@edynamix/mf-isolation 0.0.33 → 0.0.35

package/README.md

@@ -50,7 +50,8 @@ At runtime, `provideMfOverlayRoot()` and `provideMfOverlayRootFromToken()` start
 A host calls `adaptHostedModuleStyles(shadowRoot)` from `@edynamix/mf-isolation` on each module shadow root it creates, and the function it returns on unmount. It adapts what a module brings into that root at runtime, with no module rebuild:
 
 - rem follows the module's own root font size, as `followModuleRootFontSize()` does above;
-- rules a library injects at runtime for the document root never match inside a shadow root (Angular Material's `html { --mat-focus-indicator-display: block; }` left keyboard focus rings off), so they move onto the shadow host, as the PostCSS plugins do at build time: `html`, `body`, `:root` and `html body` become `:host`, and `html .x`, `body > .x` or `:root .x` become `:host .x` and `:host > .x`. A root with conditions of its own (`html.dark`, `body#app`, `:root[dir=rtl]`) is left alone, as is any rule that already names `:host` or `data-edyn-mf`. `rescopeDocumentRootSelectors(selectorText)` is the pure selector step and also reports how many qualified roots it left.
+- rules a library injects at runtime for the document root never match inside a shadow root (Angular Material's `html { --mat-focus-indicator-display: block; }` left keyboard focus rings off), so they move onto the shadow host, as the PostCSS plugins do at build time: `html`, `body`, `:root` and `html body` become `:host`, and `html .x`, `body > .x` or `:root .x` become `:host .x` and `:host > .x`. A root with conditions of its own (`html.dark`, `body#app`, `:root[dir=rtl]`) is left alone, as is any rule that already names `:host` or `data-edyn-mf`. `rescopeDocumentRootSelectors(selectorText)` is the pure selector step and also reports how many qualified roots it left;
+- sticky headers written for the legacy navigation's top bar stick to the top of the host's content area: old pages scrolled under that 49px bar, so a sticky `top` of 49px or more (`top: 49px`, `top: 50px`) moves up by 49px, in stylesheet rules and in inline styles a module sets from code (the position-sticky directives' `position: sticky; top: 50px`), with its priority kept and once per value the module writes (0.0.34 or later). Smaller tops (`0`, `1px`, for pages and panels that already scrolled below the bar), `var()`, `%` and `calc()` values, and non-sticky rules are left alone.
 
 It is safe beside a module's own `followModuleRootFontSize()` on the same root (0.0.31 or later): stylesheet changes go through the CSSOM, which no mutation observer sees, every step is idempotent, and an inline style already followed never looks like work again, so neither side acts on the other's writes.
 
@@ -153,7 +154,7 @@ const localHostNavigationUrl = new URL(
 ).href;
 ```
 
-`hostNavigationUrl` selects the host environment. Load the browser entry from `localHostNavigationUrl`; the BFF serves the selected bundle and its host-owned logo assets through the secure local origin, avoiding mixed-content failures when the selected host is an HTTP localhost instance. Host API calls go to the selected host origin, while module API calls go to the explicit `moduleApiOrigin`. The BFF performs OIDC authorization code with PKCE, retains tokens and module API cookies in the development process, and forwards authenticated API requests without exposing either to module JavaScript. The refresh token is also kept in an HttpOnly `__Host-edyn_dev_refresh` cookie for the local origin, so one sign-in survives dev server restarts and switching between modules until the token expires. The sign-in service accepts each refresh token once, so requests the browser sent before a restart's rotated cookie reached it share that restore instead of spending the token again and clearing the new cookie. Host API requests keep the browser's navigation selection headers, which the host validates. Module API requests instead carry the selection the host last confirmed, read from `/api/navigation` responses and navigation stream events, through `X-Edyn-Navigation-Group-Id`, `X-Edyn-Navigation-Dealer-Ids` and, for a single dealer, `X-Edyn-Navigation-Dealer-Id`; module backends must still authorize those values before constructing module-specific session state. Request bodies are forwarded with a fixed length (up to 100 MB), because deployed module front ends reject chunked bodies. Before a module's first API call the BFF asks the host for the current selection, because the local shell starts the module beside the navigation rather than after it. A module's redirect to its legacy `/login` page leads to the development sign-in while signed out; signed in, it shows that the module API refused the session instead of reloading the module in a loop.
+`hostNavigationUrl` selects the host environment. Load the browser entry from `localHostNavigationUrl`; the BFF serves the selected bundle and its host-owned logo assets through the secure local origin, avoiding mixed-content failures when the selected host is an HTTP localhost instance. Host API calls go to the selected host origin, while module API calls go to the explicit `moduleApiOrigin`. The BFF performs OIDC authorization code with PKCE, retains tokens and module API cookies in the development process, and forwards authenticated API requests without exposing either to module JavaScript. The refresh token is also kept in an HttpOnly `__Host-edyn_dev_refresh` cookie for the local origin, so one sign-in survives dev server restarts and switching between modules until the token expires. The sign-in service accepts each refresh token once, so requests the browser sent before a restart's rotated cookie reached it share that restore instead of spending the token again and clearing the new cookie. Host API requests keep the browser's navigation selection headers, which the host validates. Module API requests instead carry the selection the host last confirmed, read from `/api/navigation` responses and navigation stream events, through `X-Edyn-Navigation-Group-Id`, `X-Edyn-Navigation-Dealer-Ids` and, for a single dealer, `X-Edyn-Navigation-Dealer-Id`; module backends must still authorize those values before constructing module-specific session state. The standalone navigation's portal menus (`/api/navigation/portal/...`) go to the selected host's own portal API (`/portal/api/...`) the same way, so they also load from a deployed host, which relays nothing under `/api/navigation/portal`. Request bodies are forwarded with a fixed length (up to 100 MB), because deployed module front ends reject chunked bodies. Before a module's first API call the BFF asks the host for the current selection, because the local shell starts the module beside the navigation rather than after it. A module's redirect to its legacy `/login` page leads to the development sign-in while signed out; signed in, it shows that the module API refused the session instead of reloading the module in a loop. When nothing answers at `moduleApiOrigin`, module API calls answer 502 `module_api_unreachable` with that origin and the reason, and the terminal says so once until the module server answers again.
