;AAC7D,UAAM,eAAe,OAAO,WAAW,cAAc,OAAO,SAAS,WAAW;AAChF,WAAO,QAAQ,cAAc,GAAG,YAAY,IAAI,WAAW,KAAK,YAAY;AAAA,EAE9E,GAAG,CAAC,SAAS,YAAY,QAAQ,CAAC;AAElC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,GAvD2B;;;AEvB3B,SAAS,wBAAAC,6BAA4B;AASrC,IAAI,UAAqC;AACzC,IAAMC,aAAY,oBAAI,IAAgB;AAEtC,IAAM,MAAM,wBAAC,SAA0C;AACrD,YAAU;AACV,aAAW,YAAY,CAAC,GAAGA,UAAS,EAAG,UAAS;AAClD,GAHY;AAKZ,IAAMC,aAAY,wBAAC,aAAuC;AACxD,EAAAD,WAAU,IAAI,QAAQ;AACtB,SAAO,MAAM;AACX,IAAAA,WAAU,OAAO,QAAQ;AAAA,EAC3B;AACF,GALkB;AAQX,IAAM,0BAA0B,wBAAC,cAAwC,IAAI,SAAS,GAAtD;AAGhC,IAAM,wBAAwB,6BAAY,IAAI,IAAI,GAApB;AAG9B,IAAM,wBAAwB,6BACnCE,sBAAqBD,YAAW,MAAM,SAAS,MAAM,IAAI,GADtB;;;AJhB9B,IAAM,cAAc,wBAAC,YAAgD;AAC1E,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,yBAAyB;AAAA,IACzB,kBAAkB;AAAA,IAClB,WAAW;AAAA,EACb,IAAI;AAGJ,QAAM,YAAY,iBAAiB;AACnC,QAAM,aAAa,kBAAkB;AAGrC,QAAM,yBAAyBE,QAAO,KAAK;AAK3C,QAAM,qBAAqBA,QAAsB,IAAI;AAGrD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,QAAQ;AAGZ,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,EAAE,oBAAAC,oBAAmB,IAAI;AAM/B,QAAM,0BAA0BC,aAAY,CAAC,OAAe;AAC1D,cAAU,EAAE;AAAA,EACd,GAAG,CAAC,SAAS,CAAC;AAOd,EAAAC,WAAU,MAAM;AACd,UAAM,aAAa,cAAc;AACjC,QAAI,YAAY;AACd,oBAAc,UAAU;AAAA,IAC1B;AAAA,EAEF,GAAG,CAAC,CAAC;AAML,QAAM,yBAAyBD,aAAY,OAAO,MAAuB;AACvE,MAAE,eAAe;AAEjB,QAAI,CAAC,YAAY;AACf,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb;AAAA,IACF;AAEA,QAAI,CAACD,oBAAmB,UAAU,GAAG;AACnC,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb;AAAA,IACF;AAEA,QAAI,0BAA0B,CAAC,eAAe;AAC5C,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb;AAAA,IACF;AAEA,eAAW;AACX,WAAO,EAAE;AACT,eAAW,IAAI;AAEf,YAAQ,KAAK;AAEb,UAAM,WAAW,wBAAC,QAAgB;AAChC,cAAQ,YAAY;AACpB,eAAS,GAAG;AACZ,gBAAU,GAAG;AAAA,IACf,GAJiB;AAMjB,QAAI;AAEF,YAAM,UAAU,yBACZ,EAAE,kBAAkB,qBAAqB,MAAM,mBAAmB,uBAAuB,kBAAkB,IAC3G;AACJ,YAAM,SAAS,MAAM,WAAW,YAAY,WAAW,OAAO;AAE9D,UAAI,OAAO,SAAS;AAClB,gCAAwB,UAAU;AAClC,mBAAW,OAAO,WAAW,IAAI;AACjC,6BAAqB,OAAO,YAAY,eAAe,uBAAuB;AAC9E,8BAAsB,UAAU;AAAA,MAClC,WAAW,OAAO,YAAY;AAC5B,gBAAQ,YAAY;AACpB,gCAAwB,OAAO,UAAU;AAAA,MAC3C,OAAO;AACL,iBAAS,OAAO,OAAO;AAAA,MACzB;AAAA,IACF,QAAQ;AACN,eAAS,8BAA8B;AAAA,IACzC;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IAAY;AAAA,IAAe;AAAA,IAC3B;AAAA,IAAkB;AAAA,IAClBA;AAAA,IAAoB;AAAA,IAAY;AAAA,IAChC;AAAA,IAAU;AAAA,IAAQ;AAAA,IAAS;AAAA,IAAY;AAAA,IACvC;AAAA,IAAyB;AAAA,IAAsB;AAAA,IAAqB;AAAA,IAAS;AAAA,EAC/E,CAAC;AAGD,QAAM,YAAYC,aAAY,OAC5B,kBACA,cACqB;AACrB,QAAI,CAAC,aAAa,UAAU,SAAS,eAAe,kBAAkB;AACpE,YAAM,MAAM,oBAAoB,eAAe,gBAAgB;AAC/D,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AAEA,iBAAa,IAAI;AACjB,eAAW;AAEX,QAAI;AAEF,YAAM,SAAS,MAAM,UAAU,kBAAkB,WAAW,WAAW,aAAa,IAAI;AAExF,UAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,mBAAW,KAAK,qCAAqC;AACrD,gCAAwB,EAAE,WAAW,OAAO,WAAW,CAAC;AACxD,gCAAwB,gBAAgB;AACxC,eAAO;AAAA,MACT;AAEA,UAAI,OAAO,SAAS;AAClB,gCAAwB,gBAAgB;AAExC,mBAAW,KAAK,qDAAqD;AACrE,gBAAQ,SAAS;AACjB,uBAAe;AACf,eAAO;AAAA,MACT,OAAO;AACL,iBAAS,OAAO,OAAO;AACvB,kBAAU,OAAO,OAAO;AACxB,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AACN,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,WAAW,yBAAyB,UAAU,cAAc,YAAY,cAAc,SAAS,WAAW,aAAa,OAAO,CAAC;AAEnI,QAAM,kBAAkBA,aAAY,OAAO,MAAuB;AAChE,MAAE,eAAe;AACjB,UAAM,UAAU,YAAY,GAAG;AAAA,EACjC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC;AAQ/B,QAAM,iBAAiBA,aAAY,OACjC,kBACA,oBACqB;AACrB,QAAI,CAAC,oBAAoB,CAACD,oBAAmB,gBAAgB,GAAG;AAC9D,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,iBAAiB;AACpB,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AAEA,iBAAa,IAAI;AACjB,eAAW;AAEX,QAAI;AAEF,YAAM,SAAS,MAAM,MAAM,kBAAkB,iBAAiB;AAAA,QAC5D;AAAA,QACA,cAAc;AAAA,MAChB,CAAC;AAED,UAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,mBAAW,KAAK,mCAAmC;AACnD,gCAAwB,EAAE,WAAW,OAAO,WAAW,CAAC;AACxD,gCAAwB,gBAAgB;AACxC,eAAO;AAAA,MACT;AAEA,UAAI,OAAO,SAAS;AAClB,gCAAwB,gBAAgB;AACxC,mBAAW,KAAK,mDAAmD;AACnE,gBAAQ,SAAS;AACjB,uBAAe;AACf,eAAO;AAAA,MACT;AAIA,UAAI,OAAO,YAAY;AACrB,gCAAwB,OAAO,UAAU;AACzC,mBAAW;AAAA,MACb,OAAO;AACL,iBAAS,OAAO,OAAO;AACvB,kBAAU,OAAO,OAAO;AAAA,MAC1B;AACA,aAAO;AAAA,IACT,QAAQ;AACN,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IAAOA;AAAA,IAAoB;AAAA,IAAyB;AAAA,IAAU;AAAA,IAC9D;AAAA,IAAY;AAAA,IAAyB;AAAA,IAAc;AAAA,IAAS;AAAA,IAC5D;AAAA,EACF,CAAC;AAED,QAAM,uBAAuBC,aAAY,OAAO,MAAuB;AACrE,MAAE,eAAe;AACjB,UAAM,eAAe,YAAY,QAAQ;AAAA,EAC3C,GAAG,CAAC,YAAY,UAAU,cAAc,CAAC;AAEzC,QAAM,kBAAkBA,aAAY,YAAY;AAC9C,iBAAa,IAAI;AACjB,eAAW;AAEX,QAAI;AAGF,YAAM,UAAU,yBACZ,EAAE,kBAAkB,qBAAqB,MAAM,mBAAmB,uBAAuB,kBAAkB,IAC3G;AACJ,YAAM,SAAS,MAAM,WAAW,YAAY,WAAW,OAAO;AAE9D,UAAI,OAAO,SAAS;AAClB,gCAAwB,UAAU;AAClC,mBAAW,OAAO,WAAW,IAAI;AACjC,6BAAqB,OAAO,YAAY,eAAe,uBAAuB;AAC9E,eAAO,EAAE;AAAA,MACX,OAAO;AACL,YAAI,OAAO,YAAY;AACrB,kCAAwB,OAAO,UAAU;AACzC,qBAAW;AAAA,QACb,OAAO;AACL,mBAAS,OAAO,OAAO;AACvB,oBAAU,OAAO,OAAO;AAAA,QAC1B;AAAA,MACF;AAAA,IACF,QAAQ;AACN,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AAAA,IACf,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,YAAY,kBAAkB,wBAAwB,YAAY,yBAAyB,QAAQ,UAAU,cAAc,YAAY,yBAAyB,sBAAsB,YAAY,SAAS,SAAS,CAAC;AAEzN,QAAM,yBAAyBA,aAAY,MAAM;AAC/C,YAAQ,YAAY;AACpB,eAAW;AAAA,EACb,GAAG,CAAC,SAAS,UAAU,CAAC;AAExB,QAAM,eAAeA,aAAY,MAAM;AACrC,YAAQ,KAAK;AACb,eAAW;AAAA,EACb,GAAG,CAAC,SAAS,UAAU,CAAC;AAMxB,QAAM,mBAAmBA,aAAY,CAAC,aAAqB,kBAA2B;AAGpF,UAAM,iBAAiB,iBAAiB,cAAc,KAAK;AAE3D,QAAI,CAAC,gBAAgB;AACnB,iBAAW,KAAK,kEAAkE;AAClF;AAAA,IACF;AAKA,UAAM,SAAS,GAAG,cAAc,IAAI,WAAW;AAC/C,QAAI,mBAAmB,YAAY,OAAQ;AAC3C,QAAI,uBAAuB,QAAS;AAEpC,uBAAmB,UAAU;AAC7B,2BAAuB,UAAU;AAEjC,eAAW,KAAK,wCAAwC;AAGxD,kBAAc,cAAc;AAC5B,WAAO,WAAW;AAClB,YAAQ,KAAK;AAGb,eAAW,YAAY;AACrB,UAAI;AACF,cAAM,UAAU,gBAAgB,WAAW;AAAA,MAC7C,UAAE;AACA,+BAAuB,UAAU;AAAA,MACnC;AAAA,IACF,GAAG,GAAG;AAAA,EACR,GAAG,CAAC,eAAe,eAAe,QAAQ,SAAS,SAAS,CAAC;AAE7D,cAAY;AAAA,IACV,cAAc,CAAC,QAAQ;AAAA,IACvB,eAAe;AAAA,IACf,YAAY;AAAA,EACd,CAAC;AAMD,SAAO;AAAA;AAAA,IAEL,GAAG;AAAA;AAAA,IAGH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IAGA,GAAG;AAAA;AAAA,IAGH,yBAAyB;AAAA,EAC3B;AACF,GApY2B;;;AKf3B,SAAS,eAAAE,cAAa,aAAAC,YAAW,UAAAC,SAAQ,YAAAC,iBAAgB;;;ACoBzD,IAAM,wBAAwB,wBAAC,MAAgB,KAAa,UAAyB;AACnF,MAAI,OAAO,UAAU,YAAY,iBAAiB,MAAM;AACtD,SAAK,OAAO,KAAK,KAAK;AAAA,EACxB,WAAW,iBAAiB,MAAM;AAChC,SAAK,OAAO,KAAK,MAAM,YAAY,CAAC;AAAA,EACtC,OAAO;AACL,SAAK,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC;AAAA,EACxC;AACF,GAR8B;AAkBvB,IAAM,yBAAyB;AAAA,EACpC,gBAAgB,wBAAC,SAA4B;AAC3C,UAAM,OAAO,IAAI,SAAS;AAE1B,WAAO,QAAQ,IAA+B,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACxE,UAAI,UAAU,UAAa,UAAU,MAAM;AACzC;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,cAAM,QAAQ,CAAC,MAAM,sBAAsB,MAAM,KAAK,CAAC,CAAC;AAAA,MAC1D,OAAO;AACL,8BAAsB,MAAM,KAAK,KAAK;AAAA,MACxC;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT,GAfgB;AAgBlB;AAEO,IAAM,qBAAqB;AAAA,EAChC,gBAAgB,wBAAC,SACf,KAAK,UAAU,MAAM,CAAC,MAAM,UAAW,OAAO,UAAU,WAAW,MAAM,SAAS,IAAI,KAAM,GAD9E;AAElB;;;AClBA,IAAM,mBAAyC;AAAA,EAC7C,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,SAAS;AACX;AACA,IAAM,gBAAgB,OAAO,QAAQ,gBAAgB;;;AC+B9C,SAAS,gBAAiC;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,GAA2D;AACzD,MAAI;AAEJ,QAAM,QAAQ,eAAe,CAAC,OAAe,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAE7F,QAAM,eAAe,0CAAmB;AACtC,QAAI,aAAqB,wBAAwB;AACjD,QAAI,UAAU;AACd,UAAM,SAAS,QAAQ,UAAU,IAAI,gBAAgB,EAAE;AAEvD,WAAO,MAAM;AACX,UAAI,OAAO,QAAS;AAEpB;AAEA,YAAM,UACJ,QAAQ,mBAAmB,UACvB,QAAQ,UACR,IAAI,QAAQ,QAAQ,OAA6C;AAEvE,UAAI,gBAAgB,QAAW;AAC7B,gBAAQ,IAAI,iBAAiB,WAAW;AAAA,MAC1C;AAEA,UAAI;AACF,cAAM,cAA2B;AAAA,UAC/B,UAAU;AAAA,UACV,GAAG;AAAA,UACH,MAAM,QAAQ;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,YAAI,UAAU,IAAI,QAAQ,KAAK,WAAW;AAC1C,YAAI,WAAW;AACb,oBAAU,MAAM,UAAU,KAAK,WAAW;AAAA,QAC5C;AAGA,cAAM,SAAS,QAAQ,SAAS,WAAW;AAC3C,cAAM,WAAW,MAAM,OAAO,OAAO;AAErC,YAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,eAAe,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAEzF,YAAI,CAAC,SAAS,KAAM,OAAM,IAAI,MAAM,yBAAyB;AAE7D,cAAM,SAAS,SAAS,KAAK,YAAY,IAAI,kBAAkB,CAAC,EAAE,UAAU;AAE5E,YAAI,SAAS;AAEb,cAAM,eAAe,6BAAM;AACzB,cAAI;AACF,mBAAO,OAAO;AAAA,UAChB,QAAQ;AAAA,UAER;AAAA,QACF,GANqB;AAQrB,eAAO,iBAAiB,SAAS,YAAY;AAE7C,YAAI;AACF,iBAAO,MAAM;AACX,kBAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,gBAAI,KAAM;AACV,sBAAU;AACV,qBAAS,OAAO,QAAQ,UAAU,IAAI;AAEtC,kBAAM,SAAS,OAAO,MAAM,MAAM;AAClC,qBAAS,OAAO,IAAI,KAAK;AAEzB,uBAAW,SAAS,QAAQ;AAC1B,oBAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,oBAAM,YAA2B,CAAC;AAClC,kBAAI;AAEJ,yBAAW,QAAQ,OAAO;AACxB,oBAAI,KAAK,WAAW,OAAO,GAAG;AAC5B,4BAAU,KAAK,KAAK,QAAQ,aAAa,EAAE,CAAC;AAAA,gBAC9C,WAAW,KAAK,WAAW,QAAQ,GAAG;AACpC,8BAAY,KAAK,QAAQ,cAAc,EAAE;AAAA,gBAC3C,WAAW,KAAK,WAAW,KAAK,GAAG;AACjC,gCAAc,KAAK,QAAQ,WAAW,EAAE;AAAA,gBAC1C,WAAW,KAAK,WAAW,QAAQ,GAAG;AACpC,wBAAM,SAAS,OAAO,SAAS,KAAK,QAAQ,cAAc,EAAE,GAAG,EAAE;AACjE,sBAAI,CAAC,OAAO,MAAM,MAAM,GAAG;AACzB,iCAAa;AAAA,kBACf;AAAA,gBACF;AAAA,cACF;AAEA,kBAAI;AACJ,kBAAI,aAAa;AAEjB,kBAAI,UAAU,QAAQ;AACpB,sBAAM,UAAU,UAAU,KAAK,IAAI;AACnC,oBAAI;AACF,yBAAO,KAAK,MAAM,OAAO;AACzB,+BAAa;AAAA,gBACf,QAAQ;AACN,yBAAO;AAAA,gBACT;AAAA,cACF;AAEA,kBAAI,YAAY;AACd,oBAAI,mBAAmB;AACrB,wBAAM,kBAAkB,IAAI;AAAA,gBAC9B;AAEA,oBAAI,qBAAqB;AACvB,yBAAO,MAAM,oBAAoB,IAAI;AAAA,gBACvC;AAAA,cACF;AAEA,2BAAa;AAAA,gBACX;AAAA,gBACA,OAAO;AAAA,gBACP,IAAI;AAAA,gBACJ,OAAO;AAAA,cACT,CAAC;AAED,kBAAI,UAAU,QAAQ;AACpB,sBAAM;AAAA,cACR;AAAA,YACF;AAAA,UACF;AAAA,QACF,UAAE;AACA,iBAAO,oBAAoB,SAAS,YAAY;AAChD,iBAAO,YAAY;AAAA,QACrB;AAEA;AAAA,MACF,SAAS,OAAO;AAEd,qBAAa,KAAK;AAElB,YAAI,wBAAwB,UAAa,WAAW,qBAAqB;AACvE;AAAA,QACF;AAGA,cAAM,UAAU,KAAK,IAAI,aAAa,MAAM,UAAU,IAAI,oBAAoB,GAAK;AACnF,cAAM,MAAM,OAAO;AAAA,MACrB;AAAA,IACF;AAAA,EACF,GA1IqB;AA4IrB,QAAM,SAAS,aAAa;AAE5B,SAAO,EAAE,OAAO;AAClB;AAhKgB;;;ACtDT,IAAM,wBAAwB,wBAAC,UAAsD;AAC1F,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF,GAXqC;AAa9B,IAAM,0BAA0B,wBAAC,UAAkD;AACxF,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF,GAXuC;AAahC,IAAM,yBAAyB,wBAAC,UAAuD;AAC5F,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF,GAXsC;AAa/B,IAAM,sBAAsB,wBAAC;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,MAEc;AACZ,MAAI,CAAC,SAAS;AACZ,UAAMC,iBACJ,gBAAgB,QAAQ,MAAM,IAAI,CAAC,MAAM,mBAAmB,CAAW,CAAC,GACxE,KAAK,wBAAwB,KAAK,CAAC;AACrC,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,IAAIA,aAAY;AAAA,MACzB,KAAK;AACH,eAAO,IAAI,IAAI,IAAIA,aAAY;AAAA,MACjC,KAAK;AACH,eAAOA;AAAA,MACT;AACE,eAAO,GAAG,IAAI,IAAIA,aAAY;AAAA,IAClC;AAAA,EACF;AAEA,QAAM,YAAY,sBAAsB,KAAK;AAC7C,QAAM,eAAe,MAClB,IAAI,CAAC,MAAM;AACV,QAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,aAAO,gBAAgB,IAAI,mBAAmB,CAAW;AAAA,IAC3D;AAEA,WAAO,wBAAwB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAAA,EACH,CAAC,EACA,KAAK,SAAS;AACjB,SAAO,UAAU,WAAW,UAAU,WAAW,YAAY,eAAe;AAC9E,GAxCmC;AA0C5B,IAAM,0BAA0B,wBAAC;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF,MAAuC;AACrC,MAAI,UAAU,UAAa,UAAU,MAAM;AACzC,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,GAAG,IAAI,IAAI,gBAAgB,QAAQ,mBAAmB,KAAK,CAAC;AACrE,GAhBuC;AAkBhC,IAAM,uBAAuB,wBAAC;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,MAGc;AACZ,MAAI,iBAAiB,MAAM;AACzB,WAAO,YAAY,MAAM,YAAY,IAAI,GAAG,IAAI,IAAI,MAAM,YAAY,CAAC;AAAA,EACzE;AAEA,MAAI,UAAU,gBAAgB,CAAC,SAAS;AACtC,QAAI,SAAmB,CAAC;AACxB,WAAO,QAAQ,KAAK,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM;AAC1C,eAAS,CAAC,GAAG,QAAQ,KAAK,gBAAiB,IAAe,mBAAmB,CAAW,CAAC;AAAA,IAC3F,CAAC;AACD,UAAMA,gBAAe,OAAO,KAAK,GAAG;AACpC,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,GAAG,IAAI,IAAIA,aAAY;AAAA,MAChC,KAAK;AACH,eAAO,IAAIA,aAAY;AAAA,MACzB,KAAK;AACH,eAAO,IAAI,IAAI,IAAIA,aAAY;AAAA,MACjC;AACE,eAAOA;AAAA,IACX;AAAA,EACF;AAEA,QAAM,YAAY,uBAAuB,KAAK;AAC9C,QAAM,eAAe,OAAO,QAAQ,KAAK,EACtC;AAAA,IAAI,CAAC,CAAC,KAAK,CAAC,MACX,wBAAwB;AAAA,MACtB;AAAA,MACA,MAAM,UAAU,eAAe,GAAG,IAAI,IAAI,GAAG,MAAM;AAAA,MACnD,OAAO;AAAA,IACT,CAAC;AAAA,EACH,EACC,KAAK,SAAS;AACjB,SAAO,UAAU,WAAW,UAAU,WAAW,YAAY,eAAe;AAC9E,GA5CoC;;;AC/G7B,IAAM,gBAAwB;AAE9B,IAAM,wBAAwB,wBAAC,EAAE,MAAM,KAAK,KAAK,MAA8B;AACpF,MAAI,MAAM;AACV,QAAM,UAAU,KAAK,MAAM,aAAa;AACxC,MAAI,SAAS;AACX,eAAW,SAAS,SAAS;AAC3B,UAAI,UAAU;AACd,UAAI,OAAO,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC;AAC9C,UAAI,QAA6B;AAEjC,UAAI,KAAK,SAAS,GAAG,GAAG;AACtB,kBAAU;AACV,eAAO,KAAK,UAAU,GAAG,KAAK,SAAS,CAAC;AAAA,MAC1C;AAEA,UAAI,KAAK,WAAW,GAAG,GAAG;AACxB,eAAO,KAAK,UAAU,CAAC;AACvB,gBAAQ;AAAA,MACV,WAAW,KAAK,WAAW,GAAG,GAAG;AAC/B,eAAO,KAAK,UAAU,CAAC;AACvB,gBAAQ;AAAA,MACV;AAEA,YAAM,QAAQ,KAAK,IAAI;AAEvB,UAAI,UAAU,UAAa,UAAU,MAAM;AACzC;AAAA,MACF;AAEA,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,cAAM,IAAI,QAAQ,OAAO,oBAAoB,EAAE,SAAS,MAAM,OAAO,MAAM,CAAC,CAAC;AAC7E;AAAA,MACF;AAEA,UAAI,OAAO,UAAU,UAAU;AAC7B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,qBAAqB;AAAA,YACnB;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA;AAAA,MACF;AAEA,UAAI,UAAU,UAAU;AACtB,cAAM,IAAI;AAAA,UACR;AAAA,UACA,IAAI,wBAAwB;AAAA,YAC1B;AAAA,YACA;AAAA,UACF,CAAC,CAAC;AAAA,QACJ;AACA;AAAA,MACF;AAEA,YAAM,eAAe;AAAA,QACnB,UAAU,UAAU,IAAI,KAAe,KAAM;AAAA,MAC/C;AACA,YAAM,IAAI,QAAQ,OAAO,YAAY;AAAA,IACvC;AAAA,EACF;AACA,SAAO;AACT,GAjEqC;AAmE9B,IAAM,SAAS,wBAAC;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,KAAK;AACP,MAMc;AACZ,QAAM,UAAU,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AACtD,MAAI,OAAO,WAAW,MAAM;AAC5B,MAAI,MAAM;AACR,UAAM,sBAAsB,EAAE,MAAM,IAAI,CAAC;AAAA,EAC3C;AACA,MAAI,SAAS,QAAQ,gBAAgB,KAAK,IAAI;AAC9C,MAAI,OAAO,WAAW,GAAG,GAAG;AAC1B,aAAS,OAAO,UAAU,CAAC;AAAA,EAC7B;AACA,MAAI,QAAQ;AACV,WAAO,IAAI,MAAM;AAAA,EACnB;AACA,SAAO;AACT,GA1BsB;AA4Bf,SAAS,oBAAoB,SAIxB;AACV,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,mBAAmB,WAAW,QAAQ;AAE5C,MAAI,kBAAkB;AACpB,QAAI,oBAAoB,SAAS;AAC/B,YAAM,oBACJ,QAAQ,mBAAmB,UAAa,QAAQ,mBAAmB;AAErE,aAAO,oBAAoB,QAAQ,iBAAiB;AAAA,IACtD;AAGA,WAAO,QAAQ,SAAS,KAAK,QAAQ,OAAO;AAAA,EAC9C;AAGA,MAAI,SAAS;AACX,WAAO,QAAQ;AAAA,EACjB;AAGA,SAAO;AACT;AA3BgB;;;ACpFT,IAAM,eAAe,8BAC1BC,OACA,aACgC;AAChC,QAAM,QAAQ,OAAO,aAAa,aAAa,MAAM,SAASA,KAAI,IAAI;AAEtE,MAAI,CAAC,OAAO;AACV;AAAA,EACF;AAEA,MAAIA,MAAK,WAAW,UAAU;AAC5B,WAAO,UAAU,KAAK;AAAA,EACxB;AAEA,MAAIA,MAAK,WAAW,SAAS;AAC3B,WAAO,SAAS,KAAK,KAAK,CAAC;AAAA,EAC7B;AAEA,SAAO;AACT,GAnB4B;;;ACfrB,IAAM,wBAAwB,wBAAc;AAAA,EACjD,aAAa,CAAC;AAAA,EACd,GAAG;AACL,IAA4B,CAAC,MAAoC;AAC/D,QAAM,kBAAkB,wBAAC,gBAA2B;AAClD,UAAM,SAAmB,CAAC;AAC1B,QAAI,eAAe,OAAO,gBAAgB,UAAU;AAClD,iBAAW,QAAQ,aAAa;AAC9B,cAAM,QAAQ,YAAY,IAAI;AAE9B,YAAI,UAAU,UAAa,UAAU,MAAM;AACzC;AAAA,QACF;AAEA,cAAM,UAAU,WAAW,IAAI,KAAK;AAEpC,YAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,gBAAM,kBAAkB,oBAAoB;AAAA,YAC1C,eAAe,QAAQ;AAAA,YACvB,SAAS;AAAA,YACT;AAAA,YACA,OAAO;AAAA,YACP;AAAA,YACA,GAAG,QAAQ;AAAA,UACb,CAAC;AACD,cAAI,gBAAiB,QAAO,KAAK,eAAe;AAAA,QAClD,WAAW,OAAO,UAAU,UAAU;AACpC,gBAAM,mBAAmB,qBAAqB;AAAA,YAC5C,eAAe,QAAQ;AAAA,YACvB,SAAS;AAAA,YACT;AAAA,YACA,OAAO;AAAA,YACP;AAAA,YACA,GAAG,QAAQ;AAAA,UACb,CAAC;AACD,cAAI,iBAAkB,QAAO,KAAK,gBAAgB;AAAA,QACpD,OAAO;AACL,gBAAM,sBAAsB,wBAAwB;AAAA,YAClD,eAAe,QAAQ;AAAA,YACvB;AAAA,YACA;AAAA,UACF,CAAC;AACD,cAAI,oBAAqB,QAAO,KAAK,mBAAmB;AAAA,QAC1D;AAAA,MACF;AAAA,IACF;AACA,WAAO,OAAO,KAAK,GAAG;AAAA,EACxB,GA3CwB;AA4CxB,SAAO;AACT,GAjDqC;AAsD9B,IAAM,aAAa,wBAAC,gBAAmE;AAC5F,MAAI,CAAC,aAAa;AAGhB,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,YAAY,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAErD,MAAI,CAAC,cAAc;AACjB;AAAA,EACF;AAEA,MAAI,aAAa,WAAW,kBAAkB,KAAK,aAAa,SAAS,OAAO,GAAG;AACjF,WAAO;AAAA,EACT;AAEA,MAAI,iBAAiB,uBAAuB;AAC1C,WAAO;AAAA,EACT;AAEA,MACE,CAAC,gBAAgB,UAAU,UAAU,QAAQ,EAAE,KAAK,CAAC,SAAS,aAAa,WAAW,IAAI,CAAC,GAC3F;AACA,WAAO;AAAA,EACT;AAEA,MAAI,aAAa,WAAW,OAAO,GAAG;AACpC,WAAO;AAAA,EACT;AAEA;AACF,GAhC0B;AAkC1B,IAAM,oBAAoB,wBACxB,SAGA,SACY;AACZ,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,MACE,QAAQ,QAAQ,IAAI,IAAI,KACxB,QAAQ,QAAQ,IAAI,KACpB,QAAQ,QAAQ,IAAI,QAAQ,GAAG,SAAS,GAAG,IAAI,GAAG,GAClD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT,GAjB0B;AAmB1B,eAAsB,cACpB,SAGe;AACf,aAAWC,SAAQ,QAAQ,YAAY,CAAC,GAAG;AACzC,QAAI,kBAAkB,SAASA,MAAK,IAAI,GAAG;AACzC;AAAA,IACF;AAEA,UAAM,QAAQ,MAAM,aAAaA,OAAM,QAAQ,IAAI;AAEnD,QAAI,CAAC,OAAO;AACV;AAAA,IACF;AAEA,UAAM,OAAOA,MAAK,QAAQ;AAE1B,YAAQA,MAAK,IAAI;AAAA,MACf,KAAK;AACH,YAAI,CAAC,QAAQ,OAAO;AAClB,kBAAQ,QAAQ,CAAC;AAAA,QACnB;AACA,gBAAQ,MAAM,IAAI,IAAI;AACtB;AAAA,MACF,KAAK;AACH,gBAAQ,QAAQ,OAAO,UAAU,GAAG,IAAI,IAAI,KAAK,EAAE;AACnD;AAAA,MACF,KAAK;AAAA,MACL;AACE,gBAAQ,QAAQ,IAAI,MAAM,KAAK;AAC/B;AAAA,IACJ;AAAA,EACF;AACF;AAlCsB;AAoCf,IAAM,WAA+B,wBAAC,YAC3C,OAAO;AAAA,EACL,SAAS,QAAQ;AAAA,EACjB,MAAM,QAAQ;AAAA,EACd,OAAO,QAAQ;AAAA,EACf,iBACE,OAAO,QAAQ,oBAAoB,aAC/B,QAAQ,kBACR,sBAAsB,QAAQ,eAAe;AAAA,EACnD,KAAK,QAAQ;AACf,CAAC,GAVyC;AAYrC,IAAM,eAAe,wBAAC,GAAW,MAAsB;AAC5D,QAAM,SAAS,EAAE,GAAG,GAAG,GAAG,EAAE;AAC5B,MAAI,OAAO,SAAS,SAAS,GAAG,GAAG;AACjC,WAAO,UAAU,OAAO,QAAQ,UAAU,GAAG,OAAO,QAAQ,SAAS,CAAC;AAAA,EACxE;AACA,SAAO,UAAU,aAAa,EAAE,SAAS,EAAE,OAAO;AAClD,SAAO;AACT,GAP4B;AAS5B,IAAM,iBAAiB,wBAAC,YAA8C;AACpE,QAAM,UAAmC,CAAC;AAC1C,UAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC9B,YAAQ,KAAK,CAAC,KAAK,KAAK,CAAC;AAAA,EAC3B,CAAC;AACD,SAAO;AACT,GANuB;AAQhB,IAAM,eAAe,2BACvB,YACS;AACZ,QAAM,gBAAgB,IAAI,QAAQ;AAClC,aAAW,UAAU,SAAS;AAC5B,QAAI,CAAC,QAAQ;AACX;AAAA,IACF;AAEA,UAAM,WAAW,kBAAkB,UAAU,eAAe,MAAM,IAAI,OAAO,QAAQ,MAAM;AAE3F,eAAW,CAAC,KAAK,KAAK,KAAK,UAAU;AACnC,UAAI,UAAU,MAAM;AAClB,sBAAc,OAAO,GAAG;AAAA,MAC1B,WAAW,MAAM,QAAQ,KAAK,GAAG;AAC/B,mBAAW,KAAK,OAAO;AACrB,wBAAc,OAAO,KAAK,CAAW;AAAA,QACvC;AAAA,MACF,WAAW,UAAU,QAAW;AAG9B,sBAAc;AAAA,UACZ;AAAA,UACA,OAAO,UAAU,WAAW,KAAK,UAAU,KAAK,IAAK;AAAA,QACvD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT,GA7B4B;AAgD5B,IAAM,eAAN,MAAgC;AAAA,EAzOhC,OAyOgC;AAAA;AAAA;AAAA,EAC9B,MAAiC,CAAC;AAAA,EAElC,QAAc;AACZ,SAAK,MAAM,CAAC;AAAA,EACd;AAAA,EAEA,MAAM,IAAgC;AACpC,UAAM,QAAQ,KAAK,oBAAoB,EAAE;AACzC,QAAI,KAAK,IAAI,KAAK,GAAG;AACnB,WAAK,IAAI,KAAK,IAAI;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,OAAO,IAAmC;AACxC,UAAM,QAAQ,KAAK,oBAAoB,EAAE;AACzC,WAAO,QAAQ,KAAK,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEA,oBAAoB,IAAkC;AACpD,QAAI,OAAO,OAAO,UAAU;AAC1B,aAAO,KAAK,IAAI,EAAE,IAAI,KAAK;AAAA,IAC7B;AACA,WAAO,KAAK,IAAI,QAAQ,EAAE;AAAA,EAC5B;AAAA,EAEA,OAAO,IAA0B,IAA+C;AAC9E,UAAM,QAAQ,KAAK,oBAAoB,EAAE;AACzC,QAAI,KAAK,IAAI,KAAK,GAAG;AACnB,WAAK,IAAI,KAAK,IAAI;AAClB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,IAAyB;AAC3B,SAAK,IAAI,KAAK,EAAE;AAChB,WAAO,KAAK,IAAI,SAAS;AAAA,EAC3B;AACF;AAQO,IAAM,qBAAqB,8BAK5B;AAAA,EACJ,OAAO,IAAI,aAAqD;AAAA,EAChE,SAAS,IAAI,aAA2C;AAAA,EACxD,UAAU,IAAI,aAAgD;AAChE,IATkC;AAWlC,IAAM,yBAAyB,sBAAsB;AAAA,EACnD,eAAe;AAAA,EACf,OAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AACF,CAAC;AAED,IAAM,iBAAiB;AAAA,EACrB,gBAAgB;AAClB;AAEO,IAAM,eAAe,wBAC1B,WAAqD,CAAC,OACR;AAAA,EAC9C,GAAG;AAAA,EACH,SAAS;AAAA,EACT,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,GAAG;AACL,IAR4B;;;AC9RrB,IAAM,eAAe,wBAAC,SAAiB,CAAC,MAAc;AAC3D,MAAI,UAAU,aAAa,aAAa,GAAG,MAAM;AAEjD,QAAM,YAAY,8BAAe,EAAE,GAAG,QAAQ,IAA5B;AAElB,QAAM,YAAY,wBAACC,YAA2B;AAC5C,cAAU,aAAa,SAASA,OAAM;AACtC,WAAO,UAAU;AAAA,EACnB,GAHkB;AAKlB,QAAM,eAAe,mBAAuE;AAE5F,QAAM,gBAAgB,8BAMpB,YACG;AACH,UAAM,OAAO;AAAA,MACX,GAAG;AAAA,MACH,GAAG;AAAA,MACH,OAAO,QAAQ,SAAS,QAAQ,SAAS,WAAW;AAAA,MACpD,SAAS,aAAa,QAAQ,SAAS,QAAQ,OAAO;AAAA,MACtD,gBAAgB;AAAA,IAClB;AAEA,QAAI,KAAK,UAAU;AACjB,YAAM,cAAc,IAAI;AAAA,IAC1B;AAEA,QAAI,KAAK,kBAAkB;AACzB,YAAM,KAAK,iBAAiB,IAAI;AAAA,IAClC;AAEA,QAAI,KAAK,SAAS,UAAa,KAAK,gBAAgB;AAClD,WAAK,iBAAiB,KAAK,eAAe,KAAK,IAAI;AAAA,IACrD;AAGA,QAAI,KAAK,SAAS,UAAa,KAAK,mBAAmB,IAAI;AACzD,WAAK,QAAQ,OAAO,cAAc;AAAA,IACpC;AAEA,UAAM,eAAe;AAErB,UAAM,MAAM,SAAS,YAAY;AAEjC,WAAO,EAAE,MAAM,cAAc,IAAI;AAAA,EACnC,GAtCsB;AAwCtB,QAAM,UAA6B,8BAAO,YAAY;AACpD,UAAM,eAAe,QAAQ,gBAAgB,QAAQ;AACrD,UAAM,gBAAgB,QAAQ,iBAAiB,QAAQ;AAEvD,QAAIC;AACJ,QAAI;AAEJ,QAAI;AACF,YAAM,EAAE,MAAM,IAAI,IAAI,MAAM,cAAc,OAAO;AACjD,YAAM,cAAuB;AAAA,QAC3B,UAAU;AAAA,QACV,GAAG;AAAA,QACH,MAAM,oBAAoB,IAAI;AAAA,MAChC;AAEA,MAAAA,WAAU,IAAI,QAAQ,KAAK,WAAW;AAEtC,iBAAW,MAAM,aAAa,QAAQ,KAAK;AACzC,YAAI,IAAI;AACN,UAAAA,WAAU,MAAM,GAAGA,UAAS,IAAI;AAAA,QAClC;AAAA,MACF;AAIA,YAAM,SAAS,KAAK;AAEpB,iBAAW,MAAM,OAAOA,QAAO;AAE/B,iBAAW,MAAM,aAAa,SAAS,KAAK;AAC1C,YAAI,IAAI;AACN,qBAAW,MAAM,GAAG,UAAUA,UAAS,IAAI;AAAA,QAC7C;AAAA,MACF;AAEA,YAAM,SAAS;AAAA,QACb,SAAAA;AAAA,QACA;AAAA,MACF;AAEA,UAAI,SAAS,IAAI;AACf,cAAM,WACH,KAAK,YAAY,SACd,WAAW,SAAS,QAAQ,IAAI,cAAc,CAAC,IAC/C,KAAK,YAAY;AAEvB,YAAI,SAAS,WAAW,OAAO,SAAS,QAAQ,IAAI,gBAAgB,MAAM,KAAK;AAC7E,cAAI;AACJ,kBAAQ,SAAS;AAAA,YACf,KAAK;AAAA,YACL,KAAK;AAAA,YACL,KAAK;AACH,0BAAY,MAAM,SAAS,OAAO,EAAE;AACpC;AAAA,YACF,KAAK;AACH,0BAAY,IAAI,SAAS;AACzB;AAAA,YACF,KAAK;AACH,0BAAY,SAAS;AACrB;AAAA,YACF,KAAK;AAAA,YACL;AACE,0BAAY,CAAC;AACb;AAAA,UACJ;AACA,iBAAO,KAAK,kBAAkB,SAC1B,YACA;AAAA,YACE,MAAM;AAAA,YACN,GAAG;AAAA,UACL;AAAA,QACN;AAEA,YAAI;AACJ,gBAAQ,SAAS;AAAA,UACf,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK;AACH,mBAAO,MAAM,SAAS,OAAO,EAAE;AAC/B;AAAA,UACF,KAAK,QAAQ;AAGX,kBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,mBAAO,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAClC;AAAA,UACF;AAAA,UACA,KAAK;AACH,mBAAO,KAAK,kBAAkB,SAC1B,SAAS,OACT;AAAA,cACE,MAAM,SAAS;AAAA,cACf,GAAG;AAAA,YACL;AAAA,QACR;AAEA,YAAI,YAAY,QAAQ;AACtB,cAAI,KAAK,mBAAmB;AAC1B,kBAAM,KAAK,kBAAkB,IAAI;AAAA,UACnC;AAEA,cAAI,KAAK,qBAAqB;AAC5B,mBAAO,MAAM,KAAK,oBAAoB,IAAI;AAAA,UAC5C;AAAA,QACF;AAEA,eAAO,KAAK,kBAAkB,SAC1B,OACA;AAAA,UACE;AAAA,UACA,GAAG;AAAA,QACL;AAAA,MACN;AAEA,YAAM,YAAY,MAAM,SAAS,KAAK;AACtC,UAAI;AAEJ,UAAI;AACF,oBAAY,KAAK,MAAM,SAAS;AAAA,MAClC,QAAQ;AAAA,MAER;AAEA,YAAM,aAAa;AAAA,IACrB,SAAS,OAAO;AACd,UAAI,aAAa;AAEjB,iBAAW,MAAM,aAAa,MAAM,KAAK;AACvC,YAAI,IAAI;AACN,uBAAa,MAAM,GAAG,YAAY,UAAUA,UAAS,OAAiC;AAAA,QACxF;AAAA,MACF;AAEA,mBAAa,cAAc,CAAC;AAE5B,UAAI,cAAc;AAChB,cAAM;AAAA,MACR;AAGA,aAAO,kBAAkB,SACrB,SACA;AAAA,QACE,OAAO;AAAA,QACP,SAAAA;AAAA,QACA;AAAA,MACF;AAAA,IACN;AAAA,EACF,GArJmC;AAuJnC,QAAM,eAAe,wBAAC,WAAkC,CAAC,YACvD,QAAQ,EAAE,GAAG,SAAS,OAAO,CAAC,GADX;AAGrB,QAAM,YAAY,wBAAC,WAAkC,OAAO,YAA4B;AACtF,UAAM,EAAE,MAAM,IAAI,IAAI,MAAM,cAAc,OAAO;AACjD,WAAO,gBAAgB;AAAA,MACrB,GAAG;AAAA,MACH,MAAM,KAAK;AAAA,MACX;AAAA,MACA,WAAW,8BAAOC,MAAK,SAAS;AAC9B,YAAID,WAAU,IAAI,QAAQC,MAAK,IAAI;AACnC,mBAAW,MAAM,aAAa,QAAQ,KAAK;AACzC,cAAI,IAAI;AACN,YAAAD,WAAU,MAAM,GAAGA,UAAS,IAAI;AAAA,UAClC;AAAA,QACF;AACA,eAAOA;AAAA,MACT,GARW;AAAA,MASX,gBAAgB,oBAAoB,IAAI;AAAA,MACxC;AAAA,IACF,CAAC;AAAA,EACH,GAlBkB;AAoBlB,QAAM,YAAgC,wBAAC,YAAY,SAAS,EAAE,GAAG,SAAS,GAAG,QAAQ,CAAC,GAAhD;AAEtC,SAAO;AAAA,IACL,UAAU;AAAA,IACV,SAAS,aAAa,SAAS;AAAA,IAC/B,QAAQ,aAAa,QAAQ;AAAA,IAC7B,KAAK,aAAa,KAAK;AAAA,IACvB;AAAA,IACA,MAAM,aAAa,MAAM;AAAA,IACzB;AAAA,IACA,SAAS,aAAa,SAAS;AAAA,IAC/B,OAAO,aAAa,OAAO;AAAA,IAC3B,MAAM,aAAa,MAAM;AAAA,IACzB,KAAK,aAAa,KAAK;AAAA,IACvB;AAAA,IACA;AAAA,IACA,KAAK;AAAA,MACH,SAAS,UAAU,SAAS;AAAA,MAC5B,QAAQ,UAAU,QAAQ;AAAA,MAC1B,KAAK,UAAU,KAAK;AAAA,MACpB,MAAM,UAAU,MAAM;AAAA,MACtB,SAAS,UAAU,SAAS;AAAA,MAC5B,OAAO,UAAU,OAAO;AAAA,MACxB,MAAM,UAAU,MAAM;AAAA,MACtB,KAAK,UAAU,KAAK;AAAA,MACpB,OAAO,UAAU,OAAO;AAAA,IAC1B;AAAA,IACA,OAAO,aAAa,OAAO;AAAA,EAC7B;AACF,GA/P4B;;;ACNrB,IAAM,SAAiB,aAAa,aAA6B,EAAE,SAAS,wBAAwB,CAAC,CAAC;AAI7G,oBAAoB,MAAM;;;ACmGnB,IAAM,mBAAN,MAAuB;AAAA,EAtH9B,OAsH8B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1B,OAAc,gCAAsE,SAAsJ;AACtO,YAAQ,SAAS,UAAU,QAAQ,IAAqE;AAAA,MACpG,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,IACP,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,iCAAuE,SAAsL;AACvQ,YAAQ,QAAQ,UAAU,QAAQ,KAAsG;AAAA,MACpI,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,sCAA4E,SAAsM;AAC5R,YAAQ,SAAS,UAAU,QAAQ,KAAgH;AAAA,MAC/I,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,qCAA2E,SAAkM;AACvR,YAAQ,QAAQ,UAAU,QAAQ,KAA8G;AAAA,MAC5I,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,sCAA4E,SAAsM;AAC5R,YAAQ,SAAS,UAAU,QAAQ,KAAgH;AAAA,MAC/I,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,qCAA2E,SAAkM;AACvR,YAAQ,QAAQ,UAAU,QAAQ,KAA8G;AAAA,MAC5I,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,kCAAwE,SAA0J;AAC5O,YAAQ,SAAS,UAAU,QAAQ,IAAuE,EAAE,KAAK,kCAAkC,GAAG,QAAQ,CAAC;AAAA,EACnK;AACJ;AAEO,IAAM,iBAAN,MAAqB;AAAA,EAvO5B,OAuO4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQxB,OAAc,oCAA0E,SAA8J;AAClP,YAAQ,SAAS,UAAU,QAAQ,IAAyE;AAAA,MACxG,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,IACP,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,OAAc,4BAAkE,SAAuK;AACnP,YAAQ,QAAQ,UAAU,QAAQ,KAA4F;AAAA,MAC1H,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,OAAc,2BAAiE,SAAoK;AAC/O,YAAQ,QAAQ,UAAU,QAAQ,KAA0F;AAAA,MACxH,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;AAEO,IAAM,qBAAN,MAAyB;AAAA,EAzShC,OAySgC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5B,OAAc,2BAAiE,SAAqK;AAChP,YAAQ,SAAS,UAAU,QAAQ,IAAyF;AAAA,MACxH,UAAU,CAAC,EAAE,QAAQ,UAAU,MAAM,OAAO,GAAG;AAAA,QACvC,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,MACV,CAAC;AAAA,MACL,KAAK;AAAA,MACL,GAAG;AAAA,IACP,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,+BAAqE,SAAiL;AAChQ,YAAQ,SAAS,UAAU,QAAQ,KAAkG;AAAA,MACjI,GAAG;AAAA,MACH,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,OAAc,+BAAqE,SAAiL;AAChQ,YAAQ,SAAS,UAAU,QAAQ,KAAkG;AAAA,MACjI,UAAU,CAAC,EAAE,QAAQ,UAAU,MAAM,OAAO,GAAG;AAAA,QACvC,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,MACV,CAAC;AAAA,MACL,KAAK;AAAA,MACL,GAAG;AAAA,IACP,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,uCAA6E,SAAyM;AAChS,YAAQ,SAAS,UAAU,QAAQ,MAAmH;AAAA,MAClJ,UAAU,CAAC,EAAE,QAAQ,UAAU,MAAM,OAAO,GAAG;AAAA,QACvC,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,MACV,CAAC;AAAA,MACL,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,gCAAsE,SAAoL;AACpQ,YAAQ,SAAS,UAAU,QAAQ,IAAmG;AAAA,MAClI,UAAU,CAAC,EAAE,QAAQ,UAAU,MAAM,OAAO,GAAG;AAAA,QACvC,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,MACV,CAAC;AAAA,MACL,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,sCAA4E,SAAsM;AAC5R,YAAQ,SAAS,UAAU,QAAQ,MAAiH;AAAA,MAChJ,UAAU,CAAC,EAAE,QAAQ,UAAU,MAAM,OAAO,GAAG;AAAA,QACvC,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,MACV,CAAC;AAAA,MACL,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,+BAAqE,SAAiL;AAChQ,YAAQ,SAAS,UAAU,QAAQ,IAAiG;AAAA,MAChI,UAAU,CAAC,EAAE,QAAQ,UAAU,MAAM,OAAO,GAAG;AAAA,QACvC,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,MACV,CAAC;AAAA,MACL,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;AAEO,IAAM,kBAAN,MAAsB;AAAA,EAjc7B,OAic6B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASzB,OAAc,uBAA6D,SAAwJ;AAC/N,YAAQ,QAAQ,UAAU,QAAQ,KAAkF;AAAA,MAChH,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAc,gCAAsE,SAAqJ;AACrO,YAAQ,QAAQ,UAAU,QAAQ,KAAsE;AAAA,MACpG,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAc,8BAAoE,SAAiJ;AAC/N,YAAQ,QAAQ,UAAU,QAAQ,KAAoE;AAAA,MAClG,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;AAyCO,IAAM,UAAN,MAAc;AAAA,EAniBrB,OAmiBqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAIjB,OAAc,uBAA6D,SAAoI;AAC3M,YAAQ,SAAS,UAAU,QAAQ,IAA4D;AAAA,MAC3F,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,IACP,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,sBAA4D,SAAiI;AACvM,YAAQ,QAAQ,UAAU,QAAQ,OAA8D;AAAA,MAC5F,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,IACP,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,qBAA2D,SAAkJ;AACvN,YAAQ,QAAQ,UAAU,QAAQ,KAA8E;AAAA,MAC5G,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;AAEO,IAAM,eAAN,MAAmB;AAAA,EA1lB1B,OA0lB0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtB,OAAc,mBAAyD,SAA6I;AAChN,YAAQ,SAAS,UAAU,QAAQ,KAA0E;AAAA,MACzG,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,0BAAgE,SAAiK;AAC3O,YAAQ,QAAQ,UAAU,QAAQ,KAAwF;AAAA,MACtH,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;AAEO,IAAM,gBAAN,MAAoB;AAAA,EAtoB3B,OAsoB2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvB,OAAc,oBAA0D,SAA+I;AACnN,YAAQ,QAAQ,UAAU,QAAQ,KAA4E;AAAA,MAC1G,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,0BAAgE,SAAiK;AAC3O,YAAQ,QAAQ,UAAU,QAAQ,KAAwF;AAAA,MACtH,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;;;AC/pBO,IAAK,iBAAL,kBAAKE,oBAAL;AACL,EAAAA,gBAAA,sBAAmB;AACnB,EAAAA,gBAAA,wBAAqB;AACrB,EAAAA,gBAAA,0BAAuB;AACvB,EAAAA,gBAAA,8BAA2B;AAC3B,EAAAA,gBAAA,0BAAuB;AACvB,EAAAA,gBAAA,wBAAqB;AACrB,EAAAA,gBAAA,6BAA0B;AAC1B,EAAAA,gBAAA,iBAAc;AACd,EAAAA,gBAAA,sBAAmB;AACnB,EAAAA,gBAAA,qBAAkB;AAVR,SAAAA;AAAA,GAAA;AAaL,IAAK,oBAAL,kBAAKC,uBAAL;AACL,EAAAA,mBAAA,UAAO;AADG,SAAAA;AAAA,GAAA;AAwCZ,IAAI,OAA6B;AAQ1B,SAAS,iBAAiB,MAAkC;AACjE,SAAO;AACT;AAFgB;AAIT,IAAM,YAAY;AAAA;AAAA,EAEvB,MAAM,WAA+B,QAA+B;AAClE,QAAI,MAAM;AACR,WAAK,MAAM,WAAW,MAAM;AAC5B;AAAA,IACF;AAGA,QAAI,OAAO;AACT,cAAQ,IAAI,uBAAuB,WAAW,MAAM;AAAA,IACtD;AAAA,EACF;AAAA;AAAA,EAGA,QAAQ,QAAuB;AAC7B,QAAI,MAAM;AACR,WAAK,QAAQ,MAAM;AACnB;AAAA,IACF;AACA,QAAI,OAAO;AACT,cAAQ,IAAI,iCAAiC,MAAM;AAAA,IACrD;AAAA,EACF;AACF;;;AC4TO,IAAK,qBAAL,kBAAKC,wBAAL;AACH,EAAAA,oBAAA,oBAAiB;AACjB,EAAAA,oBAAA,2BAAwB;AACxB,EAAAA,oBAAA,wBAAqB;AACrB,EAAAA,oBAAA,0BAAuB;AACvB,EAAAA,oBAAA,mBAAgB;AAChB,EAAAA,oBAAA,2BAAwB;AACxB,EAAAA,oBAAA,sBAAmB;AACnB,EAAAA,oBAAA,mBAAgB;AAChB,EAAAA,oBAAA,wBAAqB;AACrB,EAAAA,oBAAA,+BAA4B;AAC5B,EAAAA,oBAAA,sBAAmB;AACnB,EAAAA,oBAAA,sBAAmB;AACnB,EAAAA,oBAAA,kBAAe;AACf,EAAAA,oBAAA,0BAAuB;AACvB,EAAAA,oBAAA,kBAAe;AACf,EAAAA,oBAAA,eAAY;AAhBJ,SAAAA;AAAA,GAAA;;;ACraZ,IAAM,OAAO,wBAAC,OAAgB,QAC5B,OAAO,UAAU,YAAY,UAAU,OAClC,MAAkC,GAAG,IACtC,QAHO;AAab,IAAM,qBAAqB;AAepB,IAAM,kBAAkB;AAAA,EAC7B,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,cAAc;AAAA,EACd,SAAS;AACX;AAQA,IAAM,gBAA8C;AAAA,EAClD,CAAC,gBAAgB,kBAAkB,GAAG;AAAA,EACtC,CAAC,gBAAgB,WAAW,GAAG;AAAA,EAC/B,CAAC,gBAAgB,iBAAiB,GAAG;AAAA,EACrC,CAAC,gBAAgB,YAAY,GAAG;AAAA,EAChC,CAAC,gBAAgB,OAAO,GAAG;AAC7B;AAGA,IAAM,eAAe,wBAAC,WAA6C;AACjE,MAAI,WAAW,OAAW,QAAO,gBAAgB;AAGjD,MAAI,WAAW,EAAG,QAAO,gBAAgB;AACzC,MAAI,WAAW,OAAO,WAAW,IAAK,QAAO,gBAAgB;AAE7D,MAAI,WAAW,IAAK,QAAO,gBAAgB;AAC3C,MAAI,WAAW,IAAK,QAAO,gBAAgB;AAC3C,MAAI,UAAU,IAAK,QAAO,gBAAgB;AAC1C,SAAO,gBAAgB;AACzB,GAXqB;AA2Cd,IAAM,mBAAmB,wBAAC,OAAgB,aAAqC;AACpF,MAAI,OAAO,UAAU,YAAY,SAAS,CAAC,mBAAmB,KAAK,KAAK,GAAG;AACzE,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AAEA,QAAM,aAAa;AAAA,IACjB,KAAK,OAAO,SAAS;AAAA,IACrB,KAAK,OAAO,QAAQ;AAAA,IACpB,KAAK,KAAK,OAAO,UAAU,GAAG,OAAO;AAAA,IACrC,KAAK,KAAK,OAAO,UAAU,GAAG,QAAQ;AAAA,IACtC,KAAK,KAAK,OAAO,UAAU,GAAG,SAAS;AAAA,IACvC,KAAK,KAAK,KAAK,OAAO,UAAU,GAAG,MAAM,GAAG,QAAQ;AAAA,EACtD;AAEA,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,cAAc,YAAY,aAAa,CAAC,mBAAmB,KAAK,SAAS,GAAG;AACrF,aAAO,EAAE,SAAS,UAAU;AAAA,IAC9B;AAAA,EACF;AAKA,QAAM,YAAY,KAAK,OAAO,YAAY,KAAK,KAAK,OAAO,QAAQ;AACnE,QAAM,SAAS,OAAO,cAAc,WAAW,YAAY;AAI3D,MAAI,WAAW,UAAa,UAAU;AACpC,WAAO,EAAE,SAAS,SAAS;AAAA,EAC7B;AAEA,QAAM,MAAM,aAAa,MAAM;AAC/B,SAAO,EAAE,SAAS,cAAc,GAAG,GAAG,IAAI;AAC5C,GAlCgC;AA0CzB,IAAM,kBAAkB,wBAAC,OAAgB,aAC9C,iBAAiB,OAAO,QAAQ,EAAE,SADL;AAoBxB,IAAM,iBAAiB,wBAC5B,KACA,SACA,UACS;AACT,QAAM,OAAO,KAAK,OAAO,YAAY,KAAK,KAAK,OAAO,QAAQ;AAC9D,QAAM,gBAAgB,OAAO,SAAS,YAAY,QAAQ,OAAO,OAAO;AACxE,MAAI,eAAe;AACjB,QAAI,KAAK,SAAS,KAAK;AACvB;AAAA,EACF;AACA,MAAI,MAAM,SAAS,KAAK;AAC1B,GAZ8B;;;ACvI9B,IAAM,eAAoC,IAAI,IAAY,OAAO,OAAO,kBAAkB,CAAC;AAE3F,IAAMC,UAAS,wBAAC,UACd,OAAO,UAAU,YAAY,UAAU,OAAQ,QAAoC,MADtE;AASR,IAAM,mBAAmB,wBAAC,KAAc,aAAmC;AAChF,QAAM,OAAOA,QAAOA,QAAO,GAAG,GAAG,QAAQ;AACzC,QAAM,OAAO,MAAM;AACnB,MAAI,OAAO,SAAS,YAAY,aAAa,IAAI,IAAI,GAAG;AACtD,UAAM,cAAc,MAAM;AAC1B,WAAO;AAAA,MACL;AAAA,MACA,SAAS,OAAO,gBAAgB,YAAY,cAAc,cAAc;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,EAAE,SAAS,gBAAgB,KAAK,QAAQ,EAAE;AACnD,GAXgC;;;AC/BhC,SAAS,YAAAC,iBAAgB;;;ACUzB,IAAM,cAAc;AAWb,SAAS,qBAAqB,OAAyB;AAC5D,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AAExD,QAAM,EAAE,MAAM,MAAM,QAAQ,IAAI;AAMhC,SACE,SAAS,wBACT,SAAS,MACR,OAAO,YAAY,YAAY,QAAQ,SAAS,OAAO;AAE5D;AAdgB;AAwBT,SAAS,kBAAkB,MAAe,KAAsB;AACrE,MAAI;AACF,UAAM,WAAW,IAAI,KAAK,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,EAAE,OAAO;AAEzD,QAAI,WAAW,aAAa;AAC1B,iBAAW;AAAA,QACT,cAAc,SAAS,QAAQ,CAAC,CAAC,kCAAkC,GAAG;AAAA,MACxE;AACA,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,eAAW,MAAM,qCAAqC,GAAG,MAAM,KAAK;AACpE,WAAO;AAAA,EACT;AACF;AAhBgB;;;ADlCT,SAAS,kBAAqB,KAAa,cAAiB;AAEjE,QAAM,CAAC,aAAa,cAAc,IAAIC,UAAY,MAAM;AACtD,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO;AAAA,IACT;AAEA,QAAI;AACF,YAAM,OAAO,OAAO,eAAe,QAAQ,GAAG;AAC9C,aAAO,OAAO,KAAK,MAAM,IAAI,IAAI;AAAA,IACnC,SAAS,OAAO;AACd,iBAAW,MAAM,qCAAqC,GAAG,MAAM,KAAK;AACpE,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AAGD,QAAM,eAAe,6BAAM;AACzB,QAAI;AACF,YAAM,OAAO,OAAO,KAAK,cAAc,EAAE,OAAO,CAAAC,SAAOA,QAAO,OAAOA,SAAQ,QAAQ;AAErF,UAAI,KAAK,SAAS,IAAI;AACpB,cAAM,gBAAgB,KAAK,KAAK,KAAK,SAAS,GAAG;AACjD,iBAAS,IAAI,GAAG,IAAI,eAAe,KAAK;AACtC,cAAI;AACF,kBAAMA,OAAM,KAAK,CAAC;AAClB,gBAAIA,MAAK;AACP,6BAAe,WAAWA,IAAG;AAC7B,6BAAe,WAAW,GAAGA,IAAG,KAAK;AAAA,YACvC;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,2CAA2C,KAAK;AAAA,IACnE;AAAA,EACF,GArBqB;AAwBrB,QAAM,gBAAgB,6BAAM;AAC1B,QAAI;AACF,YAAM,OAAO,OAAO,KAAK,cAAc;AACvC,iBAAWA,QAAO,MAAM;AACtB,YAAI;AACF,yBAAe,WAAWA,IAAG;AAAA,QAC/B,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,wCAAwC,KAAK;AAAA,IAChE;AAAA,EACF,GAbsB;AAgBtB,QAAM,WAAW,wBAAC,UAA+B;AAC/C,QAAI;AACF,YAAM,eAAe,iBAAiB,WAAW,MAAM,WAAW,IAAI;AAGtE,UAAI,CAAC,kBAAkB,cAAc,GAAG,GAAG;AACzC,mBAAW,KAAK,gCAAgC,GAAG,iBAAiB;AAEpE,YAAI;AACF,iBAAO,eAAe,WAAW,GAAG;AACpC,iBAAO,eAAe,WAAW,GAAG,GAAG,KAAK;AAAA,QAC9C,QAAQ;AAAA,QAER;AAEA,uBAAe,YAAY;AAC3B;AAAA,MACF;AAEA,qBAAe,YAAY;AAE3B,UAAI,OAAO,WAAW,aAAa;AAEjC,YAAI;AACF,iBAAO,eAAe,QAAQ,KAAK,KAAK,UAAU,YAAY,CAAC;AAE/D,iBAAO,eAAe,QAAQ,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,SAAS,CAAC;AAAA,QAClE,SAAS,cAAuB;AAE9B,cAAI,qBAAqB,YAAY,GAAG;AACtC,uBAAW,KAAK,qDAAqD;AACrE,yBAAa;AAGb,gBAAI;AACF,qBAAO,eAAe,QAAQ,KAAK,KAAK,UAAU,YAAY,CAAC;AAC/D,qBAAO,eAAe,QAAQ,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,SAAS,CAAC;AAAA,YAClE,SAAS,YAAY;AACnB,yBAAW,MAAM,qCAAqC,GAAG,8BAA8B,UAAU;AAEjG,kBAAI;AACF,8BAAc;AACd,uBAAO,eAAe,QAAQ,KAAK,KAAK,UAAU,YAAY,CAAC;AAC/D,uBAAO,eAAe,QAAQ,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,SAAS,CAAC;AAAA,cAClE,SAAS,YAAY;AACnB,2BAAW,MAAM,qCAAqC,GAAG,2BAA2B,UAAU;AAE9F,+BAAe,YAAY;AAAA,cAC7B;AAAA,YACF;AAAA,UACF,OAAO;AACL,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,qCAAqC,GAAG,MAAM,KAAK;AAEpE,YAAM,eAAe,iBAAiB,WAAW,MAAM,WAAW,IAAI;AACtE,qBAAe,YAAY;AAAA,IAC7B;AAAA,EACF,GA7DiB;AAgEjB,QAAM,cAAc,6BAAM;AACxB,QAAI;AACF,qBAAe,YAAY;AAC3B,UAAI,OAAO,WAAW,aAAa;AACjC,YAAI;AACF,iBAAO,eAAe,WAAW,GAAG;AACpC,iBAAO,eAAe,WAAW,GAAG,GAAG,KAAK;AAAA,QAC9C,SAAS,aAAsB;AAE7B,cAAI,qBAAqB,WAAW,GAAG;AACrC,uBAAW,KAAK,oEAAoE;AACpF,yBAAa;AAEb,gBAAI;AACF,qBAAO,eAAe,WAAW,GAAG;AACpC,qBAAO,eAAe,WAAW,GAAG,GAAG,KAAK;AAAA,YAC9C,SAAS,YAAY;AACnB,yBAAW,MAAM,wCAAwC,GAAG,qBAAqB,UAAU;AAE3F,4BAAc;AAAA,YAChB;AAAA,UACF,OAAO;AACL,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,sCAAsC,GAAG,MAAM,KAAK;AAAA,IACvE;AAAA,EACF,GA7BoB;AA+BpB,SAAO,CAAC,aAAa,UAAU,WAAW;AAC5C;AAzJgB;;;AEVhB,IAAM,oBAAoB,SAAS,YAAY;AAW/C,IAAM,yBAAyB,6BAAc;AAC3C,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACF,UAAM,OAAO,OAAO,eAAe,QAAQ,iBAAiB;AAC5D,WAAO,OAAO,KAAK,MAAM,IAAI,IAAI;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF,GAR+B;AAa/B,IAAM,2BAA2B,6BAAY;AAC3C,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI;AACF,WAAO,eAAe,WAAW,iBAAiB;AAClD,WAAO,eAAe,WAAW,GAAG,iBAAiB,KAAK;AAAA,EAC5D,QAAQ;AAAA,EAER;AACF,GARiC;AAc1B,IAAM,oBAAoB,6BAAqB,uBAAuB,KAAK,MAAjD;AAO1B,IAAM,uBAAuB,6BAAqB;AACvD,QAAM,SAAS,uBAAuB;AACtC,MAAI,OAAQ,0BAAyB;AACrC,SAAO,UAAU;AACnB,GAJoC;AAM7B,IAAM,yBAAyB,wBAAC,UAA+B,CAAC,MAAM;AAC3E,QAAM,EAAE,cAAc,YAAY,aAAa,KAAK,IAAI;AACxD,QAAM,CAAC,aAAa,gBAAgB,iBAAiB,IAAI,kBAA0B,mBAAmB,EAAE;AAExG,QAAM,cAAc,wBAAC,QAAgB;AACnC,mBAAe,GAAG;AAAA,EACpB,GAFoB;AAIpB,QAAM,cAAc,6BAAM;AAExB,WAAO,uBAAuB,KAAK;AAAA,EACrC,GAHoB;AAKpB,QAAM,gBAAgB,6BAAM;AAC1B,sBAAkB;AAClB,6BAAyB;AAAA,EAC3B,GAHsB;AAKtB,QAAM,cAAc,6BAAM;AACxB,UAAM,SAAS,uBAAuB;AACtC,WAAO,OAAO,SAAS,KAAK,YAAY,SAAS;AAAA,EACnD,GAHoB;AAKpB,QAAM,sBAAsB,6BAAM;AAEhC,UAAM,SAAS,uBAAuB;AACtC,WAAO,UAAU,eAAe;AAAA,EAClC,GAJ4B;AAM5B,QAAM,sBAAsB,6BAAM;AAGhC,UAAM,SAAS,uBAAuB;AACtC,UAAM,WAAW,UAAU,eAAe;AAE1C,QAAI,YAAY;AACd,oBAAc;AAAA,IAChB;AACA,WAAO;AAAA,EACT,GAV4B;AAY5B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,GAlDsC;;;AjBjBtC,IAAM,WAAkD;AAAA,EACtD,QAAQ;AAAA,IACN,WAAW,8BAAO,UACf,MAAM,iBAAiB,sCAAsC,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,MADpF;AAAA,IAEX,UAAU,8BAAO,UACd,MAAM,iBAAiB,qCAAqC,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,MADpF;AAAA,EAEZ;AAAA,EACA,QAAQ;AAAA,IACN,WAAW,8BAAO,UACf,MAAM,iBAAiB,sCAAsC,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,MADpF;AAAA,IAEX,UAAU,8BAAO,UACd,MAAM,iBAAiB,qCAAqC,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,MADpF;AAAA,EAEZ;AACF;AAGO,IAAM,qBAAqB,OAAO,KAAK,QAAQ;AAE/C,IAAM,oBAAoB,wBAAC,UAChC,OAAO,UAAU,YAAY,OAAO,OAAO,UAAU,KAAK,GAD3B;AAGjC,IAAM,YAAY,SAAS,WAAW;AACtC,IAAM,eAAe,SAAS,cAAc;AAGrC,IAAM,oBAAoB,6BAAY;AAC3C,aAAW,OAAO,SAAS;AAC3B,aAAW,OAAO,YAAY;AAChC,GAHiC;AAwC1B,IAAM,gBAAgB,wBAAC,UAAgC,CAAC,MAA2B;AACxF,QAAM,SAAS,aAAa;AAE5B,QAAM,aAAaC,QAAO,OAAO;AACjC,aAAW,UAAU;AACrB,QAAM,YAAYA,QAAO,MAAM;AAC/B,YAAU,UAAU;AAEpB,QAAM,CAAC,iBAAiB,kBAAkB,IAAIC,UAAiC,IAAI;AACnF,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAAwB,IAAI;AACtD,QAAM,CAAC,WAAW,YAAY,IAAIA,UAAkC,IAAI;AAIxE,EAAAC,WAAU,MAAM;AACd,UAAM,SAAS,wBAAC,UAA+B;AAC7C,UAAI,MAAM,UAAW,oBAAmB,IAAI;AAAA,IAC9C,GAFe;AAGf,WAAO,iBAAiB,YAAY,MAAM;AAC1C,WAAO,MAAM,OAAO,oBAAoB,YAAY,MAAM;AAAA,EAC5D,GAAG,CAAC,CAAC;AAEL,QAAM,OAAOC,aAAY,CAAC,UAA2B,SAAiB,SAA4B;AAChG,aAAS,OAAO;AAChB,iBAAa,QAAQ,IAAI;AACzB,uBAAmB,IAAI;AACvB,eAAW,QAAQ,UAAU,SAAS,IAAI;AAC1C,cAAU,+CAAsC;AAAA,MAC9C;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAAA,EACH,GAAG,CAAC,CAAC;AAEL,QAAM,QAAQA,aAAY,OAAO,aAA8B;AAC7D,uBAAmB,QAAQ;AAC3B,aAAS,IAAI;AACb,iBAAa,IAAI;AAGjB,cAAU,aAAa;AACvB,SAAK,aAAa;AAElB,QAAI;AACF,gBAAU,iDAAuC;AAAA,QAC/C;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAGD,YAAM,YAAY,WAAW,QAAQ,aAAa,OAAO,SAAS;AAClE,YAAM,WAAW,MAAM,SAAS,QAAQ,EAAE,UAAU,EAAE,YAAY,UAAU,CAAC;AAC7E,UAAI,CAAC,SAAS,qBAAqB,CAAC,SAAS,OAAO;AAClD,cAAM,IAAI,MAAM,iCAAiC;AAAA,MACnD;AAEA,iBAAW,MAAM,WAAW,SAAS,KAAK;AAC1C,iBAAW,MAAM,cAAc,QAAQ;AACvC,iBAAW,KAAK,kBAAkB,QAAQ,KAAK;AAE/C,aAAO,SAAS,OAAO,SAAS;AAAA,IAClC,SAAS,KAAK;AACZ,iBAAW,MAAM,GAAG,QAAQ,uBAAuB,GAAG;AACtD,YAAM,UAAU,iBAAiB,KAAK,gCAAgC;AACtE,WAAK,UAAU,QAAQ,SAAS,QAAQ,IAAI;AAAA,IAC9C;AAAA,EACF,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,WAAWA,aAAY,OAAO,UAA2B,MAAc,UAAkB;AAC7F,uBAAmB,QAAQ;AAC3B,aAAS,IAAI;AACb,iBAAa,IAAI;AAKjB,UAAM,cAAc,WAAW,KAAK,SAAS;AAC7C,UAAM,iBAAiB,WAAW,KAAK,YAAY;AACnD,sBAAkB;AAClB,QAAI,CAAC,eAAe,gBAAgB,SAAU,kBAAkB,mBAAmB,UAAW;AAC5F,iBAAW,KAAK,GAAG,QAAQ,6DAA6D;AACxF,WAAK,UAAU,8CAA8C,eAAe;AAC5E;AAAA,IACF;AAEA,QAAI;AACF,YAAM,WAAW,MAAM,SAAS,QAAQ,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAElE,UAAI,SAAS,gBAAgB,SAAS,YAAY;AAChD,kBAAU,iDAAuC;AAAA,UAC/C;AAAA,UACA,OAAO,GAAG,QAAQ;AAAA,QACpB,CAAC;AACD,mBAAW,QAAQ,gBAAgB,SAAS,YAAY,SAAS,qBAAqB,KAAK;AAC3F,2BAAmB,IAAI;AACvB;AAAA,MACF;AAEA,UAAI,CAAC,SAAS,UAAU,CAAC,SAAS,SAAS;AACzC,cAAM,IAAI,MAAM,sCAAsC;AAAA,MACxD;AAGA,gBAAU,eAAe;AACzB,WAAK,WAAW,EAAE,QAAQ,SAAS,QAAQ,SAAS,SAAS,QAAQ,CAAC;AAEtE,gBAAU,qDAAyC;AAAA,QACjD;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AACD,UAAI,SAAS,MAAM,IAAI;AACrB,kBAAU,QAAQ,OAAO,SAAS,KAAK,EAAE,CAAC;AAAA,MAC5C;AACA,UAAI,SAAS,MAAM;AACjB,mBAAW,QAAQ,YAAY,SAAS,MAAM,SAAS,eAAe,OAAO,QAAQ;AAAA,MACvF;AAEA,yBAAmB,IAAI;AACvB,UAAI,CAAC,WAAW,QAAQ,cAAc;AAGpC,kBAAU,QAAQ,SAAS,qBAAqB,KAAK,WAAW,QAAQ,eAAe,UAAU;AAAA,MACnG;AAAA,IACF,SAAS,KAAK;AACZ,iBAAW,MAAM,GAAG,QAAQ,0BAA0B,GAAG;AACzD,YAAM,UAAU,iBAAiB,KAAK,uBAAuB;AAC7D,WAAK,UAAU,QAAQ,SAAS,QAAQ,IAAI;AAAA,IAC9C;AAAA,EACF,GAAG,CAAC,IAAI,CAAC;AAET,SAAO;AAAA,IACL,WAAW,oBAAoB;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,GAzI6B;;;AkBpG7B,SAAS,WAAAC,UAAS,YAAAC,WAAU,wBAAAC,6BAA4B;;;ACIxD,OAAO,YAAY;AAsBZ,SAAS,qCACd,MACA,QACqB;AACrB,QAAM,EAAE,UAAU,MAAM,GAAG,UAAU,IAAI,UAAU,CAAC;AACpD,QAAM,MAAM,UAAU,CAAC,yCAAyC,QAAQ,CAAC,CAAC,IAAa;AACvF,SAAO;AAAA,IACL;AAAA,IACA,YAAY;AACV,YAAM,MAAM,MAAM,iBAAiB,kCAAkC,EAAE,GAAI,QAAQ,CAAC,GAAI,cAAc,KAAK,CAAU;AACrH,YAAM,OAAO,IAAI;AACjB,WAAK,OAAO,uCAAmC,EAC5C,KAAK,CAAC,EAAE,6BAA6B,MAAM;AAC1C,cAAM,SAAS,6BAA6B,UAAU,IAAI;AAC1D,YAAI,OAAO,QAAS;AAGpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,QAAQ,OAAO,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI;AACF,mBAAO;AAAA,cACL,IAAI,YAAY,wBAAwB;AAAA,gBACtC,QAAQ;AAAA,kBACN,WAAW;AAAA,kBACX,QAAQ;AAAA,kBACR,MAAM;AAAA,kBACN,QAAQ,OAAO,MAAM;AAAA,kBACrB;AAAA,kBACA,WAAW,oBAAI,KAAK;AAAA,gBACtB;AAAA,gBACA,SAAS;AAAA,gBACT,YAAY;AAAA,cACd,CAAC;AAAA,YACH;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC;AACH,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAvDgB;;;ADZhB,IAAM,QAA6B,CAAC;AACpC,IAAM,YAAY,SAAS,eAAe;AAGnC,IAAM,8BAA8B;AAEpC,IAAM,2BAA2B;AAExC,IAAM,SAAS,wBAAC,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,OAAQ,MAA2B,OAAO,UAD5E;AAIf,IAAI,UAAyB;AAC7B,IAAI;AAGJ,IAAM,aAAa,6BAAuC;AACxD,QAAM,MAAM,WAAW,KAAK,SAAS;AACrC,MAAI,QAAQ,QAAS,QAAO;AAC5B,YAAU;AACV,MAAI;AACF,UAAM,SAAkB,QAAQ,OAAO,OAAO,KAAK,MAAM,GAAG;AAC5D,iBAAa,MAAM,QAAQ,MAAM,KAAK,OAAO,MAAM,MAAM,IAAI,SAAS;AAAA,EACxE,QAAQ;AACN,iBAAa;AAAA,EACf;AACA,SAAO;AACT,GAXmB;AAanB,IAAMC,aAAY,6BAAM,MAAM;AAAC,GAAb;AAClB,IAAM,iBAAiB,6BAAM,QAAN;AAahB,IAAM,oBAAoB,6BAA+B;AAE9D,QAAM,SAASC,sBAAqBD,YAAW,YAAY,cAAc;AAEzE,QAAM,CAAC,QAAQ,SAAS,IAAIE,UAAS,KAAK;AAE1C,QAAM,EAAE,KAAK,IAAI,qCAAqC,QAAW;AAAA,IAC/D,mBAAmB;AAAA,IACnB,uBAAuB;AAAA,IACvB,mBAAmB;AAAA,IACnB,oBAAoB;AAAA,IACpB,cAAc,wBAAC,QAAQ,MAAM,SAAS,YAAY,SAAS;AAEzD,UAAI,KAAK,aAAa,6BAA6B;AACjD,kBAAU,IAAI;AACd;AAAA,MACF;AACA,iBAAW,MAAM,KAAK,WAAW,IAAI,GAAG,2BAA2B,KAAK,UAAU;AAAA,IACpF,GAPc;AAAA,IAQd,kBAAkB,KAAK,KAAK;AAAA,IAC5B,cAAc,UAAU,EAAE,WAAW,OAAO;AAAA,IAC5C,WAAW,wBAAC,aAAa;AACvB,gBAAU,KAAK;AACf,iBAAW,UAAU,WAAW,SAAS,SAAS;AAAA,IACpD,GAHW;AAAA,EAIb,CAAC;AAED,QAAM,YAAYC;AAAA,IAChB,MAAM,MAAM,UAAU,OAAO,CAAC,MAAM,mBAAmB,SAAS,EAAE,EAAE,CAAC,KAAK;AAAA,IAC1E,CAAC,IAAI;AAAA,EACP;AAIA,SAAO,EAAE,WAAW,SAAS,SAAS,UAAa,UAAU,WAAW,OAAU;AACpF,GAnCiC;;;AEzDjC,SAAS,eAAAC,oBAAmB;AAqBrB,IAAM,gBAAgB,wBAAC,UAAgC,CAAC,MAA2B;AACxF,QAAM,EAAE,WAAW,OAAO,OAAO,SAAS,IAAI,cAAc,OAAO;AACnE,QAAM,kBAAkBC,aAAY,MAAM,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC;AAClE,QAAM,uBAAuBA;AAAA,IAC3B,CAAC,MAAc,UAAkB,SAAS,UAAU,MAAM,KAAK;AAAA,IAC/D,CAAC,QAAQ;AAAA,EACX;AACA,SAAO,EAAE,WAAW,OAAO,iBAAiB,qBAAqB;AACnE,GAR6B;;;ACrB7B,SAAS,eAAAC,cAAa,YAAAC,iBAAgB;;;ACetC,IAAM,mBAAmB;AAQlB,SAAS,yBAAyB,KAA6B;AACpE,MAAI,eAAe,UAAU;AAC3B,UAAM,OAAQ,IAAI,YAAY;AAC9B,QAAI,OAAO,MAAM,uBAAuB,SAAU,QAAO,KAAK;AAAA,EAChE;AACA,SAAO;AACT;AANgB;AAST,SAAS,gBAAgB,MAAuB;AACrD,SAAO,CAAC,CAAC,QAAQ,KAAK,WAAW;AACnC;AAFgB;;;ADkBT,IAAM,qBAAqB,wBAChC,UAAqC,CAAC,MACT;AAC7B,QAAM,EAAE,WAAW,SAAS,aAAa,eAAe,MAAM,IAAI;AAClE,QAAM,SAAS,aAAa;AAE5B,QAAM,CAAC,WAAW,YAAY,IAAIC,UAAS,KAAK;AAChD,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAAwB,IAAI;AACtD,QAAM,CAAC,SAAS,UAAU,IAAIA,UAAwB,IAAI;AAC1D,QAAM,CAAC,sBAAsB,uBAAuB,IAAIA,UAAwB,IAAI;AACpF,QAAM,CAAC,mBAAmB,oBAAoB,IAAIA,UAAwB,IAAI;AAE9E,QAAM,aAAaC,aAAY,MAAM;AACnC,aAAS,IAAI;AAAA,EACf,GAAG,CAAC,CAAC;AAIL,QAAM,gBAAgBA,aAAY,CAAC,aAA6B;AAI9D,cAAU,aAAa;AACvB,SAAK,WAAW,EAAE,QAAQ,SAAS,cAAc,SAAS,SAAS,cAAc,CAAC;AAElF,QAAI,SAAS,SAAS;AACpB,iBAAW,SAAS,OAAO;AAAA,IAC7B;AACA,QAAI,SAAS,2BAA2B,QAAW;AACjD,8BAAwB,SAAS,sBAAsB;AAAA,IACzD;AAEA,cAAU,qDAAyC;AAAA,MACjD;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AACD,QAAI,SAAS,MAAM,IAAI;AACrB,gBAAU,QAAQ,OAAO,SAAS,KAAK,EAAE,CAAC;AAAA,IAC5C;AAEA,gBAAY,SAAS,IAAI;AAGzB,QAAI,CAAC,cAAc;AACjB,YAAM,mBAAmB,qBAAqB,KAAK,eAAe;AAClE,iBAAW,KAAK,mCAAmC,gBAAgB;AACnE,aAAO,SAAS,gBAAgB;AAAA,IAClC;AAAA,EACF,GAAG,CAAC,WAAW,aAAa,QAAQ,YAAY,CAAC;AAEjD,QAAM,aAAaA,aAAY,OAAO,WAAmB,SAAmC;AAC1F,QAAI,CAAC,WAAW;AACd,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AACA,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AAEA,iBAAa,IAAI;AACjB,aAAS,IAAI;AAEb,QAAI;AACF,iBAAW,KAAK,wBAAwB;AAExC,YAAM,SAAS,MAAM,cAAc,oBAAoB;AAAA,QACrD,MAAM,EAAE,YAAY,WAAW,KAAK;AAAA,QACpC,cAAc;AAAA,MAChB,CAAC;AACD,YAAM,WAAW,OAAO;AAExB,UAAI,CAAC,SAAS,gBAAgB,CAAC,SAAS,eAAe;AACrD,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D;AAEA,oBAAc,QAAQ;AACtB,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,qBAAe,YAAY,iCAAiC,GAAG;AAC/D,YAAM,eAAe,gBAAgB,KAAK,2BAA2B;AACrE,YAAM,WAAW,yBAAyB,GAAG;AAC7C,UAAI,aAAa,KAAM,sBAAqB,QAAQ;AACpD,eAAS,YAAY;AACrB,gBAAU,YAAY;AAEtB,gBAAU,yDAA2C;AAAA,QACnD;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AACD,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,eAAe,OAAO,CAAC;AAE3B,QAAM,mBAAmBA,aAAY,OAAO,WAAmB,eAAyC;AACtG,QAAI,CAAC,WAAW;AACd,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AACA,QAAI,CAAC,cAAc,WAAW,SAAS,GAAG;AACxC,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AAEA,iBAAa,IAAI;AACjB,aAAS,IAAI;AAEb,QAAI;AACF,iBAAW,KAAK,0BAA0B;AAE1C,YAAM,SAAS,MAAM,cAAc,0BAA0B;AAAA,QAC3D,MAAM;AAAA,UACJ,YAAY;AAAA,UACZ,aAAa,WAAW,QAAQ,QAAQ,EAAE;AAAA,QAC5C;AAAA,QACA,cAAc;AAAA,MAChB,CAAC;AACD,YAAM,WAAW,OAAO;AAExB,UAAI,CAAC,SAAS,gBAAgB,CAAC,SAAS,eAAe;AACrD,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AAEA,oBAAc,QAAQ;AACtB,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,qBAAe,YAAY,wCAAwC,GAAG;AACtE,YAAM,eAAe,gBAAgB,KAAK,qBAAqB;AAC/D,YAAM,WAAW,yBAAyB,GAAG;AAC7C,UAAI,aAAa,KAAM,sBAAqB,QAAQ;AACpD,eAAS,YAAY;AACrB,gBAAU,YAAY;AAEtB,gBAAU,yDAA2C;AAAA,QACnD;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AACD,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,eAAe,OAAO,CAAC;AAE3B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,GAnKkC;;;AElDlC,SAAS,eAAAC,cAAa,YAAAC,iBAAgB;AAuD/B,IAAM,oBAAoB,wBAC/B,UAAoC,CAAC,MACT;AAC5B,QAAM,EAAE,YAAY,QAAQ,IAAI;AAEhC,QAAM,CAAC,WAAW,YAAY,IAAIC,UAAS,KAAK;AAChD,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAAwB,IAAI;AACtD,QAAM,CAAC,WAAW,YAAY,IAAIA,UAAoC,IAAI;AAC1E,QAAM,CAAC,aAAa,cAAc,IAAIA,UAA0B,IAAI;AACpE,QAAM,CAAC,oBAAoB,qBAAqB,IAAIA,UAAwB,IAAI;AAChF,QAAM,CAAC,WAAW,YAAY,IAAIA,UAA0D,MAAM;AAElG,QAAM,aAAaC,aAAY,MAAM;AACnC,aAAS,IAAI;AAAA,EACf,GAAG,CAAC,CAAC;AAEL,QAAM,aAAaA,aAAY,MAAM;AACnC,iBAAa,IAAI;AACjB,mBAAe,IAAI;AACnB,0BAAsB,IAAI;AAC1B,iBAAa,MAAM;AACnB,aAAS,IAAI;AAAA,EACf,GAAG,CAAC,CAAC;AAEL,QAAM,aAAaA,aAAY,OAAO,eAA4D;AAChG,iBAAa,IAAI;AACjB,aAAS,IAAI;AACb,iBAAa,UAAU;AAEvB,QAAI;AACF,iBAAW,KAAK,uBAAuB;AAEvC,YAAM,SAAS,MAAM,aAAa,mBAAmB;AAAA,QACnD,MAAM,EAAE,aAAa,WAAW;AAAA,QAChC,cAAc;AAAA,MAChB,CAAC;AACD,YAAM,WAAW,OAAO;AAExB,YAAM,OAA2B;AAAA,QAC/B,UAAU,SAAS;AAAA,QACnB,QAAQ,SAAS;AAAA,QACjB,iBAAiB,SAAS;AAAA,QAC1B,cAAc,SAAS;AAAA,QACvB,WAAW,SAAS;AAAA,MACtB;AAEA,mBAAa,IAAI;AACjB,iBAAW,KAAK,oCAAoC,KAAK,WAAW,SAAS;AAE7E,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,YAAM,eAAe,gBAAgB,KAAK,2BAA2B;AACrE,qBAAe,YAAY,qBAAqB,GAAG;AACnD,eAAS,YAAY;AACrB,mBAAa,MAAM;AACnB,gBAAU,YAAY;AACtB,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,OAAO,CAAC;AAEZ,QAAM,eAAeA,aAAY,OAAO,SAA2C;AACjF,QAAI,CAAC,WAAW;AACd,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AACA,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AAEA,iBAAa,IAAI;AACjB,aAAS,IAAI;AACb,iBAAa,YAAY;AAEzB,QAAI;AACF,iBAAW,KAAK,yBAAyB;AAEzC,YAAM,SAAS,MAAM,aAAa,0BAA0B;AAAA,QAC1D,MAAM,EAAE,WAAW,UAAU,UAAU,KAAK;AAAA,QAC5C,cAAc;AAAA,MAChB,CAAC;AACD,YAAM,WAAW,OAAO;AAExB,YAAM,QAAQ,SAAS;AACvB,qBAAe,KAAK;AACpB,4BAAsB,SAAS,oBAAoB;AACnD,mBAAa,UAAU;AAEvB,iBAAW,KAAK,gDAAgD,MAAM,MAAM;AAE5E,mBAAa,KAAK;AAClB,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,YAAM,eAAe,gBAAgB,KAAK,iCAAiC;AAC3E,qBAAe,YAAY,kCAAkC,GAAG;AAChE,eAAS,YAAY;AACrB,mBAAa,UAAU;AACvB,gBAAU,YAAY;AACtB,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,WAAW,YAAY,OAAO,CAAC;AAEnC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,GA1HiC;;;ACvDjC,SAAS,eAAAC,eAAa,YAAAC,iBAAgB;AAqC/B,IAAM,qBAAqB,6BAAgC;AAChE,QAAM,CAAC,WAAW,YAAY,IAAIC,UAAS,KAAK;AAChD,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAAwB,IAAI;AACtD,QAAM,CAAC,eAAe,gBAAgB,IAAIA,UAAyB,IAAI;AACvE,QAAM,CAAC,SAAS,UAAU,IAAIA,UAA4B,CAAC,CAAC;AAE5D,QAAM,aAAaC,cAAY,MAAM;AACnC,aAAS,IAAI;AAAA,EACf,GAAG,CAAC,CAAC;AAEL,QAAM,cAAcA,cAAY,YAA2B;AACzD,iBAAa,IAAI;AACjB,aAAS,IAAI;AAEb,QAAI;AACF,iBAAW,KAAK,wBAAwB;AAGxC,YAAM,SAAS,MAAM,QAAQ,uBAAuB,EAAE,cAAc,KAAK,CAAC;AAC1E,YAAM,WAAW,OAAO;AAExB,YAAM,gBAAmC,SAAS,QAAQ,IAAI,CAAC,YAAY;AAAA,QACzE,IAAI,OAAO;AAAA,QACX,MAAM,OAAO;AAAA,QACb,WAAW,OAAO;AAAA,QAClB,YAAY,OAAO,gBAAgB;AAAA,QACnC,WAAW,OAAO;AAAA,MACpB,EAAE;AAEF,iBAAW,aAAa;AACxB,uBAAiB,SAAS,eAAe;AAEzC,iBAAW,KAAK,eAAe,SAAS,kBAAkB,YAAY,UAAU;AAAA,IAClF,SAAS,KAAK;AACZ,YAAM,eAAe,gBAAgB,KAAK,4BAA4B;AACtE,qBAAe,YAAY,+BAA+B,GAAG;AAC7D,eAAS,YAAY;AAAA,IACvB,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,aAAaA,cAAY,OAAO,SAAmC;AACvE,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,eAAS,6BAA6B;AACtC,aAAO;AAAA,IACT;AAEA,iBAAa,IAAI;AACjB,aAAS,IAAI;AAEb,QAAI;AACF,iBAAW,KAAK,kBAAkB;AAElC,YAAM,QAAQ,qBAAqB,EAAE,MAAM,EAAE,KAAK,GAAG,cAAc,KAAK,CAAC;AAEzE,uBAAiB,KAAK;AACtB,iBAAW,CAAC,CAAC;AAEb,iBAAW,KAAK,2BAA2B;AAC3C,aAAO;AAAA,IACT,SAAS,KAAc;AACrB,YAAM,eAAe,gBAAgB,KAAK,2BAA2B;AACrE,qBAAe,YAAY,0BAA0B,GAAG;AACxD,eAAS,YAAY;AACrB,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,GAhFkC;;;ACgB3B,IAAM,eAAe,wBAAC,UAA+B,CAAC,MAA0B;AACrF,QAAM,SAAS,mBAAmB,QAAQ,MAAM;AAChD,QAAM,QAAQ,kBAAkB,QAAQ,KAAK;AAC7C,QAAM,SAAS,mBAAmB;AAElC,SAAO,EAAE,QAAQ,OAAO,OAAO;AACjC,GAN4B;;;ACrD5B,SAAS,YAAAC,iBAAgB;AAWlB,SAAS,gBAAmB,KAAa,cAAiB;AAE/D,QAAM,CAAC,aAAa,cAAc,IAAIC,UAAY,MAAM;AACtD,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO;AAAA,IACT;AAEA,QAAI;AACF,YAAM,OAAO,OAAO,aAAa,QAAQ,GAAG;AAC5C,UAAI,SAAS,MAAM;AACjB,eAAO;AAAA,MACT;AAGA,UAAI;AACF,eAAO,KAAK,MAAM,IAAI;AAAA,MACxB,QAAQ;AAEN,eAAO;AAAA,MACT;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,mCAAmC,GAAG,MAAM,KAAK;AAClE,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AAGD,QAAM,eAAe,6BAAM;AACzB,QAAI;AACF,YAAM,OAAO,OAAO,KAAK,YAAY,EAAE,OAAO,CAAAC,SAAOA,QAAO,OAAOA,SAAQ,QAAQ;AAEnF,UAAI,KAAK,SAAS,IAAI;AACpB,cAAM,gBAAgB,KAAK,KAAK,KAAK,SAAS,GAAG;AACjD,iBAAS,IAAI,GAAG,IAAI,eAAe,KAAK;AACtC,cAAI;AACF,kBAAMA,OAAM,KAAK,CAAC;AAClB,gBAAIA,MAAK;AACP,2BAAa,WAAWA,IAAG;AAC3B,2BAAa,WAAW,GAAGA,IAAG,KAAK;AAAA,YACrC;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,yCAAyC,KAAK;AAAA,IACjE;AAAA,EACF,GArBqB;AAwBrB,QAAM,gBAAgB,6BAAM;AAC1B,QAAI;AACF,YAAM,OAAO,OAAO,KAAK,YAAY;AACrC,iBAAWA,QAAO,MAAM;AACtB,YAAI;AACF,uBAAa,WAAWA,IAAG;AAAA,QAC7B,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,sCAAsC,KAAK;AAAA,IAC9D;AAAA,EACF,GAbsB;AAgBtB,QAAM,WAAW,wBAAC,UAA+B;AAC/C,QAAI;AACF,YAAM,eAAe,iBAAiB,WAAW,MAAM,WAAW,IAAI;AAGtE,UAAI,CAAC,kBAAkB,cAAc,GAAG,GAAG;AACzC,mBAAW,KAAK,gCAAgC,GAAG,iBAAiB;AAEpE,YAAI;AACF,iBAAO,aAAa,WAAW,GAAG;AAClC,iBAAO,aAAa,WAAW,GAAG,GAAG,KAAK;AAAA,QAC5C,QAAQ;AAAA,QAER;AAEA,uBAAe,YAAY;AAC3B;AAAA,MACF;AAEA,qBAAe,YAAY;AAE3B,UAAI,OAAO,WAAW,aAAa;AAEjC,YAAI;AAEF,cAAI,OAAO,iBAAiB,UAAU;AACpC,mBAAO,aAAa,QAAQ,KAAK,YAAY;AAAA,UAC/C,OAAO;AACL,mBAAO,aAAa,QAAQ,KAAK,KAAK,UAAU,YAAY,CAAC;AAAA,UAC/D;AAEA,iBAAO,aAAa,QAAQ,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,SAAS,CAAC;AAAA,QAChE,SAAS,cAAuB;AAE9B,cAAI,qBAAqB,YAAY,GAAG;AACtC,uBAAW,KAAK,mDAAmD;AACnE,yBAAa;AAGb,gBAAI;AAEF,kBAAI,OAAO,iBAAiB,UAAU;AACpC,uBAAO,aAAa,QAAQ,KAAK,YAAY;AAAA,cAC/C,OAAO;AACL,uBAAO,aAAa,QAAQ,KAAK,KAAK,UAAU,YAAY,CAAC;AAAA,cAC/D;AACA,qBAAO,aAAa,QAAQ,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,SAAS,CAAC;AAAA,YAChE,SAAS,YAAY;AACnB,yBAAW,MAAM,mCAAmC,GAAG,8BAA8B,UAAU;AAE/F,kBAAI;AACF,8BAAc;AAEd,oBAAI,OAAO,iBAAiB,UAAU;AACpC,yBAAO,aAAa,QAAQ,KAAK,YAAY;AAAA,gBAC/C,OAAO;AACL,yBAAO,aAAa,QAAQ,KAAK,KAAK,UAAU,YAAY,CAAC;AAAA,gBAC/D;AACA,uBAAO,aAAa,QAAQ,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,SAAS,CAAC;AAAA,cAChE,SAAS,YAAY;AACnB,2BAAW,MAAM,mCAAmC,GAAG,2BAA2B,UAAU;AAE5F,+BAAe,YAAY;AAAA,cAC7B;AAAA,YACF;AAAA,UACF,OAAO;AACL,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,mCAAmC,GAAG,MAAM,KAAK;AAElE,YAAM,eAAe,iBAAiB,WAAW,MAAM,WAAW,IAAI;AACtE,qBAAe,YAAY;AAAA,IAC7B;AAAA,EACF,GA5EiB;AA+EjB,QAAM,cAAc,6BAAM;AACxB,QAAI;AACF,qBAAe,YAAY;AAC3B,UAAI,OAAO,WAAW,aAAa;AACjC,YAAI;AACF,iBAAO,aAAa,WAAW,GAAG;AAClC,iBAAO,aAAa,WAAW,GAAG,GAAG,KAAK;AAAA,QAC5C,SAAS,aAAsB;AAE7B,cAAI,qBAAqB,WAAW,GAAG;AACrC,uBAAW,KAAK,kEAAkE;AAClF,yBAAa;AAEb,gBAAI;AACF,qBAAO,aAAa,WAAW,GAAG;AAClC,qBAAO,aAAa,WAAW,GAAG,GAAG,KAAK;AAAA,YAC5C,SAAS,YAAY;AACnB,yBAAW,MAAM,sCAAsC,GAAG,qBAAqB,UAAU;AAEzF,4BAAc;AAAA,YAChB;AAAA,UACF,OAAO;AACL,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,oCAAoC,GAAG,MAAM,KAAK;AAAA,IACrE;AAAA,EACF,GA7BoB;AA+BpB,SAAO,CAAC,aAAa,UAAU,WAAW;AAC5C;AAlLgB;;;ACIT,SAAS,aAAa,MAAsB;AACjD,MAAI,OAAO;AACT,WAAO;AAAA,EACT;AAEA,MAAI;AAEF,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,KAAK,mBAAmB,IAAI,EAAE,QAAQ,mBAAmB,CAAC,GAAG,OAAO;AACzE,eAAO,OAAO,aAAa,SAAS,IAAI,EAAE,CAAC;AAAA,MAC7C,CAAC,CAAC;AAAA,IACJ;AAEA,WAAO,OAAO,KAAK,MAAM,OAAO,EAAE,SAAS,QAAQ;AAAA,EACrD,SAAS,OAAO;AACd,YAAQ,MAAM,0BAA0B,KAAK;AAC7C,WAAO;AAAA,EACT;AACF;AAlBgB;AAyBT,SAAS,aAAa,SAAyB;AACpD,MAAI,OAAO;AACT,WAAO;AAAA,EACT;AAEA,MAAI;AAEF,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,SAAS,KAAK,OAAO;AAC3B,YAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,eAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,cAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,MAChC;AACA,aAAO;AAAA,QACL,MAAM,KAAK,KAAK,EACb,IAAI,UAAQ,OAAO,OAAO,KAAK,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,EACtD,KAAK,EAAE;AAAA,MACZ;AAAA,IACF;AAEA,WAAO,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,OAAO;AAAA,EACxD,SAAS,OAAO;AACd,YAAQ,MAAM,0BAA0B,KAAK;AAC7C,WAAO;AAAA,EACT;AACF;AAzBgB;AA+BT,SAAS,YAAY;AAC1B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR;AAAA,EACF;AACF;AANgB;;;ACxDhB,IAAMC,aAAY,SAAS,aAAa;AACxC,IAAM,gBAAgB;AACtB,IAAM,cAAc;AAkBb,SAAS,mBAAgC;AAC9C,MAAI;AACF,QAAI,OAAO,WAAW,YAAa,QAAO;AAE1C,UAAM,SAAS,aAAa,QAAQA,UAAS;AAC7C,QAAI,CAAC,QAAQ;AACX,iBAAc,MAAM,yBAAyB;AAC7C,aAAO;AAAA,IACT;AAGA,UAAM,UAAU,aAAa,MAAM;AACnC,UAAM,aAA4B,KAAK,MAAM,OAAO;AAGpD,QAAI,WAAW,YAAY,eAAe;AACxC,iBAAc,KAAK,wCAAwC;AAC3D,wBAAkB;AAClB,aAAO;AAAA,IACT;AAGA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,MAAM,MAAM,WAAW;AAC7B,QAAI,MAAM,WAAW,KAAK;AACxB,iBAAc,KAAK,yBAAyB;AAC5C,wBAAkB;AAClB,aAAO;AAAA,IACT;AAEA,eAAc,MAAM,mBAAmB,KAAK,MAAM,MAAM,GAAI,GAAG,SAAS;AACxE,WAAO,WAAW;AAAA,EACpB,SAAS,OAAO;AACd,eAAc,MAAM,wBAAwB,KAAK;AACjD,sBAAkB;AAClB,WAAO;AAAA,EACT;AACF;AArCgB;AA4CT,SAAS,iBAAiB,SAAe,SAAqC;AACnF,MAAI;AACF,QAAI,OAAO,WAAW,YAAa;AAEnC,UAAM,aAA4B;AAAA,MAChC,SAAS;AAAA,MACT,MAAM;AAAA,MACN,WAAW,KAAK,IAAI;AAAA,MACpB,KAAK,SAAS,OAAO;AAAA,IACvB;AAGA,UAAM,UAAU,aAAa,KAAK,UAAU,UAAU,CAAC;AACvD,iBAAa,QAAQA,YAAW,OAAO;AACvC,eAAc,MAAM,wBAAwB,WAAW,MAAM,KAAM,SAAS;AAAA,EAC9E,SAAS,OAAO;AACd,eAAc,MAAM,wBAAwB,KAAK;AAAA,EACnD;AACF;AAlBgB;AAuBT,SAAS,oBAA0B;AACxC,MAAI;AACF,QAAI,OAAO,WAAW,YAAa;AACnC,iBAAa,WAAWA,UAAS;AACjC,eAAc,MAAM,eAAe;AAAA,EACrC,SAAS,OAAO;AACd,eAAc,MAAM,yBAAyB,KAAK;AAAA,EACpD;AACF;AARgB;AAaT,SAAS,gBAAyB;AACvC,SAAO,iBAAiB,MAAM;AAChC;AAFgB;AAOT,SAAS,mBAKP;AACP,MAAI;AACF,QAAI,OAAO,WAAW,YAAa,QAAO;AAE1C,UAAM,SAAS,aAAa,QAAQA,UAAS;AAC7C,QAAI,CAAC,OAAQ,QAAO,EAAE,QAAQ,MAAM;AAGpC,UAAM,UAAU,aAAa,MAAM;AACnC,UAAM,aAA4B,KAAK,MAAM,OAAO;AACpD,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,MAAM,MAAM,WAAW;AAC7B,UAAM,YAAY,WAAW,MAAM;AAEnC,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,WAAW;AAAA,MAChB,WAAW,KAAK,IAAI,GAAG,SAAS;AAAA,IAClC;AAAA,EACF,SAAS,OAAO;AACd,eAAc,MAAM,2BAA2B,KAAK;AACpD,WAAO;AAAA,EACT;AACF;AA7BgB;;;AC1HhB,SAAS,eAAAC,eAAa,YAAAC,kBAAgB;AAqC/B,IAAM,mBAAmB,6BAA8B;AAC5D,QAAM,CAAC,WAAW,YAAY,IAAIC,WAAS,KAAK;AAChD,QAAM,CAAC,OAAO,QAAQ,IAAIA,WAAwB,IAAI;AACtD,QAAM,EAAE,OAAO,IAAI,QAAQ;AAE3B,QAAM,aAAaC,cAAY,MAAM;AACnC,aAAS,IAAI;AAAA,EACf,GAAG,CAAC,CAAC;AAKL,QAAM,gBAAgBA,cAAY,YAA0C;AAC1E,iBAAa,IAAI;AACjB,aAAS,IAAI;AAEb,QAAI;AACF,iBAAW,KAAK,qBAAqB;AAErC,YAAM,SAAS,MAAM,mBAAmB,+BAA+B,EAAE,cAAc,KAAK,CAAC;AAC7F,YAAM,WAAW,OAAO;AAExB,UAAI,CAAC,SAAS,SAAS;AACrB,mBAAW,MAAM,6BAA6B,SAAS,OAAO;AAC9D,iBAAS,SAAS,OAAO;AACzB,cAAM,IAAI,MAAM,SAAS,OAAO;AAAA,MAClC;AAAA,IACF,SAASC,QAAO;AACd,iBAAW,MAAM,6BAA6BA,MAAK;AACnD,YAAMA;AAAA,IACR,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAEA,UAAM,OAAO;AACb,WAAO,EAAE,SAAS,MAAM,SAAS,+BAA+B;AAAA,EAClE,GAAG,CAAC,MAAM,CAAC;AAEX,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,GA5CgC;;;AC/BhC,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,SAAS,0BAAoC;AAClD,QAAM,UAAoB,CAAC;AAC3B,MAAI;AACF,QAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,eAAW,OAAO,mBAAmB;AACnC,UAAI,OAAO,aAAa,QAAQ,GAAG,MAAM,MAAM;AAC7C,eAAO,aAAa,WAAW,GAAG;AAClC,gBAAQ,KAAK,GAAG;AAAA,MAClB;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAdgB;;;ACaT,SAAS,kBAAkB,GAA+B;AAC/D,MAAI,CAAC,EAAE,YAAa,QAAO;AAC3B,MAAI,EAAE,uBAAuB;AAC3B,WAAO,EAAE,kBAAkB,EAAE,WAAW,kBAAkB;AAAA,EAC5D;AAEA,MAAI,EAAE,sBAAsB,CAAC,EAAE,SAAU,QAAO;AAChD,SAAO;AACT;AARgB;;;ACfhB;AAAA,EACe,eAAAC;AAAA,EAAa;AAAA,EAAY,aAAAC;AAAA,EAAW,WAAAC;AAAA,EAAS,UAAAC;AAAA,EAAQ,YAAAC;AAAA,OAC7D;;;ACXP,OAAO,oBAAoB;;;ACA3B,OAAOC,aAAY;;;ACAnB,OAAOC,qBAAoB;;;ACA3B,OAAOC,qBAAoB;;;ACA3B,OAAOC,aAAY;;;ACAnB,OAAOC,qBAAoB;;;ACA3B,OAAOC,qBAAoB;;;ACA3B,OAAOC,qBAAoB;;;ACA3B,OAAOC,qBAAoB;;;ACA3B,OAAOC,qBAAoB;;;ACA3B,OAAOC,aAAY;;;ACAnB,OAAOC,qBAAoB;AASpB,SAAS,+BACd,QACA;AACA,SAAOC;AAAA,IACL,CAAC,iCAAiC;AAAA,IAClC,OAAO,MAAM,EAAE,IAAI,MAAqB;AACtC,YAAM,MAAM,MAAM,eAAe,4BAA4B,EAAE,GAAG,KAAK,cAAc,KAAK,CAAU;AACpG,YAAM,OAAO,IAAI;AACjB,WAAK,OAAO,mCAA+B,EACxC,KAAK,CAAC,EAAE,yBAAyB,MAAM;AACtC,cAAM,SAAS,yBAAyB,UAAU,IAAI;AACtD,YAAI,OAAO,QAAS;AAGpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,QAAQ,OAAO,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI;AACF,mBAAO;AAAA,cACL,IAAI,YAAY,wBAAwB;AAAA,gBACtC,QAAQ;AAAA,kBACN,WAAW;AAAA,kBACX,QAAQ;AAAA,kBACR,MAAM;AAAA,kBACN,QAAQ,OAAO,MAAM;AAAA,kBACrB;AAAA,kBACA,WAAW,oBAAI,KAAK;AAAA,gBACtB;AAAA,gBACA,SAAS;AAAA,gBACT,YAAY;AAAA,cACd,CAAC;AAAA,YACH;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC;AACH,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AApDgB;;;ACThB,OAAOC,sBAAoB;AASpB,SAAS,8BACd,QACA;AACA,SAAOC;AAAA,IACL,CAAC,gCAAgC;AAAA,IACjC,OAAO,MAAM,EAAE,IAAI,MAAqB;AACtC,YAAM,MAAM,MAAM,eAAe,2BAA2B,EAAE,GAAG,KAAK,cAAc,KAAK,CAAU;AACnG,YAAM,OAAO,IAAI;AACjB,WAAK,OAAO,kCAA8B,EACvC,KAAK,CAAC,EAAE,wBAAwB,MAAM;AACrC,cAAM,SAAS,wBAAwB,UAAU,IAAI;AACrD,YAAI,OAAO,QAAS;AAGpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,QAAQ,OAAO,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI;AACF,mBAAO;AAAA,cACL,IAAI,YAAY,wBAAwB;AAAA,gBACtC,QAAQ;AAAA,kBACN,WAAW;AAAA,kBACX,QAAQ;AAAA,kBACR,MAAM;AAAA,kBACN,QAAQ,OAAO,MAAM;AAAA,kBACrB;AAAA,kBACA,WAAW,oBAAI,KAAK;AAAA,gBACtB;AAAA,gBACA,SAAS;AAAA,gBACT,YAAY;AAAA,cACd,CAAC;AAAA,YACH;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC;AACH,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AApDgB;;;ACThB,OAAOC,sBAAoB;AASpB,SAAS,kCACd,QACA;AACA,SAAOC;AAAA,IACL,CAAC,oCAAoC;AAAA,IACrC,OAAO,MAAM,EAAE,IAAI,MAAqB;AACtC,YAAM,MAAM,MAAM,mBAAmB,+BAA+B,EAAE,GAAG,KAAK,cAAc,KAAK,CAAU;AAC3G,YAAM,OAAO,IAAI;AACjB,WAAK,OAAO,qBAAiB,EAC1B,KAAK,CAAC,EAAE,WAAW,MAAM;AACxB,cAAM,SAAS,WAAW,UAAU,IAAI;AACxC,YAAI,OAAO,QAAS;AAGpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,QAAQ,OAAO,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI;AACF,mBAAO;AAAA,cACL,IAAI,YAAY,wBAAwB;AAAA,gBACtC,QAAQ;AAAA,kBACN,WAAW;AAAA,kBACX,QAAQ;AAAA,kBACR,MAAM;AAAA,kBACN,QAAQ,OAAO,MAAM;AAAA,kBACrB;AAAA,kBACA,WAAW,oBAAI,KAAK;AAAA,gBACtB;AAAA,gBACA,SAAS;AAAA,gBACT,YAAY;AAAA,cACd,CAAC;AAAA,YACH;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC;AACH,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AApDgB;;;ACThB,OAAOC,sBAAoB;;;ACA3B,OAAOC,sBAAoB;;;ACA3B,OAAOC,sBAAoB;AASpB,SAAS,mCACd,QACA;AACA,SAAOC;AAAA,IACL,CAAC,qCAAqC;AAAA,IACtC,OAAO,MAAM,EAAE,IAAI,MAAqB;AACtC,YAAM,MAAM,MAAM,mBAAmB,gCAAgC,EAAE,GAAG,KAAK,cAAc,KAAK,CAAU;AAC5G,YAAM,OAAO,IAAI;AACjB,WAAK,OAAO,qBAAiB,EAC1B,KAAK,CAAC,EAAE,WAAW,MAAM;AACxB,cAAM,SAAS,WAAW,UAAU,IAAI;AACxC,YAAI,OAAO,QAAS;AAGpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,QAAQ,OAAO,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI;AACF,mBAAO;AAAA,cACL,IAAI,YAAY,wBAAwB;AAAA,gBACtC,QAAQ;AAAA,kBACN,WAAW;AAAA,kBACX,QAAQ;AAAA,kBACR,MAAM;AAAA,kBACN,QAAQ,OAAO,MAAM;AAAA,kBACrB;AAAA,kBACA,WAAW,oBAAI,KAAK;AAAA,gBACtB;AAAA,gBACA,SAAS;AAAA,gBACT,YAAY;AAAA,cACd,CAAC;AAAA,YACH;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC;AACH,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AApDgB;;;ACThB,OAAOC,aAAY;;;ACAnB,OAAOC,sBAAoB;;;ACA3B,OAAOC,sBAAoB;AASpB,SAAS,kCACd,QACA;AACA,SAAOC;AAAA,IACL,CAAC,oCAAoC;AAAA,IACrC,OAAO,MAAM,EAAE,IAAI,MAAqB;AACtC,YAAM,MAAM,MAAM,mBAAmB,+BAA+B,EAAE,GAAG,KAAK,cAAc,KAAK,CAAU;AAC3G,YAAM,OAAO,IAAI;AACjB,WAAK,OAAO,qBAAiB,EAC1B,KAAK,CAAC,EAAE,WAAW,MAAM;AACxB,cAAM,SAAS,WAAW,UAAU,IAAI;AACxC,YAAI,OAAO,QAAS;AAGpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,QAAQ,OAAO,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI;AACF,mBAAO;AAAA,cACL,IAAI,YAAY,wBAAwB;AAAA,gBACtC,QAAQ;AAAA,kBACN,WAAW;AAAA,kBACX,QAAQ;AAAA,kBACR,MAAM;AAAA,kBACN,QAAQ,OAAO,MAAM;AAAA,kBACrB;AAAA,kBACA,WAAW,oBAAI,KAAK;AAAA,gBACtB;AAAA,gBACA,SAAS;AAAA,gBACT,YAAY;AAAA,cACd,CAAC;AAAA,YACH;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC;AACH,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AApDgB;;;ACThB,OAAOC,sBAAoB;;;ACA3B,OAAOC,sBAAoB;AASpB,SAAS,0BACd,QACA;AACA,SAAOC;AAAA,IACL,CAAC,2BAA2B;AAAA,IAC5B,OAAO,MAAM,EAAE,IAAI,MAAqB;AACtC,YAAM,MAAM,MAAM,gBAAgB,uBAAuB,EAAE,GAAG,KAAK,cAAc,KAAK,CAAU;AAChG,YAAM,OAAO,IAAI;AACjB,WAAK,OAAO,sCAAkC,EAC3C,KAAK,CAAC,EAAE,4BAA4B,MAAM;AACzC,cAAM,SAAS,4BAA4B,UAAU,IAAI;AACzD,YAAI,OAAO,QAAS;AAGpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,QAAQ,OAAO,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI;AACF,mBAAO;AAAA,cACL,IAAI,YAAY,wBAAwB;AAAA,gBACtC,QAAQ;AAAA,kBACN,WAAW;AAAA,kBACX,QAAQ;AAAA,kBACR,MAAM;AAAA,kBACN,QAAQ,OAAO,MAAM;AAAA,kBACrB;AAAA,kBACA,WAAW,oBAAI,KAAK;AAAA,gBACtB;AAAA,gBACA,SAAS;AAAA,gBACT,YAAY;AAAA,cACd,CAAC;AAAA,YACH;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC;AACH,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AApDgB;;;ACThB,OAAOC,sBAAoB;;;ACN3B,SAAS,qBAAmC;AAWrC,SAAS,cAAiB,KAAa,SAAwB;AACpE,QAAM,IAAI;AACV,QAAM,WAAY,EAAE,sBAAsB,CAAC;AAC3C,SAAQ,SAAS,GAAG,MAAM,cAAuB,OAAO;AAC1D;AAJgB;;;AxBuRZ;AA1PJ,SAAS,eAAwB;AAC/B,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,CAAC,QAAQ,IAAK,QAAO;AAC3D,QAAI,QAAQ,IAAI,6BAA6B,OAAQ,QAAO;AAC5D,QAAI,QAAQ,IAAI,8BAA8B,OAAW,QAAO;AAChE,WAAO,QAAQ,QAAQ,IAAI,mBAAmB;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AATS;AA+CT,IAAM,kBAAkB,cAAgD,YAAY,MAAS;AAMtF,SAAS,iBAAiB,EAAE,SAAS,GAA0B;AACpE,QAAM,CAAC,SAAS,UAAU,IAAIC,WAA2B,MAAM;AAG7D,QAAI,CAAC,KAAK,gBAAgB,GAAG;AAC3B,wBAAkB;AAClB,aAAO;AAAA,IACT;AACA,UAAM,SAAS,iBAAiB;AAChC,WAAO,UAAU;AAAA,EACnB,CAAC;AACD,QAAM,CAAC,kBAAkB,mBAAmB,IAAIA,WAAS,KAAK;AAC9D,QAAM,CAAC,cAAc,eAAe,IAAIA,WAAuB,IAAI;AAEnE,QAAM,aAAaC,QAAyB,OAAO;AACnD,QAAM,eAAeA,QAAO,KAAK;AAGjC,QAAM,cAAcA,QAAO,CAAC;AAE5B,EAAAC,WAAU,MAAM;AACd,eAAW,UAAU;AAAA,EACvB,GAAG,CAAC,OAAO,CAAC;AAEZ,EAAAA,WAAU,MAAM;AACd,iBAAa,UAAU;AAAA,EACzB,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM,EAAE,SAAS,qBAAqB,IAAI,kCAAkC;AAC5E,QAAM,EAAE,SAAS,4BAA4B,IAAI,mCAAmC;AACpF,QAAM,EAAE,SAAS,cAAc,IAAI,kCAAkC;AACrE,QAAM,EAAE,SAAS,kBAAkB,IAAI,+BAA+B;AACtE,QAAM,EAAE,SAAS,iBAAiB,IAAI,8BAA8B;AACpE,QAAM,EAAE,SAAS,qBAAqB,IAAI,0BAA0B;AAEpE,QAAM,iBAAiBC,cAAY,OAAO,YAAgF;AACxH,UAAM,EAAE,UAAU,MAAM,IAAI,WAAW,CAAC;AAMxC,QAAI,CAAC,aAAa,GAAG;AACnB,iBAAW,MAAM,6DAA6D,QAAQ,GAAG;AACzF,aAAO;AAAA,IACT;AAMA,QAAI,aAAa,WAAW,CAAC,OAAO;AAClC,iBAAW,MAAM,kDAAkD,QAAQ,GAAG;AAC9E,aAAO,WAAW;AAAA,IACpB;AAEA,UAAM,MAAM,EAAE,YAAY;AAC1B,wBAAoB,IAAI;AACxB,iBAAa,UAAU;AACvB,oBAAgB,IAAI;AACpB,QAAI;AACF,iBAAW,MAAM,sCAAsC,QAAQ,YAAY,KAAK,GAAG;AACnF,YAAM,MAAM,MAAM,mBAAmB,2BAA2B,EAAE,cAAc,KAAK,CAAC;AACtF,YAAM,SAAS,IAAI;AAGnB,UAAI,QAAQ,YAAY,QAAS,QAAO;AACxC,iBAAW,MAAM;AACjB,iBAAW,UAAU;AACrB,uBAAiB,MAAM;AACvB,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,MAAM,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,yBAAyB;AAChF,UAAI,QAAQ,YAAY,QAAS,iBAAgB,GAAG;AACpD,YAAM;AAAA,IACR,UAAE;AACA,UAAI,QAAQ,YAAY,SAAS;AAC/B,4BAAoB,KAAK;AACzB,qBAAa,UAAU;AAAA,MACzB;AAAA,IACF;AAAA,EACF,GAAG,CAAC,CAAC;AAML,QAAM,gBAAgBA,cAAY,OAAO,SAA8C;AACrF,UAAM,qBAAqB,EAAE,MAAM,KAAK,CAAC;AACzC,UAAM,OAAO,MAAM,eAAe,EAAE,UAAU,iBAAiB,OAAO,KAAK,CAAC;AAC5E,WAAO;AAAA,EACT,GAAG,CAAC,sBAAsB,cAAc,CAAC;AAEzC,QAAM,uBAAuBA,cAAY,OAAO,SAAqD;AACnG,UAAM,4BAA4B,EAAE,MAAM,KAAK,CAAC;AAChD,UAAM,OAAO,MAAM,eAAe,EAAE,UAAU,wBAAwB,OAAO,KAAK,CAAC;AACnF,WAAO;AAAA,EACT,GAAG,CAAC,6BAA6B,cAAc,CAAC;AAEhD,QAAM,eAAeA,cAAY,OAAO,WAAuC;AAC7E,UAAM,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACxC,UAAM,OAAO,MAAM,eAAe,EAAE,UAAU,gBAAgB,OAAO,KAAK,CAAC;AAC3E,WAAO;AAAA,EACT,GAAG,CAAC,eAAe,cAAc,CAAC;AAElC,QAAM,aAAaA,cAAY,OAAO,SAAyD;AAC7F,UAAM,SAAS,MAAM,kBAAkB,EAAE,MAAM,KAAK,CAAC;AACrD,WAAO;AAAA,EACT,GAAG,CAAC,iBAAiB,CAAC;AAKtB,QAAM,sBAAsBA,cAAY,OACtC,QACA,aACkB;AAClB,QAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,iBAAW,KAAK,0BAA0B,OAAO,UAAU;AAC3D;AAAA,IACF;AAEA,QAAI,OAAO,UAAU,OAAO,SAAS;AAKnC,gBAAU,sBAAsB;AAChC,WAAK,WAAW,EAAE,QAAQ,OAAO,QAAQ,SAAS,OAAO,QAAQ,CAAC;AAClE,UAAI;AACF,cAAM,eAAe,EAAE,UAAU,OAAO,KAAK,CAAC;AAAA,MAChD,SAASC,eAAc;AACrB,mBAAW,KAAK,gCAAgC,QAAQ,wBAAwBA,aAAY;AAAA,MAC9F;AAAA,IACF;AAAA,EACF,GAAG,CAAC,cAAc,CAAC;AAEnB,QAAM,YAAYD,cAAY,OAAO,SAAuD;AAC1F,UAAM,SAAU,MAAM,iBAAiB,EAAE,MAAM,KAAK,CAAC;AACrD,UAAM,oBAAoB,QAAQ,WAAW;AAC7C,WAAO;AAAA,EACT,GAAG,CAAC,kBAAkB,mBAAmB,CAAC;AAE1C,QAAM,oBAAoBA,cAAY,OACpC,SACmC;AAGnC,UAAM,SAAU,MAAM,qBAAqB,EAAE,MAAM,KAAK,CAAC;AACzD,UAAM,oBAAoB,QAAQ,mBAAmB;AACrD,WAAO;AAAA,EACT,GAAG,CAAC,sBAAsB,mBAAmB,CAAC;AAE9C,QAAM,SAASA,cAAY,MAAM;AAI/B,UAAME,WAAU,KAAK,gBAAgB;AACrC,QAAIA,UAAS;AACX,sBAAgB,gCAAgC,EAAE,MAAM,EAAE,SAAAA,SAAQ,EAAE,CAAC,EAAE,MAAM,MAAM;AACjF,mBAAW,KAAK,4DAA4D;AAAA,MAC9E,CAAC;AAAA,IACH;AACA,cAAU,iBAAiB;AAC3B,SAAK,aAAa;AAClB,eAAW,MAAS;AACpB,oBAAgB,IAAI;AACpB,sBAAkB;AAAA,EACpB,GAAG,CAAC,CAAC;AAEL,QAAM,QAA8BC,SAAQ,OAAO;AAAA,IACjD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,SACE,oBAAC,gBAAgB,UAAhB,EAAyB,OACvB,UACH;AAEJ;AAzMgB;AA2MT,SAAS,qBAA2C;AACzD,QAAMC,WAAU,WAAW,eAAe;AAC1C,MAAI,CAACA,UAAS;AACZ,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,SAAOA;AACT;AANgB;;;AlD4UP,SASc,UATd,OAAAC,YAAA;AAzjBT,IAAM,gBAAgB;AAAA,EACpB,MAAM;AAAA,EACN,iBAAiB;AAAA,EACjB,qBAAqB;AACvB;AAGO,IAAM,oBAAoB,wBAC/B,YACI;AAAA,EACJ,MAAM,QAAQ,QAAQ,cAAc;AAAA,EACpC,iBAAiB,QAAQ,mBAAmB,cAAc;AAAA,EAC1D,qBAAqB,QAAQ,uBAAuB,QAAQ,QAAQ,cAAc;AACpF,IANiC;AAQjC,IAAM,oBAAoB,SAAS,MAAM;AAEzC,IAAM,cAAc,cAA2C,QAAQ,MAAS;AAEhF,IAAM,uBAAoD,wBAAC,EAAE,UAAU,OAAO,MAAM;AAClF,QAAM,WAAW,mBAAmB;AACpC,QAAM,UAAU,WAAW;AAC3B,QAAM,kBAAkB,QAAQ,WAAW;AAE3C,QAAM,SAAS,aAAa;AAC5B,QAAM,WAAWC,aAAY;AAC7B,QAAM,cAAc,eAAe;AACnC,QAAM,CAAC,aAAa,gBAAgB,gBAAgB,IAAI;AAAA,IACtD;AAAA,IACA;AAAA,EACF;AAIA,QAAM,SAASC,SAAQ,MAAM,kBAAkB,QAAQ,MAAM,GAAG,CAAC,QAAQ,MAAM,CAAC;AAChF,QAAM,YAAYC,QAAO,MAAM;AAC/B,EAAAC,WAAU,MAAM;AACd,cAAU,UAAU;AAAA,EACtB,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,kBAAkB,uBAAuB;AAAA,IAC7C,aAAa,OAAO;AAAA,IACpB,YAAY;AAAA,EACd,CAAC;AAED,QAAM,YAAYD,QAAO,MAAM;AAC/B,EAAAC,WAAU,MAAM;AACd,cAAU,UAAU;AAAA,EACtB,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,cAAcD,QAAO,QAAQ;AACnC,EAAAC,WAAU,MAAM;AACd,gBAAY,UAAU;AAAA,EACxB,GAAG,CAAC,QAAQ,CAAC;AAOb,QAAM,sBAAsBD,QAAO,KAAK;AAOxC,QAAM,CAAC,gBAAgB,iBAAiB,IAAIE,WAAS,KAAK;AAC1D,QAAM,aAAa,QAAQ,SAAS,OAAO;AAC3C,QAAM,sBAAsBF,QAAO,KAAK;AAExC,EAAAC,WAAU,MAAM;AACd,QAAI,CAAC,iBAAiB;AACpB,0BAAoB,UAAU;AAY9B,YAAM,YAAY,QAAQ,KAAK,SAAS,KAAK,KAAK,gBAAgB,CAAC;AACnE,UAAI,aAAa,CAAC,KAAK,gBAAgB,GAAG;AACxC,mBAAW,KAAK,yCAAoC;AACpD,kBAAU,mBAAmB,EAAE,KAAK,cAAc,CAAC;AACnD,aAAK,aAAa;AAClB,0BAAkB;AAAA,MACpB,WAAW,CAAC,aAAa,CAAC,KAAK,gBAAgB,GAAG;AAGhD,kBAAU,mBAAmB,EAAE,KAAK,aAAa,CAAC;AAClD,0BAAkB;AAClB,gCAAwB;AACxB,YAAI,YAAY,QAAQ,QAAS,aAAY,QAAQ,OAAO;AAAA,MAC9D;AACA,wBAAkB,IAAI;AACtB;AAAA,IACF;AACA,QAAI,cAAc,oBAAoB,SAAS;AAC7C,wBAAkB,IAAI;AACtB;AAAA,IACF;AACA,wBAAoB,UAAU;AAC9B,cAAU,yBAAyB;AACnC,QAAI,YAAY;AAChB,gBAAY,QACT,eAAe,EAAE,UAAU,yBAAyB,CAAC,EACrD,MAAM,CAAC,UAAmB;AAIzB,iBAAW,KAAK,uCAAuC,KAAK;AAC5D,gBAAU,4BAA4B;AAAA,QACpC,QAAQ,iBAAiB,WAAW,MAAM,aAAa;AAAA,MACzD,CAAC;AAAA,IACH,CAAC,EACA,QAAQ,MAAM;AACb,UAAI,CAAC,UAAW,mBAAkB,IAAI;AAAA,IACxC,CAAC;AACH,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,iBAAiB,UAAU,CAAC;AAEhC,QAAM,YAAY,CAAC;AAKnB,QAAM,CAAC,aAAa,cAAc,IAAIC,WAAS,KAAK;AACpD,QAAM,CAAC,UAAU,WAAW,IAAIA,WAAS,KAAK;AAC9C,EAAAD,WAAU,MAAM;AACd,mBAAe,IAAI;AACnB,UAAM,QAAQ,WAAW,MAAM,YAAY,IAAI,GAAG,GAAI;AACtD,WAAO,MAAM,aAAa,KAAK;AAAA,EACjC,GAAG,CAAC,CAAC;AACL,QAAM,SAAS,kBAAkB;AAAA,IAC/B;AAAA,IACA,uBAAuB;AAAA,IACvB,oBAAoBE,aAAY,KAAK,gBAAgB,IAAI;AAAA,IACzD;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,gBAAgBH,QAAe,EAAE;AACvC,EAAAC,WAAU,MAAM;AACd,QAAI,cAAc,YAAY,OAAQ;AACtC,kBAAc,UAAU;AACxB,cAAU,UAAU;AAAA,MAClB;AAAA,MACA,UAAU;AAAA,MACV,OAAO,KAAK,gBAAgB;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,MAAM,YAAY;AAAA,IACpB,CAAC;AAAA,EACH,GAAG,CAAC,QAAQ,iBAAiB,gBAAgB,UAAU,QAAQ,CAAC;AAChE,EAAAA,WAAU,MAAM;AACd,IAAC,WAAuC,eAAe,OAAO;AAAA,MAC5D;AAAA,MACA,UAAU;AAAA,MACV,OAAO,KAAK,gBAAgB;AAAA,MAC5B,UAAU,QAAQ,KAAK,SAAS,CAAC;AAAA,MACjC,YAAY,QAAQ,KAAK,gBAAgB,CAAC;AAAA,MAC1C;AAAA,MACA;AAAA,IACF;AAAA,EACF,GAAG,CAAC,QAAQ,iBAAiB,gBAAgB,QAAQ,CAAC;AAOtD,EAAAA,WAAU,MAAM;AACd,UAAM,cAAc,KAAK,iBAAiB,MAAM;AAC9C,gBAAU,mBAAmB,EAAE,MAAM,YAAY,GAAG,CAAC;AACrD,iBAAW,KAAK,4DAAuD;AACvE,wBAAkB;AAClB,gBAAU,yDAA2C;AAAA,QACnD;AAAA,MACF,CAAC;AACD,aAAO,YAAY,UAAU,QAAQ,mBAAmB;AAAA,IAC1D,CAAC;AACD,WAAO;AAAA,EACT,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAOrB,EAAAA,WAAU,MAAM;AACd,QAAI,CAAC,mBAAmB,oBAAoB,QAAS;AACrD,QAAI,aAAa,OAAO,QAAQ,CAAC,YAAY,IAAI,MAAM,GAAG;AACxD,YAAM,QAAQ,gBAAgB,YAAY,IAAI,gBAAgB,YAAY,IAAI;AAC9E,UAAI,MAAO,iBAAgB,cAAc;AACzC,gBAAU,cAAc,EAAE,IAAI,SAAS,OAAO,iBAAiB,OAAO,QAAQ,KAAK,EAAE,CAAC;AACtF,aAAO,KAAK,SAAS,OAAO,eAAe;AAAA,IAC7C;AAAA,EACF,GAAG,CAAC,iBAAiB,UAAU,aAAa,QAAQ,QAAQ,eAAe,CAAC;AAI5E,QAAM,qBAAqBG,cAAY,OAAO,aAAqC;AACjF,QAAI,CAAC,KAAK,gBAAgB,GAAG;AAC3B,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AACA,UAAM,YAAY,QAAQ,eAAe;AAAA,MACvC,UAAU,YAAY;AAAA,IACxB,CAAC;AAAA,EACH,GAAG,CAAC,CAAC;AAEL,QAAM,uBAAuBA,cAAY,YAA2B;AAClE,QAAI,KAAK,gBAAgB,GAAG;AAC1B,UAAI;AACF,cAAM,mBAAmB,sBAAsB;AAAA,MACjD,SAAS,OAAO;AACd,mBAAW,KAAK,6CAA6C,KAAK;AAAA,MACpE;AACA,aAAO,KAAK,UAAU,QAAQ,eAAe;AAAA,IAC/C,OAAO;AACL,aAAO,KAAK,UAAU,QAAQ,mBAAmB;AAAA,IACnD;AAAA,EACF,GAAG,CAAC,oBAAoB,MAAM,CAAC;AAI/B,QAAM,aAAaA;AAAA,IACjB,OAAO,YAAoB,WAAoB,YAA2D;AAExG,gBAAU,aAAa;AACvB,WAAK,aAAa;AAElB,UAAI;AACF,cAAM,OAA0B;AAAA,UAC9B;AAAA,UACA,YAAY;AAAA;AAAA;AAAA,UAGZ,GAAI,WAAW;AAAA,YACb,mBAAmB,QAAQ;AAAA,YAC3B,4BAA4B,QAAQ;AAAA,UACtC;AAAA,QACF;AACA,cAAM,SAAS,MAAM,YAAY,QAAQ,WAAW,IAAI;AAExD,kBAAU,iDAAuC;AAAA,UAC/C;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AAED,eAAO;AAAA,UACL,SAAS;AAAA,UACT,SAAS,OAAO,WAAW;AAAA,UAC3B,SAAS,OAAO,WAAW;AAAA,UAC3B,UAAU,OAAO;AAAA,QACnB;AAAA,MACF,SAAS,OAAO;AACd,uBAAe,YAAY,uBAAuB,KAAK;AAEvD,YAAI,iBAAiB,UAAU;AAC7B,gBAAM,OAAO,MAAM;AAGnB,gBAAM,aAAa,MAAM,eAAe,MAAM;AAC9C,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,YAAY,MAAM;AAAA,YAClB,SAAS,gBAAgB,KAAK;AAAA,YAC9B,YAAY,OAAO,eAAe,WAAW,aAAa;AAAA,UAC5D;AAAA,QACF;AACA,eAAO,EAAE,SAAS,OAAO,SAAS,gBAAgB,OAAO,oBAAoB,EAAE;AAAA,MACjF;AAAA,IACF;AAAA,IACA,CAAC;AAAA,EACH;AAEA,QAAM,YAAYA;AAAA,IAChB,OACE,YACA,SACA,WACA,aACA,iBAQI;AACJ,UAAI;AAGF,4BAAoB,UAAU,QAAQ,YAAY;AAClD,kBAAU,cAAc,EAAE,cAAc,QAAQ,YAAY,EAAE,CAAC;AAE/D,cAAM,SAAS,MAAM,YAAY,QAAQ,UAAU;AAAA,UACjD;AAAA,UACA,KAAK;AAAA,UACL,YAAY;AAAA,QACd,CAAC;AAED,YAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,qBAAW,KAAK,0BAA0B,OAAO,UAAU;AAC3D,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,SAAS;AAAA,YACT,cAAc;AAAA,YACd,YAAY,OAAO;AAAA,YACnB,mBAAmB,OAAO;AAAA,UAC5B;AAAA,QACF;AAEA,YAAI,CAAC,OAAO,UAAU,CAAC,OAAO,SAAS;AACrC,qBAAW,MAAM,yCAAyC,MAAM;AAChE,iBAAO,EAAE,SAAS,OAAO,SAAS,oCAAoC;AAAA,QACxE;AACA,YAAI,WAAW,SAAS,GAAG,GAAG;AAC5B,yBAAe,UAAU;AAAA,QAC3B;AAEA,kBAAU,qDAAyC;AAAA,UACjD;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,YAAI,OAAO,MAAM,IAAI;AACnB,oBAAU,QAAQ,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,QAC1C;AAEA,YAAI,CAAC,cAAc;AAIjB,gBAAM,QAAQ,gBAAgB,YAAY,IAAI,gBAAgB,YAAY,IAAI;AAC9E,cAAI,MAAO,iBAAgB,cAAc;AACzC,gBAAM,mBAAmB,SAAS,eAAe,UAAU,QAAQ;AACnE,qBAAW,KAAK,8BAA8B,gBAAgB;AAC9D,iBAAO,SAAS,gBAAgB;AAAA,QAClC;AAEA,eAAO;AAAA,UACL,SAAS;AAAA,UACT,SAAS;AAAA,UACT,MAAM,OAAO;AAAA,UACb,mBAAmB,OAAO;AAAA,QAC5B;AAAA,MACF,SAAS,OAAO;AACd,uBAAe,YAAY,sBAAsB,KAAK;AACtD,kBAAU,yDAA2C;AAAA,UACnD;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,YAAI,iBAAiB,UAAU;AAC7B,iBAAO,EAAE,SAAS,OAAO,SAAS,gBAAgB,KAAK,EAAE;AAAA,QAC3D;AACA,eAAO,EAAE,SAAS,OAAO,SAAS,gBAAgB,OAAO,sBAAsB,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,IACA,CAAC,gBAAgB,iBAAiB,MAAM;AAAA,EAC1C;AAOA,QAAM,QAAQA;AAAA,IACZ,OACE,OACA,UACA,YACiC;AACjC,YAAM,EAAE,aAAa,aAAa,IAAI,WAAW,CAAC;AAElD,UAAI;AAGF,4BAAoB,UAAU,QAAQ,YAAY;AAClD,kBAAU,kBAAkB,EAAE,cAAc,QAAQ,YAAY,EAAE,CAAC;AAEnE,cAAM,SAAS,MAAM,YAAY,QAAQ,kBAAkB;AAAA,UACzD;AAAA,UACA;AAAA,QACF,CAAC;AAED,YAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,qBAAW,KAAK,0BAA0B,OAAO,UAAU;AAC3D,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,SAAS;AAAA,YACT,cAAc;AAAA,YACd,YAAY,OAAO;AAAA,YACnB,mBAAmB,OAAO;AAAA,UAC5B;AAAA,QACF;AAEA,YAAI,CAAC,OAAO,UAAU,CAAC,OAAO,SAAS;AACrC,qBAAW,MAAM,6CAA6C,MAAM;AACpE,iBAAO,EAAE,SAAS,OAAO,SAAS,yBAAyB;AAAA,QAC7D;AACA,uBAAe,KAAK;AAEpB,kBAAU,qDAAyC;AAAA,UACjD;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,YAAI,OAAO,MAAM,IAAI;AACnB,oBAAU,QAAQ,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,QAC1C;AAEA,YAAI,CAAC,cAAc;AAIjB,gBAAM,QAAQ,gBAAgB,YAAY,IAAI,gBAAgB,YAAY,IAAI;AAC9E,cAAI,MAAO,iBAAgB,cAAc;AACzC,gBAAM,mBAAmB,SAAS,eAAe,UAAU,QAAQ;AACnE,qBAAW,KAAK,8BAA8B,gBAAgB;AAC9D,iBAAO,SAAS,gBAAgB;AAAA,QAClC;AAEA,eAAO;AAAA,UACL,SAAS;AAAA,UACT,SAAS;AAAA,UACT,MAAM,OAAO;AAAA,UACb,mBAAmB,OAAO;AAAA,QAC5B;AAAA,MACF,SAAS,OAAO;AACd,uBAAe,YAAY,0BAA0B,KAAK;AAC1D,kBAAU,iEAA+C;AAAA,UACvD;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,YAAI,iBAAiB,UAAU;AAG7B,gBAAM,OAAO,MAAM;AAGnB,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,YAAY,MAAM;AAAA,YAClB,SAAS,gBAAgB,KAAK;AAAA,YAC9B,WAAW,MAAM;AAAA,YACjB,YAAY,OAAO,MAAM,gBAAgB,WAAW,KAAK,cAAc;AAAA,UACzE;AAAA,QACF;AACA,eAAO,EAAE,SAAS,OAAO,SAAS,gBAAgB,OAAO,mBAAmB,EAAE;AAAA,MAChF;AAAA,IACF;AAAA,IACA,CAAC,gBAAgB,iBAAiB,MAAM;AAAA,EAC1C;AAIA,QAAM,eAAeA,cAAY,YAA4D;AAG3F,UAAM,SAAS,MAAM,KAAK,WAAW;AACrC,QAAI,QAAQ;AACV,gBAAU,qDAAyC;AAAA,QACjD;AAAA,MACF,CAAC;AACD,aAAO,EAAE,SAAS,MAAM,SAAS,kBAAkB;AAAA,IACrD;AACA,cAAU,+DAA8C;AAAA,MACtD;AAAA,IACF,CAAC;AACD,WAAO,EAAE,SAAS,OAAO,SAAS,yBAAyB;AAAA,EAC7D,GAAG,CAAC,CAAC;AAEL,QAAM,SAASA,cAAY,MAAY;AACrC,cAAU,QAAQ;AAClB,cAAU,uCAAkC;AAAA,MAC1C;AAAA,IACF,CAAC;AACD,gBAAY,QAAQ,OAAO;AAG3B,WAAO,YAAY,UAAU,QAAQ,mBAAmB;AAAA,EAC1D,GAAG,CAAC,MAAM,CAAC;AAIX,QAAM,OAAQ,SAAS,WAAuC;AAC9D,QAAM,cAAc,QAAQ,MAAM,YAAY,MAAM,YAAY;AAIhE,EAAAH,WAAU,MAAM;AACd,uBAAmB,EAAE,SAAS,YAAY,CAAC;AAAA,EAC7C,GAAG,CAAC,WAAW,CAAC;AAEhB,QAAM,gBAAgBG;AAAA,IACpB,OAAO,SAIqB;AAC1B,YAAM,SAAS,MAAM,YAAY,QAAQ,qBAAqB,IAAI;AAClE,aAAO;AAAA,IACT;AAAA,IACA,CAAC;AAAA,EACH;AAEA,QAAM,eAAeA,cAAY,OAAO,WAA8C;AACpF,UAAM,SAAS,MAAM,YAAY,QAAQ,aAAa,MAAM;AAC5D,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,QAAM,QAAQL;AAAA,IACZ,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA,MAGA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,6BAAM,KAAK,SAAS,GAApB;AAAA,MACV,iBAAiB,6BAAM,KAAK,gBAAgB,GAA3B;AAAA,MACjB,eAAe,6BAAM,aAAN;AAAA,MACf,WAAW;AAAA,MACX,iBAAiB;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB,gBAAgB;AAAA,MACjC,gBAAgB,gBAAgB;AAAA,MAChC,kBAAkB,gBAAgB;AAAA,MAClC,gBAAgB,gBAAgB;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO,gBAAAF,KAAC,YAAY,UAAZ,EAAqB,OAAe,UAAS;AACvD,GAviB0D;AA8iB1D,SAAS,gBAAgB,EAAE,UAAU,QAAQ,UAAU,KAAK,GAAsB;AAChF,MAAI,CAAC,QAAS,QAAO,gBAAAA,KAAA,YAAG,UAAS;AACjC,SACE,gBAAAA,KAAC,oBACC,0BAAAA,KAAC,wBAAqB,QAAiB,UAAS,GAClD;AAEJ;AAPS;AASF,IAAM,eAAe,KAAK,eAAe;AAMhD,IAAM,mBAAoC;AAAA,EACxC,MAAM;AAAA,EACN,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,QAAQ,kBAAkB;AAAA,EAC1B,oBAAoB,mCAAY;AAC9B,eAAW,KAAK,yDAAyD;AAAA,EAC3E,GAFoB;AAAA,EAGpB,sBAAsB,mCAAY;AAChC,eAAW,KAAK,2DAA2D;AAAA,EAC7E,GAFsB;AAAA,EAGtB,UAAU,6BAAM,MAAN;AAAA,EACV,iBAAiB,6BAAM,MAAN;AAAA,EACjB,eAAe,6BAAM,MAAN;AAAA,EACf,WAAW,6BAAM;AACf,eAAW,KAAK,gDAAgD;AAAA,EAClE,GAFW;AAAA,EAGX,iBAAiB,6BAAM;AAAA,EAAC,GAAP;AAAA,EACjB,YAAY,mCAAY;AACtB,eAAW,KAAK,iDAAiD;AACjE,WAAO,EAAE,SAAS,OAAO,SAAS,6BAA6B;AAAA,EACjE,GAHY;AAAA,EAIZ,WAAW,mCAAY;AACrB,eAAW,KAAK,gDAAgD;AAChE,WAAO,EAAE,SAAS,OAAO,SAAS,6BAA6B;AAAA,EACjE,GAHW;AAAA,EAIX,OAAO,mCAAY;AACjB,eAAW,KAAK,4CAA4C;AAC5D,WAAO,EAAE,SAAS,OAAO,SAAS,6BAA6B;AAAA,EACjE,GAHO;AAAA,EAIP,cAAc,mCAAY;AACxB,eAAW,KAAK,mDAAmD;AACnE,WAAO,EAAE,SAAS,OAAO,SAAS,6BAA6B;AAAA,EACjE,GAHc;AAAA,EAId,QAAQ,6BAAM;AACZ,eAAW,KAAK,6CAA6C;AAAA,EAC/D,GAFQ;AAAA,EAGR,iBAAiB,6BAAM;AAAA,EAAC,GAAP;AAAA,EACjB,gBAAgB,6BAAM,IAAN;AAAA,EAChB,kBAAkB,6BAAM;AAAA,EAAC,GAAP;AAAA,EAClB,gBAAgB,6BAAM,OAAN;AAAA,EAChB,eAAe,mCAAY;AACzB,eAAW,KAAK,oDAAoD;AACpE,WAAO,CAAC;AAAA,EACV,GAHe;AAAA,EAIf,cAAc,mCAAY;AACxB,eAAW,KAAK,mDAAmD;AACnE,WAAO,CAAC;AAAA,EACV,GAHc;AAIhB;AAQO,IAAM,UAAU,6BAAuB;AAC5C,QAAMQ,WAAUC,YAAW,WAAW;AACtC,MAAID,aAAY,QAAW;AACzB,QAAIF,cAAa,OAAO;AACtB,iBAAW,MAAM,8DAA8D;AAAA,IACjF;AACA,WAAO;AAAA,EACT;AACA,SAAOE;AACT,GATuB;AAWvB,IAAO,sBAAQ;;;A2E9sBR,IAAM,gBAAgB,wBAAC,UAA2B;AACvD,QAAM,aAAa;AACnB,SAAO,WAAW,KAAK,KAAK;AAC9B,GAH6B;;;ACsCtB,SAAS,YAAY,GAAwB;AAClD,SAAO;AAAA,IACL,EAAE,WACF,EAAE,eACF,EAAE,gBACF,CAAC,EAAE,eACH,EAAE,mBACF,CAAC,EAAE;AAAA,EACL;AACF;AATgB;AAeT,SAAS,sBAAsB,GAAwB;AAC5D,MAAI,CAAC,EAAE,QAAS,QAAO;AACvB,MAAI,CAAC,EAAE,YAAa,QAAO;AAC3B,MAAI,YAAY,CAAC,EAAG,QAAO;AAC3B,SAAO,EAAE,eAAe,EAAE,iBAAiB,CAAC,EAAE;AAChD;AALgB;AAYT,SAAS,qBAAqB,GAAwB;AAC3D,SACE,EAAE,WACF,EAAE,eACF,CAAC,EAAE,eACH,CAAC,EAAE,mBACH,CAAC,EAAE;AAEP;AARgB;AAWT,SAAS,4BAA4B,GAAiE;AAC3G,SAAO,CAAC,EAAE,eAAe,EAAE;AAC7B;AAFgB;","names":["k","f","auth","usePathname","useCallback","useContext","useEffect","useMemo","useRef","useState","hasWindow","memory","createStorage","sink","refresh","backend","client","isBrowser","dpopEnabled","useSyncExternalStore","useSyncExternalStore","useCallback","useCallback","refresh","useCallback","useEffect","useRef","useState","useState","useRef","useCallback","useEffect","useCallback","validateIdentifier","useCallback","useCallback","useEffect","useRef","createConsola","createConsola","usePathname","useEffect","useRef","usePathname","useRef","useEffect","useSyncExternalStore","listeners","subscribe","useSyncExternalStore","useRef","validateIdentifier","useCallback","useEffect","useCallback","useEffect","useRef","useState","joinedValues","auth","auth","config","request","url","AnalyticsEvent","AnalyticsCategory","OAuthErrorCodeEnum","record","useState","useState","key","useRef","useState","useEffect","useCallback","useMemo","useState","useSyncExternalStore","subscribe","useSyncExternalStore","useState","useMemo","useCallback","useCallback","useCallback","useState","useState","useCallback","useCallback","useState","useState","useCallback","useCallback","useState","useState","useCallback","useState","useState","key","CACHE_KEY","useCallback","useState","useState","useCallback","error","useCallback","useEffect","useMemo","useRef","useState","useSWR","useSWRMutation","useSWRMutation","useSWR","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWR","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWR","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useState","useRef","useEffect","useCallback","profileError","refresh","useMemo","context","jsx","usePathname","useMemo","useRef","useEffect","useState","isBrowser","useCallback","context","useContext"]}