 
 ## Angular base path in any letter case
 

package/dist/hosted-module-styles.d.ts

@@ -10,8 +10,10 @@ export declare const followModuleRootFontSize: (root: ShadowRoot) => (() => void
  * Adapts the CSS a module brings into its shadow root at runtime to the hosted page, for a host to call on each module
  * shadow root it creates and stop on unmount: rem follows the module's own root font size (as followModuleRootFontSize
  * does), and rules a library injects for the document root (`html { --mat-focus-indicator-display: block; }`), which
- * never match inside a shadow root, move onto `:host` (see rescopeDocumentRootSelectors). Safe beside a module's own
- * followModuleRootFontSize on the same root: every step is idempotent, and neither writes anything the other acts on.
+ * never match inside a shadow root, move onto `:host` (see rescopeDocumentRootSelectors), and sticky tops written for
+ * the legacy navigation's top bar (`top: 49px`), in rules and inline styles, move up by that bar, which a hosted page
+ * does not have. Safe beside a module's own followModuleRootFontSize on the same root: every step is idempotent, and
+ * neither writes anything the other acts on.
  */
 export declare const adaptHostedModuleStyles: (root: ShadowRoot) => (() => void);
 //# sourceMappingURL=hosted-module-styles.d.ts.map

package/dist/hosted-module-styles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-module-styles.d.ts","sourceRoot":"","sources":["../src/hosted-module-styles.ts"],"names":[],"mappings":"AAiPA;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,UAAU,KAAG,CAAC,MAAM,IAAI,CAEtE,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,GAAI,MAAM,UAAU,KAAG,CAAC,MAAM,IAAI,CAErE,CAAC","sourcesContent":["import { rescopeDocumentRootSelectors } from './document-root-selectors.js';\nimport {\n  MF_ROOT_FONT_SIZE_PROPERTY,\n  REM_LENGTH_HINT_PATTERN,\n  ROOT_FONT_SIZE_DECLARATION_PATTERN,\n  rewriteRemLengths,\n  UNFOLLOWED_REM_PATTERN,\n} from './root-font-size.js';\n\nconst INLINE_REM_SELECTOR = '[style*=\"rem\" i]';\n\n// By class name, not instanceof: a root in another window (a frame, or a test's own window) has its own CSSFontFaceRule.\nconst isFontFaceRule = (rule: CSSRule): boolean => {\n  return rule.constructor?.name === 'CSSFontFaceRule';\n};\n\n// Rule kinds are told apart by what they carry, not by class: @import has a sheet, style and keyframe rules have\n// declarations, and grouping rules (@media, @supports, @container, @layer, @keyframes, nesting) have child rules.\nconst importedSheetOf = (rule: CSSRule): CSSStyleSheet | undefined => {\n  return 'styleSheet' in rule && rule.styleSheet ? (rule.styleSheet as CSSStyleSheet) : undefined;\n};\n\nconst declarationsOf = (rule: CSSRule): CSSStyleDeclaration | undefined => {\n  return 'style' in rule && rule.style && !isFontFaceRule(rule) ? (rule.style as CSSStyleDeclaration) : undefined;\n};\n\nconst childRulesOf = (rule: CSSRule): CSSRuleList | undefined => {\n  return 'cssRules' in rule && rule.cssRules ? (rule.cssRules as CSSRuleList) : undefined;\n};\n\nconst readRules = (sheet: CSSStyleSheet): CSSRuleList | undefined => {\n  try {\n    return sheet.cssRules;\n  } catch {\n    // A cross-origin sheet (a font service's @font-face list) cannot be read, and none of its rules are module rules.\n    return undefined;\n  }\n};\n\nconst walkRules = (sheet: CSSStyleSheet, visit: (rule: CSSRule) => void): void => {\n  const walk = (rules: CSSRuleList): void => {\n    for (const rule of Array.from(rules)) {\n      const importedSheet = importedSheetOf(rule);\n      const importedRules = importedSheet ? readRules(importedSheet) : undefined;\n      if (importedRules) {\n        walk(importedRules);\n      }\n      visit(rule);\n      const childRules = childRulesOf(rule);\n      if (childRules) {\n        walk(childRules);\n      }\n    }\n  };\n  const rules = readRules(sheet);\n  if (rules) {\n    walk(rules);\n  }\n};\n\n// Only declaration blocks change, through the CSSOM: @media, @container and @supports conditions keep their rem (var()\n// is invalid there, and a media query rem is the browser's initial size anyway), and !important stays with its value.\n// CSSOM changes are not DOM mutations, so no observer, this one or another on the same root, sees them.\nconst followRemInSheet = (sheet: CSSStyleSheet): void => {\n  walkRules(sheet, (rule) => {\n    const declarations = declarationsOf(rule);\n    if (declarations && REM_LENGTH_HINT_PATTERN.test(declarations.cssText)) {\n      const rewritten = rewriteRemLengths(declarations.cssText);\n      if (rewritten !== declarations.cssText) {\n        declarations.cssText = rewritten;\n      }\n    }\n  });\n};\n\nconst rescopeDocumentRootRules = (sheet: CSSStyleSheet): void => {\n  walkRules(sheet, (rule) => {\n    if (!('selectorText' in rule) || typeof rule.selectorText !== 'string') {\n      return;\n    }\n    const { selectorText } = rescopeDocumentRootSelectors(rule.selectorText);\n    if (selectorText !== rule.selectorText) {\n      (rule as CSSStyleRule).selectorText = selectorText;\n    }\n  });\n};\n\nconst declaresRootFontSize = (sheet: CSSStyleSheet): boolean => {\n  let declares = false;\n  walkRules(sheet, (rule) => {\n    declares ||= !!declarationsOf(rule)?.getPropertyValue(MF_ROOT_FONT_SIZE_PROPERTY);\n  });\n  return declares;\n};\n\n// Inline styles carry rem too, from templates (`style=\"padding-bottom: 0.25rem !important\"`) and from style bindings\n// and code. The whole declaration block is rewritten through element.style, as for sheet rules: !important stays with\n// its value, and a shorthand that also holds var() (whose longhands read empty) is still seen. Material sets inline\n// styles constantly (ripples, overlay positions), so anything without an unfollowed rem length returns at once, and a\n// followed value never looks like work again, which is also why a second observer on the same root writes nothing.\nconst followInlineStyle = (element: Element): void => {\n  const attribute = element.getAttribute('style');\n  if (!attribute || !UNFOLLOWED_REM_PATTERN.test(attribute)) {\n    return;\n  }\n  const style = (element as HTMLElement).style;\n  const declarations = style?.cssText;\n  if (!declarations) {\n    return;\n  }\n  const rewritten = rewriteRemLengths(declarations);\n  if (rewritten !