+{"version":3,"sources":["../src/auth/constants.ts","../src/auth/trace.ts","../src/auth/context/AuthContext.tsx","../src/_api/generated/helpers/errors.ts","../src/_api/generated/helpers/keys.ts","../src/_api/generated/helpers/auth.ts","../src/_api/generated/helpers/logger.ts","../src/auth/utils/env.ts","../src/log-control.ts","../src/auth/hooks/useSession.ts","../src/auth/hooks/useTimezone.ts","../src/auth/hooks/useCfgRouter.ts","../src/auth/hooks/useQueryParams.ts","../src/auth/hooks/useAuthFormState.ts","../src/auth/hooks/useAuthValidation.ts","../src/auth/hooks/useAuthForm.ts","../src/auth/utils/logger.ts","../src/auth/hooks/useAutoAuth.ts","../src/auth/utils/path.ts","../src/auth/hooks/useTwoFactorChallenge.ts","../src/auth/hooks/useOAuthLogin.ts","../src/_api/generated/core/bodySerializer.gen.ts","../src/_api/generated/core/params.gen.ts","../src/_api/generated/core/serverSentEvents.gen.ts","../src/_api/generated/core/pathSerializer.gen.ts","../src/_api/generated/core/utils.gen.ts","../src/_api/generated/core/auth.gen.ts","../src/_api/generated/client/utils.gen.ts","../src/_api/generated/client/client.gen.ts","../src/_api/generated/client.gen.ts","../src/_api/generated/sdk.gen.ts","../src/auth/utils/analytics.ts","../src/_api/generated/types.gen.ts","../src/auth/utils/errors.ts","../src/auth/utils/oauthErrors.ts","../src/auth/hooks/useSessionStorage.ts","../src/auth/utils/storage.ts","../src/auth/hooks/useAuthRedirect.ts","../src/auth/hooks/useOAuthProviders.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthProvidersRetrieve.ts","../src/auth/hooks/useGithubAuth.ts","../src/auth/hooks/useTwoFactorVerify.ts","../src/auth/hooks/twoFactor.shared.ts","../src/auth/hooks/useTwoFactorSetup.ts","../src/auth/hooks/useTwoFactorStatus.ts","../src/auth/hooks/useTwoFactor.ts","../src/auth/hooks/useLocalStorage.ts","../src/auth/hooks/useBase64.ts","../src/auth/hooks/useProfileCache.ts","../src/auth/hooks/useDeleteAccount.ts","../src/auth/hooks/legacyStorage.ts","../src/auth/utils/authState.ts","../src/auth/context/AccountsContext.tsx","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRegenerateCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRetrieve.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyRevealCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsApiKeyTestCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthConnectionsList.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthDisconnectCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGithubAuthorizeCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGithubCallbackCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGoogleAuthorizeCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthGoogleCallbackCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpConsentPolicyRetrieve.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpRequestCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsOtpVerifyCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileAvatarCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileDeleteCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfilePartialPartialUpdate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfilePartialUpdate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileRetrieve.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileUpdatePartialUpdate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsProfileUpdateUpdate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenBlacklistCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenCreate.ts","../src/_api/generated/_cfg_accounts/hooks/useCfgAccountsTokenRefreshCreate.ts","../src/auth/context/sharedContext.ts","../src/auth/utils/validation.ts","../src/auth/utils/guard.ts","../src/auth/index.ts"],"sourcesContent":["/**\n * Auth-related constants shared across the frontend.\n * Single source of truth — do not redefine these elsewhere.\n */\n\nexport const AUTH_CONSTANTS = {\n  /** Email OTP code length (numeric). */\n  EMAIL_OTP_LENGTH: 4,\n  /** TOTP code length (RFC 6238 — authenticator apps). */\n  TOTP_LENGTH: 6,\n  /** Backup code max length. */\n  BACKUP_CODE_MAX_LENGTH: 12,\n  /** Resend cooldown (s) when the server does not state one. Mirrors the backend per-email cooldown. */\n  RESEND_COOLDOWN_SECONDS: 30,\n} as const;\n\n// Route conventions are NOT exported here on purpose. The '/auth' and '/'\n// defaults are applied in exactly one place — AuthProvider's route resolution\n// — and every consumer reads the resolved values from `useAuth().routes`.\n// Exporting route constants invites components to default to them directly,\n// which silently diverges from an app's AuthConfig.routes override.\n","/**\n * Auth trace: a persisted record of what the auth layer did, readable after any reload or redirect.\n *\n * Why storage and not `window`: a sign-in problem usually ends in a reload or a redirect, which throws away\n * everything held in memory and in the console. The events live in `localStorage` (falling back to\n * `sessionStorage`, then memory), so the next page can still print them. `window.__cfgAuth` is only the reader.\n *\n * Read it in the browser console, on any page of the origin, even after the redirect:\n *\n *   __cfgAuth.dump()    // copy-ready text with a header; paste it into the report\n *   __cfgAuth.trace()   // the raw array\n *   __cfgAuth.clear()   // empty it before reproducing\n *   __cfgAuth.copy()    // dump to the clipboard; __cfgAuth.download() saves the raw JSON\n *\n * What is recorded is the decision, never the secret: no token, code, address, cookie value or password.\n * Values are primitives, strings are cut, and keys that look sensitive are dropped (`SENSITIVE`).\n */\n\ntype Primitive = string | number | boolean | null;\nexport type TraceFields = Record<string, Primitive>;\n\nexport interface TraceEntry {\n  /** Wall clock, ms since epoch. */\n  t: number;\n  /** ms since this page started (`performance.now()`), so a reload shows as the counter restarting. */\n  p: number;\n  /** Short random id of this page load: one sequence, several loads, told apart by this. */\n  tab: string;\n  ev: string;\n  f?: TraceFields;\n  /** Times this exact event repeated back to back (absent = once). A loop must not push the start of the chain out of the buffer. */\n  n?: number;\n}\n\nconst KEY = 'cfg.auth.trace';\nconst MAX = 200;\nconst MAX_STRING = 120;\nconst SENSITIVE = /token|otp|code|email|password|secret|cookie|authorization|key|identifier/i;\n\n// One id per page load, shared by every copy of this module on the page (a second copy must not look like a second tab).\nconst TAB: string = (() => {\n  const g = globalThis as Record<string, unknown>;\n  return (g.__cfgAuthTab ??= Math.random().toString(36).slice(2, 6)) as string;\n})();\nconst hasWindow = typeof window !== 'undefined';\n\nlet memory: TraceEntry[] = [];\nlet loaded = false;\n\nfunction backend(): Storage | null {\n  if (!hasWindow) return null;\n  for (const name of ['localStorage', 'sessionStorage'] as const) {\n    try {\n      const s = window[name];\n      s.setItem('__cfg_probe', '1');\n      s.removeItem('__cfg_probe');\n      return s;\n    } catch {\n      /* try the next one */\n    }\n  }\n  return null;\n}\n\nfunction load(): TraceEntry[] {\n  if (loaded) return memory;\n  loaded = true;\n  try {\n    const raw = backend()?.getItem(KEY);\n    const parsed: unknown = raw ? JSON.parse(raw) : [];\n    if (Array.isArray(parsed)) memory = parsed.filter((e): e is TraceEntry => typeof e === 'object' && e !== null);\n  } catch {\n    memory = [];\n  }\n  return memory;\n}\n\nfunction persist(): void {\n  try {\n    backend()?.setItem(KEY, JSON.stringify(memory));\n  } catch {\n    /* quota or blocked storage: the in-memory copy still serves this page */\n  }\n}\n\nfunction clean(fields?: TraceFields): TraceFields | undefined {\n  if (!fields) return undefined;\n  const out: TraceFields = {};\n  for (const [k, v] of Object.entries(fields)) {\n    if (SENSITIVE.test(k)) continue;\n    if (typeof v === 'string') out[k] = v.length > MAX_STRING ? `${v.slice(0, MAX_STRING)}…` : v;\n    else if (typeof v === 'number' || typeof v === 'boolean' || v === null) out[k] = v;\n  }\n  return Object.keys(out).length ? out : undefined;\n}\n\n/** Re-read storage before every write: another tab (or another copy) may have appended since this one last looked. */\nfunction refresh(): void {\n  try {\n    const raw = backend()?.getItem(KEY);\n    const parsed: unknown = raw ? JSON.parse(raw) : null;\n    if (Array.isArray(parsed)) memory = parsed.filter((e): e is TraceEntry => typeof e === 'object' && e !== null);\n  } catch {\n    /* keep the in-memory copy */\n  }\n}\n\nfunction record(at: number, ev: string, fields?: TraceFields): void {\n  load();\n  refresh();\n  const entries = memory;\n  const p = hasWindow && typeof performance !== 'undefined' ? Math.round(performance.now()) : 0;\n  const f = clean(fields);\n  const last = entries[entries.length - 1];\n  if (last && last.tab === TAB && last.ev === ev && JSON.stringify(last.f) === JSON.stringify(f)) {\n    last.n = (last.n ?? 1) + 1;\n    last.t = at;\n    last.p = p;\n    persist();\n    return;\n  }\n  entries.push({ t: at, p, tab: TAB, ev, f });\n  if (entries.length > MAX) entries.splice(0, entries.length - MAX);\n  persist();\n}\n\n/** Record one auth event. Safe anywhere: it never throws and does nothing on the server. */\nexport function authTrace(ev: string, fields?: TraceFields): void {\n  if (!hasWindow) return;\n  try {\n    record(Date.now(), ev, fields);\n  } catch {\n    /* tracing never breaks auth */\n  }\n}\n\n/** The recorded events, oldest first. */\n/** @internal for tests */\nexport function resetAuthTraceForTests(): void {\n  memory = [];\n  loaded = true;\n}\n\nexport function readAuthTrace(): TraceEntry[] {\n  return load().slice();\n}\n\n/** Empty the trace. */\nexport function clearAuthTrace(): void {\n  memory = [];\n  loaded = true;\n  try {\n    backend()?.removeItem(KEY);\n  } catch {\n    /* ignore */\n  }\n}\n\nfunction context(): string[] {\n  if (!hasWindow) return [];\n  const copies = (globalThis as Record<string, unknown>).__cfgAuthCopies ?? 1;\n  const lines = [`url: ${window.location.href.split('?')[0]}`, `copies: ${String(copies)}`, `online: ${navigator.onLine}`, `ua: ${navigator.userAgent}`];\n  try {\n    const auth = (globalThis as Record<string, unknown>).__cfgAuthNow as (() => TraceFields) | undefined;\n    const now = auth?.();\n    if (now) lines.push(`now: ${Object.entries(now).map(([k, v]) => `${k}=${String(v)}`).join(' ')}`);\n  } catch {\n    /* the live state is a courtesy */\n  }\n  return lines;\n}\n\n/** Copy-ready text: a short header, then one line per event. Reloads show as a new `[tab]`. */\nexport function dumpAuthTrace(): string {\n  const entries = load();\n  const first = entries[0]?.t ?? Date.now();\n  const rows = entries.map((e) => {\n    const fields = e.f ? ` ${Object.entries(e.f).map(([k, v]) => `${k}=${String(v)}`).join(' ')}` : '';\n    const at = new Date(e.t).toISOString().slice(11, 23);\n    return `${at} +${String(e.t - first).padStart(6)}ms [${e.tab} p${e.p}] ${e.ev}${fields}${e.n && e.n > 1 ? ` x${e.n}` : ''}`;\n  });\n  return [`# cfg auth trace, ${entries.length} events`, ...context(), '', ...rows].join('\\n');\n}\n\n/**\n * Install the reader. Called once from the package entry; idempotent across copies of this module.\n * The generated auth store forwards through `globalThis.__cfgAuthTrace` and queues until this runs.\n */\nexport function installAuthTrace(): void {\n  if (!hasWindow) return;\n  const g = globalThis as Record<string, unknown>;\n  g.__cfgAuthTrace = authTrace;\n  g.__cfgAuth = {\n    trace: readAuthTrace,\n    dump: () => {\n      const text = dumpAuthTrace();\n      // eslint-disable-next-line no-console\n      console.log(text);\n      return text;\n    },\n    clear: clearAuthTrace,\n    /** Put the dump on the clipboard (works when the console output is blocked or too long to select). */\n    copy: () => {\n      const text = dumpAuthTrace();\n      void navigator.clipboard?.writeText(text);\n      return `${text.split('\\n').length} lines copied`;\n    },\n    /** Download the raw trace as a JSON file. */\n    download: () => {\n      const blob = new Blob([JSON.stringify(readAuthTrace(), null, 1)], { type: 'application/json' });\n      const a = document.createElement('a');\n      a.href = URL.createObjectURL(blob);\n      a.download = `auth-trace-${Date.now()}.json`;\n      a.click();\n    },\n  };\n  const queued = g.__cfgAuthTraceQ;\n  if (Array.isArray(queued)) {\n    g.__cfgAuthTraceQ = [];\n    for (const item of queued) {\n      if (Array.isArray(item) && typeof item[1] === 'string') {\n        try {\n          record(Number(item[0]) || Date.now(), item[1], item[2] as TraceFields | undefined);\n        } catch {\n          /* ignore */\n        }\n      }\n    }\n  }\n}\n\n/**\n * Count the copies of this package in the page. More than one means the bundle holds duplicates (pnpm peer-set\n * variants, a dual ESM/CJS load): the contexts are shared (`sharedContext`), but the build should still be fixed.\n * Visible as `dup.copy` in the trace and once in the console.\n * Called once by the auth entry (`src/auth/index.ts`), not by this module (see below).\n */\nexport function registerAuthCopy(): void {\n  if (!hasWindow) return;\n  const g = globalThis as Record<string, unknown>;\n  const n = ((g.__cfgAuthCopies as number | undefined) ?? 0) + 1;\n  g.__cfgAuthCopies = n;\n  if (n > 1) {\n    authTrace('dup.copy', { copies: n });\n    if (n === 2) {\n      // eslint-disable-next-line no-console\n      console.warn('[@djangocfg/api] more than one copy of the auth package is loaded; see __cfgAuth.dump() (dup.copy). Align the peer set so pnpm installs one instance.');\n    }\n  }\n}\n// NOT called here: `src/index.ts` and `src/auth/index.ts` are separate bundles that each carry this module, so\n// counting at load made every healthy page report `copies: 2`. `src/auth/index.ts` (the client entry, which holds\n// the contexts that must be single) calls `registerAuthCopy()`, so only a second copy of that entry counts.\n\n// The reader is installed as soon as the package loads, so a trace exists from the first event.\ninstallAuthTrace();\n","'use client';\n\n/**\n * AuthProvider — thin React layer over the generated auth store.\n *\n * Architecture rule (auth v2): the generated store (`_api/generated/helpers/auth`)\n * is the ONLY auth engine. It owns tokens, JWT-exp semantics, the reactive\n * session snapshot, 401→refresh→retry recovery (cross-store Web-Locks), and\n * the terminal-401 `onSessionExpired` event. React only:\n *   1. subscribes to the snapshot (`useSyncExternalStore`),\n *   2. loads the user profile when a session exists,\n *   3. routes to login when the store says the session died,\n *   4. exposes login/logout actions.\n *\n * Everything that used to live here — authTick, expiry timers, four parallel\n * 401 handlers, presence-vs-exp token checks — is the store's job now.\n */\n\nimport { usePathname } from 'next/navigation';\nimport React, {\n  memo,\n  useCallback,\n  useContext,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n} from 'react';\n\nimport { auth } from '../../_api/generated/helpers/auth';\nimport { APIError } from '../../_api/generated/helpers';\nimport { CFG_KEYS } from '../../_api/generated/helpers/keys';\nimport { applyRoleLogPolicy } from '../../log-control';\nimport { useCfgRouter, useLocalStorage, useQueryParams, useSession } from '../hooks';\nimport { clearProfileCache } from '../hooks/useProfileCache';\nimport { purgeLegacyTokenStorage } from '../hooks/legacyStorage';\nimport { useAuthRedirectManager } from '../hooks/useAuthRedirect';\nimport { Analytics, AnalyticsCategory, AnalyticsEvent } from '../utils/analytics';\nimport { formatAuthError, logAuthFailure } from '../utils/errors';\nimport { resolveAuthStatus } from '../utils/authState';\nimport { authTrace } from '../trace';\nimport { isDev, isBrowser } from '../utils/env';\nimport { authLogger } from '../utils/logger';\nimport { AccountsProvider, useAccountsContext } from './AccountsContext';\nimport { sharedContext } from './sharedContext';\n\nimport type { AuthContextType, AuthProviderProps, UserProfile } from './types';\nimport type {\n  OTPRequestConsent,\n  OTPRequestResult,\n  PasswordLoginOptions,\n  PasswordLoginResult,\n} from '../types';\nimport type { OtpRequestRequest } from '../../_api/generated/_cfg_accounts/types.gen';\n\n// The ONLY place route conventions are declared. '/auth' is the sign-in page\n// convention and '/private' is the default landing page after sign-in\n// (`defaultCallback`). Apps override via AuthConfig.routes;\n// everything downstream reads the RESOLVED values from `useAuth().routes`.\nconst defaultRoutes = {\n  auth: '/auth',\n  defaultCallback: '/private',\n  defaultAuthCallback: '/auth',\n};\n\n/** Resolve AuthConfig.routes against the conventions — applied exactly once. */\nexport const resolveAuthRoutes = (\n  routes?: { auth?: string; defaultCallback?: string; defaultAuthCallback?: string },\n) => ({\n  auth: routes?.auth || defaultRoutes.auth,\n  defaultCallback: routes?.defaultCallback || defaultRoutes.defaultCallback,\n  defaultAuthCallback: routes?.defaultAuthCallback || routes?.auth || defaultRoutes.defaultAuthCallback,\n});\n\nconst EMAIL_STORAGE_KEY = CFG_KEYS.email.key;\n\nconst AuthContext = sharedContext<AuthContextType | undefined>('auth', undefined);\n\nconst AuthProviderInternal: React.FC<AuthProviderProps> = ({ children, config }) => {\n  const accounts = useAccountsContext();\n  const session = useSession();\n  const isAuthenticated = session.status === 'authenticated';\n\n  const router = useCfgRouter();\n  const pathname = usePathname();\n  const queryParams = useQueryParams();\n  const [storedEmail, setStoredEmail, clearStoredEmail] = useLocalStorage<string | null>(\n    EMAIL_STORAGE_KEY,\n    null,\n  );\n\n  // Resolved once; every consumer below (and, via context, every component)\n  // reads these — never the raw config and never a module constant.\n  const routes = useMemo(() => resolveAuthRoutes(config?.routes), [config?.routes]);\n  const routesRef = useRef(routes);\n  useEffect(() => {\n    routesRef.current = routes;\n  }, [routes]);\n\n  const redirectManager = useAuthRedirectManager({\n    fallbackUrl: routes.defaultCallback,\n    clearOnUse: true,\n  });\n\n  const configRef = useRef(config);\n  useEffect(() => {\n    configRef.current = config;\n  }, [config]);\n\n  const accountsRef = useRef(accounts);\n  useEffect(() => {\n    accountsRef.current = accounts;\n  }, [accounts]);\n\n  // Set when a login flow opts out of automatic navigation (verifyOTP with\n  // skipRedirect — the AuthLayout success screen owns the final hardPush,\n  // including through a 2FA continuation). While set, the \"redirect\n  // authenticated users away from /auth\" effect must stand down, otherwise it\n  // races the success screen and eats the saved back-url.\n  const pendingManualNavRef = useRef(false);\n\n  // ── Bootstrap: settle the profile for the current session ─────────────────\n  // The session itself needs no async bootstrap — the store answers\n  // synchronously from token `exp`. The only async part is the profile fetch,\n  // and it re-runs automatically when a session appears later (e.g. iframe\n  // token delivery via postMessage → setSession → snapshot flips).\n  const [profileSettled, setProfileSettled] = useState(false);\n  const hasProfile = Boolean(accounts.profile);\n  const profileAttemptedRef = useRef(false);\n\n  useEffect(() => {\n    if (!isAuthenticated) {\n      profileAttemptedRef.current = false;\n      // Dead tokens may still sit in storage (access AND refresh both\n      // expired). Purge so the login form shows instantly instead of the app\n      // firing doomed API calls — the automated \"clear localStorage and the\n      // form appears\".\n      //\n      // CRITICAL: ask the STORE synchronously, never trust the React snapshot\n      // here. During hydration useSyncExternalStore serves the SERVER snapshot\n      // ('anonymous') for one commit even when perfectly live tokens sit in\n      // storage — purging on that stale value nuked fresh logins (user typed\n      // OTP → tokens saved → hardPush → hydration commit saw 'anonymous' →\n      // tokens cleared → bounced back to /auth).\n      const hasTokens = Boolean(auth.getToken() || auth.getRefreshToken());\n      if (hasTokens && !auth.isAuthenticated()) {\n        authLogger.warn('Dead session in storage — clearing');\n        authTrace('bootstrap.purge', { why: 'dead-tokens' });\n        auth.clearSession();\n        clearProfileCache();\n      } else if (!hasTokens && !auth.isAuthenticated()) {\n        // No session at all: a leftover profile cache and the old localStorage tokens (pre-cookie auth) must not keep\n        // the private UI alive. Drop them; the page's own guard then sends the user to /auth.\n        authTrace('bootstrap.purge', { why: 'no-session' });\n        clearProfileCache();\n        purgeLegacyTokenStorage();\n        if (accountsRef.current.profile) accountsRef.current.logout();\n      }\n      setProfileSettled(true);\n      return;\n    }\n    if (hasProfile || profileAttemptedRef.current) {\n      setProfileSettled(true);\n      return;\n    }\n    profileAttemptedRef.current = true;\n    authTrace('bootstrap.profile.start');\n    let cancelled = false;\n    accountsRef.current\n      .refreshProfile({ callerId: 'AuthProvider:bootstrap' })\n      .catch((error: unknown) => {\n        // A terminal 401 collapses the session via the store's\n        // onSessionExpired funnel below. Anything else (network, 5xx) keeps\n        // the session — the user can retry.\n        authLogger.warn('Profile load failed (session kept):', error);\n        authTrace('bootstrap.profile.failed', {\n          status: error instanceof APIError ? error.statusCode : 0,\n        });\n      })\n      .finally(() => {\n        if (!cancelled) setProfileSettled(true);\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [isAuthenticated, hasProfile]);\n\n  const isLoading = !profileSettled;\n\n  // ── The one linear state ───────────────────────────────────────────────────\n  // clientReady: the hydration commit is over (the server snapshot is always 'anonymous', so before this the\n  // snapshot proves nothing). timedOut: ONE safety timer, so 'resolving' always ends.\n  const [clientReady, setClientReady] = useState(false);\n  const [timedOut, setTimedOut] = useState(false);\n  useEffect(() => {\n    setClientReady(true);\n    const timer = setTimeout(() => setTimedOut(true), 8000);\n    return () => clearTimeout(timer);\n  }, []);\n  const status = resolveAuthStatus({\n    clientReady,\n    snapshotAuthenticated: isAuthenticated,\n    storeAuthenticated: isBrowser ? auth.isAuthenticated() : false,\n    profileSettled,\n    timedOut,\n  });\n  const lastStatusRef = useRef<string>('');\n  useEffect(() => {\n    if (lastStatusRef.current === status) return;\n    lastStatusRef.current = status;\n    authTrace('status', {\n      status,\n      snapshot: isAuthenticated,\n      store: auth.isAuthenticated(),\n      profileSettled,\n      timedOut,\n      path: pathname ?? '',\n    });\n  }, [status, isAuthenticated, profileSettled, timedOut, pathname]);\n  useEffect(() => {\n    (globalThis as Record<string, unknown>).__cfgAuthNow = () => ({\n      status,\n      snapshot: isAuthenticated,\n      store: auth.isAuthenticated(),\n      hasToken: Boolean(auth.getToken()),\n      hasRefresh: Boolean(auth.getRefreshToken()),\n      profileSettled,\n      timedOut,\n    });\n  }, [status, isAuthenticated, profileSettled, timedOut]);\n\n  // ── The ONE exit: terminal 401 → login ─────────────────────────────────────\n  // The store has already cleared the session before this fires (subscribers\n  // flipped to 'anonymous'), so the handler only routes. Registration returns\n  // its own unsubscribe — StrictMode double-mounts compose instead of racing.\n  // One hard navigation per page is enforced in useCfgRouter, so no per-handler dedupe flag is needed.\n  useEffect(() => {\n    const unsubscribe = auth.onSessionExpired(() => {\n      authTrace('expired.handler', { path: pathname ?? '' });\n      authLogger.warn('Session expired (terminal 401) — redirecting to login');\n      clearProfileCache();\n      Analytics.event(AnalyticsEvent.AUTH_SESSION_EXPIRED, {\n        category: AnalyticsCategory.AUTH,\n      });\n      router.hardReplace(routesRef.current.defaultAuthCallback);\n    });\n    return unsubscribe;\n  }, [router, pathname]);\n\n  // ── Redirect authenticated users away from the auth page ──────────────────\n  // Stands down while a login flow on this page owns navigation (success\n  // screen / 2FA continuation — see pendingManualNavRef). When it does fire\n  // (an already-authenticated user landing on /auth), it honors the saved\n  // back-url with the same priority rule as every other consumer.\n  useEffect(() => {\n    if (!isAuthenticated || pendingManualNavRef.current) return;\n    if (pathname === routes.auth && !queryParams.get('flow')) {\n      const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;\n      if (saved) redirectManager.clearRedirect();\n      authTrace('leave-auth', { to: saved || routes.defaultCallback, saved: Boolean(saved) });\n      router.push(saved || routes.defaultCallback);\n    }\n  }, [isAuthenticated, pathname, queryParams, routes, router, redirectManager]);\n\n  // ── Profile actions (delegated to AccountsContext) ─────────────────────────\n\n  const loadCurrentProfile = useCallback(async (callerId?: string): Promise<void> => {\n    if (!auth.isAuthenticated()) {\n      throw new Error('No valid authentication token');\n    }\n    await accountsRef.current.refreshProfile({\n      callerId: callerId || 'AuthContext.loadCurrentProfile',\n    });\n  }, []);\n\n  const checkAuthAndRedirect = useCallback(async (): Promise<void> => {\n    if (auth.isAuthenticated()) {\n      try {\n        await loadCurrentProfile('checkAuthAndRedirect');\n      } catch (error) {\n        authLogger.warn('checkAuthAndRedirect: profile load failed', error);\n      }\n      router.push(routesRef.current.defaultCallback);\n    } else {\n      router.push(routesRef.current.defaultAuthCallback);\n    }\n  }, [loadCurrentProfile, router]);\n\n  // ── OTP login flow ─────────────────────────────────────────────────────────\n\n  const requestOTP = useCallback(\n    async (identifier: string, sourceUrl?: string, consent?: OTPRequestConsent): Promise<OTPRequestResult> => {\n      // A login attempt invalidates whatever session was lying around.\n      authTrace('otp.request');\n      auth.clearSession();\n\n      try {\n        const body: OtpRequestRequest = {\n          identifier,\n          source_url: sourceUrl,\n          // Absent when the consuming app didn't enable the opt-in checkbox —\n          // the backend treats absent/null as \"not asked\".\n          ...(consent && {\n            marketing_consent: consent.marketingConsent,\n            consent_disclosure_version: consent.disclosureVersion,\n          }),\n        };\n        const result = await accountsRef.current.requestOTP(body);\n\n        Analytics.event(AnalyticsEvent.AUTH_OTP_REQUEST, {\n          category: AnalyticsCategory.AUTH,\n          label: 'email',\n        });\n\n        return {\n          success: true,\n          message: result.message || 'OTP code sent to your email address',\n          webmail: result.webmail ?? null,\n          resendIn: result.resend_in,\n        };\n      } catch (error) {\n        logAuthFailure(authLogger, 'Request OTP failed:', error);\n\n        if (error instanceof APIError) {\n          const body = error.response as\n            | { retry_after?: number; retryAfter?: number }\n            | undefined;\n          const retryAfter = body?.retry_after ?? body?.retryAfter;\n          return {\n            success: false,\n            statusCode: error.statusCode,\n            message: formatAuthError(error),\n            retryAfter: typeof retryAfter === 'number' ? retryAfter : undefined,\n          };\n        }\n        return { success: false, message: formatAuthError(error, 'Failed to send OTP') };\n      }\n    },\n    [],\n  );\n\n  const verifyOTP = useCallback(\n    async (\n      identifier: string,\n      otpCode: string,\n      sourceUrl?: string,\n      redirectUrl?: string,\n      skipRedirect?: boolean,\n    ): Promise<{\n      success: boolean;\n      message: string;\n      user?: UserProfile;\n      requires_2fa?: boolean;\n      session_id?: string | null;\n      should_prompt_2fa?: boolean;\n    }> => {\n      try {\n        // The caller opting out of redirect commits to handling ALL navigation\n        // for this login — including the 2FA continuation and success screen.\n        pendingManualNavRef.current = Boolean(skipRedirect);\n        authTrace('otp.verify', { skipRedirect: Boolean(skipRedirect) });\n\n        const result = await accountsRef.current.verifyOTP({\n          identifier,\n          otp: otpCode,\n          source_url: sourceUrl,\n        });\n\n        if (result.requires_2fa && result.session_id) {\n          authLogger.info('2FA required, session:', result.session_id);\n          return {\n            success: true,\n            message: 'OTP verified, 2FA required',\n            requires_2fa: true,\n            session_id: result.session_id,\n            should_prompt_2fa: result.should_prompt_2fa,\n          };\n        }\n\n        if (!result.access || !result.refresh) {\n          authLogger.error('Verify OTP returned invalid response:', result);\n          return { success: false, message: 'Invalid OTP verification response' };\n        }\n        if (identifier.includes('@')) {\n          setStoredEmail(identifier);\n        }\n\n        Analytics.event(AnalyticsEvent.AUTH_LOGIN_SUCCESS, {\n          category: AnalyticsCategory.AUTH,\n          label: 'email',\n        });\n        if (result.user?.id) {\n          Analytics.setUser(String(result.user.id));\n        }\n\n        if (!skipRedirect) {\n          // Priority: saved back-url (per-visit intent from the guard) >\n          // explicit redirectUrl (static app default) > config default.\n          // hardPush = full page load so every context reinitializes cleanly.\n          const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;\n          if (saved) redirectManager.clearRedirect();\n          const finalRedirectUrl = saved || redirectUrl || routesRef.current.defaultCallback;\n          authLogger.info('Redirecting after auth to:', finalRedirectUrl);\n          router.hardPush(finalRedirectUrl);\n        }\n\n        return {\n          success: true,\n          message: 'Login successful',\n          user: result.user as UserProfile,\n          should_prompt_2fa: result.should_prompt_2fa,\n        };\n      } catch (error) {\n        logAuthFailure(authLogger, 'Verify OTP failed:', error);\n        Analytics.event(AnalyticsEvent.AUTH_OTP_VERIFY_FAIL, {\n          category: AnalyticsCategory.AUTH,\n          label: 'email',\n        });\n        if (error instanceof APIError) {\n          return { success: false, message: formatAuthError(error) };\n        }\n        return { success: false, message: formatAuthError(error, 'Failed to verify OTP') };\n      }\n    },\n    [setStoredEmail, redirectManager, router],\n  );\n\n  // ── Password login flow ────────────────────────────────────────────────────\n\n  // Same envelope, same branches and the same single session owner as\n  // verifyOTP — only the credential differs. Anything that diverges here\n  // (a second token store, a bespoke fetch) forks the session.\n  const login = useCallback(\n    async (\n      email: string,\n      password: string,\n      options?: PasswordLoginOptions,\n    ): Promise<PasswordLoginResult> => {\n      const { redirectUrl, skipRedirect } = options || {};\n\n      try {\n        // The caller opting out of redirect commits to handling ALL navigation\n        // for this login — including the 2FA continuation and success screen.\n        pendingManualNavRef.current = Boolean(skipRedirect);\n        authTrace('password.login', { skipRedirect: Boolean(skipRedirect) });\n\n        const result = await accountsRef.current.loginWithPassword({\n          email,\n          password,\n        });\n\n        if (result.requires_2fa && result.session_id) {\n          authLogger.info('2FA required, session:', result.session_id);\n          return {\n            success: true,\n            message: 'Password verified, 2FA required',\n            requires_2fa: true,\n            session_id: result.session_id,\n            should_prompt_2fa: result.should_prompt_2fa,\n          };\n        }\n\n        if (!result.access || !result.refresh) {\n          authLogger.error('Password login returned invalid response:', result);\n          return { success: false, message: 'Invalid login response' };\n        }\n        setStoredEmail(email);\n\n        Analytics.event(AnalyticsEvent.AUTH_LOGIN_SUCCESS, {\n          category: AnalyticsCategory.AUTH,\n          label: 'password',\n        });\n        if (result.user?.id) {\n          Analytics.setUser(String(result.user.id));\n        }\n\n        if (!skipRedirect) {\n          // Priority: saved back-url (per-visit intent from the guard) >\n          // explicit redirectUrl (static app default) > config default.\n          // hardPush = full page load so every context reinitializes cleanly.\n          const saved = redirectManager.hasRedirect() ? redirectManager.getRedirect() : null;\n          if (saved) redirectManager.clearRedirect();\n          const finalRedirectUrl = saved || redirectUrl || routesRef.current.defaultCallback;\n          authLogger.info('Redirecting after auth to:', finalRedirectUrl);\n          router.hardPush(finalRedirectUrl);\n        }\n\n        return {\n          success: true,\n          message: 'Login successful',\n          user: result.user as UserProfile,\n          should_prompt_2fa: result.should_prompt_2fa,\n        };\n      } catch (error) {\n        logAuthFailure(authLogger, 'Password login failed:', error);\n        Analytics.event(AnalyticsEvent.AUTH_PASSWORD_LOGIN_FAIL, {\n          category: AnalyticsCategory.AUTH,\n          label: 'password',\n        });\n        if (error instanceof APIError) {\n          // 429 carries `retry_after`; 401 carries only `error_code`. Both are\n          // surfaced so a form can show a countdown instead of a dead message.\n          const body = error.response as\n            | { error_code?: string; retry_after?: number }\n            | undefined;\n          return {\n            success: false,\n            statusCode: error.statusCode,\n            message: formatAuthError(error),\n            errorCode: body?.error_code,\n            retryAfter: typeof body?.retry_after === 'number' ? body.retry_after : undefined,\n          };\n        }\n        return { success: false, message: formatAuthError(error, 'Failed to sign in') };\n      }\n    },\n    [setStoredEmail, redirectManager, router],\n  );\n\n  // ── Session actions ────────────────────────────────────────────────────────\n\n  const refreshToken = useCallback(async (): Promise<{ success: boolean; message: string }> => {\n    // Same single-flight + Web-Locks path as the 401 interceptor — rotation,\n    // dedup and rotated-token persistence come for free.\n    const access = await auth.refreshNow();\n    if (access) {\n      Analytics.event(AnalyticsEvent.AUTH_TOKEN_REFRESH, {\n        category: AnalyticsCategory.AUTH,\n      });\n      return { success: true, message: 'Token refreshed' };\n    }\n    Analytics.event(AnalyticsEvent.AUTH_TOKEN_REFRESH_FAIL, {\n      category: AnalyticsCategory.AUTH,\n    });\n    return { success: false, message: 'Error refreshing token' };\n  }, []);\n\n  const logout = useCallback((): void => {\n    authTrace('logout');\n    Analytics.event(AnalyticsEvent.AUTH_LOGOUT, {\n      category: AnalyticsCategory.AUTH,\n    });\n    accountsRef.current.logout(); // clears session + profile + cache\n    // hardReplace = full reload + history replace, so contexts reinitialize\n    // and Back doesn't return to a protected page.\n    router.hardReplace(routesRef.current.defaultAuthCallback);\n  }, [router]);\n\n  // ── Derived state ──────────────────────────────────────────────────────────\n\n  const user = (accounts.profile as UserProfile | undefined) ?? null;\n  const isAdminUser = Boolean(user?.is_staff || user?.is_superuser);\n\n  // Role-aware console verbosity: admins (and dev) get debug logs, regular\n  // users in production get a clean console.\n  useEffect(() => {\n    applyRoleLogPolicy({ isAdmin: isAdminUser });\n  }, [isAdminUser]);\n\n  const updateProfile = useCallback(\n    async (data: {\n      first_name?: string;\n      last_name?: string;\n      username?: string;\n    }): Promise<UserProfile> => {\n      const result = await accountsRef.current.partialUpdateProfile(data);\n      return result as UserProfile;\n    },\n    [],\n  );\n\n  const uploadAvatar = useCallback(async (avatar: File | Blob): Promise<UserProfile> => {\n    const result = await accountsRef.current.uploadAvatar(avatar);\n    return result as UserProfile;\n  }, []);\n\n  const value = useMemo<AuthContextType>(\n    () => ({\n      user,\n      isLoading,\n      status,\n      // Reactive: flips via the store snapshot (token writes, refreshes,\n      // expiry timer, cross-tab/cross-store sync) — no ticks, no polling.\n      isAuthenticated,\n      isAdminUser,\n      routes,\n      loadCurrentProfile,\n      checkAuthAndRedirect,\n      getToken: () => auth.getToken(),\n      getRefreshToken: () => auth.getRefreshToken(),\n      getSavedEmail: () => storedEmail,\n      saveEmail: setStoredEmail,\n      clearSavedEmail: clearStoredEmail,\n      requestOTP,\n      verifyOTP,\n      login,\n      refreshToken,\n      logout,\n      saveRedirectUrl: redirectManager.setRedirect,\n      getRedirectUrl: redirectManager.getFinalRedirectUrl,\n      clearRedirectUrl: redirectManager.clearRedirect,\n      hasRedirectUrl: redirectManager.hasRedirect,\n      updateProfile,\n      uploadAvatar,\n    }),\n    [\n      user,\n      isLoading,\n      status,\n      isAuthenticated,\n      isAdminUser,\n      routes,\n      loadCurrentProfile,\n      checkAuthAndRedirect,\n      storedEmail,\n      setStoredEmail,\n      clearStoredEmail,\n      requestOTP,\n      verifyOTP,\n      login,\n      refreshToken,\n      logout,\n      redirectManager,\n      updateProfile,\n      uploadAvatar,\n    ],\n  );\n\n  return <AuthContext.Provider value={value}>{children}</AuthContext.Provider>;\n};\n\n/**\n * AuthProvider — wraps AccountsProvider + AuthProviderInternal.\n *\n * Memoised: re-renders only when `config` reference or `children` change.\n */\nfunction AuthProviderRaw({ children, config, enabled = true }: AuthProviderProps) {\n  if (!enabled) return <>{children}</>;\n  return (\n    <AccountsProvider>\n      <AuthProviderInternal config={config}>{children}</AuthProviderInternal>\n    </AccountsProvider>\n  );\n}\n\nexport const AuthProvider = memo(AuthProviderRaw);\n\n/**\n * Default auth state for SSR/outside provider.\n * Safe defaults that read as \"not authenticated, not loading\".\n */\nconst defaultAuthState: AuthContextType = {\n  user: null,\n  isLoading: false,\n  status: 'anonymous',\n  isAuthenticated: false,\n  isAdminUser: false,\n  routes: resolveAuthRoutes(),\n  loadCurrentProfile: async () => {\n    authLogger.warn('useAuth: loadCurrentProfile called outside AuthProvider');\n  },\n  checkAuthAndRedirect: async () => {\n    authLogger.warn('useAuth: checkAuthAndRedirect called outside AuthProvider');\n  },\n  getToken: () => null,\n  getRefreshToken: () => null,\n  getSavedEmail: () => null,\n  saveEmail: () => {\n    authLogger.warn('useAuth: saveEmail called outside AuthProvider');\n  },\n  clearSavedEmail: () => {},\n  requestOTP: async () => {\n    authLogger.warn('useAuth: requestOTP called outside AuthProvider');\n    return { success: false, message: 'AuthProvider not available' };\n  },\n  verifyOTP: async () => {\n    authLogger.warn('useAuth: verifyOTP called outside AuthProvider');\n    return { success: false, message: 'AuthProvider not available' };\n  },\n  login: async () => {\n    authLogger.warn('useAuth: login called outside AuthProvider');\n    return { success: false, message: 'AuthProvider not available' };\n  },\n  refreshToken: async () => {\n    authLogger.warn('useAuth: refreshToken called outside AuthProvider');\n    return { success: false, message: 'AuthProvider not available' };\n  },\n  logout: () => {\n    authLogger.warn('useAuth: logout called outside AuthProvider');\n  },\n  saveRedirectUrl: () => {},\n  getRedirectUrl: () => '',\n  clearRedirectUrl: () => {},\n  hasRedirectUrl: () => false,\n  updateProfile: async () => {\n    authLogger.warn('useAuth: updateProfile called outside AuthProvider');\n    return {} as UserProfile;\n  },\n  uploadAvatar: async () => {\n    authLogger.warn('useAuth: uploadAvatar called outside AuthProvider');\n    return {} as UserProfile;\n  },\n};\n\n/**\n * Hook to access auth context.\n *\n * SSR-safe: returns default unauthenticated state when called outside\n * AuthProvider (e.g. during static page generation).\n */\nexport const useAuth = (): AuthContextType => {\n  const context = useContext(AuthContext);\n  if (context === undefined) {\n    if (isBrowser && isDev) {\n      authLogger.debug('useAuth called outside AuthProvider, returning default state');\n    }\n    return defaultAuthState;\n  }\n  return context;\n};\n\nexport default AuthContext;\n","// AUTO-GENERATED by django_generator / ts_extras.wrapper\n// Typed error classes with DRF field-error support.\n// DO NOT EDIT — re-run `make gen`.\n\n/**\n * HTTP API Error with DRF field-specific validation errors.\n */\nexport class APIError extends Error {\n  constructor(\n    public statusCode: number,\n    public statusText: string,\n    public response: any,\n    public url: string,\n    message?: string,\n  ) {\n    super(message || `HTTP ${statusCode}: ${statusText}`);\n    this.name = \"APIError\";\n  }\n\n  get details(): Record<string, any> | null {\n    if (typeof this.response === \"object\" && this.response !== null) {\n      return this.response;\n    }\n    return null;\n  }\n\n  get fieldErrors(): Record<string, string[]> | null {\n    const details = this.details;\n    if (!details) return null;\n    const fieldErrors: Record<string, string[]> = {};\n    for (const [key, value] of Object.entries(details)) {\n      if (Array.isArray(value)) fieldErrors[key] = value;\n    }\n    return Object.keys(fieldErrors).length > 0 ? fieldErrors : null;\n  }\n\n  get errorMessage(): string {\n    const details = this.details;\n    if (!details) return this.message;\n    if (details.detail) {\n      return Array.isArray(details.detail) ? details.detail.join(\", \") : String(details.detail);\n    }\n    if (details.error) return String(details.error);\n    if (details.message) return String(details.message);\n    const fieldErrors = this.fieldErrors;\n    if (fieldErrors) {\n      const firstField = Object.keys(fieldErrors)[0];\n      if (firstField) return `${firstField}: ${fieldErrors[firstField]?.join(\", \")}`;\n    }\n    return this.message;\n  }\n\n  get isValidationError(): boolean { return this.statusCode === 400; }\n  get isAuthError(): boolean { return this.statusCode === 401; }\n  get isPermissionError(): boolean { return this.statusCode === 403; }\n  get isNotFoundError(): boolean { return this.statusCode === 404; }\n  get isServerError(): boolean { return this.statusCode >= 500 && this.statusCode < 600; }\n}\n\n/** Network Error (connection failed, timeout, etc.) */\nexport class NetworkError extends Error {\n  constructor(\n    message: string,\n    public url: string,\n    public originalError?: Error,\n  ) {\n    super(message);\n    this.name = \"NetworkError\";\n  }\n}\n","// AUTO-GENERATED by django_generator / ts_extras.wrapper\n// Browser-storage key registry: one scheme, guarded access.\n// DO NOT EDIT — re-run `make gen`.\n//\n// Rules for agents and apps: @docs/STORAGE_KEYS.md in @djangocfg/api.\n//\n// Scheme: `<owner>.<area>.<name>` — lower case, dots between levels,\n// `snake_case` inside a level. The framework's owner is `cfg`; an app picks its\n// own with `createStorage('<owner>')`. Third-party keys (a library's own\n// prefix, `NEXT_LOCALE`) are not ours to rename and stay as they are.\n\nexport type KeyStore = 'local' | 'session' | 'cookie';\n\nexport interface KeySpec {\n  /** The canonical key. */\n  readonly key: string;\n  readonly store: KeyStore;\n  /** Removed by `clearAll()` (sign-out). Preferences are kept. */\n  readonly personal: boolean;\n}\n\nexport interface FamilySpec {\n  /** Canonical prefix ending in a dot; the id is appended in normalised form. */\n  readonly prefix: string;\n  readonly store: 'local' | 'session';\n  readonly personal: boolean;\n}\n\nconst k = (\n  key: string,\n  store: KeyStore,\n  personal: boolean,\n): KeySpec => ({ key, store, personal });\n\nconst f = (\n  prefix: string,\n  store: 'local' | 'session',\n  personal: boolean,\n): FamilySpec => ({ prefix, store, personal });\n\n/** Every key the framework writes. No legacy spellings are read: old keys are simply ignored. */\nexport const CFG_KEYS = {\n  accessToken: k('cfg.auth.access_token', 'cookie', true),\n  refreshToken: k('cfg.auth.refresh_token', 'cookie', true),\n  apiKey: k('cfg.auth.api_key', 'local', true),\n  email: k('cfg.auth.email', 'local', false),\n  emailTs: k('cfg.auth.email_ts', 'local', false),\n  redirectUrl: k('cfg.auth.redirect_url', 'session', true),\n  redirectUrlTs: k('cfg.auth.redirect_url_ts', 'session', true),\n  oauthState: k('cfg.auth.oauth_state', 'session', true),\n  oauthProvider: k('cfg.auth.oauth_provider', 'session', true),\n  oauthProviders: k('cfg.auth.oauth_providers', 'session', false),\n  profileCache: k('cfg.profile.cache', 'local', true),\n  monitorSessionId: k('cfg.monitor.session_id', 'local', false),\n  monitorSessionCookie: k('cfg.monitor.session_id', 'cookie', false),\n  monitorDebug: k('cfg.monitor.debug', 'local', false),\n  uiTabId: k('cfg.ui.tab_id', 'session', false),\n  uiRouterSerial: k('cfg.ui.router_serial', 'session', false),\n  uiState: k('cfg.ui.state', 'local', false),\n  chatSpeechLanguage: k('cfg.chat.speech_language', 'local', false),\n  chatRecentTools: k('cfg.chat.recent_tools', 'local', false),\n  formsSpeechDebug: k('cfg.forms.speech_debug', 'local', false),\n  formsSpeechPrefs: k('cfg.forms.speech_prefs', 'local', false),\n  agentPlaygroundApiKeyId: k('cfg.agent.playground_api_key_id', 'session', true),\n  agentPlaygroundBearer: k('cfg.agent.playground_bearer', 'session', true),\n  agentEndpointDoc: k('cfg.agent.endpoint_doc', 'session', false),\n} as const satisfies Record<string, KeySpec>;\n\n/** Keys with a caller-supplied id part: one per room, tree, endpoint. */\nexport const CFG_FAMILIES = {\n  chatDraft: f('cfg.chat.draft.', 'session', true),\n  dataTree: f('cfg.data.tree.', 'local', false),\n  agentEndpointDraft: f('cfg.agent.endpoint_draft.', 'local', false),\n} as const satisfies Record<string, FamilySpec>;\n\nconst OWNER_RE = /^[a-z][a-z0-9_]*$/;\n\n/** One segment of a key: lower case, `[a-z0-9_]`, anything else folded to `_`. */\nexport function normalizeSegment(raw: string): string {\n  return raw\n    .trim()\n    .toLowerCase()\n    .replace(/[^a-z0-9_]+/g, '_')\n    .replace(/^_+|_+$/g, '');\n}\n\nexport interface StorageOptions {\n  /** Named keys of this owner. */\n  readonly keys?: Readonly<Record<string, KeySpec>>;\n  readonly families?: Readonly<Record<string, FamilySpec>>;\n  /** Cookie lifetime for the `cookie` store. Default 30 days. */\n  readonly cookieMaxAgeSeconds?: number;\n  /**\n   * Cookie `Domain`. `'auto'` (default): the registrable domain of the page, so every subdomain\n   * shares the cookie (`example.com` for `my.example.com`). A string forces a domain; `false`\n   * keeps cookies host-only.\n   */\n  readonly cookieDomain?: 'auto' | string | false;\n}\n\nexport interface WriteOptions {\n  /** Cookie store: lifetime of this write. Default: the owner's `cookieMaxAgeSeconds`. */\n  readonly maxAgeSeconds?: number;\n}\n\nexport interface GuardedStorage {\n  readonly owner: string;\n  /** Builds `<owner>.<part>.<part>` from free-form parts; throws if a part is empty. */\n  key(...parts: string[]): string;\n  /** Builds a family member key: the prefix plus the normalised id. */\n  familyKey(family: FamilySpec, id: string): string;\n  /** `^(cfg|<owner>)(\\.[a-z0-9_]+)+$`. */\n  isValid(key: string): boolean;\n  read(key: string, store?: KeyStore): string | null;\n  /** True when the value reached the browser's storage; false means it is held in memory for this page only. */\n  write(key: string, value: string, store?: KeyStore, options?: WriteOptions): boolean;\n  /** Removes the key. */\n  remove(key: string, store?: KeyStore): void;\n  readJSON<T>(key: string, store?: KeyStore): T | null;\n  writeJSON(key: string, value: unknown, store?: KeyStore): boolean;\n  /** Keys this owner holds in `store`. */\n  keys(store?: Exclude<KeyStore, 'cookie'>): string[];\n  /** Sign-out: removes the `personal` keys. `{ all: true }` removes everything under this owner. */\n  clearAll(options?: { all?: boolean }): void;\n  /** Cookie store: change the `Domain` policy (`'auto'`, a domain, or `false` for host-only cookies). */\n  setCookieDomain(domain: 'auto' | string | false): void;\n  /** The `Domain` cookies are written with right now; `null` means host-only. */\n  cookieDomain(): string | null;\n  /** Cross-tab: calls `listener` with the new value when ANOTHER tab changes `key`. Cookies fire no events. */\n  onChange(key: string, listener: (value: string | null) => void, store?: Exclude<KeyStore, 'cookie'>): () => void;\n}\n\nconst hasWindow = () => typeof window !== 'undefined';\n\nconst domainByHost = new Map<string, string | null>();\n\n/**\n * The broadest domain this page may set cookies on (`example.com` for `my.example.com`,\n * `example.co.uk` for `a.example.co.uk`), found by asking the browser: it refuses a cookie for a\n * public suffix, so no suffix list lives in our code. `null` for an IP, `localhost`, a single label\n * or when cookies are blocked (the cookie is then host-only).\n */\nfunction detectCookieDomain(): string | null {\n  if (!hasWindow() || typeof document === 'undefined') return null;\n  const host = window.location.hostname.toLowerCase();\n  if (!host || !host.includes('.') || host.includes(':') || /^[0-9.]+$/.test(host)) return null;\n  const cached = domainByHost.get(host);\n  if (cached !== undefined) return cached;\n  const labels = host.split('.');\n  const secure = window.location.protocol === 'https:' ? '; Secure' : '';\n  let found: string | null = null;\n  try {\n    for (let i = labels.length - 2; i >= 0 && found === null; i -= 1) {\n      const candidate = labels.slice(i).join('.');\n      const probe = 'cfg_probe_' + Math.random().toString(36).slice(2);\n      document.cookie = probe + '=1; Domain=' + candidate + '; Path=/; Max-Age=30; SameSite=Lax' + secure;\n      if (document.cookie.includes(probe + '=1')) found = candidate;\n      document.cookie = probe + '=; Domain=' + candidate + '; Path=/; Max-Age=0; SameSite=Lax' + secure;\n    }\n  } catch {\n    found = null;\n  }\n  domainByHost.set(host, found);\n  return found;\n}\n\nfunction nativeStorage(store: 'local' | 'session'): Storage | null {\n  if (!hasWindow()) return null;\n  try {\n    return store === 'session' ? window.sessionStorage : window.localStorage;\n  } catch {\n    return null;\n  }\n}\n\nfunction cookieNames(): string[] {\n  if (!hasWindow()) return [];\n  try {\n    return document.cookie\n      .split('; ')\n      .map((part) => decodeURIComponent(part.split('=')[0] ?? ''))\n      .filter(Boolean);\n  } catch {\n    return [];\n  }\n}\n\nexport function createStorage(owner: string, options: StorageOptions = {}): GuardedStorage {\n  if (!OWNER_RE.test(owner)) {\n    throw new TypeError(`createStorage: owner \"${owner}\" must match ${OWNER_RE}`);\n  }\n  const prefix = `${owner}.`;\n  const pattern = owner === 'cfg' ? /^cfg(\\.[a-z0-9_]+)+$/ : new RegExp(`^(cfg|${owner})(\\\\.[a-z0-9_]+)+$`);\n  const cookieMaxAge = options.cookieMaxAgeSeconds ?? 60 * 60 * 24 * 30;\n  let cookiePolicy: 'auto' | string | false = options.cookieDomain ?? 'auto';\n  const resolveCookieDomain = (): string | null =>\n    cookiePolicy === false ? null : cookiePolicy === 'auto' ? detectCookieDomain() : cookiePolicy;\n  // A cookie is identified by name AND Domain: expire the twin without a domain and the one with it.\n  const expireCookie = (key: string, domain: string | null) => {\n    const secure = window.location.protocol === 'https:' ? '; Secure' : '';\n    document.cookie =\n      encodeURIComponent(key) + '=; Path=/; Max-Age=0; SameSite=Lax' + (domain ? '; Domain=' + domain : '') + secure;\n  };\n  const specs = Object.values(options.keys ?? {});\n  const families = Object.values(options.families ?? {});\n  const specByKey = new Map<string, KeySpec[]>();\n  for (const spec of specs) specByKey.set(spec.key, [...(specByKey.get(spec.key) ?? []), spec]);\n  // Held in memory when the browser refuses a write (quota, private mode), so the page still works until reload.\n  const memory: Record<KeyStore, Map<string, string>> = {\n    local: new Map(),\n    session: new Map(),\n    cookie: new Map(),\n  };\n\n  const isValid = (key: string) => pattern.test(key);\n  const assertValid = (key: string) => {\n    if (!isValid(key)) throw new TypeError(`storage key \"${key}\" must match ${pattern}`);\n  };\n  const assertOwned = (key: string) => {\n    assertValid(key);\n    if (!key.startsWith(prefix)) throw new TypeError(`storage key \"${key}\" is not owned by \"${owner}\"`);\n  };\n\n  function rawGet(store: KeyStore, key: string): string | null {\n    if (!hasWindow()) return null;\n    if (store === 'cookie') {\n      try {\n        const escaped = encodeURIComponent(key).replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n        const match = document.cookie.match(new RegExp(`(?:^|;\\\\s*)${escaped}=([^;]*)`));\n        if (match?.[1] !== undefined) return decodeURIComponent(match[1]);\n      } catch {\n        /* fall through to memory */\n      }\n      return memory.cookie.get(key) ?? null;\n    }\n    try {\n      const value = nativeStorage(store)?.getItem(key) ?? null;\n      if (value !== null) return value;\n    } catch {\n      /* fall through to memory */\n    }\n    return memory[store].get(key) ?? null;\n  }\n\n  function rawSet(store: KeyStore, key: string, value: string, maxAgeSeconds?: number): boolean {\n    if (!hasWindow()) return false;\n    try {\n      if (store === 'cookie') {\n        const secure = window.location.protocol === 'https:' ? '; Secure' : '';\n        const domain = resolveCookieDomain();\n        const domainPart = domain ? `; Domain=${domain}` : '';\n        document.cookie = `${encodeURIComponent(key)}=${encodeURIComponent(value)}; Path=/; Max-Age=${Math.max(1, Math.floor(maxAgeSeconds ?? cookieMaxAge))}; SameSite=Lax${domainPart}${secure}`;\n        // A host-only cookie written earlier would shadow the shared one: drop that twin.\n        if (domain) expireCookie(key, null);\n        if (rawGet('cookie', key) === value && !memory.cookie.has(key)) return true;\n        memory.cookie.set(key, value);\n        return false;\n      }\n      const native = nativeStorage(store);\n      if (!native) throw new Error('storage unavailable');\n      native.setItem(key, value);\n      memory[store].delete(key);\n      return true;\n    } catch {\n      memory[store].set(key, value);\n      return false;\n    }\n  }\n\n  function rawRemove(store: KeyStore, key: string): void {\n    memory[store].delete(key);\n    if (!hasWindow()) return;\n    try {\n      if (store === 'cookie') {\n        expireCookie(key, null);\n        const domain = resolveCookieDomain();\n        if (domain) expireCookie(key, domain);\n      } else {\n        nativeStorage(store)?.removeItem(key);\n      }\n    } catch {\n      /* ignore */\n    }\n  }\n\n  function resolveStore(key: string, store?: KeyStore): KeyStore {\n    return store ?? specByKey.get(key)?.[0]?.store ?? 'local';\n  }\n\n  function listKeys(store: 'local' | 'session', startsWith: string): string[] {\n    const out: string[] = [];\n    try {\n      const native = nativeStorage(store);\n      if (native) {\n        for (let i = 0; i < native.length; i += 1) {\n          const name = native.key(i);\n          if (name?.startsWith(startsWith)) out.push(name);\n        }\n      }\n    } catch {\n      /* ignore */\n    }\n    for (const name of memory[store].keys()) if (name.startsWith(startsWith) && !out.includes(name)) out.push(name);\n    return out;\n  }\n\n  const familyKey = (family: FamilySpec, id: string) => {\n    const part = normalizeSegment(id);\n    if (!part) throw new TypeError('storage family id is empty after normalisation');\n    return family.prefix + part;\n  };\n\n  const api: GuardedStorage = {\n    owner,\n    key(...parts) {\n      const segments = parts.map(normalizeSegment);\n      if (segments.length === 0 || segments.some((segment) => !segment)) {\n        throw new TypeError(`storage key parts must be non-empty: ${JSON.stringify(parts)}`);\n      }\n      return `${prefix}${segments.join('.')}`;\n    },\n    familyKey,\n    isValid,\n    read(key, store) {\n      assertValid(key);\n      const target = resolveStore(key, store);\n      return rawGet(target, key);\n    },\n    write(key, value, store, writeOptions) {\n      assertOwned(key);\n      const target = resolveStore(key, store);\n      return rawSet(target, key, value, writeOptions?.maxAgeSeconds);\n    },\n    remove(key, store) {\n      assertOwned(key);\n      const target = resolveStore(key, store);\n      rawRemove(target, key);\n    },\n    readJSON<T>(key: string, store?: KeyStore): T | null {\n      const raw = api.read(key, store);\n      if (raw === null) return null;\n      try {\n        return JSON.parse(raw) as T;\n      } catch {\n        return null;\n      }\n    },\n    writeJSON(key, value, store) {\n      return api.write(key, JSON.stringify(value), store);\n    },\n    keys(store = 'local') {\n      return listKeys(store, prefix);\n    },\n    clearAll({ all = false } = {}) {\n      for (const spec of specs) {\n        if (!all && !spec.personal) continue;\n        rawRemove(spec.store, spec.key);\n      }\n      for (const family of families) {\n        if (!all && !family.personal) continue;\n        for (const name of listKeys(family.store, family.prefix)) rawRemove(family.store, name);\n      }\n      if (all) {\n        for (const store of ['local', 'session'] as const) {\n          for (const name of listKeys(store, prefix)) rawRemove(store, name);\n        }\n        for (const name of cookieNames()) if (name.startsWith(prefix)) rawRemove('cookie', name);\n      }\n    },\n    setCookieDomain(domain) {\n      cookiePolicy = domain;\n    },\n    cookieDomain: resolveCookieDomain,\n    onChange(key, listener, store = 'local') {\n      assertValid(key);\n      if (!hasWindow()) return () => {};\n      const handler = (event: StorageEvent) => {\n        if (event.storageArea !== nativeStorage(store)) return;\n        if (event.key === null || event.key === key) listener(event.key === null ? null : event.newValue);\n      };\n      window.addEventListener('storage', handler);\n      return () => window.removeEventListener('storage', handler);\n    },\n  };\n  return api;\n}\n\n/** The framework's own storage: every `cfg.*` key. */\nexport const cfgStorage: GuardedStorage = createStorage('cfg', {\n  keys: CFG_KEYS,\n  families: CFG_FAMILIES,\n});\n\n","// AUTO-GENERATED by django_generator / ts_extras.wrapper\n// Global auth store. Wired into the shared `client` from `client.gen.ts`\n// via `installAuthOnClient(client)` — called synchronously by the\n// post-processed bottom of client.gen.ts. No circular import here.\n// DO NOT EDIT — re-run `make gen`.\n\nimport { APIError } from './errors';\nimport { cfgStorage, createStorage, type KeyStore } from './keys';\n\nconst ACCESS_KEY = 'cfg.auth.access_token';\nconst REFRESH_KEY = 'cfg.auth.refresh_token';\nconst API_KEY_KEY = 'cfg.auth.api_key';\n\n// The framework's own keys use the shared registry; a custom owner gets the same guarded helpers.\nconst storage = 'cfg' === 'cfg' ? cfgStorage : createStorage('cfg');\n\nconst isBrowser = typeof window !== 'undefined';\n\n/**\n * Auth trace hook. The reader lives in `@djangocfg/api` (`auth/trace.ts`) and installs `globalThis.__cfgAuthTrace`;\n * until it does, events queue on `globalThis` so none are lost. Never pass a token, a code or an address.\n */\ntype TraceFields = Record<string, string | number | boolean | null>;\nfunction trace(ev: string, fields?: TraceFields): void {\n  try {\n    const g = globalThis as Record<string, unknown>;\n    const sink = g.__cfgAuthTrace as ((e: string, f?: TraceFields) => void) | undefined;\n    if (sink) { sink(ev, fields); return; }\n    const queue = (g.__cfgAuthTraceQ as unknown[] | undefined) ?? [];\n    g.__cfgAuthTraceQ = queue;\n    if (queue.length < 100) queue.push([Date.now(), ev, fields]);\n  } catch { /* tracing never breaks auth */ }\n}\nfunction pathOf(url: string): string {\n  try { return new URL(url, 'http://x').pathname; } catch { return ''; }\n}\n\nexport type StorageMode = 'localStorage' | 'sessionStorage' | 'cookie';\n\n// ── Storage backends (browser-only; server-side reads return null) ─────────\n\ninterface KVStore {\n  get(key: string): string | null;\n  set(key: string, value: string | null): void;\n}\n\n/** Seconds until a JWT's `exp`, for the cookie lifetime; undefined when it has none. */\nfunction secondsUntilExp(token: string): number | undefined {\n  const exp = jwtExpMs(token);\n  return exp === null ? undefined : Math.max(1, Math.floor((exp - Date.now()) / 1000));\n}\n\n// Every read and write goes through the registry's guarded storage: SSR-safe,\n// private-mode and quota safe, and a key written under an older spelling is\n// moved to its `cfg.auth.*` name on first read.\nconst STORE_OF: Record<StorageMode, KeyStore> = {\n  localStorage: 'local',\n  sessionStorage: 'session',\n  cookie: 'cookie',\n};\n\nfunction backendFor(mode: StorageMode): KVStore {\n  const store = STORE_OF[mode];\n  return {\n    get: (key) => storage.read(key, store),\n    set(key, value) {\n      if (value === null) storage.remove(key, store);\n      // The refresh cookie lives as long as the refresh token; everything else takes the default.\n      else storage.write(key, value, store, store === 'cookie' && key === REFRESH_KEY ? { maxAgeSeconds: secondsUntilExp(value) } : undefined);\n    },\n  };\n}\n\n/**\n * The session backend: a cookie shared by every subdomain of the registrable\n * domain (`Domain=example.com`, found by asking the browser), so signing in on\n * `my.example.com` signs in `example.com` and `studio.example.com`, and so\n * Next.js `cookies()` can read the token during SSR. Django never reads this\n * cookie (the API authenticates the `Authorization` header), so it is no CSRF\n * surface.\n *\n * `setStorageMode('localStorage')` opts a host out, once at bootstrap. It is NOT\n * a per-login switch: this value lives in module memory and\n * resets to the default on every page load, so tokens written to a non-default\n * backend after startup would be stranded — present in the browser, invisible\n * to the client, and every request would go out unauthenticated.\n *\n * Session LENGTH is therefore not a client concern. The server decides it when\n * minting the refresh token; the client just stores whatever it\n * was given, in one place.\n */\nlet _storageMode: StorageMode = 'cookie';\nlet _storage: KVStore = backendFor(_storageMode);\n// The API key is per browser, not per domain family: always localStorage.\nconst _apiKeyStore: KVStore = backendFor('localStorage');\n\n/** One-time move of a session an older build kept in localStorage into the shared cookie. */\nfunction adoptLegacySession(): void {\n  if (!isBrowser || _storageMode !== 'cookie') return;\n  try {\n    if (_storage.get(ACCESS_KEY) !== null || _storage.get(REFRESH_KEY) !== null) return;\n    const legacy = backendFor('localStorage');\n    const access = legacy.get(ACCESS_KEY);\n    const refresh = legacy.get(REFRESH_KEY);\n    if (access === null && refresh === null) return;\n    if (access !== null) _storage.set(ACCESS_KEY, access);\n    if (refresh !== null) _storage.set(REFRESH_KEY, refresh);\n    legacy.set(ACCESS_KEY, null);\n    legacy.set(REFRESH_KEY, null);\n  } catch {}\n}\nadoptLegacySession();\n\n/** Detect locale from `NEXT_LOCALE` cookie or `navigator.language`. */\nfunction detectLocale(): string | null {\n  try {\n    // BROWSER ONLY, and `document` is what decides that.\n    //\n    // `navigator` used to be the browser test and no longer is: Node 18+\n    // defines `navigator.language`, so on a server this returned the HOST's\n    // locale — `en-US` on most machines — and every server-rendered request\n    // carried `Accept-Language: en-US` no matter which locale the page was\n    // being rendered for. A valid header stating the wrong thing, which is\n    // worse than none: nothing looks broken.\n    //\n    // A server caller that knows its locale passes it explicitly with\n    // `setLocale()`. There is nothing here to detect it FROM — the request is\n    // the framework's, not this module's.\n    if (typeof document === 'undefined') return null;\n\n    const m = document.cookie.match(/(?:^|;\\s*)NEXT_LOCALE=([^;]*)/);\n    const locale = m?.[1];\n    if (locale !== undefined) return decodeURIComponent(locale);\n\n    if (typeof navigator !== 'undefined' && navigator.language) {\n      return navigator.language;\n    }\n  } catch {}\n  return null;\n}\n\n/** Default baseUrl.\n *\n * Browser: uses NEXT_PUBLIC_API_PROXY_URL if set (empty string = same-origin\n * Next.js proxy), otherwise falls back to NEXT_PUBLIC_API_URL directly.\n * Set NEXT_PUBLIC_API_PROXY_URL='' in apps that proxy /apix/* via Next.js\n * Route Handler; leave it unset in apps that hit Django directly.\n *\n * Server (SSR / RSC / Edge): use NEXT_PUBLIC_API_URL so server-side fetch\n * reaches Django directly (proxy is a same-origin HTTP round-trip on server).\n */\nfunction defaultBaseUrl(): string {\n  if (typeof window !== 'undefined') {\n    try {\n      if (typeof process !== 'undefined' && process.env) {\n        if (process.env.NEXT_PUBLIC_STATIC_BUILD === 'true') return '';\n        // NEXT_PUBLIC_API_PROXY_URL='' means same-origin proxy (e.g. /apix/* route handler).\n        // Next.js inlines defined vars as their value; undefined means the var was not set.\n        if (process.env.NEXT_PUBLIC_API_PROXY_URL !== undefined)\n          return process.env.NEXT_PUBLIC_API_PROXY_URL;\n        return process.env.NEXT_PUBLIC_API_URL || '';\n      }\n    } catch {}\n    return '';\n  }\n  try {\n    if (typeof process !== 'undefined' && process.env) {\n      if (process.env.NEXT_PUBLIC_STATIC_BUILD === 'true') return '';\n      return process.env.NEXT_PUBLIC_API_URL || '';\n    }\n  } catch {}\n  return '';\n}\n\n/** The browser's IANA zone; null where Intl cannot tell (e.g. a bare server runtime). */\nfunction detectTimezone(): string | null {\n  try {\n    return Intl.DateTimeFormat().resolvedOptions().timeZone || null;\n  } catch {\n    return null;\n  }\n}\n\n/** Default API key fallback from `NEXT_PUBLIC_API_KEY`.\n *\n * Both browser and server: if NEXT_PUBLIC_API_KEY is set it is used as a\n * global fallback (e.g. a public demo key). When not set, returns null so\n * per-request keys passed via options.headers take effect unobstructed.\n */\nfunction defaultApiKey(): string | null {\n  try {\n    if (typeof process !== 'undefined' && process.env?.NEXT_PUBLIC_API_KEY) {\n      return process.env.NEXT_PUBLIC_API_KEY;\n    }\n  } catch {}\n  return null;\n}\n\n// ── In-memory overrides (win over storage / env) ───────────────────────────\nlet _localeOverride: string | null = null;\nlet _timezoneOverride: string | null = null;\nlet _apiKeyOverride: string | null = null;\nlet _baseUrlOverride: string | null = null;\nlet _withCredentials = true;\nlet _onUnauthorized: ((response: Response) => void) | null = null;\n\n/**\n * User-supplied refresh handler. Receives the current refresh token,\n * must return a fresh access (and optional refresh) pair or null on failure.\n * Set once at app bootstrap via `auth.setRefreshHandler(...)`.\n */\ntype RefreshResult = { access: string; refresh?: string } | null;\ntype RefreshHandler = (refreshToken: string) => Promise<RefreshResult>;\nlet _refreshHandler: RefreshHandler | null = null;\n\n/** Single-flight: every concurrent 401 awaits the same refresh. */\nlet _refreshInflight: Promise<string | null> | null = null;\n\n/** Marker header — set on retried requests so we never loop on 401. */\nconst RETRY_MARKER = 'X-Auth-Retry';\n\n// ── Reactive session snapshot ───────────────────────────────────────────────\n//\n// The store is the single source of truth for \"am I logged in\". React (or any\n// listener) subscribes via `auth.subscribe` + `auth.getSnapshot` — designed to\n// plug straight into `useSyncExternalStore`. The snapshot flips automatically\n// on: token writes, refresh success/failure, cross-tab storage events, and an\n// internal timer armed to the next JWT `exp` boundary.\n\nexport type SessionStatus = 'authenticated' | 'anonymous';\n\nexport type SessionSnapshot = {\n  /** 'authenticated' = a live access token OR a live refresh token exists. */\n  status: SessionStatus;\n  /** ms-epoch expiry of the current access token (null: no token / no exp). */\n  accessExpiresAt: number | null;\n};\n\n/** Decode a JWT `exp` claim to ms epoch. Null on any malformed input. */\nfunction jwtExpMs(token: string): number | null {\n  try {\n    const payload = token.split('.')[1];\n    if (!payload) return null;\n    const json = JSON.parse(atob(payload.replace(/-/g, '+').replace(/_/g, '/')));\n    return typeof json.exp === 'number' ? json.exp * 1000 : null;\n  } catch { return null; }\n}\n\nfunction computeSnapshot(): SessionSnapshot {\n  const access = _storage.get(ACCESS_KEY);\n  const refresh = _storage.get(REFRESH_KEY);\n  const now = Date.now();\n  const accessExp = access ? jwtExpMs(access) : null;\n  const accessAlive = access !== null && (accessExp === null || accessExp > now);\n  const refreshExp = refresh ? jwtExpMs(refresh) : null;\n  const refreshAlive = refresh !== null && (refreshExp === null || refreshExp > now);\n  return {\n    status: accessAlive || refreshAlive ? 'authenticated' : 'anonymous',\n    accessExpiresAt: accessExp,\n  };\n}\n\n/** Stable object for SSR — `useSyncExternalStore` needs referential equality. */\nconst SERVER_SNAPSHOT: SessionSnapshot = { status: 'anonymous', accessExpiresAt: null };\n\n/** Same-tab, cross-store sync channel. An app can host several copies of this\n * generated store (separate JS modules) sharing the same storage keys; the\n * `storage` event only fires in OTHER tabs, so a window event bridges them\n * synchronously within the tab (login in one store flips all of them). */\nconst SESSION_SYNC_EVENT = `cfg-auth:changed:${ACCESS_KEY}`;\n\nlet _snapshot: SessionSnapshot = computeSnapshot();\nconst _sessionListeners = new Set<() => void>();\nlet _expiryTimer: ReturnType<typeof setTimeout> | null = null;\nlet _storageListenerInstalled = false;\n\n/** Re-arm the timer that flips the snapshot exactly when a token expires. */\nfunction scheduleExpiryFlip(): void {\n  if (!isBrowser) return;\n  if (_expiryTimer !== null) { clearTimeout(_expiryTimer); _expiryTimer = null; }\n  if (_sessionListeners.size === 0) return;\n  const now = Date.now();\n  const exps: number[] = [];\n  const access = _storage.get(ACCESS_KEY);\n  const refresh = _storage.get(REFRESH_KEY);\n  const accessExp = access ? jwtExpMs(access) : null;\n  const refreshExp = refresh ? jwtExpMs(refresh) : null;\n  if (accessExp !== null && accessExp > now) exps.push(accessExp);\n  if (refreshExp !== null && refreshExp > now) exps.push(refreshExp);\n  if (!exps.length) return;\n  // +250ms grace so the token is REALLY expired when we flip; clamp to the\n  // max signed-32-bit setTimeout delay (~24.8 days).\n  const delay = Math.min(Math.min(...exps) - now + 250, 0x7fffffff);\n  _expiryTimer = setTimeout(notifySessionChanged, delay);\n}\n\n/** Recompute the snapshot; notify subscribers only when it actually changed. */\nfunction notifySessionChanged(): void {\n  const next = computeSnapshot();\n  const changed =\n    next.status !== _snapshot.status ||\n    next.accessExpiresAt !== _snapshot.accessExpiresAt;\n  if (changed) { _snapshot = next; trace('store.snapshot', { status: next.status }); }\n  scheduleExpiryFlip();\n  if (!changed) return;\n  for (const listener of Array.from(_sessionListeners)) {\n    try { listener(); } catch {}\n  }\n  // Wake sibling stores in this tab. Re-entrant but convergent: a store that\n  // recomputes to the SAME snapshot doesn't re-dispatch, so the cascade stops\n  // after every store has caught up.\n  if (isBrowser) {\n    try { window.dispatchEvent(new Event(SESSION_SYNC_EVENT)); } catch {}\n  }\n}\n\n/** Cross-tab + cross-store sync — `storage` events only fire in OTHER tabs;\n * the window event covers sibling stores in THIS tab. Either way a login or\n * logout anywhere flips every snapshot reading the same keys. */\nfunction ensureStorageSync(): void {\n  if (!isBrowser || _storageListenerInstalled) return;\n  _storageListenerInstalled = true;\n  window.addEventListener('storage', (e) => {\n    if (e.key === null || e.key === ACCESS_KEY || e.key === REFRESH_KEY) {\n      notifySessionChanged();\n    }\n  });\n  window.addEventListener(SESSION_SYNC_EVENT, () => notifySessionChanged());\n  // Cookies fire no `storage` event: a sign-in or sign-out on another subdomain is\n  // picked up when this page is looked at again (or at once where `cookieStore` exists).\n  window.addEventListener('focus', () => notifySessionChanged());\n  document.addEventListener('visibilitychange', () => {\n    if (document.visibilityState === 'visible') notifySessionChanged();\n  });\n  try {\n    (window as unknown as { cookieStore?: EventTarget }).cookieStore?.addEventListener('change', () => notifySessionChanged());\n  } catch {}\n}\n\n/**\n * Terminal-401 subscribers. Unlike the single `onUnauthorized` slot these\n * compose: each registration returns its own unsubscribe, so StrictMode\n * double-mounts and multiple packages can't clobber each other.\n *\n * THE SET LIVES ON `globalThis`, and it has to.\n *\n * An app that generates its own SDK gets its own compiled copy of this file,\n * while `AuthProvider` comes from `@djangocfg/api/dist` — a second copy, with\n * its own module scope. Tokens survive that split because both copies read the\n * same storage keys and wake each other through `SESSION_SYNC_EVENT`; a plain\n * module-level `Set` does not. So the app's copy raised the terminal 401 into\n * an empty set while the provider sat subscribed to the other one, and the\n * redirect `AuthContext` calls \"the ONE exit\" never fired: the cabinet kept\n * polling a dead session and the customer watched the console fill with 401s\n * instead of being sent to sign in. Carapis reported ten of them.\n *\n * Keyed by `ACCESS_KEY` for the same reason `SESSION_SYNC_EVENT` is: two\n * stores configured against different token keys are different sessions and\n * must not share subscribers.\n */\ntype SessionExpiredHandler = (response: Response) => void;\n\nconst SESSION_EXPIRED_REGISTRY = `cfg-auth:expired-handlers:${ACCESS_KEY}`;\n\nconst _sessionExpiredHandlers: Set<SessionExpiredHandler> = (() => {\n  // No browser guard: Node/SSR has a `globalThis` too, the registry is\n  // per-realm either way, and a server render simply never fires.\n  const g = globalThis as Record<string, unknown>;\n  const existing = g[SESSION_EXPIRED_REGISTRY];\n  if (existing instanceof Set) return existing as Set<SessionExpiredHandler>;\n  const created = new Set<SessionExpiredHandler>();\n  g[SESSION_EXPIRED_REGISTRY] = created;\n  return created;\n})();\n\n/**\n * Captured reference to the shared Hey API client. Set exactly once by\n * `installAuthOnClient(client)` (called from client.gen.ts). All `auth.set*`\n * methods that mutate transport config (baseUrl / credentials) push through\n * this reference. Until installed, those mutations are silently buffered as\n * in-memory state — the next request after install will pick them up.\n */\ntype HeyClient = {\n  setConfig(opts: Record<string, unknown>): void;\n  interceptors: {\n    request: { use(fn: (req: Request) => Request | Promise<Request>): void };\n    response: { use(fn: (res: Response, req: Request) => Response | Promise<Response>): void };\n    error: { use(fn: (err: unknown, res: Response | undefined, req: Request | undefined, opts: unknown) => unknown): void };\n  };\n};\nlet _client: HeyClient | null = null;\n\nfunction pushClientConfig(): void {\n  if (!_client) return;\n  _client.setConfig({\n    baseUrl: auth.getBaseUrl(),\n    credentials: _withCredentials ? 'include' : 'same-origin',\n  });\n}\n\n/**\n * Global auth/config store. All getters read live state every call —\n * the interceptor below uses these to attach headers per-request.\n *\n * Default storage backend is `localStorage`. Switch to cookies (e.g.\n * for Next.js SSR cookie access) via `auth.setStorageMode('cookie')`\n * early in the app bootstrap.\n *\n * @example\n *   import { auth } from '@your/api';\n *   auth.setToken(jwt);\n *   auth.clearTokens();\n *   auth.setStorageMode('cookie');\n */\nexport const auth = {\n  // ── Storage mode ──────────────────────────────────────────────────\n  getStorageMode(): StorageMode { return _storageMode; },\n  /** Relocate the session backend. Call once at bootstrap, before any sign-in:\n   *  the mode is module state and resets on reload, so a later switch strands\n   *  whatever was written after it. */\n  setStorageMode(mode: StorageMode): void {\n    _storageMode = mode;\n    _storage = backendFor(mode);\n    notifySessionChanged();\n  },\n\n  // ── Shared cookie domain ──────────────────────────────────────────\n  /** `'auto'` (default): the registrable domain of the page. A domain forces it; `null` keeps\n   *  cookies host-only (no sign-in sharing between subdomains). Call before sign-in. */\n  setCookieDomain(domain: 'auto' | string | null): void {\n    storage.setCookieDomain(domain === null ? false : domain);\n    notifySessionChanged();\n  },\n  /** The `Domain` the session cookie is written with; `null` = host-only. */\n  getCookieDomain(): string | null { return storage.cookieDomain(); },\n\n  // ── Bearer token ──────────────────────────────────────────────────\n  getToken(): string | null { return _storage.get(ACCESS_KEY); },\n  setToken(token: string | null): void {\n    trace('store.setToken', { present: token !== null });\n    _storage.set(ACCESS_KEY, token);\n    notifySessionChanged();\n  },\n  getRefreshToken(): string | null { return _storage.get(REFRESH_KEY); },\n  setRefreshToken(token: string | null): void {\n    trace('store.setRefreshToken', { present: token !== null });\n    _storage.set(REFRESH_KEY, token);\n    notifySessionChanged();\n  },\n  clearTokens(): void {\n    trace('store.clearTokens');\n    // Clear every backend, not just the active one. Sign-out must leave nothing\n    // behind anywhere — including tokens an older build stranded in\n    // sessionStorage — or the next page load could resurrect a dead session.\n    for (const mode of ['localStorage', 'sessionStorage', 'cookie'] as const) {\n      const backend = backendFor(mode);\n      backend.set(ACCESS_KEY, null);\n      backend.set(REFRESH_KEY, null);\n    }\n    // The rest of the signed-in user's keys (profile cache, OAuth leftovers) go with the tokens.\n    storage.clearAll();\n    notifySessionChanged();\n  },\n  /** Session-aware: token PRESENT and not past its `exp` (or a live refresh\n   * token exists that can mint one). Prefer `getSnapshot().status` in React. */\n  isAuthenticated(): boolean { return computeSnapshot().status === 'authenticated'; },\n\n  // ── Session (the ONE write path for login/logout flows) ──────────\n  /**\n   * Persist a token pair atomically. Every login flow (OTP verify, 2FA,\n   * OAuth callback) and the refresh handler should end here — do NOT\n   * scatter `setToken`/`setRefreshToken` pairs through app code.\n   * `refresh: undefined` keeps the current refresh token (access-only\n   * rotation); `refresh: null` explicitly drops it.\n   */\n  setSession(tokens: { access: string; refresh?: string | null }): void {\n    trace('store.setSession', { refresh: tokens.refresh === undefined ? 'kept' : tokens.refresh === null ? 'dropped' : 'set' });\n    _storage.set(ACCESS_KEY, tokens.access);\n    if (tokens.refresh !== undefined) _storage.set(REFRESH_KEY, tokens.refresh);\n    notifySessionChanged();\n  },\n  clearSession(): void { auth.clearTokens(); },\n\n  // ── Reactive snapshot (for useSyncExternalStore) ──────────────────\n  /**\n   * @example React:\n   *   const session = useSyncExternalStore(\n   *     auth.subscribe, auth.getSnapshot, auth.getServerSnapshot,\n   *   );\n   *   const isAuthenticated = session.status === 'authenticated';\n   */\n  getSnapshot(): SessionSnapshot { return _snapshot; },\n  getServerSnapshot(): SessionSnapshot { return SERVER_SNAPSHOT; },\n  subscribe(listener: () => void): () => void {\n    ensureStorageSync();\n    _sessionListeners.add(listener);\n    // Sync state & arm the expiry timer now that someone is listening.\n    notifySessionChanged();\n    return () => {\n      _sessionListeners.delete(listener);\n      if (_sessionListeners.size === 0 && _expiryTimer !== null) {\n        clearTimeout(_expiryTimer);\n        _expiryTimer = null;\n      }\n    };\n  },\n\n  /**\n   * Fired on TERMINAL 401 — after the refresh+retry path is exhausted.\n   * The store has already cleared the session before calling back, so\n   * handlers only need to route to login (no clear-then-redirect\n   * ordering to get wrong). Returns an unsubscribe function; multiple\n   * handlers compose (unlike the legacy single-slot `onUnauthorized`).\n   */\n  onSessionExpired(cb: SessionExpiredHandler): () => void {\n    _sessionExpiredHandlers.add(cb);\n    return () => { _sessionExpiredHandlers.delete(cb); };\n  },\n\n  // ── API key ───────────────────────────────────────────────────────\n  getApiKey(): string | null {\n    return _apiKeyOverride ?? _apiKeyStore.get(API_KEY_KEY) ?? defaultApiKey();\n  },\n  setApiKey(key: string | null): void { _apiKeyOverride = key; },\n  setApiKeyPersist(key: string | null): void {\n    _apiKeyOverride = key;\n    _apiKeyStore.set(API_KEY_KEY, key);\n  },\n  clearApiKey(): void { _apiKeyOverride = null; _apiKeyStore.set(API_KEY_KEY, null); },\n\n  // ── Locale ────────────────────────────────────────────────────────\n  getLocale(): string | null { return _localeOverride ?? detectLocale(); },\n  setLocale(locale: string | null): void { _localeOverride = locale; },\n\n  // ── Time zone ─────────────────────────────────────────────────────\n  // IANA name sent as `X-Timezone`. `null` override = follow the browser.\n  getTimezone(): string | null { return _timezoneOverride ?? detectTimezone(); },\n  setTimezone(timezone: string | null): void { _timezoneOverride = timezone; },\n\n  // ── Base URL ──────────────────────────────────────────────────────\n  getBaseUrl(): string {\n    const url = (_baseUrlOverride ?? defaultBaseUrl());\n    return url.replace(/\\/$/, '');\n  },\n  setBaseUrl(url: string | null): void {\n    _baseUrlOverride = url ? url.replace(/\\/$/, '') : null;\n    pushClientConfig();\n  },\n\n  // ── Credentials toggle ────────────────────────────────────────────\n  getWithCredentials(): boolean { return _withCredentials; },\n  setWithCredentials(value: boolean): void {\n    _withCredentials = value;\n    pushClientConfig();\n  },\n\n  // ── 401 handler ───────────────────────────────────────────────────\n  /**\n   * Fired when the server returns 401 AND no refresh path recovers it\n   * (no refresh token, no refresh handler, refresh failed, or retry\n   * still 401). The app should clear local state and redirect to login.\n   *\n   * NOT fired for 401 that gets transparently recovered by the refresh\n   * handler — those are invisible to callers.\n   */\n  onUnauthorized(cb: ((response: Response) => void) | null): void {\n    _onUnauthorized = cb;\n  },\n\n  /**\n   * Register the refresh strategy. The handler receives the current\n   * refresh token and must call your refresh endpoint, returning\n   * `{ access, refresh? }` on success or `null` on failure.\n   *\n   * @example\n   *   auth.setRefreshHandler(async (refresh) => {\n   *     const { data } = await Auth.tokenRefreshCreate({ body: { refresh } });\n   *     return data ? { access: data.access, refresh: data.refresh } : null;\n   *   });\n   */\n  setRefreshHandler(fn: RefreshHandler | null): void {\n    _refreshHandler = fn;\n  },\n\n  /**\n   * Proactively run the registered refresh handler right now, reusing the\n   * SAME single-flight promise as the 401-recovery interceptor. Callers\n   * (e.g. an expiry timer / focus / reconnect) get token rotation,\n   * de-duplication and rotated-token persistence for free — they must NOT\n   * re-implement any of it. Returns the fresh access token, or null if\n   * there is no handler / no refresh token / the refresh failed.\n   */\n  refreshNow(): Promise<string | null> {\n    return tryRefresh();\n  },\n};\n\n/**\n * Run the user-supplied refresh handler, persist the rotated tokens, and\n * return the fresh access token (or null on any failure path).\n *\n * TWO layers of coordination, because a single app can host MULTIPLE copies of\n * this generated store (e.g. `@djangocfg/api` + a locally-generated client +\n * `@djangocfg/monitor`), all sharing the SAME refresh token in storage:\n *\n *   1. Per-store single-flight (`_refreshInflight`) — concurrent 401s WITHIN\n *      this module coalesce onto one promise. Fast path, no lock.\n *   2. Cross-store mutex (`navigator.locks`) keyed on the refresh-token storage\n *      key — serializes refreshes across EVERY store in the app. The refresh\n *      token is re-read INSIDE the lock, so if another store already rotated it\n *      (SimpleJWT `ROTATE_REFRESH_TOKENS` blacklists the old one), the loser\n *      picks up the fresh access token instead of re-POSTing a blacklisted\n *      refresh token and getting a spurious 401 → logout.\n *\n * Web Locks is browser-only; on SSR / older runtimes we degrade gracefully to\n * layer 1 alone (correct whenever at most one store refreshes).\n */\nasync function tryRefresh(): Promise<string | null> {\n  if (_refreshInflight) return _refreshInflight;\n  if (!_refreshHandler) return null;\n\n  // The critical section — re-reads the refresh token every time it runs, so a\n  // rotation performed by another store (or by us on a prior attempt) is always\n  // observed. Returns the fresh access token, or null on any failure.\n  const runRefresh = async (): Promise<string | null> => {\n    const refresh = auth.getRefreshToken();\n    if (!refresh) return null;\n    const result = await _refreshHandler!(refresh);\n    if (!result?.access) { trace('refresh', { ok: false, why: 'no-access' }); return null; }\n    trace('refresh', { ok: true, rotated: Boolean(result.refresh) });\n    auth.setToken(result.access);\n    if (result.refresh) auth.setRefreshToken(result.refresh);\n    return result.access;\n  };\n\n  _refreshInflight = (async () => {\n    try {\n      // Serialize across all stores in this app when Web Locks is available.\n      const locks =\n        typeof navigator !== 'undefined'\n          ? (navigator as Navigator & { locks?: LockManager }).locks\n          : undefined;\n      if (locks?.request) {\n        return await locks.request(`${REFRESH_KEY}:refresh`, runRefresh);\n      }\n      return await runRefresh();\n    } catch {\n      trace('refresh', { ok: false, why: 'threw' });\n      return null;\n    } finally {\n      _refreshInflight = null;\n    }\n  })();\n\n  return _refreshInflight;\n}\n\n/**\n * Terminal 401 — no refresh path can recover this session. The store clears\n * its own tokens FIRST (subscribers flip to 'anonymous' via the snapshot),\n * then notifies `onSessionExpired` subscribers and the legacy\n * `onUnauthorized` slot. Apps only route to login; they never own the\n * clear-before-redirect ordering.\n */\nfunction expireSession(response: Response, why: string): void {\n  trace('store.expire', { why, status: response.status, path: pathOf(response.url), handlers: _sessionExpiredHandlers.size });\n  auth.clearTokens();\n  for (const cb of Array.from(_sessionExpiredHandlers)) {\n    try { cb(response); } catch {}\n  }\n  if (_onUnauthorized) {\n    try { _onUnauthorized(response); } catch {}\n  }\n}\n\n/**\n * Wire the shared client to the global auth store. Called exactly\n * once from `client.gen.ts` (post-processed) right after\n * `createClient()`. Synchronous — no microtask, no TDZ races.\n *\n * Safe to call from server / SSR: storage backends short-circuit on\n * non-browser environments, so headers populated by the interceptor\n * are simply absent server-side (which is the correct behaviour\n * unless the caller explicitly sets a server-side token).\n *\n * ── How API key auth works ────────────────────────────────────────────────\n *\n * There are three ways to supply X-API-Key, in priority order:\n *\n *   1. Per-request header (highest priority, overrides everything):\n *        SomeApi.someEndpoint({ headers: { 'X-API-Key': userKey } })\n *      Use this in playgrounds or any context where the key comes from\n *      user input rather than app config.\n *\n *   2. Global override via auth.setApiKey(key) — applies to every request\n *      from this client until cleared. Good for single-user sessions.\n *\n *   3. NEXT_PUBLIC_API_KEY env var — read by defaultApiKey() on every request.\n *      Use as a public fallback key (e.g. a shared demo key for unauthenticated\n *      visitors). When not set, returns null so per-request keys work freely.\n *\n * ── baseUrl gotcha with proxy packages ───────────────────────────────────\n *\n * If another package (e.g. @carapis/catalog-api/client) calls\n * `auth.setBaseUrl('')` on import, ALL requests from this shared client\n * will go to relative paths (Next.js proxy) instead of hitting Django\n * directly. This is intentional for the public catalog — but breaks any\n * feature that needs to reach Django with a dynamic API key from the\n * browser (e.g. a playground).\n *\n * Fix: pass `baseUrl` explicitly per-call to override the global setting:\n *   SomeApi.someEndpoint({\n *     baseUrl: process.env.NEXT_PUBLIC_API_URL,\n *     headers: { 'X-API-Key': userKey },\n *   })\n */\n// ── DPoP (RFC 9449) — sender-constrained tokens ────────────────────────────\n//\n// When NEXT_PUBLIC_DPOP_ENABLED === 'true', the client holds a P-256 keypair\n// whose PRIVATE key is non-extractable (Web Crypto `extractable:false`) and\n// stored in IndexedDB. JS — including XSS — can sign with it but can NEVER read\n// it. Each request carries a fresh `DPoP` proof signed by that key; the backend\n// binds the token to the key (`cnf.jkt`) and rejects any request whose proof key\n// doesn't match. A stolen token is therefore useless to an attacker.\n//\n// Dormant unless the env flag is on — bearer-mode apps are unaffected.\n\nfunction dpopEnabled(): boolean {\n  try {\n    return typeof process !== 'undefined'\n      && process.env?.NEXT_PUBLIC_DPOP_ENABLED === 'true';\n  } catch { return false; }\n}\n\nconst _DPOP_DB = 'cfg.auth.dpop';\nconst _DPOP_STORE = 'keys';\nconst _DPOP_KEY_ID = 'dpop-ec-p256';\n\nfunction _idbOpen(): Promise<IDBDatabase> {\n  return new Promise((resolve, reject) => {\n    const req = indexedDB.open(_DPOP_DB, 1);\n    req.onupgradeneeded = () => req.result.createObjectStore(_DPOP_STORE);\n    req.onsuccess = () => resolve(req.result);\n    req.onerror = () => reject(req.error);\n  });\n}\n\nfunction _idbGet(key: string): Promise<CryptoKeyPair | undefined> {\n  return _idbOpen().then((db) => new Promise((resolve, reject) => {\n    const tx = db.transaction(_DPOP_STORE, 'readonly');\n    const req = tx.objectStore(_DPOP_STORE).get(key);\n    req.onsuccess = () => resolve(req.result);\n    req.onerror = () => reject(req.error);\n  }));\n}\n\nfunction _idbPut(key: string, value: CryptoKeyPair): Promise<void> {\n  return _idbOpen().then((db) => new Promise((resolve, reject) => {\n    const tx = db.transaction(_DPOP_STORE, 'readwrite');\n    tx.objectStore(_DPOP_STORE).put(value, key);\n    tx.oncomplete = () => resolve();\n    tx.onerror = () => reject(tx.error);\n  }));\n}\n\n/** Single-flight keypair init — the private key is created non-extractable. */\nlet _dpopKeyPromise: Promise<CryptoKeyPair> | null = null;\n\nfunction _getDpopKeyPair(): Promise<CryptoKeyPair> {\n  if (_dpopKeyPromise) return _dpopKeyPromise;\n  _dpopKeyPromise = (async () => {\n    const existing = await _idbGet(_DPOP_KEY_ID).catch(() => undefined);\n    if (existing) return existing;\n    const pair = await crypto.subtle.generateKey(\n      { name: 'ECDSA', namedCurve: 'P-256' },\n      false, // extractable:false — JS can sign but never export the private key\n      ['sign'],\n    );\n    // CryptoKey is structured-cloneable; IndexedDB persists it across reloads\n    // WITHOUT ever exposing raw key bytes to JS.\n    await _idbPut(_DPOP_KEY_ID, pair).catch(() => {});\n    return pair;\n  })();\n  return _dpopKeyPromise;\n}\n\nfunction _b64urlFromBytes(bytes: ArrayBuffer | Uint8Array): string {\n  const arr = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);\n  let s = '';\n  for (let i = 0; i < arr.length; i++) s += String.fromCharCode(arr[i] ?? 0);\n  return btoa(s).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n\nfunction _b64urlFromString(str: string): string {\n  return _b64urlFromBytes(new TextEncoder().encode(str));\n}\n\n/** ECDSA raw signature (r||s) → JOSE base64url (Web Crypto already returns raw). */\nasync function _publicJwk(pub: CryptoKey): Promise<Record<string, string>> {\n  const jwk = await crypto.subtle.exportKey('jwk', pub);\n  // Public components only — required RFC 7638 members for EC.\n  return { kty: 'EC', crv: 'P-256', x: jwk.x as string, y: jwk.y as string };\n}\n\n/** Build a DPoP proof JWT for this request (htm/htu/iat/jti), signed in-key. */\nasync function _makeDpopProof(method: string, url: string): Promise<string | null> {\n  try {\n    const pair = await _getDpopKeyPair();\n    const jwk = await _publicJwk(pair.publicKey);\n    const header = { typ: 'dpop+jwt', alg: 'ES256', jwk };\n    // htu = scheme://authority/path without query/fragment.\n    const withoutFragment = url.split('#')[0] ?? url;\n    const htu = withoutFragment.split('?')[0] ?? withoutFragment;\n    const jti =\n      (crypto.randomUUID && crypto.randomUUID()) ||\n      _b64urlFromBytes(crypto.getRandomValues(new Uint8Array(16)));\n    const payload = { htm: method.toUpperCase(), htu, iat: Math.floor(Date.now() / 1000), jti };\n    const signingInput =\n      `${_b64urlFromString(JSON.stringify(header))}.${_b64urlFromString(JSON.stringify(payload))}`;\n    const sig = await crypto.subtle.sign(\n      { name: 'ECDSA', hash: 'SHA-256' },\n      pair.privateKey,\n      new TextEncoder().encode(signingInput),\n    );\n    return `${signingInput}.${_b64urlFromBytes(sig)}`;\n  } catch {\n    return null; // never break a request because proof generation failed\n  }\n}\n\nexport function installAuthOnClient(client: HeyClient): void {\n  if (_client) return; // idempotent\n  _client = client;\n\n  client.setConfig({\n    baseUrl: auth.getBaseUrl(),\n    credentials: _withCredentials ? 'include' : 'same-origin',\n  });\n\n  client.interceptors.request.use(async (request) => {\n    const token = auth.getToken();\n    if (token) request.headers.set('Authorization', `Bearer ${token}`);\n\n    const locale = auth.getLocale();\n    if (locale) request.headers.set('Accept-Language', locale);\n\n    // Only set X-API-Key from global store if NOT already present on the\n    // request — per-request headers take precedence.\n    const apiKey = auth.getApiKey();\n    if (apiKey && !request.headers.has('X-API-Key')) request.headers.set('X-API-Key', apiKey);\n\n    const tz = auth.getTimezone();\n    if (tz) request.headers.set('X-Timezone', tz);\n    request.headers.set('X-Client-Time', new Date().toISOString());\n\n    // DPoP proof — sign a fresh per-request proof with the non-extractable key.\n    // Only in a browser, only when enabled. Failure is non-fatal (proof null).\n    if (dpopEnabled() && typeof window !== 'undefined') {\n      const proof = await _makeDpopProof(request.method, request.url);\n      if (proof) request.headers.set('DPoP', proof);\n    }\n\n    return request;\n  });\n\n  client.interceptors.error.use((err, res, req) => {\n    if (err instanceof APIError) return err;\n    const url = (req as Request | undefined)?.url ?? '';\n    const status = (res as Response | undefined)?.status ?? 0;\n    const statusText = (res as Response | undefined)?.statusText ?? '';\n    return new APIError(status, statusText, err, url);\n  });\n\n\n  client.interceptors.response.use(async (response, request) => {\n    if (response.status !== 401) return response;\n\n    // A refusal from the sign-in endpoints themselves (wrong OTP / password, bad OAuth code) is a credential error, not\n    // a dead session: expiring here reloads the sign-in page and wipes the error the user is reading.\n    if (/\\/accounts\\/(otp|oauth|login|register|token)\\b/.test(request.url)) {\n      trace('401.passthrough', { path: pathOf(request.url) });\n      return response;\n    }\n\n    // Already retried once — give up to avoid loops.\n    if (request.headers.get(RETRY_MARKER)) {\n      expireSession(response, 'retry-marker');\n      return response;\n    }\n\n    const newToken = await tryRefresh();\n    if (!newToken) {\n      expireSession(response, 'refresh-failed');\n      return response;\n    }\n\n    // Retry the original request once with the new token. We mutate a\n    // clone so the original Request body (already consumed by the\n    // failed call) doesn't trip \"body already used\".\n    const retry = request.clone();\n    retry.headers.set('Authorization', `Bearer ${newToken}`);\n    retry.headers.set(RETRY_MARKER, '1');\n    // This retry uses raw fetch() and bypasses the request interceptor, so the\n    // DPoP proof must be re-attached here or a bound token would 401 on retry.\n    if (dpopEnabled() && typeof window !== 'undefined') {\n      const proof = await _makeDpopProof(retry.method, retry.url);\n      if (proof) retry.headers.set('DPoP', proof);\n    }\n    try {\n      const retried = await fetch(retry);\n      if (retried.status === 401) expireSession(retried, 'retry-401');\n      return retried;\n    } catch {\n      // Network error on the retry. The refresh SUCCEEDED (we hold a fresh\n      // token), so the session is alive — a transient network blip must NOT\n      // log the user out. Surface the original 401 to the caller only.\n      return response;\n    }\n  });\n}\n\n// ── Default refresh handler (auto-registered) ──────────────────────────────\n//\n// POSTs straight to the SimpleJWT refresh endpoint so a 401 transparently\n// refreshes and retries. Registered at import time; an app can override it\n// afterwards with `auth.setRefreshHandler(...)` (last write wins). Returns the\n// ROTATED refresh token so the store persists it — `ROTATE_REFRESH_TOKENS`\n// blacklists the old one, so reusing it would 401 on the next refresh.\n//\n// Raw fetch, NOT the SDK: the endpoint exists on the server even when this\n// target's sliced SDK doesn't include the accounts group, and importing\n// sdk.gen here would close the cycle auth.ts → sdk.gen → client.gen → auth.ts.\nconst REFRESH_ENDPOINT = '/cfg/accounts/token/refresh/';\n\nauth.setRefreshHandler(async (refresh) => {\n  try {\n    const url = `${auth.getBaseUrl()}${REFRESH_ENDPOINT}`;\n    const headers: Record<string, string> = { 'Content-Type': 'application/json' };\n    // Bound tokens (`cnf.jkt`) require a DPoP proof on the refresh call too.\n    if (dpopEnabled() && typeof window !== 'undefined') {\n      const proof = await _makeDpopProof('POST', url);\n      if (proof) headers['DPoP'] = proof;\n    }\n    const res = await fetch(url, {\n      method: 'POST',\n      headers,\n      credentials: auth.getWithCredentials() ? 'include' : 'same-origin',\n      body: JSON.stringify({ refresh }),\n    });\n    if (!res.ok) return null;\n    const data = (await res.json()) as { access?: string; refresh?: string } | null;\n    return data?.access\n      ? { access: data.access, refresh: data.refresh ?? refresh }\n      : null;\n  } catch {\n    return null;\n  }\n});\n\nexport type Auth = typeof auth;\n","// AUTO-GENERATED by django_generator / ts_extras.wrapper\n// API logger built on consola. Optional dependency — install if you enable logging:\n//   npm install consola\n// DO NOT EDIT — re-run `make gen`.\n\nimport { type ConsolaInstance, createConsola } from \"consola\";\n\nexport interface RequestLog {\n  method: string;\n  url: string;\n  headers?: Record<string, string>;\n  body?: any;\n  timestamp: number;\n}\n\nexport interface ResponseLog {\n  status: number;\n  statusText: string;\n  data?: any;\n  duration: number;\n  timestamp: number;\n}\n\nexport interface ErrorLog {\n  message: string;\n  statusCode?: number;\n  fieldErrors?: Record<string, string[]>;\n  duration: number;\n  timestamp: number;\n}\n\nexport interface LoggerConfig {\n  enabled: boolean;\n  logRequests: boolean;\n  logResponses: boolean;\n  logErrors: boolean;\n  logBodies: boolean;\n  logHeaders: boolean;\n  consola?: ConsolaInstance;\n}\n\nconst DEFAULT_CONFIG: LoggerConfig = {\n  enabled: typeof process !== \"undefined\" && process.env?.NODE_ENV !== \"production\",\n  logRequests: true,\n  logResponses: true,\n  logErrors: true,\n  logBodies: true,\n  logHeaders: false,\n};\n\nconst SENSITIVE_HEADERS = [\n  \"authorization\",\n  \"cookie\",\n  \"set-cookie\",\n  \"x-api-key\",\n  \"x-csrf-token\",\n];\n\nexport class APILogger {\n  private config: LoggerConfig;\n  private consola: ConsolaInstance;\n\n  constructor(config: Partial<LoggerConfig> = {}) {\n    this.config = { ...DEFAULT_CONFIG, ...config };\n    this.consola = config.consola || createConsola({\n      level: this.config.enabled ? 4 : 0,\n    });\n  }\n\n  enable(): void { this.config.enabled = true; }\n  disable(): void { this.config.enabled = false; }\n  setConfig(config: Partial<LoggerConfig>): void {\n    this.config = { ...this.config, ...config };\n  }\n\n  private filterHeaders(headers?: Record<string, string>): Record<string, string> {\n    if (!headers) return {};\n    const filtered: Record<string, string> = {};\n    Object.keys(headers).forEach((key) => {\n      filtered[key] = SENSITIVE_HEADERS.includes(key.toLowerCase()) ? \"***\" : (headers[key] || \"\");\n    });\n    return filtered;\n  }\n\n  logRequest(request: RequestLog): void {\n    if (!this.config.enabled || !this.config.logRequests) return;\n    const { method, url, headers, body } = request;\n    this.consola.start(`${method} ${url}`);\n    if (this.config.logHeaders && headers) this.consola.debug(\"Headers:\", this.filterHeaders(headers));\n    if (this.config.logBodies && body) this.consola.debug(\"Body:\", body);\n  }\n\n  logResponse(request: RequestLog, response: ResponseLog): void {\n    if (!this.config.enabled || !this.config.logResponses) return;\n    const { method, url } = request;\n    const { status, statusText, data, duration } = response;\n    this.consola.success(`${method} ${url} ${status} ${statusText} (${duration}ms)`);\n    if (this.config.logBodies && data) this.consola.debug(\"Response:\", data);\n  }\n\n  logError(request: RequestLog, error: ErrorLog): void {\n    if (!this.config.enabled || !this.config.logErrors) return;\n    const { method, url } = request;\n    const { message, statusCode, fieldErrors, duration } = error;\n    this.consola.error(`${method} ${url} ${statusCode || \"Network\"} Error (${duration}ms)`);\n    this.consola.error(\"Message:\", message);\n    if (fieldErrors && Object.keys(fieldErrors).length > 0) {\n      this.consola.error(\"Field Errors:\");\n      Object.entries(fieldErrors).forEach(([field, errors]) => {\n        errors.forEach((err) => this.consola.error(`  • ${field}: ${err}`));\n      });\n    }\n  }\n\n  info(message: string, ...args: any[]): void { if (this.config.enabled) this.consola.info(message, ...args); }\n  warn(message: string, ...args: any[]): void { if (this.config.enabled) this.consola.warn(message, ...args); }\n  error(message: string, ...args: any[]): void { if (this.config.enabled) this.consola.error(message, ...args); }\n  debug(message: string, ...args: any[]): void { if (this.config.enabled) this.consola.debug(message, ...args); }\n  success(message: string, ...args: any[]): void { if (this.config.enabled) this.consola.success(message, ...args); }\n  withTag(tag: string): ConsolaInstance { return this.consola.withTag(tag); }\n}\n\nexport const defaultLogger = new APILogger();\n","export const isDev = process.env.NODE_ENV === 'development';\nexport const isProd = !isDev;\nexport const isBrowser = typeof window !== 'undefined';\n\n/**\n * Next.js static-export build (`output: 'export'`). Loggers treat it like dev\n * for visibility; some auth/SSR features behave differently under it.\n */\nexport const isStaticBuild = process.env.NEXT_PUBLIC_STATIC_BUILD === 'true';\n\n/**\n * DPoP (RFC 9449) sender-constrained tokens are enabled for this app.\n *\n * Set by `createBaseNextConfig({ dpop: true })` (inlines\n * `NEXT_PUBLIC_DPOP_ENABLED='true'`). When true: tokens are bound to a\n * non-extractable in-browser key, a copied Bearer token can't be replayed, and\n * the API client signs a per-request DPoP proof. This flag lives in\n * `@djangocfg/api` — the package that implements DPoP — so it is the single\n * source of truth, importable by every higher-level package.\n */\nexport const dpopEnabled = process.env.NEXT_PUBLIC_DPOP_ENABLED === 'true';\n","/**\n * Global runtime log-level control.\n *\n * One mutable level that every `@djangocfg/*` consola wrapper reads, so the\n * whole app's console verbosity can be changed at runtime (e.g. raised for an\n * admin, kept silent for a regular user in production) WITHOUT each package\n * hardcoding `isDev ? 4 : 1`.\n *\n * Lives in `@djangocfg/api` because it's the lowest shared package — api,\n * layouts, ui-core consumers can all import it without a cycle.\n *\n * consola levels: 0 silent · 1 error · 2 warn · 3 info · 4 debug · 5 trace.\n *\n * Default policy (before anyone calls setLogLevel):\n *   - dev / static build → 4 (debug)\n *   - production         → 1 (errors only)\n * App bootstrap should call `applyRoleLogPolicy({ isAdmin, isDev })` once auth\n * is known to raise verbosity for staff/superusers even in production.\n */\n\nimport { isDev, isStaticBuild } from './auth/utils/env';\n\nexport type ConsolaLevel = 0 | 1 | 2 | 3 | 4 | 5;\n\n/** Dev or a static export → show verbose logs by default. */\nconst verboseByDefault = isDev || isStaticBuild;\n\nconst DEFAULT_LEVEL: ConsolaLevel = verboseByDefault ? 4 : 1;\n\nlet _level: ConsolaLevel = DEFAULT_LEVEL;\n\n/** Subscribers (the wrapper loggers) notified when the level changes. */\nconst _subscribers = new Set<(level: ConsolaLevel) => void>();\n\n/** Current global log level. Wrappers read this when constructing/refreshing. */\nexport function getLogLevel(): ConsolaLevel {\n  return _level;\n}\n\n/** Set the global log level and notify all live loggers. */\nexport function setLogLevel(level: ConsolaLevel): void {\n  _level = level;\n  for (const fn of _subscribers) {\n    try {\n      fn(level);\n    } catch {\n      /* a bad subscriber must not break logging */\n    }\n  }\n}\n\n/**\n * Subscribe to level changes. Returns an unsubscribe fn. The callback fires\n * immediately with the current level so a logger can sync on registration.\n */\nexport function onLogLevelChange(fn: (level: ConsolaLevel) => void): () => void {\n  _subscribers.add(fn);\n  try {\n    fn(_level);\n  } catch {\n    /* ignore */\n  }\n  return () => _subscribers.delete(fn);\n}\n\n/**\n * Apply the role-aware policy. Call once at bootstrap and whenever auth changes.\n *\n *   - admin (is_staff / is_superuser): full verbosity (debug) everywhere, even\n *     in production — so support/devs can diagnose live without a redeploy.\n *   - dev (non-admin): debug.\n *   - production regular user: errors only — a clean console, like big SaaS apps.\n */\nexport function applyRoleLogPolicy(opts: { isAdmin: boolean; isDev?: boolean }): void {\n  const devMode = opts.isDev ?? verboseByDefault;\n  if (opts.isAdmin || devMode) {\n    setLogLevel(4);\n  } else {\n    setLogLevel(1);\n  }\n}\n","'use client';\n\n/**\n * useSession — reactive session snapshot from the generated auth store.\n *\n * The ONE way to answer \"am I logged in\" in React. The store owns the\n * semantics (JWT `exp`-aware, refresh-token-aware) and pushes changes on\n * token writes, refresh success/failure, expiry (internal timer), and\n * cross-tab / cross-store sync. No polling, no ticks.\n */\n\nimport { useSyncExternalStore } from 'react';\n\nimport { auth } from '../../_api/generated/helpers/auth';\n\nimport type { SessionSnapshot, SessionStatus } from '../../_api/generated/helpers/auth';\n\nexport type { SessionSnapshot, SessionStatus };\n\nexport function useSession(): SessionSnapshot {\n  return useSyncExternalStore(auth.subscribe, auth.getSnapshot, auth.getServerSnapshot);\n}\n","'use client';\n\nimport { useCallback, useSyncExternalStore } from 'react';\n\nimport { auth } from '../../_api/generated/helpers/auth';\n\n/**\n * Time zone preference. The choice lives on the device (localStorage) and is\n * pushed into the generated auth store, which sends it as `X-Timezone` on every\n * request; Django's TimezoneMiddleware then activates it and mirrors it onto\n * the profile. `null` = automatic (follow the browser).\n */\nconst STORAGE_KEY = 'djangocfg.timezone';\n\nconst listeners = new Set<() => void>();\n\nfunction read(): string | null {\n  try {\n    return localStorage.getItem(STORAGE_KEY) || null;\n  } catch {\n    return null;\n  }\n}\n\n/** Apply the stored choice to the transport before any request goes out. */\nfunction hydrate(): void {\n  if (typeof window === 'undefined') return;\n  auth.setTimezone(read());\n}\nhydrate();\n\nfunction write(timezone: string | null): void {\n  try {\n    if (timezone) localStorage.setItem(STORAGE_KEY, timezone);\n    else localStorage.removeItem(STORAGE_KEY);\n  } catch {\n    /* storage unavailable — the choice then lasts for this page only */\n  }\n  auth.setTimezone(timezone);\n  listeners.forEach((l) => l());\n}\n\nfunction subscribe(listener: () => void): () => void {\n  listeners.add(listener);\n  return () => listeners.delete(listener);\n}\n\nexport interface UseTimezoneReturn {\n  /** Zone in effect: the explicit choice, else the browser's. `null` only where Intl cannot tell. */\n  timezone: string | null;\n  /** The explicit choice; `null` = automatic. Feed this to `TimezoneSelect`. */\n  preference: string | null;\n  isAuto: boolean;\n  /** Pick a zone, or `null` for automatic. */\n  setTimezone: (timezone: string | null) => void;\n}\n\nexport function useTimezone(): UseTimezoneReturn {\n  const preference = useSyncExternalStore(subscribe, read, () => null);\n  const setTimezone = useCallback((tz: string | null) => write(tz), []);\n  return {\n    timezone: preference ?? auth.getTimezone(),\n    preference,\n    isAuto: preference === null,\n    setTimezone,\n  };\n}\n","/**\n * Universal Router Hook with BasePath Support\n *\n * Wrapper around Next.js useRouter that automatically handles basePath\n * for static builds served via iframe or subdirectory\n * \n * IMPORTANT: In Next.js 15 App Router, router.push() does NOT automatically\n * handle basePath (unlike Pages Router). This is a breaking change in App Router.\n * \n * This hook ensures basePath is always included when navigating, especially\n * important for static exports served via iframe where basePath is critical.\n * \n * @see https://nextjs.org/docs/app/building-your-application/upgrading/app-router-migration\n */\n\n'use client';\n\nimport { useRouter as useNextRouter } from 'next/navigation';\nimport { useCallback, useMemo } from 'react';\n\nimport { authTrace } from '../trace';\n\n/**\n * A hard navigation unloads the page. Once one is in flight, a second one (two 401s, the guard and an effect, a double\n * click) is dropped: the first decides. Reset when the page is restored from the back/forward cache.\n */\nlet hardNavigating = false;\nif (typeof window !== 'undefined') {\n  window.addEventListener('pageshow', (e) => {\n    if (e.persisted) hardNavigating = false;\n  });\n}\n\nfunction fromPath(): string {\n  return typeof window === 'undefined' ? '' : window.location.pathname;\n}\n\n/**\n * Get base path from environment variable\n */\nfunction getBasePath(): string {\n  if (typeof process === 'undefined') {\n    return '';\n  }\n  return process.env.NEXT_PUBLIC_BASE_PATH || '';\n}\n\n/**\n * Add base path to a route path\n */\nfunction withBasePath(path: string, basePath: string): string {\n  if (!basePath) {\n    return path;\n  }\n  // Ensure path starts with /\n  const normalizedPath = path.startsWith('/') ? path : `/${path}`;\n  // Remove trailing slash from basePath\n  const normalizedBasePath = basePath.replace(/\\/$/, '');\n  return `${normalizedBasePath}${normalizedPath}`;\n}\n\n/**\n * Router with basePath support\n *\n * Automatically adds basePath to all navigation methods when basePath is configured.\n * In Next.js 15 App Router, router.push() doesn't handle basePath automatically,\n * so this hook uses window.location to ensure basePath is always included.\n *\n * @example\n * ```tsx\n * const router = useCfgRouter();\n *\n * // With basePath='/cfg/admin':\n * router.push('/dashboard');     // Client-side navigation to '/cfg/admin/dashboard'\n * router.replace('/auth');       // Client-side replace with '/cfg/admin/auth'\n * router.hardPush('/dashboard'); // Full page reload to '/cfg/admin/dashboard'\n * router.hardReplace('/auth');   // Full page replace with '/cfg/admin/auth'\n * ```\n */\nexport function useCfgRouter() {\n  const router = useNextRouter();\n\n  // Get basePath\n  const basePath = useMemo(() => getBasePath(), []);\n\n  const push = useCallback((href: string, options?: { scroll?: boolean }) => {\n    authTrace('nav.push', { from: fromPath(), to: href });\n    if (basePath) {\n      // App Router doesn't handle basePath automatically, use window.location\n      window.location.href = withBasePath(href, basePath);\n    } else {\n      // No basePath configured, use standard router\n      router.push(href, options);\n    }\n  }, [router, basePath]);\n\n  const replace = useCallback((href: string, options?: { scroll?: boolean }) => {\n    authTrace('nav.replace', { from: fromPath(), to: href });\n    if (basePath) {\n      // App Router doesn't handle basePath automatically, use window.location\n      window.location.replace(withBasePath(href, basePath));\n    } else {\n      // No basePath configured, use standard router\n      router.replace(href, options);\n    }\n  }, [router, basePath]);\n\n  /**\n   * Hard push - always uses window.location.href for full page reload\n   *\n   * Use this for auth redirects where React contexts need to reinitialize.\n   * Unlike push(), this ALWAYS triggers a full page reload, ensuring all\n   * contexts are reinitialized with fresh state.\n   *\n   * @example\n   * ```tsx\n   * // After successful login - contexts need to reload with new auth state\n   * router.hardPush('/dashboard');\n   * ```\n   */\n  const hardPush = useCallback((href: string) => {\n    if (hardNavigating) {\n      authTrace('nav.hardPush.ignored', { from: fromPath(), to: href });\n      return;\n    }\n    hardNavigating = true;\n    authTrace('nav.hardPush', { from: fromPath(), to: href });\n    window.location.href = withBasePath(href, basePath);\n  }, [basePath]);\n\n  /**\n   * Hard replace - always uses window.location.replace for full page reload\n   *\n   * Same as hardPush but replaces current history entry.\n   * Use for auth redirects where you don't want back button to return to login.\n   *\n   * @example\n   * ```tsx\n   * // After logout - replace so back button doesn't go to protected page\n   * router.hardReplace('/auth');\n   * ```\n   */\n  const hardReplace = useCallback((href: string) => {\n    if (hardNavigating) {\n      authTrace('nav.hardReplace.ignored', { from: fromPath(), to: href });\n      return;\n    }\n    hardNavigating = true;\n    authTrace('nav.hardReplace', { from: fromPath(), to: href });\n    window.location.replace(withBasePath(href, basePath));\n  }, [basePath]);\n\n  const prefetch = useCallback((href: string) => {\n    // Prefetch doesn't need basePath handling, Next.js handles it\n    router.prefetch(href);\n  }, [router]);\n\n  const back = useCallback(() => {\n    router.back();\n  }, [router]);\n\n  const forward = useCallback(() => {\n    router.forward();\n  }, [router]);\n\n  const refresh = useCallback(() => {\n    router.refresh();\n  }, [router]);\n\n  return {\n    push,\n    replace,\n    hardPush,\n    hardReplace,\n    prefetch,\n    back,\n    forward,\n    refresh,\n  };\n}\n\n","/**\n * useQueryParams Hook\n * \n * Safe hook to access URL query parameters without requiring Suspense boundary.\n * Works on client-side only, returns empty URLSearchParams during SSR/prerendering.\n * \n * @example\n * ```tsx\n * const params = useQueryParams();\n * const flow = params.get('flow');\n * const hasFlow = params.has('flow');\n * const allTags = params.getAll('tags');\n * ```\n */\n\n'use client';\n\nimport { usePathname } from 'next/navigation';\nimport { useEffect, useRef, useState } from 'react';\n\n/**\n * Hook to safely access URL query parameters without useSearchParams()\n * \n * This hook reads query parameters directly from window.location.search,\n * avoiding the need for Suspense boundaries that useSearchParams() requires.\n * \n * Automatically updates when URL changes (navigation, back/forward, etc.)\n * Uses pathname from Next.js to detect route changes and polls for query param changes.\n * \n * Returns a URLSearchParams object with get(), getAll(), has(), etc.\n * \n * @returns URLSearchParams object (empty during SSR)\n */\nexport function useQueryParams(): URLSearchParams {\n  const pathname = usePathname();\n  const [queryParams, setQueryParams] = useState<URLSearchParams>(() => {\n    if (typeof window === 'undefined') {\n      return new URLSearchParams();\n    }\n    return new URLSearchParams(window.location.search);\n  });\n  const lastSearchRef = useRef<string>('');\n\n  useEffect(() => {\n    if (typeof window === 'undefined') return;\n\n    const updateQueryParams = () => {\n      const currentSearch = window.location.search;\n      if (currentSearch !== lastSearchRef.current) {\n        lastSearchRef.current = currentSearch;\n        setQueryParams(new URLSearchParams(currentSearch));\n      }\n    };\n\n    // Sync on mount / pathname change (Next.js navigation).\n    updateQueryParams();\n\n    // back/forward navigation fires popstate natively.\n    window.addEventListener('popstate', updateQueryParams);\n\n    // Next.js router.push/replace updates the URL via history.pushState/replaceState,\n    // which do NOT emit any event. Patch them to notify us, so we react to query-only\n    // changes (same pathname) without polling. This replaces the old setInterval(100ms),\n    // whose churning object reference helped drive the OTP auto-submit loop.\n    const origPush = window.history.pushState;\n    const origReplace = window.history.replaceState;\n    window.history.pushState = function (...args) {\n      const result = origPush.apply(this, args);\n      updateQueryParams();\n      return result;\n    };\n    window.history.replaceState = function (...args) {\n      const result = origReplace.apply(this, args);\n      updateQueryParams();\n      return result;\n    };\n\n    return () => {\n      window.removeEventListener('popstate', updateQueryParams);\n      window.history.pushState = origPush;\n      window.history.replaceState = origReplace;\n    };\n  }, [pathname]);\n\n  return queryParams;\n}\n\n","\"use client\"\n\nimport { useCallback, useEffect, useRef, useState } from 'react';\n\nimport type { AuthFormState, AuthFormStateHandlers, AuthStep, WebmailLink } from '../types';\n\nconst formatCountdown = (s: number): string => {\n  if (s <= 0) return '';\n  const m = Math.floor(s / 60);\n  return m > 0 ? `${m}:${String(s % 60).padStart(2, '0')}` : `${s}s`;\n};\n\nconst useCountdown = () => {\n  const [seconds, setSeconds] = useState(0);\n  const timerRef = useRef<ReturnType<typeof setInterval> | null>(null);\n\n  const start = useCallback((from: number) => {\n    if (timerRef.current) clearInterval(timerRef.current);\n    setSeconds(from);\n    timerRef.current = setInterval(() => {\n      setSeconds((prev) => {\n        if (prev <= 1) {\n          clearInterval(timerRef.current!);\n          timerRef.current = null;\n          return 0;\n        }\n        return prev - 1;\n      });\n    }, 1000);\n  }, []);\n\n  useEffect(() => () => {\n    if (timerRef.current) clearInterval(timerRef.current);\n  }, []);\n\n  return { seconds, start };\n};\n\nexport interface UseAuthFormStateReturn extends AuthFormState, AuthFormStateHandlers {}\n\n/**\n * Hook for auth form state management.\n * Pure state - no side effects, no API calls.\n */\nexport const useAuthFormState = (\n  initialIdentifier = '',\n): UseAuthFormStateReturn => {\n  const [identifier, setIdentifier] = useState(initialIdentifier);\n  const [otp, setOtp] = useState('');\n  const [password, setPassword] = useState('');\n  const [isLoading, setIsLoading] = useState(false);\n  const [acceptedTerms, setAcceptedTerms] = useState(true);\n  // null until the marketing-consent feature (if enabled) resolves its\n  // jurisdiction-aware default — the layout owns that decision.\n  const [marketingConsent, setMarketingConsent] = useState<boolean | null>(null);\n  const [step, setStep] = useState<AuthStep>('identifier');\n  const [error, setError] = useState('');\n  const [webmail, setWebmail] = useState<WebmailLink | null>(null);\n\n  const rateLimit = useCountdown();\n  const resend = useCountdown();\n\n  const clearError = useCallback(() => setError(''), []);\n\n  return {\n    // State\n    identifier,\n    otp,\n    password,\n    isLoading,\n    acceptedTerms,\n    marketingConsent,\n    step,\n    error,\n    rateLimitSeconds: rateLimit.seconds,\n    isRateLimited: rateLimit.seconds > 0,\n    rateLimitLabel: formatCountdown(rateLimit.seconds),\n    resendSeconds: resend.seconds,\n    resendLabel: formatCountdown(resend.seconds),\n    webmail,\n    // Handlers\n    setIdentifier,\n    setOtp,\n    setPassword,\n    setAcceptedTerms,\n    setMarketingConsent,\n    setError,\n    clearError,\n    setStep,\n    setIsLoading,\n    startRateLimitCountdown: rateLimit.start,\n    startResendCountdown: resend.start,\n    setWebmail,\n  };\n};\n","\"use client\"\n\nimport { useCallback } from 'react';\n\nimport type { AuthFormValidation } from '../types';\n\nconst EMAIL_REGEX = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n\nexport const useAuthValidation = (): AuthFormValidation => {\n  const validateIdentifier = useCallback((id: string): boolean => {\n    return EMAIL_REGEX.test(id);\n  }, []);\n\n  return { validateIdentifier };\n};\n\nexport const validateIdentifier = (id: string): boolean => EMAIL_REGEX.test(id);\n","\"use client\"\n\nimport { useCallback, useEffect, useRef } from 'react';\n\nimport { AUTH_CONSTANTS } from '../constants';\nimport { useAuth } from '../context';\nimport { authLogger } from '../utils/logger';\nimport { useAuthFormState } from './useAuthFormState';\nimport { useAuthValidation } from './useAuthValidation';\nimport { useAutoAuth } from './useAutoAuth';\nimport { beginTwoFactorChallenge } from './useTwoFactorChallenge';\n\nimport type { AuthFormReturn, UseAuthFormOptions } from '../types';\n/**\n * Complete auth form hook.\n * Composes smaller hooks for state, validation, and submission.\n */\nexport const useAuthForm = (options: UseAuthFormOptions): AuthFormReturn => {\n  const {\n    onIdentifierSuccess,\n    onOTPSuccess,\n    onError,\n    sourceUrl,\n    redirectUrl,\n    requireTermsAcceptance = false,\n    marketingConsent: marketingConsentOption,\n    authPath = '/auth',\n  } = options;\n\n  // Compose smaller hooks\n  const formState = useAuthFormState();\n  const validation = useAuthValidation();\n\n  // Ref to track auto-submit from URL\n  const isAutoSubmitFromUrlRef = useRef(false);\n  // Remembers the exact `identifier:otp` we already attempted from a magic-link\n  // URL. We verify a given code at most ONCE — even if it turns out invalid or\n  // expired — so re-renders never re-fire the request. Without this, the auto\n  // submit loops and hammers /verify/ until the backend returns 429.\n  const processedOtpKeyRef = useRef<string | null>(null);\n\n  // Auth context for API calls and storage\n  const {\n    requestOTP,\n    verifyOTP,\n    login,\n    getSavedEmail,\n    saveEmail,\n  } = useAuth();\n\n  // Destructure for convenience\n  const {\n    identifier,\n    otp,\n    password,\n    acceptedTerms,\n    marketingConsent,\n    setIdentifier,\n    setOtp,\n    setStep,\n    setError,\n    setIsLoading,\n    clearError,\n    startRateLimitCountdown,\n    startResendCountdown,\n    setWebmail,\n  } = formState;\n\n  const { validateIdentifier } = validation;\n\n  // ─────────────────────────────────────────────────────────────────────────\n  // Storage Helper\n  // ─────────────────────────────────────────────────────────────────────────\n\n  const saveIdentifierToStorage = useCallback((id: string) => {\n    saveEmail(id);\n  }, [saveEmail]);\n\n  // ─────────────────────────────────────────────────────────────────────────\n  // Effects\n  // ─────────────────────────────────────────────────────────────────────────\n\n  // Load saved identifier on mount\n  useEffect(() => {\n    const savedEmail = getSavedEmail();\n    if (savedEmail) {\n      setIdentifier(savedEmail);\n    }\n  // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, []);\n\n  // ─────────────────────────────────────────────────────────────────────────\n  // Submit Handlers\n  // ─────────────────────────────────────────────────────────────────────────\n\n  const handleIdentifierSubmit = useCallback(async (e: React.FormEvent) => {\n    e.preventDefault();\n\n    if (!identifier) {\n      const msg = 'Please enter your email address';\n      setError(msg);\n      onError?.(msg);\n      return;\n    }\n\n    if (!validateIdentifier(identifier)) {\n      const msg = 'Please enter a valid email address';\n      setError(msg);\n      onError?.(msg);\n      return;\n    }\n\n    if (requireTermsAcceptance && !acceptedTerms) {\n      const msg = 'Please accept the Terms of Service and Privacy Policy';\n      setError(msg);\n      onError?.(msg);\n      return;\n    }\n\n    clearError();\n    setOtp('');\n    setWebmail(null);\n    // Optimistic: the code screen opens now; a failed request rolls back to the identifier step.\n    setStep('otp');\n\n    const rollBack = (msg: string) => {\n      setStep('identifier');\n      setError(msg);\n      onError?.(msg);\n    };\n\n    try {\n      // Only apps that opted in send consent fields — absent option ⇒ body unchanged.\n      const consent = marketingConsentOption\n        ? { marketingConsent: marketingConsent === true, disclosureVersion: marketingConsentOption.disclosureVersion }\n        : undefined;\n      const result = await requestOTP(identifier, sourceUrl, consent);\n\n      if (result.success) {\n        saveIdentifierToStorage(identifier);\n        setWebmail(result.webmail ?? null);\n        startResendCountdown(result.resendIn ?? AUTH_CONSTANTS.RESEND_COOLDOWN_SECONDS);\n        onIdentifierSuccess?.(identifier);\n      } else if (result.retryAfter) {\n        setStep('identifier');\n        startRateLimitCountdown(result.retryAfter);\n      } else {\n        rollBack(result.message);\n      }\n    } catch {\n      rollBack('An unexpected error occurred');\n    }\n  }, [\n    identifier, acceptedTerms, requireTermsAcceptance,\n    marketingConsent, marketingConsentOption,\n    validateIdentifier, requestOTP, saveIdentifierToStorage,\n    setError, setOtp, setStep, clearError, setWebmail,\n    startRateLimitCountdown, startResendCountdown, onIdentifierSuccess, onError, sourceUrl,\n  ]);\n\n  // Core OTP submit - accepts explicit values to avoid stale closures\n  const submitOTP = useCallback(async (\n    submitIdentifier: string,\n    submitOtp: string,\n  ): Promise<boolean> => {\n    if (!submitOtp || submitOtp.length < AUTH_CONSTANTS.EMAIL_OTP_LENGTH) {\n      const msg = `Please enter the ${AUTH_CONSTANTS.EMAIL_OTP_LENGTH}-digit verification code`;\n      setError(msg);\n      onError?.(msg);\n      return false;\n    }\n\n    setIsLoading(true);\n    clearError();\n\n    try {\n      // Skip redirect - we'll show success screen first\n      const result = await verifyOTP(submitIdentifier, submitOtp, sourceUrl, redirectUrl, true);\n\n      if (result.requires_2fa && result.session_id) {\n        authLogger.info('2FA required after OTP verification');\n        beginTwoFactorChallenge({ sessionId: result.session_id });\n        saveIdentifierToStorage(submitIdentifier);\n        return true; // OTP was successful, now need 2FA\n      }\n\n      if (result.success) {\n        saveIdentifierToStorage(submitIdentifier);\n\n        authLogger.info('OTP verification successful, showing success screen');\n        setStep('success');\n        onOTPSuccess?.();\n        return true;\n      } else {\n        setError(result.message);\n        onError?.(result.message);\n        return false;\n      }\n    } catch {\n      const msg = 'An unexpected error occurred';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    } finally {\n      setIsLoading(false);\n    }\n  }, [verifyOTP, saveIdentifierToStorage, setError, setIsLoading, clearError, onOTPSuccess, onError, sourceUrl, redirectUrl, setStep]);\n\n  const handleOTPSubmit = useCallback(async (e: React.FormEvent) => {\n    e.preventDefault();\n    await submitOTP(identifier, otp);\n  }, [identifier, otp, submitOTP]);\n\n  // ─────────────────────────────────────────────────────────────────────────\n  // Password Submit\n  // ─────────────────────────────────────────────────────────────────────────\n\n  // The password credential lands on the same outcomes as the OTP code:\n  // a 2FA challenge or 'success'.\n  const submitPassword = useCallback(async (\n    submitIdentifier: string,\n    submitPassword_: string,\n  ): Promise<boolean> => {\n    if (!submitIdentifier || !validateIdentifier(submitIdentifier)) {\n      const msg = 'Please enter a valid email address';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    }\n\n    if (!submitPassword_) {\n      const msg = 'Please enter your password';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    }\n\n    setIsLoading(true);\n    clearError();\n\n    try {\n      // Skip redirect - we'll show success screen first\n      const result = await login(submitIdentifier, submitPassword_, {\n        redirectUrl,\n        skipRedirect: true,\n      });\n\n      if (result.requires_2fa && result.session_id) {\n        authLogger.info('2FA required after password login');\n        beginTwoFactorChallenge({ sessionId: result.session_id });\n        saveIdentifierToStorage(submitIdentifier);\n        return true; // Password was accepted, now need 2FA\n      }\n\n      if (result.success) {\n        saveIdentifierToStorage(submitIdentifier);\n        authLogger.info('Password login successful, showing success screen');\n        setStep('success');\n        onOTPSuccess?.();\n        return true;\n      }\n\n      // A lockout (429) carries a retry-after; show the countdown instead of a\n      // message the user can only re-trigger.\n      if (result.retryAfter) {\n        startRateLimitCountdown(result.retryAfter);\n        clearError();\n      } else {\n        setError(result.message);\n        onError?.(result.message);\n      }\n      return false;\n    } catch {\n      const msg = 'An unexpected error occurred';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    } finally {\n      setIsLoading(false);\n    }\n  }, [\n    login, validateIdentifier, saveIdentifierToStorage, setError, setIsLoading,\n    clearError, startRateLimitCountdown, onOTPSuccess, onError, redirectUrl,\n    setStep,\n  ]);\n\n  const handlePasswordSubmit = useCallback(async (e: React.FormEvent) => {\n    e.preventDefault();\n    await submitPassword(identifier, password);\n  }, [identifier, password, submitPassword]);\n\n  const handleResendOTP = useCallback(async () => {\n    setIsLoading(true);\n    clearError();\n\n    try {\n      // Resend repeats the same OTP request — carry the same consent state so\n      // the backend never sees a consent-less duplicate of an opted-in request.\n      const consent = marketingConsentOption\n        ? { marketingConsent: marketingConsent === true, disclosureVersion: marketingConsentOption.disclosureVersion }\n        : undefined;\n      const result = await requestOTP(identifier, sourceUrl, consent);\n\n      if (result.success) {\n        saveIdentifierToStorage(identifier);\n        setWebmail(result.webmail ?? null);\n        startResendCountdown(result.resendIn ?? AUTH_CONSTANTS.RESEND_COOLDOWN_SECONDS);\n        setOtp('');\n      } else {\n        if (result.retryAfter) {\n          startRateLimitCountdown(result.retryAfter);\n          clearError(); // countdown in rateLimitLabel is enough feedback\n        } else {\n          setError(result.message);\n          onError?.(result.message);\n        }\n      }\n    } catch {\n      const msg = 'Failed to resend verification code';\n      setError(msg);\n      onError?.(msg);\n    } finally {\n      setIsLoading(false);\n    }\n  }, [identifier, marketingConsent, marketingConsentOption, requestOTP, saveIdentifierToStorage, setOtp, setError, setIsLoading, clearError, startRateLimitCountdown, startResendCountdown, setWebmail, onError, sourceUrl]);\n\n  const handleBackToIdentifier = useCallback(() => {\n    setStep('identifier');\n    clearError();\n  }, [setStep, clearError]);\n\n  const forceOTPStep = useCallback(() => {\n    setStep('otp');\n    clearError();\n  }, [setStep, clearError]);\n\n  // ─────────────────────────────────────────────────────────────────────────\n  // Auto-auth from URL\n  // ─────────────────────────────────────────────────────────────────────────\n\n  const handleOTPFromUrl = useCallback((detectedOtp: string, detectedEmail?: string) => {\n    // Prefer the email from the magic-link URL (works on a fresh browser/device),\n    // fall back to the one saved from a previous request on this browser.\n    const autoIdentifier = detectedEmail || getSavedEmail() || '';\n\n    if (!autoIdentifier) {\n      authLogger.warn('No identifier found for auto-submit (no email in URL or storage)');\n      return;\n    }\n\n    // Verify each magic-link code at most once. A re-render must never re-fire\n    // the request — a failed/expired code that retried in a loop is exactly what\n    // drove the /verify/ spam and the backend's 429 lockout.\n    const otpKey = `${autoIdentifier}:${detectedOtp}`;\n    if (processedOtpKeyRef.current === otpKey) return;\n    if (isAutoSubmitFromUrlRef.current) return;\n\n    processedOtpKeyRef.current = otpKey;\n    isAutoSubmitFromUrlRef.current = true;\n\n    authLogger.info('OTP detected from URL, auto-submitting');\n\n    // Update UI state\n    setIdentifier(autoIdentifier);\n    setOtp(detectedOtp);\n    setStep('otp');\n\n    // Submit with explicit values\n    setTimeout(async () => {\n      try {\n        await submitOTP(autoIdentifier, detectedOtp);\n      } finally {\n        isAutoSubmitFromUrlRef.current = false;\n      }\n    }, 100);\n  }, [getSavedEmail, setIdentifier, setOtp, setStep, submitOTP]);\n\n  useAutoAuth({\n    allowedPaths: [authPath],\n    onOTPDetected: handleOTPFromUrl,\n    cleanupUrl: true,\n  });\n\n  // ─────────────────────────────────────────────────────────────────────────\n  // Return\n  // ─────────────────────────────────────────────────────────────────────────\n\n  return {\n    // State\n    ...formState,\n\n    // Submit handlers\n    handleIdentifierSubmit,\n    handleOTPSubmit,\n    handlePasswordSubmit,\n    handleResendOTP,\n    handleBackToIdentifier,\n    forceOTPStep,\n\n    // Validation\n    ...validation,\n\n    // Auto-submit ref\n    isAutoSubmittingFromUrl: isAutoSubmitFromUrlRef,\n  };\n};\n\n// Re-export types for convenience\nexport type { AuthFormReturn, UseAuthFormOptions } from '../types';\n","import { createConsola } from 'consola';\n\n/**\n * Universal logger for @djangocfg/api/auth\n * Uses consola for beautiful console logging\n *\n * Log levels:\n * - 0: silent\n * - 1: fatal, error\n * - 2: warn\n * - 3: log, info\n * - 4: debug\n * - 5: trace, verbose\n *\n * The level is driven by the GLOBAL runtime controller (log-control), so an\n * admin can get verbose logs (even in prod) while regular users keep a clean\n * console. `applyRoleLogPolicy(...)` at app bootstrap sets the policy.\n */\nimport { getLogLevel, onLogLevelChange } from '../../log-control';\n\nexport const logger = createConsola({\n  level: getLogLevel(),\n}).withTag('api');\n\n// Keep the live logger's level in sync with the global controller.\nonLogLevelChange((level) => {\n  logger.level = level;\n});\n\n/**\n * Auth-specific logger\n */\nexport const authLogger = logger.withTag('auth');\n\nexport default logger;\n","'use client';\n\nimport { usePathname } from 'next/navigation';\nimport { useEffect, useRef } from 'react';\n\nimport { AUTH_CONSTANTS } from '../constants';\nimport { authLogger } from '../utils/logger';\nimport { isAllowedAuthPath } from '../utils/path';\nimport { useCfgRouter } from './useCfgRouter';\nimport { useQueryParams } from './useQueryParams';\n\nexport interface UseAutoAuthOptions {\n  /** Called with the OTP from the URL, plus the optional `email` query param if present. */\n  onOTPDetected?: (otp: string, email?: string) => void;\n  cleanupUrl?: boolean;\n  /** Paths where auto-auth should be active. Default: ['/auth'] */\n  allowedPaths?: string[];\n}\n\n/**\n * Hook for automatic authentication from URL query parameters\n * Detects OTP from URL and triggers callback.\n * (Path normalization / allow-list matching live in ../utils/path so they can\n * be unit-tested independently of the hook.)\n */\nexport const useAutoAuth = (options: UseAutoAuthOptions = {}) => {\n  const { onOTPDetected, cleanupUrl = true, allowedPaths = ['/auth'] } = options;\n  const queryParams = useQueryParams();\n  const pathname = usePathname();\n  const router = useCfgRouter();\n\n  // Check if current path is in allowed paths, ignoring the locale prefix\n  // (next-intl may keep it in the URL, e.g. /ru/auth) and trailing slashes.\n  const isAllowedPath = isAllowedAuthPath(pathname, allowedPaths);\n\n  const queryOtp = queryParams.get('otp') || '';\n  const queryEmail = queryParams.get('email') || undefined;\n  const hasOTP = !!queryOtp;\n  const isReady = !!pathname && hasOTP && isAllowedPath;\n  const otpValid = queryOtp.length === AUTH_CONSTANTS.EMAIL_OTP_LENGTH;\n\n  // Keep the latest callback in a ref so its (unstable) identity never lands in\n  // the effect deps below. Otherwise a parent that passes an inline function\n  // re-runs this effect on every render and re-fires the OTP submission.\n  const onOTPDetectedRef = useRef(onOTPDetected);\n  onOTPDetectedRef.current = onOTPDetected;\n\n  // Detect OTP and notify the parent. Keyed on the OTP *value* (a string), not\n  // on the `queryParams` object reference — so the effect fires once per code,\n  // not on every poll tick / re-render.\n  useEffect(() => {\n    if (!isReady || !otpValid) return;\n    // Only on allowed paths to avoid conflicts with other pages\n    // (e.g., /dashboard/device uses ?otp= for device authorization, not user auth)\n    authLogger.info('OTP detected in URL on auth page:', queryOtp);\n    onOTPDetectedRef.current?.(queryOtp, queryEmail);\n  }, [isReady, otpValid, queryOtp, queryEmail]);\n\n  // Clean up URL to remove sensitive params for security. Separate effect so it\n  // does not depend on `onOTPDetected` and cannot re-trigger the submission.\n  // Use window.location.pathname to preserve the locale prefix (e.g. /ru/auth)\n  // because usePathname() strips the locale, and router.push('/auth') would cause\n  // next-intl middleware to redirect back to /ru/auth — triggering a full page reload\n  // that loses the in-flight OTP submission.\n  useEffect(() => {\n    if (!isReady || !cleanupUrl || !queryOtp) return;\n    const cleanQuery = Object.fromEntries(queryParams.entries());\n    delete cleanQuery.otp;\n    delete cleanQuery.email;\n    const queryString = new URLSearchParams(cleanQuery).toString();\n    const realPathname = typeof window !== 'undefined' ? window.location.pathname : pathname;\n    router.replace(queryString ? `${realPathname}?