== declarations) {\n    style.cssText = rewritten;\n  }\n};\n\nconst followInlineStylesWithin = (node: Node): void => {\n  if (node.nodeType !== 1) {\n    return;\n  }\n  const element = node as Element;\n  followInlineStyle(element);\n  if (element.firstElementChild) {\n    for (const descendant of Array.from(element.querySelectorAll(INLINE_REM_SELECTOR))) {\n      followInlineStyle(descendant);\n    }\n  }\n};\n\ntype TStyleOwner = HTMLLinkElement | HTMLStyleElement;\n\nconst isStyleOwner = (node: Node): node is TStyleOwner => {\n  return node.nodeName === 'STYLE' || (node.nodeName === 'LINK' && (node as HTMLLinkElement).rel.split(/\\s+/).includes('stylesheet'));\n};\n\ninterface IAdaptStylesOptions {\n  documentRootRules: boolean;\n}\n\nconst adaptShadowRootStyles = (root: ShadowRoot, { documentRootRules }: IAdaptStylesOptions): (() => void) => {\n  // The root's own window, which need not be the global one (a frame, or a test's own window).\n  const RootMutationObserver = root.ownerDocument.defaultView?.MutationObserver ?? MutationObserver;\n  let followingRem = false;\n  const remSheets = new WeakSet<CSSStyleSheet>();\n  const rescopedSheets = new WeakSet<CSSStyleSheet>();\n  const watchedStyles = new WeakSet<HTMLStyleElement>();\n\n  const owners = (): TStyleOwner[] => Array.from(root.childNodes).filter(isStyleOwner);\n\n  const sheetsOf = (styleOwners: TStyleOwner[]): CSSStyleSheet[] => {\n    return [...(root.adoptedStyleSheets ?? []), ...styleOwners.map((owner) => owner.sheet).filter((sheet): sheet is CSSStyleSheet => !!sheet)];\n  };\n\n  // A <style>'s own text is the cheap check; linked and adopted sheets have only their rules.\n  const findsRootFontSize = (styleOwners: TStyleOwner[]): boolean => {\n    const styles = styleOwners.filter((owner): owner is HTMLStyleElement => owner.nodeName === 'STYLE');\n    if (styles.some((style) => ROOT_FONT_SIZE_DECLARATION_PATTERN.test(style.textContent ?? ''))) {\n      return true;\n    }\n    const linkedSheets = styleOwners.filter((owner) => owner.nodeName === 'LINK').map((owner) => owner.sheet);\n    return [...(root.adoptedStyleSheets ?? []), ...linkedSheets].some((sheet) => !!sheet && declaresRootFontSize(sheet));\n  };\n\n  // Started only once the module's CSS declares a root size, so a module without one pays nothing. An element gets its\n  // template styles before it is inserted, so insertions are scanned as well as later style attribute changes.\n  let inlineObserver: MutationObserver | undefined;\n  const followInlineStyles = (): void => {\n    for (const element of Array.from(root.querySelectorAll(INLINE_REM_SELECTOR))) {\n      followInlineStyle(element);\n    }\n    inlineObserver = new RootMutationObserver((records) => {\n      for (const record of records) {\n        if (record.type === 'attributes') {\n          followInlineStyle(record.target as Element);\n        } else {\n          for (const node of Array.from(record.addedNodes)) {\n            followInlineStylesWithin(node);\n          }\n        }\n      }\n      // Only this callback ran since the records were delivered, so what is queued now are its own rewrites.\n      inlineObserver?.takeRecords();\n    });\n    inlineObserver.observe(root, { attributeFilter: ['style'], attributes: true, childList: true, subtree: true });\n  };\n\n  const observer = new RootMutationObserver(() => update());\n\n  const update = (): void => {\n    const styleOwners = owners();\n    for (const owner of styleOwners) {\n      if (owner.nodeName === 'STYLE' && !watchedStyles.has(owner as HTMLStyleElement)) {\n        // Replacing a <style>'s text gives it a new sheet, which must be adapted again.\n        observer.observe(owner, { characterData: true, childList: true, subtree: true });\n        watchedStyles.add(owner as HTMLStyleElement);\n      }\n    }\n\n    const sheets = sheetsOf(styleOwners);\n    if (documentRootRules) {\n      for (const sheet of sheets) {\n        if (!rescopedSheets.has(sheet)) {\n          rescopeDocumentRootRules(sheet);\n          rescopedSheets.add(sheet);\n        }\n      }\n    }\n\n    followingRem ||= findsRootFontSize(styleOwners);\n    if (!followingRem) {\n      return;\n    }\n    if (!inlineObserver) {\n      followInlineStyles();\n    }\n    for (const sheet of sheets) {\n      if (!remSheets.has(sheet)) {\n        followRemInSheet(sheet);\n        remSheets.add(sheet);\n      }\n    }\n  };\n\n  // A <link> sheet has no rules until it loads; load does not bubble, so it is caught on the way down.\n  const onLoad = (event: Event): void => {\n    if (event.target instanceof Node && isStyleOwner(event.target)) {\n      update();\n    }\n  };\n\n  observer.observe(root, { childList: true });\n  root.addEventListener('load', onLoad, true);\n  update();\n\n  return () => {\n    observer.disconnect();\n    inlineObserver?.disconnect();\n    root.removeEventListener('load', onLoad, true);\n  };\n};\n\n/**\n * Makes rem lengths in a hosted module's shadow root follow the root font size its own page had, once the module's\n * CSS declares one (see MF_ROOT_FONT_SIZE_PROPERTY): in stylesheets already in the root and every one added or changed\n * later, such as the component styles Angular adds as components first render, and in inline style attributes,\n * including ones inserted or changed later. A module whose CSS never sizes its root is left untouched. Returns a\n * function that stops following; rewritten rules and styles stay rewritten.\n */\nexport const followModuleRootFontSize = (root: ShadowRoot): (() => void) => {\n  return adaptShadowRootStyles(root, { documentRootRules: false });\n};\n\n/**\n * Adapts the CSS a module brings into its shadow root at runtime to the hosted page, for a host to call on each module\n * shadow root it creates and stop on unmount: rem follows the module's own root font size (as followModuleRootFontSize\n * does), and rules a library injects for the document root (`html { --mat-focus-indicator-display: block; }`), which\n * never match inside a shadow root, move onto `:host` (see rescopeDocumentRootSelectors). Safe beside a module's own\n * followModuleRootFontSize on the same root: every step is idempotent, and neither writes anything the other acts on.\n */\nexport const adaptHostedModuleStyles = (root: ShadowRoot): (() => void) => {\n  return adaptShadowRootStyles(root, { documentRootRules: true });\n};\n"]}
+{"version":3,"file":"hosted-module-styles.d.ts","sourceRoot":"","sources":["../src/hosted-module-styles.ts"],"names":[],"mappings":"AAyUA;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,UAAU,KAAG,CAAC,MAAM,IAAI,CAEtE,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAAI,MAAM,UAAU,KAAG,CAAC,MAAM,IAAI,CAErE,CAAC","sourcesContent":["import { rescopeDocumentRootSelectors } from './document-root-selectors.js';\nimport {\n  MF_ROOT_FONT_SIZE_PROPERTY,\n  REM_LENGTH_HINT_PATTERN,\n  ROOT_FONT_SIZE_DECLARATION_PATTERN,\n  rewriteRemLengths,\n  UNFOLLOWED_REM_PATTERN,\n} from './root-font-size.js';\n\nconst INLINE_REM_SELECTOR = '[style*=\"rem\" i]';\nconst INLINE_STICKY_SELECTOR = '[style*=\"sticky\" i]';\n\n// The legacy navigation's top bar (@edyn/navigation: `.mat-sidenav-container { padding-top: 49px }`). Old pages scrolled\n// under it, so their sticky headers stuck below it with `top: 49px` (or 50px, one pixel lower). Hosted, a module scrolls\n// in the host's content area, which has no bar inside it, so those headers would stick 49px too low.\nconst LEGACY_NAVIGATION_BAR_HEIGHT = 49;\nconst PIXEL_LENGTH_PATTERN = /^(\\d+(?:\\.\\d+)?)px$/i;\n\n// A sticky top of at least the bar's height moves up by the bar; smaller ones (0, 1px) belong to pages or panels that\n// scrolled below the bar already, and anything else (var(), %, calc()) is a module's own choice. Returns whether the\n// declarations changed.\nconst liftStickyTop = (declarations: CSSStyleDeclaration): boolean => {\n  if (!/sticky/i.test(declarations.getPropertyValue('position'))) {\n    return false;\n  }\n  const top = PIXEL_LENGTH_PATTERN.exec(declarations.getPropertyValue('top').trim());\n  const pixels = top ? Number(top[1]) : Number.NaN;\n  if (!(pixels >= LEGACY_NAVIGATION_BAR_HEIGHT)) {\n    return false;\n  }\n  declarations.setProperty('top', `${pixels - LEGACY_NAVIGATION_BAR_HEIGHT}px`, declarations.getPropertyPriority('top'));\n  return true;\n};\n\n// By class name, not instanceof: a root in another window (a frame, or a test's own window) has its own CSSFontFaceRule.\nconst isFontFaceRule = (rule: CSSRule): boolean => {\n  return rule.constructor?.name === 'CSSFontFaceRule';\n};\n\n// Rule kinds are told apart by what they carry, not by class: @import has a sheet, style and keyframe rules have\n// declarations, and grouping rules (@media, @supports, @container, @layer, @keyframes, nesting) have child rules.\nconst importedSheetOf = (rule: CSSRule): CSSStyleSheet | undefined => {\n  return 'styleSheet' in rule && rule.styleSheet ? (rule.styleSheet as CSSStyleSheet) : undefined;\n};\n\nconst declarationsOf = (rule: CSSRule): CSSStyleDeclaration | undefined => {\n  return 'style' in rule && rule.style && !isFontFaceRule(rule) ? (rule.style as CSSStyleDeclaration) : undefined;\n};\n\nconst childRulesOf = (rule: CSSRule): CSSRuleList | undefined => {\n  return 'cssRules' in rule && rule.cssRules ? (rule.cssRules as CSSRuleList) : undefined;\n};\n\nconst readRules = (sheet: CSSStyleSheet): CSSRuleList | undefined => {\n  try {\n    return sheet.cssRules;\n  } catch {\n    // A cross-origin sheet (a font service's @font-face list) cannot be read, and none of its rules are module rules.\n    return undefined;\n  }\n};\n\nconst walkRules = (sheet: CSSStyleSheet, visit: (rule: CSSRule) => void): void => {\n  const walk = (rules: CSSRuleList): void => {\n    for (const rule of Array.from(rules)) {\n      const importedSheet = importedSheetOf(rule);\n      const importedRules = importedSheet ? readRules(importedSheet) : undefined;\n      if (importedRules) {\n        walk(importedRules);\n      }\n      visit(rule);\n      const childRules = childRulesOf(rule);\n      if (childRules) {\n        walk(childRules);\n      }\n    }\n  };\n  const rules = readRules(sheet);\n  if (rules) {\n    walk(rules);\n  }\n};\n\n// Only declaration blocks change, through the CSSOM: @media, @container and @supports conditions keep their rem (var()\n// is invalid there, and a media query rem is the browser's initial size anyway), and !important stays with its value.\n// CSSOM changes are not DOM mutations, so no observer, this one or another on the same root, sees them.\nconst followRemInSheet = (sheet: CSSStyleSheet): void => {\n  walkRules(sheet, (rule) => {\n    const declarations = declarationsOf(rule);\n    if (declarations && REM_LENGTH_HINT_PATTERN.test(declarations.cssText)) {\n      const rewritten = rewriteRemLengths(declarations.cssText);\n      if (rewritten !== declarations.cssText) {\n        declarations.cssText = rewritten;\n      }\n    }\n  });\n};\n\nconst rescopeDocumentRootRules = (sheet: CSSStyleSheet): void => {\n  walkRules(sheet, (rule) => {\n    if (!('selectorText' in rule) || typeof rule.selectorText !== 'string') {\n      return;\n    }\n    const { selectorText } = rescopeDocumentRootSelectors(rule.selectorText);\n    if (selectorText !== rule.selectorText) {\n      (rule as CSSStyleRule).selectorText = selectorText;\n    }\n  });\n};\n\nconst liftStickyTopsInSheet = (sheet: CSSStyleSheet): void => {\n  walkRules(sheet, (rule) => {\n    const declarations = declarationsOf(rule);\n    if (declarations && /sticky/i.test(declarations.cssText)) {\n      liftStickyTop(declarations);\n    }\n  });\n};\n\nconst declaresRootFontSize = (sheet: CSSStyleSheet): boolean => {\n  let declares = false;\n  walkRules(sheet, (rule) => {\n    declares ||= !!declarationsOf(rule)?.getPropertyValue(MF_ROOT_FONT_SIZE_PROPERTY);\n  });\n  return declares;\n};\n\n// Inline styles carry rem too, from templates (`style=\"padding-bottom: 0.25rem !important\"`) and from style bindings\n// and code. The whole declaration block is rewritten through element.style, as for sheet rules: !important stays with\n// its value, and a shorthand that also holds var() (whose longhands read empty) is still seen. Material sets inline\n// styles constantly (ripples, overlay positions), so anything without an unfollowed rem length returns at once, and a\n// followed value never looks like work again, which is also why a second observer on the same root writes nothing.