${queryString}` : realPathname);\n    // eslint-disable-next-line react-hooks/exhaustive-deps\n  }, [isReady, cleanupUrl, queryOtp]);\n\n  return {\n    isReady,\n    hasOTP,\n    isAllowedPath,\n  };\n};\n","/**\n * Path normalization for auth routing.\n *\n * next-intl may keep a 2-letter locale prefix in the URL (e.g. `/ru/auth`), and\n * paths arrive with or without trailing slashes. To match a pathname against a\n * fixed allow-list (like `['/auth']`) reliably, strip the locale segment and\n * trailing slashes first. Extracted from useAutoAuth so it can be unit-tested\n * and reused.\n */\n\n/**\n * Strip a leading 2-letter locale segment and trailing slashes.\n * '/ru/auth/' → '/auth', '/auth' → '/auth', '/' → '/', '' → ''.\n */\nexport const normalizePath = (path: string | null | undefined): string => {\n  if (!path) return '';\n  const withoutLocale = path.replace(/^\\/[a-z]{2}(?=\\/|$)/, '');\n  const trimmed = withoutLocale.replace(/\\/+$/, '');\n  return trimmed || '/';\n};\n\n/**\n * True when `pathname` (after locale/slash normalization) is one of the allowed\n * paths, or nested under one of them (`/auth` matches `/auth/callback`).\n */\nexport const isAllowedAuthPath = (\n  pathname: string | null | undefined,\n  allowedPaths: string[],\n): boolean => {\n  const normalized = normalizePath(pathname);\n  return allowedPaths.some(\n    (p) => normalized === p || normalized.startsWith(p + '/'),\n  );\n};\n","'use client';\n\nimport { useSyncExternalStore } from 'react';\n\n/** A pending login that needs a TOTP or backup code before tokens are issued. */\nexport interface TwoFactorChallenge {\n  sessionId: string;\n}\n\n// Module-scoped on purpose: one sign-in is in flight per page, and the sign-in\n// form and the challenge dialog share it without either importing the other.\nlet current: TwoFactorChallenge | null = null;\nconst listeners = new Set<() => void>();\n\nconst set = (next: TwoFactorChallenge | null): void => {\n  current = next;\n  for (const listener of [...listeners]) listener();\n};\n\nconst subscribe = (listener: () => void): (() => void) => {\n  listeners.add(listener);\n  return () => {\n    listeners.delete(listener);\n  };\n};\n\n/** Called by whichever step received `requires_2fa` (OTP, password, OAuth callback). */\nexport const beginTwoFactorChallenge = (challenge: TwoFactorChallenge): void => set(challenge);\n\n/** Called when the challenge is verified or abandoned. */\nexport const endTwoFactorChallenge = (): void => set(null);\n\n/** The pending challenge, or null. */\nexport const useTwoFactorChallenge = (): TwoFactorChallenge | null =>\n  useSyncExternalStore(subscribe, () => current, () => null);\n","'use client';\n\nimport { useCallback, useEffect, useRef, useState } from 'react';\n\nimport { auth } from '../../_api/generated/helpers/auth';\nimport { CFG_KEYS, cfgStorage } from '../../_api/generated/helpers/keys';\nimport { CfgAccountsOauth } from '../../_api/generated/sdk.gen';\nimport type {\n  OAuthAuthorizeRequestRequest,\n  OAuthAuthorizeResponse,\n  OAuthCallbackRequestRequest,\n  OAuthTokenResponse,\n} from '../../_api/generated/types.gen';\nimport { Analytics, AnalyticsCategory, AnalyticsEvent } from '../utils/analytics';\nimport { authLogger } from '../utils/logger';\nimport { type OAuthFailureCode, type OAuthProviderId, readOAuthFailure } from '../utils/oauthErrors';\nimport { consumeSavedRedirect } from './useAuthRedirect';\nimport { useCfgRouter } from './useCfgRouter';\nimport { authTrace } from '../trace';\n\n/**\n * The user payload as the OAuth endpoint declares it.\n *\n * Derived from the generated response rather than restated, so a schema change\n * reaches callers through `make generate` instead of drifting silently.\n */\nexport type OAuthUser = NonNullable<OAuthTokenResponse['user']>;\n\ninterface OAuthAdapter {\n  authorize: (body: OAuthAuthorizeRequestRequest) => Promise<OAuthAuthorizeResponse>;\n  callback: (body: OAuthCallbackRequestRequest) => Promise<OAuthTokenResponse>;\n}\n\n/**\n * One entry per provider the backend can offer. Keyed by the generated enum:\n * when the backend adds a provider, this stops compiling until it is wired.\n */\nconst ADAPTERS: Record<OAuthProviderId, OAuthAdapter> = {\n  github: {\n    authorize: async (body) =>\n      (await CfgAccountsOauth.cfgAccountsOauthGithubAuthorizeCreate({ body, throwOnError: true })).data,\n    callback: async (body) =>\n      (await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({ body, throwOnError: true })).data,\n  },\n  google: {\n    authorize: async (body) =>\n      (await CfgAccountsOauth.cfgAccountsOauthGoogleAuthorizeCreate({ body, throwOnError: true })).data,\n    callback: async (body) =>\n      (await CfgAccountsOauth.cfgAccountsOauthGoogleCallbackCreate({ body, throwOnError: true })).data,\n  },\n};\n\n/** Provider ids this client can run, in the order the adapters are declared. */\nexport const OAUTH_PROVIDER_IDS = Object.keys(ADAPTERS) as OAuthProviderId[];\n\nexport const isOAuthProviderId = (value: unknown): value is OAuthProviderId =>\n  typeof value === 'string' && Object.hasOwn(ADAPTERS, value);\n\nconst STATE_KEY = CFG_KEYS.oauthState.key;\nconst PROVIDER_KEY = CFG_KEYS.oauthProvider.key;\n\n/** Forget the stored state: the attempt is over without an exchange (Cancel, a provider error). */\nexport const clearOAuthAttempt = (): void => {\n  cfgStorage.remove(STATE_KEY);\n  cfgStorage.remove(PROVIDER_KEY);\n};\n\nexport interface UseOAuthLoginOptions {\n  sourceUrl?: string;\n  /** The endpoint types `user` as a free-form object; narrow it at the call site. */\n  onSuccess?: (user: OAuthUser, isNewUser: boolean, provider: OAuthProviderId) => void;\n  /** `message` is server prose or an English fallback; `code` lets the caller choose its own copy. */\n  onError?: (message: string, code?: OAuthFailureCode) => void;\n  /** Called when 2FA is required instead of a session. */\n  onRequires2FA?: (sessionId: string, shouldPrompt2FA: boolean) => void;\n  redirectUrl?: string;\n  /** Skip the automatic redirect after success (the caller navigates). */\n  skipRedirect?: boolean;\n}\n\nexport interface UseOAuthLoginReturn {\n  /** True from the click until the page leaves (start) or the exchange settles (complete). */\n  isLoading: boolean;\n  /** The provider whose flow is in flight; disable the other buttons, show progress on this one. */\n  loadingProvider: OAuthProviderId | null;\n  error: string | null;\n  errorCode: OAuthFailureCode | null;\n  /** Redirects the tab to the provider. Resolves only if it failed to start. */\n  start: (provider: OAuthProviderId) => Promise<void>;\n  /** Exchanges the `code` the provider returned. The stored `state` must match; there is no unchecked path. */\n  complete: (provider: OAuthProviderId, code: string, state: string) => Promise<void>;\n}\n\n/**\n * Sign in with a third-party provider: one hook for every provider.\n *\n * Flow, full page in the same tab so the saved return URL survives:\n * `start(provider)` stores the server's `state`, then navigates to the provider.\n * The provider returns to `/auth?provider=<id>&code&state`; `complete(...)`\n * verifies that `state` against the stored one (login CSRF defence), exchanges\n * the code and writes the session.\n */\nexport const useOAuthLogin = (options: UseOAuthLoginOptions = {}): UseOAuthLoginReturn => {\n  const router = useCfgRouter();\n\n  const optionsRef = useRef(options);\n  optionsRef.current = options;\n  const routerRef = useRef(router);\n  routerRef.current = router;\n\n  const [loadingProvider, setLoadingProvider] = useState<OAuthProviderId | null>(null);\n  const [error, setError] = useState<string | null>(null);\n  const [errorCode, setErrorCode] = useState<OAuthFailureCode | null>(null);\n\n  // Coming back with the back button restores this page from the bfcache with\n  // the spinner still on; the provider page was left, so the flow is over.\n  useEffect(() => {\n    const onShow = (event: PageTransitionEvent) => {\n      if (event.persisted) setLoadingProvider(null);\n    };\n    window.addEventListener('pageshow', onShow);\n    return () => window.removeEventListener('pageshow', onShow);\n  }, []);\n\n  const fail = useCallback((provider: OAuthProviderId, message: string, code?: OAuthFailureCode) => {\n    setError(message);\n    setErrorCode(code ?? null);\n    setLoadingProvider(null);\n    optionsRef.current.onError?.(message, code);\n    Analytics.event(AnalyticsEvent.AUTH_OAUTH_FAIL, {\n      category: AnalyticsCategory.AUTH,\n      label: provider,\n    });\n  }, []);\n\n  const start = useCallback(async (provider: OAuthProviderId) => {\n    setLoadingProvider(provider);\n    setError(null);\n    setErrorCode(null);\n    // Match the OTP flow: a new login must not leave an older persistent\n    // session available after this browser is intentionally made session-only.\n    authTrace('oauth.start');\n    auth.clearSession();\n\n    try {\n      Analytics.event(AnalyticsEvent.AUTH_OAUTH_START, {\n        category: AnalyticsCategory.AUTH,\n        label: provider,\n      });\n\n      // No `redirect_uri`: the server derives it from the request origin.\n      const sourceUrl = optionsRef.current.sourceUrl || window.location.href;\n      const response = await ADAPTERS[provider].authorize({ source_url: sourceUrl });\n      if (!response.authorization_url || !response.state) {\n        throw new Error('Failed to get authorization URL');\n      }\n\n      cfgStorage.write(STATE_KEY, response.state);\n      cfgStorage.write(PROVIDER_KEY, provider);\n      authLogger.info(`Redirecting to ${provider}...`);\n      // Loading stays on: the tab is leaving.\n      window.location.href = response.authorization_url;\n    } catch (err) {\n      authLogger.error(`${provider} OAuth start error:`, err);\n      const failure = readOAuthFailure(err, 'Failed to start authentication');\n      fail(provider, failure.message, failure.code);\n    }\n  }, [fail]);\n\n  const complete = useCallback(async (provider: OAuthProviderId, code: string, state: string) => {\n    setLoadingProvider(provider);\n    setError(null);\n    setErrorCode(null);\n\n    // The stored state is the proof that THIS browser started the flow. A\n    // missing one is as wrong as a different one: an attacker's link carries a\n    // valid code and state for the attacker's account. Spent before any await.\n    const storedState = cfgStorage.read(STATE_KEY);\n    const storedProvider = cfgStorage.read(PROVIDER_KEY);\n    clearOAuthAttempt();\n    if (!storedState || storedState !== state || (storedProvider && storedProvider !== provider)) {\n      authLogger.warn(`${provider} OAuth callback rejected: state does not match this browser`);\n      fail(provider, 'Invalid sign-in attempt. Please try again.', 'invalid_state');\n      return;\n    }\n\n    try {\n      const response = await ADAPTERS[provider].callback({ code, state });\n\n      if (response.requires_2fa && response.session_id) {\n        Analytics.event(AnalyticsEvent.AUTH_OAUTH_START, {\n          category: AnalyticsCategory.AUTH,\n          label: `${provider}-2fa-required`,\n        });\n        optionsRef.current.onRequires2FA?.(response.session_id, response.should_prompt_2fa || false);\n        setLoadingProvider(null);\n        return;\n      }\n\n      if (!response.access || !response.refresh) {\n        throw new Error('Invalid response from OAuth callback');\n      }\n\n      // The ONE write path — atomic pair + session notification.\n      authTrace('oauth.session');\n      auth.setSession({ access: response.access, refresh: response.refresh });\n\n      Analytics.event(AnalyticsEvent.AUTH_LOGIN_SUCCESS, {\n        category: AnalyticsCategory.AUTH,\n        label: provider,\n      });\n      if (response.user?.id) {\n        Analytics.setUser(String(response.user.id));\n      }\n      if (response.user) {\n        optionsRef.current.onSuccess?.(response.user, response.is_new_user || false, provider);\n      }\n\n      setLoadingProvider(null);\n      if (!optionsRef.current.skipRedirect) {\n        // Full reload so every React context reinitialises with the new session.\n        // The saved back-url (where a guard bounced the visitor from) comes first.\n        routerRef.current.hardPush(consumeSavedRedirect() || optionsRef.current.redirectUrl || '/private');\n      }\n    } catch (err) {\n      authLogger.error(`${provider} OAuth callback error:`, err);\n      const failure = readOAuthFailure(err, 'Authentication failed');\n      fail(provider, failure.message, failure.code);\n    }\n  }, [fail]);\n\n  return {\n    isLoading: loadingProvider !== null,\n    loadingProvider,\n    error,\n    errorCode,\n    start,\n    complete,\n  };\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport type { ArrayStyle, ObjectStyle, SerializerOptions } from './pathSerializer.gen';\n\nexport type QuerySerializer = (query: Record<string, unknown>) => string;\n\nexport type BodySerializer = (body: unknown) => unknown;\n\ntype QuerySerializerOptionsObject = {\n  allowReserved?: boolean;\n  array?: Partial<SerializerOptions<ArrayStyle>>;\n  object?: Partial<SerializerOptions<ObjectStyle>>;\n};\n\nexport type QuerySerializerOptions = QuerySerializerOptionsObject & {\n  /**\n   * Per-parameter serialization overrides. When provided, these settings\n   * override the global array/object settings for specific parameter names.\n   */\n  parameters?: Record<string, QuerySerializerOptionsObject>;\n};\n\nconst serializeFormDataPair = (data: FormData, key: string, value: unknown): void => {\n  if (typeof value === 'string' || value instanceof Blob) {\n    data.append(key, value);\n  } else if (value instanceof Date) {\n    data.append(key, value.toISOString());\n  } else {\n    data.append(key, JSON.stringify(value));\n  }\n};\n\nconst serializeUrlSearchParamsPair = (data: URLSearchParams, key: string, value: unknown): void => {\n  if (typeof value === 'string') {\n    data.append(key, value);\n  } else {\n    data.append(key, JSON.stringify(value));\n  }\n};\n\nexport const formDataBodySerializer = {\n  bodySerializer: (body: unknown): FormData => {\n    const data = new FormData();\n\n    Object.entries(body as Record<string, unknown>).forEach(([key, value]) => {\n      if (value === undefined || value === null) {\n        return;\n      }\n      if (Array.isArray(value)) {\n        value.forEach((v) => serializeFormDataPair(data, key, v));\n      } else {\n        serializeFormDataPair(data, key, value);\n      }\n    });\n\n    return data;\n  },\n};\n\nexport const jsonBodySerializer = {\n  bodySerializer: (body: unknown): string =>\n    JSON.stringify(body, (_key, value) => (typeof value === 'bigint' ? value.toString() : value)),\n};\n\nexport const urlSearchParamsBodySerializer = {\n  bodySerializer: (body: unknown): string => {\n    const data = new URLSearchParams();\n\n    Object.entries(body as Record<string, unknown>).forEach(([key, value]) => {\n      if (value === undefined || value === null) {\n        return;\n      }\n      if (Array.isArray(value)) {\n        value.forEach((v) => serializeUrlSearchParamsPair(data, key, v));\n      } else {\n        serializeUrlSearchParamsPair(data, key, value);\n      }\n    });\n\n    return data.toString();\n  },\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\ntype Slot = 'body' | 'headers' | 'path' | 'query';\n\nexport type Field =\n  | {\n      in: Exclude<Slot, 'body'>;\n      /**\n       * Field name. This is the name we want the user to see and use.\n       */\n      key: string;\n      /**\n       * Field mapped name. This is the name we want to use in the request.\n       * If omitted, we use the same value as `key`.\n       */\n      map?: string;\n    }\n  | {\n      in: Extract<Slot, 'body'>;\n      /**\n       * Key isn't required for bodies.\n       */\n      key?: string;\n      map?: string;\n    }\n  | {\n      /**\n       * Field name. This is the name we want the user to see and use.\n       */\n      key: string;\n      /**\n       * Field mapped name. This is the name we want to use in the request.\n       * If `in` is omitted, `map` aliases `key` to the transport layer.\n       */\n      map: Slot;\n    };\n\nexport interface Fields {\n  allowExtra?: Partial<Record<Slot, boolean>>;\n  args?: ReadonlyArray<Field>;\n}\n\nexport type FieldsConfig = ReadonlyArray<Field | Fields>;\n\nconst extraPrefixesMap: Record<string, Slot> = {\n  $body_: 'body',\n  $headers_: 'headers',\n  $path_: 'path',\n  $query_: 'query',\n};\nconst extraPrefixes = Object.entries(extraPrefixesMap);\n\ntype KeyMap = Map<\n  string,\n  | {\n      in: Slot;\n      map?: string;\n    }\n  | {\n      in?: never;\n      map: Slot;\n    }\n>;\n\nfunction buildKeyMap(fields: FieldsConfig, map?: KeyMap): KeyMap {\n  if (!map) {\n    map = new Map();\n  }\n\n  for (const config of fields) {\n    if ('in' in config) {\n      if (config.key) {\n        map.set(config.key, {\n          in: config.in,\n          map: config.map,\n        });\n      }\n    } else if ('key' in config) {\n      map.set(config.key, {\n        map: config.map,\n      });\n    } else if (config.args) {\n      buildKeyMap(config.args, map);\n    }\n  }\n\n  return map;\n}\n\ninterface Params {\n  body?: unknown;\n  headers: Record<string, unknown>;\n  path: Record<string, unknown>;\n  query: Record<string, unknown>;\n}\n\nfunction stripEmptySlots(params: Params): void {\n  for (const [slot, value] of Object.entries(params)) {\n    if (slot === 'body') continue;\n    if (value && typeof value === 'object' && !Array.isArray(value) && !Object.keys(value).length) {\n      delete params[slot as Slot];\n    }\n  }\n}\n\nexport function buildClientParams(args: ReadonlyArray<unknown>, fields: FieldsConfig): Params {\n  const params: Params = {\n    headers: Object.create(null),\n    path: Object.create(null),\n    query: Object.create(null),\n  };\n\n  const map = buildKeyMap(fields);\n\n  function writeSlot(slot: Slot, key: string, value: unknown): void {\n    let record = params[slot] as Record<string, unknown> | undefined;\n    if (record === undefined) {\n      record = Object.create(null) as Record<string, unknown>;\n      params[slot] = record;\n    }\n    record[key] = value;\n  }\n\n  let config: FieldsConfig[number] | undefined;\n\n  for (const [index, arg] of args.entries()) {\n    if (fields[index]) {\n      config = fields[index];\n    }\n\n    if (!config) {\n      continue;\n    }\n\n    if ('in' in config) {\n      if (config.key) {\n        const field = map.get(config.key)!;\n        const name = field.map || config.key;\n        if (field.in) {\n          writeSlot(field.in, name, arg);\n        }\n      } else {\n        params.body = arg;\n      }\n    } else {\n      for (const [key, value] of Object.entries(arg ?? {})) {\n        const field = map.get(key);\n\n        if (field) {\n          if (field.in) {\n            const name = field.map || key;\n            writeSlot(field.in, name, value);\n          } else {\n            params[field.map] = value;\n          }\n        } else {\n          const extra = extraPrefixes.find(([prefix]) => key.startsWith(prefix));\n\n          if (extra) {\n            const [prefix, slot] = extra;\n            writeSlot(slot, key.slice(prefix.length), value);\n          } else if ('allowExtra' in config && config.allowExtra) {\n            for (const [slot, allowed] of Object.entries(config.allowExtra)) {\n              if (allowed) {\n                writeSlot(slot as Slot, key, value);\n                break;\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n\n  stripEmptySlots(params);\n\n  return params;\n}\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport type { Config } from './types.gen';\n\nexport type ServerSentEventsOptions<TData = unknown> = Omit<RequestInit, 'method'> &\n  Pick<Config, 'method' | 'responseTransformer' | 'responseValidator'> & {\n    /**\n     * Fetch API implementation. You can use this option to provide a custom\n     * fetch instance.\n     *\n     * @default globalThis.fetch\n     */\n    fetch?: typeof fetch;\n    /**\n     * Implementing clients can call request interceptors inside this hook.\n     */\n    onRequest?: (url: string, init: RequestInit) => Promise<Request>;\n    /**\n     * Callback invoked when a network or parsing error occurs during streaming.\n     *\n     * This option applies only if the endpoint returns a stream of events.\n     *\n     * @param error The error that occurred.\n     */\n    onSseError?: (error: unknown) => void;\n    /**\n     * Callback invoked when an event is streamed from the server.\n     *\n     * This option applies only if the endpoint returns a stream of events.\n     *\n     * @param event Event streamed from the server.\n     * @returns Nothing (void).\n     */\n    onSseEvent?: (event: StreamEvent<TData>) => void;\n    serializedBody?: RequestInit['body'];\n    /**\n     * Default retry delay in milliseconds.\n     *\n     * This option applies only if the endpoint returns a stream of events.\n     *\n     * @default 3000\n     */\n    sseDefaultRetryDelay?: number;\n    /**\n     * Maximum number of retry attempts before giving up.\n     */\n    sseMaxRetryAttempts?: number;\n    /**\n     * Maximum retry delay in milliseconds.\n     *\n     * Applies only when exponential backoff is used.\n     *\n     * This option applies only if the endpoint returns a stream of events.\n     *\n     * @default 30000\n     */\n    sseMaxRetryDelay?: number;\n    /**\n     * Optional sleep function for retry backoff.\n     *\n     * Defaults to using `setTimeout`.\n     */\n    sseSleepFn?: (ms: number) => Promise<void>;\n    url: string;\n  };\n\nexport interface StreamEvent<TData = unknown> {\n  data: TData;\n  event?: string;\n  id?: string;\n  retry?: number;\n}\n\nexport type ServerSentEventsResult<TData = unknown, TReturn = void, TNext = unknown> = {\n  stream: AsyncGenerator<\n    TData extends Record<string, unknown> ? TData[keyof TData] : TData,\n    TReturn,\n    TNext\n  >;\n};\n\nexport function createSseClient<TData = unknown>({\n  onRequest,\n  onSseError,\n  onSseEvent,\n  responseTransformer,\n  responseValidator,\n  sseDefaultRetryDelay,\n  sseMaxRetryAttempts,\n  sseMaxRetryDelay,\n  sseSleepFn,\n  url,\n  ...options\n}: ServerSentEventsOptions): ServerSentEventsResult<TData> {\n  let lastEventId: string | undefined;\n\n  const sleep = sseSleepFn ?? ((ms: number) => new Promise((resolve) => setTimeout(resolve, ms)));\n\n  const createStream = async function* () {\n    let retryDelay: number = sseDefaultRetryDelay ?? 3000;\n    let attempt = 0;\n    const signal = options.signal ?? new AbortController().signal;\n\n    while (true) {\n      if (signal.aborted) break;\n\n      attempt++;\n\n      const headers =\n        options.headers instanceof Headers\n          ? options.headers\n          : new Headers(options.headers as Record<string, string> | undefined);\n\n      if (lastEventId !== undefined) {\n        headers.set('Last-Event-ID', lastEventId);\n      }\n\n      try {\n        const requestInit: RequestInit = {\n          redirect: 'follow',\n          ...options,\n          body: options.serializedBody,\n          headers,\n          signal,\n        };\n        let request = new Request(url, requestInit);\n        if (onRequest) {\n          request = await onRequest(url, requestInit);\n        }\n        // fetch must be assigned here, otherwise it would throw the error:\n        // TypeError: Failed to execute 'fetch' on 'Window': Illegal invocation\n        const _fetch = options.fetch ?? globalThis.fetch;\n        const response = await _fetch(request);\n\n        if (!response.ok) throw new Error(`SSE failed: ${response.status} ${response.statusText}`);\n\n        if (!response.body) throw new Error('No body in SSE response');\n\n        const reader = response.body.pipeThrough(new TextDecoderStream()).getReader();\n\n        let buffer = '';\n\n        const abortHandler = () => {\n          try {\n            reader.cancel();\n          } catch {\n            // noop\n          }\n        };\n\n        signal.addEventListener('abort', abortHandler);\n\n        try {\n          while (true) {\n            const { done, value } = await reader.read();\n            if (done) break;\n            buffer += value;\n            buffer = buffer.replace(/\\r\\n?/g, '\\n'); // normalize line endings\n\n            const chunks = buffer.split('\\n\\n');\n            buffer = chunks.pop() ?? '';\n\n            for (const chunk of chunks) {\n              const lines = chunk.split('\\n');\n              const dataLines: Array<string> = [];\n              let eventName: string | undefined;\n\n              for (const line of lines) {\n                if (line.startsWith('data:')) {\n                  dataLines.push(line.replace(/^data:\\s*/, ''));\n                } else if (line.startsWith('event:')) {\n                  eventName = line.replace(/^event:\\s*/, '');\n                } else if (line.startsWith('id:')) {\n                  lastEventId = line.replace(/^id:\\s*/, '');\n                } else if (line.startsWith('retry:')) {\n                  const parsed = Number.parseInt(line.replace(/^retry:\\s*/, ''), 10);\n                  if (!Number.isNaN(parsed)) {\n                    retryDelay = parsed;\n                  }\n                }\n              }\n\n              let data: unknown;\n              let parsedJson = false;\n\n              if (dataLines.length) {\n                const rawData = dataLines.join('\\n');\n                try {\n                  data = JSON.parse(rawData);\n                  parsedJson = true;\n                } catch {\n                  data = rawData;\n                }\n              }\n\n              if (parsedJson) {\n                if (responseValidator) {\n                  await responseValidator(data);\n                }\n\n                if (responseTransformer) {\n                  data = await responseTransformer(data);\n                }\n              }\n\n              onSseEvent?.({\n                data,\n                event: eventName,\n                id: lastEventId,\n                retry: retryDelay,\n              });\n\n              if (dataLines.length) {\n                yield data as any;\n              }\n            }\n          }\n        } finally {\n          signal.removeEventListener('abort', abortHandler);\n          reader.releaseLock();\n        }\n\n        break; // exit loop on normal completion\n      } catch (error) {\n        // connection failed or aborted; retry after delay\n        onSseError?.(error);\n\n        if (sseMaxRetryAttempts !== undefined && attempt >= sseMaxRetryAttempts) {\n          break; // stop after firing error\n        }\n\n        // exponential backoff: double retry each attempt, cap at 30s\n        const backoff = Math.min(retryDelay * 2 ** (attempt - 1), sseMaxRetryDelay ?? 30000);\n        await sleep(backoff);\n      }\n    }\n  };\n\n  const stream = createStream();\n\n  return { stream };\n}\n","// This file is auto-generated by @hey-api/openapi-ts\n\ninterface SerializeOptions<T> extends SerializePrimitiveOptions, SerializerOptions<T> {}\n\ninterface SerializePrimitiveOptions {\n  allowReserved?: boolean;\n  name: string;\n}\n\nexport interface SerializerOptions<T> {\n  /**\n   * @default true\n   */\n  explode: boolean;\n  style: T;\n}\n\nexport type ArrayStyle = 'form' | 'spaceDelimited' | 'pipeDelimited';\nexport type ArraySeparatorStyle = ArrayStyle | MatrixStyle;\ntype MatrixStyle = 'label' | 'matrix' | 'simple';\nexport type ObjectStyle = 'form' | 'deepObject';\ntype ObjectSeparatorStyle = ObjectStyle | MatrixStyle;\n\ninterface SerializePrimitiveParam extends SerializePrimitiveOptions {\n  value: string;\n}\n\nexport const separatorArrayExplode = (style: ArraySeparatorStyle): '.' | ';' | ',' | '&' => {\n  switch (style) {\n    case 'label':\n      return '.';\n    case 'matrix':\n      return ';';\n    case 'simple':\n      return ',';\n    default:\n      return '&';\n  }\n};\n\nexport const separatorArrayNoExplode = (style: ArraySeparatorStyle): ',' | '|' | '%20' => {\n  switch (style) {\n    case 'form':\n      return ',';\n    case 'pipeDelimited':\n      return '|';\n    case 'spaceDelimited':\n      return '%20';\n    default:\n      return ',';\n  }\n};\n\nexport const separatorObjectExplode = (style: ObjectSeparatorStyle): '.' | ';' | ',' | '&' => {\n  switch (style) {\n    case 'label':\n      return '.';\n    case 'matrix':\n      return ';';\n    case 'simple':\n      return ',';\n    default:\n      return '&';\n  }\n};\n\nexport const serializeArrayParam = ({\n  allowReserved,\n  explode,\n  name,\n  style,\n  value,\n}: SerializeOptions<ArraySeparatorStyle> & {\n  value: unknown[];\n}): string => {\n  if (!explode) {\n    const joinedValues = (\n      allowReserved ? value : value.map((v) => encodeURIComponent(v as string))\n    ).join(separatorArrayNoExplode(style));\n    switch (style) {\n      case 'label':\n        return `.${joinedValues}`;\n      case 'matrix':\n        return `;${name}=${joinedValues}`;\n      case 'simple':\n        return joinedValues;\n      default:\n        return `${name}=${joinedValues}`;\n    }\n  }\n\n  const separator = separatorArrayExplode(style);\n  const joinedValues = value\n    .map((v) => {\n      if (style === 'label' || style === 'simple') {\n        return allowReserved ? v : encodeURIComponent(v as string);\n      }\n\n      return serializePrimitiveParam({\n        allowReserved,\n        name,\n        value: v as string,\n      });\n    })\n    .join(separator);\n  return style === 'label' || style === 'matrix' ? separator + joinedValues : joinedValues;\n};\n\nexport const serializePrimitiveParam = ({\n  allowReserved,\n  name,\n  value,\n}: SerializePrimitiveParam): string => {\n  if (value === undefined || value === null) {\n    return '';\n  }\n\n  if (typeof value === 'object') {\n    throw new Error(\n      'Deeply-nested arrays/objects aren’t supported. Provide your own `querySerializer()` to handle these.',\n    );\n  }\n\n  return `${name}=${allowReserved ? value : encodeURIComponent(value)}`;\n};\n\nexport const serializeObjectParam = ({\n  allowReserved,\n  explode,\n  name,\n  style,\n  value,\n  valueOnly,\n}: SerializeOptions<ObjectSeparatorStyle> & {\n  value: Record<string, unknown> | Date;\n  valueOnly?: boolean;\n}): string => {\n  if (value instanceof Date) {\n    return valueOnly ? value.toISOString() : `${name}=${value.toISOString()}`;\n  }\n\n  if (style !== 'deepObject' && !explode) {\n    let values: string[] = [];\n    Object.entries(value).forEach(([key, v]) => {\n      values = [...values, key, allowReserved ? (v as string) : encodeURIComponent(v as string)];\n    });\n    const joinedValues = values.join(',');\n    switch (style) {\n      case 'form':\n        return `${name}=${joinedValues}`;\n      case 'label':\n        return `.${joinedValues}`;\n      case 'matrix':\n        return `;${name}=${joinedValues}`;\n      default:\n        return joinedValues;\n    }\n  }\n\n  const separator = separatorObjectExplode(style);\n  const joinedValues = Object.entries(value)\n    .map(([key, v]) =>\n      serializePrimitiveParam({\n        allowReserved,\n        name: style === 'deepObject' ? `${name}[${key}]` : key,\n        value: v as string,\n      }),\n    )\n    .join(separator);\n  return style === 'label' || style === 'matrix' ? separator + joinedValues : joinedValues;\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport type { BodySerializer, QuerySerializer } from './bodySerializer.gen';\nimport {\n  type ArraySeparatorStyle,\n  serializeArrayParam,\n  serializeObjectParam,\n  serializePrimitiveParam,\n} from './pathSerializer.gen';\n\nexport interface PathSerializer {\n  path: Record<string, unknown>;\n  url: string;\n}\n\nexport const PATH_PARAM_RE: RegExp = /\\{[^{}]+\\}/g;\n\nexport const defaultPathSerializer = ({ path, url: _url }: PathSerializer): string => {\n  let url = _url;\n  const matches = _url.match(PATH_PARAM_RE);\n  if (matches) {\n    for (const match of matches) {\n      let explode = false;\n      let name = match.substring(1, match.length - 1);\n      let style: ArraySeparatorStyle = 'simple';\n\n      if (name.endsWith('*')) {\n        explode = true;\n        name = name.substring(0, name.length - 1);\n      }\n\n      if (name.startsWith('.')) {\n        name = name.substring(1);\n        style = 'label';\n      } else if (name.startsWith(';')) {\n        name = name.substring(1);\n        style = 'matrix';\n      }\n\n      const value = path[name];\n\n      if (value === undefined || value === null) {\n        continue;\n      }\n\n      if (Array.isArray(value)) {\n        url = url.replace(match, serializeArrayParam({ explode, name, style, value }));\n        continue;\n      }\n\n      if (typeof value === 'object') {\n        url = url.replace(\n          match,\n          serializeObjectParam({\n            explode,\n            name,\n            style,\n            value: value as Record<string, unknown>,\n            valueOnly: true,\n          }),\n        );\n        continue;\n      }\n\n      if (style === 'matrix') {\n        url = url.replace(\n          match,\n          `;${serializePrimitiveParam({\n            name,\n            value: value as string,\n          })}`,\n        );\n        continue;\n      }\n\n      const replaceValue = encodeURIComponent(\n        style === 'label' ? `.${value as string}` : (value as string),\n      );\n      url = url.replace(match, replaceValue);\n    }\n  }\n  return url;\n};\n\nexport const getUrl = ({\n  baseUrl,\n  path,\n  query,\n  querySerializer,\n  url: _url,\n}: {\n  baseUrl?: string;\n  path?: Record<string, unknown>;\n  query?: Record<string, unknown>;\n  querySerializer: QuerySerializer;\n  url: string;\n}): string => {\n  const pathUrl = _url.startsWith('/') ? _url : `/${_url}`;\n  let url = (baseUrl ?? '') + pathUrl;\n  if (path) {\n    url = defaultPathSerializer({ path, url });\n  }\n  let search = query ? querySerializer(query) : '';\n  if (search.startsWith('?')) {\n    search = search.substring(1);\n  }\n  if (search) {\n    url += `?${search}`;\n  }\n  return url;\n};\n\nexport function getValidRequestBody(options: {\n  body?: unknown;\n  bodySerializer?: BodySerializer | null;\n  serializedBody?: unknown;\n}): unknown {\n  const hasBody = options.body !== undefined;\n  const isSerializedBody = hasBody && options.bodySerializer;\n\n  if (isSerializedBody) {\n    if ('serializedBody' in options) {\n      const hasSerializedBody =\n        options.serializedBody !== undefined && options.serializedBody !== '';\n\n      return hasSerializedBody ? options.serializedBody : null;\n    }\n\n    // not all clients implement a serializedBody property (i.e., client-axios)\n    return options.body !== '' ? options.body : null;\n  }\n\n  // plain/text body\n  if (hasBody) {\n    return options.body;\n  }\n\n  // no body was provided\n  return undefined;\n}\n","// This file is auto-generated by @hey-api/openapi-ts\n\nexport type AuthToken = string | undefined;\n\nexport interface Auth {\n  /**\n   * Which part of the request do we use to send the auth?\n   *\n   * @default 'header'\n   */\n  in?: 'header' | 'query' | 'cookie';\n  /**\n   * A unique identifier for the security scheme.\n   *\n   * Defined only when there are multiple security schemes whose `Auth`\n   * shape would otherwise be identical.\n   */\n  key?: string;\n  /**\n   * Header or query parameter name.\n   *\n   * @default 'Authorization'\n   */\n  name?: string;\n  scheme?: 'basic' | 'bearer';\n  type: 'apiKey' | 'http';\n}\n\nexport const getAuthToken = async (\n  auth: Auth,\n  callback: ((auth: Auth) => Promise<AuthToken> | AuthToken) | AuthToken,\n): Promise<string | undefined> => {\n  const token = typeof callback === 'function' ? await callback(auth) : callback;\n\n  if (!token) {\n    return;\n  }\n\n  if (auth.scheme === 'bearer') {\n    return `Bearer ${token}`;\n  }\n\n  if (auth.scheme === 'basic') {\n    return `Basic ${btoa(token)}`;\n  }\n\n  return token;\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport { getAuthToken } from '../core/auth.gen';\nimport type { QuerySerializerOptions } from '../core/bodySerializer.gen';\nimport { jsonBodySerializer } from '../core/bodySerializer.gen';\nimport {\n  serializeArrayParam,\n  serializeObjectParam,\n  serializePrimitiveParam,\n} from '../core/pathSerializer.gen';\nimport { getUrl } from '../core/utils.gen';\nimport type { Client, ClientOptions, Config, RequestOptions } from './types.gen';\n\nexport const createQuerySerializer = <T = unknown>({\n  parameters = {},\n  ...args\n}: QuerySerializerOptions = {}): ((queryParams: T) => string) => {\n  const querySerializer = (queryParams: T): string => {\n    const search: string[] = [];\n    if (queryParams && typeof queryParams === 'object') {\n      for (const name in queryParams) {\n        const value = queryParams[name];\n\n        if (value === undefined || value === null) {\n          continue;\n        }\n\n        const options = parameters[name] || args;\n\n        if (Array.isArray(value)) {\n          const serializedArray = serializeArrayParam({\n            allowReserved: options.allowReserved,\n            explode: true,\n            name,\n            style: 'form',\n            value,\n            ...options.array,\n          });\n          if (serializedArray) search.push(serializedArray);\n        } else if (typeof value === 'object') {\n          const serializedObject = serializeObjectParam({\n            allowReserved: options.allowReserved,\n            explode: true,\n            name,\n            style: 'deepObject',\n            value: value as Record<string, unknown>,\n            ...options.object,\n          });\n          if (serializedObject) search.push(serializedObject);\n        } else {\n          const serializedPrimitive = serializePrimitiveParam({\n            allowReserved: options.allowReserved,\n            name,\n            value: value as string,\n          });\n          if (serializedPrimitive) search.push(serializedPrimitive);\n        }\n      }\n    }\n    return search.join('&');\n  };\n  return querySerializer;\n};\n\n/**\n * Infers parseAs value from provided Content-Type header.\n */\nexport const getParseAs = (contentType: string | null): Exclude<Config['parseAs'], 'auto'> => {\n  if (!contentType) {\n    // If no Content-Type header is provided, the best we can do is return the raw response body,\n    // which is effectively the same as the 'stream' option.\n    return 'stream';\n  }\n\n  const cleanContent = contentType.split(';')[0]?.trim();\n\n  if (!cleanContent) {\n    return;\n  }\n\n  if (cleanContent.startsWith('application/json') || cleanContent.endsWith('+json')) {\n    return 'json';\n  }\n\n  if (cleanContent === 'multipart/form-data') {\n    return 'formData';\n  }\n\n  if (\n    ['application/', 'audio/', 'image/', 'video/'].some((type) => cleanContent.startsWith(type))\n  ) {\n    return 'blob';\n  }\n\n  if (cleanContent.startsWith('text/')) {\n    return 'text';\n  }\n\n  return;\n};\n\nconst checkForExistence = (\n  options: Pick<RequestOptions, 'auth' | 'query'> & {\n    headers: Headers;\n  },\n  name?: string,\n): boolean => {\n  if (!name) {\n    return false;\n  }\n  if (\n    options.headers.has(name) ||\n    options.query?.[name] ||\n    options.headers.get('Cookie')?.includes(`${name}=`)\n  ) {\n    return true;\n  }\n  return false;\n};\n\nexport async function setAuthParams(\n  options: Pick<RequestOptions, 'auth' | 'query' | 'security'> & {\n    headers: Headers;\n  },\n): Promise<void> {\n  for (const auth of options.security ?? []) {\n    if (checkForExistence(options, auth.name)) {\n      continue;\n    }\n\n    const token = await getAuthToken(auth, options.auth);\n\n    if (!token) {\n      continue;\n    }\n\n    const name = auth.name ?? 'Authorization';\n\n    switch (auth.in) {\n      case 'query':\n        if (!options.query) {\n          options.query = {};\n        }\n        options.query[name] = token;\n        break;\n      case 'cookie':\n        options.headers.append('Cookie', `${name}=${token}`);\n        break;\n      case 'header':\n      default:\n        options.headers.set(name, token);\n        break;\n    }\n  }\n}\n\nexport const buildUrl: Client['buildUrl'] = (options) =>\n  getUrl({\n    baseUrl: options.baseUrl as string,\n    path: options.path,\n    query: options.query,\n    querySerializer:\n      typeof options.querySerializer === 'function'\n        ? options.querySerializer\n        : createQuerySerializer(options.querySerializer),\n    url: options.url,\n  });\n\nexport const mergeConfigs = (a: Config, b: Config): Config => {\n  const config = { ...a, ...b };\n  if (config.baseUrl?.endsWith('/')) {\n    config.baseUrl = config.baseUrl.substring(0, config.baseUrl.length - 1);\n  }\n  config.headers = mergeHeaders(a.headers, b.headers);\n  return config;\n};\n\nconst headersEntries = (headers: Headers): Array<[string, string]> => {\n  const entries: Array<[string, string]> = [];\n  headers.forEach((value, key) => {\n    entries.push([key, value]);\n  });\n  return entries;\n};\n\nexport const mergeHeaders = (\n  ...headers: Array<Required<Config>['headers'] | undefined>\n): Headers => {\n  const mergedHeaders = new Headers();\n  for (const header of headers) {\n    if (!header) {\n      continue;\n    }\n\n    const iterator = header instanceof Headers ? headersEntries(header) : Object.entries(header);\n\n    for (const [key, value] of iterator) {\n      if (value === null) {\n        mergedHeaders.delete(key);\n      } else if (Array.isArray(value)) {\n        for (const v of value) {\n          mergedHeaders.append(key, v as string);\n        }\n      } else if (value !== undefined) {\n        // assume object headers are meant to be JSON stringified, i.e., their\n        // content value in OpenAPI specification is 'application/json'\n        mergedHeaders.set(\n          key,\n          typeof value === 'object' ? JSON.stringify(value) : (value as string),\n        );\n      }\n    }\n  }\n  return mergedHeaders;\n};\n\ntype ErrInterceptor<Err, Res, Req, Options> = (\n  error: Err,\n  /** response may be undefined due to a network error where no response object is produced */\n  response: Res | undefined,\n  /** request may be undefined, because error may be from building the request object itself */\n  request: Req | undefined,\n  options: Options,\n) => Err | Promise<Err>;\n\ntype ReqInterceptor<Req, Options> = (request: Req, options: Options) => Req | Promise<Req>;\n\ntype ResInterceptor<Res, Req, Options> = (\n  response: Res,\n  request: Req,\n  options: Options,\n) => Res | Promise<Res>;\n\nclass Interceptors<Interceptor> {\n  fns: Array<Interceptor | null> = [];\n\n  clear(): void {\n    this.fns = [];\n  }\n\n  eject(id: number | Interceptor): void {\n    const index = this.getInterceptorIndex(id);\n    if (this.fns[index]) {\n      this.fns[index] = null;\n    }\n  }\n\n  exists(id: number | Interceptor): boolean {\n    const index = this.getInterceptorIndex(id);\n    return Boolean(this.fns[index]);\n  }\n\n  getInterceptorIndex(id: number | Interceptor): number {\n    if (typeof id === 'number') {\n      return this.fns[id] ? id : -1;\n    }\n    return this.fns.indexOf(id);\n  }\n\n  update(id: number | Interceptor, fn: Interceptor): number | Interceptor | false {\n    const index = this.getInterceptorIndex(id);\n    if (this.fns[index]) {\n      this.fns[index] = fn;\n      return id;\n    }\n    return false;\n  }\n\n  use(fn: Interceptor): number {\n    this.fns.push(fn);\n    return this.fns.length - 1;\n  }\n}\n\nexport interface Middleware<Req, Res, Err, Options> {\n  error: Interceptors<ErrInterceptor<Err, Res, Req, Options>>;\n  request: Interceptors<ReqInterceptor<Req, Options>>;\n  response: Interceptors<ResInterceptor<Res, Req, Options>>;\n}\n\nexport const createInterceptors = <Req, Res, Err, Options>(): Middleware<\n  Req,\n  Res,\n  Err,\n  Options\n> => ({\n  error: new Interceptors<ErrInterceptor<Err, Res, Req, Options>>(),\n  request: new Interceptors<ReqInterceptor<Req, Options>>(),\n  response: new Interceptors<ResInterceptor<Res, Req, Options>>(),\n});\n\nconst defaultQuerySerializer = createQuerySerializer({\n  allowReserved: false,\n  array: {\n    explode: true,\n    style: 'form',\n  },\n  object: {\n    explode: true,\n    style: 'deepObject',\n  },\n});\n\nconst defaultHeaders = {\n  'Content-Type': 'application/json',\n};\n\nexport const createConfig = <T extends ClientOptions = ClientOptions>(\n  override: Config<Omit<ClientOptions, keyof T> & T> = {},\n): Config<Omit<ClientOptions, keyof T> & T> => ({\n  ...jsonBodySerializer,\n  headers: defaultHeaders,\n  parseAs: 'auto',\n  querySerializer: defaultQuerySerializer,\n  ...override,\n});\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport { createSseClient } from '../core/serverSentEvents.gen';\nimport type { HttpMethod } from '../core/types.gen';\nimport { getValidRequestBody } from '../core/utils.gen';\nimport type { Client, Config, RequestOptions, ResolvedRequestOptions } from './types.gen';\nimport {\n  buildUrl,\n  createConfig,\n  createInterceptors,\n  getParseAs,\n  mergeConfigs,\n  mergeHeaders,\n  setAuthParams,\n} from './utils.gen';\n\ntype ReqInit = Omit<RequestInit, 'body' | 'headers'> & {\n  body?: any;\n  headers: ReturnType<typeof mergeHeaders>;\n};\n\nexport const createClient = (config: Config = {}): Client => {\n  let _config = mergeConfigs(createConfig(), config);\n\n  const getConfig = (): Config => ({ ..._config });\n\n  const setConfig = (config: Config): Config => {\n    _config = mergeConfigs(_config, config);\n    return getConfig();\n  };\n\n  const interceptors = createInterceptors<Request, Response, unknown, ResolvedRequestOptions>();\n\n  const beforeRequest = async <\n    TData = unknown,\n    TResponseStyle extends 'data' | 'fields' = 'fields',\n    ThrowOnError extends boolean = boolean,\n    Url extends string = string,\n  >(\n    options: RequestOptions<TData, TResponseStyle, ThrowOnError, Url>,\n  ) => {\n    const opts = {\n      ..._config,\n      ...options,\n      fetch: options.fetch ?? _config.fetch ?? globalThis.fetch,\n      headers: mergeHeaders(_config.headers, options.headers),\n      serializedBody: undefined as string | undefined,\n    };\n\n    if (opts.security) {\n      await setAuthParams(opts);\n    }\n\n    if (opts.requestValidator) {\n      await opts.requestValidator(opts);\n    }\n\n    if (opts.body !== undefined && opts.bodySerializer) {\n      opts.serializedBody = opts.bodySerializer(opts.body) as string | undefined;\n    }\n\n    // remove Content-Type header if body is empty to avoid sending invalid requests\n    if (opts.body === undefined || opts.serializedBody === '') {\n      opts.headers.delete('Content-Type');\n    }\n\n    const resolvedOpts = opts as typeof opts &\n      ResolvedRequestOptions<TResponseStyle, ThrowOnError, Url>;\n    const url = buildUrl(resolvedOpts);\n\n    return { opts: resolvedOpts, url };\n  };\n\n  const request: Client['request'] = async (options) => {\n    const throwOnError = options.throwOnError ?? _config.throwOnError;\n    const responseStyle = options.responseStyle ?? _config.responseStyle;\n\n    let request: Request | undefined;\n    let response: Response | undefined;\n\n    try {\n      const { opts, url } = await beforeRequest(options);\n      const requestInit: ReqInit = {\n        redirect: 'follow',\n        ...opts,\n        body: getValidRequestBody(opts),\n      };\n\n      request = new Request(url, requestInit);\n\n      for (const fn of interceptors.request.fns) {\n        if (fn) {\n          request = await fn(request, opts);\n        }\n      }\n\n      // fetch must be assigned here, otherwise it would throw the error:\n      // TypeError: Failed to execute 'fetch' on 'Window': Illegal invocation\n      const _fetch = opts.fetch!;\n\n      response = await _fetch(request);\n\n      for (const fn of interceptors.response.fns) {\n        if (fn) {\n          response = await fn(response, request, opts);\n        }\n      }\n\n      const result = {\n        request,\n        response,\n      };\n\n      if (response.ok) {\n        const parseAs =\n          (opts.parseAs === 'auto'\n            ? getParseAs(response.headers.get('Content-Type'))\n            : opts.parseAs) ?? 'json';\n\n        if (response.status === 204 || response.headers.get('Content-Length') === '0') {\n          let emptyData: any;\n          switch (parseAs) {\n            case 'arrayBuffer':\n            case 'blob':\n            case 'text':\n              emptyData = await response[parseAs]();\n              break;\n            case 'formData':\n              emptyData = new FormData();\n              break;\n            case 'stream':\n              emptyData = response.body;\n              break;\n            case 'json':\n            default:\n              emptyData = {};\n              break;\n          }\n          return opts.responseStyle === 'data'\n            ? emptyData\n            : {\n                data: emptyData,\n                ...result,\n              };\n        }\n\n        let data: any;\n        switch (parseAs) {\n          case 'arrayBuffer':\n          case 'blob':\n          case 'formData':\n          case 'text':\n            data = await response[parseAs]();\n            break;\n          case 'json': {\n            // Some servers return 200 with no Content-Length and empty body.\n            // response.json() would throw; read as text and parse if non-empty.\n            const text = await response.text();\n            data = text ? JSON.parse(text) : {};\n            break;\n          }\n          case 'stream':\n            return opts.responseStyle === 'data'\n              ? response.body\n              : {\n                  data: response.body,\n                  ...result,\n                };\n        }\n\n        if (parseAs === 'json') {\n          if (opts.responseValidator) {\n            await opts.responseValidator(data);\n          }\n\n          if (opts.responseTransformer) {\n            data = await opts.responseTransformer(data);\n          }\n        }\n\n        return opts.responseStyle === 'data'\n          ? data\n          : {\n              data,\n              ...result,\n            };\n      }\n\n      const textError = await response.text();\n      let jsonError: unknown;\n\n      try {\n        jsonError = JSON.parse(textError);\n      } catch {\n        // noop\n      }\n\n      throw jsonError ?? textError;\n    } catch (error) {\n      let finalError = error;\n\n      for (const fn of interceptors.error.fns) {\n        if (fn) {\n          finalError = await fn(finalError, response, request, options as ResolvedRequestOptions);\n        }\n      }\n\n      finalError = finalError || {};\n\n      if (throwOnError) {\n        throw finalError;\n      }\n\n      // TODO: we probably want to return error and improve types\n      return responseStyle === 'data'\n        ? undefined\n        : {\n            error: finalError,\n            request,\n            response,\n          };\n    }\n  };\n\n  const makeMethodFn = (method: Uppercase<HttpMethod>) => (options: RequestOptions) =>\n    request({ ...options, method });\n\n  const makeSseFn = (method: Uppercase<HttpMethod>) => async (options: RequestOptions) => {\n    const { opts, url } = await beforeRequest(options);\n    return createSseClient({\n      ...opts,\n      body: opts.body as BodyInit | null | undefined,\n      method,\n      onRequest: async (url, init) => {\n        let request = new Request(url, init);\n        for (const fn of interceptors.request.fns) {\n          if (fn) {\n            request = await fn(request, opts);\n          }\n        }\n        return request;\n      },\n      serializedBody: getValidRequestBody(opts) as BodyInit | null | undefined,\n      url,\n    });\n  };\n\n  const _buildUrl: Client['buildUrl'] = (options) => buildUrl({ ..._config, ...options });\n\n  return {\n    buildUrl: _buildUrl,\n    connect: makeMethodFn('CONNECT'),\n    delete: makeMethodFn('DELETE'),\n    get: makeMethodFn('GET'),\n    getConfig,\n    head: makeMethodFn('HEAD'),\n    interceptors,\n    options: makeMethodFn('OPTIONS'),\n    patch: makeMethodFn('PATCH'),\n    post: makeMethodFn('POST'),\n    put: makeMethodFn('PUT'),\n    request,\n    setConfig,\n    sse: {\n      connect: makeSseFn('CONNECT'),\n      delete: makeSseFn('DELETE'),\n      get: makeSseFn('GET'),\n      head: makeSseFn('HEAD'),\n      options: makeSseFn('OPTIONS'),\n      patch: makeSseFn('PATCH'),\n      post: makeSseFn('POST'),\n      put: makeSseFn('PUT'),\n      trace: makeSseFn('TRACE'),\n    },\n    trace: makeMethodFn('TRACE'),\n  } as Client;\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport { type Client, type ClientOptions, type Config, createClient, createConfig } from './client';\nimport type { ClientOptions as ClientOptions2 } from './types.gen';\n\n/**\n * The `createClientConfig()` function will be called on client initialization\n * and the returned object will become the client's initial configuration.\n *\n * You may want to initialize your client this way instead of calling\n * `setConfig()`. This is useful for example if you're using Next.js\n * to ensure your client always has the correct values.\n */\nexport type CreateClientConfig<T extends ClientOptions = ClientOptions2> = (override?: Config<ClientOptions & T>) => Config<Required<ClientOptions> & T>;\n\nexport const client: Client = createClient(createConfig<ClientOptions2>({ baseUrl: 'http://localhost:8000' }));\n\n// auto-init: install auth on client\nimport { installAuthOnClient } from './helpers/auth';\ninstallAuthOnClient(client);\n","// This file is auto-generated by @hey-api/openapi-ts\n\nimport { type Client, type ClientMeta, formDataBodySerializer, type Options as Options2, type RequestResult, type TDataShape } from './client';\nimport { client } from './client.gen';\nimport type { CfgAccountsApiKeyRegenerateCreateData, CfgAccountsApiKeyRegenerateCreateErrors, CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRetrieveData, CfgAccountsApiKeyRetrieveErrors, CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRevealCreateData, CfgAccountsApiKeyRevealCreateErrors, CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyTestCreateData, CfgAccountsApiKeyTestCreateResponses, CfgAccountsOauthConnectionsListData, CfgAccountsOauthConnectionsListResponses, CfgAccountsOauthDisconnectCreateData, CfgAccountsOauthDisconnectCreateErrors, CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthGithubAuthorizeCreateData, CfgAccountsOauthGithubAuthorizeCreateErrors, CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubCallbackCreateData, CfgAccountsOauthGithubCallbackCreateErrors, CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthGoogleAuthorizeCreateData, CfgAccountsOauthGoogleAuthorizeCreateErrors, CfgAccountsOauthGoogleAuthorizeCreateResponses, CfgAccountsOauthGoogleCallbackCreateData, CfgAccountsOauthGoogleCallbackCreateErrors, CfgAccountsOauthGoogleCallbackCreateResponses, CfgAccountsOauthProvidersRetrieveData, CfgAccountsOauthProvidersRetrieveResponses, CfgAccountsOtpConsentPolicyRetrieveData, CfgAccountsOtpConsentPolicyRetrieveResponses, CfgAccountsOtpRequestCreateData, CfgAccountsOtpRequestCreateErrors, CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpVerifyCreateData, CfgAccountsOtpVerifyCreateErrors, CfgAccountsOtpVerifyCreateResponses, CfgAccountsProfileAvatarCreateData, CfgAccountsProfileAvatarCreateErrors, CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileDeleteCreateData, CfgAccountsProfileDeleteCreateErrors, CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfilePartialPartialUpdateData, CfgAccountsProfilePartialPartialUpdateErrors, CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialUpdateData, CfgAccountsProfilePartialUpdateErrors, CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfileRetrieveData, CfgAccountsProfileRetrieveErrors, CfgAccountsProfileRetrieveResponses, CfgAccountsProfileUpdatePartialUpdateData, CfgAccountsProfileUpdatePartialUpdateErrors, CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdateUpdateData, CfgAccountsProfileUpdateUpdateErrors, CfgAccountsProfileUpdateUpdateResponses, CfgAccountsTokenBlacklistCreateData, CfgAccountsTokenBlacklistCreateResponses, CfgAccountsTokenCreateData, CfgAccountsTokenCreateErrors, CfgAccountsTokenCreateResponses, CfgAccountsTokenRefreshCreateData, CfgAccountsTokenRefreshCreateResponses, CfgTotpBackupCodesRegenerateCreateData, CfgTotpBackupCodesRegenerateCreateErrors, CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRetrieveData, CfgTotpBackupCodesRetrieveResponses, CfgTotpDevicesDestroyData, CfgTotpDevicesDestroyResponses, CfgTotpDevicesRetrieveData, CfgTotpDevicesRetrieveResponses, CfgTotpDisableCreateData, CfgTotpDisableCreateErrors, CfgTotpDisableCreateResponses, CfgTotpSetupConfirmCreateData, CfgTotpSetupConfirmCreateErrors, CfgTotpSetupConfirmCreateResponses, CfgTotpSetupCreateData, CfgTotpSetupCreateErrors, CfgTotpSetupCreateResponses, CfgTotpVerifyBackupCreateData, CfgTotpVerifyBackupCreateErrors, CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyCreateData, CfgTotpVerifyCreateErrors, CfgTotpVerifyCreateResponses } from './types.gen';\n\nexport type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {\n    /**\n     * You can provide a client instance returned by `createClient()` instead of\n     * individual options. This might be also useful if you want to implement a\n     * custom client.\n     */\n    client?: Client;\n    /**\n     * You can pass arbitrary values through the `meta` object. This can be\n     * used to access values that aren't defined as part of the SDK function.\n     */\n    meta?: keyof ClientMeta extends never ? Record<string, unknown> : ClientMeta;\n};\n\nexport class CfgAccountsApiKey {\n    /**\n     * Get API key details\n     *\n     * Retrieve the current user's API key (masked) and metadata.\n     */\n    public static cfgAccountsApiKeyRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsApiKeyRetrieveData, ThrowOnError>): RequestResult<CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRetrieveErrors, ThrowOnError> {\n        return (options?.client ?? client).get<CfgAccountsApiKeyRetrieveResponses, CfgAccountsApiKeyRetrieveErrors, ThrowOnError>({\n            security: [\n                { scheme: 'bearer', type: 'http' },\n                {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                },\n                { name: 'X-API-Key', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/api-key/',\n            ...options\n        });\n    }\n\n    /**\n     * Regenerate API key\n     *\n     * Generate a new API key. The full key is returned only once.\n     */\n    public static cfgAccountsApiKeyRegenerateCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsApiKeyRegenerateCreateData, ThrowOnError>): RequestResult<CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRegenerateCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsApiKeyRegenerateCreateResponses, CfgAccountsApiKeyRegenerateCreateErrors, ThrowOnError>({\n            security: [\n                { scheme: 'bearer', type: 'http' },\n                {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                },\n                { name: 'X-API-Key', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/api-key/regenerate/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Reveal API key\n     *\n     * Return the current full API key WITHOUT rotating it. The same durable value every one of the user's agents uses — for the signed-in user to copy and paste into agent onboarding. Default GET stays masked; this is the explicit reveal action.\n     */\n    public static cfgAccountsApiKeyRevealCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsApiKeyRevealCreateData, ThrowOnError>): RequestResult<CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyRevealCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsApiKeyRevealCreateResponses, CfgAccountsApiKeyRevealCreateErrors, ThrowOnError>({\n            security: [\n                { scheme: 'bearer', type: 'http' },\n                {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                },\n                { name: 'X-API-Key', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/api-key/reveal/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Test API key\n     *\n     * Test whether an API key is valid without consuming it.\n     */\n    public static cfgAccountsApiKeyTestCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsApiKeyTestCreateData, ThrowOnError>): RequestResult<CfgAccountsApiKeyTestCreateResponses, unknown, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsApiKeyTestCreateResponses, unknown, ThrowOnError>({\n            security: [\n                { scheme: 'bearer', type: 'http' },\n                {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                },\n                { name: 'X-API-Key', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/api-key/test/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n}\n\nexport class CfgAccountsOauth {\n    /**\n     * List OAuth connections\n     *\n     * Get all OAuth connections for the current user.\n     */\n    public static cfgAccountsOauthConnectionsList<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthConnectionsListData, ThrowOnError>): RequestResult<CfgAccountsOauthConnectionsListResponses, unknown, ThrowOnError> {\n        return (options?.client ?? client).get<CfgAccountsOauthConnectionsListResponses, unknown, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/oauth/connections/',\n            ...options\n        });\n    }\n\n    /**\n     * Disconnect OAuth provider\n     *\n     * Remove OAuth connection for the specified provider.\n     */\n    public static cfgAccountsOauthDisconnectCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOauthDisconnectCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthDisconnectCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsOauthDisconnectCreateResponses, CfgAccountsOauthDisconnectCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/oauth/disconnect/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Start GitHub OAuth\n     *\n     * Generate the GitHub authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.\n     */\n    public static cfgAccountsOauthGithubAuthorizeCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthGithubAuthorizeCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubAuthorizeCreateErrors, ThrowOnError> {\n        return (options?.client ?? client).post<CfgAccountsOauthGithubAuthorizeCreateResponses, CfgAccountsOauthGithubAuthorizeCreateErrors, ThrowOnError>({\n            url: '/cfg/accounts/oauth/github/authorize/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options?.headers\n            }\n        });\n    }\n\n    /**\n     * Complete GitHub OAuth\n     *\n     * Exchange the authorization code for JWT tokens. Call this after GitHub redirects back with a code. The state is single use.\n     */\n    public static cfgAccountsOauthGithubCallbackCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOauthGithubCallbackCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthGithubCallbackCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsOauthGithubCallbackCreateResponses, CfgAccountsOauthGithubCallbackCreateErrors, ThrowOnError>({\n            url: '/cfg/accounts/oauth/github/callback/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Start Google OAuth\n     *\n     * Generate the Google authorization URL. Redirect the user to it to start authentication. The redirect URI is derived from the request Origin.\n     */\n    public static cfgAccountsOauthGoogleAuthorizeCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthGoogleAuthorizeCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGoogleAuthorizeCreateResponses, CfgAccountsOauthGoogleAuthorizeCreateErrors, ThrowOnError> {\n        return (options?.client ?? client).post<CfgAccountsOauthGoogleAuthorizeCreateResponses, CfgAccountsOauthGoogleAuthorizeCreateErrors, ThrowOnError>({\n            url: '/cfg/accounts/oauth/google/authorize/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options?.headers\n            }\n        });\n    }\n\n    /**\n     * Complete Google OAuth\n     *\n     * Exchange the authorization code for JWT tokens. Call this after Google redirects back with a code. The state is single use.\n     */\n    public static cfgAccountsOauthGoogleCallbackCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOauthGoogleCallbackCreateData, ThrowOnError>): RequestResult<CfgAccountsOauthGoogleCallbackCreateResponses, CfgAccountsOauthGoogleCallbackCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsOauthGoogleCallbackCreateResponses, CfgAccountsOauthGoogleCallbackCreateErrors, ThrowOnError>({\n            url: '/cfg/accounts/oauth/google/callback/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * List OAuth providers\n     *\n     * Providers that are configured, in display order. The login screen shows exactly these buttons.\n     */\n    public static cfgAccountsOauthProvidersRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOauthProvidersRetrieveData, ThrowOnError>): RequestResult<CfgAccountsOauthProvidersRetrieveResponses, unknown, ThrowOnError> {\n        return (options?.client ?? client).get<CfgAccountsOauthProvidersRetrieveResponses, unknown, ThrowOnError>({ url: '/cfg/accounts/oauth/providers/', ...options });\n    }\n}\n\nexport class CfgAccountsOtp {\n    /**\n     * Marketing-consent checkbox policy for the caller's jurisdiction.\n     *\n     * Derived from the edge-provided CF-IPCountry — the same signal stored\n     * as consent evidence at request time. Unknown country fails safe to\n     * \"unchecked\".\n     */\n    public static cfgAccountsOtpConsentPolicyRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsOtpConsentPolicyRetrieveData, ThrowOnError>): RequestResult<CfgAccountsOtpConsentPolicyRetrieveResponses, unknown, ThrowOnError> {\n        return (options?.client ?? client).get<CfgAccountsOtpConsentPolicyRetrieveResponses, unknown, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/otp/consent-policy/',\n            ...options\n        });\n    }\n\n    /**\n     * Request OTP code to email.\n     */\n    public static cfgAccountsOtpRequestCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOtpRequestCreateData, ThrowOnError>): RequestResult<CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpRequestCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsOtpRequestCreateResponses, CfgAccountsOtpRequestCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/otp/request/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Verify OTP code and return JWT tokens or 2FA session.\n     *\n     * If user has 2FA enabled:\n     * - Returns requires_2fa=True with session_id\n     * - Client must complete 2FA verification at /cfg/totp/verify/\n     *\n     * If user has no 2FA:\n     * - Returns JWT tokens and user data directly\n     */\n    public static cfgAccountsOtpVerifyCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsOtpVerifyCreateData, ThrowOnError>): RequestResult<CfgAccountsOtpVerifyCreateResponses, CfgAccountsOtpVerifyCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsOtpVerifyCreateResponses, CfgAccountsOtpVerifyCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/otp/verify/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n}\n\nexport class CfgAccountsProfile {\n    /**\n     * Get current user profile\n     *\n     * Retrieve the current authenticated user's profile information.\n     */\n    public static cfgAccountsProfileRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileRetrieveData, ThrowOnError>): RequestResult<CfgAccountsProfileRetrieveResponses, CfgAccountsProfileRetrieveErrors, ThrowOnError> {\n        return (options?.client ?? client).get<CfgAccountsProfileRetrieveResponses, CfgAccountsProfileRetrieveErrors, ThrowOnError>({\n            security: [{ scheme: 'bearer', type: 'http' }, {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                }],\n            url: '/cfg/accounts/profile/',\n            ...options\n        });\n    }\n\n    /**\n     * Upload user avatar\n     *\n     * Upload avatar image for the current authenticated user. Accepts multipart/form-data with 'avatar' field.\n     */\n    public static cfgAccountsProfileAvatarCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileAvatarCreateData, ThrowOnError>): RequestResult<CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileAvatarCreateErrors, ThrowOnError> {\n        return (options?.client ?? client).post<CfgAccountsProfileAvatarCreateResponses, CfgAccountsProfileAvatarCreateErrors, ThrowOnError>({\n            ...formDataBodySerializer,\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/accounts/profile/avatar/',\n            ...options,\n            headers: {\n                'Content-Type': null,\n                ...options?.headers\n            }\n        });\n    }\n\n    /**\n     * Delete user account\n     *\n     *\n     * Permanently delete the current user's account.\n     *\n     * This operation:\n     * - Deactivates the account (user cannot log in)\n     * - Anonymizes personal data (GDPR compliance)\n     * - Frees up the email address for re-registration\n     * - Preserves audit trail\n     *\n     * The account can be restored by an administrator if needed.\n     *\n     */\n    public static cfgAccountsProfileDeleteCreate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileDeleteCreateData, ThrowOnError>): RequestResult<CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfileDeleteCreateErrors, ThrowOnError> {\n        return (options?.client ?? client).post<CfgAccountsProfileDeleteCreateResponses, CfgAccountsProfileDeleteCreateErrors, ThrowOnError>({\n            security: [{ scheme: 'bearer', type: 'http' }, {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                }],\n            url: '/cfg/accounts/profile/delete/',\n            ...options\n        });\n    }\n\n    /**\n     * Partial update user profile\n     *\n     * Partially update the current authenticated user's profile information. Supports avatar upload.\n     */\n    public static cfgAccountsProfilePartialPartialUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfilePartialPartialUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialPartialUpdateErrors, ThrowOnError> {\n        return (options?.client ?? client).patch<CfgAccountsProfilePartialPartialUpdateResponses, CfgAccountsProfilePartialPartialUpdateErrors, ThrowOnError>({\n            security: [{ scheme: 'bearer', type: 'http' }, {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                }],\n            url: '/cfg/accounts/profile/partial/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options?.headers\n            }\n        });\n    }\n\n    /**\n     * Partial update user profile\n     *\n     * Partially update the current authenticated user's profile information. Supports avatar upload.\n     */\n    public static cfgAccountsProfilePartialUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfilePartialUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfilePartialUpdateErrors, ThrowOnError> {\n        return (options?.client ?? client).put<CfgAccountsProfilePartialUpdateResponses, CfgAccountsProfilePartialUpdateErrors, ThrowOnError>({\n            security: [{ scheme: 'bearer', type: 'http' }, {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                }],\n            url: '/cfg/accounts/profile/partial/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options?.headers\n            }\n        });\n    }\n\n    /**\n     * Update user profile\n     *\n     * Update the current authenticated user's profile information.\n     */\n    public static cfgAccountsProfileUpdatePartialUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileUpdatePartialUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdatePartialUpdateErrors, ThrowOnError> {\n        return (options?.client ?? client).patch<CfgAccountsProfileUpdatePartialUpdateResponses, CfgAccountsProfileUpdatePartialUpdateErrors, ThrowOnError>({\n            security: [{ scheme: 'bearer', type: 'http' }, {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                }],\n            url: '/cfg/accounts/profile/update/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options?.headers\n            }\n        });\n    }\n\n    /**\n     * Update user profile\n     *\n     * Update the current authenticated user's profile information.\n     */\n    public static cfgAccountsProfileUpdateUpdate<ThrowOnError extends boolean = false>(options?: Options<CfgAccountsProfileUpdateUpdateData, ThrowOnError>): RequestResult<CfgAccountsProfileUpdateUpdateResponses, CfgAccountsProfileUpdateUpdateErrors, ThrowOnError> {\n        return (options?.client ?? client).put<CfgAccountsProfileUpdateUpdateResponses, CfgAccountsProfileUpdateUpdateErrors, ThrowOnError>({\n            security: [{ scheme: 'bearer', type: 'http' }, {\n                    in: 'cookie',\n                    name: 'sessionid',\n                    type: 'apiKey'\n                }],\n            url: '/cfg/accounts/profile/update/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options?.headers\n            }\n        });\n    }\n}\n\nexport class CfgAccountsAuth {\n    /**\n     * Obtain a JWT pair with email + password.\n     *\n     * Returns the same envelope as OTP verify: either ``requires_2fa=True`` with\n     * a session id, or the token pair plus the user object. Failures are uniform\n     * (401 ``invalid_credentials``) whether the email is unknown, the password is\n     * wrong, or the account is inactive/soft-deleted — no enumeration.\n     */\n    public static cfgAccountsTokenCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsTokenCreateData, ThrowOnError>): RequestResult<CfgAccountsTokenCreateResponses, CfgAccountsTokenCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsTokenCreateResponses, CfgAccountsTokenCreateErrors, ThrowOnError>({\n            url: '/cfg/accounts/token/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Revoke a refresh token (logout).\n     *\n     * Blacklists the posted refresh token so it can never mint another access\n     * token. Called best-effort by the client's logout — without it, \"logout\"\n     * is purely client-side and a stolen refresh token survives until expiry.\n     */\n    public static cfgAccountsTokenBlacklistCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsTokenBlacklistCreateData, ThrowOnError>): RequestResult<CfgAccountsTokenBlacklistCreateResponses, unknown, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsTokenBlacklistCreateResponses, unknown, ThrowOnError>({\n            url: '/cfg/accounts/token/blacklist/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Refresh JWT token.\n     *\n     * DPoP-aware: when the incoming refresh token is key-bound (`cnf.jkt`), the\n     * rotated access/refresh in the response are re-stamped with the same `cnf`\n     * (stock SimpleJWT drops it from the derived access), and a matching DPoP\n     * proof is required on the refresh request — so a stolen refresh token can't\n     * be used to mint fresh tokens.\n     */\n    public static cfgAccountsTokenRefreshCreate<ThrowOnError extends boolean = false>(options: Options<CfgAccountsTokenRefreshCreateData, ThrowOnError>): RequestResult<CfgAccountsTokenRefreshCreateResponses, unknown, ThrowOnError> {\n        return (options.client ?? client).post<CfgAccountsTokenRefreshCreateResponses, unknown, ThrowOnError>({\n            url: '/cfg/accounts/token/refresh/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n}\n\nexport class CfgTotpBackupCodes {\n    /**\n     * Get backup codes status for user.\n     */\n    public static cfgTotpBackupCodesRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgTotpBackupCodesRetrieveData, ThrowOnError>): RequestResult<CfgTotpBackupCodesRetrieveResponses, unknown, ThrowOnError> {\n        return (options?.client ?? client).get<CfgTotpBackupCodesRetrieveResponses, unknown, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/backup-codes/',\n            ...options\n        });\n    }\n\n    /**\n     * Regenerate backup codes.\n     *\n     * Requires TOTP code for verification.\n     * Invalidates all existing codes.\n     */\n    public static cfgTotpBackupCodesRegenerateCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpBackupCodesRegenerateCreateData, ThrowOnError>): RequestResult<CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRegenerateCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgTotpBackupCodesRegenerateCreateResponses, CfgTotpBackupCodesRegenerateCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/backup-codes/regenerate/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n}\n\nexport class CfgTotp {\n    /**\n     * List all TOTP devices for user.\n     */\n    public static cfgTotpDevicesRetrieve<ThrowOnError extends boolean = false>(options?: Options<CfgTotpDevicesRetrieveData, ThrowOnError>): RequestResult<CfgTotpDevicesRetrieveResponses, unknown, ThrowOnError> {\n        return (options?.client ?? client).get<CfgTotpDevicesRetrieveResponses, unknown, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/devices/',\n            ...options\n        });\n    }\n\n    /**\n     * Delete a TOTP device.\n     *\n     * Requires verification code if removing the last/primary device.\n     */\n    public static cfgTotpDevicesDestroy<ThrowOnError extends boolean = false>(options: Options<CfgTotpDevicesDestroyData, ThrowOnError>): RequestResult<CfgTotpDevicesDestroyResponses, unknown, ThrowOnError> {\n        return (options.client ?? client).delete<CfgTotpDevicesDestroyResponses, unknown, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/devices/{id}/',\n            ...options\n        });\n    }\n\n    /**\n     * Completely disable 2FA for account.\n     *\n     * Requires verification code.\n     */\n    public static cfgTotpDisableCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpDisableCreateData, ThrowOnError>): RequestResult<CfgTotpDisableCreateResponses, CfgTotpDisableCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgTotpDisableCreateResponses, CfgTotpDisableCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/disable/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n}\n\nexport class CfgTotpSetup {\n    /**\n     * Start 2FA setup process.\n     *\n     * Creates a new TOTP device and returns QR code for scanning.\n     */\n    public static cfgTotpSetupCreate<ThrowOnError extends boolean = false>(options?: Options<CfgTotpSetupCreateData, ThrowOnError>): RequestResult<CfgTotpSetupCreateResponses, CfgTotpSetupCreateErrors, ThrowOnError> {\n        return (options?.client ?? client).post<CfgTotpSetupCreateResponses, CfgTotpSetupCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/setup/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options?.headers\n            }\n        });\n    }\n\n    /**\n     * Confirm 2FA setup with first valid code.\n     *\n     * Activates the device and generates backup codes.\n     */\n    public static cfgTotpSetupConfirmCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpSetupConfirmCreateData, ThrowOnError>): RequestResult<CfgTotpSetupConfirmCreateResponses, CfgTotpSetupConfirmCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgTotpSetupConfirmCreateResponses, CfgTotpSetupConfirmCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/setup/confirm/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n}\n\nexport class CfgTotpVerify {\n    /**\n     * Verify TOTP code for 2FA session.\n     *\n     * Completes authentication and returns JWT tokens on success.\n     */\n    public static cfgTotpVerifyCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpVerifyCreateData, ThrowOnError>): RequestResult<CfgTotpVerifyCreateResponses, CfgTotpVerifyCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgTotpVerifyCreateResponses, CfgTotpVerifyCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/verify/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n\n    /**\n     * Verify backup recovery code for 2FA session.\n     *\n     * Alternative verification method when TOTP device unavailable.\n     */\n    public static cfgTotpVerifyBackupCreate<ThrowOnError extends boolean = false>(options: Options<CfgTotpVerifyBackupCreateData, ThrowOnError>): RequestResult<CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyBackupCreateErrors, ThrowOnError> {\n        return (options.client ?? client).post<CfgTotpVerifyBackupCreateResponses, CfgTotpVerifyBackupCreateErrors, ThrowOnError>({\n            security: [\n                { name: 'X-API-Key', type: 'apiKey' },\n                { scheme: 'bearer', type: 'http' },\n                { name: 'Authorization', type: 'apiKey' }\n            ],\n            url: '/cfg/totp/verify/backup/',\n            ...options,\n            headers: {\n                'Content-Type': 'application/json',\n                ...options.headers\n            }\n        });\n    }\n}\n","import { isDev } from \"./env\";\n/**\n * Auth analytics — a dependency-free SINK, not an implementation.\n *\n * `@djangocfg/api` cannot depend on `@djangocfg/analytics`: analytics reads auth\n * state (to attribute events to a signed-in user), so importing it here would\n * close a dependency cycle. Instead this module owns the *interface* and lets a\n * real implementation be injected at runtime — `@djangocfg/analytics` calls\n * `setAnalyticsSink()` when its provider mounts.\n *\n * Before this, the object below was a hardcoded stub that console.logged in dev\n * and did NOTHING in production. Every auth event it \"tracked\" —\n * AUTH_LOGIN_SUCCESS, AUTH_OAUTH_FAIL, AUTH_SESSION_EXPIRED — was silently\n * discarded. The events were fired, the calls looked right, and nothing ever\n * arrived anywhere.\n */\n\nexport enum AnalyticsEvent {\n  AUTH_OTP_REQUEST = 'auth_otp_request',\n  AUTH_LOGIN_SUCCESS = 'auth_login_success',\n  AUTH_OTP_VERIFY_FAIL = 'auth_otp_verify_fail',\n  AUTH_PASSWORD_LOGIN_FAIL = 'auth_password_login_fail',\n  AUTH_SESSION_EXPIRED = 'auth_session_expired',\n  AUTH_TOKEN_REFRESH = 'auth_token_refresh',\n  AUTH_TOKEN_REFRESH_FAIL = 'auth_token_refresh_fail',\n  AUTH_LOGOUT = 'auth_logout',\n  AUTH_OAUTH_START = 'auth_oauth_start',\n  AUTH_OAUTH_FAIL = 'auth_oauth_fail',\n}\n\nexport enum AnalyticsCategory {\n  AUTH = 'auth',\n}\n\nexport type AnalyticsEventType = `${AnalyticsEvent}`;\nexport type AnalyticsCategoryType = `${AnalyticsCategory}`;\n\n/**\n * What an analytics backend can actually carry.\n *\n * GA4 and OpenPanel serialise a property to a scalar; an object or a function\n * arrives as \"[object Object]\" without erroring anywhere. Declaring the wider\n * `unknown` here promised a forwarding guarantee no implementation keeps, and\n * it made this sink incompatible with `AnalyticsEventProperties` in\n * `@djangocfg/analytics` — the two describe the same channel and must agree.\n * Kept as a local declaration rather than an import: `api` does not depend on\n * `analytics`, and one shared four-member union is not worth that edge.\n */\nexport type AnalyticsPropertyValue = string | number | boolean | null;\n\ninterface AnalyticsEventParams {\n  category?: AnalyticsCategoryType;\n  label?: string;\n  value?: number;\n  // Extra dimensions vary per event; the sink only forwards them.\n  [key: string]: AnalyticsPropertyValue | undefined;\n}\n\n/** What an analytics implementation must provide to receive auth events. */\nexport interface AnalyticsSink {\n  // `| undefined` in the value: an optional dimension that was not supplied\n  // reaches the sink as an explicit `undefined`, which every backend already\n  // treats as absent. Excluding it would reject the caller below.\n  event(\n    name: string,\n    params?: Record<string, AnalyticsPropertyValue | undefined>,\n  ): void;\n  setUser(userId: string | null): void;\n}\n\nlet sink: AnalyticsSink | null = null;\n\n/**\n * Install the real analytics implementation.\n *\n * Called by `@djangocfg/analytics` when its provider mounts. Pass `null` to\n * uninstall (on unmount), so a torn-down provider does not keep receiving events.\n */\nexport function setAnalyticsSink(next: AnalyticsSink | null): void {\n  sink = next;\n}\n\nexport const Analytics = {\n  /** Track an auth event. Delivered to the installed sink, if any. */\n  event(eventName: AnalyticsEventType, params?: AnalyticsEventParams) {\n    if (sink) {\n      sink.event(eventName, params);\n      return;\n    }\n    // No sink installed: the app is not using @djangocfg/analytics. Say so in\n    // dev rather than pretending the event went somewhere.\n    if (isDev) {\n      console.log('[Analytics:no-sink]', eventName, params);\n    }\n  },\n\n  /** Attach the signed-in user. Pass null on logout. */\n  setUser(userId: string | null) {\n    if (sink) {\n      sink.setUser(userId);\n      return;\n    }\n    if (isDev) {\n      console.log('[Analytics:no-sink] Set user:', userId);\n    }\n  },\n};\n","// This file is auto-generated by @hey-api/openapi-ts\n\nexport type ClientOptions = {\n    baseUrl: 'http://localhost:8000' | (string & {});\n};\n\n/**\n * Serializer for API key response (masked).\n */\nexport type ApiKey = {\n    /**\n     * Masked API key\n     */\n    key: string;\n    /**\n     * When the key was last regenerated\n     */\n    reissued_at: string | null;\n    /**\n     * When the key was created\n     */\n    created_at: string;\n};\n\n/**\n * Serializer for API key regeneration response (full key shown once).\n */\nexport type ApiKeyRegenerate = {\n    /**\n     * New API key (shown only once)\n     */\n    key: string;\n    /**\n     * When the key was regenerated\n     */\n    reissued_at: string;\n};\n\n/**\n * Serializer for API key response (masked).\n */\nexport type ApiKeyRequest = {\n    /**\n     * Masked API key\n     */\n    key: string;\n    /**\n     * When the key was last regenerated\n     */\n    reissued_at: string | null;\n    /**\n     * When the key was created\n     */\n    created_at: string;\n};\n\n/**\n * Serializer for revealing the current (unrotated) full API key.\n */\nexport type ApiKeyReveal = {\n    /**\n     * Full API key (current value, not rotated)\n     */\n    key: string;\n    /**\n     * When the key was created\n     */\n    created_at: string;\n    /**\n     * When the key was last regenerated\n     */\n    reissued_at: string | null;\n};\n\n/**\n * Serializer for testing an API key.\n */\nexport type ApiKeyTestRequest = {\n    /**\n     * API key to test\n     */\n    key: string;\n};\n\n/**\n * Serializer for API key test result.\n */\nexport type ApiKeyTestResult = {\n    /**\n     * Whether the key is valid\n     */\n    valid: boolean;\n    /**\n     * User ID if valid, null otherwise\n     */\n    user_id: string | null;\n};\n\n/**\n * Response serializer for account deletion.\n */\nexport type AccountDeleteResponse = {\n    /**\n     * Whether the account was successfully deleted\n     */\n    success: boolean;\n    /**\n     * Human-readable message about the deletion\n     */\n    message: string;\n};\n\n/**\n * Serializer for regenerating backup codes.\n */\nexport type BackupCodesRegenerateRequest = {\n    /**\n     * TOTP code for verification\n     */\n    code: string;\n};\n\n/**\n * Response serializer for backup codes regeneration.\n */\nexport type BackupCodesRegenerateResponse = {\n    /**\n     * List of new backup codes (save these!)\n     */\n    backup_codes: Array<string>;\n    /**\n     * Warning about previous codes being invalidated\n     */\n    warning: string;\n};\n\n/**\n * Serializer for backup codes status.\n */\nexport type BackupCodesStatus = {\n    /**\n     * Number of unused backup codes\n     */\n    remaining_count: number;\n    /**\n     * Total number of codes generated\n     */\n    total_generated: number;\n    /**\n     * Warning if running low on codes\n     */\n    warning?: string | null;\n};\n\n/**\n * Serializer for updating user profile.\n */\nexport type CfgUserUpdateRequest = {\n    first_name?: string;\n    last_name?: string;\n    company?: string;\n    phone?: string;\n    position?: string;\n    language?: string;\n    /**\n     * IANA timezone name (e.g. 'Asia/Seoul'). Auto-detected from browser via X-Timezone header.\n     */\n    timezone?: string;\n};\n\n/**\n * Serializer for confirming 2FA setup with first code.\n */\nexport type ConfirmSetupRequest = {\n    /**\n     * Device ID from setup response\n     */\n    device_id: string;\n    /**\n     * 6-digit TOTP code from authenticator app\n     */\n    code: string;\n};\n\n/**\n * Response serializer for setup confirmation.\n */\nexport type ConfirmSetupResponse = {\n    message: string;\n    /**\n     * List of backup recovery codes (save these!)\n     */\n    backup_codes: Array<string>;\n    /**\n     * Warning message about backup codes\n     */\n    backup_codes_warning: string;\n};\n\n/**\n * Marketing-consent UI policy derived from the request's geo context.\n */\nexport type ConsentPolicy = {\n    /**\n     * Country code seen by the edge (CF-IPCountry), '' if unknown\n     */\n    country: string;\n    /**\n     * Default state for the marketing-consent checkbox\n     *\n     * * `checked` - checked\n     * * `unchecked` - unchecked\n     */\n    marketing_consent_default: MarketingConsentDefaultEnum;\n};\n\n/**\n * Serializer for listing TOTP devices.\n */\nexport type DeviceList = {\n    readonly id: string;\n    /**\n     * Device name for identification\n     */\n    readonly name: string;\n    /**\n     * Primary device used for verification\n     */\n    readonly is_primary: boolean;\n    readonly status: DeviceStatusEnum;\n    readonly created_at: string;\n    /**\n     * When device setup was confirmed\n     */\n    readonly confirmed_at: string | null;\n    /**\n     * Last successful verification\n     */\n    readonly last_used_at: string | null;\n};\n\n/**\n * Response serializer for device list endpoint.\n */\nexport type DeviceListResponse = {\n    devices: Array<DeviceList>;\n    has_2fa_enabled: boolean;\n};\n\n/**\n * * `pending` - Pending Confirmation\n * * `active` - Active\n * * `disabled` - Disabled\n */\nexport enum DeviceStatusEnum {\n    PENDING = 'pending',\n    ACTIVE = 'active',\n    DISABLED = 'disabled'\n}\n\n/**\n * Serializer for completely disabling 2FA.\n */\nexport type DisableRequest = {\n    /**\n     * TOTP code for verification\n     */\n    code: string;\n};\n\n/**\n * * `checked` - checked\n * * `unchecked` - unchecked\n */\nexport enum MarketingConsentDefaultEnum {\n    CHECKED = 'checked',\n    UNCHECKED = 'unchecked'\n}\n\n/**\n * Request to start OAuth flow.\n */\nexport type OAuthAuthorizeRequestRequest = {\n    /**\n     * Optional. Must be `<origin>/auth?provider=<id>` for an origin of the resolved site; anything else is rejected with `origin_not_allowed`. Omit it: the server derives it from the request Origin.\n     */\n    redirect_uri?: string;\n    /**\n     * Optional source URL for registration tracking\n     */\n    source_url?: string;\n};\n\n/**\n * Response with OAuth authorization URL.\n */\nexport type OAuthAuthorizeResponse = {\n    /**\n     * Full URL to redirect user to OAuth provider\n     */\n    authorization_url: string;\n    /**\n     * State token for CSRF protection. Store this and verify on callback.\n     */\n    state: string;\n};\n\n/**\n * Request to complete OAuth flow (callback handler).\n */\nexport type OAuthCallbackRequestRequest = {\n    /**\n     * Authorization code from OAuth provider callback\n     */\n    code: string;\n    /**\n     * State token from the authorize response; single use\n     */\n    state: string;\n    /**\n     * Ignored. The server reuses the redirect URI stored with the state.\n     */\n    redirect_uri?: string;\n};\n\n/**\n * Serializer for OAuth connection info (user-facing).\n */\nexport type OAuthConnection = {\n    readonly id: number;\n    /**\n     * OAuth provider name (github, google, etc.)\n     *\n     * * `github` - GitHub\n     * * `google` - Google\n     */\n    readonly provider: OAuthProviderEnum;\n    readonly provider_display: string;\n    /**\n     * Username on the OAuth provider platform\n     */\n    readonly provider_username: string;\n    /**\n     * Email from OAuth provider (may differ from user.email)\n     */\n    readonly provider_email: string;\n    /**\n     * Avatar URL from OAuth provider\n     */\n    readonly provider_avatar_url: string;\n    /**\n     * When this OAuth connection was created\n     */\n    readonly connected_at: string;\n    /**\n     * Last time this OAuth connection was used for login\n     */\n    readonly last_login_at: string;\n};\n\n/**\n * Request to disconnect OAuth provider.\n */\nexport type OAuthDisconnectRequestRequest = {\n    /**\n     * OAuth provider to disconnect\n     *\n     * * `github` - GitHub\n     * * `google` - Google\n     */\n    provider: OAuthProviderEnum;\n};\n\n/**\n * Error response for OAuth endpoints.\n */\nexport type OAuthError = {\n    /**\n     * Error code (closed set)\n     *\n     * * `oauth_disabled` - oauth_disabled\n     * * `github_oauth_disabled` - github_oauth_disabled\n     * * `origin_not_allowed` - origin_not_allowed\n     * * `missing_redirect_uri` - missing_redirect_uri\n     * * `invalid_state` - invalid_state\n     * * `oauth_exchange_failed` - oauth_exchange_failed\n     * * `invalid_id_token` - invalid_id_token\n     * * `email_missing` - email_missing\n     * * `email_not_verified` - email_not_verified\n     * * `hosted_domain_not_allowed` - hosted_domain_not_allowed\n     * * `account_inactive` - account_inactive\n     * * `link_not_allowed` - link_not_allowed\n     * * `rate_limited` - rate_limited\n     * * `provider_unavailable` - provider_unavailable\n     * * `server_error` - server_error\n     * * `not_found` - not_found\n     */\n    error: OAuthErrorCodeEnum;\n    /**\n     * Human-readable error description\n     */\n    error_description?: string;\n};\n\n/**\n * * `oauth_disabled` - oauth_disabled\n * * `github_oauth_disabled` - github_oauth_disabled\n * * `origin_not_allowed` - origin_not_allowed\n * * `missing_redirect_uri` - missing_redirect_uri\n * * `invalid_state` - invalid_state\n * * `oauth_exchange_failed` - oauth_exchange_failed\n * * `invalid_id_token` - invalid_id_token\n * * `email_missing` - email_missing\n * * `email_not_verified` - email_not_verified\n * * `hosted_domain_not_allowed` - hosted_domain_not_allowed\n * * `account_inactive` - account_inactive\n * * `link_not_allowed` - link_not_allowed\n * * `rate_limited` - rate_limited\n * * `provider_unavailable` - provider_unavailable\n * * `server_error` - server_error\n * * `not_found` - not_found\n */\nexport enum OAuthErrorCodeEnum {\n    OAUTH_DISABLED = 'oauth_disabled',\n    GITHUB_OAUTH_DISABLED = 'github_oauth_disabled',\n    ORIGIN_NOT_ALLOWED = 'origin_not_allowed',\n    MISSING_REDIRECT_URI = 'missing_redirect_uri',\n    INVALID_STATE = 'invalid_state',\n    OAUTH_EXCHANGE_FAILED = 'oauth_exchange_failed',\n    INVALID_ID_TOKEN = 'invalid_id_token',\n    EMAIL_MISSING = 'email_missing',\n    EMAIL_NOT_VERIFIED = 'email_not_verified',\n    HOSTED_DOMAIN_NOT_ALLOWED = 'hosted_domain_not_allowed',\n    ACCOUNT_INACTIVE = 'account_inactive',\n    LINK_NOT_ALLOWED = 'link_not_allowed',\n    RATE_LIMITED = 'rate_limited',\n    PROVIDER_UNAVAILABLE = 'provider_unavailable',\n    SERVER_ERROR = 'server_error',\n    NOT_FOUND = 'not_found'\n}\n\n/**\n * * `github` - GitHub\n * * `google` - Google\n */\nexport enum OAuthProviderEnum {\n    GITHUB = 'github',\n    GOOGLE = 'google'\n}\n\n/**\n * One enabled sign-in provider.\n */\nexport type OAuthProviderInfo = {\n    /**\n     * Provider id\n     *\n     * * `github` - GitHub\n     * * `google` - Google\n     */\n    id: OAuthProviderEnum;\n    /**\n     * Display name\n     */\n    name: string;\n    /**\n     * Icon key\n     */\n    icon: string;\n};\n\n/**\n * Response with available OAuth providers.\n */\nexport type OAuthProvidersResponse = {\n    /**\n     * Providers that are configured, in display order. The login screen shows exactly these.\n     */\n    providers: Array<OAuthProviderInfo>;\n};\n\n/**\n * Response with JWT tokens after OAuth authentication.\n *\n * When 2FA is required:\n * - requires_2fa: True\n * - session_id: UUID of 2FA verification session\n * - access/refresh/user: null\n *\n * When 2FA is not required:\n * - requires_2fa: False\n * - session_id: null\n * - access/refresh/user: populated\n */\nexport type OAuthTokenResponse = {\n    /**\n     * True if 2FA verification is required\n     */\n    requires_2fa?: boolean;\n    /**\n     * 2FA session ID (only when requires_2fa=True)\n     */\n    session_id?: string | null;\n    /**\n     * JWT access token (null when requires_2fa=True)\n     */\n    access?: string | null;\n    /**\n     * JWT refresh token (null when requires_2fa=True)\n     */\n    refresh?: string | null;\n    /**\n     * Authenticated user info (null when requires_2fa=True)\n     */\n    user?: {\n        [key: string]: unknown;\n    } | null;\n    /**\n     * True if a new user was created during this OAuth flow\n     */\n    is_new_user?: boolean;\n    /**\n     * True if a new OAuth connection was created\n     */\n    is_new_connection?: boolean;\n    /**\n     * True if user should be prompted to enable 2FA\n     */\n    should_prompt_2fa?: boolean;\n};\n\n/**\n * Typed error response for OTP operations.\n *\n * error_code values:\n * - invalid_identifier   — malformed email\n * - cooldown             — too soon after last request (retry_after = seconds)\n * - hourly_limit         — hourly quota exceeded   (retry_after = seconds until reset)\n * - daily_limit          — daily quota exceeded    (retry_after = seconds until reset)\n * - rate_limited         — IP-level rate limit hit (no retry_after)\n * - user_creation_failed — internal error creating account\n * - send_failed          — transport error (email / SMS)\n * - internal_error       — unexpected server error\n */\nexport type OtpErrorResponse = {\n    /**\n     * Human-readable error message\n     */\n    error: string;\n    /**\n     * Machine-readable error code\n     */\n    error_code?: string | null;\n    /**\n     * Seconds until the client may retry (present only for rate-limit errors)\n     */\n    retry_after?: number | null;\n};\n\n/**\n * Serializer for OTP request.\n */\nexport type OtpRequestRequest = {\n    /**\n     * Email address for OTP delivery\n     */\n    identifier: string;\n    /**\n     * Source URL for tracking registration (e.g., https://my.djangocfg.com)\n     */\n    source_url?: string;\n    /**\n     * Marketing-consent choice made at signup (absent/null = not asked, false = declined)\n     */\n    marketing_consent?: boolean | null;\n    /**\n     * Version of the consent disclosure text shown (e.g. product-updates-reg-v1)\n     */\n    consent_disclosure_version?: string;\n};\n\n/**\n * OTP request response.\n */\nexport type OtpRequestResponse = {\n    /**\n     * Success message\n     */\n    message: string;\n    /**\n     * Webmail deep-link for the recipient's provider, or null if the domain is unknown.\n     */\n    webmail?: WebmailLink | null;\n    /**\n     * Seconds until a new code may be requested for this email.\n     */\n    resend_in?: number;\n    /**\n     * Seconds the code stays valid.\n     */\n    expires_in?: number;\n};\n\n/**\n * Serializer for OTP verification.\n */\nexport type OtpVerifyRequest = {\n    /**\n     * Email address used for OTP request\n     */\n    identifier: string;\n    otp: string;\n    /**\n     * Source URL for tracking login (e.g., https://my.djangocfg.com)\n     */\n    source_url?: string;\n};\n\n/**\n * OTP verification response.\n *\n * When 2FA is required:\n * - requires_2fa: True\n * - session_id: UUID of 2FA verification session\n * - refresh/access/user: null\n *\n * When 2FA is not required:\n * - requires_2fa: False\n * - session_id: null\n * - refresh/access/user: populated\n */\nexport type OtpVerifyResponse = {\n    /**\n     * Whether 2FA verification is required\n     */\n    requires_2fa?: boolean;\n    /**\n     * 2FA session ID (if requires_2fa is True)\n     */\n    session_id?: string | null;\n    /**\n     * JWT refresh token (if requires_2fa is False)\n     */\n    refresh?: string | null;\n    /**\n     * JWT access token (if requires_2fa is False)\n     */\n    access?: string | null;\n    /**\n     * User information (if requires_2fa is False)\n     */\n    user?: User | null;\n    /**\n     * Whether user should be prompted to enable 2FA\n     */\n    should_prompt_2fa?: boolean;\n};\n\n/**\n * Typed error response for password login.\n *\n * error_code values:\n * - invalid_credentials — wrong email/password, inactive or deleted account\n * - rate_limited        — IP rate limit hit\n * - locked_out          — too many failed attempts for this email\n */\nexport type PasswordLoginError = {\n    /**\n     * Human-readable error message\n     */\n    error: string;\n    /**\n     * Machine-readable error code\n     */\n    error_code: string;\n    /**\n     * Seconds until the caller may retry (throttled responses only)\n     */\n    retry_after?: number | null;\n};\n\n/**\n * Validate email+password against live accounts only.\n *\n * Subclasses SimpleJWT so the field/validation contract stays theirs, but\n * replaces ``validate()`` — the token pair itself is minted by the view via\n * ``mint_tokens_for_request`` so the DPoP binding and token\n * lifetime match OTP, OAuth and TOTP exactly.\n */\nexport type PasswordLoginRequest = {\n    email: string;\n    password: string;\n};\n\n/**\n * Password-login response.\n *\n * Mirrors the OTP verify response so a client can treat every login flow\n * identically. ``requires_2fa=True`` carries a session id instead of tokens.\n */\nexport type PasswordLoginResponse = {\n    /**\n     * Whether 2FA verification is required\n     */\n    requires_2fa?: boolean;\n    /**\n     * 2FA session ID (if requires_2fa is True)\n     */\n    session_id?: string | null;\n    /**\n     * JWT refresh token (if requires_2fa is False)\n     */\n    refresh?: string | null;\n    /**\n     * JWT access token (if requires_2fa is False)\n     */\n    access?: string | null;\n    /**\n     * User information (if requires_2fa is False)\n     */\n    user?: User | null;\n    /**\n     * Whether user should be prompted to enable 2FA\n     */\n    should_prompt_2fa?: boolean;\n};\n\n/**\n * Serializer for updating user profile.\n */\nexport type PatchedCfgUserUpdateRequest = {\n    first_name?: string;\n    last_name?: string;\n    company?: string;\n    phone?: string;\n    position?: string;\n    language?: string;\n    /**\n     * IANA timezone name (e.g. 'Asia/Seoul'). Auto-detected from browser via X-Timezone header.\n     */\n    timezone?: string;\n};\n\n/**\n * Serializer for starting 2FA setup.\n */\nexport type SetupRequest = {\n    /**\n     * Device name for identification (e.g., 'My iPhone')\n     */\n    device_name?: string;\n};\n\n/**\n * Response serializer for setup initiation.\n */\nexport type SetupResponse = {\n    /**\n     * Device ID to use for confirmation\n     */\n    device_id: string;\n    /**\n     * Base32-encoded TOTP secret (for manual entry)\n     */\n    secret: string;\n    /**\n     * otpauth:// URI for QR code generation\n     */\n    provisioning_uri: string;\n    /**\n     * Base64-encoded QR code image (data URI)\n     */\n    qr_code_base64: string;\n    /**\n     * Seconds until setup expires (typically 600 = 10 minutes)\n     */\n    expires_in: number;\n};\n\nexport type TokenBlacklistRequest = {\n    refresh: string;\n};\n\nexport type TokenRefresh = {\n    readonly access: string;\n    refresh: string;\n};\n\nexport type TokenRefreshRequest = {\n    refresh: string;\n};\n\n/**\n * User data returned after 2FA verification.\n */\nexport type TotpVerifyUser = {\n    readonly id: number;\n    readonly email: string;\n    first_name?: string | null;\n    last_name?: string | null;\n    /**\n     * Get user's full name.\n     */\n    readonly full_name: string;\n    /**\n     * Get user's initials for avatar fallback.\n     */\n    readonly initials: string;\n    /**\n     * Get formatted username for display.\n     */\n    readonly display_username: string;\n    company?: string | null;\n    phone?: string | null;\n    position?: string | null;\n    language?: string | null;\n    timezone?: string | null;\n    readonly avatar: string | null;\n    /**\n     * Staff status\n     *\n     * Designates whether the user can log into this admin site.\n     */\n    readonly is_staff: boolean;\n    /**\n     * Superuser status\n     *\n     * Designates that this user has all permissions without explicitly assigning them.\n     */\n    readonly is_superuser: boolean;\n    readonly date_joined: string;\n    readonly last_login: string | null;\n    readonly unanswered_messages_count: number;\n    readonly api_key: string | null;\n};\n\n/**\n * Serializer for user details.\n */\nexport type User = {\n    readonly id: number;\n    readonly email: string;\n    first_name?: string | null;\n    last_name?: string | null;\n    /**\n     * Get user's full name.\n     */\n    readonly full_name: string;\n    /**\n     * Get user's initials for avatar fallback.\n     */\n    readonly initials: string;\n    /**\n     * Get formatted username for display.\n     */\n    readonly display_username: string;\n    company?: string | null;\n    phone?: string | null;\n    position?: string | null;\n    language?: string | null;\n    timezone?: string | null;\n    readonly avatar: string | null;\n    /**\n     * Staff status\n     *\n     * Designates whether the user can log into this admin site.\n     */\n    readonly is_staff: boolean;\n    /**\n     * Superuser status\n     *\n     * Designates that this user has all permissions without explicitly assigning them.\n     */\n    readonly is_superuser: boolean;\n    readonly date_joined: string;\n    readonly last_login: string | null;\n    readonly unanswered_messages_count: number;\n    readonly api_key: string | null;\n};\n\n/**\n * Serializer for backup code verification during login.\n */\nexport type VerifyBackupRequest = {\n    /**\n     * 2FA session ID from login response\n     */\n    session_id: string;\n    /**\n     * 8-character backup recovery code\n     */\n    backup_code: string;\n};\n\n/**\n * Serializer for TOTP code verification during login.\n */\nexport type VerifyRequest = {\n    /**\n     * 2FA session ID from login response\n     */\n    session_id: string;\n    /**\n     * 6-digit TOTP code from authenticator app\n     */\n    code: string;\n};\n\n/**\n * Response serializer for successful 2FA verification.\n */\nexport type VerifyResponse = {\n    message: string;\n    /**\n     * JWT access token\n     */\n    access_token: string;\n    /**\n     * JWT refresh token\n     */\n    refresh_token: string;\n    /**\n     * User profile data\n     */\n    user: TotpVerifyUser;\n    /**\n     * Number of remaining backup codes (if backup code was used)\n     */\n    remaining_backup_codes?: number;\n    /**\n     * Warning message (e.g., low backup codes)\n     */\n    warning?: string;\n};\n\n/**\n * Deep-link that opens the user's webmail on a search for our login email.\n *\n * Present only when the recipient's email domain maps to a known webmail\n * provider (Gmail, Outlook, Mail.ru, Yandex, iCloud, …). For unknown/corporate\n * domains this whole object is null and the frontend shows no button.\n */\nexport type WebmailLink = {\n    /**\n     * Provider slug (e.g. 'gmail', 'outlook', 'mail_ru'). Also selects the brand icon on the frontend.\n     *\n     * * `gmail` - gmail\n     * * `outlook` - outlook\n     * * `yahoo` - yahoo\n     * * `icloud` - icloud\n     * * `proton` - proton\n     * * `zoho` - zoho\n     * * `aol` - aol\n     * * `fastmail` - fastmail\n     * * `gmx` - gmx\n     * * `mailcom` - mailcom\n     * * `mail_ru` - mail_ru\n     * * `yandex` - yandex\n     * * `rambler` - rambler\n     * * `qq` - qq\n     * * `netease` - netease\n     * * `sina` - sina\n     * * `aliyun` - aliyun\n     * * `naver` - naver\n     * * `daum` - daum\n     * * `web_de` - web_de\n     * * `tonline` - tonline\n     * * `seznam` - seznam\n     * * `wp_pl` - wp_pl\n     * * `o2_pl` - o2_pl\n     * * `interia` - interia\n     * * `libero` - libero\n     * * `virgilio` - virgilio\n     * * `orange` - orange\n     * * `laposte` - laposte\n     * * `free_fr` - free_fr\n     * * `sfr` - sfr\n     */\n    provider: WebmailLinkProviderEnum;\n    /**\n     * Human-facing provider name, e.g. 'Gmail'.\n     */\n    provider_name: string;\n    /**\n     * Absolute URL to open in a new tab (a sender-filtered search, or the inbox as fallback).\n     */\n    url: string;\n    /**\n     * True if the URL opens a search filtered to our sender; False if it only opens the inbox.\n     */\n    is_search: boolean;\n};\n\n/**\n * * `gmail` - gmail\n * * `outlook` - outlook\n * * `yahoo` - yahoo\n * * `icloud` - icloud\n * * `proton` - proton\n * * `zoho` - zoho\n * * `aol` - aol\n * * `fastmail` - fastmail\n * * `gmx` - gmx\n * * `mailcom` - mailcom\n * * `mail_ru` - mail_ru\n * * `yandex` - yandex\n * * `rambler` - rambler\n * * `qq` - qq\n * * `netease` - netease\n * * `sina` - sina\n * * `aliyun` - aliyun\n * * `naver` - naver\n * * `daum` - daum\n * * `web_de` - web_de\n * * `tonline` - tonline\n * * `seznam` - seznam\n * * `wp_pl` - wp_pl\n * * `o2_pl` - o2_pl\n * * `interia` - interia\n * * `libero` - libero\n * * `virgilio` - virgilio\n * * `orange` - orange\n * * `laposte` - laposte\n * * `free_fr` - free_fr\n * * `sfr` - sfr\n */\nexport enum WebmailLinkProviderEnum {\n    GMAIL = 'gmail',\n    OUTLOOK = 'outlook',\n    YAHOO = 'yahoo',\n    ICLOUD = 'icloud',\n    PROTON = 'proton',\n    ZOHO = 'zoho',\n    AOL = 'aol',\n    FASTMAIL = 'fastmail',\n    GMX = 'gmx',\n    MAILCOM = 'mailcom',\n    MAIL_RU = 'mail_ru',\n    YANDEX = 'yandex',\n    RAMBLER = 'rambler',\n    QQ = 'qq',\n    NETEASE = 'netease',\n    SINA = 'sina',\n    ALIYUN = 'aliyun',\n    NAVER = 'naver',\n    DAUM = 'daum',\n    WEB_DE = 'web_de',\n    TONLINE = 'tonline',\n    SEZNAM = 'seznam',\n    WP_PL = 'wp_pl',\n    O2_PL = 'o2_pl',\n    INTERIA = 'interia',\n    LIBERO = 'libero',\n    VIRGILIO = 'virgilio',\n    ORANGE = 'orange',\n    LAPOSTE = 'laposte',\n    FREE_FR = 'free_fr',\n    SFR = 'sfr'\n}\n\nexport type CfgAccountsOauthConnectionsResponse200AutoRef = Array<OAuthConnection>;\n\nexport type CfgAccountsOauthDisconnectResponse200AutoRef = {\n    message?: string;\n};\n\n/**\n * 2FA disabled successfully\n */\nexport type CfgTotpDisableResponse200AutoRef = unknown;\n\n/**\n * Response serializer for device list endpoint.\n */\nexport type DeviceListResponseWritable = {\n    devices: Array<unknown>;\n    has_2fa_enabled: boolean;\n};\n\n/**\n * OTP verification response.\n *\n * When 2FA is required:\n * - requires_2fa: True\n * - session_id: UUID of 2FA verification session\n * - refresh/access/user: null\n *\n * When 2FA is not required:\n * - requires_2fa: False\n * - session_id: null\n * - refresh/access/user: populated\n */\nexport type OtpVerifyResponseWritable = {\n    /**\n     * Whether 2FA verification is required\n     */\n    requires_2fa?: boolean;\n    /**\n     * 2FA session ID (if requires_2fa is True)\n     */\n    session_id?: string | null;\n    /**\n     * JWT refresh token (if requires_2fa is False)\n     */\n    refresh?: string | null;\n    /**\n     * JWT access token (if requires_2fa is False)\n     */\n    access?: string | null;\n    /**\n     * User information (if requires_2fa is False)\n     */\n    user?: UserWritable | null;\n    /**\n     * Whether user should be prompted to enable 2FA\n     */\n    should_prompt_2fa?: boolean;\n};\n\n/**\n * Password-login response.\n *\n * Mirrors the OTP verify response so a client can treat every login flow\n * identically. ``requires_2fa=True`` carries a session id instead of tokens.\n */\nexport type PasswordLoginResponseWritable = {\n    /**\n     * Whether 2FA verification is required\n     */\n    requires_2fa?: boolean;\n    /**\n     * 2FA session ID (if requires_2fa is True)\n     */\n    session_id?: string | null;\n    /**\n     * JWT refresh token (if requires_2fa is False)\n     */\n    refresh?: string | null;\n    /**\n     * JWT access token (if requires_2fa is False)\n     */\n    access?: string | null;\n    /**\n     * User information (if requires_2fa is False)\n     */\n    user?: UserWritable | null;\n    /**\n     * Whether user should be prompted to enable 2FA\n     */\n    should_prompt_2fa?: boolean;\n};\n\nexport type TokenRefreshWritable = {\n    refresh: string;\n};\n\n/**\n * User data returned after 2FA verification.\n */\nexport type TotpVerifyUserWritable = {\n    first_name?: string | null;\n    last_name?: string | null;\n    company?: string | null;\n    phone?: string | null;\n    position?: string | null;\n    language?: string | null;\n    timezone?: string | null;\n};\n\n/**\n * Serializer for user details.\n */\nexport type UserWritable = {\n    first_name?: string | null;\n    last_name?: string | null;\n    company?: string | null;\n    phone?: string | null;\n    position?: string | null;\n    language?: string | null;\n    timezone?: string | null;\n};\n\n/**\n * Response serializer for successful 2FA verification.\n */\nexport type VerifyResponseWritable = {\n    message: string;\n    /**\n     * JWT access token\n     */\n    access_token: string;\n    /**\n     * JWT refresh token\n     */\n    refresh_token: string;\n    /**\n     * User profile data\n     */\n    user: TotpVerifyUserWritable;\n    /**\n     * Number of remaining backup codes (if backup code was used)\n     */\n    remaining_backup_codes?: number;\n    /**\n     * Warning message (e.g., low backup codes)\n     */\n    warning?: string;\n};\n\nexport type CfgAccountsApiKeyRetrieveData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/api-key/';\n};\n\nexport type CfgAccountsApiKeyRetrieveErrors = {\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsApiKeyRetrieveResponses = {\n    200: ApiKey;\n};\n\nexport type CfgAccountsApiKeyRetrieveResponse = CfgAccountsApiKeyRetrieveResponses[keyof CfgAccountsApiKeyRetrieveResponses];\n\nexport type CfgAccountsApiKeyRegenerateCreateData = {\n    body: ApiKeyRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/api-key/regenerate/';\n};\n\nexport type CfgAccountsApiKeyRegenerateCreateErrors = {\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsApiKeyRegenerateCreateResponses = {\n    200: ApiKeyRegenerate;\n};\n\nexport type CfgAccountsApiKeyRegenerateCreateResponse = CfgAccountsApiKeyRegenerateCreateResponses[keyof CfgAccountsApiKeyRegenerateCreateResponses];\n\nexport type CfgAccountsApiKeyRevealCreateData = {\n    body: ApiKeyRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/api-key/reveal/';\n};\n\nexport type CfgAccountsApiKeyRevealCreateErrors = {\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsApiKeyRevealCreateResponses = {\n    200: ApiKeyReveal;\n};\n\nexport type CfgAccountsApiKeyRevealCreateResponse = CfgAccountsApiKeyRevealCreateResponses[keyof CfgAccountsApiKeyRevealCreateResponses];\n\nexport type CfgAccountsApiKeyTestCreateData = {\n    body: ApiKeyTestRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/api-key/test/';\n};\n\nexport type CfgAccountsApiKeyTestCreateResponses = {\n    200: ApiKeyTestResult;\n};\n\nexport type CfgAccountsApiKeyTestCreateResponse = CfgAccountsApiKeyTestCreateResponses[keyof CfgAccountsApiKeyTestCreateResponses];\n\nexport type CfgAccountsOauthConnectionsListData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/oauth/connections/';\n};\n\nexport type CfgAccountsOauthConnectionsListResponses = {\n    200: CfgAccountsOauthConnectionsResponse200AutoRef;\n};\n\nexport type CfgAccountsOauthConnectionsListResponse = CfgAccountsOauthConnectionsListResponses[keyof CfgAccountsOauthConnectionsListResponses];\n\nexport type CfgAccountsOauthDisconnectCreateData = {\n    body: OAuthDisconnectRequestRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/oauth/disconnect/';\n};\n\nexport type CfgAccountsOauthDisconnectCreateErrors = {\n    400: OAuthError;\n    404: OAuthError;\n};\n\nexport type CfgAccountsOauthDisconnectCreateError = CfgAccountsOauthDisconnectCreateErrors[keyof CfgAccountsOauthDisconnectCreateErrors];\n\nexport type CfgAccountsOauthDisconnectCreateResponses = {\n    200: CfgAccountsOauthDisconnectResponse200AutoRef;\n};\n\nexport type CfgAccountsOauthDisconnectCreateResponse = CfgAccountsOauthDisconnectCreateResponses[keyof CfgAccountsOauthDisconnectCreateResponses];\n\nexport type CfgAccountsOauthGithubAuthorizeCreateData = {\n    body?: OAuthAuthorizeRequestRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/oauth/github/authorize/';\n};\n\nexport type CfgAccountsOauthGithubAuthorizeCreateErrors = {\n    400: OAuthError;\n    503: OAuthError;\n};\n\nexport type CfgAccountsOauthGithubAuthorizeCreateError = CfgAccountsOauthGithubAuthorizeCreateErrors[keyof CfgAccountsOauthGithubAuthorizeCreateErrors];\n\nexport type CfgAccountsOauthGithubAuthorizeCreateResponses = {\n    200: OAuthAuthorizeResponse;\n};\n\nexport type CfgAccountsOauthGithubAuthorizeCreateResponse = CfgAccountsOauthGithubAuthorizeCreateResponses[keyof CfgAccountsOauthGithubAuthorizeCreateResponses];\n\nexport type CfgAccountsOauthGithubCallbackCreateData = {\n    body: OAuthCallbackRequestRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/oauth/github/callback/';\n};\n\nexport type CfgAccountsOauthGithubCallbackCreateErrors = {\n    400: OAuthError;\n    403: OAuthError;\n    429: OAuthError;\n    502: OAuthError;\n    503: OAuthError;\n};\n\nexport type CfgAccountsOauthGithubCallbackCreateError = CfgAccountsOauthGithubCallbackCreateErrors[keyof CfgAccountsOauthGithubCallbackCreateErrors];\n\nexport type CfgAccountsOauthGithubCallbackCreateResponses = {\n    200: OAuthTokenResponse;\n};\n\nexport type CfgAccountsOauthGithubCallbackCreateResponse = CfgAccountsOauthGithubCallbackCreateResponses[keyof CfgAccountsOauthGithubCallbackCreateResponses];\n\nexport type CfgAccountsOauthGoogleAuthorizeCreateData = {\n    body?: OAuthAuthorizeRequestRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/oauth/google/authorize/';\n};\n\nexport type CfgAccountsOauthGoogleAuthorizeCreateErrors = {\n    400: OAuthError;\n    503: OAuthError;\n};\n\nexport type CfgAccountsOauthGoogleAuthorizeCreateError = CfgAccountsOauthGoogleAuthorizeCreateErrors[keyof CfgAccountsOauthGoogleAuthorizeCreateErrors];\n\nexport type CfgAccountsOauthGoogleAuthorizeCreateResponses = {\n    200: OAuthAuthorizeResponse;\n};\n\nexport type CfgAccountsOauthGoogleAuthorizeCreateResponse = CfgAccountsOauthGoogleAuthorizeCreateResponses[keyof CfgAccountsOauthGoogleAuthorizeCreateResponses];\n\nexport type CfgAccountsOauthGoogleCallbackCreateData = {\n    body: OAuthCallbackRequestRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/oauth/google/callback/';\n};\n\nexport type CfgAccountsOauthGoogleCallbackCreateErrors = {\n    400: OAuthError;\n    403: OAuthError;\n    429: OAuthError;\n    502: OAuthError;\n    503: OAuthError;\n};\n\nexport type CfgAccountsOauthGoogleCallbackCreateError = CfgAccountsOauthGoogleCallbackCreateErrors[keyof CfgAccountsOauthGoogleCallbackCreateErrors];\n\nexport type CfgAccountsOauthGoogleCallbackCreateResponses = {\n    200: OAuthTokenResponse;\n};\n\nexport type CfgAccountsOauthGoogleCallbackCreateResponse = CfgAccountsOauthGoogleCallbackCreateResponses[keyof CfgAccountsOauthGoogleCallbackCreateResponses];\n\nexport type CfgAccountsOauthProvidersRetrieveData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/oauth/providers/';\n};\n\nexport type CfgAccountsOauthProvidersRetrieveResponses = {\n    200: OAuthProvidersResponse;\n};\n\nexport type CfgAccountsOauthProvidersRetrieveResponse = CfgAccountsOauthProvidersRetrieveResponses[keyof CfgAccountsOauthProvidersRetrieveResponses];\n\nexport type CfgAccountsOtpConsentPolicyRetrieveData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/otp/consent-policy/';\n};\n\nexport type CfgAccountsOtpConsentPolicyRetrieveResponses = {\n    200: ConsentPolicy;\n};\n\nexport type CfgAccountsOtpConsentPolicyRetrieveResponse = CfgAccountsOtpConsentPolicyRetrieveResponses[keyof CfgAccountsOtpConsentPolicyRetrieveResponses];\n\nexport type CfgAccountsOtpRequestCreateData = {\n    body: OtpRequestRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/otp/request/';\n};\n\nexport type CfgAccountsOtpRequestCreateErrors = {\n    400: OtpErrorResponse;\n    429: OtpErrorResponse;\n    500: OtpErrorResponse;\n};\n\nexport type CfgAccountsOtpRequestCreateError = CfgAccountsOtpRequestCreateErrors[keyof CfgAccountsOtpRequestCreateErrors];\n\nexport type CfgAccountsOtpRequestCreateResponses = {\n    200: OtpRequestResponse;\n};\n\nexport type CfgAccountsOtpRequestCreateResponse = CfgAccountsOtpRequestCreateResponses[keyof CfgAccountsOtpRequestCreateResponses];\n\nexport type CfgAccountsOtpVerifyCreateData = {\n    body: OtpVerifyRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/otp/verify/';\n};\n\nexport type CfgAccountsOtpVerifyCreateErrors = {\n    401: OtpErrorResponse;\n    429: OtpErrorResponse;\n};\n\nexport type CfgAccountsOtpVerifyCreateError = CfgAccountsOtpVerifyCreateErrors[keyof CfgAccountsOtpVerifyCreateErrors];\n\nexport type CfgAccountsOtpVerifyCreateResponses = {\n    200: OtpVerifyResponse;\n};\n\nexport type CfgAccountsOtpVerifyCreateResponse = CfgAccountsOtpVerifyCreateResponses[keyof CfgAccountsOtpVerifyCreateResponses];\n\nexport type CfgAccountsProfileRetrieveData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/profile/';\n};\n\nexport type CfgAccountsProfileRetrieveErrors = {\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsProfileRetrieveResponses = {\n    200: User;\n};\n\nexport type CfgAccountsProfileRetrieveResponse = CfgAccountsProfileRetrieveResponses[keyof CfgAccountsProfileRetrieveResponses];\n\nexport type CfgAccountsProfileAvatarCreateData = {\n    body?: {\n        /**\n         * Avatar image file (JPEG, PNG, GIF, WebP, max 5MB)\n         */\n        avatar: Blob | File;\n    };\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/profile/avatar/';\n};\n\nexport type CfgAccountsProfileAvatarCreateErrors = {\n    /**\n     * Invalid file or validation error.\n     */\n    400: unknown;\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsProfileAvatarCreateResponses = {\n    200: User;\n};\n\nexport type CfgAccountsProfileAvatarCreateResponse = CfgAccountsProfileAvatarCreateResponses[keyof CfgAccountsProfileAvatarCreateResponses];\n\nexport type CfgAccountsProfileDeleteCreateData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/profile/delete/';\n};\n\nexport type CfgAccountsProfileDeleteCreateErrors = {\n    /**\n     * Account is already deleted.\n     */\n    400: unknown;\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsProfileDeleteCreateResponses = {\n    200: AccountDeleteResponse;\n};\n\nexport type CfgAccountsProfileDeleteCreateResponse = CfgAccountsProfileDeleteCreateResponses[keyof CfgAccountsProfileDeleteCreateResponses];\n\nexport type CfgAccountsProfilePartialPartialUpdateData = {\n    body?: PatchedCfgUserUpdateRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/profile/partial/';\n};\n\nexport type CfgAccountsProfilePartialPartialUpdateErrors = {\n    /**\n     * Invalid data provided.\n     */\n    400: unknown;\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsProfilePartialPartialUpdateResponses = {\n    200: User;\n};\n\nexport type CfgAccountsProfilePartialPartialUpdateResponse = CfgAccountsProfilePartialPartialUpdateResponses[keyof CfgAccountsProfilePartialPartialUpdateResponses];\n\nexport type CfgAccountsProfilePartialUpdateData = {\n    body?: CfgUserUpdateRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/profile/partial/';\n};\n\nexport type CfgAccountsProfilePartialUpdateErrors = {\n    /**\n     * Invalid data provided.\n     */\n    400: unknown;\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsProfilePartialUpdateResponses = {\n    200: User;\n};\n\nexport type CfgAccountsProfilePartialUpdateResponse = CfgAccountsProfilePartialUpdateResponses[keyof CfgAccountsProfilePartialUpdateResponses];\n\nexport type CfgAccountsProfileUpdatePartialUpdateData = {\n    body?: PatchedCfgUserUpdateRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/profile/update/';\n};\n\nexport type CfgAccountsProfileUpdatePartialUpdateErrors = {\n    /**\n     * Invalid data provided.\n     */\n    400: unknown;\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsProfileUpdatePartialUpdateResponses = {\n    200: User;\n};\n\nexport type CfgAccountsProfileUpdatePartialUpdateResponse = CfgAccountsProfileUpdatePartialUpdateResponses[keyof CfgAccountsProfileUpdatePartialUpdateResponses];\n\nexport type CfgAccountsProfileUpdateUpdateData = {\n    body?: CfgUserUpdateRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/profile/update/';\n};\n\nexport type CfgAccountsProfileUpdateUpdateErrors = {\n    /**\n     * Invalid data provided.\n     */\n    400: unknown;\n    /**\n     * Authentication credentials were not provided.\n     */\n    401: unknown;\n};\n\nexport type CfgAccountsProfileUpdateUpdateResponses = {\n    200: User;\n};\n\nexport type CfgAccountsProfileUpdateUpdateResponse = CfgAccountsProfileUpdateUpdateResponses[keyof CfgAccountsProfileUpdateUpdateResponses];\n\nexport type CfgAccountsTokenCreateData = {\n    body: PasswordLoginRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/token/';\n};\n\nexport type CfgAccountsTokenCreateErrors = {\n    401: PasswordLoginError;\n    429: PasswordLoginError;\n};\n\nexport type CfgAccountsTokenCreateError = CfgAccountsTokenCreateErrors[keyof CfgAccountsTokenCreateErrors];\n\nexport type CfgAccountsTokenCreateResponses = {\n    200: PasswordLoginResponse;\n};\n\nexport type CfgAccountsTokenCreateResponse = CfgAccountsTokenCreateResponses[keyof CfgAccountsTokenCreateResponses];\n\nexport type CfgAccountsTokenBlacklistCreateData = {\n    body: TokenBlacklistRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/token/blacklist/';\n};\n\nexport type CfgAccountsTokenBlacklistCreateResponses = {\n    /**\n     * No response body\n     */\n    200: unknown;\n};\n\nexport type CfgAccountsTokenRefreshCreateData = {\n    body: TokenRefreshRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/accounts/token/refresh/';\n};\n\nexport type CfgAccountsTokenRefreshCreateResponses = {\n    200: TokenRefresh;\n};\n\nexport type CfgAccountsTokenRefreshCreateResponse = CfgAccountsTokenRefreshCreateResponses[keyof CfgAccountsTokenRefreshCreateResponses];\n\nexport type CfgTotpBackupCodesRetrieveData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/backup-codes/';\n};\n\nexport type CfgTotpBackupCodesRetrieveResponses = {\n    200: BackupCodesStatus;\n};\n\nexport type CfgTotpBackupCodesRetrieveResponse = CfgTotpBackupCodesRetrieveResponses[keyof CfgTotpBackupCodesRetrieveResponses];\n\nexport type CfgTotpBackupCodesRegenerateCreateData = {\n    body: BackupCodesRegenerateRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/backup-codes/regenerate/';\n};\n\nexport type CfgTotpBackupCodesRegenerateCreateErrors = {\n    /**\n     * Invalid code or 2FA not enabled\n     */\n    400: unknown;\n};\n\nexport type CfgTotpBackupCodesRegenerateCreateResponses = {\n    200: BackupCodesRegenerateResponse;\n};\n\nexport type CfgTotpBackupCodesRegenerateCreateResponse = CfgTotpBackupCodesRegenerateCreateResponses[keyof CfgTotpBackupCodesRegenerateCreateResponses];\n\nexport type CfgTotpDevicesRetrieveData = {\n    body?: never;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/devices/';\n};\n\nexport type CfgTotpDevicesRetrieveResponses = {\n    200: DeviceListResponse;\n};\n\nexport type CfgTotpDevicesRetrieveResponse = CfgTotpDevicesRetrieveResponses[keyof CfgTotpDevicesRetrieveResponses];\n\nexport type CfgTotpDevicesDestroyData = {\n    body?: never;\n    path: {\n        id: string;\n    };\n    query?: never;\n    url: '/cfg/totp/devices/{id}/';\n};\n\nexport type CfgTotpDevicesDestroyResponses = {\n    /**\n     * No response body\n     */\n    204: void;\n};\n\nexport type CfgTotpDevicesDestroyResponse = CfgTotpDevicesDestroyResponses[keyof CfgTotpDevicesDestroyResponses];\n\nexport type CfgTotpDisableCreateData = {\n    body: DisableRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/disable/';\n};\n\nexport type CfgTotpDisableCreateErrors = {\n    /**\n     * Invalid code\n     */\n    400: unknown;\n};\n\nexport type CfgTotpDisableCreateResponses = {\n    200: CfgTotpDisableResponse200AutoRef;\n};\n\nexport type CfgTotpDisableCreateResponse = CfgTotpDisableCreateResponses[keyof CfgTotpDisableCreateResponses];\n\nexport type CfgTotpSetupCreateData = {\n    body?: SetupRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/setup/';\n};\n\nexport type CfgTotpSetupCreateErrors = {\n    /**\n     * 2FA already enabled or invalid request\n     */\n    400: unknown;\n};\n\nexport type CfgTotpSetupCreateResponses = {\n    200: SetupResponse;\n};\n\nexport type CfgTotpSetupCreateResponse = CfgTotpSetupCreateResponses[keyof CfgTotpSetupCreateResponses];\n\nexport type CfgTotpSetupConfirmCreateData = {\n    body: ConfirmSetupRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/setup/confirm/';\n};\n\nexport type CfgTotpSetupConfirmCreateErrors = {\n    /**\n     * Invalid code or setup expired\n     */\n    400: unknown;\n};\n\nexport type CfgTotpSetupConfirmCreateResponses = {\n    200: ConfirmSetupResponse;\n};\n\nexport type CfgTotpSetupConfirmCreateResponse = CfgTotpSetupConfirmCreateResponses[keyof CfgTotpSetupConfirmCreateResponses];\n\nexport type CfgTotpVerifyCreateData = {\n    body: VerifyRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/verify/';\n};\n\nexport type CfgTotpVerifyCreateErrors = {\n    /**\n     * Invalid code or session\n     */\n    400: unknown;\n    /**\n     * Too many attempts\n     */\n    403: unknown;\n};\n\nexport type CfgTotpVerifyCreateResponses = {\n    200: VerifyResponse;\n};\n\nexport type CfgTotpVerifyCreateResponse = CfgTotpVerifyCreateResponses[keyof CfgTotpVerifyCreateResponses];\n\nexport type CfgTotpVerifyBackupCreateData = {\n    body: VerifyBackupRequest;\n    path?: never;\n    query?: never;\n    url: '/cfg/totp/verify/backup/';\n};\n\nexport type CfgTotpVerifyBackupCreateErrors = {\n    /**\n     * Invalid backup code or session\n     */\n    400: unknown;\n};\n\nexport type CfgTotpVerifyBackupCreateResponses = {\n    200: VerifyResponse;\n};\n\nexport type CfgTotpVerifyBackupCreateResponse = CfgTotpVerifyBackupCreateResponses[keyof CfgTotpVerifyBackupCreateResponses];\n","/** Read a property off an unknown value without asserting its shape. */\nconst prop = (value: unknown, key: string): unknown =>\n  typeof value === 'object' && value !== null\n    ? (value as Record<string, unknown>)[key]\n    : undefined;\n\n/**\n * The transport's own fallback message, e.g. `HTTP 404: ` or `HTTP 500: Boom`.\n *\n * `APIError` builds this when the caller supplies no message of its own\n * (`_api/generated/helpers/errors.ts`), so it is never server prose — it is the\n * status line restated. Under HTTP/2 `statusText` is empty, which is how a bare\n * `HTTP 404:` (and `HTTP 0:` for a response that never arrived) reached a sign-in form and told the user nothing at all.\n */\nconst TRANSPORT_FALLBACK = /^HTTP \\d{1,3}:\\s*/;\n\n/**\n * Translation keys for the copy this module can choose.\n *\n * Every one already exists, translated, in all 17 locales of `@djangocfg/i18n`\n * — `api.errors.*` for transport conditions and `ui.errors.*` for the ones a\n * person can act on. Nothing is added here: a second key saying \"Server is\n * unavailable\" in a namespace of its own would be a second owner of the same\n * sentence, and the one that loses is whichever the caller did not use.\n *\n * A 404 maps to `serverUnavailable`, not to `ui.errors.notFound` (\"Not found\"):\n * on a sign-in POST the missing thing is the ENDPOINT, which tells the visitor\n * nothing about a page and everything about the service being down.\n */\nexport const AUTH_ERROR_KEYS = {\n  invalidCredentials: 'ui.errors.unauthorized',\n  rateLimited: 'api.errors.rateLimited',\n  serverUnavailable: 'api.errors.serverUnavailable',\n  networkError: 'api.errors.networkError',\n  generic: 'ui.errors.generic',\n} as const;\n\nexport type AuthErrorKey = (typeof AUTH_ERROR_KEYS)[keyof typeof AUTH_ERROR_KEYS];\n\n/**\n * English copy for each key, so a caller without a translator still renders a\n * sentence. The catalogue is authoritative; this is the offline twin.\n */\nconst FALLBACK_COPY: Record<AuthErrorKey, string> = {\n  [AUTH_ERROR_KEYS.invalidCredentials]: 'Please sign in to continue',\n  [AUTH_ERROR_KEYS.rateLimited]: 'Too many requests. Please wait.',\n  [AUTH_ERROR_KEYS.serverUnavailable]: 'Server is unavailable',\n  [AUTH_ERROR_KEYS.networkError]: 'Network error',\n  [AUTH_ERROR_KEYS.generic]: 'Something went wrong',\n};\n\n/** Map a status code to the key whose copy explains it. */\nconst keyForStatus = (status: number | undefined): AuthErrorKey => {\n  if (status === undefined) return AUTH_ERROR_KEYS.generic;\n  // 0 is \"no response at all\": the network dropped, CORS refused (a proxy answering 404 while the API restarts carries\n  // no CORS headers, so the browser reports it as 0), or the request was blocked. Not a server verdict.\n  if (status === 0) return AUTH_ERROR_KEYS.networkError;\n  if (status === 401 || status === 403) return AUTH_ERROR_KEYS.invalidCredentials;\n  // A 404 here is a missing endpoint, not a missing page — see AUTH_ERROR_KEYS.\n  if (status === 404) return AUTH_ERROR_KEYS.serverUnavailable;\n  if (status === 429) return AUTH_ERROR_KEYS.rateLimited;\n  if (status >= 500) return AUTH_ERROR_KEYS.serverUnavailable;\n  return AUTH_ERROR_KEYS.generic;\n};\n\n/** What the auth layer decided to show, and why. */\nexport interface AuthErrorCopy {\n  /** Ready-to-render text: server prose, or this module's English fallback. */\n  message: string;\n  /**\n   * Set only when `message` came from `FALLBACK_COPY`. A caller holding a\n   * translator renders `t(key)` instead; server prose carries no key because\n   * the backend already chose the words and the locale.\n   */\n  key?: AuthErrorKey;\n}\n\n/**\n * Decide what a failed auth call should say.\n *\n * Order: text the SERVER wrote, then copy chosen from the status code, then a\n * generic sentence. Server prose wins because the backend knows the specific\n * reason (\"This code has expired\") that a status code cannot express.\n *\n * Each candidate is checked to be a string before it is returned. Under the\n * previous `any` the check was only that the property was truthy, so a DRF\n * field-error object (`{detail: {email: [...]}}`) reached the UI as\n * \"[object Object]\" — an error message that tells the user nothing.\n *\n * `HTTP <code>:` strings are rejected on the way through. They are the\n * transport restating its own status line, not prose anyone wrote to be read,\n * and treating them as a message is what put a bare `HTTP 404:` under a\n * sign-in field. The code itself stays useful — `logAuthFailure` puts it in\n * the console, where diagnosis belongs.\n */\nexport const resolveAuthError = (error: unknown, fallback?: string): AuthErrorCopy => {\n  if (typeof error === 'string' && error && !TRANSPORT_FALLBACK.test(error)) {\n    return { message: error };\n  }\n\n  const candidates = [\n    prop(error, 'message'),\n    prop(error, 'detail'),\n    prop(prop(error, 'response'), 'error'),\n    prop(prop(error, 'response'), 'detail'),\n    prop(prop(error, 'response'), 'message'),\n    prop(prop(prop(error, 'response'), 'data'), 'detail'),\n  ];\n\n  for (const candidate of candidates) {\n    if (typeof candidate === 'string' && candidate && !TRANSPORT_FALLBACK.test(candidate)) {\n      return { message: candidate };\n    }\n  }\n\n  // Both spellings are read: `statusCode` is what `APIError` declares, while a\n  // Response-shaped rejection reaching here from outside the interceptor\n  // carries `status`.\n  const rawStatus = prop(error, 'statusCode') ?? prop(error, 'status');\n  const status = typeof rawStatus === 'number' ? rawStatus : undefined;\n\n  // A caller's own fallback only applies where the status says nothing; a 404\n  // must not be reported as \"Failed to send the code\".\n  if (status === undefined && fallback) {\n    return { message: fallback };\n  }\n\n  const key = keyForStatus(status);\n  return { message: FALLBACK_COPY[key], key };\n};\n\n/**\n * `resolveAuthError` for callers that only want the string.\n *\n * Kept because most call sites store a plain `error` string in form state and\n * have no translator to hand.\n */\nexport const formatAuthError = (error: unknown, fallback?: string): string =>\n  resolveAuthError(error, fallback).message;\n\n/**\n * Log a failed auth call at the level its cause deserves.\n *\n * A 4xx on an auth endpoint is the USER getting it wrong — a mistyped OTP, an\n * expired code, a bad password. It is the endpoint working. Logged through\n * `console.error` it became a production alert: `@djangocfg/devtools` captures\n * `console.error` as an `ERROR` event, so every typo raised \"❌ Error\" in\n * Telegram, complete with consola's `%c` CSS in the message body. Real faults\n * drown in that.\n *\n * 5xx, a network failure and a broken response contract stay at `error`:\n * nobody can fix those by retyping, and they are what the alert is for.\n *\n * Both `statusCode` (what `APIError` declares) and `status` are read, because\n * a Response-shaped rejection can reach here from code that does not go\n * through the interceptor.\n */\nexport const logAuthFailure = (\n  log: { warn: (...args: unknown[]) => void; error: (...args: unknown[]) => void },\n  message: string,\n  error: unknown,\n): void => {\n  const code = prop(error, 'statusCode') ?? prop(error, 'status');\n  const isClientError = typeof code === 'number' && code >= 400 && code < 500;\n  if (isClientError) {\n    log.warn(message, error);\n    return;\n  }\n  log.error(message, error);\n};\n","import { OAuthErrorCodeEnum, type OAuthProviderEnum } from '../../_api/generated/types.gen';\nimport { formatAuthError } from './errors';\n\n/** A provider the server can offer. Derived from the generated enum, so a new backend provider is a type error until it gets an adapter. */\nexport type OAuthProviderId = `${OAuthProviderEnum}`;\n\n/** Every `error` value the OAuth endpoints can return (closed set from the OpenAPI schema). */\nexport type OAuthErrorCode = `${OAuthErrorCodeEnum}`;\n\n/** Failures the browser detects itself, before or instead of a server answer. */\nexport type OAuthClientErrorCode = 'cancelled' | 'unknown_provider';\n\nexport type OAuthFailureCode = OAuthErrorCode | OAuthClientErrorCode;\n\nexport interface OAuthFailure {\n  /** Set when the cause is one the UI can explain; absent for transport faults. */\n  code?: OAuthFailureCode;\n  /** English text for callers without a translator: server prose, else a generic sentence. */\n  message: string;\n}\n\n// Read from the generated enum: a code the backend adds arrives with `make generate`.\nconst SERVER_CODES: ReadonlySet<string> = new Set<string>(Object.values(OAuthErrorCodeEnum));\n\nconst record = (value: unknown): Record<string, unknown> | null =>\n  typeof value === 'object' && value !== null ? (value as Record<string, unknown>) : null;\n\n/**\n * Read `{error, error_description}` off a thrown API error.\n *\n * The transport keeps the parsed body on `response`; `formatAuthError` alone\n * would surface the machine code (`invalid_state`) as if it were prose.\n */\nexport const readOAuthFailure = (err: unknown, fallback: string): OAuthFailure => {\n  const body = record(record(err)?.response);\n  const code = body?.error;\n  if (typeof code === 'string' && SERVER_CODES.has(code)) {\n    const description = body?.error_description;\n    return {\n      code: code as OAuthErrorCode,\n      message: typeof description === 'string' && description ? description : fallback,\n    };\n  }\n  return { message: formatAuthError(err, fallback) };\n};\n","'use client';\n\nimport { useState } from 'react';\n\nimport { authLogger } from '../utils/logger';\nimport { isQuotaExceededError, isWithinSizeLimit } from '../utils/storage';\n\n/**\n * Simple sessionStorage hook with better error handling\n * @param key - Storage key\n * @param initialValue - Default value if key doesn't exist\n * @returns [value, setValue, removeValue] - Current value, setter function, and remove function\n */\nexport function useSessionStorage<T>(key: string, initialValue: T) {\n  // Get initial value from sessionStorage or use provided initialValue\n  const [storedValue, setStoredValue] = useState<T>(() => {\n    if (typeof window === 'undefined') {\n      return initialValue;\n    }\n\n    try {\n      const item = window.sessionStorage.getItem(key);\n      return item ? JSON.parse(item) : initialValue;\n    } catch (error) {\n      authLogger.error(`Error reading sessionStorage key \"${key}\":`, error);\n      return initialValue;\n    }\n  });\n\n  // Clear old data when sessionStorage is full\n  const clearOldData = () => {\n    try {\n      const keys = Object.keys(sessionStorage).filter(key => key && typeof key === 'string');\n      // Remove oldest items if we have more than 50 items\n      if (keys.length > 50) {\n        const itemsToRemove = Math.ceil(keys.length * 0.2);\n        for (let i = 0; i < itemsToRemove; i++) {\n          try {\n            const key = keys[i];\n            if (key) {\n              sessionStorage.removeItem(key);\n              sessionStorage.removeItem(`${key}_ts`);\n            }\n          } catch {\n            // Ignore errors when removing items\n          }\n        }\n      }\n    } catch (error) {\n      authLogger.error('Error clearing old sessionStorage data:', error);\n    }\n  };\n\n  // Force clear all data if quota is exceeded\n  const forceClearAll = () => {\n    try {\n      const keys = Object.keys(sessionStorage);\n      for (const key of keys) {\n        try {\n          sessionStorage.removeItem(key);\n        } catch {\n          // Ignore errors when removing items\n        }\n      }\n    } catch (error) {\n      authLogger.error('Error force clearing sessionStorage:', error);\n    }\n  };\n\n  // Update sessionStorage when value changes\n  const setValue = (value: T | ((val: T) => T)) => {\n    try {\n      const valueToStore = value instanceof Function ? value(storedValue) : value;\n      \n      // Check data size before attempting to save\n      if (!isWithinSizeLimit(valueToStore, key)) {\n        authLogger.warn(`Data size too large for key \"${key}\", removing key`);\n        // Remove the key if data is too large\n        try {\n          window.sessionStorage.removeItem(key);\n          window.sessionStorage.removeItem(`${key}_ts`);\n        } catch {\n          // Ignore errors when removing\n        }\n        // Still update the state\n        setStoredValue(valueToStore);\n        return;\n      }\n      \n      setStoredValue(valueToStore);\n\n      if (typeof window !== 'undefined') {\n        // Try to set the value\n        try {\n          window.sessionStorage.setItem(key, JSON.stringify(valueToStore));\n          // Add timestamp for cleanup\n          window.sessionStorage.setItem(`${key}_ts`, Date.now().toString());\n        } catch (storageError: unknown) {\n          // If quota exceeded, clear old data and try again\n          if (isQuotaExceededError(storageError)) {\n            authLogger.warn('sessionStorage quota exceeded, clearing old data...');\n            clearOldData();\n            \n            // Try again after clearing\n            try {\n              window.sessionStorage.setItem(key, JSON.stringify(valueToStore));\n              window.sessionStorage.setItem(`${key}_ts`, Date.now().toString());\n            } catch (retryError) {\n              authLogger.error(`Failed to set sessionStorage key \"${key}\" after clearing old data:`, retryError);\n              // If still fails, force clear all and try one more time\n              try {\n                forceClearAll();\n                window.sessionStorage.setItem(key, JSON.stringify(valueToStore));\n                window.sessionStorage.setItem(`${key}_ts`, Date.now().toString());\n              } catch (finalError) {\n                authLogger.error(`Failed to set sessionStorage key \"${key}\" after force clearing:`, finalError);\n                // If still fails, just update the state without sessionStorage\n                setStoredValue(valueToStore);\n              }\n            }\n          } else {\n            throw storageError;\n          }\n        }\n      }\n    } catch (error) {\n      authLogger.error(`Error setting sessionStorage key \"${key}\":`, error);\n      // Still update the state even if sessionStorage fails\n      const valueToStore = value instanceof Function ? value(storedValue) : value;\n      setStoredValue(valueToStore);\n    }\n  };\n\n  // Remove value from sessionStorage\n  const removeValue = () => {\n    try {\n      setStoredValue(initialValue);\n      if (typeof window !== 'undefined') {\n        try {\n          window.sessionStorage.removeItem(key);\n          window.sessionStorage.removeItem(`${key}_ts`);\n        } catch (removeError: unknown) {\n          // If removal fails due to quota, try to clear some data first\n          if (isQuotaExceededError(removeError)) {\n            authLogger.warn('sessionStorage quota exceeded during removal, clearing old data...');\n            clearOldData();\n            \n            try {\n              window.sessionStorage.removeItem(key);\n              window.sessionStorage.removeItem(`${key}_ts`);\n            } catch (retryError) {\n              authLogger.error(`Failed to remove sessionStorage key \"${key}\" after clearing:`, retryError);\n              // If still fails, force clear all\n              forceClearAll();\n            }\n          } else {\n            throw removeError;\n          }\n        }\n      }\n    } catch (error) {\n      authLogger.error(`Error removing sessionStorage key \"${key}\":`, error);\n    }\n  };\n\n  return [storedValue, setValue, removeValue] as const;\n}\n","/**\n * Web Storage helpers shared by `useLocalStorage` and `useSessionStorage`.