\nconst followInlineStyle = (element: Element): void => {\n  const attribute = element.getAttribute('style');\n  if (!attribute || !UNFOLLOWED_REM_PATTERN.test(attribute)) {\n    return;\n  }\n  const style = (element as HTMLElement).style;\n  const declarations = style?.cssText;\n  if (!declarations) {\n    return;\n  }\n  const rewritten = rewriteRemLengths(declarations);\n  if (rewritten !== declarations) {\n    style.cssText = rewritten;\n  }\n};\n\nconst followInlineStylesWithin = (node: Node): void => {\n  if (node.nodeType !== 1) {\n    return;\n  }\n  const element = node as Element;\n  followInlineStyle(element);\n  if (element.firstElementChild) {\n    for (const descendant of Array.from(element.querySelectorAll(INLINE_REM_SELECTOR))) {\n      followInlineStyle(descendant);\n    }\n  }\n};\n\ntype TStyleOwner = HTMLLinkElement | HTMLStyleElement;\n\nconst isStyleOwner = (node: Node): node is TStyleOwner => {\n  return node.nodeName === 'STYLE' || (node.nodeName === 'LINK' && (node as HTMLLinkElement).rel.split(/\\s+/).includes('stylesheet'));\n};\n\ninterface IAdaptStylesOptions {\n  documentRootRules: boolean;\n  stickyTops: boolean;\n}\n\n// Sticky headers set from code carry their top inline (`style.cssText = 'position: sticky; top: 50px'` in the modules'\n// position-sticky directives). Each value a module writes moves up once: the attribute this wrote is remembered, so its\n// own change, which the observer sees too, is not lifted again, while a value the module writes later is.\nconst liftInlineStickyTops = (root: ShadowRoot, RootMutationObserver: typeof MutationObserver): MutationObserver => {\n  const lifted = new WeakMap<Element, string>();\n  const lift = (element: Element): void => {\n    const attribute = element.getAttribute('style');\n    if (!attribute || !/sticky/i.test(attribute) || lifted.get(element) === attribute) {\n      return;\n    }\n    const style = (element as HTMLElement).style;\n    if (style && liftStickyTop(style)) {\n      lifted.set(element, element.getAttribute('style') ?? '');\n    }\n  };\n  const liftWithin = (node: Node): void => {\n    if (node.nodeType !== 1) {\n      return;\n    }\n    lift(node as Element);\n    for (const descendant of Array.from((node as Element).querySelectorAll(INLINE_STICKY_SELECTOR))) {\n      lift(descendant);\n    }\n  };\n\n  for (const element of Array.from(root.querySelectorAll(INLINE_STICKY_SELECTOR))) {\n    lift(element);\n  }\n  const observer = new RootMutationObserver((records) => {\n    for (const record of records) {\n      if (record.type === 'attributes') {\n        lift(record.target as Element);\n      } else {\n        for (const node of Array.from(record.addedNodes)) {\n          liftWithin(node);\n        }\n      }\n    }\n  });\n  observer.observe(root, { attributeFilter: ['style'], attributes: true, childList: true, subtree: true });\n  return observer;\n};\n\nconst adaptShadowRootStyles = (root: ShadowRoot, { documentRootRules, stickyTops }: IAdaptStylesOptions): (() => void) => {\n  // The root's own window, which need not be the global one (a frame, or a test's own window).\n  const RootMutationObserver = root.ownerDocument.defaultView?.MutationObserver ?? MutationObserver;\n  let followingRem = false;\n  const remSheets = new WeakSet<CSSStyleSheet>();\n  const rescopedSheets = new WeakSet<CSSStyleSheet>();\n  const stickySheets = new WeakSet<CSSStyleSheet>();\n  const watchedStyles = new WeakSet<HTMLStyleElement>();\n\n  const owners = (): TStyleOwner[] => Array.from(root.childNodes).filter(isStyleOwner);\n\n  const sheetsOf = (styleOwners: TStyleOwner[]): CSSStyleSheet[] => {\n    return [...(root.adoptedStyleSheets ?? []), ...styleOwners.map((owner) => owner.sheet).filter((sheet): sheet is CSSStyleSheet => !!sheet)];\n  };\n\n  // A <style>'s own text is the cheap check; linked and adopted sheets have only their rules.\n  const findsRootFontSize = (styleOwners: TStyleOwner[]): boolean => {\n    const styles = styleOwners.filter((owner): owner is HTMLStyleElement => owner.nodeName === 'STYLE');\n    if (styles.some((style) => ROOT_FONT_SIZE_DECLARATION_PATTERN.test(style.textContent ?? ''))) {\n      return true;\n    }\n    const linkedSheets = styleOwners.filter((owner) => owner.nodeName === 'LINK').map((owner) => owner.sheet);\n    return [...(root.adoptedStyleSheets ?? []), ...linkedSheets].some((sheet) => !!sheet && declaresRootFontSize(sheet));\n  };\n\n  // Started only once the module's CSS declares a root size, so a module without one pays nothing. An element gets its\n  // template styles before it is inserted, so insertions are scanned as well as later style attribute changes.\n  let inlineObserver: MutationObserver | undefined;\n  const followInlineStyles = (): void => {\n    for (const element of Array.from(root.querySelectorAll(INLINE_REM_SELECTOR))) {\n      followInlineStyle(element);\n    }\n    inlineObserver = new RootMutationObserver((records) => {\n      for (const record of records) {\n        if (record.type === 'attributes') {\n          followInlineStyle(record.target as Element);\n        } else {\n          for (const node of Array.from(record.addedNodes)) {\n            followInlineStylesWithin(node);\n          }\n        }\n      }\n      // Only this callback ran since the records were delivered, so what is queued now are its own rewrites.\n      inlineObserver?.takeRecords();\n    });\n    inlineObserver.observe(root, { attributeFilter: ['style'], attributes: true, childList: true, subtree: true });\n  };\n\n  const observer = new RootMutationObserver(() => update());\n\n  const update = (): void => {\n    const styleOwners = owners();\n    for (const owner of styleOwners) {\n      if (owner.nodeName === 'STYLE' && !watchedStyles.has(owner as HTMLStyleElement)) {\n        // Replacing a <style>'s text gives it a new sheet, which must be adapted again.