\n *\n * Both hooks carried byte-identical copies of `checkDataSize`, and the quota\n * check was written out four times — twice per hook, on write and on remove.\n * Every copy typed its caught error `any` and then read three properties off\n * it, which is exactly the read `unknown` makes you justify.\n */\n\nimport { authLogger } from './logger';\n\n/** Per-item ceiling. Browsers cap the whole origin near 5MB. */\nconst MAX_ITEM_KB = 1024;\n\n/**\n * Whether a caught error means the storage quota is full.\n *\n * Browsers disagree on how to say it: modern engines throw a `DOMException`\n * named `QuotaExceededError`, older WebKit used code 22, and some report it\n * only in the message. All three are checked because all three are still met\n * in the wild — and because the caller's response (drop old data, retry) is\n * the same for each.\n */\nexport function isQuotaExceededError(error: unknown): boolean {\n  if (typeof error !== 'object' || error === null) return false;\n\n  const { name, code, message } = error as {\n    name?: unknown;\n    code?: unknown;\n    message?: unknown;\n  };\n\n  return (\n    name === 'QuotaExceededError' ||\n    code === 22 ||\n    (typeof message === 'string' && message.includes('quota'))\n  );\n}\n\n/**\n * Whether `data` serialises to something small enough to store.\n *\n * `unknown` rather than a type parameter: this only serialises, so it needs no\n * knowledge of the shape, and a parameter would invite callers to read one.\n * Returns false on a value that cannot be serialised at all — a circular\n * reference is not storable either, and the caller's response is identical.\n */\nexport function isWithinSizeLimit(data: unknown, key: string): boolean {\n  try {\n    const sizeInKB = new Blob([JSON.stringify(data)]).size / 1024;\n\n    if (sizeInKB > MAX_ITEM_KB) {\n      authLogger.warn(\n        `Data size (${sizeInKB.toFixed(2)}KB) exceeds 1MB limit for key \"${key}\"`,\n      );\n      return false;\n    }\n\n    return true;\n  } catch (error) {\n    authLogger.error(`Error checking data size for key \"${key}\":`, error);\n    return false;\n  }\n}\n","import { CFG_KEYS } from '../../_api/generated/helpers/keys';\nimport { useSessionStorage } from './useSessionStorage';\n\nconst AUTH_REDIRECT_KEY = CFG_KEYS.redirectUrl.key;\n\nexport interface AuthRedirectOptions {\n  fallbackUrl?: string;\n  clearOnUse?: boolean;\n}\n\n/**\n * Read redirect URL directly from sessionStorage (bypasses React state)\n * This is needed because different component instances have different React states\n */\nconst getRedirectFromStorage = (): string => {\n  if (typeof window === 'undefined') return '';\n  try {\n    const item = window.sessionStorage.getItem(AUTH_REDIRECT_KEY);\n    return item ? JSON.parse(item) : '';\n  } catch {\n    return '';\n  }\n};\n\n/**\n * Clear redirect URL directly from sessionStorage\n */\nconst clearRedirectFromStorage = (): void => {\n  if (typeof window === 'undefined') return;\n  try {\n    window.sessionStorage.removeItem(AUTH_REDIRECT_KEY);\n    window.sessionStorage.removeItem(`${AUTH_REDIRECT_KEY}_ts`);\n  } catch {\n    // Ignore errors\n  }\n};\n\n/**\n * Read the saved back-url without clearing it. Null when nothing saved —\n * unlike getFinalRedirectUrl, never substitutes a fallback.\n */\nexport const peekSavedRedirect = (): string | null => getRedirectFromStorage() || null;\n\n/**\n * Read AND clear the saved back-url (single-use intent). Null when nothing\n * saved. This is the one primitive every post-auth navigator uses to honor\n * \"return the user to where the guard bounced them from\".\n */\nexport const consumeSavedRedirect = (): string | null => {\n  const stored = getRedirectFromStorage();\n  if (stored) clearRedirectFromStorage();\n  return stored || null;\n};\n\nexport const useAuthRedirectManager = (options: AuthRedirectOptions = {}) => {\n  const { fallbackUrl = '/private', clearOnUse = true } = options;\n  const [redirectUrl, setRedirectUrl, removeRedirectUrl] = useSessionStorage<string>(AUTH_REDIRECT_KEY, '');\n\n  const setRedirect = (url: string) => {\n    setRedirectUrl(url);\n  };\n\n  const getRedirect = () => {\n    // Read directly from storage to get latest value across components\n    return getRedirectFromStorage() || redirectUrl;\n  };\n\n  const clearRedirect = () => {\n    removeRedirectUrl();\n    clearRedirectFromStorage();\n  };\n\n  const hasRedirect = () => {\n    const stored = getRedirectFromStorage();\n    return stored.length > 0 || redirectUrl.length > 0;\n  };\n\n  const getFinalRedirectUrl = () => {\n    // Read directly from storage to get latest value across components\n    const stored = getRedirectFromStorage();\n    return stored || redirectUrl || fallbackUrl;\n  };\n\n  const useAndClearRedirect = () => {\n    // Read directly from storage to ensure we get the latest saved URL\n    // even if it was saved by a different component instance\n    const stored = getRedirectFromStorage();\n    const finalUrl = stored || redirectUrl || fallbackUrl;\n\n    if (clearOnUse) {\n      clearRedirect();\n    }\n    return finalUrl;\n  };\n\n  return {\n    redirectUrl,\n    setRedirect,\n    getRedirect,\n    clearRedirect,\n    hasRedirect,\n    getFinalRedirectUrl,\n    useAndClearRedirect\n  };\n}; \n","'use client';\n\nimport { useMemo, useState, useSyncExternalStore } from 'react';\n\nimport { useCfgAccountsOauthProvidersRetrieve } from '../../_api/generated/_cfg_accounts/hooks/useCfgAccountsOauthProvidersRetrieve';\nimport { CFG_KEYS, cfgStorage } from '../../_api/generated/helpers/keys';\nimport type { OAuthProviderInfo } from '../../_api/generated/types.gen';\nimport { OAUTH_PROVIDER_IDS } from './useOAuthLogin';\n\nexport interface UseOAuthProvidersReturn {\n  /** Providers the server has configured, in the server's display order. Empty until ready and on failure. */\n  providers: OAuthProviderInfo[];\n  /** False only while the first request is in flight and nothing is cached. */\n  isReady: boolean;\n}\n\nconst EMPTY: OAuthProviderInfo[] = [];\nconst CACHE_KEY = CFG_KEYS.oauthProviders.key;\n\n/** A failed request is tried again this many times before the list is given up as empty. */\nexport const OAUTH_PROVIDERS_MAX_RETRIES = 2;\n/** Base wait before a retry; grows linearly (1s, then 2s), so a flaky mobile network has ~3s to recover. */\nexport const OAUTH_PROVIDERS_RETRY_MS = 1000;\n\nconst isInfo = (value: unknown): value is OAuthProviderInfo =>\n  typeof value === 'object' && value !== null && typeof (value as { id?: unknown }).id === 'string';\n\n// useSyncExternalStore needs a stable snapshot: parse again only when the stored text changed.\nlet lastRaw: string | null = null;\nlet lastParsed: OAuthProviderInfo[] | undefined;\n\n/** The list the previous page of this tab fetched; `undefined` when none or unreadable. */\nconst readCached = (): OAuthProviderInfo[] | undefined => {\n  const raw = cfgStorage.read(CACHE_KEY);\n  if (raw === lastRaw) return lastParsed;\n  lastRaw = raw;\n  try {\n    const parsed: unknown = raw === null ? null : JSON.parse(raw);\n    lastParsed = Array.isArray(parsed) && parsed.every(isInfo) ? parsed : undefined;\n  } catch {\n    lastParsed = undefined;\n  }\n  return lastParsed;\n};\n\nconst subscribe = () => () => {};\nconst serverSnapshot = () => undefined;\n\n/**\n * The sign-in providers the server offers (`GET /cfg/accounts/oauth/providers/`).\n *\n * Fetched once per page session and kept in `sessionStorage`, so a reload or\n * \"Try again\" after a failed callback shows the buttons at once; the server\n * answer always wins. A failed request is retried twice (a dropped mobile\n * connection or a gateway 502 must not hide the buttons for the whole visit);\n * only when the retries fail too does the hook yield the cached list, else\n * `[]`, with `isReady: true`: the email form never waits on, or breaks\n * because of, this list. Ids this client has no adapter for (a newer backend) are dropped.\n */\nexport const useOAuthProviders = (): UseOAuthProvidersReturn => {\n  // Server and first client render see `undefined`, so hydration matches.\n  const cached = useSyncExternalStore(subscribe, readCached, serverSnapshot);\n\n  const [failed, setFailed] = useState(false);\n\n  const { data } = useCfgAccountsOauthProvidersRetrieve(undefined, {\n    revalidateOnFocus: false,\n    revalidateOnReconnect: false,\n    revalidateOnMount: true,\n    shouldRetryOnError: true,\n    onErrorRetry: (_error, _key, _config, revalidate, opts) => {\n      // `opts.retryCount` is 1 for the first failure.\n      if (opts.retryCount > OAUTH_PROVIDERS_MAX_RETRIES) {\n        setFailed(true);\n        return;\n      }\n      setTimeout(() => void revalidate(opts), OAUTH_PROVIDERS_RETRY_MS * opts.retryCount);\n    },\n    dedupingInterval: 60 * 60 * 1000,\n    fallbackData: cached && { providers: cached },\n    onSuccess: (response) => {\n      setFailed(false);\n      cfgStorage.writeJSON(CACHE_KEY, response.providers);\n    },\n  });\n\n  const providers = useMemo(\n    () => data?.providers.filter((p) => OAUTH_PROVIDER_IDS.includes(p.id)) ?? EMPTY,\n    [data],\n  );\n\n  // Ready on an answer, on a cached list (usable at once), or when the retries gave up.\n  // Not `isLoading`: it is off in the wait between a failure and its retry.\n  return { providers, isReady: data !== undefined || failed || cached !== undefined };\n};\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// List OAuth providers\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWR from \"swr\";\nimport type { SWRConfiguration, SWRResponse } from \"swr\";\nimport { CfgAccountsOauth } from \"../../sdk.gen\";\nimport type { CfgAccountsOauthProvidersRetrieveData, CfgAccountsOauthProvidersRetrieveResponses } from \"../../types.gen\";\n\n\ntype Result = CfgAccountsOauthProvidersRetrieveResponses[keyof CfgAccountsOauthProvidersRetrieveResponses];\n\n/**\n * Optional `enabled` flag — when `false`, the SWR key becomes `null` and\n * no request is made. Use for gated endpoints (auth-required, feature\n * flags, \"fetch only when X is selected\"). The flag is stripped before\n * being forwarded to `useSWR` so the underlying SWR config stays pristine.\n */\ntype HookConfig = SWRConfiguration<Result> & { enabled?: boolean };\n\n// The return type is ANNOTATED, not inferred. Left to inference, tsc reaches\n// into swr's internal `dist/types-*` module to name the result and fails with\n// TS2742 (\"cannot be named without a reference to ... not portable\") in every\n// consumer that has swr hoisted to a different node_modules depth. Naming\n// SWRResponse here keeps the public surface expressible from the package's own\n// imports.\nexport function useCfgAccountsOauthProvidersRetrieve(\n  args?: Omit<CfgAccountsOauthProvidersRetrieveData, \"url\" | \"body\">,\n  config?: HookConfig,\n): SWRResponse<Result> {\n  const { enabled = true, ...swrConfig } = config ?? {};\n  const key = enabled ? [\"cfg_accounts_oauth_providers_retrieve\", args ?? {}] as const : null;\n  return useSWR<Result>(\n    key,\n    async () => {\n      const res = await CfgAccountsOauth.cfgAccountsOauthProvidersRetrieve({ ...(args ?? {}), throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/OAuthProvidersResponse\")\n        .then(({ OAuthProvidersResponseSchema }) => {\n          const parsed = OAuthProvidersResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_oauth_providers_retrieve\",\n              method: \"GET\",\n              path: \"/cfg/accounts/oauth/providers/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_oauth_providers_retrieve\",\n                    method: \"GET\",\n                    path: \"/cfg/accounts/oauth/providers/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    swrConfig,\n  );\n}\n","'use client';\n\nimport { useCallback } from 'react';\n\nimport { type UseOAuthLoginOptions, useOAuthLogin } from './useOAuthLogin';\n\nexport type { OAuthUser } from './useOAuthLogin';\n\n/** @deprecated Use `UseOAuthLoginOptions`. */\nexport type UseGithubAuthOptions = UseOAuthLoginOptions;\n\n/** @deprecated Use `UseOAuthLoginReturn`. */\nexport interface UseGithubAuthReturn {\n  isLoading: boolean;\n  error: string | null;\n  startGithubAuth: () => Promise<void>;\n  handleGithubCallback: (code: string, state: string) => Promise<void>;\n}\n\n/**\n * @deprecated Use `useOAuthLogin` (`start('github')`, `complete('github', code, state)`).\n * Kept for one minor release; behaviour is `useOAuthLogin` with the provider fixed.\n */\nexport const useGithubAuth = (options: UseGithubAuthOptions = {}): UseGithubAuthReturn => {\n  const { isLoading, error, start, complete } = useOAuthLogin(options);\n  const startGithubAuth = useCallback(() => start('github'), [start]);\n  const handleGithubCallback = useCallback(\n    (code: string, state: string) => complete('github', code, state),\n    [complete],\n  );\n  return { isLoading, error, startGithubAuth, handleGithubCallback };\n};\n","'use client';\n\nimport { useCallback, useState } from 'react';\n\nimport { auth } from '../../_api/generated/helpers/auth';\nimport { CfgTotpVerify } from '../../_api/generated/sdk.gen';\nimport type { TotpVerifyUser, VerifyResponse } from '../../_api/generated/types.gen';\nimport { Analytics, AnalyticsCategory, AnalyticsEvent } from '../utils/analytics';\nimport { authLogger } from '../utils/logger';\nimport { formatAuthError, logAuthFailure } from '../utils/errors';\nimport { consumeSavedRedirect } from './useAuthRedirect';\nimport { useCfgRouter } from './useCfgRouter';\nimport { extractAttemptsRemaining, isValidTotpCode } from './twoFactor.shared';\nimport { authTrace } from '../trace';\n\nexport interface UseTwoFactorVerifyOptions {\n  /** Callback on successful 2FA verification */\n  onSuccess?: (user: TotpVerifyUser) => void;\n  /** Callback on error */\n  onError?: (error: string) => void;\n  /** URL to redirect after successful verification */\n  redirectUrl?: string;\n  /** Skip automatic redirect after success (caller handles navigation) */\n  skipRedirect?: boolean;\n}\n\nexport interface UseTwoFactorVerifyReturn {\n  /** Loading state */\n  isLoading: boolean;\n  /** Error message */\n  error: string | null;\n  /** Warning message (e.g., low backup codes) */\n  warning: string | null;\n  /** Remaining backup codes (if backup code was used) */\n  remainingBackupCodes: number | null;\n  /** Remaining verification attempts before lockout */\n  attemptsRemaining: number | null;\n  /** Verify TOTP code */\n  verifyTOTP: (sessionId: string, code: string) => Promise<boolean>;\n  /** Verify backup code */\n  verifyBackupCode: (sessionId: string, backupCode: string) => Promise<boolean>;\n  /** Clear error */\n  clearError: () => void;\n}\n\n/**\n * 2FA verification during login (internal — composed by {@link useTwoFactor}).\n *\n * After OTP/OAuth verification returns requires_2fa=true and a session_id,\n * collect the TOTP (or backup) code and call verifyTOTP/verifyBackupCode to\n * complete authentication.\n */\nexport const useTwoFactorVerify = (\n  options: UseTwoFactorVerifyOptions = {},\n): UseTwoFactorVerifyReturn => {\n  const { onSuccess, onError, redirectUrl, skipRedirect = false } = options;\n  const router = useCfgRouter();\n\n  const [isLoading, setIsLoading] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [warning, setWarning] = useState<string | null>(null);\n  const [remainingBackupCodes, setRemainingBackupCodes] = useState<number | null>(null);\n  const [attemptsRemaining, setAttemptsRemaining] = useState<number | null>(null);\n\n  const clearError = useCallback(() => {\n    setError(null);\n  }, []);\n\n  // `VerifyResponse` is the generated shape of this endpoint, so the hand-written\n  // copy it replaces cannot drift from the server contract any more.\n  const handleSuccess = useCallback((response: VerifyResponse) => {\n    // Save tokens — the ONE write path (atomic pair + session notification).\n    // Storage is always localStorage; session length is the server's call.\n    // See AccountsContext.verifyOTP.\n    authTrace('2fa.session');\n    auth.setSession({ access: response.access_token, refresh: response.refresh_token });\n\n    if (response.warning) {\n      setWarning(response.warning);\n    }\n    if (response.remaining_backup_codes !== undefined) {\n      setRemainingBackupCodes(response.remaining_backup_codes);\n    }\n\n    Analytics.event(AnalyticsEvent.AUTH_LOGIN_SUCCESS, {\n      category: AnalyticsCategory.AUTH,\n      label: '2fa',\n    });\n    if (response.user?.id) {\n      Analytics.setUser(String(response.user.id));\n    }\n\n    onSuccess?.(response.user);\n\n    // Redirect (unless skipRedirect). Priority: saved back-url > option > default.\n    if (!skipRedirect) {\n      const finalRedirectUrl = consumeSavedRedirect() || redirectUrl || '/private';\n      authLogger.info('2FA successful, redirecting to:', finalRedirectUrl);\n      router.hardPush(finalRedirectUrl);\n    }\n  }, [onSuccess, redirectUrl, router, skipRedirect]);\n\n  const verifyTOTP = useCallback(async (sessionId: string, code: string): Promise<boolean> => {\n    if (!sessionId) {\n      const msg = 'Missing 2FA session ID';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    }\n    if (!isValidTotpCode(code)) {\n      const msg = 'Please enter a 6-digit code';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    }\n\n    setIsLoading(true);\n    setError(null);\n\n    try {\n      authLogger.info('Verifying TOTP code...');\n\n      const result = await CfgTotpVerify.cfgTotpVerifyCreate({\n        body: { session_id: sessionId, code },\n        throwOnError: true,\n      });\n      const response = result.data;\n\n      if (!response.access_token || !response.refresh_token) {\n        throw new Error('Invalid response from 2FA verification');\n      }\n\n      handleSuccess(response);\n      return true;\n    } catch (err) {\n      logAuthFailure(authLogger, '2FA TOTP verification failed:', err);\n      const errorMessage = formatAuthError(err, 'Invalid verification code');\n      const attempts = extractAttemptsRemaining(err);\n      if (attempts !== null) setAttemptsRemaining(attempts);\n      setError(errorMessage);\n      onError?.(errorMessage);\n\n      Analytics.event(AnalyticsEvent.AUTH_OTP_VERIFY_FAIL, {\n        category: AnalyticsCategory.AUTH,\n        label: '2fa-totp',\n      });\n      return false;\n    } finally {\n      setIsLoading(false);\n    }\n  }, [handleSuccess, onError]);\n\n  const verifyBackupCode = useCallback(async (sessionId: string, backupCode: string): Promise<boolean> => {\n    if (!sessionId) {\n      const msg = 'Missing 2FA session ID';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    }\n    if (!backupCode || backupCode.length < 8) {\n      const msg = 'Please enter your backup code';\n      setError(msg);\n      onError?.(msg);\n      return false;\n    }\n\n    setIsLoading(true);\n    setError(null);\n\n    try {\n      authLogger.info('Verifying backup code...');\n\n      const result = await CfgTotpVerify.cfgTotpVerifyBackupCreate({\n        body: {\n          session_id: sessionId,\n          backup_code: backupCode.replace(/\\s+/g, ''),\n        },\n        throwOnError: true,\n      });\n      const response = result.data;\n\n      if (!response.access_token || !response.refresh_token) {\n        throw new Error('Invalid response from backup code verification');\n      }\n\n      handleSuccess(response);\n      return true;\n    } catch (err) {\n      logAuthFailure(authLogger, '2FA backup code verification failed:', err);\n      const errorMessage = formatAuthError(err, 'Invalid backup code');\n      const attempts = extractAttemptsRemaining(err);\n      if (attempts !== null) setAttemptsRemaining(attempts);\n      setError(errorMessage);\n      onError?.(errorMessage);\n\n      Analytics.event(AnalyticsEvent.AUTH_OTP_VERIFY_FAIL, {\n        category: AnalyticsCategory.AUTH,\n        label: '2fa-backup',\n      });\n      return false;\n    } finally {\n      setIsLoading(false);\n    }\n  }, [handleSuccess, onError]);\n\n  return {\n    isLoading,\n    error,\n    warning,\n    remainingBackupCodes,\n    attemptsRemaining,\n    verifyTOTP,\n    verifyBackupCode,\n    clearError,\n  };\n};\n","'use client';\n\nimport { APIError } from '../../_api/generated/helpers';\n\n/**\n * Shared internals for the 2FA hook family (verify / setup / status).\n *\n * Before consolidation each of the three hooks re-implemented error extraction\n * and 6-digit validation slightly differently — three copies that drifted. This\n * module is the single source for both, so every 2FA verb reports errors and\n * validates codes identically.\n *\n * Error extraction itself now lives one level up, in `utils/errors`: this\n * module's own copy was the second of three spellings of the same chain across\n * the auth layer, and the one that could not tell a status code from prose.\n */\n\nconst TOTP_CODE_LENGTH = 6;\n\n/** The one field the shared resolver does not read for us. */\ninterface TwoFactorErrorBody {\n  attempts_remaining?: unknown;\n}\n\n/** Pull `attempts_remaining` off an APIError body, or null if absent. */\nexport function extractAttemptsRemaining(err: unknown): number | null {\n  if (err instanceof APIError) {\n    const body = (err.response ?? null) as TwoFactorErrorBody | null;\n    if (typeof body?.attempts_remaining === 'number') return body.attempts_remaining;\n  }\n  return null;\n}\n\n/** True when `code` is a well-formed 6-digit TOTP code. */\nexport function isValidTotpCode(code: string): boolean {\n  return !!code && code.length === TOTP_CODE_LENGTH;\n}\n\nexport { TOTP_CODE_LENGTH };\n","'use client';\n\nimport { useCallback, useState } from 'react';\n\nimport { CfgTotpSetup } from '../../_api/generated/sdk.gen';\nimport { authLogger } from '../utils/logger';\nimport { formatAuthError, logAuthFailure } from '../utils/errors';\nimport { isValidTotpCode } from './twoFactor.shared';\n\nexport interface TwoFactorSetupData {\n  /** Device ID to use for confirmation */\n  deviceId: string;\n  /** Base32-encoded TOTP secret (for manual entry) */\n  secret: string;\n  /** otpauth:// URI for QR code generation */\n  provisioningUri: string;\n  /** Base64-encoded QR code image (data URI) */\n  qrCodeBase64: string;\n  /** Seconds until setup expires */\n  expiresIn: number;\n}\n\nexport interface UseTwoFactorSetupOptions {\n  /** Callback when setup is confirmed and backup codes are generated */\n  onComplete?: (backupCodes: string[]) => void;\n  /** Callback on error */\n  onError?: (error: string) => void;\n}\n\nexport interface UseTwoFactorSetupReturn {\n  /** Loading state */\n  isLoading: boolean;\n  /** Error message */\n  error: string | null;\n  /** Setup data (QR code, secret, etc.) */\n  setupData: TwoFactorSetupData | null;\n  /** Backup codes after confirmation */\n  backupCodes: string[] | null;\n  /** Warning message about backup codes */\n  backupCodesWarning: string | null;\n  /** Current setup step */\n  setupStep: 'idle' | 'scanning' | 'confirming' | 'complete';\n  /** Start 2FA setup - returns QR code data */\n  startSetup: (deviceName?: string) => Promise<TwoFactorSetupData | null>;\n  /** Confirm setup with TOTP code - returns backup codes */\n  confirmSetup: (code: string) => Promise<string[] | null>;\n  /** Reset setup state */\n  resetSetup: () => void;\n  /** Clear error */\n  clearError: () => void;\n}\n\n/**\n * 2FA setup — enabling TOTP (internal, composed by {@link useTwoFactor}).\n *\n * Flow: startSetup() → user scans QR → confirmSetup(code) → show backup codes.\n */\nexport const useTwoFactorSetup = (\n  options: UseTwoFactorSetupOptions = {},\n): UseTwoFactorSetupReturn => {\n  const { onComplete, onError } = options;\n\n  const [isLoading, setIsLoading] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [setupData, setSetupData] = useState<TwoFactorSetupData | null>(null);\n  const [backupCodes, setBackupCodes] = useState<string[] | null>(null);\n  const [backupCodesWarning, setBackupCodesWarning] = useState<string | null>(null);\n  const [setupStep, setSetupStep] = useState<'idle' | 'scanning' | 'confirming' | 'complete'>('idle');\n\n  const clearError = useCallback(() => {\n    setError(null);\n  }, []);\n\n  const resetSetup = useCallback(() => {\n    setSetupData(null);\n    setBackupCodes(null);\n    setBackupCodesWarning(null);\n    setSetupStep('idle');\n    setError(null);\n  }, []);\n\n  const startSetup = useCallback(async (deviceName?: string): Promise<TwoFactorSetupData | null> => {\n    setIsLoading(true);\n    setError(null);\n    setSetupStep('scanning');\n\n    try {\n      authLogger.info('Starting 2FA setup...');\n\n      const result = await CfgTotpSetup.cfgTotpSetupCreate({\n        body: { device_name: deviceName },\n        throwOnError: true,\n      });\n      const response = result.data;\n\n      const data: TwoFactorSetupData = {\n        deviceId: response.device_id,\n        secret: response.secret,\n        provisioningUri: response.provisioning_uri,\n        qrCodeBase64: response.qr_code_base64,\n        expiresIn: response.expires_in,\n      };\n\n      setSetupData(data);\n      authLogger.info('2FA setup initiated, expires in:', data.expiresIn, 'seconds');\n\n      return data;\n    } catch (err) {\n      const errorMessage = formatAuthError(err, 'Failed to start 2FA setup');\n      logAuthFailure(authLogger, '2FA setup failed:', err);\n      setError(errorMessage);\n      setSetupStep('idle');\n      onError?.(errorMessage);\n      return null;\n    } finally {\n      setIsLoading(false);\n    }\n  }, [onError]);\n\n  const confirmSetup = useCallback(async (code: string): Promise<string[] | null> => {\n    if (!setupData) {\n      const msg = 'Setup not started. Call startSetup() first.';\n      setError(msg);\n      onError?.(msg);\n      return null;\n    }\n    if (!isValidTotpCode(code)) {\n      const msg = 'Please enter a 6-digit code';\n      setError(msg);\n      onError?.(msg);\n      return null;\n    }\n\n    setIsLoading(true);\n    setError(null);\n    setSetupStep('confirming');\n\n    try {\n      authLogger.info('Confirming 2FA setup...');\n\n      const result = await CfgTotpSetup.cfgTotpSetupConfirmCreate({\n        body: { device_id: setupData.deviceId, code },\n        throwOnError: true,\n      });\n      const response = result.data;\n\n      const codes = response.backup_codes;\n      setBackupCodes(codes);\n      setBackupCodesWarning(response.backup_codes_warning);\n      setSetupStep('complete');\n\n      authLogger.info('2FA setup confirmed, backup codes generated:', codes.length);\n\n      onComplete?.(codes);\n      return codes;\n    } catch (err) {\n      const errorMessage = formatAuthError(err, 'Invalid code. Please try again.');\n      logAuthFailure(authLogger, '2FA setup confirmation failed:', err);\n      setError(errorMessage);\n      setSetupStep('scanning'); // Go back to scanning step\n      onError?.(errorMessage);\n      return null;\n    } finally {\n      setIsLoading(false);\n    }\n  }, [setupData, onComplete, onError]);\n\n  return {\n    isLoading,\n    error,\n    setupData,\n    backupCodes,\n    backupCodesWarning,\n    setupStep,\n    startSetup,\n    confirmSetup,\n    resetSetup,\n    clearError,\n  };\n};\n","'use client';\n\nimport { useCallback, useState } from 'react';\n\nimport { CfgTotp } from '../../_api/generated/sdk.gen';\nimport { authLogger } from '../utils/logger';\nimport { formatAuthError, logAuthFailure } from '../utils/errors';\nimport { isValidTotpCode } from './twoFactor.shared';\n\nexport interface TwoFactorDevice {\n  id: string;\n  name: string;\n  createdAt: string;\n  lastUsedAt: string | null;\n  isPrimary: boolean;\n}\n\nexport interface UseTwoFactorStatusReturn {\n  /** Loading state */\n  isLoading: boolean;\n  /** Error message */\n  error: string | null;\n  /** Whether 2FA is enabled for user */\n  has2FAEnabled: boolean | null;\n  /** List of TOTP devices */\n  devices: TwoFactorDevice[];\n  /** Fetch 2FA status */\n  fetchStatus: () => Promise<void>;\n  /** Disable 2FA (requires TOTP code) */\n  disable2FA: (code: string) => Promise<boolean>;\n  /** Clear error */\n  clearError: () => void;\n}\n\n/**\n * Read and manage 2FA status (internal, composed by {@link useTwoFactor}).\n *\n * Fetches the device list / enabled flag and disables 2FA.\n */\nexport const useTwoFactorStatus = (): UseTwoFactorStatusReturn => {\n  const [isLoading, setIsLoading] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const [has2FAEnabled, setHas2FAEnabled] = useState<boolean | null>(null);\n  const [devices, setDevices] = useState<TwoFactorDevice[]>([]);\n\n  const clearError = useCallback(() => {\n    setError(null);\n  }, []);\n\n  const fetchStatus = useCallback(async (): Promise<void> => {\n    setIsLoading(true);\n    setError(null);\n\n    try {\n      authLogger.info('Fetching 2FA status...');\n\n      // API returns { devices: [...], has_2fa_enabled: bool }\n      const result = await CfgTotp.cfgTotpDevicesRetrieve({ throwOnError: true });\n      const response = result.data;\n\n      const mappedDevices: TwoFactorDevice[] = response.devices.map((device) => ({\n        id: device.id,\n        name: device.name,\n        createdAt: device.created_at,\n        lastUsedAt: device.last_used_at ?? null,\n        isPrimary: device.is_primary,\n      }));\n\n      setDevices(mappedDevices);\n      setHas2FAEnabled(response.has_2fa_enabled);\n\n      authLogger.info('2FA status:', response.has_2fa_enabled ? 'enabled' : 'disabled');\n    } catch (err) {\n      const errorMessage = formatAuthError(err, 'Failed to fetch 2FA status');\n      logAuthFailure(authLogger, 'Failed to fetch 2FA status:', err);\n      setError(errorMessage);\n    } finally {\n      setIsLoading(false);\n    }\n  }, []);\n\n  const disable2FA = useCallback(async (code: string): Promise<boolean> => {\n    if (!isValidTotpCode(code)) {\n      setError('Please enter a 6-digit code');\n      return false;\n    }\n\n    setIsLoading(true);\n    setError(null);\n\n    try {\n      authLogger.info('Disabling 2FA...');\n\n      await CfgTotp.cfgTotpDisableCreate({ body: { code }, throwOnError: true });\n\n      setHas2FAEnabled(false);\n      setDevices([]);\n\n      authLogger.info('2FA disabled successfully');\n      return true;\n    } catch (err: unknown) {\n      const errorMessage = formatAuthError(err, 'Invalid verification code');\n      logAuthFailure(authLogger, 'Failed to disable 2FA:', err);\n      setError(errorMessage);\n      return false;\n    } finally {\n      setIsLoading(false);\n    }\n  }, []);\n\n  return {\n    isLoading,\n    error,\n    has2FAEnabled,\n    devices,\n    fetchStatus,\n    disable2FA,\n    clearError,\n  };\n};\n","'use client';\n\nimport {\n  useTwoFactorVerify,\n  type UseTwoFactorVerifyOptions,\n  type UseTwoFactorVerifyReturn,\n} from './useTwoFactorVerify';\nimport {\n  useTwoFactorSetup,\n  type TwoFactorSetupData,\n  type UseTwoFactorSetupOptions,\n  type UseTwoFactorSetupReturn,\n} from './useTwoFactorSetup';\nimport {\n  useTwoFactorStatus,\n  type TwoFactorDevice,\n  type UseTwoFactorStatusReturn,\n} from './useTwoFactorStatus';\n\nexport interface UseTwoFactorOptions {\n  /** Options for the login-time verification namespace */\n  verify?: UseTwoFactorVerifyOptions;\n  /** Options for the setup (enable) namespace */\n  setup?: UseTwoFactorSetupOptions;\n}\n\nexport interface UseTwoFactorReturn {\n  /** Verify a 2FA challenge during login (TOTP / backup code). */\n  verify: UseTwoFactorVerifyReturn;\n  /** Enable 2FA — QR provisioning → confirm → backup codes. */\n  setup: UseTwoFactorSetupReturn;\n  /** Read device list / enabled flag and disable 2FA. */\n  status: UseTwoFactorStatusReturn;\n}\n\n/**\n * Single entry point for all two-factor authentication flows.\n *\n * The three concerns — **verify** (login), **setup** (enable) and **status**\n * (manage/disable) — are distinct verbs over the same `CfgTotp*` API, so each\n * is exposed as its own namespace with an independent loading/error surface:\n *\n * @example\n * ```tsx\n * const two = useTwoFactor({ verify: { redirectUrl: '/dashboard' } });\n *\n * await two.verify.verifyTOTP(sessionId, code); // login\n * await two.setup.startSetup('My iPhone');       // enable\n * await two.status.fetchStatus();                // manage\n * ```\n *\n * Consumers that only need one concern can compose the underlying hooks\n * directly (`useTwoFactorVerify` / `useTwoFactorSetup` / `useTwoFactorStatus`),\n * all re-exported alongside this one, to avoid mounting the others' state.\n */\nexport const useTwoFactor = (options: UseTwoFactorOptions = {}): UseTwoFactorReturn => {\n  const verify = useTwoFactorVerify(options.verify);\n  const setup = useTwoFactorSetup(options.setup);\n  const status = useTwoFactorStatus();\n\n  return { verify, setup, status };\n};\n\n// Namespaced sub-hooks — use directly when only one concern is needed.\nexport {\n  useTwoFactorVerify,\n  useTwoFactorSetup,\n  useTwoFactorStatus,\n  type UseTwoFactorVerifyOptions,\n  type UseTwoFactorVerifyReturn,\n  type UseTwoFactorSetupOptions,\n  type UseTwoFactorSetupReturn,\n  type UseTwoFactorStatusReturn,\n  type TwoFactorSetupData,\n  type TwoFactorDevice,\n};\n","'use client';\n\nimport { useState } from 'react';\n\nimport { authLogger } from '../utils/logger';\nimport { isQuotaExceededError, isWithinSizeLimit } from '../utils/storage';\n\n/**\n * Simple localStorage hook with better error handling\n * @param key - Storage key\n * @param initialValue - Default value if key doesn't exist\n * @returns [value, setValue, removeValue] - Current value, setter function, and remove function\n */\nexport function useLocalStorage<T>(key: string, initialValue: T) {\n  // Get initial value from localStorage or use provided initialValue\n  const [storedValue, setStoredValue] = useState<T>(() => {\n    if (typeof window === 'undefined') {\n      return initialValue;\n    }\n\n    try {\n      const item = window.localStorage.getItem(key);\n      if (item === null) {\n        return initialValue;\n      }\n      \n      // Try to parse as JSON first, fallback to string\n      try {\n        return JSON.parse(item);\n      } catch {\n        // If JSON.parse fails, return as string\n        return item as T;\n      }\n    } catch (error) {\n      authLogger.error(`Error reading localStorage key \"${key}\":`, error);\n      return initialValue;\n    }\n  });\n\n  // Clear old data when localStorage is full\n  const clearOldData = () => {\n    try {\n      const keys = Object.keys(localStorage).filter(key => key && typeof key === 'string');\n      // Remove oldest items if we have more than 50 items\n      if (keys.length > 50) {\n        const itemsToRemove = Math.ceil(keys.length * 0.2);\n        for (let i = 0; i < itemsToRemove; i++) {\n          try {\n            const key = keys[i];\n            if (key) {\n              localStorage.removeItem(key);\n              localStorage.removeItem(`${key}_ts`);\n            }\n          } catch {\n            // Ignore errors when removing items\n          }\n        }\n      }\n    } catch (error) {\n      authLogger.error('Error clearing old localStorage data:', error);\n    }\n  };\n\n  // Force clear all data if quota is exceeded\n  const forceClearAll = () => {\n    try {\n      const keys = Object.keys(localStorage);\n      for (const key of keys) {\n        try {\n          localStorage.removeItem(key);\n        } catch {\n          // Ignore errors when removing items\n        }\n      }\n    } catch (error) {\n      authLogger.error('Error force clearing localStorage:', error);\n    }\n  };\n\n  // Update localStorage when value changes\n  const setValue = (value: T | ((val: T) => T)) => {\n    try {\n      const valueToStore = value instanceof Function ? value(storedValue) : value;\n      \n      // Check data size before attempting to save\n      if (!isWithinSizeLimit(valueToStore, key)) {\n        authLogger.warn(`Data size too large for key \"${key}\", removing key`);\n        // Remove the key if data is too large\n        try {\n          window.localStorage.removeItem(key);\n          window.localStorage.removeItem(`${key}_ts`);\n        } catch {\n          // Ignore errors when removing\n        }\n        // Still update the state\n        setStoredValue(valueToStore);\n        return;\n      }\n      \n      setStoredValue(valueToStore);\n\n      if (typeof window !== 'undefined') {\n        // Try to set the value\n        try {\n          // For strings, store directly without JSON.stringify\n          if (typeof valueToStore === 'string') {\n            window.localStorage.setItem(key, valueToStore);\n          } else {\n            window.localStorage.setItem(key, JSON.stringify(valueToStore));\n          }\n          // Add timestamp for cleanup\n          window.localStorage.setItem(`${key}_ts`, Date.now().toString());\n        } catch (storageError: unknown) {\n          // If quota exceeded, clear old data and try again\n          if (isQuotaExceededError(storageError)) {\n            authLogger.warn('localStorage quota exceeded, clearing old data...');\n            clearOldData();\n            \n            // Try again after clearing\n            try {\n              // For strings, store directly without JSON.stringify\n              if (typeof valueToStore === 'string') {\n                window.localStorage.setItem(key, valueToStore);\n              } else {\n                window.localStorage.setItem(key, JSON.stringify(valueToStore));\n              }\n              window.localStorage.setItem(`${key}_ts`, Date.now().toString());\n            } catch (retryError) {\n              authLogger.error(`Failed to set localStorage key \"${key}\" after clearing old data:`, retryError);\n              // If still fails, force clear all and try one more time\n              try {\n                forceClearAll();\n                // For strings, store directly without JSON.stringify\n                if (typeof valueToStore === 'string') {\n                  window.localStorage.setItem(key, valueToStore);\n                } else {\n                  window.localStorage.setItem(key, JSON.stringify(valueToStore));\n                }\n                window.localStorage.setItem(`${key}_ts`, Date.now().toString());\n              } catch (finalError) {\n                authLogger.error(`Failed to set localStorage key \"${key}\" after force clearing:`, finalError);\n                // If still fails, just update the state without localStorage\n                setStoredValue(valueToStore);\n              }\n            }\n          } else {\n            throw storageError;\n          }\n        }\n      }\n    } catch (error) {\n      authLogger.error(`Error setting localStorage key \"${key}\":`, error);\n      // Still update the state even if localStorage fails\n      const valueToStore = value instanceof Function ? value(storedValue) : value;\n      setStoredValue(valueToStore);\n    }\n  };\n\n  // Remove value from localStorage\n  const removeValue = () => {\n    try {\n      setStoredValue(initialValue);\n      if (typeof window !== 'undefined') {\n        try {\n          window.localStorage.removeItem(key);\n          window.localStorage.removeItem(`${key}_ts`);\n        } catch (removeError: unknown) {\n          // If removal fails due to quota, try to clear some data first\n          if (isQuotaExceededError(removeError)) {\n            authLogger.warn('localStorage quota exceeded during removal, clearing old data...');\n            clearOldData();\n            \n            try {\n              window.localStorage.removeItem(key);\n              window.localStorage.removeItem(`${key}_ts`);\n            } catch (retryError) {\n              authLogger.error(`Failed to remove localStorage key \"${key}\" after clearing:`, retryError);\n              // If still fails, force clear all\n              forceClearAll();\n            }\n          } else {\n            throw removeError;\n          }\n        }\n      }\n    } catch (error) {\n      authLogger.error(`Error removing localStorage key \"${key}\":`, error);\n    }\n  };\n\n  return [storedValue, setValue, removeValue] as const;\n}\n","\"use client\"\n\n/**\n * Base64 Encoding/Decoding Hook\n *\n * Provides base64 encoding/decoding with dev mode detection:\n * - In production: encodes data to base64\n * - In development: returns data as-is (no encoding)\n */\n\nimport { isDev } from '../utils/env';\n\n/**\n * Encode string to base64\n * @param data - String data to encode\n * @returns Base64 encoded string (or original in dev mode)\n */\nexport function encodeBase64(data: string): string {\n  if (isDev) {\n    return data;\n  }\n\n  try {\n    // Browser-safe base64 encoding\n    if (typeof window !== 'undefined') {\n      return btoa(encodeURIComponent(data).replace(/%([0-9A-F]{2})/g, (_, p1) => {\n        return String.fromCharCode(parseInt(p1, 16));\n      }));\n    }\n    // Node.js fallback\n    return Buffer.from(data, 'utf-8').toString('base64');\n  } catch (error) {\n    console.error('Base64 encoding error:', error);\n    return data; // Return original on error\n  }\n}\n\n/**\n * Decode base64 to string\n * @param encoded - Base64 encoded string\n * @returns Decoded string (or original in dev mode)\n */\nexport function decodeBase64(encoded: string): string {\n  if (isDev) {\n    return encoded;\n  }\n\n  try {\n    // Browser-safe base64 decoding\n    if (typeof window !== 'undefined') {\n      const binary = atob(encoded);\n      const bytes = new Uint8Array(binary.length);\n      for (let i = 0; i < binary.length; i++) {\n        bytes[i] = binary.charCodeAt(i);\n      }\n      return decodeURIComponent(\n        Array.from(bytes)\n          .map(byte => '%' + ('00' + byte.toString(16)).slice(-2))\n          .join('')\n      );\n    }\n    // Node.js fallback\n    return Buffer.from(encoded, 'base64').toString('utf-8');\n  } catch (error) {\n    console.error('Base64 decoding error:', error);\n    return encoded; // Return original on error\n  }\n}\n\n/**\n * Hook for base64 encoding/decoding\n * @returns Object with encode and decode functions\n */\nexport function useBase64() {\n  return {\n    encode: encodeBase64,\n    decode: decodeBase64,\n    isDev,\n  };\n}\n","\"use client\"\n\n/**\n * Profile Cache Hook\n *\n * Provides localStorage-based caching for user profile with:\n * - TTL (Time To Live) - default 1 hour\n * - Version control for migrations\n * - Automatic invalidation on expiry\n */\n\nimport type { User } from '../../';\nimport { authLogger as profileLogger } from '../utils/logger';\nimport { CFG_KEYS } from '../../_api/generated/helpers/keys';\nimport { decodeBase64, encodeBase64 } from './useBase64';\n\n// Cache configuration\nconst CACHE_KEY = CFG_KEYS.profileCache.key;\nconst CACHE_VERSION = 1;\nconst DEFAULT_TTL = 14400000; // 4 hours in milliseconds (reduced API calls, more resilient)\n\nexport interface ProfileCacheOptions {\n  /** Time to live in milliseconds (default: 1 hour) */\n  ttl?: number;\n}\n\ninterface CachedProfile {\n  version: number;\n  data: User;\n  timestamp: number;\n  ttl: number;\n}\n\n/**\n * Get cached profile from localStorage\n * @returns User profile if valid cache exists, null otherwise\n */\nexport function getCachedProfile(): User | null {\n  try {\n    if (typeof window === 'undefined') return null;\n\n    const cached = localStorage.getItem(CACHE_KEY);\n    if (!cached) {\n      profileLogger.debug('No cached profile found');\n      return null;\n    }\n\n    // Decode from base64\n    const decoded = decodeBase64(cached);\n    const cachedData: CachedProfile = JSON.parse(decoded);\n\n    // Version check\n    if (cachedData.version !== CACHE_VERSION) {\n      profileLogger.warn('Cache version mismatch, clearing cache');\n      clearProfileCache();\n      return null;\n    }\n\n    // TTL check\n    const now = Date.now();\n    const age = now - cachedData.timestamp;\n    if (age > cachedData.ttl) {\n      profileLogger.info('Cache expired, clearing');\n      clearProfileCache();\n      return null;\n    }\n\n    profileLogger.debug('Cache hit, age:', Math.round(age / 1000), 'seconds');\n    return cachedData.data;\n  } catch (error) {\n    profileLogger.error('Error reading cache:', error);\n    clearProfileCache();\n    return null;\n  }\n}\n\n/**\n * Save profile to localStorage cache\n * @param profile - User profile to cache\n * @param options - Cache options (TTL)\n */\nexport function setCachedProfile(profile: User, options?: ProfileCacheOptions): void {\n  try {\n    if (typeof window === 'undefined') return;\n\n    const cachedData: CachedProfile = {\n      version: CACHE_VERSION,\n      data: profile,\n      timestamp: Date.now(),\n      ttl: options?.ttl || DEFAULT_TTL,\n    };\n\n    // Encode to base64\n    const encoded = encodeBase64(JSON.stringify(cachedData));\n    localStorage.setItem(CACHE_KEY, encoded);\n    profileLogger.debug('Profile cached, TTL:', cachedData.ttl / 1000, 'seconds');\n  } catch (error) {\n    profileLogger.error('Error writing cache:', error);\n  }\n}\n\n/**\n * Clear profile cache from localStorage\n */\nexport function clearProfileCache(): void {\n  try {\n    if (typeof window === 'undefined') return;\n    localStorage.removeItem(CACHE_KEY);\n    profileLogger.debug('Cache cleared');\n  } catch (error) {\n    profileLogger.error('Error clearing cache:', error);\n  }\n}\n\n/**\n * Check if cached profile is valid (exists and not expired)\n */\nexport function hasValidCache(): boolean {\n  return getCachedProfile() !== null;\n}\n\n/**\n * Get cache metadata (age, TTL, etc.)\n */\nexport function getCacheMetadata(): {\n  exists: boolean;\n  age?: number;\n  ttl?: number;\n  expiresIn?: number;\n} | null {\n  try {\n    if (typeof window === 'undefined') return null;\n\n    const cached = localStorage.getItem(CACHE_KEY);\n    if (!cached) return { exists: false };\n\n    // Decode from base64\n    const decoded = decodeBase64(cached);\n    const cachedData: CachedProfile = JSON.parse(decoded);\n    const now = Date.now();\n    const age = now - cachedData.timestamp;\n    const expiresIn = cachedData.ttl - age;\n\n    return {\n      exists: true,\n      age,\n      ttl: cachedData.ttl,\n      expiresIn: Math.max(0, expiresIn),\n    };\n  } catch (error) {\n    profileLogger.error('Error reading metadata:', error);\n    return null;\n  }\n}\n","'use client';\n\nimport { useCallback, useState } from 'react';\n\nimport { CfgAccountsProfile } from '../../_api/generated/sdk.gen';\nimport { useAuth } from '../context';\nimport { authLogger } from '../utils/logger';\n\nexport interface DeleteAccountResult {\n  success: boolean;\n  message: string;\n}\n\nexport interface UseDeleteAccountReturn {\n  /** Loading state */\n  isLoading: boolean;\n  /** Error message */\n  error: string | null;\n  /** Delete the account */\n  deleteAccount: () => Promise<DeleteAccountResult>;\n  /** Clear error */\n  clearError: () => void;\n}\n\n/**\n * Hook for deleting user account.\n *\n * This performs a soft delete - deactivates the account and anonymizes personal data.\n * The account can be restored by an administrator if needed.\n *\n * @example\n * ```tsx\n * const { deleteAccount, isLoading, error } = useDeleteAccount();\n *\n * const handleDelete = async () => {\n *   await deleteAccount(); // Signs out after a successful deletion.\n * };\n * ```\n */\nexport const useDeleteAccount = (): UseDeleteAccountReturn => {\n  const [isLoading, setIsLoading] = useState(false);\n  const [error, setError] = useState<string | null>(null);\n  const { logout } = useAuth();\n\n  const clearError = useCallback(() => {\n    setError(null);\n  }, []);\n\n  /**\n   * Delete the user account (soft delete)\n   */\n  const deleteAccount = useCallback(async (): Promise<DeleteAccountResult> => {\n    setIsLoading(true);\n    setError(null);\n\n    try {\n      authLogger.info('Deleting account...');\n\n      const result = await CfgAccountsProfile.cfgAccountsProfileDeleteCreate({ throwOnError: true });\n      const response = result.data;\n\n      if (!response.success) {\n        authLogger.error('Failed to delete account:', response.message);\n        setError(response.message);\n        throw new Error(response.message);\n      }\n    } catch (error) {\n      authLogger.error('Failed to delete account:', error);\n      throw error;\n    } finally {\n      setIsLoading(false);\n    }\n\n    await logout();\n    return { success: true, message: 'Account deleted successfully' };\n  }, [logout]);\n\n  return {\n    isLoading,\n    error,\n    deleteAccount,\n    clearError,\n  };\n};\n","/**\n * One-time cleanup of what the pre-cookie auth left in the browser.\n *\n * Before 2.1.604 the session tokens lived in `localStorage`. They are cookies now (shared across subdomains), so the old\n * entries are never read again; left alone they are harmless but misleading, and the 4 h profile cache next to them used\n * to keep the UI looking signed in without any token (empty private pages). Cookies are untouched.\n */\n\nconst LEGACY_TOKEN_KEYS = [\n  'cfg.auth.access_token',\n  'cfg.auth.refresh_token',\n  'auth_token',\n  'refresh_token',\n  'access_token',\n] as const;\n\n/** Removes the old `localStorage` token entries. Safe on the server and with blocked storage. */\nexport function purgeLegacyTokenStorage(): string[] {\n  const removed: string[] = [];\n  try {\n    if (typeof window === 'undefined') return removed;\n    for (const key of LEGACY_TOKEN_KEYS) {\n      if (window.localStorage.getItem(key) !== null) {\n        window.localStorage.removeItem(key);\n        removed.push(key);\n      }\n    }\n  } catch {\n    /* storage blocked: nothing to purge */\n  }\n  return removed;\n}\n","/**\n * The one auth state: a single value answers \"may this page render?\".\n *\n *   resolving      the client has not read the session yet, or a live session is still loading its profile\n *   authenticated  a live session and its profile settled\n *   anonymous      no session (store and React snapshot agree)\n *\n * Every consumer (the page guard, the \"leave /auth\" effect, the trace) reads this and nothing else. The\n * inputs are plain booleans so the whole table is unit-tested.\n *\n * Termination: `resolving` is left in finite time. `timedOut` is set by one timer in the provider, and\n * when it fires the React snapshot decides. There is no input combination that stays `resolving` with\n * `timedOut` true.\n */\n\nexport type AuthStatus = 'resolving' | 'authenticated' | 'anonymous';\n\nexport interface AuthStateInput {\n  /** The first client effect has run (the hydration commit is over). */\n  clientReady: boolean;\n  /** `useSession()` says authenticated (the React snapshot; the server snapshot is always anonymous). */\n  snapshotAuthenticated: boolean;\n  /** `auth.isAuthenticated()` read straight from the store at this render. */\n  storeAuthenticated: boolean;\n  /** The profile for a live session has loaded, failed in a way that keeps the session, or was cached. */\n  profileSettled: boolean;\n  /** The provider's single safety timer fired. */\n  timedOut: boolean;\n}\n\nexport function resolveAuthStatus(s: AuthStateInput): AuthStatus {\n  if (!s.clientReady) return 'resolving';\n  if (s.snapshotAuthenticated) {\n    return s.profileSettled || s.timedOut ? 'authenticated' : 'resolving';\n  }\n  // Snapshot says signed out. If the store disagrees the snapshot is lagging: wait for it, but never forever.\n  if (s.storeAuthenticated && !s.timedOut) return 'resolving';\n  return 'anonymous';\n}\n","/**\n * CfgAccounts Context\n *\n * Manages user authentication and profile operations using generated SWR hooks.\n *\n * Features:\n * - OTP-based authentication\n * - User profile management\n * - Avatar upload\n * - Profile updates\n * - localStorage cache with TTL (1 hour)\n */\n\n\"use client\";\n\nimport {\n    ReactNode, useCallback, useContext, useEffect, useMemo, useRef, useState\n} from 'react';\n\nimport { auth } from '../../_api/generated/helpers/auth';\nimport { CfgAccountsAuth, CfgAccountsProfile } from '../../_api/generated/_cfg_accounts/sdk.gen';\nimport {\n    useCfgAccountsOtpRequestCreate,\n    useCfgAccountsOtpVerifyCreate,\n    useCfgAccountsProfileAvatarCreate,\n    useCfgAccountsProfilePartialUpdate,\n    useCfgAccountsProfileUpdateUpdate,\n    useCfgAccountsTokenCreate,\n} from '../../_api/generated/_cfg_accounts/hooks';\nimport { clearProfileCache, getCachedProfile, setCachedProfile } from '../hooks/useProfileCache';\nimport { authLogger } from '../utils/logger';\n\n/**\n * Whether this build has a usable API origin.\n *\n * `NEXT_PUBLIC_API_URL` is inlined at build time; when it is missing the\n * generated client falls back to `''`, and every request becomes relative to\n * whatever page the user is on. A static build is same-origin by design, so\n * relative paths ARE correct there.\n */\nfunction hasApiOrigin(): boolean {\n  try {\n    if (typeof process === 'undefined' || !process.env) return false;\n    if (process.env.NEXT_PUBLIC_STATIC_BUILD === 'true') return true;\n    if (process.env.NEXT_PUBLIC_API_PROXY_URL !== undefined) return true;\n    return Boolean(process.env.NEXT_PUBLIC_API_URL);\n  } catch {\n    return false;\n  }\n}\n\nimport type {\n    User,\n    CfgUserUpdateRequest,\n    PatchedCfgUserUpdateRequest,\n    OtpRequestRequest,\n    OtpVerifyRequest,\n    OtpRequestResponse,\n    OtpVerifyResponse,\n    PasswordLoginRequest,\n    PasswordLoginResponse,\n} from '../../_api/generated/_cfg_accounts/types.gen';\nimport { authTrace } from '../trace';\nimport { sharedContext } from './sharedContext';\n\nexport type { PatchedCfgUserUpdateRequest, User, CfgUserUpdateRequest as UserProfileUpdateRequest };\n\n// ─────────────────────────────────────────────────────────────────────────\n// Context Type\n// ─────────────────────────────────────────────────────────────────────────\n\nexport interface AccountsContextValue {\n  profile?: User;\n  isLoadingProfile: boolean;\n  profileError: Error | null;\n\n  updateProfile: (data: CfgUserUpdateRequest) => Promise<User>;\n  partialUpdateProfile: (data: PatchedCfgUserUpdateRequest) => Promise<User>;\n  uploadAvatar: (avatar: File | Blob) => Promise<User>;\n  refreshProfile: (options?: { callerId?: string; force?: boolean }) => Promise<User | undefined>;\n\n  requestOTP: (data: OtpRequestRequest) => Promise<OtpRequestResponse>;\n  verifyOTP: (data: OtpVerifyRequest) => Promise<OtpVerifyResponse>;\n  loginWithPassword: (data: PasswordLoginRequest) => Promise<PasswordLoginResponse>;\n  logout: () => void;\n}\n\nconst AccountsContext = sharedContext<AccountsContextValue | undefined>('accounts', undefined);\n\ninterface AccountsProviderProps {\n  children: ReactNode;\n}\n\nexport function AccountsProvider({ children }: AccountsProviderProps) {\n  const [profile, setProfile] = useState<User | undefined>(() => {\n    // A cached profile is only a head start for a live session; with no session (tokens gone after the move to cookies,\n    // or signed out elsewhere) it would render the private UI with nothing behind it.\n    if (!auth.isAuthenticated()) {\n      clearProfileCache();\n      return undefined;\n    }\n    const cached = getCachedProfile() as User | null;\n    return cached || undefined;\n  });\n  const [isLoadingProfile, setIsLoadingProfile] = useState(false);\n  const [profileError, setProfileError] = useState<Error | null>(null);\n\n  const profileRef = useRef<User | undefined>(profile);\n  const isLoadingRef = useRef(false);\n  // Monotonic id per fetch. A forced re-read can now overlap the bootstrap\n  // one, and the slower response must not overwrite the newer profile.\n  const fetchSeqRef = useRef(0);\n\n  useEffect(() => {\n    profileRef.current = profile;\n  }, [profile]);\n\n  useEffect(() => {\n    isLoadingRef.current = isLoadingProfile;\n  }, [isLoadingProfile]);\n\n  const { trigger: triggerProfileUpdate } = useCfgAccountsProfileUpdateUpdate();\n  const { trigger: triggerProfilePartialUpdate } = useCfgAccountsProfilePartialUpdate();\n  const { trigger: triggerAvatar } = useCfgAccountsProfileAvatarCreate();\n  const { trigger: triggerOtpRequest } = useCfgAccountsOtpRequestCreate();\n  const { trigger: triggerOtpVerify } = useCfgAccountsOtpVerifyCreate();\n  const { trigger: triggerPasswordLogin } = useCfgAccountsTokenCreate();\n\n  const refreshProfile = useCallback(async (options?: { callerId?: string; force?: boolean }): Promise<User | undefined> => {\n    const { callerId, force } = options || {};\n\n    // No API origin configured → skip the request instead of letting it resolve\n    // against the current page. A relative URL on an i18n-prefixed route turns\n    // `/cfg/accounts/profile` into `/<locale>/cfg/accounts/profile` on the\n    // site's own origin — a 404 that only ever shows up in production.\n    if (!hasApiOrigin()) {\n      authLogger.debug(`No API origin configured, skipping profile fetch (caller: ${callerId})`);\n      return undefined;\n    }\n\n    // `force` is how a write says \"I just changed the server, re-read it\".\n    // Honouring the in-flight guard there would hand the caller back the\n    // pre-write profile and never fetch again, so the UI keeps showing the\n    // old value indefinitely.\n    if (isLoadingRef.current && !force) {\n      authLogger.debug(`Profile loading in progress, skipping (caller: ${callerId})`);\n      return profileRef.current;\n    }\n\n    const seq = ++fetchSeqRef.current;\n    setIsLoadingProfile(true);\n    isLoadingRef.current = true;\n    setProfileError(null);\n    try {\n      authLogger.debug(`Fetching profile from API (caller: ${callerId}, force: ${force})`);\n      const res = await CfgAccountsProfile.cfgAccountsProfileRetrieve({ throwOnError: true });\n      const result = res.data;\n      // A newer fetch already landed — its profile is the current one, and\n      // this older response would roll it back.\n      if (seq !== fetchSeqRef.current) return result;\n      setProfile(result);\n      profileRef.current = result;\n      setCachedProfile(result);\n      return result;\n    } catch (error) {\n      const err = error instanceof Error ? error : new Error('Failed to fetch profile');\n      if (seq === fetchSeqRef.current) setProfileError(err);\n      throw err;\n    } finally {\n      if (seq === fetchSeqRef.current) {\n        setIsLoadingProfile(false);\n        isLoadingRef.current = false;\n      }\n    }\n  }, []);\n\n  // These five are `useCallback`ed because they are dependencies of the context\n  // `useMemo` below. Rebuilt each render, they made that memo return a new object\n  // every time — so every consumer of this root provider re-rendered on every\n  // render of it, and the memo bought nothing. SWR guarantees a stable `trigger`.\n  const updateProfile = useCallback(async (data: CfgUserUpdateRequest): Promise<User> => {\n    await triggerProfileUpdate({ body: data });\n    const user = await refreshProfile({ callerId: 'updateProfile', force: true });\n    return user as User;\n  }, [triggerProfileUpdate, refreshProfile]);\n\n  const partialUpdateProfile = useCallback(async (data: PatchedCfgUserUpdateRequest): Promise<User> => {\n    await triggerProfilePartialUpdate({ body: data });\n    const user = await refreshProfile({ callerId: 'partialUpdateProfile', force: true });\n    return user as User;\n  }, [triggerProfilePartialUpdate, refreshProfile]);\n\n  const uploadAvatar = useCallback(async (avatar: File | Blob): Promise<User> => {\n    await triggerAvatar({ body: { avatar } });\n    const user = await refreshProfile({ callerId: 'uploadAvatar', force: true });\n    return user as User;\n  }, [triggerAvatar, refreshProfile]);\n\n  const requestOTP = useCallback(async (data: OtpRequestRequest): Promise<OtpRequestResponse> => {\n    const result = await triggerOtpRequest({ body: data });\n    return result as OtpRequestResponse;\n  }, [triggerOtpRequest]);\n\n  // OTP verify and password login return the SAME envelope by design, so both\n  // settle it here — one 2FA branch, one token write, one profile refresh. A\n  // second copy of this is a second session owner.\n  const settleLoginEnvelope = useCallback(async (\n    result: OtpVerifyResponse | PasswordLoginResponse,\n    callerId: string,\n  ): Promise<void> => {\n    if (result.requires_2fa && result.session_id) {\n      authLogger.info('2FA required, session:', result.session_id);\n      return;\n    }\n\n    if (result.access && result.refresh) {\n      // The ONE write path — atomic pair, notifies every session subscriber.\n      // Storage is always localStorage: session length is the token lifetime\n      // the server chose. A sessionStorage switch would strand the tokens — the\n      // module reinitializes to localStorage on the next page load.\n      authTrace('accounts.otp.session');\n      auth.setSession({ access: result.access, refresh: result.refresh });\n      try {\n        await refreshProfile({ callerId, force: true });\n      } catch (profileError) {\n        authLogger.warn(`Profile refresh failed after ${callerId} (tokens are saved):`, profileError);\n      }\n    }\n  }, [refreshProfile]);\n\n  const verifyOTP = useCallback(async (data: OtpVerifyRequest): Promise<OtpVerifyResponse> => {\n    const result = (await triggerOtpVerify({ body: data })) as OtpVerifyResponse;\n    await settleLoginEnvelope(result, 'verifyOTP');\n    return result;\n  }, [triggerOtpVerify, settleLoginEnvelope]);\n\n  const loginWithPassword = useCallback(async (\n    data: PasswordLoginRequest,\n  ): Promise<PasswordLoginResponse> => {\n    // Errors propagate: the SWR trigger throws APIError for 401/429 and the\n    // caller maps them. Nothing is written to the session on a failure.\n    const result = (await triggerPasswordLogin({ body: data })) as PasswordLoginResponse;\n    await settleLoginEnvelope(result, 'loginWithPassword');\n    return result;\n  }, [triggerPasswordLogin, settleLoginEnvelope]);\n\n  const logout = useCallback(() => {\n    // Best-effort server-side revocation: without blacklisting, a stolen\n    // refresh token survives \"logout\" until it expires. Fire-and-forget —\n    // local logout must never block on the network.\n    const refresh = auth.getRefreshToken();\n    if (refresh) {\n      CfgAccountsAuth.cfgAccountsTokenBlacklistCreate({ body: { refresh } }).catch(() => {\n        authLogger.warn('Refresh-token blacklist failed (logged out locally anyway)');\n      });\n    }\n    authTrace('accounts.logout');\n    auth.clearSession();\n    setProfile(undefined);\n    setProfileError(null);\n    clearProfileCache();\n  }, []);\n\n  const value: AccountsContextValue = useMemo(() => ({\n    profile,\n    isLoadingProfile,\n    profileError,\n    updateProfile,\n    partialUpdateProfile,\n    uploadAvatar,\n    refreshProfile,\n    requestOTP,\n    verifyOTP,\n    loginWithPassword,\n    logout,\n  }), [\n    profile,\n    isLoadingProfile,\n    profileError,\n    updateProfile,\n    partialUpdateProfile,\n    uploadAvatar,\n    refreshProfile,\n    requestOTP,\n    verifyOTP,\n    loginWithPassword,\n    logout,\n  ]);\n\n  return (\n    <AccountsContext.Provider value={value}>\n      {children}\n    </AccountsContext.Provider>\n  );\n}\n\nexport function useAccountsContext(): AccountsContextValue {\n  const context = useContext(AccountsContext);\n  if (!context) {\n    throw new Error('useAccountsContext must be used within AccountsProvider');\n  }\n  return context;\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Regenerate API key\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsApiKey } from \"../../sdk.gen\";\nimport type { CfgAccountsApiKeyRegenerateCreateData, CfgAccountsApiKeyRegenerateCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsApiKeyRegenerateCreateData, \"url\">;\ntype Result = CfgAccountsApiKeyRegenerateCreateResponses[keyof CfgAccountsApiKeyRegenerateCreateResponses];\n\nexport function useCfgAccountsApiKeyRegenerateCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_api_key_regenerate_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_api_key_regenerate_create\"], Args>(\n    [\"cfg_accounts_api_key_regenerate_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsApiKey.cfgAccountsApiKeyRegenerateCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/APIKeyRegenerate\")\n        .then(({ APIKeyRegenerateSchema }) => {\n          const parsed = APIKeyRegenerateSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_api_key_regenerate_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/api-key/regenerate/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_api_key_regenerate_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/api-key/regenerate/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Get API key details\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWR from \"swr\";\nimport type { SWRConfiguration, SWRResponse } from \"swr\";\nimport { CfgAccountsApiKey } from \"../../sdk.gen\";\nimport type { CfgAccountsApiKeyRetrieveData, CfgAccountsApiKeyRetrieveResponses } from \"../../types.gen\";\n\n\ntype Result = CfgAccountsApiKeyRetrieveResponses[keyof CfgAccountsApiKeyRetrieveResponses];\n\n/**\n * Optional `enabled` flag — when `false`, the SWR key becomes `null` and\n * no request is made. Use for gated endpoints (auth-required, feature\n * flags, \"fetch only when X is selected\"). The flag is stripped before\n * being forwarded to `useSWR` so the underlying SWR config stays pristine.\n */\ntype HookConfig = SWRConfiguration<Result> & { enabled?: boolean };\n\n// The return type is ANNOTATED, not inferred. Left to inference, tsc reaches\n// into swr's internal `dist/types-*` module to name the result and fails with\n// TS2742 (\"cannot be named without a reference to ... not portable\") in every\n// consumer that has swr hoisted to a different node_modules depth. Naming\n// SWRResponse here keeps the public surface expressible from the package's own\n// imports.\nexport function useCfgAccountsApiKeyRetrieve(\n  args?: Omit<CfgAccountsApiKeyRetrieveData, \"url\" | \"body\">,\n  config?: HookConfig,\n): SWRResponse<Result> {\n  const { enabled = true, ...swrConfig } = config ?? {};\n  const key = enabled ? [\"cfg_accounts_api_key_retrieve\", args ?? {}] as const : null;\n  return useSWR<Result>(\n    key,\n    async () => {\n      const res = await CfgAccountsApiKey.cfgAccountsApiKeyRetrieve({ ...(args ?? {}), throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/APIKey\")\n        .then(({ APIKeySchema }) => {\n          const parsed = APIKeySchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_api_key_retrieve\",\n              method: \"GET\",\n              path: \"/cfg/accounts/api-key/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_api_key_retrieve\",\n                    method: \"GET\",\n                    path: \"/cfg/accounts/api-key/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    swrConfig,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Reveal API key\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsApiKey } from \"../../sdk.gen\";\nimport type { CfgAccountsApiKeyRevealCreateData, CfgAccountsApiKeyRevealCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsApiKeyRevealCreateData, \"url\">;\ntype Result = CfgAccountsApiKeyRevealCreateResponses[keyof CfgAccountsApiKeyRevealCreateResponses];\n\nexport function useCfgAccountsApiKeyRevealCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_api_key_reveal_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_api_key_reveal_create\"], Args>(\n    [\"cfg_accounts_api_key_reveal_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsApiKey.cfgAccountsApiKeyRevealCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/APIKeyReveal\")\n        .then(({ APIKeyRevealSchema }) => {\n          const parsed = APIKeyRevealSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_api_key_reveal_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/api-key/reveal/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_api_key_reveal_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/api-key/reveal/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Test API key\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsApiKey } from \"../../sdk.gen\";\nimport type { CfgAccountsApiKeyTestCreateData, CfgAccountsApiKeyTestCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsApiKeyTestCreateData, \"url\">;\ntype Result = CfgAccountsApiKeyTestCreateResponses[keyof CfgAccountsApiKeyTestCreateResponses];\n\nexport function useCfgAccountsApiKeyTestCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_api_key_test_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_api_key_test_create\"], Args>(\n    [\"cfg_accounts_api_key_test_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsApiKey.cfgAccountsApiKeyTestCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/APIKeyTestResult\")\n        .then(({ APIKeyTestResultSchema }) => {\n          const parsed = APIKeyTestResultSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_api_key_test_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/api-key/test/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_api_key_test_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/api-key/test/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// List OAuth connections\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWR from \"swr\";\nimport type { SWRConfiguration, SWRResponse } from \"swr\";\nimport { CfgAccountsOauth } from \"../../sdk.gen\";\nimport type { CfgAccountsOauthConnectionsListData, CfgAccountsOauthConnectionsListResponses } from \"../../types.gen\";\n\n\ntype Result = CfgAccountsOauthConnectionsListResponses[keyof CfgAccountsOauthConnectionsListResponses];\n\n/**\n * Optional `enabled` flag — when `false`, the SWR key becomes `null` and\n * no request is made. Use for gated endpoints (auth-required, feature\n * flags, \"fetch only when X is selected\"). The flag is stripped before\n * being forwarded to `useSWR` so the underlying SWR config stays pristine.\n */\ntype HookConfig = SWRConfiguration<Result> & { enabled?: boolean };\n\n// The return type is ANNOTATED, not inferred. Left to inference, tsc reaches\n// into swr's internal `dist/types-*` module to name the result and fails with\n// TS2742 (\"cannot be named without a reference to ... not portable\") in every\n// consumer that has swr hoisted to a different node_modules depth. Naming\n// SWRResponse here keeps the public surface expressible from the package's own\n// imports.\nexport function useCfgAccountsOauthConnectionsList(\n  args?: Omit<CfgAccountsOauthConnectionsListData, \"url\" | \"body\">,\n  config?: HookConfig,\n): SWRResponse<Result> {\n  const { enabled = true, ...swrConfig } = config ?? {};\n  const key = enabled ? [\"cfg_accounts_oauth_connections_list\", args ?? {}] as const : null;\n  return useSWR<Result>(\n    key,\n    async () => {\n      const res = await CfgAccountsOauth.cfgAccountsOauthConnectionsList({ ...