\n        observer.observe(owner, { characterData: true, childList: true, subtree: true });\n        watchedStyles.add(owner as HTMLStyleElement);\n      }\n    }\n\n    const sheets = sheetsOf(styleOwners);\n    if (documentRootRules) {\n      for (const sheet of sheets) {\n        if (!rescopedSheets.has(sheet)) {\n          rescopeDocumentRootRules(sheet);\n          rescopedSheets.add(sheet);\n        }\n      }\n    }\n\n    if (stickyTops) {\n      for (const sheet of sheets) {\n        if (!stickySheets.has(sheet)) {\n          liftStickyTopsInSheet(sheet);\n          stickySheets.add(sheet);\n        }\n      }\n    }\n\n    followingRem ||= findsRootFontSize(styleOwners);\n    if (!followingRem) {\n      return;\n    }\n    if (!inlineObserver) {\n      followInlineStyles();\n    }\n    for (const sheet of sheets) {\n      if (!remSheets.has(sheet)) {\n        followRemInSheet(sheet);\n        remSheets.add(sheet);\n      }\n    }\n  };\n\n  // A <link> sheet has no rules until it loads; load does not bubble, so it is caught on the way down.\n  const onLoad = (event: Event): void => {\n    if (event.target instanceof Node && isStyleOwner(event.target)) {\n      update();\n    }\n  };\n\n  observer.observe(root, { childList: true });\n  root.addEventListener('load', onLoad, true);\n  update();\n  const stickyObserver = stickyTops ? liftInlineStickyTops(root, RootMutationObserver) : undefined;\n\n  return () => {\n    observer.disconnect();\n    inlineObserver?.disconnect();\n    stickyObserver?.disconnect();\n    root.removeEventListener('load', onLoad, true);\n  };\n};\n\n/**\n * Makes rem lengths in a hosted module's shadow root follow the root font size its own page had, once the module's\n * CSS declares one (see MF_ROOT_FONT_SIZE_PROPERTY): in stylesheets already in the root and every one added or changed\n * later, such as the component styles Angular adds as components first render, and in inline style attributes,\n * including ones inserted or changed later. A module whose CSS never sizes its root is left untouched. Returns a\n * function that stops following; rewritten rules and styles stay rewritten.\n */\nexport const followModuleRootFontSize = (root: ShadowRoot): (() => void) => {\n  return adaptShadowRootStyles(root, { documentRootRules: false, stickyTops: false });\n};\n\n/**\n * Adapts the CSS a module brings into its shadow root at runtime to the hosted page, for a host to call on each module\n * shadow root it creates and stop on unmount: rem follows the module's own root font size (as followModuleRootFontSize\n * does), and rules a library injects for the document root (`html { --mat-focus-indicator-display: block; }`), which\n * never match inside a shadow root, move onto `:host` (see rescopeDocumentRootSelectors), and sticky tops written for\n * the legacy navigation's top bar (`top: 49px`), in rules and inline styles, move up by that bar, which a hosted page\n * does not have. Safe beside a module's own followModuleRootFontSize on the same root: every step is idempotent, and\n * neither writes anything the other acts on.\n */\nexport const adaptHostedModuleStyles = (root: ShadowRoot): (() => void) => {\n  return adaptShadowRootStyles(root, { documentRootRules: true, stickyTops: true });\n};\n"]}

package/dist/hosted-module-styles.js

@@ -1,6 +1,27 @@
 import { rescopeDocumentRootSelectors } from './document-root-selectors.js';
 import { MF_ROOT_FONT_SIZE_PROPERTY, REM_LENGTH_HINT_PATTERN, ROOT_FONT_SIZE_DECLARATION_PATTERN, rewriteRemLengths, UNFOLLOWED_REM_PATTERN, } from './root-font-size.js';
 const INLINE_REM_SELECTOR = '[style*="rem" i]';
+const INLINE_STICKY_SELECTOR = '[style*="sticky" i]';
+// The legacy navigation's top bar (@edyn/navigation: `.mat-sidenav-container { padding-top: 49px }`). Old pages scrolled
+// under it, so their sticky headers stuck below it with `top: 49px` (or 50px, one pixel lower). Hosted, a module scrolls
+// in the host's content area, which has no bar inside it, so those headers would stick 49px too low.
+const LEGACY_NAVIGATION_BAR_HEIGHT = 49;
+const PIXEL_LENGTH_PATTERN = /^(\d+(?:\.\d+)?)px$/i;
+// A sticky top of at least the bar's height moves up by the bar; smaller ones (0, 1px) belong to pages or panels that
+// scrolled below the bar already, and anything else (var(), %, calc()) is a module's own choice. Returns whether the
+// declarations changed.
+const liftStickyTop = (declarations) => {
+    if (!/sticky/i.test(declarations.getPropertyValue('position'))) {
+        return false;
+    }
+    const top = PIXEL_LENGTH_PATTERN.exec(declarations.getPropertyValue('top').trim());
+    const pixels = top ? Number(top[1]) : Number.NaN;
+    if (!(pixels >= LEGACY_NAVIGATION_BAR_HEIGHT)) {
+        return false;
+    }
+    declarations.setProperty('top', `${pixels - LEGACY_NAVIGATION_BAR_HEIGHT}px`, declarations.getPropertyPriority('top'));
+    return true;
+};
 // By class name, not instanceof: a root in another window (a frame, or a test's own window) has its own CSSFontFaceRule.
 const isFontFaceRule = (rule) => {
     return rule.constructor?.name === 'CSSFontFaceRule';
@@ -70,6 +91,14 @@ const rescopeDocumentRootRules = (sheet) => {
         }
     });
 };
+const liftStickyTopsInSheet = (sheet) => {
+    walkRules(sheet, (rule) => {
+        const declarations = declarationsOf(rule);
+        if (declarations && /sticky/i.test(declarations.cssText)) {
+            liftStickyTop(declarations);
+        }
+    });
+};
 const declaresRootFontSize = (sheet) => {
     let declares = false;
     walkRules(sheet, (rule) => {
@@ -112,12 +141,55 @@ const followInlineStylesWithin = (node) => {
 const isStyleOwner = (node) => {
     return node.nodeName === 'STYLE' || (node.nodeName === 'LINK' && node.rel.split(/\s+/).includes('stylesheet'));
 };
-const adaptShadowRootStyles = (root, { documentRootRules }) => {
+// Sticky headers set from code carry their top inline (`style.cssText = 'position: sticky; top: 50px'` in the modules'
+// position-sticky directives). Each value a module writes moves up once: the attribute this wrote is remembered, so its
+// own change, which the observer sees too, is not lifted again, while a value the module writes later is.