(args ?? {}), throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/cfg_accounts_oauth_connections_response_200_AutoRef\")\n        .then(({ cfg_accounts_oauth_connections_response_200_AutoRefSchema }) => {\n          const parsed = cfg_accounts_oauth_connections_response_200_AutoRefSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_oauth_connections_list\",\n              method: \"GET\",\n              path: \"/cfg/accounts/oauth/connections/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_oauth_connections_list\",\n                    method: \"GET\",\n                    path: \"/cfg/accounts/oauth/connections/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    swrConfig,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Disconnect OAuth provider\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsOauth } from \"../../sdk.gen\";\nimport type { CfgAccountsOauthDisconnectCreateData, CfgAccountsOauthDisconnectCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsOauthDisconnectCreateData, \"url\">;\ntype Result = CfgAccountsOauthDisconnectCreateResponses[keyof CfgAccountsOauthDisconnectCreateResponses];\n\nexport function useCfgAccountsOauthDisconnectCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_oauth_disconnect_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_oauth_disconnect_create\"], Args>(\n    [\"cfg_accounts_oauth_disconnect_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsOauth.cfgAccountsOauthDisconnectCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/cfg_accounts_oauth_disconnect_response_200_AutoRef\")\n        .then(({ cfg_accounts_oauth_disconnect_response_200_AutoRefSchema }) => {\n          const parsed = cfg_accounts_oauth_disconnect_response_200_AutoRefSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_oauth_disconnect_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/oauth/disconnect/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_oauth_disconnect_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/oauth/disconnect/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Start GitHub OAuth\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsOauth } from \"../../sdk.gen\";\nimport type { CfgAccountsOauthGithubAuthorizeCreateData, CfgAccountsOauthGithubAuthorizeCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsOauthGithubAuthorizeCreateData, \"url\">;\ntype Result = CfgAccountsOauthGithubAuthorizeCreateResponses[keyof CfgAccountsOauthGithubAuthorizeCreateResponses];\n\nexport function useCfgAccountsOauthGithubAuthorizeCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_oauth_github_authorize_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_oauth_github_authorize_create\"], Args>(\n    [\"cfg_accounts_oauth_github_authorize_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsOauth.cfgAccountsOauthGithubAuthorizeCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/OAuthAuthorizeResponse\")\n        .then(({ OAuthAuthorizeResponseSchema }) => {\n          const parsed = OAuthAuthorizeResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_oauth_github_authorize_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/oauth/github/authorize/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_oauth_github_authorize_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/oauth/github/authorize/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Complete GitHub OAuth\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsOauth } from \"../../sdk.gen\";\nimport type { CfgAccountsOauthGithubCallbackCreateData, CfgAccountsOauthGithubCallbackCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsOauthGithubCallbackCreateData, \"url\">;\ntype Result = CfgAccountsOauthGithubCallbackCreateResponses[keyof CfgAccountsOauthGithubCallbackCreateResponses];\n\nexport function useCfgAccountsOauthGithubCallbackCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_oauth_github_callback_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_oauth_github_callback_create\"], Args>(\n    [\"cfg_accounts_oauth_github_callback_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsOauth.cfgAccountsOauthGithubCallbackCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/OAuthTokenResponse\")\n        .then(({ OAuthTokenResponseSchema }) => {\n          const parsed = OAuthTokenResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_oauth_github_callback_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/oauth/github/callback/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_oauth_github_callback_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/oauth/github/callback/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Start Google OAuth\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsOauth } from \"../../sdk.gen\";\nimport type { CfgAccountsOauthGoogleAuthorizeCreateData, CfgAccountsOauthGoogleAuthorizeCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsOauthGoogleAuthorizeCreateData, \"url\">;\ntype Result = CfgAccountsOauthGoogleAuthorizeCreateResponses[keyof CfgAccountsOauthGoogleAuthorizeCreateResponses];\n\nexport function useCfgAccountsOauthGoogleAuthorizeCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_oauth_google_authorize_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_oauth_google_authorize_create\"], Args>(\n    [\"cfg_accounts_oauth_google_authorize_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsOauth.cfgAccountsOauthGoogleAuthorizeCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/OAuthAuthorizeResponse\")\n        .then(({ OAuthAuthorizeResponseSchema }) => {\n          const parsed = OAuthAuthorizeResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_oauth_google_authorize_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/oauth/google/authorize/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_oauth_google_authorize_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/oauth/google/authorize/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Complete Google OAuth\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsOauth } from \"../../sdk.gen\";\nimport type { CfgAccountsOauthGoogleCallbackCreateData, CfgAccountsOauthGoogleCallbackCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsOauthGoogleCallbackCreateData, \"url\">;\ntype Result = CfgAccountsOauthGoogleCallbackCreateResponses[keyof CfgAccountsOauthGoogleCallbackCreateResponses];\n\nexport function useCfgAccountsOauthGoogleCallbackCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_oauth_google_callback_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_oauth_google_callback_create\"], Args>(\n    [\"cfg_accounts_oauth_google_callback_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsOauth.cfgAccountsOauthGoogleCallbackCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/OAuthTokenResponse\")\n        .then(({ OAuthTokenResponseSchema }) => {\n          const parsed = OAuthTokenResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_oauth_google_callback_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/oauth/google/callback/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_oauth_google_callback_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/oauth/google/callback/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// GET /cfg/accounts/otp/consent-policy/\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWR from \"swr\";\nimport type { SWRConfiguration, SWRResponse } from \"swr\";\nimport { CfgAccountsOtp } from \"../../sdk.gen\";\nimport type { CfgAccountsOtpConsentPolicyRetrieveData, CfgAccountsOtpConsentPolicyRetrieveResponses } from \"../../types.gen\";\n\n\ntype Result = CfgAccountsOtpConsentPolicyRetrieveResponses[keyof CfgAccountsOtpConsentPolicyRetrieveResponses];\n\n/**\n * Optional `enabled` flag — when `false`, the SWR key becomes `null` and\n * no request is made. Use for gated endpoints (auth-required, feature\n * flags, \"fetch only when X is selected\"). The flag is stripped before\n * being forwarded to `useSWR` so the underlying SWR config stays pristine.\n */\ntype HookConfig = SWRConfiguration<Result> & { enabled?: boolean };\n\n// The return type is ANNOTATED, not inferred. Left to inference, tsc reaches\n// into swr's internal `dist/types-*` module to name the result and fails with\n// TS2742 (\"cannot be named without a reference to ... not portable\") in every\n// consumer that has swr hoisted to a different node_modules depth. Naming\n// SWRResponse here keeps the public surface expressible from the package's own\n// imports.\nexport function useCfgAccountsOtpConsentPolicyRetrieve(\n  args?: Omit<CfgAccountsOtpConsentPolicyRetrieveData, \"url\" | \"body\">,\n  config?: HookConfig,\n): SWRResponse<Result> {\n  const { enabled = true, ...swrConfig } = config ?? {};\n  const key = enabled ? [\"cfg_accounts_otp_consent_policy_retrieve\", args ?? {}] as const : null;\n  return useSWR<Result>(\n    key,\n    async () => {\n      const res = await CfgAccountsOtp.cfgAccountsOtpConsentPolicyRetrieve({ ...(args ?? {}), throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/ConsentPolicy\")\n        .then(({ ConsentPolicySchema }) => {\n          const parsed = ConsentPolicySchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_otp_consent_policy_retrieve\",\n              method: \"GET\",\n              path: \"/cfg/accounts/otp/consent-policy/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_otp_consent_policy_retrieve\",\n                    method: \"GET\",\n                    path: \"/cfg/accounts/otp/consent-policy/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    swrConfig,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// POST /cfg/accounts/otp/request/\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsOtp } from \"../../sdk.gen\";\nimport type { CfgAccountsOtpRequestCreateData, CfgAccountsOtpRequestCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsOtpRequestCreateData, \"url\">;\ntype Result = CfgAccountsOtpRequestCreateResponses[keyof CfgAccountsOtpRequestCreateResponses];\n\nexport function useCfgAccountsOtpRequestCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_otp_request_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_otp_request_create\"], Args>(\n    [\"cfg_accounts_otp_request_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsOtp.cfgAccountsOtpRequestCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/OTPRequestResponse\")\n        .then(({ OTPRequestResponseSchema }) => {\n          const parsed = OTPRequestResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_otp_request_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/otp/request/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_otp_request_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/otp/request/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// POST /cfg/accounts/otp/verify/\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsOtp } from \"../../sdk.gen\";\nimport type { CfgAccountsOtpVerifyCreateData, CfgAccountsOtpVerifyCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsOtpVerifyCreateData, \"url\">;\ntype Result = CfgAccountsOtpVerifyCreateResponses[keyof CfgAccountsOtpVerifyCreateResponses];\n\nexport function useCfgAccountsOtpVerifyCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_otp_verify_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_otp_verify_create\"], Args>(\n    [\"cfg_accounts_otp_verify_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsOtp.cfgAccountsOtpVerifyCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/OTPVerifyResponse\")\n        .then(({ OTPVerifyResponseSchema }) => {\n          const parsed = OTPVerifyResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_otp_verify_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/otp/verify/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_otp_verify_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/otp/verify/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Upload user avatar\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsProfile } from \"../../sdk.gen\";\nimport type { CfgAccountsProfileAvatarCreateData, CfgAccountsProfileAvatarCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsProfileAvatarCreateData, \"url\">;\ntype Result = CfgAccountsProfileAvatarCreateResponses[keyof CfgAccountsProfileAvatarCreateResponses];\n\nexport function useCfgAccountsProfileAvatarCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_profile_avatar_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_profile_avatar_create\"], Args>(\n    [\"cfg_accounts_profile_avatar_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsProfile.cfgAccountsProfileAvatarCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/User\")\n        .then(({ UserSchema }) => {\n          const parsed = UserSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_profile_avatar_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/profile/avatar/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_profile_avatar_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/profile/avatar/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Delete user account\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsProfile } from \"../../sdk.gen\";\nimport type { CfgAccountsProfileDeleteCreateData, CfgAccountsProfileDeleteCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsProfileDeleteCreateData, \"url\">;\ntype Result = CfgAccountsProfileDeleteCreateResponses[keyof CfgAccountsProfileDeleteCreateResponses];\n\nexport function useCfgAccountsProfileDeleteCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_profile_delete_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_profile_delete_create\"], Args>(\n    [\"cfg_accounts_profile_delete_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsProfile.cfgAccountsProfileDeleteCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/AccountDeleteResponse\")\n        .then(({ AccountDeleteResponseSchema }) => {\n          const parsed = AccountDeleteResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_profile_delete_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/profile/delete/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_profile_delete_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/profile/delete/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Partial update user profile\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsProfile } from \"../../sdk.gen\";\nimport type { CfgAccountsProfilePartialPartialUpdateData, CfgAccountsProfilePartialPartialUpdateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsProfilePartialPartialUpdateData, \"url\">;\ntype Result = CfgAccountsProfilePartialPartialUpdateResponses[keyof CfgAccountsProfilePartialPartialUpdateResponses];\n\nexport function useCfgAccountsProfilePartialPartialUpdate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_profile_partial_partial_update\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_profile_partial_partial_update\"], Args>(\n    [\"cfg_accounts_profile_partial_partial_update\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsProfile.cfgAccountsProfilePartialPartialUpdate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/User\")\n        .then(({ UserSchema }) => {\n          const parsed = UserSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_profile_partial_partial_update\",\n              method: \"PATCH\",\n              path: \"/cfg/accounts/profile/partial/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_profile_partial_partial_update\",\n                    method: \"PATCH\",\n                    path: \"/cfg/accounts/profile/partial/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Partial update user profile\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsProfile } from \"../../sdk.gen\";\nimport type { CfgAccountsProfilePartialUpdateData, CfgAccountsProfilePartialUpdateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsProfilePartialUpdateData, \"url\">;\ntype Result = CfgAccountsProfilePartialUpdateResponses[keyof CfgAccountsProfilePartialUpdateResponses];\n\nexport function useCfgAccountsProfilePartialUpdate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_profile_partial_update\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_profile_partial_update\"], Args>(\n    [\"cfg_accounts_profile_partial_update\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsProfile.cfgAccountsProfilePartialUpdate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/User\")\n        .then(({ UserSchema }) => {\n          const parsed = UserSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_profile_partial_update\",\n              method: \"PUT\",\n              path: \"/cfg/accounts/profile/partial/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_profile_partial_update\",\n                    method: \"PUT\",\n                    path: \"/cfg/accounts/profile/partial/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Get current user profile\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWR from \"swr\";\nimport type { SWRConfiguration, SWRResponse } from \"swr\";\nimport { CfgAccountsProfile } from \"../../sdk.gen\";\nimport type { CfgAccountsProfileRetrieveData, CfgAccountsProfileRetrieveResponses } from \"../../types.gen\";\n\n\ntype Result = CfgAccountsProfileRetrieveResponses[keyof CfgAccountsProfileRetrieveResponses];\n\n/**\n * Optional `enabled` flag — when `false`, the SWR key becomes `null` and\n * no request is made. Use for gated endpoints (auth-required, feature\n * flags, \"fetch only when X is selected\"). The flag is stripped before\n * being forwarded to `useSWR` so the underlying SWR config stays pristine.\n */\ntype HookConfig = SWRConfiguration<Result> & { enabled?: boolean };\n\n// The return type is ANNOTATED, not inferred. Left to inference, tsc reaches\n// into swr's internal `dist/types-*` module to name the result and fails with\n// TS2742 (\"cannot be named without a reference to ... not portable\") in every\n// consumer that has swr hoisted to a different node_modules depth. Naming\n// SWRResponse here keeps the public surface expressible from the package's own\n// imports.\nexport function useCfgAccountsProfileRetrieve(\n  args?: Omit<CfgAccountsProfileRetrieveData, \"url\" | \"body\">,\n  config?: HookConfig,\n): SWRResponse<Result> {\n  const { enabled = true, ...swrConfig } = config ?? {};\n  const key = enabled ? [\"cfg_accounts_profile_retrieve\", args ?? {}] as const : null;\n  return useSWR<Result>(\n    key,\n    async () => {\n      const res = await CfgAccountsProfile.cfgAccountsProfileRetrieve({ ...(args ?? {}), throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/User\")\n        .then(({ UserSchema }) => {\n          const parsed = UserSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_profile_retrieve\",\n              method: \"GET\",\n              path: \"/cfg/accounts/profile/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_profile_retrieve\",\n                    method: \"GET\",\n                    path: \"/cfg/accounts/profile/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    swrConfig,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Update user profile\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsProfile } from \"../../sdk.gen\";\nimport type { CfgAccountsProfileUpdatePartialUpdateData, CfgAccountsProfileUpdatePartialUpdateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsProfileUpdatePartialUpdateData, \"url\">;\ntype Result = CfgAccountsProfileUpdatePartialUpdateResponses[keyof CfgAccountsProfileUpdatePartialUpdateResponses];\n\nexport function useCfgAccountsProfileUpdatePartialUpdate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_profile_update_partial_update\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_profile_update_partial_update\"], Args>(\n    [\"cfg_accounts_profile_update_partial_update\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsProfile.cfgAccountsProfileUpdatePartialUpdate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/User\")\n        .then(({ UserSchema }) => {\n          const parsed = UserSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_profile_update_partial_update\",\n              method: \"PATCH\",\n              path: \"/cfg/accounts/profile/update/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_profile_update_partial_update\",\n                    method: \"PATCH\",\n                    path: \"/cfg/accounts/profile/update/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// Update user profile\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsProfile } from \"../../sdk.gen\";\nimport type { CfgAccountsProfileUpdateUpdateData, CfgAccountsProfileUpdateUpdateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsProfileUpdateUpdateData, \"url\">;\ntype Result = CfgAccountsProfileUpdateUpdateResponses[keyof CfgAccountsProfileUpdateUpdateResponses];\n\nexport function useCfgAccountsProfileUpdateUpdate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_profile_update_update\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_profile_update_update\"], Args>(\n    [\"cfg_accounts_profile_update_update\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsProfile.cfgAccountsProfileUpdateUpdate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/User\")\n        .then(({ UserSchema }) => {\n          const parsed = UserSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_profile_update_update\",\n              method: \"PUT\",\n              path: \"/cfg/accounts/profile/update/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_profile_update_update\",\n                    method: \"PUT\",\n                    path: \"/cfg/accounts/profile/update/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// POST /cfg/accounts/token/blacklist/\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsAuth } from \"../../sdk.gen\";\nimport type { CfgAccountsTokenBlacklistCreateData, CfgAccountsTokenBlacklistCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsTokenBlacklistCreateData, \"url\">;\ntype Result = CfgAccountsTokenBlacklistCreateResponses[keyof CfgAccountsTokenBlacklistCreateResponses];\n\nexport function useCfgAccountsTokenBlacklistCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_token_blacklist_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_token_blacklist_create\"], Args>(\n    [\"cfg_accounts_token_blacklist_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsAuth.cfgAccountsTokenBlacklistCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// POST /cfg/accounts/token/\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsAuth } from \"../../sdk.gen\";\nimport type { CfgAccountsTokenCreateData, CfgAccountsTokenCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsTokenCreateData, \"url\">;\ntype Result = CfgAccountsTokenCreateResponses[keyof CfgAccountsTokenCreateResponses];\n\nexport function useCfgAccountsTokenCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_token_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_token_create\"], Args>(\n    [\"cfg_accounts_token_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsAuth.cfgAccountsTokenCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/PasswordLoginResponse\")\n        .then(({ PasswordLoginResponseSchema }) => {\n          const parsed = PasswordLoginResponseSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_token_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/token/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_token_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/token/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","'use client';\n\n// AUTO-GENERATED by openapi_processor / ts.hooks\n// POST /cfg/accounts/token/refresh/\n// DO NOT EDIT — re-run `make gen`.\n\nimport useSWRMutation from \"swr/mutation\";\nimport type { SWRMutationConfiguration } from \"swr/mutation\";\nimport { CfgAccountsAuth } from \"../../sdk.gen\";\nimport type { CfgAccountsTokenRefreshCreateData, CfgAccountsTokenRefreshCreateResponses } from \"../../types.gen\";\n\n\ntype Args = Omit<CfgAccountsTokenRefreshCreateData, \"url\">;\ntype Result = CfgAccountsTokenRefreshCreateResponses[keyof CfgAccountsTokenRefreshCreateResponses];\n\nexport function useCfgAccountsTokenRefreshCreate(\n  config?: SWRMutationConfiguration<Result, Error, readonly [\"cfg_accounts_token_refresh_create\"], Args>,\n) {\n  return useSWRMutation<Result, Error, readonly [\"cfg_accounts_token_refresh_create\"], Args>(\n    [\"cfg_accounts_token_refresh_create\"] as const,\n    async (_key, { arg }: { arg: Args }) => {\n      const res = await CfgAccountsAuth.cfgAccountsTokenRefreshCreate({ ...arg, throwOnError: true } as never);\n      const data = res.data as Result;\n      void import(\"../schemas/TokenRefresh\")\n        .then(({ TokenRefreshSchema }) => {\n          const parsed = TokenRefreshSchema.safeParse(data);\n          if (parsed.success) return;\n          // Log first so the failure is always visible, even if the\n          // event handler swallows it.\n          console.warn(\n            \"[zod] response did not match schema\",\n            {\n              operation: \"cfg_accounts_token_refresh_create\",\n              method: \"POST\",\n              path: \"/cfg/accounts/token/refresh/\",\n              issues: parsed.error.issues,\n              data,\n            },\n          );\n          if (typeof window !== \"undefined\") {\n            try {\n              window.dispatchEvent(\n                new CustomEvent(\"zod-validation-error\", {\n                  detail: {\n                    operation: \"cfg_accounts_token_refresh_create\",\n                    method: \"POST\",\n                    path: \"/cfg/accounts/token/refresh/\",\n                    issues: parsed.error.issues,\n                    data,\n                    timestamp: new Date(),\n                  },\n                  bubbles: true,\n                  cancelable: false,\n                }),\n              );\n            } catch {\n              // Event dispatch is best-effort.\n            }\n          }\n        })\n        .catch(() => {\n          // A schema chunk that fails to load is not the caller's problem.\n        });\n      return data;\n    },\n    config,\n  );\n}\n","import { createContext, type Context } from 'react';\n\n/**\n * A React context that stays ONE object even when the bundle holds several copies of this package.\n *\n * pnpm builds a separate physical copy of a package per distinct peer set, and a dual ESM/CJS load can do the same.\n * Each copy would call `createContext` itself: the provider mounted from copy A and a `useAuth()` called from copy B\n * would then never meet, B would read the empty default and the page guard would redirect a signed-in user forever\n * (hub.reforms.ai, 5 Nov 2026). Registering the context on `globalThis` makes every copy share it. React itself must\n * still be a single copy, which every Next.js app already requires.\n */\nexport function sharedContext<T>(key: string, initial: T): Context<T> {\n  const g = globalThis as Record<string, unknown>;\n  const registry = (g.__cfgAuthContexts ??= {}) as Record<string, Context<unknown>>;\n  return (registry[key] ??= createContext<unknown>(initial)) as Context<T>;\n}\n","/**\n * Email validation utility\n */\nexport const validateEmail = (email: string): boolean => {\n  const emailRegex = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n  return emailRegex.test(email);\n};\n","/**\n * Pure auth-guard state resolution.\n *\n * This is the decision that produced the \"stuck on Authenticating…\" bug: given\n * the auth state, should the UI show a preloader, redirect to login, or render\n * the protected content? Extracted from useAuthGuard (which lives in a package\n * with no test infra) so the branching can be unit-tested in isolation — the\n * hook just wires React state (mounted / isRedirecting) into these functions.\n *\n * Invariant that fixes the bug: once auth is resolved (`authLoading === false`)\n * and the user is unauthenticated, `isLoading` must become false so the guard\n * redirects to the form instead of spinning forever. The same invariant covers\n * the forbidden case: a signed-in user without the required privilege must stop\n * loading too, or the preloader spins on a state no redirect will ever clear.\n */\n\nexport interface GuardInput {\n  /** First client render matches SSR (preloader) until mounted, to avoid hydration mismatch. */\n  mounted: boolean;\n  /** Whether this route requires authentication. */\n  requireAuth: boolean;\n  /** AuthContext still resolving initial state. */\n  authLoading: boolean;\n  /** A redirect to the auth page is in flight. */\n  isRedirecting: boolean;\n  /** User currently has a (valid-looking) session. */\n  isAuthenticated: boolean;\n  /** Route requires staff/admin privileges, not just a session. */\n  requireStaff?: boolean;\n  /** `is_staff || is_superuser`, from `useAuth().isAdminUser`. */\n  isAdminUser?: boolean;\n}\n\n/**\n * True when the session is valid but lacks the required privilege.\n *\n * Distinct from unauthenticated: the fix is a different account, not signing\n * in, so this must never redirect to the auth form. Redirecting would also\n * loop — the guard saves the current URL first, so a successful re-login on\n * the same account returns straight to the wall.\n */\nexport function isForbidden(s: GuardInput): boolean {\n  return Boolean(\n    s.mounted &&\n    s.requireAuth &&\n    s.requireStaff &&\n    !s.authLoading &&\n    s.isAuthenticated &&\n    !s.isAdminUser\n  );\n}\n\n/**\n * True while the guard should render a preloader rather than the protected\n * content. Mirrors useAuthGuard's formula exactly.\n */\nexport function resolveGuardIsLoading(s: GuardInput): boolean {\n  if (!s.mounted) return true; // pre-hydration: always preloader\n  if (!s.requireAuth) return false; // public route: never blocks\n  if (isForbidden(s)) return false; // resolved: render the wall, don't spin\n  return s.authLoading || s.isRedirecting || !s.isAuthenticated;\n}\n\n/**\n * Whether the guard should trigger a redirect to the auth page. Only once\n * mounted, on a protected route, after auth resolved, when unauthenticated and\n * not already redirecting. This is the branch that must fire for a dead session.\n */\nexport function shouldRedirectToAuth(s: GuardInput): boolean {\n  return (\n    s.mounted &&\n    s.requireAuth &&\n    !s.authLoading &&\n    !s.isAuthenticated &&\n    !s.isRedirecting\n  );\n}\n\n/** The effective authenticated flag the guard exposes to consumers. */\nexport function resolveGuardIsAuthenticated(s: Pick<GuardInput, 'requireAuth' | 'isAuthenticated'>): boolean {\n  return !s.requireAuth || s.isAuthenticated;\n}\n\n","/**\n * @djangocfg/api/auth\n *\n * Authentication module with contexts, hooks and utilities.\n * Use this entry point in client components.\n *\n * @example\n * ```tsx\n * 'use client';\n * import { AuthProvider, useAuth } from '@djangocfg/api/auth';\n *\n * export function MyApp({ children }) {\n *   return (\n *     <AuthProvider>\n *       {children}\n *     </AuthProvider>\n *   );\n * }\n *\n * export function Profile() {\n *   const { user, logout } = useAuth();\n *   return <div>{user?.email}</div>;\n * }\n * ```\n */\n\n// Constants\nexport * from './constants';\n\n// Persisted auth trace: `authTrace(ev, fields)` and the readers behind `window.__cfgAuth`.\nexport * from './trace';\nimport { registerAuthCopy } from './trace';\nregisterAuthCopy();\n\n// Contexts\nexport * from './context';\n\n// Hooks\nexport * from './hooks';\n\n// Types (single source of truth)\nexport * from './types';\n\n// Utils (validation, errors, analytics)\nexport * from './utils';\n"],"mappings":";;;;;;AAKO,IAAM,iBAAiB;AAAA;AAAA,EAE5B,kBAAkB;AAAA;AAAA,EAElB,aAAa;AAAA;AAAA,EAEb,wBAAwB;AAAA;AAAA,EAExB,yBAAyB;AAC3B;;;ACoBA,IAAM,MAAM;AACZ,IAAM,MAAM;AACZ,IAAM,aAAa;AACnB,IAAM,YAAY;AAGlB,IAAM,OAAe,MAAM;AACzB,QAAM,IAAI;AACV,SAAQ,EAAE,iBAAiB,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC;AAClE,GAAG;AACH,IAAM,YAAY,OAAO,WAAW;AAEpC,IAAI,SAAuB,CAAC;AAC5B,IAAI,SAAS;AAEb,SAAS,UAA0B;AACjC,MAAI,CAAC,UAAW,QAAO;AACvB,aAAW,QAAQ,CAAC,gBAAgB,gBAAgB,GAAY;AAC9D,QAAI;AACF,YAAM,IAAI,OAAO,IAAI;AACrB,QAAE,QAAQ,eAAe,GAAG;AAC5B,QAAE,WAAW,aAAa;AAC1B,aAAO;AAAA,IACT,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAbS;AAeT,SAAS,OAAqB;AAC5B,MAAI,OAAQ,QAAO;AACnB,WAAS;AACT,MAAI;AACF,UAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG;AAClC,UAAM,SAAkB,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;AACjD,QAAI,MAAM,QAAQ,MAAM,EAAG,UAAS,OAAO,OAAO,CAAC,MAAuB,OAAO,MAAM,YAAY,MAAM,IAAI;AAAA,EAC/G,QAAQ;AACN,aAAS,CAAC;AAAA,EACZ;AACA,SAAO;AACT;AAXS;AAaT,SAAS,UAAgB;AACvB,MAAI;AACF,YAAQ,GAAG,QAAQ,KAAK,KAAK,UAAU,MAAM,CAAC;AAAA,EAChD,QAAQ;AAAA,EAER;AACF;AANS;AAQT,SAAS,MAAM,QAA+C;AAC5D,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,MAAmB,CAAC;AAC1B,aAAW,CAACA,IAAG,CAAC,KAAK,OAAO,QAAQ,MAAM,GAAG;AAC3C,QAAI,UAAU,KAAKA,EAAC,EAAG;AACvB,QAAI,OAAO,MAAM,SAAU,KAAIA,EAAC,IAAI,EAAE,SAAS,aAAa,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC,WAAM;AAAA,aAClF,OAAO,MAAM,YAAY,OAAO,MAAM,aAAa,MAAM,KAAM,KAAIA,EAAC,IAAI;AAAA,EACnF;AACA,SAAO,OAAO,KAAK,GAAG,EAAE,SAAS,MAAM;AACzC;AATS;AAYT,SAAS,UAAgB;AACvB,MAAI;AACF,UAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG;AAClC,UAAM,SAAkB,MAAM,KAAK,MAAM,GAAG,IAAI;AAChD,QAAI,MAAM,QAAQ,MAAM,EAAG,UAAS,OAAO,OAAO,CAAC,MAAuB,OAAO,MAAM,YAAY,MAAM,IAAI;AAAA,EAC/G,QAAQ;AAAA,EAER;AACF;AARS;AAUT,SAAS,OAAO,IAAY,IAAY,QAA4B;AAClE,OAAK;AACL,UAAQ;AACR,QAAM,UAAU;AAChB,QAAM,IAAI,aAAa,OAAO,gBAAgB,cAAc,KAAK,MAAM,YAAY,IAAI,CAAC,IAAI;AAC5F,QAAMC,KAAI,MAAM,MAAM;AACtB,QAAM,OAAO,QAAQ,QAAQ,SAAS,CAAC;AACvC,MAAI,QAAQ,KAAK,QAAQ,OAAO,KAAK,OAAO,MAAM,KAAK,UAAU,KAAK,CAAC,MAAM,KAAK,UAAUA,EAAC,GAAG;AAC9F,SAAK,KAAK,KAAK,KAAK,KAAK;AACzB,SAAK,IAAI;AACT,SAAK,IAAI;AACT,YAAQ;AACR;AAAA,EACF;AACA,UAAQ,KAAK,EAAE,GAAG,IAAI,GAAG,KAAK,KAAK,IAAI,GAAAA,GAAE,CAAC;AAC1C,MAAI,QAAQ,SAAS,IAAK,SAAQ,OAAO,GAAG,QAAQ,SAAS,GAAG;AAChE,UAAQ;AACV;AAjBS;AAoBF,SAAS,UAAU,IAAY,QAA4B;AAChE,MAAI,CAAC,UAAW;AAChB,MAAI;AACF,WAAO,KAAK,IAAI,GAAG,IAAI,MAAM;AAAA,EAC/B,QAAQ;AAAA,EAER;AACF;AAPgB;AAWT,SAAS,yBAA+B;AAC7C,WAAS,CAAC;AACV,WAAS;AACX;AAHgB;AAKT,SAAS,gBAA8B;AAC5C,SAAO,KAAK,EAAE,MAAM;AACtB;AAFgB;AAKT,SAAS,iBAAuB;AACrC,WAAS,CAAC;AACV,WAAS;AACT,MAAI;AACF,YAAQ,GAAG,WAAW,GAAG;AAAA,EAC3B,QAAQ;AAAA,EAER;AACF;AARgB;AAUhB,SAAS,UAAoB;AAC3B,MAAI,CAAC,UAAW,QAAO,CAAC;AACxB,QAAM,SAAU,WAAuC,mBAAmB;AAC1E,QAAM,QAAQ,CAAC,QAAQ,OAAO,SAAS,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,IAAI,WAAW,OAAO,MAAM,CAAC,IAAI,WAAW,UAAU,MAAM,IAAI,OAAO,UAAU,SAAS,EAAE;AACrJ,MAAI;AACF,UAAMC,QAAQ,WAAuC;AACrD,UAAM,MAAMA,QAAO;AACnB,QAAI,IAAK,OAAM,KAAK,QAAQ,OAAO,QAAQ,GAAG,EAAE,IAAI,CAAC,CAACF,IAAG,CAAC,MAAM,GAAGA,EAAC,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,EAClG,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAZS;AAeF,SAAS,gBAAwB;AACtC,QAAM,UAAU,KAAK;AACrB,QAAM,QAAQ,QAAQ,CAAC,GAAG,KAAK,KAAK,IAAI;AACxC,QAAM,OAAO,QAAQ,IAAI,CAAC,MAAM;AAC9B,UAAM,SAAS,EAAE,IAAI,IAAI,OAAO,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,CAACA,IAAG,CAAC,MAAM,GAAGA,EAAC,IAAI,OAAO,CAAC,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,KAAK;AAChG,UAAM,KAAK,IAAI,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,MAAM,IAAI,EAAE;AACnD,WAAO,GAAG,EAAE,KAAK,OAAO,EAAE,IAAI,KAAK,EAAE,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,GAAG,EAAE,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,CAAC,KAAK,EAAE;AAAA,EAC3H,CAAC;AACD,SAAO,CAAC,qBAAqB,QAAQ,MAAM,WAAW,GAAG,QAAQ,GAAG,IAAI,GAAG,IAAI,EAAE,KAAK,IAAI;AAC5F;AATgB;AAeT,SAAS,mBAAyB;AACvC,MAAI,CAAC,UAAW;AAChB,QAAM,IAAI;AACV,IAAE,iBAAiB;AACnB,IAAE,YAAY;AAAA,IACZ,OAAO;AAAA,IACP,MAAM,6BAAM;AACV,YAAM,OAAO,cAAc;AAE3B,cAAQ,IAAI,IAAI;AAChB,aAAO;AAAA,IACT,GALM;AAAA,IAMN,OAAO;AAAA;AAAA,IAEP,MAAM,6BAAM;AACV,YAAM,OAAO,cAAc;AAC3B,WAAK,UAAU,WAAW,UAAU,IAAI;AACxC,aAAO,GAAG,KAAK,MAAM,IAAI,EAAE,MAAM;AAAA,IACnC,GAJM;AAAA;AAAA,IAMN,UAAU,6BAAM;AACd,YAAM,OAAO,IAAI,KAAK,CAAC,KAAK,UAAU,cAAc,GAAG,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,mBAAmB,CAAC;AAC9F,YAAM,IAAI,SAAS,cAAc,GAAG;AACpC,QAAE,OAAO,IAAI,gBAAgB,IAAI;AACjC,QAAE,WAAW,cAAc,KAAK,IAAI,CAAC;AACrC,QAAE,MAAM;AAAA,IACV,GANU;AAAA,EAOZ;AACA,QAAM,SAAS,EAAE;AACjB,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,MAAE,kBAAkB,CAAC;AACrB,eAAW,QAAQ,QAAQ;AACzB,UAAI,MAAM,QAAQ,IAAI,KAAK,OAAO,KAAK,CAAC,MAAM,UAAU;AACtD,YAAI;AACF,iBAAO,OAAO,KAAK,CAAC,CAAC,KAAK,KAAK,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAC,CAA4B;AAAA,QACnF,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAzCgB;AAiDT,SAAS,mBAAyB;AACvC,MAAI,CAAC,UAAW;AAChB,QAAM,IAAI;AACV,QAAM,KAAM,EAAE,mBAA0C,KAAK;AAC7D,IAAE,kBAAkB;AACpB,MAAI,IAAI,GAAG;AACT,cAAU,YAAY,EAAE,QAAQ,EAAE,CAAC;AACnC,QAAI,MAAM,GAAG;AAEX,cAAQ,KAAK,uJAAuJ;AAAA,IACtK;AAAA,EACF;AACF;AAZgB;AAkBhB,iBAAiB;;;AC7OjB,SAAS,eAAAG,oBAAmB;AAC5B;AAAA,EACE;AAAA,EACA,eAAAC;AAAA,EACA,cAAAC;AAAA,EACA,aAAAC;AAAA,EACA,WAAAC;AAAA,EACA,UAAAC;AAAA,EACA,YAAAC;AAAA,OACK;;;ACpBA,IAAM,WAAN,cAAuB,MAAM;AAAA,EAClC,YACS,YACA,YACA,UACA,KACP,SACA;AACA,UAAM,WAAW,QAAQ,UAAU,KAAK,UAAU,EAAE;AAN7C;AACA;AACA;AACA;AAIP,SAAK,OAAO;AAAA,EACd;AAAA,EARS;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAZX,OAOoC;AAAA;AAAA;AAAA,EAYlC,IAAI,UAAsC;AACxC,QAAI,OAAO,KAAK,aAAa,YAAY,KAAK,aAAa,MAAM;AAC/D,aAAO,KAAK;AAAA,IACd;AACA,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,cAA+C;AACjD,UAAM,UAAU,KAAK;AACrB,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,cAAwC,CAAC;AAC/C,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,UAAI,MAAM,QAAQ,KAAK,EAAG,aAAY,GAAG,IAAI;AAAA,IAC/C;AACA,WAAO,OAAO,KAAK,WAAW,EAAE,SAAS,IAAI,cAAc;AAAA,EAC7D;AAAA,EAEA,IAAI,eAAuB;AACzB,UAAM,UAAU,KAAK;AACrB,QAAI,CAAC,QAAS,QAAO,KAAK;AAC1B,QAAI,QAAQ,QAAQ;AAClB,aAAO,MAAM,QAAQ,QAAQ,MAAM,IAAI,QAAQ,OAAO,KAAK,IAAI,IAAI,OAAO,QAAQ,MAAM;AAAA,IAC1F;AACA,QAAI,QAAQ,MAAO,QAAO,OAAO,QAAQ,KAAK;AAC9C,QAAI,QAAQ,QAAS,QAAO,OAAO,QAAQ,OAAO;AAClD,UAAM,cAAc,KAAK;AACzB,QAAI,aAAa;AACf,YAAM,aAAa,OAAO,KAAK,WAAW,EAAE,CAAC;AAC7C,UAAI,WAAY,QAAO,GAAG,UAAU,KAAK,YAAY,UAAU,GAAG,KAAK,IAAI,CAAC;AAAA,IAC9E;AACA,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,IAAI,oBAA6B;AAAE,WAAO,KAAK,eAAe;AAAA,EAAK;AAAA,EACnE,IAAI,cAAuB;AAAE,WAAO,KAAK,eAAe;AAAA,EAAK;AAAA,EAC7D,IAAI,oBAA6B;AAAE,WAAO,KAAK,eAAe;AAAA,EAAK;AAAA,EACnE,IAAI,kBAA2B;AAAE,WAAO,KAAK,eAAe;AAAA,EAAK;AAAA,EACjE,IAAI,gBAAyB;AAAE,WAAO,KAAK,cAAc,OAAO,KAAK,aAAa;AAAA,EAAK;AACzF;;;AC7BA,IAAM,IAAI,wBACR,KACA,OACA,cACa,EAAE,KAAK,OAAO,SAAS,IAJ5B;AAMV,IAAM,IAAI,wBACR,QACA,OACA,cACgB,EAAE,QAAQ,OAAO,SAAS,IAJlC;AAOH,IAAM,WAAW;AAAA,EACtB,aAAa,EAAE,yBAAyB,UAAU,IAAI;AAAA,EACtD,cAAc,EAAE,0BAA0B,UAAU,IAAI;AAAA,EACxD,QAAQ,EAAE,oBAAoB,SAAS,IAAI;AAAA,EAC3C,OAAO,EAAE,kBAAkB,SAAS,KAAK;AAAA,EACzC,SAAS,EAAE,qBAAqB,SAAS,KAAK;AAAA,EAC9C,aAAa,EAAE,yBAAyB,WAAW,IAAI;AAAA,EACvD,eAAe,EAAE,4BAA4B,WAAW,IAAI;AAAA,EAC5D,YAAY,EAAE,wBAAwB,WAAW,IAAI;AAAA,EACrD,eAAe,EAAE,2BAA2B,WAAW,IAAI;AAAA,EAC3D,gBAAgB,EAAE,4BAA4B,WAAW,KAAK;AAAA,EAC9D,cAAc,EAAE,qBAAqB,SAAS,IAAI;AAAA,EAClD,kBAAkB,EAAE,0BAA0B,SAAS,KAAK;AAAA,EAC5D,sBAAsB,EAAE,0BAA0B,UAAU,KAAK;AAAA,EACjE,cAAc,EAAE,qBAAqB,SAAS,KAAK;AAAA,EACnD,SAAS,EAAE,iBAAiB,WAAW,KAAK;AAAA,EAC5C,gBAAgB,EAAE,wBAAwB,WAAW,KAAK;AAAA,EAC1D,SAAS,EAAE,gBAAgB,SAAS,KAAK;AAAA,EACzC,oBAAoB,EAAE,4BAA4B,SAAS,KAAK;AAAA,EAChE,iBAAiB,EAAE,yBAAyB,SAAS,KAAK;AAAA,EAC1D,kBAAkB,EAAE,0BAA0B,SAAS,KAAK;AAAA,EAC5D,kBAAkB,EAAE,0BAA0B,SAAS,KAAK;AAAA,EAC5D,yBAAyB,EAAE,mCAAmC,WAAW,IAAI;AAAA,EAC7E,uBAAuB,EAAE,+BAA+B,WAAW,IAAI;AAAA,EACvE,kBAAkB,EAAE,0BAA0B,WAAW,KAAK;AAChE;AAGO,IAAM,eAAe;AAAA,EAC1B,WAAW,EAAE,mBAAmB,WAAW,IAAI;AAAA,EAC/C,UAAU,EAAE,kBAAkB,SAAS,KAAK;AAAA,EAC5C,oBAAoB,EAAE,6BAA6B,SAAS,KAAK;AACnE;AAEA,IAAM,WAAW;AAGV,SAAS,iBAAiB,KAAqB;AACpD,SAAO,IACJ,KAAK,EACL,YAAY,EACZ,QAAQ,gBAAgB,GAAG,EAC3B,QAAQ,YAAY,EAAE;AAC3B;AANgB;AAsDhB,IAAMC,aAAY,6BAAM,OAAO,WAAW,aAAxB;AAElB,IAAM,eAAe,oBAAI,IAA2B;AAQpD,SAAS,qBAAoC;AAC3C,MAAI,CAACA,WAAU,KAAK,OAAO,aAAa,YAAa,QAAO;AAC5D,QAAM,OAAO,OAAO,SAAS,SAAS,YAAY;AAClD,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAS,GAAG,KAAK,KAAK,SAAS,GAAG,KAAK,YAAY,KAAK,IAAI,EAAG,QAAO;AACzF,QAAM,SAAS,aAAa,IAAI,IAAI;AACpC,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAM,SAAS,OAAO,SAAS,aAAa,WAAW,aAAa;AACpE,MAAI,QAAuB;AAC3B,MAAI;AACF,aAAS,IAAI,OAAO,SAAS,GAAG,KAAK,KAAK,UAAU,MAAM,KAAK,GAAG;AAChE,YAAM,YAAY,OAAO,MAAM,CAAC,EAAE,KAAK,GAAG;AAC1C,YAAM,QAAQ,eAAe,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC;AAC/D,eAAS,SAAS,QAAQ,gBAAgB,YAAY,uCAAuC;AAC7F,UAAI,SAAS,OAAO,SAAS,QAAQ,IAAI,EAAG,SAAQ;AACpD,eAAS,SAAS,QAAQ,eAAe,YAAY,sCAAsC;AAAA,IAC7F;AAAA,EACF,QAAQ;AACN,YAAQ;AAAA,EACV;AACA,eAAa,IAAI,MAAM,KAAK;AAC5B,SAAO;AACT;AAtBS;AAwBT,SAAS,cAAc,OAA4C;AACjE,MAAI,CAACA,WAAU,EAAG,QAAO;AACzB,MAAI;AACF,WAAO,UAAU,YAAY,OAAO,iBAAiB,OAAO;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAPS;AAST,SAAS,cAAwB;AAC/B,MAAI,CAACA,WAAU,EAAG,QAAO,CAAC;AAC1B,MAAI;AACF,WAAO,SAAS,OACb,MAAM,IAAI,EACV,IAAI,CAAC,SAAS,mBAAmB,KAAK,MAAM,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,EAC1D,OAAO,OAAO;AAAA,EACnB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAVS;AAYF,SAAS,cAAc,OAAe,UAA0B,CAAC,GAAmB;AACzF,MAAI,CAAC,SAAS,KAAK,KAAK,GAAG;AACzB,UAAM,IAAI,UAAU,yBAAyB,KAAK,gBAAgB,QAAQ,EAAE;AAAA,EAC9E;AACA,QAAM,SAAS,GAAG,KAAK;AACvB,QAAM,UAAU,UAAU,QAAQ,yBAAyB,IAAI,OAAO,SAAS,KAAK,oBAAoB;AACxG,QAAM,eAAe,QAAQ,uBAAuB,KAAK,KAAK,KAAK;AACnE,MAAI,eAAwC,QAAQ,gBAAgB;AACpE,QAAM,sBAAsB,6BAC1B,iBAAiB,QAAQ,OAAO,iBAAiB,SAAS,mBAAmB,IAAI,cADvD;AAG5B,QAAM,eAAe,wBAAC,KAAa,WAA0B;AAC3D,UAAM,SAAS,OAAO,SAAS,aAAa,WAAW,aAAa;AACpE,aAAS,SACP,mBAAmB,GAAG,IAAI,wCAAwC,SAAS,cAAc,SAAS,MAAM;AAAA,EAC5G,GAJqB;AAKrB,QAAM,QAAQ,OAAO,OAAO,QAAQ,QAAQ,CAAC,CAAC;AAC9C,QAAM,WAAW,OAAO,OAAO,QAAQ,YAAY,CAAC,CAAC;AACrD,QAAM,YAAY,oBAAI,IAAuB;AAC7C,aAAW,QAAQ,MAAO,WAAU,IAAI,KAAK,KAAK,CAAC,GAAI,UAAU,IAAI,KAAK,GAAG,KAAK,CAAC,GAAI,IAAI,CAAC;AAE5F,QAAMC,UAAgD;AAAA,IACpD,OAAO,oBAAI,IAAI;AAAA,IACf,SAAS,oBAAI,IAAI;AAAA,IACjB,QAAQ,oBAAI,IAAI;AAAA,EAClB;AAEA,QAAM,UAAU,wBAAC,QAAgB,QAAQ,KAAK,GAAG,GAAjC;AAChB,QAAM,cAAc,wBAAC,QAAgB;AACnC,QAAI,CAAC,QAAQ,GAAG,EAAG,OAAM,IAAI,UAAU,gBAAgB,GAAG,gBAAgB,OAAO,EAAE;AAAA,EACrF,GAFoB;AAGpB,QAAM,cAAc,wBAAC,QAAgB;AACnC,gBAAY,GAAG;AACf,QAAI,CAAC,IAAI,WAAW,MAAM,EAAG,OAAM,IAAI,UAAU,gBAAgB,GAAG,sBAAsB,KAAK,GAAG;AAAA,EACpG,GAHoB;AAKpB,WAAS,OAAO,OAAiB,KAA4B;AAC3D,QAAI,CAACD,WAAU,EAAG,QAAO;AACzB,QAAI,UAAU,UAAU;AACtB,UAAI;AACF,cAAM,UAAU,mBAAmB,GAAG,EAAE,QAAQ,uBAAuB,MAAM;AAC7E,cAAM,QAAQ,SAAS,OAAO,MAAM,IAAI,OAAO,cAAc,OAAO,UAAU,CAAC;AAC/E,YAAI,QAAQ,CAAC,MAAM,OAAW,QAAO,mBAAmB,MAAM,CAAC,CAAC;AAAA,MAClE,QAAQ;AAAA,MAER;AACA,aAAOC,QAAO,OAAO,IAAI,GAAG,KAAK;AAAA,IACnC;AACA,QAAI;AACF,YAAM,QAAQ,cAAc,KAAK,GAAG,QAAQ,GAAG,KAAK;AACpD,UAAI,UAAU,KAAM,QAAO;AAAA,IAC7B,QAAQ;AAAA,IAER;AACA,WAAOA,QAAO,KAAK,EAAE,IAAI,GAAG,KAAK;AAAA,EACnC;AAnBS;AAqBT,WAAS,OAAO,OAAiB,KAAa,OAAe,eAAiC;AAC5F,QAAI,CAACD,WAAU,EAAG,QAAO;AACzB,QAAI;AACF,UAAI,UAAU,UAAU;AACtB,cAAM,SAAS,OAAO,SAAS,aAAa,WAAW,aAAa;AACpE,cAAM,SAAS,oBAAoB;AACnC,cAAM,aAAa,SAAS,YAAY,MAAM,KAAK;AACnD,iBAAS,SAAS,GAAG,mBAAmB,GAAG,CAAC,IAAI,mBAAmB,KAAK,CAAC,qBAAqB,KAAK,IAAI,GAAG,KAAK,MAAM,iBAAiB,YAAY,CAAC,CAAC,iBAAiB,UAAU,GAAG,MAAM;AAExL,YAAI,OAAQ,cAAa,KAAK,IAAI;AAClC,YAAI,OAAO,UAAU,GAAG,MAAM,SAAS,CAACC,QAAO,OAAO,IAAI,GAAG,EAAG,QAAO;AACvE,QAAAA,QAAO,OAAO,IAAI,KAAK,KAAK;AAC5B,eAAO;AAAA,MACT;AACA,YAAM,SAAS,cAAc,KAAK;AAClC,UAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,qBAAqB;AAClD,aAAO,QAAQ,KAAK,KAAK;AACzB,MAAAA,QAAO,KAAK,EAAE,OAAO,GAAG;AACxB,aAAO;AAAA,IACT,QAAQ;AACN,MAAAA,QAAO,KAAK,EAAE,IAAI,KAAK,KAAK;AAC5B,aAAO;AAAA,IACT;AAAA,EACF;AAvBS;AAyBT,WAAS,UAAU,OAAiB,KAAmB;AACrD,IAAAA,QAAO,KAAK,EAAE,OAAO,GAAG;AACxB,QAAI,CAACD,WAAU,EAAG;AAClB,QAAI;AACF,UAAI,UAAU,UAAU;AACtB,qBAAa,KAAK,IAAI;AACtB,cAAM,SAAS,oBAAoB;AACnC,YAAI,OAAQ,cAAa,KAAK,MAAM;AAAA,MACtC,OAAO;AACL,sBAAc,KAAK,GAAG,WAAW,GAAG;AAAA,MACtC;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAdS;AAgBT,WAAS,aAAa,KAAa,OAA4B;AAC7D,WAAO,SAAS,UAAU,IAAI,GAAG,IAAI,CAAC,GAAG,SAAS;AAAA,EACpD;AAFS;AAIT,WAAS,SAAS,OAA4B,YAA8B;AAC1E,UAAM,MAAgB,CAAC;AACvB,QAAI;AACF,YAAM,SAAS,cAAc,KAAK;AAClC,UAAI,QAAQ;AACV,iBAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK,GAAG;AACzC,gBAAM,OAAO,OAAO,IAAI,CAAC;AACzB,cAAI,MAAM,WAAW,UAAU,EAAG,KAAI,KAAK,IAAI;AAAA,QACjD;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AACA,eAAW,QAAQC,QAAO,KAAK,EAAE,KAAK,EAAG,KAAI,KAAK,WAAW,UAAU,KAAK,CAAC,IAAI,SAAS,IAAI,EAAG,KAAI,KAAK,IAAI;AAC9G,WAAO;AAAA,EACT;AAfS;AAiBT,QAAM,YAAY,wBAAC,QAAoB,OAAe;AACpD,UAAM,OAAO,iBAAiB,EAAE;AAChC,QAAI,CAAC,KAAM,OAAM,IAAI,UAAU,gDAAgD;AAC/E,WAAO,OAAO,SAAS;AAAA,EACzB,GAJkB;AAMlB,QAAM,MAAsB;AAAA,IAC1B;AAAA,IACA,OAAO,OAAO;AACZ,YAAM,WAAW,MAAM,IAAI,gBAAgB;AAC3C,UAAI,SAAS,WAAW,KAAK,SAAS,KAAK,CAAC,YAAY,CAAC,OAAO,GAAG;AACjE,cAAM,IAAI,UAAU,wCAAwC,KAAK,UAAU,KAAK,CAAC,EAAE;AAAA,MACrF;AACA,aAAO,GAAG,MAAM,GAAG,SAAS,KAAK,GAAG,CAAC;AAAA,IACvC;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK,KAAK,OAAO;AACf,kBAAY,GAAG;AACf,YAAM,SAAS,aAAa,KAAK,KAAK;AACtC,aAAO,OAAO,QAAQ,GAAG;AAAA,IAC3B;AAAA,IACA,MAAM,KAAK,OAAO,OAAO,cAAc;AACrC,kBAAY,GAAG;AACf,YAAM,SAAS,aAAa,KAAK,KAAK;AACtC,aAAO,OAAO,QAAQ,KAAK,OAAO,cAAc,aAAa;AAAA,IAC/D;AAAA,IACA,OAAO,KAAK,OAAO;AACjB,kBAAY,GAAG;AACf,YAAM,SAAS,aAAa,KAAK,KAAK;AACtC,gBAAU,QAAQ,GAAG;AAAA,IACvB;AAAA,IACA,SAAY,KAAa,OAA4B;AACnD,YAAM,MAAM,IAAI,KAAK,KAAK,KAAK;AAC/B,UAAI,QAAQ,KAAM,QAAO;AACzB,UAAI;AACF,eAAO,KAAK,MAAM,GAAG;AAAA,MACvB,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IACA,UAAU,KAAK,OAAO,OAAO;AAC3B,aAAO,IAAI,MAAM,KAAK,KAAK,UAAU,KAAK,GAAG,KAAK;AAAA,IACpD;AAAA,IACA,KAAK,QAAQ,SAAS;AACpB,aAAO,SAAS,OAAO,MAAM;AAAA,IAC/B;AAAA,IACA,SAAS,EAAE,MAAM,MAAM,IAAI,CAAC,GAAG;AAC7B,iBAAW,QAAQ,OAAO;AACxB,YAAI,CAAC,OAAO,CAAC,KAAK,SAAU;AAC5B,kBAAU,KAAK,OAAO,KAAK,GAAG;AAAA,MAChC;AACA,iBAAW,UAAU,UAAU;AAC7B,YAAI,CAAC,OAAO,CAAC,OAAO,SAAU;AAC9B,mBAAW,QAAQ,SAAS,OAAO,OAAO,OAAO,MAAM,EAAG,WAAU,OAAO,OAAO,IAAI;AAAA,MACxF;AACA,UAAI,KAAK;AACP,mBAAW,SAAS,CAAC,SAAS,SAAS,GAAY;AACjD,qBAAW,QAAQ,SAAS,OAAO,MAAM,EAAG,WAAU,OAAO,IAAI;AAAA,QACnE;AACA,mBAAW,QAAQ,YAAY,EAAG,KAAI,KAAK,WAAW,MAAM,EAAG,WAAU,UAAU,IAAI;AAAA,MACzF;AAAA,IACF;AAAA,IACA,gBAAgB,QAAQ;AACtB,qBAAe;AAAA,IACjB;AAAA,IACA,cAAc;AAAA,IACd,SAAS,KAAK,UAAU,QAAQ,SAAS;AACvC,kBAAY,GAAG;AACf,UAAI,CAACD,WAAU,EAAG,QAAO,MAAM;AAAA,MAAC;AAChC,YAAM,UAAU,wBAAC,UAAwB;AACvC,YAAI,MAAM,gBAAgB,cAAc,KAAK,EAAG;AAChD,YAAI,MAAM,QAAQ,QAAQ,MAAM,QAAQ,IAAK,UAAS,MAAM,QAAQ,OAAO,OAAO,MAAM,QAAQ;AAAA,MAClG,GAHgB;AAIhB,aAAO,iBAAiB,WAAW,OAAO;AAC1C,aAAO,MAAM,OAAO,oBAAoB,WAAW,OAAO;AAAA,IAC5D;AAAA,EACF;AACA,SAAO;AACT;AAtMgB;AAyMT,IAAM,aAA6B,cAAc,OAAO;AAAA,EAC7D,MAAM;AAAA,EACN,UAAU;AACZ,CAAC;;;AC9XD,IAAM,aAAa;AACnB,IAAM,cAAc;AACpB,IAAM,cAAc;AAGpB,IAAM,UAAU,OAAkB,aAAaE,eAAc,KAAK;AAElE,IAAM,YAAY,OAAO,WAAW;AAOpC,SAAS,MAAM,IAAY,QAA4B;AACrD,MAAI;AACF,UAAM,IAAI;AACV,UAAMC,QAAO,EAAE;AACf,QAAIA,OAAM;AAAE,MAAAA,MAAK,IAAI,MAAM;AAAG;AAAA,IAAQ;AACtC,UAAM,QAAS,EAAE,mBAA6C,CAAC;AAC/D,MAAE,kBAAkB;AACpB,QAAI,MAAM,SAAS,IAAK,OAAM,KAAK,CAAC,KAAK,IAAI,GAAG,IAAI,MAAM,CAAC;AAAA,EAC7D,QAAQ;AAAA,EAAkC;AAC5C;AATS;AAUT,SAAS,OAAO,KAAqB;AACnC,MAAI;AAAE,WAAO,IAAI,IAAI,KAAK,UAAU,EAAE;AAAA,EAAU,QAAQ;AAAE,WAAO;AAAA,EAAI;AACvE;AAFS;AAcT,SAAS,gBAAgB,OAAmC;AAC1D,QAAM,MAAM,SAAS,KAAK;AAC1B,SAAO,QAAQ,OAAO,SAAY,KAAK,IAAI,GAAG,KAAK,OAAO,MAAM,KAAK,IAAI,KAAK,GAAI,CAAC;AACrF;AAHS;AAQT,IAAM,WAA0C;AAAA,EAC9C,cAAc;AAAA,EACd,gBAAgB;AAAA,EAChB,QAAQ;AACV;AAEA,SAAS,WAAW,MAA4B;AAC9C,QAAM,QAAQ,SAAS,IAAI;AAC3B,SAAO;AAAA,IACL,KAAK,wBAAC,QAAQ,QAAQ,KAAK,KAAK,KAAK,GAAhC;AAAA,IACL,IAAI,KAAK,OAAO;AACd,UAAI,UAAU,KAAM,SAAQ,OAAO,KAAK,KAAK;AAAA,UAExC,SAAQ,MAAM,KAAK,OAAO,OAAO,UAAU,YAAY,QAAQ,cAAc,EAAE,eAAe,gBAAgB,KAAK,EAAE,IAAI,MAAS;AAAA,IACzI;AAAA,EACF;AACF;AAVS;AA8BT,IAAI,eAA4B;AAChC,IAAI,WAAoB,WAAW,YAAY;AAE/C,IAAM,eAAwB,WAAW,cAAc;AAGvD,SAAS,qBAA2B;AAClC,MAAI,CAAC,aAAa,iBAAiB,SAAU;AAC7C,MAAI;AACF,QAAI,SAAS,IAAI,UAAU,MAAM,QAAQ,SAAS,IAAI,WAAW,MAAM,KAAM;AAC7E,UAAM,SAAS,WAAW,cAAc;AACxC,UAAM,SAAS,OAAO,IAAI,UAAU;AACpC,UAAMC,WAAU,OAAO,IAAI,WAAW;AACtC,QAAI,WAAW,QAAQA,aAAY,KAAM;AACzC,QAAI,WAAW,KAAM,UAAS,IAAI,YAAY,MAAM;AACpD,QAAIA,aAAY,KAAM,UAAS,IAAI,aAAaA,QAAO;AACvD,WAAO,IAAI,YAAY,IAAI;AAC3B,WAAO,IAAI,aAAa,IAAI;AAAA,EAC9B,QAAQ;AAAA,EAAC;AACX;AAbS;AAcT,mBAAmB;AAGnB,SAAS,eAA8B;AACrC,MAAI;AAaF,QAAI,OAAO,aAAa,YAAa,QAAO;AAE5C,UAAM,IAAI,SAAS,OAAO,MAAM,+BAA+B;AAC/D,UAAM,SAAS,IAAI,CAAC;AACpB,QAAI,WAAW,OAAW,QAAO,mBAAmB,MAAM;AAE1D,QAAI,OAAO,cAAc,eAAe,UAAU,UAAU;AAC1D,aAAO,UAAU;AAAA,IACnB;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AAzBS;AAqCT,SAAS,iBAAyB;AAChC,MAAI,OAAO,WAAW,aAAa;AACjC,QAAI;AACF,UAAI,OAAO,YAAY,eAAe,QAAQ,KAAK;AACjD,YAAI,QAAQ,IAAI,6BAA6B,OAAQ,QAAO;AAG5D,YAAI,QAAQ,IAAI,8BAA8B;AAC5C,iBAAO,QAAQ,IAAI;AACrB,eAAO,QAAQ,IAAI,uBAAuB;AAAA,MAC5C;AAAA,IACF,QAAQ;AAAA,IAAC;AACT,WAAO;AAAA,EACT;AACA,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,KAAK;AACjD,UAAI,QAAQ,IAAI,6BAA6B,OAAQ,QAAO;AAC5D,aAAO,QAAQ,IAAI,uBAAuB;AAAA,IAC5C;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AArBS;AAwBT,SAAS,iBAAgC;AACvC,MAAI;AACF,WAAO,KAAK,eAAe,EAAE,gBAAgB,EAAE,YAAY;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AANS;AAcT,SAAS,gBAA+B;AACtC,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,QAAQ,KAAK,qBAAqB;AACtE,aAAO,QAAQ,IAAI;AAAA,IACrB;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,SAAO;AACT;AAPS;AAUT,IAAI,kBAAiC;AACrC,IAAI,oBAAmC;AACvC,IAAI,kBAAiC;AACrC,IAAI,mBAAkC;AACtC,IAAI,mBAAmB;AACvB,IAAI,kBAAyD;AAS7D,IAAI,kBAAyC;AAG7C,IAAI,mBAAkD;AAGtD,IAAM,eAAe;AAoBrB,SAAS,SAAS,OAA8B;AAC9C,MAAI;AACF,UAAM,UAAU,MAAM,MAAM,GAAG,EAAE,CAAC;AAClC,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,OAAO,KAAK,MAAM,KAAK,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,CAAC,CAAC;AAC3E,WAAO,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM,MAAO;AAAA,EAC1D,QAAQ;AAAE,WAAO;AAAA,EAAM;AACzB;AAPS;AAST,SAAS,kBAAmC;AAC1C,QAAM,SAAS,SAAS,IAAI,UAAU;AACtC,QAAMA,WAAU,SAAS,IAAI,WAAW;AACxC,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,YAAY,SAAS,SAAS,MAAM,IAAI;AAC9C,QAAM,cAAc,WAAW,SAAS,cAAc,QAAQ,YAAY;AAC1E,QAAM,aAAaA,WAAU,SAASA,QAAO,IAAI;AACjD,QAAM,eAAeA,aAAY,SAAS,eAAe,QAAQ,aAAa;AAC9E,SAAO;AAAA,IACL,QAAQ,eAAe,eAAe,kBAAkB;AAAA,IACxD,iBAAiB;AAAA,EACnB;AACF;AAZS;AAeT,IAAM,kBAAmC,EAAE,QAAQ,aAAa,iBAAiB,KAAK;AAMtF,IAAM,qBAAqB,oBAAoB,UAAU;AAEzD,IAAI,YAA6B,gBAAgB;AACjD,IAAM,oBAAoB,oBAAI,IAAgB;AAC9C,IAAI,eAAqD;AACzD,IAAI,4BAA4B;AAGhC,SAAS,qBAA2B;AAClC,MAAI,CAAC,UAAW;AAChB,MAAI,iBAAiB,MAAM;AAAE,iBAAa,YAAY;AAAG,mBAAe;AAAA,EAAM;AAC9E,MAAI,kBAAkB,SAAS,EAAG;AAClC,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,OAAiB,CAAC;AACxB,QAAM,SAAS,SAAS,IAAI,UAAU;AACtC,QAAMA,WAAU,SAAS,IAAI,WAAW;AACxC,QAAM,YAAY,SAAS,SAAS,MAAM,IAAI;AAC9C,QAAM,aAAaA,WAAU,SAASA,QAAO,IAAI;AACjD,MAAI,cAAc,QAAQ,YAAY,IAAK,MAAK,KAAK,SAAS;AAC9D,MAAI,eAAe,QAAQ,aAAa,IAAK,MAAK,KAAK,UAAU;AACjE,MAAI,CAAC,KAAK,OAAQ;AAGlB,QAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,GAAG,IAAI,IAAI,MAAM,KAAK,UAAU;AAChE,iBAAe,WAAW,sBAAsB,KAAK;AACvD;AAjBS;AAoBT,SAAS,uBAA6B;AACpC,QAAM,OAAO,gBAAgB;AAC7B,QAAM,UACJ,KAAK,WAAW,UAAU,UAC1B,KAAK,oBAAoB,UAAU;AACrC,MAAI,SAAS;AAAE,gBAAY;AAAM,UAAM,kBAAkB,EAAE,QAAQ,KAAK,OAAO,CAAC;AAAA,EAAG;AACnF,qBAAmB;AACnB,MAAI,CAAC,QAAS;AACd,aAAW,YAAY,MAAM,KAAK,iBAAiB,GAAG;AACpD,QAAI;AAAE,eAAS;AAAA,IAAG,QAAQ;AAAA,IAAC;AAAA,EAC7B;AAIA,MAAI,WAAW;AACb,QAAI;AAAE,aAAO,cAAc,IAAI,MAAM,kBAAkB,CAAC;AAAA,IAAG,QAAQ;AAAA,IAAC;AAAA,EACtE;AACF;AAjBS;AAsBT,SAAS,oBAA0B;AACjC,MAAI,CAAC,aAAa,0BAA2B;AAC7C,8BAA4B;AAC5B,SAAO,iBAAiB,WAAW,CAAC,MAAM;AACxC,QAAI,EAAE,QAAQ,QAAQ,EAAE,QAAQ,cAAc,EAAE,QAAQ,aAAa;AACnE,2BAAqB;AAAA,IACvB;AAAA,EACF,CAAC;AACD,SAAO,iBAAiB,oBAAoB,MAAM,qBAAqB,CAAC;AAGxE,SAAO,iBAAiB,SAAS,MAAM,qBAAqB,CAAC;AAC7D,WAAS,iBAAiB,oBAAoB,MAAM;AAClD,QAAI,SAAS,oBAAoB,UAAW,sBAAqB;AAAA,EACnE,CAAC;AACD,MAAI;AACF,IAAC,OAAoD,aAAa,iBAAiB,UAAU,MAAM,qBAAqB,CAAC;AAAA,EAC3H,QAAQ;AAAA,EAAC;AACX;AAlBS;AA2CT,IAAM,2BAA2B,6BAA6B,UAAU;AAExE,IAAM,2BAAuD,MAAM;AAGjE,QAAM,IAAI;AACV,QAAM,WAAW,EAAE,wBAAwB;AAC3C,MAAI,oBAAoB,IAAK,QAAO;AACpC,QAAM,UAAU,oBAAI,IAA2B;AAC/C,IAAE,wBAAwB,IAAI;AAC9B,SAAO;AACT,GAAG;AAiBH,IAAI,UAA4B;AAEhC,SAAS,mBAAyB;AAChC,MAAI,CAAC,QAAS;AACd,UAAQ,UAAU;AAAA,IAChB,SAAS,KAAK,WAAW;AAAA,IACzB,aAAa,mBAAmB,YAAY;AAAA,EAC9C,CAAC;AACH;AANS;AAsBF,IAAM,OAAO;AAAA;AAAA,EAElB,iBAA8B;AAAE,WAAO;AAAA,EAAc;AAAA;AAAA;AAAA;AAAA,EAIrD,eAAe,MAAyB;AACtC,mBAAe;AACf,eAAW,WAAW,IAAI;AAC1B,yBAAqB;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB,QAAsC;AACpD,YAAQ,gBAAgB,WAAW,OAAO,QAAQ,MAAM;AACxD,yBAAqB;AAAA,EACvB;AAAA;AAAA,EAEA,kBAAiC;AAAE,WAAO,QAAQ,aAAa;AAAA,EAAG;AAAA;AAAA,EAGlE,WAA0B;AAAE,WAAO,SAAS,IAAI,UAAU;AAAA,EAAG;AAAA,EAC7D,SAAS,OAA4B;AACnC,UAAM,kBAAkB,EAAE,SAAS,UAAU,KAAK,CAAC;AACnD,aAAS,IAAI,YAAY,KAAK;AAC9B,yBAAqB;AAAA,EACvB;AAAA,EACA,kBAAiC;AAAE,WAAO,SAAS,IAAI,WAAW;AAAA,EAAG;AAAA,EACrE,gBAAgB,OAA4B;AAC1C,UAAM,yBAAyB,EAAE,SAAS,UAAU,KAAK,CAAC;AAC1D,aAAS,IAAI,aAAa,KAAK;AAC/B,yBAAqB;AAAA,EACvB;AAAA,EACA,cAAoB;AAClB,UAAM,mBAAmB;AAIzB,eAAW,QAAQ,CAAC,gBAAgB,kBAAkB,QAAQ,GAAY;AACxE,YAAMC,WAAU,WAAW,IAAI;AAC/B,MAAAA,SAAQ,IAAI,YAAY,IAAI;AAC5B,MAAAA,SAAQ,IAAI,aAAa,IAAI;AAAA,IAC/B;AAEA,YAAQ,SAAS;AACjB,yBAAqB;AAAA,EACvB;AAAA;AAAA;AAAA,EAGA,kBAA2B;AAAE,WAAO,gBAAgB,EAAE,WAAW;AAAA,EAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUlF,WAAW,QAA2D;AACpE,UAAM,oBAAoB,EAAE,SAAS,OAAO,YAAY,SAAY,SAAS,OAAO,YAAY,OAAO,YAAY,MAAM,CAAC;AAC1H,aAAS,IAAI,YAAY,OAAO,MAAM;AACtC,QAAI,OAAO,YAAY,OAAW,UAAS,IAAI,aAAa,OAAO,OAAO;AAC1E,yBAAqB;AAAA,EACvB;AAAA,EACA,eAAqB;AAAE,SAAK,YAAY;AAAA,EAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAU3C,cAA+B;AAAE,WAAO;AAAA,EAAW;AAAA,EACnD,oBAAqC;AAAE,WAAO;AAAA,EAAiB;AAAA,EAC/D,UAAU,UAAkC;AAC1C,sBAAkB;AAClB,sBAAkB,IAAI,QAAQ;AAE9B,yBAAqB;AACrB,WAAO,MAAM;AACX,wBAAkB,OAAO,QAAQ;AACjC,UAAI,kBAAkB,SAAS,KAAK,iBAAiB,MAAM;AACzD,qBAAa,YAAY;AACzB,uBAAe;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,iBAAiB,IAAuC;AACtD,4BAAwB,IAAI,EAAE;AAC9B,WAAO,MAAM;AAAE,8BAAwB,OAAO,EAAE;AAAA,IAAG;AAAA,EACrD;AAAA;AAAA,EAGA,YAA2B;AACzB,WAAO,mBAAmB,aAAa,IAAI,WAAW,KAAK,cAAc;AAAA,EAC3E;AAAA,EACA,UAAU,KAA0B;AAAE,sBAAkB;AAAA,EAAK;AAAA,EAC7D,iBAAiB,KAA0B;AACzC,sBAAkB;AAClB,iBAAa,IAAI,aAAa,GAAG;AAAA,EACnC;AAAA,EACA,cAAoB;AAAE,sBAAkB;AAAM,iBAAa,IAAI,aAAa,IAAI;AAAA,EAAG;AAAA;AAAA,EAGnF,YAA2B;AAAE,WAAO,mBAAmB,aAAa;AAAA,EAAG;AAAA,EACvE,UAAU,QAA6B;AAAE,sBAAkB;AAAA,EAAQ;AAAA;AAAA;AAAA,EAInE,cAA6B;AAAE,WAAO,qBAAqB,eAAe;AAAA,EAAG;AAAA,EAC7E,YAAY,UAA+B;AAAE,wBAAoB;AAAA,EAAU;AAAA;AAAA,EAG3E,aAAqB;AACnB,UAAM,MAAO,oBAAoB,eAAe;AAChD,WAAO,IAAI,QAAQ,OAAO,EAAE;AAAA,EAC9B;AAAA,EACA,WAAW,KAA0B;AACnC,uBAAmB,MAAM,IAAI,QAAQ,OAAO,EAAE,IAAI;AAClD,qBAAiB;AAAA,EACnB;AAAA;AAAA,EAGA,qBAA8B;AAAE,WAAO;AAAA,EAAkB;AAAA,EACzD,mBAAmB,OAAsB;AACvC,uBAAmB;AACnB,qBAAiB;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,eAAe,IAAiD;AAC9D,sBAAkB;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,kBAAkB,IAAiC;AACjD,sBAAkB;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,aAAqC;AACnC,WAAO,WAAW;AAAA,EACpB;AACF;AAsBA,eAAe,aAAqC;AAClD,MAAI,iBAAkB,QAAO;AAC7B,MAAI,CAAC,gBAAiB,QAAO;AAK7B,QAAM,aAAa,mCAAoC;AACrD,UAAMD,WAAU,KAAK,gBAAgB;AACrC,QAAI,CAACA,SAAS,QAAO;AACrB,UAAM,SAAS,MAAM,gBAAiBA,QAAO;AAC7C,QAAI,CAAC,QAAQ,QAAQ;AAAE,YAAM,WAAW,EAAE,IAAI,OAAO,KAAK,YAAY,CAAC;AAAG,aAAO;AAAA,IAAM;AACvF,UAAM,WAAW,EAAE,IAAI,MAAM,SAAS,QAAQ,OAAO,OAAO,EAAE,CAAC;AAC/D,SAAK,SAAS,OAAO,MAAM;AAC3B,QAAI,OAAO,QAAS,MAAK,gBAAgB,OAAO,OAAO;AACvD,WAAO,OAAO;AAAA,EAChB,GATmB;AAWnB,sBAAoB,YAAY;AAC9B,QAAI;AAEF,YAAM,QACJ,OAAO,cAAc,cAChB,UAAkD,QACnD;AACN,UAAI,OAAO,SAAS;AAClB,eAAO,MAAM,MAAM,QAAQ,GAAG,WAAW,YAAY,UAAU;AAAA,MACjE;AACA,aAAO,MAAM,WAAW;AAAA,IAC1B,QAAQ;AACN,YAAM,WAAW,EAAE,IAAI,OAAO,KAAK,QAAQ,CAAC;AAC5C,aAAO;AAAA,IACT,UAAE;AACA,yBAAmB;AAAA,IACrB;AAAA,EACF,GAAG;AAEH,SAAO;AACT;AAtCe;AA+Cf,SAAS,cAAc,UAAoB,KAAmB;AAC5D,QAAM,gBAAgB,EAAE,KAAK,QAAQ,SAAS,QAAQ,MAAM,OAAO,SAAS,GAAG,GAAG,UAAU,wBAAwB,KAAK,CAAC;AAC1H,OAAK,YAAY;AACjB,aAAW,MAAM,MAAM,KAAK,uBAAuB,GAAG;AACpD,QAAI;AAAE,SAAG,QAAQ;AAAA,IAAG,QAAQ;AAAA,IAAC;AAAA,EAC/B;AACA,MAAI,iBAAiB;AACnB,QAAI;AAAE,sBAAgB,QAAQ;AAAA,IAAG,QAAQ;AAAA,IAAC;AAAA,EAC5C;AACF;AATS;AA+DT,SAAS,cAAuB;AAC9B,MAAI;AACF,WAAO,OAAO,YAAY,eACrB,QAAQ,KAAK,6BAA6B;AAAA,EACjD,QAAQ;AAAE,WAAO;AAAA,EAAO;AAC1B;AALS;AAOT,IAAM,WAAW;AACjB,IAAM,cAAc;AACpB,IAAM,eAAe;AAErB,SAAS,WAAiC;AACxC,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,MAAM,UAAU,KAAK,UAAU,CAAC;AACtC,QAAI,kBAAkB,MAAM,IAAI,OAAO,kBAAkB,WAAW;AACpE,QAAI,YAAY,MAAM,QAAQ,IAAI,MAAM;AACxC,QAAI,UAAU,MAAM,OAAO,IAAI,KAAK;AAAA,EACtC,CAAC;AACH;AAPS;AAST,SAAS,QAAQ,KAAiD;AAChE,SAAO,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC9D,UAAM,KAAK,GAAG,YAAY,aAAa,UAAU;AACjD,UAAM,MAAM,GAAG,YAAY,WAAW,EAAE,IAAI,GAAG;AAC/C,QAAI,YAAY,MAAM,QAAQ,IAAI,MAAM;AACxC,QAAI,UAAU,MAAM,OAAO,IAAI,KAAK;AAAA,EACtC,CAAC,CAAC;AACJ;AAPS;AAST,SAAS,QAAQ,KAAa,OAAqC;AACjE,SAAO,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AAC9D,UAAM,KAAK,GAAG,YAAY,aAAa,WAAW;AAClD,OAAG,YAAY,WAAW,EAAE,IAAI,OAAO,GAAG;AAC1C,OAAG,aAAa,MAAM,QAAQ;AAC9B,OAAG,UAAU,MAAM,OAAO,GAAG,KAAK;AAAA,EACpC,CAAC,CAAC;AACJ;AAPS;AAUT,IAAI,kBAAiD;AAErD,SAAS,kBAA0C;AACjD,MAAI,gBAAiB,QAAO;AAC5B,qBAAmB,YAAY;AAC7B,UAAM,WAAW,MAAM,QAAQ,YAAY,EAAE,MAAM,MAAM,MAAS;AAClE,QAAI,SAAU,QAAO;AACrB,UAAM,OAAO,MAAM,OAAO,OAAO;AAAA,MAC/B,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,MACrC;AAAA;AAAA,MACA,CAAC,MAAM;AAAA,IACT;AAGA,UAAM,QAAQ,cAAc,IAAI,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAChD,WAAO;AAAA,EACT,GAAG;AACH,SAAO;AACT;AAhBS;AAkBT,SAAS,iBAAiB,OAAyC;AACjE,QAAM,MAAM,iBAAiB,aAAa,QAAQ,IAAI,WAAW,KAAK;AACtE,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,MAAK,OAAO,aAAa,IAAI,CAAC,KAAK,CAAC;AACzE,SAAO,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC1E;AALS;AAOT,SAAS,kBAAkB,KAAqB;AAC9C,SAAO,iBAAiB,IAAI,YAAY,EAAE,OAAO,GAAG,CAAC;AACvD;AAFS;AAKT,eAAe,WAAW,KAAiD;AACzE,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAO,GAAG;AAEpD,SAAO,EAAE,KAAK,MAAM,KAAK,SAAS,GAAG,IAAI,GAAa,GAAG,IAAI,EAAY;AAC3E;AAJe;AAOf,eAAe,eAAe,QAAgB,KAAqC;AACjF,MAAI;AACF,UAAM,OAAO,MAAM,gBAAgB;AACnC,UAAM,MAAM,MAAM,WAAW,KAAK,SAAS;AAC3C,UAAM,SAAS,EAAE,KAAK,YAAY,KAAK,SAAS,IAAI;AAEpD,UAAM,kBAAkB,IAAI,MAAM,GAAG,EAAE,CAAC,KAAK;AAC7C,UAAM,MAAM,gBAAgB,MAAM,GAAG,EAAE,CAAC,KAAK;AAC7C,UAAM,MACH,OAAO,cAAc,OAAO,WAAW,KACxC,iBAAiB,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;AAC7D,UAAM,UAAU,EAAE,KAAK,OAAO,YAAY,GAAG,KAAK,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG,IAAI;AAC1F,UAAM,eACJ,GAAG,kBAAkB,KAAK,UAAU,MAAM,CAAC,CAAC,IAAI,kBAAkB,KAAK,UAAU,OAAO,CAAC,CAAC;AAC5F,UAAM,MAAM,MAAM,OAAO,OAAO;AAAA,MAC9B,EAAE,MAAM,SAAS,MAAM,UAAU;AAAA,MACjC,KAAK;AAAA,MACL,IAAI,YAAY,EAAE,OAAO,YAAY;AAAA,IACvC;AACA,WAAO,GAAG,YAAY,IAAI,iBAAiB,GAAG,CAAC;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAvBe;AAyBR,SAAS,oBAAoBE,SAAyB;AAC3D,MAAI,QAAS;AACb,YAAUA;AAEV,EAAAA,QAAO,UAAU;AAAA,IACf,SAAS,KAAK,WAAW;AAAA,IACzB,aAAa,mBAAmB,YAAY;AAAA,EAC9C,CAAC;AAED,EAAAA,QAAO,aAAa,QAAQ,IAAI,OAAO,YAAY;AACjD,UAAM,QAAQ,KAAK,SAAS;AAC5B,QAAI,MAAO,SAAQ,QAAQ,IAAI,iBAAiB,UAAU,KAAK,EAAE;AAEjE,UAAM,SAAS,KAAK,UAAU;AAC9B,QAAI,OAAQ,SAAQ,QAAQ,IAAI,mBAAmB,MAAM;AAIzD,UAAM,SAAS,KAAK,UAAU;AAC9B,QAAI,UAAU,CAAC,QAAQ,QAAQ,IAAI,WAAW,EAAG,SAAQ,QAAQ,IAAI,aAAa,MAAM;AAExF,UAAM,KAAK,KAAK,YAAY;AAC5B,QAAI,GAAI,SAAQ,QAAQ,IAAI,cAAc,EAAE;AAC5C,YAAQ,QAAQ,IAAI,kBAAiB,oBAAI,KAAK,GAAE,YAAY,CAAC;AAI7D,QAAI,YAAY,KAAK,OAAO,WAAW,aAAa;AAClD,YAAM,QAAQ,MAAM,eAAe,QAAQ,QAAQ,QAAQ,GAAG;AAC9D,UAAI,MAAO,SAAQ,QAAQ,IAAI,QAAQ,KAAK;AAAA,IAC9C;AAEA,WAAO;AAAA,EACT,CAAC;AAED,EAAAA,QAAO,aAAa,MAAM,IAAI,CAAC,KAAK,KAAK,QAAQ;AAC/C,QAAI,eAAe,SAAU,QAAO;AACpC,UAAM,MAAO,KAA6B,OAAO;AACjD,UAAM,SAAU,KAA8B,UAAU;AACxD,UAAM,aAAc,KAA8B,cAAc;AAChE,WAAO,IAAI,SAAS,QAAQ,YAAY,KAAK,GAAG;AAAA,EAClD,CAAC;AAGD,EAAAA,QAAO,aAAa,SAAS,IAAI,OAAO,UAAU,YAAY;AAC5D,QAAI,SAAS,WAAW,IAAK,QAAO;AAIpC,QAAI,iDAAiD,KAAK,QAAQ,GAAG,GAAG;AACtE,YAAM,mBAAmB,EAAE,MAAM,OAAO,QAAQ,GAAG,EAAE,CAAC;AACtD,aAAO;AAAA,IACT;AAGA,QAAI,QAAQ,QAAQ,IAAI,YAAY,GAAG;AACrC,oBAAc,UAAU,cAAc;AACtC,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,MAAM,WAAW;AAClC,QAAI,CAAC,UAAU;AACb,oBAAc,UAAU,gBAAgB;AACxC,aAAO;AAAA,IACT;AAKA,UAAM,QAAQ,QAAQ,MAAM;AAC5B,UAAM,QAAQ,IAAI,iBAAiB,UAAU,QAAQ,EAAE;AACvD,UAAM,QAAQ,IAAI,cAAc,GAAG;AAGnC,QAAI,YAAY,KAAK,OAAO,WAAW,aAAa;AAClD,YAAM,QAAQ,MAAM,eAAe,MAAM,QAAQ,MAAM,GAAG;AAC1D,UAAI,MAAO,OAAM,QAAQ,IAAI,QAAQ,KAAK;AAAA,IAC5C;AACA,QAAI;AACF,YAAM,UAAU,MAAM,MAAM,KAAK;AACjC,UAAI,QAAQ,WAAW,IAAK,eAAc,SAAS,WAAW;AAC9D,aAAO;AAAA,IACT,QAAQ;AAIN,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACH;AAzFgB;AAsGhB,IAAM,mBAAmB;AAEzB,KAAK,kBAAkB,OAAOF,aAAY;AACxC,MAAI;AACF,UAAM,MAAM,GAAG,KAAK,WAAW,CAAC,GAAG,gBAAgB;AACnD,UAAM,UAAkC,EAAE,gBAAgB,mBAAmB;AAE7E,QAAI,YAAY,KAAK,OAAO,WAAW,aAAa;AAClD,YAAM,QAAQ,MAAM,eAAe,QAAQ,GAAG;AAC9C,UAAI,MAAO,SAAQ,MAAM,IAAI;AAAA,IAC/B;AACA,UAAM,MAAM,MAAM,MAAM,KAAK;AAAA,MAC3B,QAAQ;AAAA,MACR;AAAA,MACA,aAAa,KAAK,mBAAmB,IAAI,YAAY;AAAA,MACrD,MAAM,KAAK,UAAU,EAAE,SAAAA,SAAQ,CAAC;AAAA,IAClC,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,WAAO,MAAM,SACT,EAAE,QAAQ,KAAK,QAAQ,SAAS,KAAK,WAAWA,SAAQ,IACxD;AAAA,EACN,QAAQ;AACN,WAAO;AAAA,EACT;AACF,CAAC;;;ACx7BD,SAA+B,qBAAqB;AAoCpD,IAAM,iBAA+B;AAAA,EACnC,SAAS,OAAO,YAAY,eAAe,yBAA0B;AAAA,EACrE,aAAa;AAAA,EACb,cAAc;AAAA,EACd,WAAW;AAAA,EACX,WAAW;AAAA,EACX,YAAY;AACd;AAEA,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,IAAM,YAAN,MAAgB;AAAA,EA1DvB,OA0DuB;AAAA;AAAA;AAAA,EACb;AAAA,EACA;AAAA,EAER,YAAY,SAAgC,CAAC,GAAG;AAC9C,SAAK,SAAS,EAAE,GAAG,gBAAgB,GAAG,OAAO;AAC7C,SAAK,UAAU,OAAO,WAAW,cAAc;AAAA,MAC7C,OAAO,KAAK,OAAO,UAAU,IAAI;AAAA,IACnC,CAAC;AAAA,EACH;AAAA,EAEA,SAAe;AAAE,SAAK,OAAO,UAAU;AAAA,EAAM;AAAA,EAC7C,UAAgB;AAAE,SAAK,OAAO,UAAU;AAAA,EAAO;AAAA,EAC/C,UAAU,QAAqC;AAC7C,SAAK,SAAS,EAAE,GAAG,KAAK,QAAQ,GAAG,OAAO;AAAA,EAC5C;AAAA,EAEQ,cAAc,SAA0D;AAC9E,QAAI,CAAC,QAAS,QAAO,CAAC;AACtB,UAAM,WAAmC,CAAC;AAC1C,WAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,eAAS,GAAG,IAAI,kBAAkB,SAAS,IAAI,YAAY,CAAC,IAAI,QAAS,QAAQ,GAAG,KAAK;AAAA,IAC3F,CAAC;AACD,WAAO;AAAA,EACT;AAAA,EAEA,WAAW,SAA2B;AACpC,QAAI,CAAC,KAAK,OAAO,WAAW,CAAC,KAAK,OAAO,YAAa;AACtD,UAAM,EAAE,QAAQ,KAAK,SAAS,KAAK,IAAI;AACvC,SAAK,QAAQ,MAAM,GAAG,MAAM,IAAI,GAAG,EAAE;AACrC,QAAI,KAAK,OAAO,cAAc,QAAS,MAAK,QAAQ,MAAM,YAAY,KAAK,cAAc,OAAO,CAAC;AACjG,QAAI,KAAK,OAAO,aAAa,KAAM,MAAK,QAAQ,MAAM,SAAS,IAAI;AAAA,EACrE;AAAA,EAEA,YAAY,SAAqB,UAA6B;AAC5D,QAAI,CAAC,KAAK,OAAO,WAAW,CAAC,KAAK,OAAO,aAAc;AACvD,UAAM,EAAE,QAAQ,IAAI,IAAI;AACxB,UAAM,EAAE,QAAQ,YAAY,MAAM,SAAS,IAAI;AAC/C,SAAK,QAAQ,QAAQ,GAAG,MAAM,IAAI,GAAG,IAAI,MAAM,IAAI,UAAU,KAAK,QAAQ,KAAK;AAC/E,QAAI,KAAK,OAAO,aAAa,KAAM,MAAK,QAAQ,MAAM,aAAa,IAAI;AAAA,EACzE;AAAA,EAEA,SAAS,SAAqB,OAAuB;AACnD,QAAI,CAAC,KAAK,OAAO,WAAW,CAAC,KAAK,OAAO,UAAW;AACpD,UAAM,EAAE,QAAQ,IAAI,IAAI;AACxB,UAAM,EAAE,SAAS,YAAY,aAAa,SAAS,IAAI;AACvD,SAAK,QAAQ,MAAM,GAAG,MAAM,IAAI,GAAG,IAAI,cAAc,SAAS,WAAW,QAAQ,KAAK;AACtF,SAAK,QAAQ,MAAM,YAAY,OAAO;AACtC,QAAI,eAAe,OAAO,KAAK,WAAW,EAAE,SAAS,GAAG;AACtD,WAAK,QAAQ,MAAM,eAAe;AAClC,aAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,OAAO,MAAM,MAAM;AACvD,eAAO,QAAQ,CAAC,QAAQ,KAAK,QAAQ,MAAM,YAAO,KAAK,KAAK,GAAG,EAAE,CAAC;AAAA,MACpE,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,KAAK,YAAoB,MAAmB;AAAE,QAAI,KAAK,OAAO,QAAS,MAAK,QAAQ,KAAK,SAAS,GAAG,IAAI;AAAA,EAAG;AAAA,EAC5G,KAAK,YAAoB,MAAmB;AAAE,QAAI,KAAK,OAAO,QAAS,MAAK,QAAQ,KAAK,SAAS,GAAG,IAAI;AAAA,EAAG;AAAA,EAC5G,MAAM,YAAoB,MAAmB;AAAE,QAAI,KAAK,OAAO,QAAS,MAAK,QAAQ,MAAM,SAAS,GAAG,IAAI;AAAA,EAAG;AAAA,EAC9G,MAAM,YAAoB,MAAmB;AAAE,QAAI,KAAK,OAAO,QAAS,MAAK,QAAQ,MAAM,SAAS,GAAG,IAAI;AAAA,EAAG;AAAA,EAC9G,QAAQ,YAAoB,MAAmB;AAAE,QAAI,KAAK,OAAO,QAAS,MAAK,QAAQ,QAAQ,SAAS,GAAG,IAAI;AAAA,EAAG;AAAA,EAClH,QAAQ,KAA8B;AAAE,WAAO,KAAK,QAAQ,QAAQ,GAAG;AAAA,EAAG;AAC5E;AAEO,IAAM,gBAAgB,IAAI,UAAU;;;AC1HpC,IAAM,QAAQ,yBAAyB;AAEvC,IAAMG,aAAY,OAAO,WAAW;AAMpC,IAAM,gBAAgB,QAAQ,IAAI,6BAA6B;AAY/D,IAAMC,eAAc,QAAQ,IAAI,6BAA6B;;;ACKpE,IAAM,mBAAmB,SAAS;AAElC,IAAM,gBAA8B,mBAAmB,IAAI;AAE3D,IAAI,SAAuB;AAG3B,IAAM,eAAe,oBAAI,IAAmC;AAGrD,SAAS,cAA4B;AAC1C,SAAO;AACT;AAFgB;AAKT,SAAS,YAAY,OAA2B;AACrD,WAAS;AACT,aAAW,MAAM,cAAc;AAC7B,QAAI;AACF,SAAG,KAAK;AAAA,IACV,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AATgB;AAeT,SAAS,iBAAiB,IAA+C;AAC9E,eAAa,IAAI,EAAE;AACnB,MAAI;AACF,OAAG,MAAM;AAAA,EACX,QAAQ;AAAA,EAER;AACA,SAAO,MAAM,aAAa,OAAO,EAAE;AACrC;AARgB;AAkBT,SAAS,mBAAmB,MAAmD;AACpF,QAAM,UAAU,KAAK,SAAS;AAC9B,MAAI,KAAK,WAAW,SAAS;AAC3B,gBAAY,CAAC;AAAA,EACf,OAAO;AACL,gBAAY,CAAC;AAAA,EACf;AACF;AAPgB;;;AC9DhB,SAAS,4BAA4B;AAQ9B,SAAS,aAA8B;AAC5C,SAAO,qBAAqB,KAAK,WAAW,KAAK,aAAa,KAAK,iBAAiB;AACtF;AAFgB;;;ACjBhB,SAAS,aAAa,wBAAAC,6BAA4B;AAUlD,IAAM,cAAc;AAEpB,IAAM,YAAY,oBAAI,IAAgB;AAEtC,SAAS,OAAsB;AAC7B,MAAI;AACF,WAAO,aAAa,QAAQ,WAAW,KAAK;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AANS;AAST,SAAS,UAAgB;AACvB,MAAI,OAAO,WAAW,YAAa;AACnC,OAAK,YAAY,KAAK,CAAC;AACzB;AAHS;AAIT,QAAQ;AAER,SAAS,MAAM,UAA+B;AAC5C,MAAI;AACF,QAAI,SAAU,cAAa,QAAQ,aAAa,QAAQ;AAAA,QACnD,cAAa,WAAW,WAAW;AAAA,EAC1C,QAAQ;AAAA,EAER;AACA,OAAK,YAAY,QAAQ;AACzB,YAAU,QAAQ,CAAC,MAAM,EAAE,CAAC;AAC9B;AATS;AAWT,SAAS,UAAU,UAAkC;AACnD,YAAU,IAAI,QAAQ;AACtB,SAAO,MAAM,UAAU,OAAO,QAAQ;AACxC;AAHS;AAeF,SAAS,cAAiC;AAC/C,QAAM,aAAaC,sBAAqB,WAAW,MAAM,MAAM,IAAI;AACnE,QAAM,cAAc,YAAY,CAAC,OAAsB,MAAM,EAAE,GAAG,CAAC,CAAC;AACpE,SAAO;AAAA,IACL,UAAU,cAAc,KAAK,YAAY;AAAA,IACzC;AAAA,IACA,QAAQ,eAAe;AAAA,IACvB;AAAA,EACF;AACF;AATgB;;;ACxChB,SAAS,aAAa,qBAAqB;AAC3C,SAAS,eAAAC,cAAa,eAAe;AAQrC,IAAI,iBAAiB;AACrB,IAAI,OAAO,WAAW,aAAa;AACjC,SAAO,iBAAiB,YAAY,CAAC,MAAM;AACzC,QAAI,EAAE,UAAW,kBAAiB;AAAA,EACpC,CAAC;AACH;AAEA,SAAS,WAAmB;AAC1B,SAAO,OAAO,WAAW,cAAc,KAAK,OAAO,SAAS;AAC9D;AAFS;AAOT,SAAS,cAAsB;AAC7B,MAAI,OAAO,YAAY,aAAa;AAClC,WAAO;AAAA,EACT;AACA,SAAO,QAAQ,IAAI,yBAAyB;AAC9C;AALS;AAUT,SAAS,aAAa,MAAc,UAA0B;AAC5D,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,EACT;AAEA,QAAM,iBAAiB,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AAE7D,QAAM,qBAAqB,SAAS,QAAQ,OAAO,EAAE;AACrD,SAAO,GAAG,kBAAkB,GAAG,cAAc;AAC/C;AATS;AA6BF,SAAS,eAAe;AAC7B,QAAM,SAAS,cAAc;AAG7B,QAAM,WAAW,QAAQ,MAAM,YAAY,GAAG,CAAC,CAAC;AAEhD,QAAM,OAAOC,aAAY,CAAC,MAAc,YAAmC;AACzE,cAAU,YAAY,EAAE,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;AACpD,QAAI,UAAU;AAEZ,aAAO,SAAS,OAAO,aAAa,MAAM,QAAQ;AAAA,IACpD,OAAO;AAEL,aAAO,KAAK,MAAM,OAAO;AAAA,IAC3B;AAAA,EACF,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAErB,QAAM,UAAUA,aAAY,CAAC,MAAc,YAAmC;AAC5E,cAAU,eAAe,EAAE,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;AACvD,QAAI,UAAU;AAEZ,aAAO,SAAS,QAAQ,aAAa,MAAM,QAAQ,CAAC;AAAA,IACtD,OAAO;AAEL,aAAO,QAAQ,MAAM,OAAO;AAAA,IAC9B;AAAA,EACF,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAerB,QAAM,WAAWA,aAAY,CAAC,SAAiB;AAC7C,QAAI,gBAAgB;AAClB,gBAAU,wBAAwB,EAAE,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;AAChE;AAAA,IACF;AACA,qBAAiB;AACjB,cAAU,gBAAgB,EAAE,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;AACxD,WAAO,SAAS,OAAO,aAAa,MAAM,QAAQ;AAAA,EACpD,GAAG,CAAC,QAAQ,CAAC;AAcb,QAAM,cAAcA,aAAY,CAAC,SAAiB;AAChD,QAAI,gBAAgB;AAClB,gBAAU,2BAA2B,EAAE,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;AACnE;AAAA,IACF;AACA,qBAAiB;AACjB,cAAU,mBAAmB,EAAE,MAAM,SAAS,GAAG,IAAI,KAAK,CAAC;AAC3D,WAAO,SAAS,QAAQ,aAAa,MAAM,QAAQ,CAAC;AAAA,EACtD,GAAG,CAAC,QAAQ,CAAC;AAEb,QAAM,WAAWA,aAAY,CAAC,SAAiB;AAE7C,WAAO,SAAS,IAAI;AAAA,EACtB,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,OAAOA,aAAY,MAAM;AAC7B,WAAO,KAAK;AAAA,EACd,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,UAAUA,aAAY,MAAM;AAChC,WAAO,QAAQ;AAAA,EACjB,GAAG,CAAC,MAAM,CAAC;AAEX,QAAMC,WAAUD,aAAY,MAAM;AAChC,WAAO,QAAQ;AAAA,EACjB,GAAG,CAAC,MAAM,CAAC;AAEX,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAAC;AAAA,EACF;AACF;AApGgB;;;AC9DhB,SAAS,mBAAmB;AAC5B,SAAS,WAAW,QAAQ,gBAAgB;AAerC,SAAS,iBAAkC;AAChD,QAAM,WAAW,YAAY;AAC7B,QAAM,CAAC,aAAa,cAAc,IAAI,SAA0B,MAAM;AACpE,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,IAAI,gBAAgB;AAAA,IAC7B;AACA,WAAO,IAAI,gBAAgB,OAAO,SAAS,MAAM;AAAA,EACnD,CAAC;AACD,QAAM,gBAAgB,OAAe,EAAE;AAEvC,YAAU,MAAM;AACd,QAAI,OAAO,WAAW,YAAa;AAEnC,UAAM,oBAAoB,6BAAM;AAC9B,YAAM,gBAAgB,OAAO,SAAS;AACtC,UAAI,kBAAkB,cAAc,SAAS;AAC3C,sBAAc,UAAU;AACxB,uBAAe,IAAI,gBAAgB,aAAa,CAAC;AAAA,MACnD;AAAA,IACF,GAN0B;AAS1B,sBAAkB;AAGlB,WAAO,iBAAiB,YAAY,iBAAiB;AAMrD,UAAM,WAAW,OAAO,QAAQ;AAChC,UAAM,cAAc,OAAO,QAAQ;AACnC,WAAO,QAAQ,YAAY,YAAa,MAAM;AAC5C,YAAM,SAAS,SAAS,MAAM,MAAM,IAAI;AACxC,wBAAkB;AAClB,aAAO;AAAA,IACT;AACA,WAAO,QAAQ,eAAe,YAAa,MAAM;AAC/C,YAAM,SAAS,YAAY,MAAM,MAAM,IAAI;AAC3C,wBAAkB;AAClB,aAAO;AAAA,IACT;AAEA,WAAO,MAAM;AACX,aAAO,oBAAoB,YAAY,iBAAiB;AACxD,aAAO,QAAQ,YAAY;AAC3B,aAAO,QAAQ,eAAe;AAAA,IAChC;AAAA,EACF,GAAG,CAAC,QAAQ,CAAC;AAEb,SAAO;AACT;AApDgB;;;AC/BhB,SAAS,eAAAC,cAAa,aAAAC,YAAW,UAAAC,SAAQ,YAAAC,iBAAgB;AAIzD,IAAM,kBAAkB,wBAAC,MAAsB;AAC7C,MAAI,KAAK,EAAG,QAAO;AACnB,QAAM,IAAI,KAAK,MAAM,IAAI,EAAE;AAC3B,SAAO,IAAI,IAAI,GAAG,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC;AACjE,GAJwB;AAMxB,IAAM,eAAe,6BAAM;AACzB,QAAM,CAAC,SAAS,UAAU,IAAIC,UAAS,CAAC;AACxC,QAAM,WAAWC,QAA8C,IAAI;AAEnE,QAAM,QAAQC,aAAY,CAAC,SAAiB;AAC1C,QAAI,SAAS,QAAS,eAAc,SAAS,OAAO;AACpD,eAAW,IAAI;AACf,aAAS,UAAU,YAAY,MAAM;AACnC,iBAAW,CAAC,SAAS;AACnB,YAAI,QAAQ,GAAG;AACb,wBAAc,SAAS,OAAQ;AAC/B,mBAAS,UAAU;AACnB,iBAAO;AAAA,QACT;AACA,eAAO,OAAO;AAAA,MAChB,CAAC;AAAA,IACH,GAAG,GAAI;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,EAAAC,WAAU,MAAM,MAAM;AACpB,QAAI,SAAS,QAAS,eAAc,SAAS,OAAO;AAAA,EACtD,GAAG,CAAC,CAAC;AAEL,SAAO,EAAE,SAAS,MAAM;AAC1B,GAxBqB;AAgCd,IAAM,mBAAmB,wBAC9B,oBAAoB,OACO;AAC3B,QAAM,CAAC,YAAY,aAAa,IAAIH,UAAS,iBAAiB;AAC9D,QAAM,CAAC,KAAK,MAAM,IAAIA,UAAS,EAAE;AACjC,QAAM,CAAC,UAAU,WAAW,IAAIA,UAAS,EAAE;AAC3C,QAAM,CAAC,WAAW,YAAY,IAAIA,UAAS,KAAK;AAChD,QAAM,CAAC,eAAe,gBAAgB,IAAIA,UAAS,IAAI;AAGvD,QAAM,CAAC,kBAAkB,mBAAmB,IAAIA,UAAyB,IAAI;AAC7E,QAAM,CAAC,MAAM,OAAO,IAAIA,UAAmB,YAAY;AACvD,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAAS,EAAE;AACrC,QAAM,CAAC,SAAS,UAAU,IAAIA,UAA6B,IAAI;AAE/D,QAAM,YAAY,aAAa;AAC/B,QAAM,SAAS,aAAa;AAE5B,QAAM,aAAaE,aAAY,MAAM,SAAS,EAAE,GAAG,CAAC,CAAC;AAErD,SAAO;AAAA;AAAA,IAEL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB,UAAU;AAAA,IAC5B,eAAe,UAAU,UAAU;AAAA,IACnC,gBAAgB,gBAAgB,UAAU,OAAO;AAAA,IACjD,eAAe,OAAO;AAAA,IACtB,aAAa,gBAAgB,OAAO,OAAO;AAAA,IAC3C;AAAA;AAAA,IAEA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,yBAAyB,UAAU;AAAA,IACnC,sBAAsB,OAAO;AAAA,IAC7B;AAAA,EACF;AACF,GAlDgC;;;AC1ChC,SAAS,eAAAE,oBAAmB;AAI5B,IAAM,cAAc;AAEb,IAAM,oBAAoB,6BAA0B;AACzD,QAAMC,sBAAqBC,aAAY,CAAC,OAAwB;AAC9D,WAAO,YAAY,KAAK,EAAE;AAAA,EAC5B,GAAG,CAAC,CAAC;AAEL,SAAO,EAAE,oBAAAD,oBAAmB;AAC9B,GANiC;AAQ1B,IAAM,qBAAqB,wBAAC,OAAwB,YAAY,KAAK,EAAE,GAA5C;;;ACdlC,SAAS,eAAAE,cAAa,aAAAC,YAAW,UAAAC,eAAc;;;ACF/C,SAAS,iBAAAC,sBAAqB;AAoBvB,IAAM,SAASC,eAAc;AAAA,EAClC,OAAO,YAAY;AACrB,CAAC,EAAE,QAAQ,KAAK;AAGhB,iBAAiB,CAAC,UAAU;AAC1B,SAAO,QAAQ;AACjB,CAAC;AAKM,IAAM,aAAa,OAAO,QAAQ,MAAM;;;AC9B/C,SAAS,eAAAC,oBAAmB;AAC5B,SAAS,aAAAC,YAAW,UAAAC,eAAc;;;ACW3B,IAAM,gBAAgB,wBAAC,SAA4C;AACxE,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,gBAAgB,KAAK,QAAQ,uBAAuB,EAAE;AAC5D,QAAM,UAAU,cAAc,QAAQ,QAAQ,EAAE;AAChD,SAAO,WAAW;AACpB,GAL6B;AAWtB,IAAM,oBAAoB,wBAC/B,UACA,iBACY;AACZ,QAAM,aAAa,cAAc,QAAQ;AACzC,SAAO,aAAa;AAAA,IAClB,CAAC,MAAM,eAAe,KAAK,WAAW,WAAW,IAAI,GAAG;AAAA,EAC1D;AACF,GARiC;;;ADA1B,IAAM,cAAc,wBAAC,UAA8B,CAAC,MAAM;AAC/D,QAAM,EAAE,eAAe,aAAa,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI;AACvE,QAAM,cAAc,eAAe;AACnC,QAAM,WAAWC,aAAY;AAC7B,QAAM,SAAS,aAAa;AAI5B,QAAM,gBAAgB,kBAAkB,UAAU,YAAY;AAE9D,QAAM,WAAW,YAAY,IAAI,KAAK,KAAK;AAC3C,QAAM,aAAa,YAAY,IAAI,OAAO,KAAK;AAC/C,QAAM,SAAS,CAAC,CAAC;AACjB,QAAM,UAAU,CAAC,CAAC,YAAY,UAAU;AACxC,QAAM,WAAW,SAAS,WAAW,eAAe;AAKpD,QAAM,mBAAmBC,QAAO,aAAa;AAC7C,mBAAiB,UAAU;AAK3B,EAAAC,WAAU,MAAM;AACd,QAAI,CAAC,WAAW,CAAC,SAAU;AAG3B,eAAW,KAAK,qCAAqC,QAAQ;AAC7D,qBAAiB,UAAU,UAAU,UAAU;AAAA,EACjD,GAAG,CAAC,SAAS,UAAU,UAAU,UAAU,CAAC;AAQ5C,EAAAA,WAAU,MAAM;AACd,QAAI,CAAC,WAAW,CAAC,cAAc,CAAC,SAAU;AAC1C,UAAM,aAAa,OAAO,YAAY,YAAY,QAAQ,CAAC;AAC3D,WAAO,WAAW;AAClB,WAAO,WAAW;AAClB,UAAM,cAAc,IAAI,gBAAgB,UAAU,EAAE,SAAS;AAC7D,UAAM,eAAe,OAAO,WAAW,cAAc,OAAO,SAAS,WAAW;AAChF,WAAO,QAAQ,cAAc,GAAG,YAAY,IAAI,WAAW,KAAK,YAAY;AAAA,EAE9E,GAAG,CAAC,SAAS,YAAY,QAAQ,CAAC;AAElC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,GAvD2B;;;AEvB3B,SAAS,wBAAAC,6BAA4B;AASrC,IAAI,UAAqC;AACzC,IAAMC,aAAY,oBAAI,IAAgB;AAEtC,IAAM,MAAM,wBAAC,SAA0C;AACrD,YAAU;AACV,aAAW,YAAY,CAAC,GAAGA,UAAS,EAAG,UAAS;AAClD,GAHY;AAKZ,IAAMC,aAAY,wBAAC,aAAuC;AACxD,EAAAD,WAAU,IAAI,QAAQ;AACtB,SAAO,MAAM;AACX,IAAAA,WAAU,OAAO,QAAQ;AAAA,EAC3B;AACF,GALkB;AAQX,IAAM,0BAA0B,wBAAC,cAAwC,IAAI,SAAS,GAAtD;AAGhC,IAAM,wBAAwB,6BAAY,IAAI,IAAI,GAApB;AAG9B,IAAM,wBAAwB,6BACnCE,sBAAqBD,YAAW,MAAM,SAAS,MAAM,IAAI,GADtB;;;AJhB9B,IAAM,cAAc,wBAAC,YAAgD;AAC1E,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,yBAAyB;AAAA,IACzB,kBAAkB;AAAA,IAClB,WAAW;AAAA,EACb,IAAI;AAGJ,QAAM,YAAY,iBAAiB;AACnC,QAAM,aAAa,kBAAkB;AAGrC,QAAM,yBAAyBE,QAAO,KAAK;AAK3C,QAAM,qBAAqBA,QAAsB,IAAI;AAGrD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI,QAAQ;AAGZ,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,EAAE,oBAAAC,oBAAmB,IAAI;AAM/B,QAAM,0BAA0BC,aAAY,CAAC,OAAe;AAC1D,cAAU,EAAE;AAAA,EACd,GAAG,CAAC,SAAS,CAAC;AAOd,EAAAC,WAAU,MAAM;AACd,UAAM,aAAa,cAAc;AACjC,QAAI,YAAY;AACd,oBAAc,UAAU;AAAA,IAC1B;AAAA,EAEF,GAAG,CAAC,CAAC;AAML,QAAM,yBAAyBD,aAAY,OAAO,MAAuB;AACvE,MAAE,eAAe;AAEjB,QAAI,CAAC,YAAY;AACf,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb;AAAA,IACF;AAEA,QAAI,CAACD,oBAAmB,UAAU,GAAG;AACnC,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb;AAAA,IACF;AAEA,QAAI,0BAA0B,CAAC,eAAe;AAC5C,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb;AAAA,IACF;AAEA,eAAW;AACX,WAAO,EAAE;AACT,eAAW,IAAI;AAEf,YAAQ,KAAK;AAEb,UAAM,WAAW,wBAAC,QAAgB;AAChC,cAAQ,YAAY;AACpB,eAAS,GAAG;AACZ,gBAAU,GAAG;AAAA,IACf,GAJiB;AAMjB,QAAI;AAEF,YAAM,UAAU,yBACZ,EAAE,kBAAkB,qBAAqB,MAAM,mBAAmB,uBAAuB,kBAAkB,IAC3G;AACJ,YAAM,SAAS,MAAM,WAAW,YAAY,WAAW,OAAO;AAE9D,UAAI,OAAO,SAAS;AAClB,gCAAwB,UAAU;AAClC,mBAAW,OAAO,WAAW,IAAI;AACjC,6BAAqB,OAAO,YAAY,eAAe,uBAAuB;AAC9E,8BAAsB,UAAU;AAAA,MAClC,WAAW,OAAO,YAAY;AAC5B,gBAAQ,YAAY;AACpB,gCAAwB,OAAO,UAAU;AAAA,MAC3C,OAAO;AACL,iBAAS,OAAO,OAAO;AAAA,MACzB;AAAA,IACF,QAAQ;AACN,eAAS,8BAA8B;AAAA,IACzC;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IAAY;AAAA,IAAe;AAAA,IAC3B;AAAA,IAAkB;AAAA,IAClBA;AAAA,IAAoB;AAAA,IAAY;AAAA,IAChC;AAAA,IAAU;AAAA,IAAQ;AAAA,IAAS;AAAA,IAAY;AAAA,IACvC;AAAA,IAAyB;AAAA,IAAsB;AAAA,IAAqB;AAAA,IAAS;AAAA,EAC/E,CAAC;AAGD,QAAM,YAAYC,aAAY,OAC5B,kBACA,cACqB;AACrB,QAAI,CAAC,aAAa,UAAU,SAAS,eAAe,kBAAkB;AACpE,YAAM,MAAM,oBAAoB,eAAe,gBAAgB;AAC/D,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AAEA,iBAAa,IAAI;AACjB,eAAW;AAEX,QAAI;AAEF,YAAM,SAAS,MAAM,UAAU,kBAAkB,WAAW,WAAW,aAAa,IAAI;AAExF,UAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,mBAAW,KAAK,qCAAqC;AACrD,gCAAwB,EAAE,WAAW,OAAO,WAAW,CAAC;AACxD,gCAAwB,gBAAgB;AACxC,eAAO;AAAA,MACT;AAEA,UAAI,OAAO,SAAS;AAClB,gCAAwB,gBAAgB;AAExC,mBAAW,KAAK,qDAAqD;AACrE,gBAAQ,SAAS;AACjB,uBAAe;AACf,eAAO;AAAA,MACT,OAAO;AACL,iBAAS,OAAO,OAAO;AACvB,kBAAU,OAAO,OAAO;AACxB,eAAO;AAAA,MACT;AAAA,IACF,QAAQ;AACN,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,WAAW,yBAAyB,UAAU,cAAc,YAAY,cAAc,SAAS,WAAW,aAAa,OAAO,CAAC;AAEnI,QAAM,kBAAkBA,aAAY,OAAO,MAAuB;AAChE,MAAE,eAAe;AACjB,UAAM,UAAU,YAAY,GAAG;AAAA,EACjC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC;AAQ/B,QAAM,iBAAiBA,aAAY,OACjC,kBACA,oBACqB;AACrB,QAAI,CAAC,oBAAoB,CAACD,oBAAmB,gBAAgB,GAAG;AAC9D,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,iBAAiB;AACpB,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AAEA,iBAAa,IAAI;AACjB,eAAW;AAEX,QAAI;AAEF,YAAM,SAAS,MAAM,MAAM,kBAAkB,iBAAiB;AAAA,QAC5D;AAAA,QACA,cAAc;AAAA,MAChB,CAAC;AAED,UAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,mBAAW,KAAK,mCAAmC;AACnD,gCAAwB,EAAE,WAAW,OAAO,WAAW,CAAC;AACxD,gCAAwB,gBAAgB;AACxC,eAAO;AAAA,MACT;AAEA,UAAI,OAAO,SAAS;AAClB,gCAAwB,gBAAgB;AACxC,mBAAW,KAAK,mDAAmD;AACnE,gBAAQ,SAAS;AACjB,uBAAe;AACf,eAAO;AAAA,MACT;AAIA,UAAI,OAAO,YAAY;AACrB,gCAAwB,OAAO,UAAU;AACzC,mBAAW;AAAA,MACb,OAAO;AACL,iBAAS,OAAO,OAAO;AACvB,kBAAU,OAAO,OAAO;AAAA,MAC1B;AACA,aAAO;AAAA,IACT,QAAQ;AACN,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG;AAAA,IACD;AAAA,IAAOA;AAAA,IAAoB;AAAA,IAAyB;AAAA,IAAU;AAAA,IAC9D;AAAA,IAAY;AAAA,IAAyB;AAAA,IAAc;AAAA,IAAS;AAAA,IAC5D;AAAA,EACF,CAAC;AAED,QAAM,uBAAuBC,aAAY,OAAO,MAAuB;AACrE,MAAE,eAAe;AACjB,UAAM,eAAe,YAAY,QAAQ;AAAA,EAC3C,GAAG,CAAC,YAAY,UAAU,cAAc,CAAC;AAEzC,QAAM,kBAAkBA,aAAY,YAAY;AAC9C,iBAAa,IAAI;AACjB,eAAW;AAEX,QAAI;AAGF,YAAM,UAAU,yBACZ,EAAE,kBAAkB,qBAAqB,MAAM,mBAAmB,uBAAuB,kBAAkB,IAC3G;AACJ,YAAM,SAAS,MAAM,WAAW,YAAY,WAAW,OAAO;AAE9D,UAAI,OAAO,SAAS;AAClB,gCAAwB,UAAU;AAClC,mBAAW,OAAO,WAAW,IAAI;AACjC,6BAAqB,OAAO,YAAY,eAAe,uBAAuB;AAC9E,eAAO,EAAE;AAAA,MACX,OAAO;AACL,YAAI,OAAO,YAAY;AACrB,kCAAwB,OAAO,UAAU;AACzC,qBAAW;AAAA,QACb,OAAO;AACL,mBAAS,OAAO,OAAO;AACvB,oBAAU,OAAO,OAAO;AAAA,QAC1B;AAAA,MACF;AAAA,IACF,QAAQ;AACN,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AAAA,IACf,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,YAAY,kBAAkB,wBAAwB,YAAY,yBAAyB,QAAQ,UAAU,cAAc,YAAY,yBAAyB,sBAAsB,YAAY,SAAS,SAAS,CAAC;AAEzN,QAAM,yBAAyBA,aAAY,MAAM;AAC/C,YAAQ,YAAY;AACpB,eAAW;AAAA,EACb,GAAG,CAAC,SAAS,UAAU,CAAC;AAExB,QAAM,eAAeA,aAAY,MAAM;AACrC,YAAQ,KAAK;AACb,eAAW;AAAA,EACb,GAAG,CAAC,SAAS,UAAU,CAAC;AAMxB,QAAM,mBAAmBA,aAAY,CAAC,aAAqB,kBAA2B;AAGpF,UAAM,iBAAiB,iBAAiB,cAAc,KAAK;AAE3D,QAAI,CAAC,gBAAgB;AACnB,iBAAW,KAAK,kEAAkE;AAClF;AAAA,IACF;AAKA,UAAM,SAAS,GAAG,cAAc,IAAI,WAAW;AAC/C,QAAI,mBAAmB,YAAY,OAAQ;AAC3C,QAAI,uBAAuB,QAAS;AAEpC,uBAAmB,UAAU;AAC7B,2BAAuB,UAAU;AAEjC,eAAW,KAAK,wCAAwC;AAGxD,kBAAc,cAAc;AAC5B,WAAO,WAAW;AAClB,YAAQ,KAAK;AAGb,eAAW,YAAY;AACrB,UAAI;AACF,cAAM,UAAU,gBAAgB,WAAW;AAAA,MAC7C,UAAE;AACA,+BAAuB,UAAU;AAAA,MACnC;AAAA,IACF,GAAG,GAAG;AAAA,EACR,GAAG,CAAC,eAAe,eAAe,QAAQ,SAAS,SAAS,CAAC;AAE7D,cAAY;AAAA,IACV,cAAc,CAAC,QAAQ;AAAA,IACvB,eAAe;AAAA,IACf,YAAY;AAAA,EACd,CAAC;AAMD,SAAO;AAAA;AAAA,IAEL,GAAG;AAAA;AAAA,IAGH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IAGA,GAAG;AAAA;AAAA,IAGH,yBAAyB;AAAA,EAC3B;AACF,GApY2B;;;AKf3B,SAAS,eAAAE,cAAa,aAAAC,YAAW,UAAAC,SAAQ,YAAAC,iBAAgB;;;ACoBzD,IAAM,wBAAwB,wBAAC,MAAgB,KAAa,UAAyB;AACnF,MAAI,OAAO,UAAU,YAAY,iBAAiB,MAAM;AACtD,SAAK,OAAO,KAAK,KAAK;AAAA,EACxB,WAAW,iBAAiB,MAAM;AAChC,SAAK,OAAO,KAAK,MAAM,YAAY,CAAC;AAAA,EACtC,OAAO;AACL,SAAK,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC;AAAA,EACxC;AACF,GAR8B;AAkBvB,IAAM,yBAAyB;AAAA,EACpC,gBAAgB,wBAAC,SAA4B;AAC3C,UAAM,OAAO,IAAI,SAAS;AAE1B,WAAO,QAAQ,IAA+B,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACxE,UAAI,UAAU,UAAa,UAAU,MAAM;AACzC;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,cAAM,QAAQ,CAAC,MAAM,sBAAsB,MAAM,KAAK,CAAC,CAAC;AAAA,MAC1D,OAAO;AACL,8BAAsB,MAAM,KAAK,KAAK;AAAA,MACxC;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT,GAfgB;AAgBlB;AAEO,IAAM,qBAAqB;AAAA,EAChC,gBAAgB,wBAAC,SACf,KAAK,UAAU,MAAM,CAAC,MAAM,UAAW,OAAO,UAAU,WAAW,MAAM,SAAS,IAAI,KAAM,GAD9E;AAElB;;;AClBA,IAAM,mBAAyC;AAAA,EAC7C,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,SAAS;AACX;AACA,IAAM,gBAAgB,OAAO,QAAQ,gBAAgB;;;AC+B9C,SAAS,gBAAiC;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL,GAA2D;AACzD,MAAI;AAEJ,QAAM,QAAQ,eAAe,CAAC,OAAe,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAE7F,QAAM,eAAe,0CAAmB;AACtC,QAAI,aAAqB,wBAAwB;AACjD,QAAI,UAAU;AACd,UAAM,SAAS,QAAQ,UAAU,IAAI,gBAAgB,EAAE;AAEvD,WAAO,MAAM;AACX,UAAI,OAAO,QAAS;AAEpB;AAEA,YAAM,UACJ,QAAQ,mBAAmB,UACvB,QAAQ,UACR,IAAI,QAAQ,QAAQ,OAA6C;AAEvE,UAAI,gBAAgB,QAAW;AAC7B,gBAAQ,IAAI,iBAAiB,WAAW;AAAA,MAC1C;AAEA,UAAI;AACF,cAAM,cAA2B;AAAA,UAC/B,UAAU;AAAA,UACV,GAAG;AAAA,UACH,MAAM,QAAQ;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,YAAI,UAAU,IAAI,QAAQ,KAAK,WAAW;AAC1C,YAAI,WAAW;AACb,oBAAU,MAAM,UAAU,KAAK,WAAW;AAAA,QAC5C;AAGA,cAAM,SAAS,QAAQ,SAAS,WAAW;AAC3C,cAAM,WAAW,MAAM,OAAO,OAAO;AAErC,YAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,eAAe,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAEzF,YAAI,CAAC,SAAS,KAAM,OAAM,IAAI,MAAM,yBAAyB;AAE7D,cAAM,SAAS,SAAS,KAAK,YAAY,IAAI,kBAAkB,CAAC,EAAE,UAAU;AAE5E,YAAI,SAAS;AAEb,cAAM,eAAe,6BAAM;AACzB,cAAI;AACF,mBAAO,OAAO;AAAA,UAChB,QAAQ;AAAA,UAER;AAAA,QACF,GANqB;AAQrB,eAAO,iBAAiB,SAAS,YAAY;AAE7C,YAAI;AACF,iBAAO,MAAM;AACX,kBAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,gBAAI,KAAM;AACV,sBAAU;AACV,qBAAS,OAAO,QAAQ,UAAU,IAAI;AAEtC,kBAAM,SAAS,OAAO,MAAM,MAAM;AAClC,qBAAS,OAAO,IAAI,KAAK;AAEzB,uBAAW,SAAS,QAAQ;AAC1B,oBAAM,QAAQ,MAAM,MAAM,IAAI;AAC9B,oBAAM,YAA2B,CAAC;AAClC,kBAAI;AAEJ,yBAAW,QAAQ,OAAO;AACxB,oBAAI,KAAK,WAAW,OAAO,GAAG;AAC5B,4BAAU,KAAK,KAAK,QAAQ,aAAa,EAAE,CAAC;AAAA,gBAC9C,WAAW,KAAK,WAAW,QAAQ,GAAG;AACpC,8BAAY,KAAK,QAAQ,cAAc,EAAE;AAAA,gBAC3C,WAAW,KAAK,WAAW,KAAK,GAAG;AACjC,gCAAc,KAAK,QAAQ,WAAW,EAAE;AAAA,gBAC1C,WAAW,KAAK,WAAW,QAAQ,GAAG;AACpC,wBAAM,SAAS,OAAO,SAAS,KAAK,QAAQ,cAAc,EAAE,GAAG,EAAE;AACjE,sBAAI,CAAC,OAAO,MAAM,MAAM,GAAG;AACzB,iCAAa;AAAA,kBACf;AAAA,gBACF;AAAA,cACF;AAEA,kBAAI;AACJ,kBAAI,aAAa;AAEjB,kBAAI,UAAU,QAAQ;AACpB,sBAAM,UAAU,UAAU,KAAK,IAAI;AACnC,oBAAI;AACF,yBAAO,KAAK,MAAM,OAAO;AACzB,+BAAa;AAAA,gBACf,QAAQ;AACN,yBAAO;AAAA,gBACT;AAAA,cACF;AAEA,kBAAI,YAAY;AACd,oBAAI,mBAAmB;AACrB,wBAAM,kBAAkB,IAAI;AAAA,gBAC9B;AAEA,oBAAI,qBAAqB;AACvB,yBAAO,MAAM,oBAAoB,IAAI;AAAA,gBACvC;AAAA,cACF;AAEA,2BAAa;AAAA,gBACX;AAAA,gBACA,OAAO;AAAA,gBACP,IAAI;AAAA,gBACJ,OAAO;AAAA,cACT,CAAC;AAED,kBAAI,UAAU,QAAQ;AACpB,sBAAM;AAAA,cACR;AAAA,YACF;AAAA,UACF;AAAA,QACF,UAAE;AACA,iBAAO,oBAAoB,SAAS,YAAY;AAChD,iBAAO,YAAY;AAAA,QACrB;AAEA;AAAA,MACF,SAAS,OAAO;AAEd,qBAAa,KAAK;AAElB,YAAI,wBAAwB,UAAa,WAAW,qBAAqB;AACvE;AAAA,QACF;AAGA,cAAM,UAAU,KAAK,IAAI,aAAa,MAAM,UAAU,IAAI,oBAAoB,GAAK;AACnF,cAAM,MAAM,OAAO;AAAA,MACrB;AAAA,IACF;AAAA,EACF,GA1IqB;AA4IrB,QAAM,SAAS,aAAa;AAE5B,SAAO,EAAE,OAAO;AAClB;AAhKgB;;;ACtDT,IAAM,wBAAwB,wBAAC,UAAsD;AAC1F,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF,GAXqC;AAa9B,IAAM,0BAA0B,wBAAC,UAAkD;AACxF,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF,GAXuC;AAahC,IAAM,yBAAyB,wBAAC,UAAuD;AAC5F,UAAQ,OAAO;AAAA,IACb,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF,GAXsC;AAa/B,IAAM,sBAAsB,wBAAC;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,MAEc;AACZ,MAAI,CAAC,SAAS;AACZ,UAAMC,iBACJ,gBAAgB,QAAQ,MAAM,IAAI,CAAC,MAAM,mBAAmB,CAAW,CAAC,GACxE,KAAK,wBAAwB,KAAK,CAAC;AACrC,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,IAAIA,aAAY;AAAA,MACzB,KAAK;AACH,eAAO,IAAI,IAAI,IAAIA,aAAY;AAAA,MACjC,KAAK;AACH,eAAOA;AAAA,MACT;AACE,eAAO,GAAG,IAAI,IAAIA,aAAY;AAAA,IAClC;AAAA,EACF;AAEA,QAAM,YAAY,sBAAsB,KAAK;AAC7C,QAAM,eAAe,MAClB,IAAI,CAAC,MAAM;AACV,QAAI,UAAU,WAAW,UAAU,UAAU;AAC3C,aAAO,gBAAgB,IAAI,mBAAmB,CAAW;AAAA,IAC3D;AAEA,WAAO,wBAAwB;AAAA,MAC7B;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAAA,EACH,CAAC,EACA,KAAK,SAAS;AACjB,SAAO,UAAU,WAAW,UAAU,WAAW,YAAY,eAAe;AAC9E,GAxCmC;AA0C5B,IAAM,0BAA0B,wBAAC;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AACF,MAAuC;AACrC,MAAI,UAAU,UAAa,UAAU,MAAM;AACzC,WAAO;AAAA,EACT;AAEA,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,SAAO,GAAG,IAAI,IAAI,gBAAgB,QAAQ,mBAAmB,KAAK,CAAC;AACrE,GAhBuC;AAkBhC,IAAM,uBAAuB,wBAAC;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,MAGc;AACZ,MAAI,iBAAiB,MAAM;AACzB,WAAO,YAAY,MAAM,YAAY,IAAI,GAAG,IAAI,IAAI,MAAM,YAAY,CAAC;AAAA,EACzE;AAEA,MAAI,UAAU,gBAAgB,CAAC,SAAS;AACtC,QAAI,SAAmB,CAAC;AACxB,WAAO,QAAQ,KAAK,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM;AAC1C,eAAS,CAAC,GAAG,QAAQ,KAAK,gBAAiB,IAAe,mBAAmB,CAAW,CAAC;AAAA,IAC3F,CAAC;AACD,UAAMA,gBAAe,OAAO,KAAK,GAAG;AACpC,YAAQ,OAAO;AAAA,MACb,KAAK;AACH,eAAO,GAAG,IAAI,IAAIA,aAAY;AAAA,MAChC,KAAK;AACH,eAAO,IAAIA,aAAY;AAAA,MACzB,KAAK;AACH,eAAO,IAAI,IAAI,IAAIA,aAAY;AAAA,MACjC;AACE,eAAOA;AAAA,IACX;AAAA,EACF;AAEA,QAAM,YAAY,uBAAuB,KAAK;AAC9C,QAAM,eAAe,OAAO,QAAQ,KAAK,EACtC;AAAA,IAAI,CAAC,CAAC,KAAK,CAAC,MACX,wBAAwB;AAAA,MACtB;AAAA,MACA,MAAM,UAAU,eAAe,GAAG,IAAI,IAAI,GAAG,MAAM;AAAA,MACnD,OAAO;AAAA,IACT,CAAC;AAAA,EACH,EACC,KAAK,SAAS;AACjB,SAAO,UAAU,WAAW,UAAU,WAAW,YAAY,eAAe;AAC9E,GA5CoC;;;AC/G7B,IAAM,gBAAwB;AAE9B,IAAM,wBAAwB,wBAAC,EAAE,MAAM,KAAK,KAAK,MAA8B;AACpF,MAAI,MAAM;AACV,QAAM,UAAU,KAAK,MAAM,aAAa;AACxC,MAAI,SAAS;AACX,eAAW,SAAS,SAAS;AAC3B,UAAI,UAAU;AACd,UAAI,OAAO,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC;AAC9C,UAAI,QAA6B;AAEjC,UAAI,KAAK,SAAS,GAAG,GAAG;AACtB,kBAAU;AACV,eAAO,KAAK,UAAU,GAAG,KAAK,SAAS,CAAC;AAAA,MAC1C;AAEA,UAAI,KAAK,WAAW,GAAG,GAAG;AACxB,eAAO,KAAK,UAAU,CAAC;AACvB,gBAAQ;AAAA,MACV,WAAW,KAAK,WAAW,GAAG,GAAG;AAC/B,eAAO,KAAK,UAAU,CAAC;AACvB,gBAAQ;AAAA,MACV;AAEA,YAAM,QAAQ,KAAK,IAAI;AAEvB,UAAI,UAAU,UAAa,UAAU,MAAM;AACzC;AAAA,MACF;AAEA,UAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,cAAM,IAAI,QAAQ,OAAO,oBAAoB,EAAE,SAAS,MAAM,OAAO,MAAM,CAAC,CAAC;AAC7E;AAAA,MACF;AAEA,UAAI,OAAO,UAAU,UAAU;AAC7B,cAAM,IAAI;AAAA,UACR;AAAA,UACA,qBAAqB;AAAA,YACnB;AAAA,YACA;AAAA,YACA;AAAA,YACA;AAAA,YACA,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA;AAAA,MACF;AAEA,UAAI,UAAU,UAAU;AACtB,cAAM,IAAI;AAAA,UACR;AAAA,UACA,IAAI,wBAAwB;AAAA,YAC1B;AAAA,YACA;AAAA,UACF,CAAC,CAAC;AAAA,QACJ;AACA;AAAA,MACF;AAEA,YAAM,eAAe;AAAA,QACnB,UAAU,UAAU,IAAI,KAAe,KAAM;AAAA,MAC/C;AACA,YAAM,IAAI,QAAQ,OAAO,YAAY;AAAA,IACvC;AAAA,EACF;AACA,SAAO;AACT,GAjEqC;AAmE9B,IAAM,SAAS,wBAAC;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,KAAK;AACP,MAMc;AACZ,QAAM,UAAU,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AACtD,MAAI,OAAO,WAAW,MAAM;AAC5B,MAAI,MAAM;AACR,UAAM,sBAAsB,EAAE,MAAM,IAAI,CAAC;AAAA,EAC3C;AACA,MAAI,SAAS,QAAQ,gBAAgB,KAAK,IAAI;AAC9C,MAAI,OAAO,WAAW,GAAG,GAAG;AAC1B,aAAS,OAAO,UAAU,CAAC;AAAA,EAC7B;AACA,MAAI,QAAQ;AACV,WAAO,IAAI,MAAM;AAAA,EACnB;AACA,SAAO;AACT,GA1BsB;AA4Bf,SAAS,oBAAoB,SAIxB;AACV,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,mBAAmB,WAAW,QAAQ;AAE5C,MAAI,kBAAkB;AACpB,QAAI,oBAAoB,SAAS;AAC/B,YAAM,oBACJ,QAAQ,mBAAmB,UAAa,QAAQ,mBAAmB;AAErE,aAAO,oBAAoB,QAAQ,iBAAiB;AAAA,IACtD;AAGA,WAAO,QAAQ,SAAS,KAAK,QAAQ,OAAO;AAAA,EAC9C;AAGA,MAAI,SAAS;AACX,WAAO,QAAQ;AAAA,EACjB;AAGA,SAAO;AACT;AA3BgB;;;ACpFT,IAAM,eAAe,8BAC1BC,OACA,aACgC;AAChC,QAAM,QAAQ,OAAO,aAAa,aAAa,MAAM,SAASA,KAAI,IAAI;AAEtE,MAAI,CAAC,OAAO;AACV;AAAA,EACF;AAEA,MAAIA,MAAK,WAAW,UAAU;AAC5B,WAAO,UAAU,KAAK;AAAA,EACxB;AAEA,MAAIA,MAAK,WAAW,SAAS;AAC3B,WAAO,SAAS,KAAK,KAAK,CAAC;AAAA,EAC7B;AAEA,SAAO;AACT,GAnB4B;;;ACfrB,IAAM,wBAAwB,wBAAc;AAAA,EACjD,aAAa,CAAC;AAAA,EACd,GAAG;AACL,IAA4B,CAAC,MAAoC;AAC/D,QAAM,kBAAkB,wBAAC,gBAA2B;AAClD,UAAM,SAAmB,CAAC;AAC1B,QAAI,eAAe,OAAO,gBAAgB,UAAU;AAClD,iBAAW,QAAQ,aAAa;AAC9B,cAAM,QAAQ,YAAY,IAAI;AAE9B,YAAI,UAAU,UAAa,UAAU,MAAM;AACzC;AAAA,QACF;AAEA,cAAM,UAAU,WAAW,IAAI,KAAK;AAEpC,YAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,gBAAM,kBAAkB,oBAAoB;AAAA,YAC1C,eAAe,QAAQ;AAAA,YACvB,SAAS;AAAA,YACT;AAAA,YACA,OAAO;AAAA,YACP;AAAA,YACA,GAAG,QAAQ;AAAA,UACb,CAAC;AACD,cAAI,gBAAiB,QAAO,KAAK,eAAe;AAAA,QAClD,WAAW,OAAO,UAAU,UAAU;AACpC,gBAAM,mBAAmB,qBAAqB;AAAA,YAC5C,eAAe,QAAQ;AAAA,YACvB,SAAS;AAAA,YACT;AAAA,YACA,OAAO;AAAA,YACP;AAAA,YACA,GAAG,QAAQ;AAAA,UACb,CAAC;AACD,cAAI,iBAAkB,QAAO,KAAK,gBAAgB;AAAA,QACpD,OAAO;AACL,gBAAM,sBAAsB,wBAAwB;AAAA,YAClD,eAAe,QAAQ;AAAA,YACvB;AAAA,YACA;AAAA,UACF,CAAC;AACD,cAAI,oBAAqB,QAAO,KAAK,mBAAmB;AAAA,QAC1D;AAAA,MACF;AAAA,IACF;AACA,WAAO,OAAO,KAAK,GAAG;AAAA,EACxB,GA3CwB;AA4CxB,SAAO;AACT,GAjDqC;AAsD9B,IAAM,aAAa,wBAAC,gBAAmE;AAC5F,MAAI,CAAC,aAAa;AAGhB,WAAO;AAAA,EACT;AAEA,QAAM,eAAe,YAAY,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAErD,MAAI,CAAC,cAAc;AACjB;AAAA,EACF;AAEA,MAAI,aAAa,WAAW,kBAAkB,KAAK,aAAa,SAAS,OAAO,GAAG;AACjF,WAAO;AAAA,EACT;AAEA,MAAI,iBAAiB,uBAAuB;AAC1C,WAAO;AAAA,EACT;AAEA,MACE,CAAC,gBAAgB,UAAU,UAAU,QAAQ,EAAE,KAAK,CAAC,SAAS,aAAa,WAAW,IAAI,CAAC,GAC3F;AACA,WAAO;AAAA,EACT;AAEA,MAAI,aAAa,WAAW,OAAO,GAAG;AACpC,WAAO;AAAA,EACT;AAEA;AACF,GAhC0B;AAkC1B,IAAM,oBAAoB,wBACxB,SAGA,SACY;AACZ,MAAI,CAAC,MAAM;AACT,WAAO;AAAA,EACT;AACA,MACE,QAAQ,QAAQ,IAAI,IAAI,KACxB,QAAQ,QAAQ,IAAI,KACpB,QAAQ,QAAQ,IAAI,QAAQ,GAAG,SAAS,GAAG,IAAI,GAAG,GAClD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT,GAjB0B;AAmB1B,eAAsB,cACpB,SAGe;AACf,aAAWC,SAAQ,QAAQ,YAAY,CAAC,GAAG;AACzC,QAAI,kBAAkB,SAASA,MAAK,IAAI,GAAG;AACzC;AAAA,IACF;AAEA,UAAM,QAAQ,MAAM,aAAaA,OAAM,QAAQ,IAAI;AAEnD,QAAI,CAAC,OAAO;AACV;AAAA,IACF;AAEA,UAAM,OAAOA,MAAK,QAAQ;AAE1B,YAAQA,MAAK,IAAI;AAAA,MACf,KAAK;AACH,YAAI,CAAC,QAAQ,OAAO;AAClB,kBAAQ,QAAQ,CAAC;AAAA,QACnB;AACA,gBAAQ,MAAM,IAAI,IAAI;AACtB;AAAA,MACF,KAAK;AACH,gBAAQ,QAAQ,OAAO,UAAU,GAAG,IAAI,IAAI,KAAK,EAAE;AACnD;AAAA,MACF,KAAK;AAAA,MACL;AACE,gBAAQ,QAAQ,IAAI,MAAM,KAAK;AAC/B;AAAA,IACJ;AAAA,EACF;AACF;AAlCsB;AAoCf,IAAM,WAA+B,wBAAC,YAC3C,OAAO;AAAA,EACL,SAAS,QAAQ;AAAA,EACjB,MAAM,QAAQ;AAAA,EACd,OAAO,QAAQ;AAAA,EACf,iBACE,OAAO,QAAQ,oBAAoB,aAC/B,QAAQ,kBACR,sBAAsB,QAAQ,eAAe;AAAA,EACnD,KAAK,QAAQ;AACf,CAAC,GAVyC;AAYrC,IAAM,eAAe,wBAAC,GAAW,MAAsB;AAC5D,QAAM,SAAS,EAAE,GAAG,GAAG,GAAG,EAAE;AAC5B,MAAI,OAAO,SAAS,SAAS,GAAG,GAAG;AACjC,WAAO,UAAU,OAAO,QAAQ,UAAU,GAAG,OAAO,QAAQ,SAAS,CAAC;AAAA,EACxE;AACA,SAAO,UAAU,aAAa,EAAE,SAAS,EAAE,OAAO;AAClD,SAAO;AACT,GAP4B;AAS5B,IAAM,iBAAiB,wBAAC,YAA8C;AACpE,QAAM,UAAmC,CAAC;AAC1C,UAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC9B,YAAQ,KAAK,CAAC,KAAK,KAAK,CAAC;AAAA,EAC3B,CAAC;AACD,SAAO;AACT,GANuB;AAQhB,IAAM,eAAe,2BACvB,YACS;AACZ,QAAM,gBAAgB,IAAI,QAAQ;AAClC,aAAW,UAAU,SAAS;AAC5B,QAAI,CAAC,QAAQ;AACX;AAAA,IACF;AAEA,UAAM,WAAW,kBAAkB,UAAU,eAAe,MAAM,IAAI,OAAO,QAAQ,MAAM;AAE3F,eAAW,CAAC,KAAK,KAAK,KAAK,UAAU;AACnC,UAAI,UAAU,MAAM;AAClB,sBAAc,OAAO,GAAG;AAAA,MAC1B,WAAW,MAAM,QAAQ,KAAK,GAAG;AAC/B,mBAAW,KAAK,OAAO;AACrB,wBAAc,OAAO,KAAK,CAAW;AAAA,QACvC;AAAA,MACF,WAAW,UAAU,QAAW;AAG9B,sBAAc;AAAA,UACZ;AAAA,UACA,OAAO,UAAU,WAAW,KAAK,UAAU,KAAK,IAAK;AAAA,QACvD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT,GA7B4B;AAgD5B,IAAM,eAAN,MAAgC;AAAA,EAzOhC,OAyOgC;AAAA;AAAA;AAAA,EAC9B,MAAiC,CAAC;AAAA,EAElC,QAAc;AACZ,SAAK,MAAM,CAAC;AAAA,EACd;AAAA,EAEA,MAAM,IAAgC;AACpC,UAAM,QAAQ,KAAK,oBAAoB,EAAE;AACzC,QAAI,KAAK,IAAI,KAAK,GAAG;AACnB,WAAK,IAAI,KAAK,IAAI;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,OAAO,IAAmC;AACxC,UAAM,QAAQ,KAAK,oBAAoB,EAAE;AACzC,WAAO,QAAQ,KAAK,IAAI,KAAK,CAAC;AAAA,EAChC;AAAA,EAEA,oBAAoB,IAAkC;AACpD,QAAI,OAAO,OAAO,UAAU;AAC1B,aAAO,KAAK,IAAI,EAAE,IAAI,KAAK;AAAA,IAC7B;AACA,WAAO,KAAK,IAAI,QAAQ,EAAE;AAAA,EAC5B;AAAA,EAEA,OAAO,IAA0B,IAA+C;AAC9E,UAAM,QAAQ,KAAK,oBAAoB,EAAE;AACzC,QAAI,KAAK,IAAI,KAAK,GAAG;AACnB,WAAK,IAAI,KAAK,IAAI;AAClB,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA,EAEA,IAAI,IAAyB;AAC3B,SAAK,IAAI,KAAK,EAAE;AAChB,WAAO,KAAK,IAAI,SAAS;AAAA,EAC3B;AACF;AAQO,IAAM,qBAAqB,8BAK5B;AAAA,EACJ,OAAO,IAAI,aAAqD;AAAA,EAChE,SAAS,IAAI,aAA2C;AAAA,EACxD,UAAU,IAAI,aAAgD;AAChE,IATkC;AAWlC,IAAM,yBAAyB,sBAAsB;AAAA,EACnD,eAAe;AAAA,EACf,OAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AAAA,EACA,QAAQ;AAAA,IACN,SAAS;AAAA,IACT,OAAO;AAAA,EACT;AACF,CAAC;AAED,IAAM,iBAAiB;AAAA,EACrB,gBAAgB;AAClB;AAEO,IAAM,eAAe,wBAC1B,WAAqD,CAAC,OACR;AAAA,EAC9C,GAAG;AAAA,EACH,SAAS;AAAA,EACT,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,GAAG;AACL,IAR4B;;;AC9RrB,IAAM,eAAe,wBAAC,SAAiB,CAAC,MAAc;AAC3D,MAAI,UAAU,aAAa,aAAa,GAAG,MAAM;AAEjD,QAAM,YAAY,8BAAe,EAAE,GAAG,QAAQ,IAA5B;AAElB,QAAM,YAAY,wBAACC,YAA2B;AAC5C,cAAU,aAAa,SAASA,OAAM;AACtC,WAAO,UAAU;AAAA,EACnB,GAHkB;AAKlB,QAAM,eAAe,mBAAuE;AAE5F,QAAM,gBAAgB,8BAMpB,YACG;AACH,UAAM,OAAO;AAAA,MACX,GAAG;AAAA,MACH,GAAG;AAAA,MACH,OAAO,QAAQ,SAAS,QAAQ,SAAS,WAAW;AAAA,MACpD,SAAS,aAAa,QAAQ,SAAS,QAAQ,OAAO;AAAA,MACtD,gBAAgB;AAAA,IAClB;AAEA,QAAI,KAAK,UAAU;AACjB,YAAM,cAAc,IAAI;AAAA,IAC1B;AAEA,QAAI,KAAK,kBAAkB;AACzB,YAAM,KAAK,iBAAiB,IAAI;AAAA,IAClC;AAEA,QAAI,KAAK,SAAS,UAAa,KAAK,gBAAgB;AAClD,WAAK,iBAAiB,KAAK,eAAe,KAAK,IAAI;AAAA,IACrD;AAGA,QAAI,KAAK,SAAS,UAAa,KAAK,mBAAmB,IAAI;AACzD,WAAK,QAAQ,OAAO,cAAc;AAAA,IACpC;AAEA,UAAM,eAAe;AAErB,UAAM,MAAM,SAAS,YAAY;AAEjC,WAAO,EAAE,MAAM,cAAc,IAAI;AAAA,EACnC,GAtCsB;AAwCtB,QAAM,UAA6B,8BAAO,YAAY;AACpD,UAAM,eAAe,QAAQ,gBAAgB,QAAQ;AACrD,UAAM,gBAAgB,QAAQ,iBAAiB,QAAQ;AAEvD,QAAIC;AACJ,QAAI;AAEJ,QAAI;AACF,YAAM,EAAE,MAAM,IAAI,IAAI,MAAM,cAAc,OAAO;AACjD,YAAM,cAAuB;AAAA,QAC3B,UAAU;AAAA,QACV,GAAG;AAAA,QACH,MAAM,oBAAoB,IAAI;AAAA,MAChC;AAEA,MAAAA,WAAU,IAAI,QAAQ,KAAK,WAAW;AAEtC,iBAAW,MAAM,aAAa,QAAQ,KAAK;AACzC,YAAI,IAAI;AACN,UAAAA,WAAU,MAAM,GAAGA,UAAS,IAAI;AAAA,QAClC;AAAA,MACF;AAIA,YAAM,SAAS,KAAK;AAEpB,iBAAW,MAAM,OAAOA,QAAO;AAE/B,iBAAW,MAAM,aAAa,SAAS,KAAK;AAC1C,YAAI,IAAI;AACN,qBAAW,MAAM,GAAG,UAAUA,UAAS,IAAI;AAAA,QAC7C;AAAA,MACF;AAEA,YAAM,SAAS;AAAA,QACb,SAAAA;AAAA,QACA;AAAA,MACF;AAEA,UAAI,SAAS,IAAI;AACf,cAAM,WACH,KAAK,YAAY,SACd,WAAW,SAAS,QAAQ,IAAI,cAAc,CAAC,IAC/C,KAAK,YAAY;AAEvB,YAAI,SAAS,WAAW,OAAO,SAAS,QAAQ,IAAI,gBAAgB,MAAM,KAAK;AAC7E,cAAI;AACJ,kBAAQ,SAAS;AAAA,YACf,KAAK;AAAA,YACL,KAAK;AAAA,YACL,KAAK;AACH,0BAAY,MAAM,SAAS,OAAO,EAAE;AACpC;AAAA,YACF,KAAK;AACH,0BAAY,IAAI,SAAS;AACzB;AAAA,YACF,KAAK;AACH,0BAAY,SAAS;AACrB;AAAA,YACF,KAAK;AAAA,YACL;AACE,0BAAY,CAAC;AACb;AAAA,UACJ;AACA,iBAAO,KAAK,kBAAkB,SAC1B,YACA;AAAA,YACE,MAAM;AAAA,YACN,GAAG;AAAA,UACL;AAAA,QACN;AAEA,YAAI;AACJ,gBAAQ,SAAS;AAAA,UACf,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK;AACH,mBAAO,MAAM,SAAS,OAAO,EAAE;AAC/B;AAAA,UACF,KAAK,QAAQ;AAGX,kBAAM,OAAO,MAAM,SAAS,KAAK;AACjC,mBAAO,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC;AAClC;AAAA,UACF;AAAA,UACA,KAAK;AACH,mBAAO,KAAK,kBAAkB,SAC1B,SAAS,OACT;AAAA,cACE,MAAM,SAAS;AAAA,cACf,GAAG;AAAA,YACL;AAAA,QACR;AAEA,YAAI,YAAY,QAAQ;AACtB,cAAI,KAAK,mBAAmB;AAC1B,kBAAM,KAAK,kBAAkB,IAAI;AAAA,UACnC;AAEA,cAAI,KAAK,qBAAqB;AAC5B,mBAAO,MAAM,KAAK,oBAAoB,IAAI;AAAA,UAC5C;AAAA,QACF;AAEA,eAAO,KAAK,kBAAkB,SAC1B,OACA;AAAA,UACE;AAAA,UACA,GAAG;AAAA,QACL;AAAA,MACN;AAEA,YAAM,YAAY,MAAM,SAAS,KAAK;AACtC,UAAI;AAEJ,UAAI;AACF,oBAAY,KAAK,MAAM,SAAS;AAAA,MAClC,QAAQ;AAAA,MAER;AAEA,YAAM,aAAa;AAAA,IACrB,SAAS,OAAO;AACd,UAAI,aAAa;AAEjB,iBAAW,MAAM,aAAa,MAAM,KAAK;AACvC,YAAI,IAAI;AACN,uBAAa,MAAM,GAAG,YAAY,UAAUA,UAAS,OAAiC;AAAA,QACxF;AAAA,MACF;AAEA,mBAAa,cAAc,CAAC;AAE5B,UAAI,cAAc;AAChB,cAAM;AAAA,MACR;AAGA,aAAO,kBAAkB,SACrB,SACA;AAAA,QACE,OAAO;AAAA,QACP,SAAAA;AAAA,QACA;AAAA,MACF;AAAA,IACN;AAAA,EACF,GArJmC;AAuJnC,QAAM,eAAe,wBAAC,WAAkC,CAAC,YACvD,QAAQ,EAAE,GAAG,SAAS,OAAO,CAAC,GADX;AAGrB,QAAM,YAAY,wBAAC,WAAkC,OAAO,YAA4B;AACtF,UAAM,EAAE,MAAM,IAAI,IAAI,MAAM,cAAc,OAAO;AACjD,WAAO,gBAAgB;AAAA,MACrB,GAAG;AAAA,MACH,MAAM,KAAK;AAAA,MACX;AAAA,MACA,WAAW,8BAAOC,MAAK,SAAS;AAC9B,YAAID,WAAU,IAAI,QAAQC,MAAK,IAAI;AACnC,mBAAW,MAAM,aAAa,QAAQ,KAAK;AACzC,cAAI,IAAI;AACN,YAAAD,WAAU,MAAM,GAAGA,UAAS,IAAI;AAAA,UAClC;AAAA,QACF;AACA,eAAOA;AAAA,MACT,GARW;AAAA,MASX,gBAAgB,oBAAoB,IAAI;AAAA,MACxC;AAAA,IACF,CAAC;AAAA,EACH,GAlBkB;AAoBlB,QAAM,YAAgC,wBAAC,YAAY,SAAS,EAAE,GAAG,SAAS,GAAG,QAAQ,CAAC,GAAhD;AAEtC,SAAO;AAAA,IACL,UAAU;AAAA,IACV,SAAS,aAAa,SAAS;AAAA,IAC/B,QAAQ,aAAa,QAAQ;AAAA,IAC7B,KAAK,aAAa,KAAK;AAAA,IACvB;AAAA,IACA,MAAM,aAAa,MAAM;AAAA,IACzB;AAAA,IACA,SAAS,aAAa,SAAS;AAAA,IAC/B,OAAO,aAAa,OAAO;AAAA,IAC3B,MAAM,aAAa,MAAM;AAAA,IACzB,KAAK,aAAa,KAAK;AAAA,IACvB;AAAA,IACA;AAAA,IACA,KAAK;AAAA,MACH,SAAS,UAAU,SAAS;AAAA,MAC5B,QAAQ,UAAU,QAAQ;AAAA,MAC1B,KAAK,UAAU,KAAK;AAAA,MACpB,MAAM,UAAU,MAAM;AAAA,MACtB,SAAS,UAAU,SAAS;AAAA,MAC5B,OAAO,UAAU,OAAO;AAAA,MACxB,MAAM,UAAU,MAAM;AAAA,MACtB,KAAK,UAAU,KAAK;AAAA,MACpB,OAAO,UAAU,OAAO;AAAA,IAC1B;AAAA,IACA,OAAO,aAAa,OAAO;AAAA,EAC7B;AACF,GA/P4B;;;ACNrB,IAAM,SAAiB,aAAa,aAA6B,EAAE,SAAS,wBAAwB,CAAC,CAAC;AAI7G,oBAAoB,MAAM;;;ACmGnB,IAAM,mBAAN,MAAuB;AAAA,EAtH9B,OAsH8B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1B,OAAc,gCAAsE,SAAsJ;AACtO,YAAQ,SAAS,UAAU,QAAQ,IAAqE;AAAA,MACpG,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,IACP,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,iCAAuE,SAAsL;AACvQ,YAAQ,QAAQ,UAAU,QAAQ,KAAsG;AAAA,MACpI,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,sCAA4E,SAAsM;AAC5R,YAAQ,SAAS,UAAU,QAAQ,KAAgH;AAAA,MAC/I,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,qCAA2E,SAAkM;AACvR,YAAQ,QAAQ,UAAU,QAAQ,KAA8G;AAAA,MAC5I,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,sCAA4E,SAAsM;AAC5R,YAAQ,SAAS,UAAU,QAAQ,KAAgH;AAAA,MAC/I,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,qCAA2E,SAAkM;AACvR,YAAQ,QAAQ,UAAU,QAAQ,KAA8G;AAAA,MAC5I,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,kCAAwE,SAA0J;AAC5O,YAAQ,SAAS,UAAU,QAAQ,IAAuE,EAAE,KAAK,kCAAkC,GAAG,QAAQ,CAAC;AAAA,EACnK;AACJ;AAEO,IAAM,iBAAN,MAAqB;AAAA,EAvO5B,OAuO4B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQxB,OAAc,oCAA0E,SAA8J;AAClP,YAAQ,SAAS,UAAU,QAAQ,IAAyE;AAAA,MACxG,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,IACP,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,OAAc,4BAAkE,SAAuK;AACnP,YAAQ,QAAQ,UAAU,QAAQ,KAA4F;AAAA,MAC1H,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,OAAc,2BAAiE,SAAoK;AAC/O,YAAQ,QAAQ,UAAU,QAAQ,KAA0F;AAAA,MACxH,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;AAEO,IAAM,qBAAN,MAAyB;AAAA,EAzShC,OAySgC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM5B,OAAc,2BAAiE,SAAqK;AAChP,YAAQ,SAAS,UAAU,QAAQ,IAAyF;AAAA,MACxH,UAAU,CAAC,EAAE,QAAQ,UAAU,MAAM,OAAO,GAAG;AAAA,QACvC,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,MACV,CAAC;AAAA,MACL,KAAK;AAAA,MACL,GAAG;AAAA,IACP,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,+BAAqE,SAAiL;AAChQ,YAAQ,SAAS,UAAU,QAAQ,KAAkG;AAAA,MACjI,GAAG;AAAA,MACH,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAiBA,OAAc,+BAAqE,SAAiL;AAChQ,YAAQ,SAAS,UAAU,QAAQ,KAAkG;AAAA,MACjI,UAAU,CAAC,EAAE,QAAQ,UAAU,MAAM,OAAO,GAAG;AAAA,QACvC,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,MACV,CAAC;AAAA,MACL,KAAK;AAAA,MACL,GAAG;AAAA,IACP,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,uCAA6E,SAAyM;AAChS,YAAQ,SAAS,UAAU,QAAQ,MAAmH;AAAA,MAClJ,UAAU,CAAC,EAAE,QAAQ,UAAU,MAAM,OAAO,GAAG;AAAA,QACvC,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,MACV,CAAC;AAAA,MACL,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,gCAAsE,SAAoL;AACpQ,YAAQ,SAAS,UAAU,QAAQ,IAAmG;AAAA,MAClI,UAAU,CAAC,EAAE,QAAQ,UAAU,MAAM,OAAO,GAAG;AAAA,QACvC,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,MACV,CAAC;AAAA,MACL,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,sCAA4E,SAAsM;AAC5R,YAAQ,SAAS,UAAU,QAAQ,MAAiH;AAAA,MAChJ,UAAU,CAAC,EAAE,QAAQ,UAAU,MAAM,OAAO,GAAG;AAAA,QACvC,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,MACV,CAAC;AAAA,MACL,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,+BAAqE,SAAiL;AAChQ,YAAQ,SAAS,UAAU,QAAQ,IAAiG;AAAA,MAChI,UAAU,CAAC,EAAE,QAAQ,UAAU,MAAM,OAAO,GAAG;AAAA,QACvC,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,MAAM;AAAA,MACV,CAAC;AAAA,MACL,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;AAEO,IAAM,kBAAN,MAAsB;AAAA,EAjc7B,OAic6B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASzB,OAAc,uBAA6D,SAAwJ;AAC/N,YAAQ,QAAQ,UAAU,QAAQ,KAAkF;AAAA,MAChH,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAc,gCAAsE,SAAqJ;AACrO,YAAQ,QAAQ,UAAU,QAAQ,KAAsE;AAAA,MACpG,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,OAAc,8BAAoE,SAAiJ;AAC/N,YAAQ,QAAQ,UAAU,QAAQ,KAAoE;AAAA,MAClG,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;AAyCO,IAAM,UAAN,MAAc;AAAA,EAniBrB,OAmiBqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAIjB,OAAc,uBAA6D,SAAoI;AAC3M,YAAQ,SAAS,UAAU,QAAQ,IAA4D;AAAA,MAC3F,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,IACP,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,sBAA4D,SAAiI;AACvM,YAAQ,QAAQ,UAAU,QAAQ,OAA8D;AAAA,MAC5F,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,IACP,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,qBAA2D,SAAkJ;AACvN,YAAQ,QAAQ,UAAU,QAAQ,KAA8E;AAAA,MAC5G,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;AAEO,IAAM,eAAN,MAAmB;AAAA,EA1lB1B,OA0lB0B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMtB,OAAc,mBAAyD,SAA6I;AAChN,YAAQ,SAAS,UAAU,QAAQ,KAA0E;AAAA,MACzG,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,SAAS;AAAA,MAChB;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,0BAAgE,SAAiK;AAC3O,YAAQ,QAAQ,UAAU,QAAQ,KAAwF;AAAA,MACtH,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;AAEO,IAAM,gBAAN,MAAoB;AAAA,EAtoB3B,OAsoB2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMvB,OAAc,oBAA0D,SAA+I;AACnN,YAAQ,QAAQ,UAAU,QAAQ,KAA4E;AAAA,MAC1G,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,OAAc,0BAAgE,SAAiK;AAC3O,YAAQ,QAAQ,UAAU,QAAQ,KAAwF;AAAA,MACtH,UAAU;AAAA,QACN,EAAE,MAAM,aAAa,MAAM,SAAS;AAAA,QACpC,EAAE,QAAQ,UAAU,MAAM,OAAO;AAAA,QACjC,EAAE,MAAM,iBAAiB,MAAM,SAAS;AAAA,MAC5C;AAAA,MACA,KAAK;AAAA,MACL,GAAG;AAAA,MACH,SAAS;AAAA,QACL,gBAAgB;AAAA,QAChB,GAAG,QAAQ;AAAA,MACf;AAAA,IACJ,CAAC;AAAA,EACL;AACJ;;;AC/pBO,IAAK,iBAAL,kBAAKE,oBAAL;AACL,EAAAA,gBAAA,sBAAmB;AACnB,EAAAA,gBAAA,wBAAqB;AACrB,EAAAA,gBAAA,0BAAuB;AACvB,EAAAA,gBAAA,8BAA2B;AAC3B,EAAAA,gBAAA,0BAAuB;AACvB,EAAAA,gBAAA,wBAAqB;AACrB,EAAAA,gBAAA,6BAA0B;AAC1B,EAAAA,gBAAA,iBAAc;AACd,EAAAA,gBAAA,sBAAmB;AACnB,EAAAA,gBAAA,qBAAkB;AAVR,SAAAA;AAAA,GAAA;AAaL,IAAK,oBAAL,kBAAKC,uBAAL;AACL,EAAAA,mBAAA,UAAO;AADG,SAAAA;AAAA,GAAA;AAwCZ,IAAI,OAA6B;AAQ1B,SAAS,iBAAiB,MAAkC;AACjE,SAAO;AACT;AAFgB;AAIT,IAAM,YAAY;AAAA;AAAA,EAEvB,MAAM,WAA+B,QAA+B;AAClE,QAAI,MAAM;AACR,WAAK,MAAM,WAAW,MAAM;AAC5B;AAAA,IACF;AAGA,QAAI,OAAO;AACT,cAAQ,IAAI,uBAAuB,WAAW,MAAM;AAAA,IACtD;AAAA,EACF;AAAA;AAAA,EAGA,QAAQ,QAAuB;AAC7B,QAAI,MAAM;AACR,WAAK,QAAQ,MAAM;AACnB;AAAA,IACF;AACA,QAAI,OAAO;AACT,cAAQ,IAAI,iCAAiC,MAAM;AAAA,IACrD;AAAA,EACF;AACF;;;AC4TO,IAAK,qBAAL,kBAAKC,wBAAL;AACH,EAAAA,oBAAA,oBAAiB;AACjB,EAAAA,oBAAA,2BAAwB;AACxB,EAAAA,oBAAA,wBAAqB;AACrB,EAAAA,oBAAA,0BAAuB;AACvB,EAAAA,oBAAA,mBAAgB;AAChB,EAAAA,oBAAA,2BAAwB;AACxB,EAAAA,oBAAA,sBAAmB;AACnB,EAAAA,oBAAA,mBAAgB;AAChB,EAAAA,oBAAA,wBAAqB;AACrB,EAAAA,oBAAA,+BAA4B;AAC5B,EAAAA,oBAAA,sBAAmB;AACnB,EAAAA,oBAAA,sBAAmB;AACnB,EAAAA,oBAAA,kBAAe;AACf,EAAAA,oBAAA,0BAAuB;AACvB,EAAAA,oBAAA,kBAAe;AACf,EAAAA,oBAAA,eAAY;AAhBJ,SAAAA;AAAA,GAAA;;;ACraZ,IAAM,OAAO,wBAAC,OAAgB,QAC5B,OAAO,UAAU,YAAY,UAAU,OAClC,MAAkC,GAAG,IACtC,QAHO;AAab,IAAM,qBAAqB;AAepB,IAAM,kBAAkB;AAAA,EAC7B,oBAAoB;AAAA,EACpB,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,cAAc;AAAA,EACd,SAAS;AACX;AAQA,IAAM,gBAA8C;AAAA,EAClD,CAAC,gBAAgB,kBAAkB,GAAG;AAAA,EACtC,CAAC,gBAAgB,WAAW,GAAG;AAAA,EAC/B,CAAC,gBAAgB,iBAAiB,GAAG;AAAA,EACrC,CAAC,gBAAgB,YAAY,GAAG;AAAA,EAChC,CAAC,gBAAgB,OAAO,GAAG;AAC7B;AAGA,IAAM,eAAe,wBAAC,WAA6C;AACjE,MAAI,WAAW,OAAW,QAAO,gBAAgB;AAGjD,MAAI,WAAW,EAAG,QAAO,gBAAgB;AACzC,MAAI,WAAW,OAAO,WAAW,IAAK,QAAO,gBAAgB;AAE7D,MAAI,WAAW,IAAK,QAAO,gBAAgB;AAC3C,MAAI,WAAW,IAAK,QAAO,gBAAgB;AAC3C,MAAI,UAAU,IAAK,QAAO,gBAAgB;AAC1C,SAAO,gBAAgB;AACzB,GAXqB;AA2Cd,IAAM,mBAAmB,wBAAC,OAAgB,aAAqC;AACpF,MAAI,OAAO,UAAU,YAAY,SAAS,CAAC,mBAAmB,KAAK,KAAK,GAAG;AACzE,WAAO,EAAE,SAAS,MAAM;AAAA,EAC1B;AAEA,QAAM,aAAa;AAAA,IACjB,KAAK,OAAO,SAAS;AAAA,IACrB,KAAK,OAAO,QAAQ;AAAA,IACpB,KAAK,KAAK,OAAO,UAAU,GAAG,OAAO;AAAA,IACrC,KAAK,KAAK,OAAO,UAAU,GAAG,QAAQ;AAAA,IACtC,KAAK,KAAK,OAAO,UAAU,GAAG,SAAS;AAAA,IACvC,KAAK,KAAK,KAAK,OAAO,UAAU,GAAG,MAAM,GAAG,QAAQ;AAAA,EACtD;AAEA,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,cAAc,YAAY,aAAa,CAAC,mBAAmB,KAAK,SAAS,GAAG;AACrF,aAAO,EAAE,SAAS,UAAU;AAAA,IAC9B;AAAA,EACF;AAKA,QAAM,YAAY,KAAK,OAAO,YAAY,KAAK,KAAK,OAAO,QAAQ;AACnE,QAAM,SAAS,OAAO,cAAc,WAAW,YAAY;AAI3D,MAAI,WAAW,UAAa,UAAU;AACpC,WAAO,EAAE,SAAS,SAAS;AAAA,EAC7B;AAEA,QAAM,MAAM,aAAa,MAAM;AAC/B,SAAO,EAAE,SAAS,cAAc,GAAG,GAAG,IAAI;AAC5C,GAlCgC;AA0CzB,IAAM,kBAAkB,wBAAC,OAAgB,aAC9C,iBAAiB,OAAO,QAAQ,EAAE,SADL;AAoBxB,IAAM,iBAAiB,wBAC5B,KACA,SACA,UACS;AACT,QAAM,OAAO,KAAK,OAAO,YAAY,KAAK,KAAK,OAAO,QAAQ;AAC9D,QAAM,gBAAgB,OAAO,SAAS,YAAY,QAAQ,OAAO,OAAO;AACxE,MAAI,eAAe;AACjB,QAAI,KAAK,SAAS,KAAK;AACvB;AAAA,EACF;AACA,MAAI,MAAM,SAAS,KAAK;AAC1B,GAZ8B;;;ACvI9B,IAAM,eAAoC,IAAI,IAAY,OAAO,OAAO,kBAAkB,CAAC;AAE3F,IAAMC,UAAS,wBAAC,UACd,OAAO,UAAU,YAAY,UAAU,OAAQ,QAAoC,MADtE;AASR,IAAM,mBAAmB,wBAAC,KAAc,aAAmC;AAChF,QAAM,OAAOA,QAAOA,QAAO,GAAG,GAAG,QAAQ;AACzC,QAAM,OAAO,MAAM;AACnB,MAAI,OAAO,SAAS,YAAY,aAAa,IAAI,IAAI,GAAG;AACtD,UAAM,cAAc,MAAM;AAC1B,WAAO;AAAA,MACL;AAAA,MACA,SAAS,OAAO,gBAAgB,YAAY,cAAc,cAAc;AAAA,IAC1E;AAAA,EACF;AACA,SAAO,EAAE,SAAS,gBAAgB,KAAK,QAAQ,EAAE;AACnD,GAXgC;;;AC/BhC,SAAS,YAAAC,iBAAgB;;;ACUzB,IAAM,cAAc;AAWb,SAAS,qBAAqB,OAAyB;AAC5D,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AAExD,QAAM,EAAE,MAAM,MAAM,QAAQ,IAAI;AAMhC,SACE,SAAS,wBACT,SAAS,MACR,OAAO,YAAY,YAAY,QAAQ,SAAS,OAAO;AAE5D;AAdgB;AAwBT,SAAS,kBAAkB,MAAe,KAAsB;AACrE,MAAI;AACF,UAAM,WAAW,IAAI,KAAK,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC,EAAE,OAAO;AAEzD,QAAI,WAAW,aAAa;AAC1B,iBAAW;AAAA,QACT,cAAc,SAAS,QAAQ,CAAC,CAAC,kCAAkC,GAAG;AAAA,MACxE;AACA,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,eAAW,MAAM,qCAAqC,GAAG,MAAM,KAAK;AACpE,WAAO;AAAA,EACT;AACF;AAhBgB;;;ADlCT,SAAS,kBAAqB,KAAa,cAAiB;AAEjE,QAAM,CAAC,aAAa,cAAc,IAAIC,UAAY,MAAM;AACtD,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO;AAAA,IACT;AAEA,QAAI;AACF,YAAM,OAAO,OAAO,eAAe,QAAQ,GAAG;AAC9C,aAAO,OAAO,KAAK,MAAM,IAAI,IAAI;AAAA,IACnC,SAAS,OAAO;AACd,iBAAW,MAAM,qCAAqC,GAAG,MAAM,KAAK;AACpE,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AAGD,QAAM,eAAe,6BAAM;AACzB,QAAI;AACF,YAAM,OAAO,OAAO,KAAK,cAAc,EAAE,OAAO,CAAAC,SAAOA,QAAO,OAAOA,SAAQ,QAAQ;AAErF,UAAI,KAAK,SAAS,IAAI;AACpB,cAAM,gBAAgB,KAAK,KAAK,KAAK,SAAS,GAAG;AACjD,iBAAS,IAAI,GAAG,IAAI,eAAe,KAAK;AACtC,cAAI;AACF,kBAAMA,OAAM,KAAK,CAAC;AAClB,gBAAIA,MAAK;AACP,6BAAe,WAAWA,IAAG;AAC7B,6BAAe,WAAW,GAAGA,IAAG,KAAK;AAAA,YACvC;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,2CAA2C,KAAK;AAAA,IACnE;AAAA,EACF,GArBqB;AAwBrB,QAAM,gBAAgB,6BAAM;AAC1B,QAAI;AACF,YAAM,OAAO,OAAO,KAAK,cAAc;AACvC,iBAAWA,QAAO,MAAM;AACtB,YAAI;AACF,yBAAe,WAAWA,IAAG;AAAA,QAC/B,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,wCAAwC,KAAK;AAAA,IAChE;AAAA,EACF,GAbsB;AAgBtB,QAAM,WAAW,wBAAC,UAA+B;AAC/C,QAAI;AACF,YAAM,eAAe,iBAAiB,WAAW,MAAM,WAAW,IAAI;AAGtE,UAAI,CAAC,kBAAkB,cAAc,GAAG,GAAG;AACzC,mBAAW,KAAK,gCAAgC,GAAG,iBAAiB;AAEpE,YAAI;AACF,iBAAO,eAAe,WAAW,GAAG;AACpC,iBAAO,eAAe,WAAW,GAAG,GAAG,KAAK;AAAA,QAC9C,QAAQ;AAAA,QAER;AAEA,uBAAe,YAAY;AAC3B;AAAA,MACF;AAEA,qBAAe,YAAY;AAE3B,UAAI,OAAO,WAAW,aAAa;AAEjC,YAAI;AACF,iBAAO,eAAe,QAAQ,KAAK,KAAK,UAAU,YAAY,CAAC;AAE/D,iBAAO,eAAe,QAAQ,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,SAAS,CAAC;AAAA,QAClE,SAAS,cAAuB;AAE9B,cAAI,qBAAqB,YAAY,GAAG;AACtC,uBAAW,KAAK,qDAAqD;AACrE,yBAAa;AAGb,gBAAI;AACF,qBAAO,eAAe,QAAQ,KAAK,KAAK,UAAU,YAAY,CAAC;AAC/D,qBAAO,eAAe,QAAQ,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,SAAS,CAAC;AAAA,YAClE,SAAS,YAAY;AACnB,yBAAW,MAAM,qCAAqC,GAAG,8BAA8B,UAAU;AAEjG,kBAAI;AACF,8BAAc;AACd,uBAAO,eAAe,QAAQ,KAAK,KAAK,UAAU,YAAY,CAAC;AAC/D,uBAAO,eAAe,QAAQ,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,SAAS,CAAC;AAAA,cAClE,SAAS,YAAY;AACnB,2BAAW,MAAM,qCAAqC,GAAG,2BAA2B,UAAU;AAE9F,+BAAe,YAAY;AAAA,cAC7B;AAAA,YACF;AAAA,UACF,OAAO;AACL,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,qCAAqC,GAAG,MAAM,KAAK;AAEpE,YAAM,eAAe,iBAAiB,WAAW,MAAM,WAAW,IAAI;AACtE,qBAAe,YAAY;AAAA,IAC7B;AAAA,EACF,GA7DiB;AAgEjB,QAAM,cAAc,6BAAM;AACxB,QAAI;AACF,qBAAe,YAAY;AAC3B,UAAI,OAAO,WAAW,aAAa;AACjC,YAAI;AACF,iBAAO,eAAe,WAAW,GAAG;AACpC,iBAAO,eAAe,WAAW,GAAG,GAAG,KAAK;AAAA,QAC9C,SAAS,aAAsB;AAE7B,cAAI,qBAAqB,WAAW,GAAG;AACrC,uBAAW,KAAK,oEAAoE;AACpF,yBAAa;AAEb,gBAAI;AACF,qBAAO,eAAe,WAAW,GAAG;AACpC,qBAAO,eAAe,WAAW,GAAG,GAAG,KAAK;AAAA,YAC9C,SAAS,YAAY;AACnB,yBAAW,MAAM,wCAAwC,GAAG,qBAAqB,UAAU;AAE3F,4BAAc;AAAA,YAChB;AAAA,UACF,OAAO;AACL,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,sCAAsC,GAAG,MAAM,KAAK;AAAA,IACvE;AAAA,EACF,GA7BoB;AA+BpB,SAAO,CAAC,aAAa,UAAU,WAAW;AAC5C;AAzJgB;;;AEVhB,IAAM,oBAAoB,SAAS,YAAY;AAW/C,IAAM,yBAAyB,6BAAc;AAC3C,MAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,MAAI;AACF,UAAM,OAAO,OAAO,eAAe,QAAQ,iBAAiB;AAC5D,WAAO,OAAO,KAAK,MAAM,IAAI,IAAI;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF,GAR+B;AAa/B,IAAM,2BAA2B,6BAAY;AAC3C,MAAI,OAAO,WAAW,YAAa;AACnC,MAAI;AACF,WAAO,eAAe,WAAW,iBAAiB;AAClD,WAAO,eAAe,WAAW,GAAG,iBAAiB,KAAK;AAAA,EAC5D,QAAQ;AAAA,EAER;AACF,GARiC;AAc1B,IAAM,oBAAoB,6BAAqB,uBAAuB,KAAK,MAAjD;AAO1B,IAAM,uBAAuB,6BAAqB;AACvD,QAAM,SAAS,uBAAuB;AACtC,MAAI,OAAQ,0BAAyB;AACrC,SAAO,UAAU;AACnB,GAJoC;AAM7B,IAAM,yBAAyB,wBAAC,UAA+B,CAAC,MAAM;AAC3E,QAAM,EAAE,cAAc,YAAY,aAAa,KAAK,IAAI;AACxD,QAAM,CAAC,aAAa,gBAAgB,iBAAiB,IAAI,kBAA0B,mBAAmB,EAAE;AAExG,QAAM,cAAc,wBAAC,QAAgB;AACnC,mBAAe,GAAG;AAAA,EACpB,GAFoB;AAIpB,QAAM,cAAc,6BAAM;AAExB,WAAO,uBAAuB,KAAK;AAAA,EACrC,GAHoB;AAKpB,QAAM,gBAAgB,6BAAM;AAC1B,sBAAkB;AAClB,6BAAyB;AAAA,EAC3B,GAHsB;AAKtB,QAAM,cAAc,6BAAM;AACxB,UAAM,SAAS,uBAAuB;AACtC,WAAO,OAAO,SAAS,KAAK,YAAY,SAAS;AAAA,EACnD,GAHoB;AAKpB,QAAM,sBAAsB,6BAAM;AAEhC,UAAM,SAAS,uBAAuB;AACtC,WAAO,UAAU,eAAe;AAAA,EAClC,GAJ4B;AAM5B,QAAM,sBAAsB,6BAAM;AAGhC,UAAM,SAAS,uBAAuB;AACtC,UAAM,WAAW,UAAU,eAAe;AAE1C,QAAI,YAAY;AACd,oBAAc;AAAA,IAChB;AACA,WAAO;AAAA,EACT,GAV4B;AAY5B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,GAlDsC;;;AjBjBtC,IAAM,WAAkD;AAAA,EACtD,QAAQ;AAAA,IACN,WAAW,8BAAO,UACf,MAAM,iBAAiB,sCAAsC,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,MADpF;AAAA,IAEX,UAAU,8BAAO,UACd,MAAM,iBAAiB,qCAAqC,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,MADpF;AAAA,EAEZ;AAAA,EACA,QAAQ;AAAA,IACN,WAAW,8BAAO,UACf,MAAM,iBAAiB,sCAAsC,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,MADpF;AAAA,IAEX,UAAU,8BAAO,UACd,MAAM,iBAAiB,qCAAqC,EAAE,MAAM,cAAc,KAAK,CAAC,GAAG,MADpF;AAAA,EAEZ;AACF;AAGO,IAAM,qBAAqB,OAAO,KAAK,QAAQ;AAE/C,IAAM,oBAAoB,wBAAC,UAChC,OAAO,UAAU,YAAY,OAAO,OAAO,UAAU,KAAK,GAD3B;AAGjC,IAAM,YAAY,SAAS,WAAW;AACtC,IAAM,eAAe,SAAS,cAAc;AAGrC,IAAM,oBAAoB,6BAAY;AAC3C,aAAW,OAAO,SAAS;AAC3B,aAAW,OAAO,YAAY;AAChC,GAHiC;AAwC1B,IAAM,gBAAgB,wBAAC,UAAgC,CAAC,MAA2B;AACxF,QAAM,SAAS,aAAa;AAE5B,QAAM,aAAaC,QAAO,OAAO;AACjC,aAAW,UAAU;AACrB,QAAM,YAAYA,QAAO,MAAM;AAC/B,YAAU,UAAU;AAEpB,QAAM,CAAC,iBAAiB,kBAAkB,IAAIC,UAAiC,IAAI;AACnF,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAAwB,IAAI;AACtD,QAAM,CAAC,WAAW,YAAY,IAAIA,UAAkC,IAAI;AAIxE,EAAAC,WAAU,MAAM;AACd,UAAM,SAAS,wBAAC,UAA+B;AAC7C,UAAI,MAAM,UAAW,oBAAmB,IAAI;AAAA,IAC9C,GAFe;AAGf,WAAO,iBAAiB,YAAY,MAAM;AAC1C,WAAO,MAAM,OAAO,oBAAoB,YAAY,MAAM;AAAA,EAC5D,GAAG,CAAC,CAAC;AAEL,QAAM,OAAOC,aAAY,CAAC,UAA2B,SAAiB,SAA4B;AAChG,aAAS,OAAO;AAChB,iBAAa,QAAQ,IAAI;AACzB,uBAAmB,IAAI;AACvB,eAAW,QAAQ,UAAU,SAAS,IAAI;AAC1C,cAAU,+CAAsC;AAAA,MAC9C;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AAAA,EACH,GAAG,CAAC,CAAC;AAEL,QAAM,QAAQA,aAAY,OAAO,aAA8B;AAC7D,uBAAmB,QAAQ;AAC3B,aAAS,IAAI;AACb,iBAAa,IAAI;AAGjB,cAAU,aAAa;AACvB,SAAK,aAAa;AAElB,QAAI;AACF,gBAAU,iDAAuC;AAAA,QAC/C;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAGD,YAAM,YAAY,WAAW,QAAQ,aAAa,OAAO,SAAS;AAClE,YAAM,WAAW,MAAM,SAAS,QAAQ,EAAE,UAAU,EAAE,YAAY,UAAU,CAAC;AAC7E,UAAI,CAAC,SAAS,qBAAqB,CAAC,SAAS,OAAO;AAClD,cAAM,IAAI,MAAM,iCAAiC;AAAA,MACnD;AAEA,iBAAW,MAAM,WAAW,SAAS,KAAK;AAC1C,iBAAW,MAAM,cAAc,QAAQ;AACvC,iBAAW,KAAK,kBAAkB,QAAQ,KAAK;AAE/C,aAAO,SAAS,OAAO,SAAS;AAAA,IAClC,SAAS,KAAK;AACZ,iBAAW,MAAM,GAAG,QAAQ,uBAAuB,GAAG;AACtD,YAAM,UAAU,iBAAiB,KAAK,gCAAgC;AACtE,WAAK,UAAU,QAAQ,SAAS,QAAQ,IAAI;AAAA,IAC9C;AAAA,EACF,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,WAAWA,aAAY,OAAO,UAA2B,MAAc,UAAkB;AAC7F,uBAAmB,QAAQ;AAC3B,aAAS,IAAI;AACb,iBAAa,IAAI;AAKjB,UAAM,cAAc,WAAW,KAAK,SAAS;AAC7C,UAAM,iBAAiB,WAAW,KAAK,YAAY;AACnD,sBAAkB;AAClB,QAAI,CAAC,eAAe,gBAAgB,SAAU,kBAAkB,mBAAmB,UAAW;AAC5F,iBAAW,KAAK,GAAG,QAAQ,6DAA6D;AACxF,WAAK,UAAU,8CAA8C,eAAe;AAC5E;AAAA,IACF;AAEA,QAAI;AACF,YAAM,WAAW,MAAM,SAAS,QAAQ,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAElE,UAAI,SAAS,gBAAgB,SAAS,YAAY;AAChD,kBAAU,iDAAuC;AAAA,UAC/C;AAAA,UACA,OAAO,GAAG,QAAQ;AAAA,QACpB,CAAC;AACD,mBAAW,QAAQ,gBAAgB,SAAS,YAAY,SAAS,qBAAqB,KAAK;AAC3F,2BAAmB,IAAI;AACvB;AAAA,MACF;AAEA,UAAI,CAAC,SAAS,UAAU,CAAC,SAAS,SAAS;AACzC,cAAM,IAAI,MAAM,sCAAsC;AAAA,MACxD;AAGA,gBAAU,eAAe;AACzB,WAAK,WAAW,EAAE,QAAQ,SAAS,QAAQ,SAAS,SAAS,QAAQ,CAAC;AAEtE,gBAAU,qDAAyC;AAAA,QACjD;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AACD,UAAI,SAAS,MAAM,IAAI;AACrB,kBAAU,QAAQ,OAAO,SAAS,KAAK,EAAE,CAAC;AAAA,MAC5C;AACA,UAAI,SAAS,MAAM;AACjB,mBAAW,QAAQ,YAAY,SAAS,MAAM,SAAS,eAAe,OAAO,QAAQ;AAAA,MACvF;AAEA,yBAAmB,IAAI;AACvB,UAAI,CAAC,WAAW,QAAQ,cAAc;AAGpC,kBAAU,QAAQ,SAAS,qBAAqB,KAAK,WAAW,QAAQ,eAAe,UAAU;AAAA,MACnG;AAAA,IACF,SAAS,KAAK;AACZ,iBAAW,MAAM,GAAG,QAAQ,0BAA0B,GAAG;AACzD,YAAM,UAAU,iBAAiB,KAAK,uBAAuB;AAC7D,WAAK,UAAU,QAAQ,SAAS,QAAQ,IAAI;AAAA,IAC9C;AAAA,EACF,GAAG,CAAC,IAAI,CAAC;AAET,SAAO;AAAA,IACL,WAAW,oBAAoB;AAAA,IAC/B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,GAzI6B;;;AkBpG7B,SAAS,WAAAC,UAAS,YAAAC,WAAU,wBAAAC,6BAA4B;;;ACIxD,OAAO,YAAY;AAsBZ,SAAS,qCACd,MACA,QACqB;AACrB,QAAM,EAAE,UAAU,MAAM,GAAG,UAAU,IAAI,UAAU,CAAC;AACpD,QAAM,MAAM,UAAU,CAAC,yCAAyC,QAAQ,CAAC,CAAC,IAAa;AACvF,SAAO;AAAA,IACL;AAAA,IACA,YAAY;AACV,YAAM,MAAM,MAAM,iBAAiB,kCAAkC,EAAE,GAAI,QAAQ,CAAC,GAAI,cAAc,KAAK,CAAU;AACrH,YAAM,OAAO,IAAI;AACjB,WAAK,OAAO,uCAAmC,EAC5C,KAAK,CAAC,EAAE,6BAA6B,MAAM;AAC1C,cAAM,SAAS,6BAA6B,UAAU,IAAI;AAC1D,YAAI,OAAO,QAAS;AAGpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,QAAQ,OAAO,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI;AACF,mBAAO;AAAA,cACL,IAAI,YAAY,wBAAwB;AAAA,gBACtC,QAAQ;AAAA,kBACN,WAAW;AAAA,kBACX,QAAQ;AAAA,kBACR,MAAM;AAAA,kBACN,QAAQ,OAAO,MAAM;AAAA,kBACrB;AAAA,kBACA,WAAW,oBAAI,KAAK;AAAA,gBACtB;AAAA,gBACA,SAAS;AAAA,gBACT,YAAY;AAAA,cACd,CAAC;AAAA,YACH;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC;AACH,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AAvDgB;;;ADZhB,IAAM,QAA6B,CAAC;AACpC,IAAM,YAAY,SAAS,eAAe;AAGnC,IAAM,8BAA8B;AAEpC,IAAM,2BAA2B;AAExC,IAAM,SAAS,wBAAC,UACd,OAAO,UAAU,YAAY,UAAU,QAAQ,OAAQ,MAA2B,OAAO,UAD5E;AAIf,IAAI,UAAyB;AAC7B,IAAI;AAGJ,IAAM,aAAa,6BAAuC;AACxD,QAAM,MAAM,WAAW,KAAK,SAAS;AACrC,MAAI,QAAQ,QAAS,QAAO;AAC5B,YAAU;AACV,MAAI;AACF,UAAM,SAAkB,QAAQ,OAAO,OAAO,KAAK,MAAM,GAAG;AAC5D,iBAAa,MAAM,QAAQ,MAAM,KAAK,OAAO,MAAM,MAAM,IAAI,SAAS;AAAA,EACxE,QAAQ;AACN,iBAAa;AAAA,EACf;AACA,SAAO;AACT,GAXmB;AAanB,IAAMC,aAAY,6BAAM,MAAM;AAAC,GAAb;AAClB,IAAM,iBAAiB,6BAAM,QAAN;AAahB,IAAM,oBAAoB,6BAA+B;AAE9D,QAAM,SAASC,sBAAqBD,YAAW,YAAY,cAAc;AAEzE,QAAM,CAAC,QAAQ,SAAS,IAAIE,UAAS,KAAK;AAE1C,QAAM,EAAE,KAAK,IAAI,qCAAqC,QAAW;AAAA,IAC/D,mBAAmB;AAAA,IACnB,uBAAuB;AAAA,IACvB,mBAAmB;AAAA,IACnB,oBAAoB;AAAA,IACpB,cAAc,wBAAC,QAAQ,MAAM,SAAS,YAAY,SAAS;AAEzD,UAAI,KAAK,aAAa,6BAA6B;AACjD,kBAAU,IAAI;AACd;AAAA,MACF;AACA,iBAAW,MAAM,KAAK,WAAW,IAAI,GAAG,2BAA2B,KAAK,UAAU;AAAA,IACpF,GAPc;AAAA,IAQd,kBAAkB,KAAK,KAAK;AAAA,IAC5B,cAAc,UAAU,EAAE,WAAW,OAAO;AAAA,IAC5C,WAAW,wBAAC,aAAa;AACvB,gBAAU,KAAK;AACf,iBAAW,UAAU,WAAW,SAAS,SAAS;AAAA,IACpD,GAHW;AAAA,EAIb,CAAC;AAED,QAAM,YAAYC;AAAA,IAChB,MAAM,MAAM,UAAU,OAAO,CAAC,MAAM,mBAAmB,SAAS,EAAE,EAAE,CAAC,KAAK;AAAA,IAC1E,CAAC,IAAI;AAAA,EACP;AAIA,SAAO,EAAE,WAAW,SAAS,SAAS,UAAa,UAAU,WAAW,OAAU;AACpF,GAnCiC;;;AEzDjC,SAAS,eAAAC,oBAAmB;AAqBrB,IAAM,gBAAgB,wBAAC,UAAgC,CAAC,MAA2B;AACxF,QAAM,EAAE,WAAW,OAAO,OAAO,SAAS,IAAI,cAAc,OAAO;AACnE,QAAM,kBAAkBC,aAAY,MAAM,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC;AAClE,QAAM,uBAAuBA;AAAA,IAC3B,CAAC,MAAc,UAAkB,SAAS,UAAU,MAAM,KAAK;AAAA,IAC/D,CAAC,QAAQ;AAAA,EACX;AACA,SAAO,EAAE,WAAW,OAAO,iBAAiB,qBAAqB;AACnE,GAR6B;;;ACrB7B,SAAS,eAAAC,cAAa,YAAAC,iBAAgB;;;ACetC,IAAM,mBAAmB;AAQlB,SAAS,yBAAyB,KAA6B;AACpE,MAAI,eAAe,UAAU;AAC3B,UAAM,OAAQ,IAAI,YAAY;AAC9B,QAAI,OAAO,MAAM,uBAAuB,SAAU,QAAO,KAAK;AAAA,EAChE;AACA,SAAO;AACT;AANgB;AAST,SAAS,gBAAgB,MAAuB;AACrD,SAAO,CAAC,CAAC,QAAQ,KAAK,WAAW;AACnC;AAFgB;;;ADkBT,IAAM,qBAAqB,wBAChC,UAAqC,CAAC,MACT;AAC7B,QAAM,EAAE,WAAW,SAAS,aAAa,eAAe,MAAM,IAAI;AAClE,QAAM,SAAS,aAAa;AAE5B,QAAM,CAAC,WAAW,YAAY,IAAIC,UAAS,KAAK;AAChD,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAAwB,IAAI;AACtD,QAAM,CAAC,SAAS,UAAU,IAAIA,UAAwB,IAAI;AAC1D,QAAM,CAAC,sBAAsB,uBAAuB,IAAIA,UAAwB,IAAI;AACpF,QAAM,CAAC,mBAAmB,oBAAoB,IAAIA,UAAwB,IAAI;AAE9E,QAAM,aAAaC,aAAY,MAAM;AACnC,aAAS,IAAI;AAAA,EACf,GAAG,CAAC,CAAC;AAIL,QAAM,gBAAgBA,aAAY,CAAC,aAA6B;AAI9D,cAAU,aAAa;AACvB,SAAK,WAAW,EAAE,QAAQ,SAAS,cAAc,SAAS,SAAS,cAAc,CAAC;AAElF,QAAI,SAAS,SAAS;AACpB,iBAAW,SAAS,OAAO;AAAA,IAC7B;AACA,QAAI,SAAS,2BAA2B,QAAW;AACjD,8BAAwB,SAAS,sBAAsB;AAAA,IACzD;AAEA,cAAU,qDAAyC;AAAA,MACjD;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AACD,QAAI,SAAS,MAAM,IAAI;AACrB,gBAAU,QAAQ,OAAO,SAAS,KAAK,EAAE,CAAC;AAAA,IAC5C;AAEA,gBAAY,SAAS,IAAI;AAGzB,QAAI,CAAC,cAAc;AACjB,YAAM,mBAAmB,qBAAqB,KAAK,eAAe;AAClE,iBAAW,KAAK,mCAAmC,gBAAgB;AACnE,aAAO,SAAS,gBAAgB;AAAA,IAClC;AAAA,EACF,GAAG,CAAC,WAAW,aAAa,QAAQ,YAAY,CAAC;AAEjD,QAAM,aAAaA,aAAY,OAAO,WAAmB,SAAmC;AAC1F,QAAI,CAAC,WAAW;AACd,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AACA,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AAEA,iBAAa,IAAI;AACjB,aAAS,IAAI;AAEb,QAAI;AACF,iBAAW,KAAK,wBAAwB;AAExC,YAAM,SAAS,MAAM,cAAc,oBAAoB;AAAA,QACrD,MAAM,EAAE,YAAY,WAAW,KAAK;AAAA,QACpC,cAAc;AAAA,MAChB,CAAC;AACD,YAAM,WAAW,OAAO;AAExB,UAAI,CAAC,SAAS,gBAAgB,CAAC,SAAS,eAAe;AACrD,cAAM,IAAI,MAAM,wCAAwC;AAAA,MAC1D;AAEA,oBAAc,QAAQ;AACtB,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,qBAAe,YAAY,iCAAiC,GAAG;AAC/D,YAAM,eAAe,gBAAgB,KAAK,2BAA2B;AACrE,YAAM,WAAW,yBAAyB,GAAG;AAC7C,UAAI,aAAa,KAAM,sBAAqB,QAAQ;AACpD,eAAS,YAAY;AACrB,gBAAU,YAAY;AAEtB,gBAAU,yDAA2C;AAAA,QACnD;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AACD,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,eAAe,OAAO,CAAC;AAE3B,QAAM,mBAAmBA,aAAY,OAAO,WAAmB,eAAyC;AACtG,QAAI,CAAC,WAAW;AACd,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AACA,QAAI,CAAC,cAAc,WAAW,SAAS,GAAG;AACxC,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AAEA,iBAAa,IAAI;AACjB,aAAS,IAAI;AAEb,QAAI;AACF,iBAAW,KAAK,0BAA0B;AAE1C,YAAM,SAAS,MAAM,cAAc,0BAA0B;AAAA,QAC3D,MAAM;AAAA,UACJ,YAAY;AAAA,UACZ,aAAa,WAAW,QAAQ,QAAQ,EAAE;AAAA,QAC5C;AAAA,QACA,cAAc;AAAA,MAChB,CAAC;AACD,YAAM,WAAW,OAAO;AAExB,UAAI,CAAC,SAAS,gBAAgB,CAAC,SAAS,eAAe;AACrD,cAAM,IAAI,MAAM,gDAAgD;AAAA,MAClE;AAEA,oBAAc,QAAQ;AACtB,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,qBAAe,YAAY,wCAAwC,GAAG;AACtE,YAAM,eAAe,gBAAgB,KAAK,qBAAqB;AAC/D,YAAM,WAAW,yBAAyB,GAAG;AAC7C,UAAI,aAAa,KAAM,sBAAqB,QAAQ;AACpD,eAAS,YAAY;AACrB,gBAAU,YAAY;AAEtB,gBAAU,yDAA2C;AAAA,QACnD;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AACD,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,eAAe,OAAO,CAAC;AAE3B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,GAnKkC;;;AElDlC,SAAS,eAAAC,cAAa,YAAAC,iBAAgB;AAuD/B,IAAM,oBAAoB,wBAC/B,UAAoC,CAAC,MACT;AAC5B,QAAM,EAAE,YAAY,QAAQ,IAAI;AAEhC,QAAM,CAAC,WAAW,YAAY,IAAIC,UAAS,KAAK;AAChD,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAAwB,IAAI;AACtD,QAAM,CAAC,WAAW,YAAY,IAAIA,UAAoC,IAAI;AAC1E,QAAM,CAAC,aAAa,cAAc,IAAIA,UAA0B,IAAI;AACpE,QAAM,CAAC,oBAAoB,qBAAqB,IAAIA,UAAwB,IAAI;AAChF,QAAM,CAAC,WAAW,YAAY,IAAIA,UAA0D,MAAM;AAElG,QAAM,aAAaC,aAAY,MAAM;AACnC,aAAS,IAAI;AAAA,EACf,GAAG,CAAC,CAAC;AAEL,QAAM,aAAaA,aAAY,MAAM;AACnC,iBAAa,IAAI;AACjB,mBAAe,IAAI;AACnB,0BAAsB,IAAI;AAC1B,iBAAa,MAAM;AACnB,aAAS,IAAI;AAAA,EACf,GAAG,CAAC,CAAC;AAEL,QAAM,aAAaA,aAAY,OAAO,eAA4D;AAChG,iBAAa,IAAI;AACjB,aAAS,IAAI;AACb,iBAAa,UAAU;AAEvB,QAAI;AACF,iBAAW,KAAK,uBAAuB;AAEvC,YAAM,SAAS,MAAM,aAAa,mBAAmB;AAAA,QACnD,MAAM,EAAE,aAAa,WAAW;AAAA,QAChC,cAAc;AAAA,MAChB,CAAC;AACD,YAAM,WAAW,OAAO;AAExB,YAAM,OAA2B;AAAA,QAC/B,UAAU,SAAS;AAAA,QACnB,QAAQ,SAAS;AAAA,QACjB,iBAAiB,SAAS;AAAA,QAC1B,cAAc,SAAS;AAAA,QACvB,WAAW,SAAS;AAAA,MACtB;AAEA,mBAAa,IAAI;AACjB,iBAAW,KAAK,oCAAoC,KAAK,WAAW,SAAS;AAE7E,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,YAAM,eAAe,gBAAgB,KAAK,2BAA2B;AACrE,qBAAe,YAAY,qBAAqB,GAAG;AACnD,eAAS,YAAY;AACrB,mBAAa,MAAM;AACnB,gBAAU,YAAY;AACtB,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,OAAO,CAAC;AAEZ,QAAM,eAAeA,aAAY,OAAO,SAA2C;AACjF,QAAI,CAAC,WAAW;AACd,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AACA,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,YAAM,MAAM;AACZ,eAAS,GAAG;AACZ,gBAAU,GAAG;AACb,aAAO;AAAA,IACT;AAEA,iBAAa,IAAI;AACjB,aAAS,IAAI;AACb,iBAAa,YAAY;AAEzB,QAAI;AACF,iBAAW,KAAK,yBAAyB;AAEzC,YAAM,SAAS,MAAM,aAAa,0BAA0B;AAAA,QAC1D,MAAM,EAAE,WAAW,UAAU,UAAU,KAAK;AAAA,QAC5C,cAAc;AAAA,MAChB,CAAC;AACD,YAAM,WAAW,OAAO;AAExB,YAAM,QAAQ,SAAS;AACvB,qBAAe,KAAK;AACpB,4BAAsB,SAAS,oBAAoB;AACnD,mBAAa,UAAU;AAEvB,iBAAW,KAAK,gDAAgD,MAAM,MAAM;AAE5E,mBAAa,KAAK;AAClB,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,YAAM,eAAe,gBAAgB,KAAK,iCAAiC;AAC3E,qBAAe,YAAY,kCAAkC,GAAG;AAChE,eAAS,YAAY;AACrB,mBAAa,UAAU;AACvB,gBAAU,YAAY;AACtB,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,WAAW,YAAY,OAAO,CAAC;AAEnC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,GA1HiC;;;ACvDjC,SAAS,eAAAC,eAAa,YAAAC,iBAAgB;AAqC/B,IAAM,qBAAqB,6BAAgC;AAChE,QAAM,CAAC,WAAW,YAAY,IAAIC,UAAS,KAAK;AAChD,QAAM,CAAC,OAAO,QAAQ,IAAIA,UAAwB,IAAI;AACtD,QAAM,CAAC,eAAe,gBAAgB,IAAIA,UAAyB,IAAI;AACvE,QAAM,CAAC,SAAS,UAAU,IAAIA,UAA4B,CAAC,CAAC;AAE5D,QAAM,aAAaC,cAAY,MAAM;AACnC,aAAS,IAAI;AAAA,EACf,GAAG,CAAC,CAAC;AAEL,QAAM,cAAcA,cAAY,YAA2B;AACzD,iBAAa,IAAI;AACjB,aAAS,IAAI;AAEb,QAAI;AACF,iBAAW,KAAK,wBAAwB;AAGxC,YAAM,SAAS,MAAM,QAAQ,uBAAuB,EAAE,cAAc,KAAK,CAAC;AAC1E,YAAM,WAAW,OAAO;AAExB,YAAM,gBAAmC,SAAS,QAAQ,IAAI,CAAC,YAAY;AAAA,QACzE,IAAI,OAAO;AAAA,QACX,MAAM,OAAO;AAAA,QACb,WAAW,OAAO;AAAA,QAClB,YAAY,OAAO,gBAAgB;AAAA,QACnC,WAAW,OAAO;AAAA,MACpB,EAAE;AAEF,iBAAW,aAAa;AACxB,uBAAiB,SAAS,eAAe;AAEzC,iBAAW,KAAK,eAAe,SAAS,kBAAkB,YAAY,UAAU;AAAA,IAClF,SAAS,KAAK;AACZ,YAAM,eAAe,gBAAgB,KAAK,4BAA4B;AACtE,qBAAe,YAAY,+BAA+B,GAAG;AAC7D,eAAS,YAAY;AAAA,IACvB,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,aAAaA,cAAY,OAAO,SAAmC;AACvE,QAAI,CAAC,gBAAgB,IAAI,GAAG;AAC1B,eAAS,6BAA6B;AACtC,aAAO;AAAA,IACT;AAEA,iBAAa,IAAI;AACjB,aAAS,IAAI;AAEb,QAAI;AACF,iBAAW,KAAK,kBAAkB;AAElC,YAAM,QAAQ,qBAAqB,EAAE,MAAM,EAAE,KAAK,GAAG,cAAc,KAAK,CAAC;AAEzE,uBAAiB,KAAK;AACtB,iBAAW,CAAC,CAAC;AAEb,iBAAW,KAAK,2BAA2B;AAC3C,aAAO;AAAA,IACT,SAAS,KAAc;AACrB,YAAM,eAAe,gBAAgB,KAAK,2BAA2B;AACrE,qBAAe,YAAY,0BAA0B,GAAG;AACxD,eAAS,YAAY;AACrB,aAAO;AAAA,IACT,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,GAhFkC;;;ACgB3B,IAAM,eAAe,wBAAC,UAA+B,CAAC,MAA0B;AACrF,QAAM,SAAS,mBAAmB,QAAQ,MAAM;AAChD,QAAM,QAAQ,kBAAkB,QAAQ,KAAK;AAC7C,QAAM,SAAS,mBAAmB;AAElC,SAAO,EAAE,QAAQ,OAAO,OAAO;AACjC,GAN4B;;;ACrD5B,SAAS,YAAAC,iBAAgB;AAWlB,SAAS,gBAAmB,KAAa,cAAiB;AAE/D,QAAM,CAAC,aAAa,cAAc,IAAIC,UAAY,MAAM;AACtD,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO;AAAA,IACT;AAEA,QAAI;AACF,YAAM,OAAO,OAAO,aAAa,QAAQ,GAAG;AAC5C,UAAI,SAAS,MAAM;AACjB,eAAO;AAAA,MACT;AAGA,UAAI;AACF,eAAO,KAAK,MAAM,IAAI;AAAA,MACxB,QAAQ;AAEN,eAAO;AAAA,MACT;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,mCAAmC,GAAG,MAAM,KAAK;AAClE,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AAGD,QAAM,eAAe,6BAAM;AACzB,QAAI;AACF,YAAM,OAAO,OAAO,KAAK,YAAY,EAAE,OAAO,CAAAC,SAAOA,QAAO,OAAOA,SAAQ,QAAQ;AAEnF,UAAI,KAAK,SAAS,IAAI;AACpB,cAAM,gBAAgB,KAAK,KAAK,KAAK,SAAS,GAAG;AACjD,iBAAS,IAAI,GAAG,IAAI,eAAe,KAAK;AACtC,cAAI;AACF,kBAAMA,OAAM,KAAK,CAAC;AAClB,gBAAIA,MAAK;AACP,2BAAa,WAAWA,IAAG;AAC3B,2BAAa,WAAW,GAAGA,IAAG,KAAK;AAAA,YACrC;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,yCAAyC,KAAK;AAAA,IACjE;AAAA,EACF,GArBqB;AAwBrB,QAAM,gBAAgB,6BAAM;AAC1B,QAAI;AACF,YAAM,OAAO,OAAO,KAAK,YAAY;AACrC,iBAAWA,QAAO,MAAM;AACtB,YAAI;AACF,uBAAa,WAAWA,IAAG;AAAA,QAC7B,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,sCAAsC,KAAK;AAAA,IAC9D;AAAA,EACF,GAbsB;AAgBtB,QAAM,WAAW,wBAAC,UAA+B;AAC/C,QAAI;AACF,YAAM,eAAe,iBAAiB,WAAW,MAAM,WAAW,IAAI;AAGtE,UAAI,CAAC,kBAAkB,cAAc,GAAG,GAAG;AACzC,mBAAW,KAAK,gCAAgC,GAAG,iBAAiB;AAEpE,YAAI;AACF,iBAAO,aAAa,WAAW,GAAG;AAClC,iBAAO,aAAa,WAAW,GAAG,GAAG,KAAK;AAAA,QAC5C,QAAQ;AAAA,QAER;AAEA,uBAAe,YAAY;AAC3B;AAAA,MACF;AAEA,qBAAe,YAAY;AAE3B,UAAI,OAAO,WAAW,aAAa;AAEjC,YAAI;AAEF,cAAI,OAAO,iBAAiB,UAAU;AACpC,mBAAO,aAAa,QAAQ,KAAK,YAAY;AAAA,UAC/C,OAAO;AACL,mBAAO,aAAa,QAAQ,KAAK,KAAK,UAAU,YAAY,CAAC;AAAA,UAC/D;AAEA,iBAAO,aAAa,QAAQ,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,SAAS,CAAC;AAAA,QAChE,SAAS,cAAuB;AAE9B,cAAI,qBAAqB,YAAY,GAAG;AACtC,uBAAW,KAAK,mDAAmD;AACnE,yBAAa;AAGb,gBAAI;AAEF,kBAAI,OAAO,iBAAiB,UAAU;AACpC,uBAAO,aAAa,QAAQ,KAAK,YAAY;AAAA,cAC/C,OAAO;AACL,uBAAO,aAAa,QAAQ,KAAK,KAAK,UAAU,YAAY,CAAC;AAAA,cAC/D;AACA,qBAAO,aAAa,QAAQ,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,SAAS,CAAC;AAAA,YAChE,SAAS,YAAY;AACnB,yBAAW,MAAM,mCAAmC,GAAG,8BAA8B,UAAU;AAE/F,kBAAI;AACF,8BAAc;AAEd,oBAAI,OAAO,iBAAiB,UAAU;AACpC,yBAAO,aAAa,QAAQ,KAAK,YAAY;AAAA,gBAC/C,OAAO;AACL,yBAAO,aAAa,QAAQ,KAAK,KAAK,UAAU,YAAY,CAAC;AAAA,gBAC/D;AACA,uBAAO,aAAa,QAAQ,GAAG,GAAG,OAAO,KAAK,IAAI,EAAE,SAAS,CAAC;AAAA,cAChE,SAAS,YAAY;AACnB,2BAAW,MAAM,mCAAmC,GAAG,2BAA2B,UAAU;AAE5F,+BAAe,YAAY;AAAA,cAC7B;AAAA,YACF;AAAA,UACF,OAAO;AACL,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,mCAAmC,GAAG,MAAM,KAAK;AAElE,YAAM,eAAe,iBAAiB,WAAW,MAAM,WAAW,IAAI;AACtE,qBAAe,YAAY;AAAA,IAC7B;AAAA,EACF,GA5EiB;AA+EjB,QAAM,cAAc,6BAAM;AACxB,QAAI;AACF,qBAAe,YAAY;AAC3B,UAAI,OAAO,WAAW,aAAa;AACjC,YAAI;AACF,iBAAO,aAAa,WAAW,GAAG;AAClC,iBAAO,aAAa,WAAW,GAAG,GAAG,KAAK;AAAA,QAC5C,SAAS,aAAsB;AAE7B,cAAI,qBAAqB,WAAW,GAAG;AACrC,uBAAW,KAAK,kEAAkE;AAClF,yBAAa;AAEb,gBAAI;AACF,qBAAO,aAAa,WAAW,GAAG;AAClC,qBAAO,aAAa,WAAW,GAAG,GAAG,KAAK;AAAA,YAC5C,SAAS,YAAY;AACnB,yBAAW,MAAM,sCAAsC,GAAG,qBAAqB,UAAU;AAEzF,4BAAc;AAAA,YAChB;AAAA,UACF,OAAO;AACL,kBAAM;AAAA,UACR;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,OAAO;AACd,iBAAW,MAAM,oCAAoC,GAAG,MAAM,KAAK;AAAA,IACrE;AAAA,EACF,GA7BoB;AA+BpB,SAAO,CAAC,aAAa,UAAU,WAAW;AAC5C;AAlLgB;;;ACIT,SAAS,aAAa,MAAsB;AACjD,MAAI,OAAO;AACT,WAAO;AAAA,EACT;AAEA,MAAI;AAEF,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,KAAK,mBAAmB,IAAI,EAAE,QAAQ,mBAAmB,CAAC,GAAG,OAAO;AACzE,eAAO,OAAO,aAAa,SAAS,IAAI,EAAE,CAAC;AAAA,MAC7C,CAAC,CAAC;AAAA,IACJ;AAEA,WAAO,OAAO,KAAK,MAAM,OAAO,EAAE,SAAS,QAAQ;AAAA,EACrD,SAAS,OAAO;AACd,YAAQ,MAAM,0BAA0B,KAAK;AAC7C,WAAO;AAAA,EACT;AACF;AAlBgB;AAyBT,SAAS,aAAa,SAAyB;AACpD,MAAI,OAAO;AACT,WAAO;AAAA,EACT;AAEA,MAAI;AAEF,QAAI,OAAO,WAAW,aAAa;AACjC,YAAM,SAAS,KAAK,OAAO;AAC3B,YAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,eAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,cAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,MAChC;AACA,aAAO;AAAA,QACL,MAAM,KAAK,KAAK,EACb,IAAI,UAAQ,OAAO,OAAO,KAAK,SAAS,EAAE,GAAG,MAAM,EAAE,CAAC,EACtD,KAAK,EAAE;AAAA,MACZ;AAAA,IACF;AAEA,WAAO,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,OAAO;AAAA,EACxD,SAAS,OAAO;AACd,YAAQ,MAAM,0BAA0B,KAAK;AAC7C,WAAO;AAAA,EACT;AACF;AAzBgB;AA+BT,SAAS,YAAY;AAC1B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR;AAAA,EACF;AACF;AANgB;;;ACxDhB,IAAMC,aAAY,SAAS,aAAa;AACxC,IAAM,gBAAgB;AACtB,IAAM,cAAc;AAkBb,SAAS,mBAAgC;AAC9C,MAAI;AACF,QAAI,OAAO,WAAW,YAAa,QAAO;AAE1C,UAAM,SAAS,aAAa,QAAQA,UAAS;AAC7C,QAAI,CAAC,QAAQ;AACX,iBAAc,MAAM,yBAAyB;AAC7C,aAAO;AAAA,IACT;AAGA,UAAM,UAAU,aAAa,MAAM;AACnC,UAAM,aAA4B,KAAK,MAAM,OAAO;AAGpD,QAAI,WAAW,YAAY,eAAe;AACxC,iBAAc,KAAK,wCAAwC;AAC3D,wBAAkB;AAClB,aAAO;AAAA,IACT;AAGA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,MAAM,MAAM,WAAW;AAC7B,QAAI,MAAM,WAAW,KAAK;AACxB,iBAAc,KAAK,yBAAyB;AAC5C,wBAAkB;AAClB,aAAO;AAAA,IACT;AAEA,eAAc,MAAM,mBAAmB,KAAK,MAAM,MAAM,GAAI,GAAG,SAAS;AACxE,WAAO,WAAW;AAAA,EACpB,SAAS,OAAO;AACd,eAAc,MAAM,wBAAwB,KAAK;AACjD,sBAAkB;AAClB,WAAO;AAAA,EACT;AACF;AArCgB;AA4CT,SAAS,iBAAiB,SAAe,SAAqC;AACnF,MAAI;AACF,QAAI,OAAO,WAAW,YAAa;AAEnC,UAAM,aAA4B;AAAA,MAChC,SAAS;AAAA,MACT,MAAM;AAAA,MACN,WAAW,KAAK,IAAI;AAAA,MACpB,KAAK,SAAS,OAAO;AAAA,IACvB;AAGA,UAAM,UAAU,aAAa,KAAK,UAAU,UAAU,CAAC;AACvD,iBAAa,QAAQA,YAAW,OAAO;AACvC,eAAc,MAAM,wBAAwB,WAAW,MAAM,KAAM,SAAS;AAAA,EAC9E,SAAS,OAAO;AACd,eAAc,MAAM,wBAAwB,KAAK;AAAA,EACnD;AACF;AAlBgB;AAuBT,SAAS,oBAA0B;AACxC,MAAI;AACF,QAAI,OAAO,WAAW,YAAa;AACnC,iBAAa,WAAWA,UAAS;AACjC,eAAc,MAAM,eAAe;AAAA,EACrC,SAAS,OAAO;AACd,eAAc,MAAM,yBAAyB,KAAK;AAAA,EACpD;AACF;AARgB;AAaT,SAAS,gBAAyB;AACvC,SAAO,iBAAiB,MAAM;AAChC;AAFgB;AAOT,SAAS,mBAKP;AACP,MAAI;AACF,QAAI,OAAO,WAAW,YAAa,QAAO;AAE1C,UAAM,SAAS,aAAa,QAAQA,UAAS;AAC7C,QAAI,CAAC,OAAQ,QAAO,EAAE,QAAQ,MAAM;AAGpC,UAAM,UAAU,aAAa,MAAM;AACnC,UAAM,aAA4B,KAAK,MAAM,OAAO;AACpD,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,MAAM,MAAM,WAAW;AAC7B,UAAM,YAAY,WAAW,MAAM;AAEnC,WAAO;AAAA,MACL,QAAQ;AAAA,MACR;AAAA,MACA,KAAK,WAAW;AAAA,MAChB,WAAW,KAAK,IAAI,GAAG,SAAS;AAAA,IAClC;AAAA,EACF,SAAS,OAAO;AACd,eAAc,MAAM,2BAA2B,KAAK;AACpD,WAAO;AAAA,EACT;AACF;AA7BgB;;;AC1HhB,SAAS,eAAAC,eAAa,YAAAC,kBAAgB;AAqC/B,IAAM,mBAAmB,6BAA8B;AAC5D,QAAM,CAAC,WAAW,YAAY,IAAIC,WAAS,KAAK;AAChD,QAAM,CAAC,OAAO,QAAQ,IAAIA,WAAwB,IAAI;AACtD,QAAM,EAAE,OAAO,IAAI,QAAQ;AAE3B,QAAM,aAAaC,cAAY,MAAM;AACnC,aAAS,IAAI;AAAA,EACf,GAAG,CAAC,CAAC;AAKL,QAAM,gBAAgBA,cAAY,YAA0C;AAC1E,iBAAa,IAAI;AACjB,aAAS,IAAI;AAEb,QAAI;AACF,iBAAW,KAAK,qBAAqB;AAErC,YAAM,SAAS,MAAM,mBAAmB,+BAA+B,EAAE,cAAc,KAAK,CAAC;AAC7F,YAAM,WAAW,OAAO;AAExB,UAAI,CAAC,SAAS,SAAS;AACrB,mBAAW,MAAM,6BAA6B,SAAS,OAAO;AAC9D,iBAAS,SAAS,OAAO;AACzB,cAAM,IAAI,MAAM,SAAS,OAAO;AAAA,MAClC;AAAA,IACF,SAASC,QAAO;AACd,iBAAW,MAAM,6BAA6BA,MAAK;AACnD,YAAMA;AAAA,IACR,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAEA,UAAM,OAAO;AACb,WAAO,EAAE,SAAS,MAAM,SAAS,+BAA+B;AAAA,EAClE,GAAG,CAAC,MAAM,CAAC;AAEX,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF,GA5CgC;;;AC/BhC,IAAM,oBAAoB;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGO,SAAS,0BAAoC;AAClD,QAAM,UAAoB,CAAC;AAC3B,MAAI;AACF,QAAI,OAAO,WAAW,YAAa,QAAO;AAC1C,eAAW,OAAO,mBAAmB;AACnC,UAAI,OAAO,aAAa,QAAQ,GAAG,MAAM,MAAM;AAC7C,eAAO,aAAa,WAAW,GAAG;AAClC,gBAAQ,KAAK,GAAG;AAAA,MAClB;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAdgB;;;ACaT,SAAS,kBAAkB,GAA+B;AAC/D,MAAI,CAAC,EAAE,YAAa,QAAO;AAC3B,MAAI,EAAE,uBAAuB;AAC3B,WAAO,EAAE,kBAAkB,EAAE,WAAW,kBAAkB;AAAA,EAC5D;AAEA,MAAI,EAAE,sBAAsB,CAAC,EAAE,SAAU,QAAO;AAChD,SAAO;AACT;AARgB;;;ACfhB;AAAA,EACe,eAAAC;AAAA,EAAa;AAAA,EAAY,aAAAC;AAAA,EAAW,WAAAC;AAAA,EAAS,UAAAC;AAAA,EAAQ,YAAAC;AAAA,OAC7D;;;ACXP,OAAO,oBAAoB;;;ACA3B,OAAOC,aAAY;;;ACAnB,OAAOC,qBAAoB;;;ACA3B,OAAOC,qBAAoB;;;ACA3B,OAAOC,aAAY;;;ACAnB,OAAOC,qBAAoB;;;ACA3B,OAAOC,qBAAoB;;;ACA3B,OAAOC,qBAAoB;;;ACA3B,OAAOC,qBAAoB;;;ACA3B,OAAOC,qBAAoB;;;ACA3B,OAAOC,aAAY;;;ACAnB,OAAOC,qBAAoB;AASpB,SAAS,+BACd,QACA;AACA,SAAOC;AAAA,IACL,CAAC,iCAAiC;AAAA,IAClC,OAAO,MAAM,EAAE,IAAI,MAAqB;AACtC,YAAM,MAAM,MAAM,eAAe,4BAA4B,EAAE,GAAG,KAAK,cAAc,KAAK,CAAU;AACpG,YAAM,OAAO,IAAI;AACjB,WAAK,OAAO,mCAA+B,EACxC,KAAK,CAAC,EAAE,yBAAyB,MAAM;AACtC,cAAM,SAAS,yBAAyB,UAAU,IAAI;AACtD,YAAI,OAAO,QAAS;AAGpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,QAAQ,OAAO,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI;AACF,mBAAO;AAAA,cACL,IAAI,YAAY,wBAAwB;AAAA,gBACtC,QAAQ;AAAA,kBACN,WAAW;AAAA,kBACX,QAAQ;AAAA,kBACR,MAAM;AAAA,kBACN,QAAQ,OAAO,MAAM;AAAA,kBACrB;AAAA,kBACA,WAAW,oBAAI,KAAK;AAAA,gBACtB;AAAA,gBACA,SAAS;AAAA,gBACT,YAAY;AAAA,cACd,CAAC;AAAA,YACH;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC;AACH,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AApDgB;;;ACThB,OAAOC,sBAAoB;AASpB,SAAS,8BACd,QACA;AACA,SAAOC;AAAA,IACL,CAAC,gCAAgC;AAAA,IACjC,OAAO,MAAM,EAAE,IAAI,MAAqB;AACtC,YAAM,MAAM,MAAM,eAAe,2BAA2B,EAAE,GAAG,KAAK,cAAc,KAAK,CAAU;AACnG,YAAM,OAAO,IAAI;AACjB,WAAK,OAAO,kCAA8B,EACvC,KAAK,CAAC,EAAE,wBAAwB,MAAM;AACrC,cAAM,SAAS,wBAAwB,UAAU,IAAI;AACrD,YAAI,OAAO,QAAS;AAGpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,QAAQ,OAAO,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI;AACF,mBAAO;AAAA,cACL,IAAI,YAAY,wBAAwB;AAAA,gBACtC,QAAQ;AAAA,kBACN,WAAW;AAAA,kBACX,QAAQ;AAAA,kBACR,MAAM;AAAA,kBACN,QAAQ,OAAO,MAAM;AAAA,kBACrB;AAAA,kBACA,WAAW,oBAAI,KAAK;AAAA,gBACtB;AAAA,gBACA,SAAS;AAAA,gBACT,YAAY;AAAA,cACd,CAAC;AAAA,YACH;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC;AACH,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AApDgB;;;ACThB,OAAOC,sBAAoB;AASpB,SAAS,kCACd,QACA;AACA,SAAOC;AAAA,IACL,CAAC,oCAAoC;AAAA,IACrC,OAAO,MAAM,EAAE,IAAI,MAAqB;AACtC,YAAM,MAAM,MAAM,mBAAmB,+BAA+B,EAAE,GAAG,KAAK,cAAc,KAAK,CAAU;AAC3G,YAAM,OAAO,IAAI;AACjB,WAAK,OAAO,qBAAiB,EAC1B,KAAK,CAAC,EAAE,WAAW,MAAM;AACxB,cAAM,SAAS,WAAW,UAAU,IAAI;AACxC,YAAI,OAAO,QAAS;AAGpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,QAAQ,OAAO,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI;AACF,mBAAO;AAAA,cACL,IAAI,YAAY,wBAAwB;AAAA,gBACtC,QAAQ;AAAA,kBACN,WAAW;AAAA,kBACX,QAAQ;AAAA,kBACR,MAAM;AAAA,kBACN,QAAQ,OAAO,MAAM;AAAA,kBACrB;AAAA,kBACA,WAAW,oBAAI,KAAK;AAAA,gBACtB;AAAA,gBACA,SAAS;AAAA,gBACT,YAAY;AAAA,cACd,CAAC;AAAA,YACH;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC;AACH,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AApDgB;;;ACThB,OAAOC,sBAAoB;;;ACA3B,OAAOC,sBAAoB;;;ACA3B,OAAOC,sBAAoB;AASpB,SAAS,mCACd,QACA;AACA,SAAOC;AAAA,IACL,CAAC,qCAAqC;AAAA,IACtC,OAAO,MAAM,EAAE,IAAI,MAAqB;AACtC,YAAM,MAAM,MAAM,mBAAmB,gCAAgC,EAAE,GAAG,KAAK,cAAc,KAAK,CAAU;AAC5G,YAAM,OAAO,IAAI;AACjB,WAAK,OAAO,qBAAiB,EAC1B,KAAK,CAAC,EAAE,WAAW,MAAM;AACxB,cAAM,SAAS,WAAW,UAAU,IAAI;AACxC,YAAI,OAAO,QAAS;AAGpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,QAAQ,OAAO,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI;AACF,mBAAO;AAAA,cACL,IAAI,YAAY,wBAAwB;AAAA,gBACtC,QAAQ;AAAA,kBACN,WAAW;AAAA,kBACX,QAAQ;AAAA,kBACR,MAAM;AAAA,kBACN,QAAQ,OAAO,MAAM;AAAA,kBACrB;AAAA,kBACA,WAAW,oBAAI,KAAK;AAAA,gBACtB;AAAA,gBACA,SAAS;AAAA,gBACT,YAAY;AAAA,cACd,CAAC;AAAA,YACH;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC;AACH,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AApDgB;;;ACThB,OAAOC,aAAY;;;ACAnB,OAAOC,sBAAoB;;;ACA3B,OAAOC,sBAAoB;AASpB,SAAS,kCACd,QACA;AACA,SAAOC;AAAA,IACL,CAAC,oCAAoC;AAAA,IACrC,OAAO,MAAM,EAAE,IAAI,MAAqB;AACtC,YAAM,MAAM,MAAM,mBAAmB,+BAA+B,EAAE,GAAG,KAAK,cAAc,KAAK,CAAU;AAC3G,YAAM,OAAO,IAAI;AACjB,WAAK,OAAO,qBAAiB,EAC1B,KAAK,CAAC,EAAE,WAAW,MAAM;AACxB,cAAM,SAAS,WAAW,UAAU,IAAI;AACxC,YAAI,OAAO,QAAS;AAGpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,QAAQ,OAAO,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI;AACF,mBAAO;AAAA,cACL,IAAI,YAAY,wBAAwB;AAAA,gBACtC,QAAQ;AAAA,kBACN,WAAW;AAAA,kBACX,QAAQ;AAAA,kBACR,MAAM;AAAA,kBACN,QAAQ,OAAO,MAAM;AAAA,kBACrB;AAAA,kBACA,WAAW,oBAAI,KAAK;AAAA,gBACtB;AAAA,gBACA,SAAS;AAAA,gBACT,YAAY;AAAA,cACd,CAAC;AAAA,YACH;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC;AACH,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AApDgB;;;ACThB,OAAOC,sBAAoB;;;ACA3B,OAAOC,sBAAoB;AASpB,SAAS,0BACd,QACA;AACA,SAAOC;AAAA,IACL,CAAC,2BAA2B;AAAA,IAC5B,OAAO,MAAM,EAAE,IAAI,MAAqB;AACtC,YAAM,MAAM,MAAM,gBAAgB,uBAAuB,EAAE,GAAG,KAAK,cAAc,KAAK,CAAU;AAChG,YAAM,OAAO,IAAI;AACjB,WAAK,OAAO,sCAAkC,EAC3C,KAAK,CAAC,EAAE,4BAA4B,MAAM;AACzC,cAAM,SAAS,4BAA4B,UAAU,IAAI;AACzD,YAAI,OAAO,QAAS;AAGpB,gBAAQ;AAAA,UACN;AAAA,UACA;AAAA,YACE,WAAW;AAAA,YACX,QAAQ;AAAA,YACR,MAAM;AAAA,YACN,QAAQ,OAAO,MAAM;AAAA,YACrB;AAAA,UACF;AAAA,QACF;AACA,YAAI,OAAO,WAAW,aAAa;AACjC,cAAI;AACF,mBAAO;AAAA,cACL,IAAI,YAAY,wBAAwB;AAAA,gBACtC,QAAQ;AAAA,kBACN,WAAW;AAAA,kBACX,QAAQ;AAAA,kBACR,MAAM;AAAA,kBACN,QAAQ,OAAO,MAAM;AAAA,kBACrB;AAAA,kBACA,WAAW,oBAAI,KAAK;AAAA,gBACtB;AAAA,gBACA,SAAS;AAAA,gBACT,YAAY;AAAA,cACd,CAAC;AAAA,YACH;AAAA,UACF,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,CAAC,EACA,MAAM,MAAM;AAAA,MAEb,CAAC;AACH,aAAO;AAAA,IACT;AAAA,IACA;AAAA,EACF;AACF;AApDgB;;;ACThB,OAAOC,sBAAoB;;;ACN3B,SAAS,qBAAmC;AAWrC,SAAS,cAAiB,KAAa,SAAwB;AACpE,QAAM,IAAI;AACV,QAAM,WAAY,EAAE,sBAAsB,CAAC;AAC3C,SAAQ,SAAS,GAAG,MAAM,cAAuB,OAAO;AAC1D;AAJgB;;;AxBuRZ;AA1PJ,SAAS,eAAwB;AAC/B,MAAI;AACF,QAAI,OAAO,YAAY,eAAe,CAAC,QAAQ,IAAK,QAAO;AAC3D,QAAI,QAAQ,IAAI,6BAA6B,OAAQ,QAAO;AAC5D,QAAI,QAAQ,IAAI,8BAA8B,OAAW,QAAO;AAChE,WAAO,QAAQ,QAAQ,IAAI,mBAAmB;AAAA,EAChD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AATS;AA+CT,IAAM,kBAAkB,cAAgD,YAAY,MAAS;AAMtF,SAAS,iBAAiB,EAAE,SAAS,GAA0B;AACpE,QAAM,CAAC,SAAS,UAAU,IAAIC,WAA2B,MAAM;AAG7D,QAAI,CAAC,KAAK,gBAAgB,GAAG;AAC3B,wBAAkB;AAClB,aAAO;AAAA,IACT;AACA,UAAM,SAAS,iBAAiB;AAChC,WAAO,UAAU;AAAA,EACnB,CAAC;AACD,QAAM,CAAC,kBAAkB,mBAAmB,IAAIA,WAAS,KAAK;AAC9D,QAAM,CAAC,cAAc,eAAe,IAAIA,WAAuB,IAAI;AAEnE,QAAM,aAAaC,QAAyB,OAAO;AACnD,QAAM,eAAeA,QAAO,KAAK;AAGjC,QAAM,cAAcA,QAAO,CAAC;AAE5B,EAAAC,WAAU,MAAM;AACd,eAAW,UAAU;AAAA,EACvB,GAAG,CAAC,OAAO,CAAC;AAEZ,EAAAA,WAAU,MAAM;AACd,iBAAa,UAAU;AAAA,EACzB,GAAG,CAAC,gBAAgB,CAAC;AAErB,QAAM,EAAE,SAAS,qBAAqB,IAAI,kCAAkC;AAC5E,QAAM,EAAE,SAAS,4BAA4B,IAAI,mCAAmC;AACpF,QAAM,EAAE,SAAS,cAAc,IAAI,kCAAkC;AACrE,QAAM,EAAE,SAAS,kBAAkB,IAAI,+BAA+B;AACtE,QAAM,EAAE,SAAS,iBAAiB,IAAI,8BAA8B;AACpE,QAAM,EAAE,SAAS,qBAAqB,IAAI,0BAA0B;AAEpE,QAAM,iBAAiBC,cAAY,OAAO,YAAgF;AACxH,UAAM,EAAE,UAAU,MAAM,IAAI,WAAW,CAAC;AAMxC,QAAI,CAAC,aAAa,GAAG;AACnB,iBAAW,MAAM,6DAA6D,QAAQ,GAAG;AACzF,aAAO;AAAA,IACT;AAMA,QAAI,aAAa,WAAW,CAAC,OAAO;AAClC,iBAAW,MAAM,kDAAkD,QAAQ,GAAG;AAC9E,aAAO,WAAW;AAAA,IACpB;AAEA,UAAM,MAAM,EAAE,YAAY;AAC1B,wBAAoB,IAAI;AACxB,iBAAa,UAAU;AACvB,oBAAgB,IAAI;AACpB,QAAI;AACF,iBAAW,MAAM,sCAAsC,QAAQ,YAAY,KAAK,GAAG;AACnF,YAAM,MAAM,MAAM,mBAAmB,2BAA2B,EAAE,cAAc,KAAK,CAAC;AACtF,YAAM,SAAS,IAAI;AAGnB,UAAI,QAAQ,YAAY,QAAS,QAAO;AACxC,iBAAW,MAAM;AACjB,iBAAW,UAAU;AACrB,uBAAiB,MAAM;AACvB,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,MAAM,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,yBAAyB;AAChF,UAAI,QAAQ,YAAY,QAAS,iBAAgB,GAAG;AACpD,YAAM;AAAA,IACR,UAAE;AACA,UAAI,QAAQ,YAAY,SAAS;AAC/B,4BAAoB,KAAK;AACzB,qBAAa,UAAU;AAAA,MACzB;AAAA,IACF;AAAA,EACF,GAAG,CAAC,CAAC;AAML,QAAM,gBAAgBA,cAAY,OAAO,SAA8C;AACrF,UAAM,qBAAqB,EAAE,MAAM,KAAK,CAAC;AACzC,UAAM,OAAO,MAAM,eAAe,EAAE,UAAU,iBAAiB,OAAO,KAAK,CAAC;AAC5E,WAAO;AAAA,EACT,GAAG,CAAC,sBAAsB,cAAc,CAAC;AAEzC,QAAM,uBAAuBA,cAAY,OAAO,SAAqD;AACnG,UAAM,4BAA4B,EAAE,MAAM,KAAK,CAAC;AAChD,UAAM,OAAO,MAAM,eAAe,EAAE,UAAU,wBAAwB,OAAO,KAAK,CAAC;AACnF,WAAO;AAAA,EACT,GAAG,CAAC,6BAA6B,cAAc,CAAC;AAEhD,QAAM,eAAeA,cAAY,OAAO,WAAuC;AAC7E,UAAM,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACxC,UAAM,OAAO,MAAM,eAAe,EAAE,UAAU,gBAAgB,OAAO,KAAK,CAAC;AAC3E,WAAO;AAAA,EACT,GAAG,CAAC,eAAe,cAAc,CAAC;AAElC,QAAM,aAAaA,cAAY,OAAO,SAAyD;AAC7F,UAAM,SAAS,MAAM,kBAAkB,EAAE,MAAM,KAAK,CAAC;AACrD,WAAO;AAAA,EACT,GAAG,CAAC,iBAAiB,CAAC;AAKtB,QAAM,sBAAsBA,cAAY,OACtC,QACA,aACkB;AAClB,QAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,iBAAW,KAAK,0BAA0B,OAAO,UAAU;AAC3D;AAAA,IACF;AAEA,QAAI,OAAO,UAAU,OAAO,SAAS;AAKnC,gBAAU,sBAAsB;AAChC,WAAK,WAAW,EAAE,QAAQ,OAAO,QAAQ,SAAS,OAAO,QAAQ,CAAC;AAClE,UAAI;AACF,cAAM,eAAe,EAAE,UAAU,OAAO,KAAK,CAAC;AAAA,MAChD,SAASC,eAAc;AACrB,mBAAW,KAAK,gCAAgC,QAAQ,wBAAwBA,aAAY;AAAA,MAC9F;AAAA,IACF;AAAA,EACF,GAAG,CAAC,cAAc,CAAC;AAEnB,QAAM,YAAYD,cAAY,OAAO,SAAuD;AAC1F,UAAM,SAAU,MAAM,iBAAiB,EAAE,MAAM,KAAK,CAAC;AACrD,UAAM,oBAAoB,QAAQ,WAAW;AAC7C,WAAO;AAAA,EACT,GAAG,CAAC,kBAAkB,mBAAmB,CAAC;AAE1C,QAAM,oBAAoBA,cAAY,OACpC,SACmC;AAGnC,UAAM,SAAU,MAAM,qBAAqB,EAAE,MAAM,KAAK,CAAC;AACzD,UAAM,oBAAoB,QAAQ,mBAAmB;AACrD,WAAO;AAAA,EACT,GAAG,CAAC,sBAAsB,mBAAmB,CAAC;AAE9C,QAAM,SAASA,cAAY,MAAM;AAI/B,UAAME,WAAU,KAAK,gBAAgB;AACrC,QAAIA,UAAS;AACX,sBAAgB,gCAAgC,EAAE,MAAM,EAAE,SAAAA,SAAQ,EAAE,CAAC,EAAE,MAAM,MAAM;AACjF,mBAAW,KAAK,4DAA4D;AAAA,MAC9E,CAAC;AAAA,IACH;AACA,cAAU,iBAAiB;AAC3B,SAAK,aAAa;AAClB,eAAW,MAAS;AACpB,oBAAgB,IAAI;AACpB,sBAAkB;AAAA,EACpB,GAAG,CAAC,CAAC;AAEL,QAAM,QAA8BC,SAAQ,OAAO;AAAA,IACjD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAAA,IACF;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AAED,SACE,oBAAC,gBAAgB,UAAhB,EAAyB,OACvB,UACH;AAEJ;AAzMgB;AA2MT,SAAS,qBAA2C;AACzD,QAAMC,WAAU,WAAW,eAAe;AAC1C,MAAI,CAACA,UAAS;AACZ,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACA,SAAOA;AACT;AANgB;;;AlD4UP,SASc,UATd,OAAAC,YAAA;AAzjBT,IAAM,gBAAgB;AAAA,EACpB,MAAM;AAAA,EACN,iBAAiB;AAAA,EACjB,qBAAqB;AACvB;AAGO,IAAM,oBAAoB,wBAC/B,YACI;AAAA,EACJ,MAAM,QAAQ,QAAQ,cAAc;AAAA,EACpC,iBAAiB,QAAQ,mBAAmB,cAAc;AAAA,EAC1D,qBAAqB,QAAQ,uBAAuB,QAAQ,QAAQ,cAAc;AACpF,IANiC;AAQjC,IAAM,oBAAoB,SAAS,MAAM;AAEzC,IAAM,cAAc,cAA2C,QAAQ,MAAS;AAEhF,IAAM,uBAAoD,wBAAC,EAAE,UAAU,OAAO,MAAM;AAClF,QAAM,WAAW,mBAAmB;AACpC,QAAM,UAAU,WAAW;AAC3B,QAAM,kBAAkB,QAAQ,WAAW;AAE3C,QAAM,SAAS,aAAa;AAC5B,QAAM,WAAWC,aAAY;AAC7B,QAAM,cAAc,eAAe;AACnC,QAAM,CAAC,aAAa,gBAAgB,gBAAgB,IAAI;AAAA,IACtD;AAAA,IACA;AAAA,EACF;AAIA,QAAM,SAASC,SAAQ,MAAM,kBAAkB,QAAQ,MAAM,GAAG,CAAC,QAAQ,MAAM,CAAC;AAChF,QAAM,YAAYC,QAAO,MAAM;AAC/B,EAAAC,WAAU,MAAM;AACd,cAAU,UAAU;AAAA,EACtB,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,kBAAkB,uBAAuB;AAAA,IAC7C,aAAa,OAAO;AAAA,IACpB,YAAY;AAAA,EACd,CAAC;AAED,QAAM,YAAYD,QAAO,MAAM;AAC/B,EAAAC,WAAU,MAAM;AACd,cAAU,UAAU;AAAA,EACtB,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,cAAcD,QAAO,QAAQ;AACnC,EAAAC,WAAU,MAAM;AACd,gBAAY,UAAU;AAAA,EACxB,GAAG,CAAC,QAAQ,CAAC;AAOb,QAAM,sBAAsBD,QAAO,KAAK;AAOxC,QAAM,CAAC,gBAAgB,iBAAiB,IAAIE,WAAS,KAAK;AAC1D,QAAM,aAAa,QAAQ,SAAS,OAAO;AAC3C,QAAM,sBAAsBF,QAAO,KAAK;AAExC,EAAAC,WAAU,MAAM;AACd,QAAI,CAAC,iBAAiB;AACpB,0BAAoB,UAAU;AAY9B,YAAM,YAAY,QAAQ,KAAK,SAAS,KAAK,KAAK,gBAAgB,CAAC;AACnE,UAAI,aAAa,CAAC,KAAK,gBAAgB,GAAG;AACxC,mBAAW,KAAK,yCAAoC;AACpD,kBAAU,mBAAmB,EAAE,KAAK,cAAc,CAAC;AACnD,aAAK,aAAa;AAClB,0BAAkB;AAAA,MACpB,WAAW,CAAC,aAAa,CAAC,KAAK,gBAAgB,GAAG;AAGhD,kBAAU,mBAAmB,EAAE,KAAK,aAAa,CAAC;AAClD,0BAAkB;AAClB,gCAAwB;AACxB,YAAI,YAAY,QAAQ,QAAS,aAAY,QAAQ,OAAO;AAAA,MAC9D;AACA,wBAAkB,IAAI;AACtB;AAAA,IACF;AACA,QAAI,cAAc,oBAAoB,SAAS;AAC7C,wBAAkB,IAAI;AACtB;AAAA,IACF;AACA,wBAAoB,UAAU;AAC9B,cAAU,yBAAyB;AACnC,QAAI,YAAY;AAChB,gBAAY,QACT,eAAe,EAAE,UAAU,yBAAyB,CAAC,EACrD,MAAM,CAAC,UAAmB;AAIzB,iBAAW,KAAK,uCAAuC,KAAK;AAC5D,gBAAU,4BAA4B;AAAA,QACpC,QAAQ,iBAAiB,WAAW,MAAM,aAAa;AAAA,MACzD,CAAC;AAAA,IACH,CAAC,EACA,QAAQ,MAAM;AACb,UAAI,CAAC,UAAW,mBAAkB,IAAI;AAAA,IACxC,CAAC;AACH,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,iBAAiB,UAAU,CAAC;AAEhC,QAAM,YAAY,CAAC;AAKnB,QAAM,CAAC,aAAa,cAAc,IAAIC,WAAS,KAAK;AACpD,QAAM,CAAC,UAAU,WAAW,IAAIA,WAAS,KAAK;AAC9C,EAAAD,WAAU,MAAM;AACd,mBAAe,IAAI;AACnB,UAAM,QAAQ,WAAW,MAAM,YAAY,IAAI,GAAG,GAAI;AACtD,WAAO,MAAM,aAAa,KAAK;AAAA,EACjC,GAAG,CAAC,CAAC;AACL,QAAM,SAAS,kBAAkB;AAAA,IAC/B;AAAA,IACA,uBAAuB;AAAA,IACvB,oBAAoBE,aAAY,KAAK,gBAAgB,IAAI;AAAA,IACzD;AAAA,IACA;AAAA,EACF,CAAC;AACD,QAAM,gBAAgBH,QAAe,EAAE;AACvC,EAAAC,WAAU,MAAM;AACd,QAAI,cAAc,YAAY,OAAQ;AACtC,kBAAc,UAAU;AACxB,cAAU,UAAU;AAAA,MAClB;AAAA,MACA,UAAU;AAAA,MACV,OAAO,KAAK,gBAAgB;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,MAAM,YAAY;AAAA,IACpB,CAAC;AAAA,EACH,GAAG,CAAC,QAAQ,iBAAiB,gBAAgB,UAAU,QAAQ,CAAC;AAChE,EAAAA,WAAU,MAAM;AACd,IAAC,WAAuC,eAAe,OAAO;AAAA,MAC5D;AAAA,MACA,UAAU;AAAA,MACV,OAAO,KAAK,gBAAgB;AAAA,MAC5B,UAAU,QAAQ,KAAK,SAAS,CAAC;AAAA,MACjC,YAAY,QAAQ,KAAK,gBAAgB,CAAC;AAAA,MAC1C;AAAA,MACA;AAAA,IACF;AAAA,EACF,GAAG,CAAC,QAAQ,iBAAiB,gBAAgB,QAAQ,CAAC;AAOtD,EAAAA,WAAU,MAAM;AACd,UAAM,cAAc,KAAK,iBAAiB,MAAM;AAC9C,gBAAU,mBAAmB,EAAE,MAAM,YAAY,GAAG,CAAC;AACrD,iBAAW,KAAK,4DAAuD;AACvE,wBAAkB;AAClB,gBAAU,yDAA2C;AAAA,QACnD;AAAA,MACF,CAAC;AACD,aAAO,YAAY,UAAU,QAAQ,mBAAmB;AAAA,IAC1D,CAAC;AACD,WAAO;AAAA,EACT,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAOrB,EAAAA,WAAU,MAAM;AACd,QAAI,CAAC,mBAAmB,oBAAoB,QAAS;AACrD,QAAI,aAAa,OAAO,QAAQ,CAAC,YAAY,IAAI,MAAM,GAAG;AACxD,YAAM,QAAQ,gBAAgB,YAAY,IAAI,gBAAgB,YAAY,IAAI;AAC9E,UAAI,MAAO,iBAAgB,cAAc;AACzC,gBAAU,cAAc,EAAE,IAAI,SAAS,OAAO,iBAAiB,OAAO,QAAQ,KAAK,EAAE,CAAC;AACtF,aAAO,KAAK,SAAS,OAAO,eAAe;AAAA,IAC7C;AAAA,EACF,GAAG,CAAC,iBAAiB,UAAU,aAAa,QAAQ,QAAQ,eAAe,CAAC;AAI5E,QAAM,qBAAqBG,cAAY,OAAO,aAAqC;AACjF,QAAI,CAAC,KAAK,gBAAgB,GAAG;AAC3B,YAAM,IAAI,MAAM,+BAA+B;AAAA,IACjD;AACA,UAAM,YAAY,QAAQ,eAAe;AAAA,MACvC,UAAU,YAAY;AAAA,IACxB,CAAC;AAAA,EACH,GAAG,CAAC,CAAC;AAEL,QAAM,uBAAuBA,cAAY,YAA2B;AAClE,QAAI,KAAK,gBAAgB,GAAG;AAC1B,UAAI;AACF,cAAM,mBAAmB,sBAAsB;AAAA,MACjD,SAAS,OAAO;AACd,mBAAW,KAAK,6CAA6C,KAAK;AAAA,MACpE;AACA,aAAO,KAAK,UAAU,QAAQ,eAAe;AAAA,IAC/C,OAAO;AACL,aAAO,KAAK,UAAU,QAAQ,mBAAmB;AAAA,IACnD;AAAA,EACF,GAAG,CAAC,oBAAoB,MAAM,CAAC;AAI/B,QAAM,aAAaA;AAAA,IACjB,OAAO,YAAoB,WAAoB,YAA2D;AAExG,gBAAU,aAAa;AACvB,WAAK,aAAa;AAElB,UAAI;AACF,cAAM,OAA0B;AAAA,UAC9B;AAAA,UACA,YAAY;AAAA;AAAA;AAAA,UAGZ,GAAI,WAAW;AAAA,YACb,mBAAmB,QAAQ;AAAA,YAC3B,4BAA4B,QAAQ;AAAA,UACtC;AAAA,QACF;AACA,cAAM,SAAS,MAAM,YAAY,QAAQ,WAAW,IAAI;AAExD,kBAAU,iDAAuC;AAAA,UAC/C;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AAED,eAAO;AAAA,UACL,SAAS;AAAA,UACT,SAAS,OAAO,WAAW;AAAA,UAC3B,SAAS,OAAO,WAAW;AAAA,UAC3B,UAAU,OAAO;AAAA,QACnB;AAAA,MACF,SAAS,OAAO;AACd,uBAAe,YAAY,uBAAuB,KAAK;AAEvD,YAAI,iBAAiB,UAAU;AAC7B,gBAAM,OAAO,MAAM;AAGnB,gBAAM,aAAa,MAAM,eAAe,MAAM;AAC9C,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,YAAY,MAAM;AAAA,YAClB,SAAS,gBAAgB,KAAK;AAAA,YAC9B,YAAY,OAAO,eAAe,WAAW,aAAa;AAAA,UAC5D;AAAA,QACF;AACA,eAAO,EAAE,SAAS,OAAO,SAAS,gBAAgB,OAAO,oBAAoB,EAAE;AAAA,MACjF;AAAA,IACF;AAAA,IACA,CAAC;AAAA,EACH;AAEA,QAAM,YAAYA;AAAA,IAChB,OACE,YACA,SACA,WACA,aACA,iBAQI;AACJ,UAAI;AAGF,4BAAoB,UAAU,QAAQ,YAAY;AAClD,kBAAU,cAAc,EAAE,cAAc,QAAQ,YAAY,EAAE,CAAC;AAE/D,cAAM,SAAS,MAAM,YAAY,QAAQ,UAAU;AAAA,UACjD;AAAA,UACA,KAAK;AAAA,UACL,YAAY;AAAA,QACd,CAAC;AAED,YAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,qBAAW,KAAK,0BAA0B,OAAO,UAAU;AAC3D,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,SAAS;AAAA,YACT,cAAc;AAAA,YACd,YAAY,OAAO;AAAA,YACnB,mBAAmB,OAAO;AAAA,UAC5B;AAAA,QACF;AAEA,YAAI,CAAC,OAAO,UAAU,CAAC,OAAO,SAAS;AACrC,qBAAW,MAAM,yCAAyC,MAAM;AAChE,iBAAO,EAAE,SAAS,OAAO,SAAS,oCAAoC;AAAA,QACxE;AACA,YAAI,WAAW,SAAS,GAAG,GAAG;AAC5B,yBAAe,UAAU;AAAA,QAC3B;AAEA,kBAAU,qDAAyC;AAAA,UACjD;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,YAAI,OAAO,MAAM,IAAI;AACnB,oBAAU,QAAQ,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,QAC1C;AAEA,YAAI,CAAC,cAAc;AAIjB,gBAAM,QAAQ,gBAAgB,YAAY,IAAI,gBAAgB,YAAY,IAAI;AAC9E,cAAI,MAAO,iBAAgB,cAAc;AACzC,gBAAM,mBAAmB,SAAS,eAAe,UAAU,QAAQ;AACnE,qBAAW,KAAK,8BAA8B,gBAAgB;AAC9D,iBAAO,SAAS,gBAAgB;AAAA,QAClC;AAEA,eAAO;AAAA,UACL,SAAS;AAAA,UACT,SAAS;AAAA,UACT,MAAM,OAAO;AAAA,UACb,mBAAmB,OAAO;AAAA,QAC5B;AAAA,MACF,SAAS,OAAO;AACd,uBAAe,YAAY,sBAAsB,KAAK;AACtD,kBAAU,yDAA2C;AAAA,UACnD;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,YAAI,iBAAiB,UAAU;AAC7B,iBAAO,EAAE,SAAS,OAAO,SAAS,gBAAgB,KAAK,EAAE;AAAA,QAC3D;AACA,eAAO,EAAE,SAAS,OAAO,SAAS,gBAAgB,OAAO,sBAAsB,EAAE;AAAA,MACnF;AAAA,IACF;AAAA,IACA,CAAC,gBAAgB,iBAAiB,MAAM;AAAA,EAC1C;AAOA,QAAM,QAAQA;AAAA,IACZ,OACE,OACA,UACA,YACiC;AACjC,YAAM,EAAE,aAAa,aAAa,IAAI,WAAW,CAAC;AAElD,UAAI;AAGF,4BAAoB,UAAU,QAAQ,YAAY;AAClD,kBAAU,kBAAkB,EAAE,cAAc,QAAQ,YAAY,EAAE,CAAC;AAEnE,cAAM,SAAS,MAAM,YAAY,QAAQ,kBAAkB;AAAA,UACzD;AAAA,UACA;AAAA,QACF,CAAC;AAED,YAAI,OAAO,gBAAgB,OAAO,YAAY;AAC5C,qBAAW,KAAK,0BAA0B,OAAO,UAAU;AAC3D,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,SAAS;AAAA,YACT,cAAc;AAAA,YACd,YAAY,OAAO;AAAA,YACnB,mBAAmB,OAAO;AAAA,UAC5B;AAAA,QACF;AAEA,YAAI,CAAC,OAAO,UAAU,CAAC,OAAO,SAAS;AACrC,qBAAW,MAAM,6CAA6C,MAAM;AACpE,iBAAO,EAAE,SAAS,OAAO,SAAS,yBAAyB;AAAA,QAC7D;AACA,uBAAe,KAAK;AAEpB,kBAAU,qDAAyC;AAAA,UACjD;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,YAAI,OAAO,MAAM,IAAI;AACnB,oBAAU,QAAQ,OAAO,OAAO,KAAK,EAAE,CAAC;AAAA,QAC1C;AAEA,YAAI,CAAC,cAAc;AAIjB,gBAAM,QAAQ,gBAAgB,YAAY,IAAI,gBAAgB,YAAY,IAAI;AAC9E,cAAI,MAAO,iBAAgB,cAAc;AACzC,gBAAM,mBAAmB,SAAS,eAAe,UAAU,QAAQ;AACnE,qBAAW,KAAK,8BAA8B,gBAAgB;AAC9D,iBAAO,SAAS,gBAAgB;AAAA,QAClC;AAEA,eAAO;AAAA,UACL,SAAS;AAAA,UACT,SAAS;AAAA,UACT,MAAM,OAAO;AAAA,UACb,mBAAmB,OAAO;AAAA,QAC5B;AAAA,MACF,SAAS,OAAO;AACd,uBAAe,YAAY,0BAA0B,KAAK;AAC1D,kBAAU,iEAA+C;AAAA,UACvD;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,YAAI,iBAAiB,UAAU;AAG7B,gBAAM,OAAO,MAAM;AAGnB,iBAAO;AAAA,YACL,SAAS;AAAA,YACT,YAAY,MAAM;AAAA,YAClB,SAAS,gBAAgB,KAAK;AAAA,YAC9B,WAAW,MAAM;AAAA,YACjB,YAAY,OAAO,MAAM,gBAAgB,WAAW,KAAK,cAAc;AAAA,UACzE;AAAA,QACF;AACA,eAAO,EAAE,SAAS,OAAO,SAAS,gBAAgB,OAAO,mBAAmB,EAAE;AAAA,MAChF;AAAA,IACF;AAAA,IACA,CAAC,gBAAgB,iBAAiB,MAAM;AAAA,EAC1C;AAIA,QAAM,eAAeA,cAAY,YAA4D;AAG3F,UAAM,SAAS,MAAM,KAAK,WAAW;AACrC,QAAI,QAAQ;AACV,gBAAU,qDAAyC;AAAA,QACjD;AAAA,MACF,CAAC;AACD,aAAO,EAAE,SAAS,MAAM,SAAS,kBAAkB;AAAA,IACrD;AACA,cAAU,+DAA8C;AAAA,MACtD;AAAA,IACF,CAAC;AACD,WAAO,EAAE,SAAS,OAAO,SAAS,yBAAyB;AAAA,EAC7D,GAAG,CAAC,CAAC;AAEL,QAAM,SAASA,cAAY,MAAY;AACrC,cAAU,QAAQ;AAClB,cAAU,uCAAkC;AAAA,MAC1C;AAAA,IACF,CAAC;AACD,gBAAY,QAAQ,OAAO;AAG3B,WAAO,YAAY,UAAU,QAAQ,mBAAmB;AAAA,EAC1D,GAAG,CAAC,MAAM,CAAC;AAIX,QAAM,OAAQ,SAAS,WAAuC;AAC9D,QAAM,cAAc,QAAQ,MAAM,YAAY,MAAM,YAAY;AAIhE,EAAAH,WAAU,MAAM;AACd,uBAAmB,EAAE,SAAS,YAAY,CAAC;AAAA,EAC7C,GAAG,CAAC,WAAW,CAAC;AAEhB,QAAM,gBAAgBG;AAAA,IACpB,OAAO,SAIqB;AAC1B,YAAM,SAAS,MAAM,YAAY,QAAQ,qBAAqB,IAAI;AAClE,aAAO;AAAA,IACT;AAAA,IACA,CAAC;AAAA,EACH;AAEA,QAAM,eAAeA,cAAY,OAAO,WAA8C;AACpF,UAAM,SAAS,MAAM,YAAY,QAAQ,aAAa,MAAM;AAC5D,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,QAAM,QAAQL;AAAA,IACZ,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA,MAGA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,6BAAM,KAAK,SAAS,GAApB;AAAA,MACV,iBAAiB,6BAAM,KAAK,gBAAgB,GAA3B;AAAA,MACjB,eAAe,6BAAM,aAAN;AAAA,MACf,WAAW;AAAA,MACX,iBAAiB;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB,gBAAgB;AAAA,MACjC,gBAAgB,gBAAgB;AAAA,MAChC,kBAAkB,gBAAgB;AAAA,MAClC,gBAAgB,gBAAgB;AAAA,MAChC;AAAA,MACA;AAAA,IACF;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO,gBAAAF,KAAC,YAAY,UAAZ,EAAqB,OAAe,UAAS;AACvD,GAviB0D;AA8iB1D,SAAS,gBAAgB,EAAE,UAAU,QAAQ,UAAU,KAAK,GAAsB;AAChF,MAAI,CAAC,QAAS,QAAO,gBAAAA,KAAA,YAAG,UAAS;AACjC,SACE,gBAAAA,KAAC,oBACC,0BAAAA,KAAC,wBAAqB,QAAiB,UAAS,GAClD;AAEJ;AAPS;AASF,IAAM,eAAe,KAAK,eAAe;AAMhD,IAAM,mBAAoC;AAAA,EACxC,MAAM;AAAA,EACN,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,QAAQ,kBAAkB;AAAA,EAC1B,oBAAoB,mCAAY;AAC9B,eAAW,KAAK,yDAAyD;AAAA,EAC3E,GAFoB;AAAA,EAGpB,sBAAsB,mCAAY;AAChC,eAAW,KAAK,2DAA2D;AAAA,EAC7E,GAFsB;AAAA,EAGtB,UAAU,6BAAM,MAAN;AAAA,EACV,iBAAiB,6BAAM,MAAN;AAAA,EACjB,eAAe,6BAAM,MAAN;AAAA,EACf,WAAW,6BAAM;AACf,eAAW,KAAK,gDAAgD;AAAA,EAClE,GAFW;AAAA,EAGX,iBAAiB,6BAAM;AAAA,EAAC,GAAP;AAAA,EACjB,YAAY,mCAAY;AACtB,eAAW,KAAK,iDAAiD;AACjE,WAAO,EAAE,SAAS,OAAO,SAAS,6BAA6B;AAAA,EACjE,GAHY;AAAA,EAIZ,WAAW,mCAAY;AACrB,eAAW,KAAK,gDAAgD;AAChE,WAAO,EAAE,SAAS,OAAO,SAAS,6BAA6B;AAAA,EACjE,GAHW;AAAA,EAIX,OAAO,mCAAY;AACjB,eAAW,KAAK,4CAA4C;AAC5D,WAAO,EAAE,SAAS,OAAO,SAAS,6BAA6B;AAAA,EACjE,GAHO;AAAA,EAIP,cAAc,mCAAY;AACxB,eAAW,KAAK,mDAAmD;AACnE,WAAO,EAAE,SAAS,OAAO,SAAS,6BAA6B;AAAA,EACjE,GAHc;AAAA,EAId,QAAQ,6BAAM;AACZ,eAAW,KAAK,6CAA6C;AAAA,EAC/D,GAFQ;AAAA,EAGR,iBAAiB,6BAAM;AAAA,EAAC,GAAP;AAAA,EACjB,gBAAgB,6BAAM,IAAN;AAAA,EAChB,kBAAkB,6BAAM;AAAA,EAAC,GAAP;AAAA,EAClB,gBAAgB,6BAAM,OAAN;AAAA,EAChB,eAAe,mCAAY;AACzB,eAAW,KAAK,oDAAoD;AACpE,WAAO,CAAC;AAAA,EACV,GAHe;AAAA,EAIf,cAAc,mCAAY;AACxB,eAAW,KAAK,mDAAmD;AACnE,WAAO,CAAC;AAAA,EACV,GAHc;AAIhB;AAQO,IAAM,UAAU,6BAAuB;AAC5C,QAAMQ,WAAUC,YAAW,WAAW;AACtC,MAAID,aAAY,QAAW;AACzB,QAAIF,cAAa,OAAO;AACtB,iBAAW,MAAM,8DAA8D;AAAA,IACjF;AACA,WAAO;AAAA,EACT;AACA,SAAOE;AACT,GATuB;AAWvB,IAAO,sBAAQ;;;A2E9sBR,IAAM,gBAAgB,wBAAC,UAA2B;AACvD,QAAM,aAAa;AACnB,SAAO,WAAW,KAAK,KAAK;AAC9B,GAH6B;;;ACsCtB,SAAS,YAAY,GAAwB;AAClD,SAAO;AAAA,IACL,EAAE,WACF,EAAE,eACF,EAAE,gBACF,CAAC,EAAE,eACH,EAAE,mBACF,CAAC,EAAE;AAAA,EACL;AACF;AATgB;AAeT,SAAS,sBAAsB,GAAwB;AAC5D,MAAI,CAAC,EAAE,QAAS,QAAO;AACvB,MAAI,CAAC,EAAE,YAAa,QAAO;AAC3B,MAAI,YAAY,CAAC,EAAG,QAAO;AAC3B,SAAO,EAAE,eAAe,EAAE,iBAAiB,CAAC,EAAE;AAChD;AALgB;AAYT,SAAS,qBAAqB,GAAwB;AAC3D,SACE,EAAE,WACF,EAAE,eACF,CAAC,EAAE,eACH,CAAC,EAAE,mBACH,CAAC,EAAE;AAEP;AARgB;AAWT,SAAS,4BAA4B,GAAiE;AAC3G,SAAO,CAAC,EAAE,eAAe,EAAE;AAC7B;AAFgB;;;AC/ChB,iBAAiB;","names":["k","f","auth","usePathname","useCallback","useContext","useEffect","useMemo","useRef","useState","hasWindow","memory","createStorage","sink","refresh","backend","client","isBrowser","dpopEnabled","useSyncExternalStore","useSyncExternalStore","useCallback","useCallback","refresh","useCallback","useEffect","useRef","useState","useState","useRef","useCallback","useEffect","useCallback","validateIdentifier","useCallback","useCallback","useEffect","useRef","createConsola","createConsola","usePathname","useEffect","useRef","usePathname","useRef","useEffect","useSyncExternalStore","listeners","subscribe","useSyncExternalStore","useRef","validateIdentifier","useCallback","useEffect","useCallback","useEffect","useRef","useState","joinedValues","auth","auth","config","request","url","AnalyticsEvent","AnalyticsCategory","OAuthErrorCodeEnum","record","useState","useState","key","useRef","useState","useEffect","useCallback","useMemo","useState","useSyncExternalStore","subscribe","useSyncExternalStore","useState","useMemo","useCallback","useCallback","useCallback","useState","useState","useCallback","useCallback","useState","useState","useCallback","useCallback","useState","useState","useCallback","useState","useState","key","CACHE_KEY","useCallback","useState","useState","useCallback","error","useCallback","useEffect","useMemo","useRef","useState","useSWR","useSWRMutation","useSWRMutation","useSWR","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWR","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWR","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useSWRMutation","useState","useRef","useEffect","useCallback","profileError","refresh","useMemo","context","jsx","usePathname","useMemo","useRef","useEffect","useState","isBrowser","useCallback","context","useContext"]}