+const liftInlineStickyTops = (root, RootMutationObserver) => {
+    const lifted = new WeakMap();
+    const lift = (element) => {
+        const attribute = element.getAttribute('style');
+        if (!attribute || !/sticky/i.test(attribute) || lifted.get(element) === attribute) {
+            return;
+        }
+        const style = element.style;
+        if (style && liftStickyTop(style)) {
+            lifted.set(element, element.getAttribute('style') ?? '');
+        }
+    };
+    const liftWithin = (node) => {
+        if (node.nodeType !== 1) {
+            return;
+        }
+        lift(node);
+        for (const descendant of Array.from(node.querySelectorAll(INLINE_STICKY_SELECTOR))) {
+            lift(descendant);
+        }
+    };
+    for (const element of Array.from(root.querySelectorAll(INLINE_STICKY_SELECTOR))) {
+        lift(element);
+    }
+    const observer = new RootMutationObserver((records) => {
+        for (const record of records) {
+            if (record.type === 'attributes') {
+                lift(record.target);
+            }
+            else {
+                for (const node of Array.from(record.addedNodes)) {
+                    liftWithin(node);
+                }
+            }
+        }
+    });
+    observer.observe(root, { attributeFilter: ['style'], attributes: true, childList: true, subtree: true });
+    return observer;
+};
+const adaptShadowRootStyles = (root, { documentRootRules, stickyTops }) => {
     // The root's own window, which need not be the global one (a frame, or a test's own window).
     const RootMutationObserver = root.ownerDocument.defaultView?.MutationObserver ?? MutationObserver;
     let followingRem = false;
     const remSheets = new WeakSet();
     const rescopedSheets = new WeakSet();
+    const stickySheets = new WeakSet();
     const watchedStyles = new WeakSet();
     const owners = () => Array.from(root.childNodes).filter(isStyleOwner);
     const sheetsOf = (styleOwners) => {
@@ -174,6 +246,14 @@ const adaptShadowRootStyles = (root, { documentRootRules }) => {
                 }
             }
         }
+        if (stickyTops) {
+            for (const sheet of sheets) {
+                if (!stickySheets.has(sheet)) {
+                    liftStickyTopsInSheet(sheet);
+                    stickySheets.add(sheet);
+                }
+            }
+        }
         followingRem ||= findsRootFontSize(styleOwners);
         if (!followingRem) {
             return;
@@ -197,9 +277,11 @@ const adaptShadowRootStyles = (root, { documentRootRules }) => {
     observer.observe(root, { childList: true });
     root.addEventListener('load', onLoad, true);
     update();
+    const stickyObserver = stickyTops ? liftInlineStickyTops(root, RootMutationObserver) : undefined;
     return () => {
         observer.disconnect();
         inlineObserver?.disconnect();
+        stickyObserver?.disconnect();
         root.removeEventListener('load', onLoad, true);
     };
 };
@@ -211,16 +293,18 @@ const adaptShadowRootStyles = (root, { documentRootRules }) => {
  * function that stops following; rewritten rules and styles stay rewritten.
  */
 export const followModuleRootFontSize = (root) => {
-    return adaptShadowRootStyles(root, { documentRootRules: false });
+    return adaptShadowRootStyles(root, { documentRootRules: false, stickyTops: false });
 };
 /**
  * Adapts the CSS a module brings into its shadow root at runtime to the hosted page, for a host to call on each module
  * shadow root it creates and stop on unmount: rem follows the module's own root font size (as followModuleRootFontSize
  * does), and rules a library injects for the document root (`html { --mat-focus-indicator-display: block; }`), which
- * never match inside a shadow root, move onto `:host` (see rescopeDocumentRootSelectors). Safe beside a module's own
- * followModuleRootFontSize on the same root: every step is idempotent, and neither writes anything the other acts on.
+ * never match inside a shadow root, move onto `:host` (see rescopeDocumentRootSelectors), and sticky tops written for
+ * the legacy navigation's top bar (`top: 49px`), in rules and inline styles, move up by that bar, which a hosted page
+ * does not have. Safe beside a module's own followModuleRootFontSize on the same root: every step is idempotent, and
+ * neither writes anything the other acts on.
  */
 export const adaptHostedModuleStyles = (root) => {
-    return adaptShadowRootStyles(root, { documentRootRules: true });
+    return adaptShadowRootStyles(root, { documentRootRules: true, stickyTops: true });
 };
 //# sourceMappingURL=hosted-module-styles.js.map

package/dist/hosted-module-styles.js.map

@@ -1 +1 @@
-{"version":3,"file":"hosted-module-styles.js","sourceRoot":"","sources":["../src/hosted-module-styles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,kCAAkC,EAClC,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAE/C,yHAAyH;AACzH,MAAM,cAAc,GAAG,CAAC,IAAa,EAAW,EAAE;IAChD,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,iBAAiB,CAAC;AACtD,CAAC,CAAC;AAEF,iHAAiH;AACjH,kHAAkH;AAClH,MAAM,eAAe,GAAG,CAAC,IAAa,EAA6B,EAAE;IACnE,OAAO,YAAY,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAE,IAAI,CAAC,UAA4B,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,IAAa,EAAmC,EAAE;IACxE,OAAO,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;AAClH,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,IAAa,EAA2B,EAAE;IAC9D,OAAO,UAAU,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,QAAwB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,KAAoB,EAA2B,EAAE;IAClE,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,kHAAkH;QAClH,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,KAAoB,EAAE,KAA8B,EAAQ,EAAE;IAC/E,MAAM,IAAI,GAAG,CAAC,KAAkB,EAAQ,EAAE;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,aAAa,CAAC,CAAC;YACtB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,CAAC;YACZ,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,UAAU,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,uHAAuH;AACvH,sHAAsH;AACtH,wGAAwG;AACxG,MAAM,gBAAgB,GAAG,CAAC,KAAoB,EAAQ,EAAE;IACtD,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,YAAY,IAAI,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YACvE,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC1D,IAAI,SAAS,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;gBACvC,YAAY,CAAC,OAAO,GAAG,SAAS,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,KAAoB,EAAQ,EAAE;IAC9D,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,GAAG,4BAA4B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzE,IAAI,YAAY,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,IAAqB,CAAC,YAAY,GAAG,YAAY,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,KAAoB,EAAW,EAAE;IAC7D,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;QACxB,QAAQ,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,qHAAqH;AACrH,sHAAsH;AACtH,oHAAoH;AACpH,sHAAsH;AACtH,mHAAmH;AACnH,MAAM,iBAAiB,GAAG,CAAC,OAAgB,EAAQ,EAAE;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAI,OAAuB,CAAC,KAAK,CAAC;IAC7C,MAAM,YAAY,GAAG,KAAK,EAAE,OAAO,CAAC;IACpC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,IAAU,EAAQ,EAAE;IACpD,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,IAAe,CAAC;IAChC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;YACnF,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAIF,MAAM,YAAY,GAAG,CAAC,IAAU,EAAuB,EAAE;IACvD,OAAO,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAK,IAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;AACtI,CAAC,CAAC;AAMF,MAAM,qBAAqB,GAAG,CAAC,IAAgB,EAAE,EAAE,iBAAiB,EAAuB,EAAgB,EAAE;IAC3G,6FAA6F;IAC7F,MAAM,oBAAoB,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,CAAC;IAClG,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,OAAO,EAAiB,CAAC;IAC/C,MAAM,cAAc,GAAG,IAAI,OAAO,EAAiB,CAAC;IACpD,MAAM,aAAa,GAAG,IAAI,OAAO,EAAoB,CAAC;IAEtD,MAAM,MAAM,GAAG,GAAkB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAErF,MAAM,QAAQ,GAAG,CAAC,WAA0B,EAAmB,EAAE;QAC/D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA0B,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7I,CAAC,CAAC;IAEF,4FAA4F;IAC5F,MAAM,iBAAiB,GAAG,CAAC,WAA0B,EAAW,EAAE;QAChE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QACpG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1G,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;IACvH,CAAC,CAAC;IAEF,qHAAqH;IACrH,6GAA6G;IAC7G,IAAI,cAA4C,CAAC;IACjD,MAAM,kBAAkB,GAAG,GAAS,EAAE;QACpC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;YAC7E,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,cAAc,GAAG,IAAI,oBAAoB,CAAC,CAAC,OAAO,EAAE,EAAE;YACpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACjC,iBAAiB,CAAC,MAAM,CAAC,MAAiB,CAAC,CAAC;gBAC9C,CAAC;qBAAM,CAAC;oBACN,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;wBACjD,wBAAwB,CAAC,IAAI,CAAC,CAAC;oBACjC,CAAC;gBACH,CAAC;YACH,CAAC;YACD,uGAAuG;YACvG,cAAc,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACjH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAyB,CAAC,EAAE,CAAC;gBAChF,gFAAgF;gBAChF,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjF,aAAa,CAAC,GAAG,CAAC,KAAyB,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,iBAAiB,EAAE,CAAC;YACtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/B,wBAAwB,CAAC,KAAK,CAAC,CAAC;oBAChC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QAED,YAAY,KAAK,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,kBAAkB,EAAE,CAAC;QACvB,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACxB,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,qGAAqG;IACrG,MAAM,MAAM,GAAG,CAAC,KAAY,EAAQ,EAAE;QACpC,IAAI,KAAK,CAAC,MAAM,YAAY,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,EAAE,CAAC;QACX,CAAC;IACH,CAAC,CAAC;IAEF,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC;IAET,OAAO,GAAG,EAAE;QACV,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtB,cAAc,EAAE,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAgB,EAAgB,EAAE;IACzE,OAAO,qBAAqB,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;AACnE,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAgB,EAAgB,EAAE;IACxE,OAAO,qBAAqB,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;AAClE,CAAC,CAAC","sourcesContent":["import { rescopeDocumentRootSelectors } from './document-root-selectors.js';\nimport {\n  MF_ROOT_FONT_SIZE_PROPERTY,\n  REM_LENGTH_HINT_PATTERN,\n  ROOT_FONT_SIZE_DECLARATION_PATTERN,\n  rewriteRemLengths,\n  UNFOLLOWED_REM_PATTERN,\n} from './root-font-size.js';\n\nconst INLINE_REM_SELECTOR = '[style*=\"rem\" i]';\n\n// By class name, not instanceof: a root in another window (a frame, or a test's own window) has its own CSSFontFaceRule.\nconst isFontFaceRule = (rule: CSSRule): boolean => {\n  return rule.constructor?.name === 'CSSFontFaceRule';\n};\n\n// Rule kinds are told apart by what they carry, not by class: @import has a sheet, style and keyframe rules have\n// declarations, and grouping rules (@media, @supports, @container, @layer, @keyframes, nesting) have child rules.\nconst importedSheetOf = (rule: CSSRule): CSSStyleSheet | undefined => {\n  return 'styleSheet' in rule && rule.styleSheet ? (rule.styleSheet as CSSStyleSheet) : undefined;\n};\n\nconst declarationsOf = (rule: CSSRule): CSSStyleDeclaration | undefined => {\n  return 'style' in rule && rule.style && !isFontFaceRule(rule) ? (rule.style as CSSStyleDeclaration) : undefined;\n};\n\nconst childRulesOf = (rule: CSSRule): CSSRuleList | undefined => {\n  return 'cssRules' in rule && rule.cssRules ? (rule.cssRules as CSSRuleList) : undefined;\n};\n\nconst readRules = (sheet: CSSStyleSheet): CSSRuleList | undefined => {\n  try {\n    return sheet.cssRules;\n  } catch {\n    // A cross-origin sheet (a font service's @font-face list) cannot be read, and none of its rules are module rules.\n    return undefined;\n  }\n};\n\nconst walkRules = (sheet: CSSStyleSheet, visit: (rule: CSSRule) => void): void => {\n  const walk = (rules: CSSRuleList): void => {\n    for (const rule of Array.from(rules)) {\n      const importedSheet = importedSheetOf(rule);\n      const importedRules = importedSheet ? readRules(importedSheet) : undefined;\n      if (importedRules) {\n        walk(importedRules);\n      }\n      visit(rule);\n      const childRules = childRulesOf(rule);\n      if (childRules) {\n        walk(childRules);\n      }\n    }\n  };\n  const rules = readRules(sheet);\n  if (rules) {\n    walk(rules);\n  }\n};\n\n// Only declaration blocks change, through the CSSOM: @media, @container and @supports conditions keep their rem (var()\n// is invalid there, and a media query rem is the browser's initial size anyway), and !important stays with its value.\n// CSSOM changes are not DOM mutations, so no observer, this one or another on the same root, sees them.\nconst followRemInSheet = (sheet: CSSStyleSheet): void => {\n  walkRules(sheet, (rule) => {\n    const declarations = declarationsOf(rule);\n    if (declarations && REM_LENGTH_HINT_PATTERN.test(declarations.cssText)) {\n      const rewritten = rewriteRemLengths(declarations.cssText);\n      if (rewritten !== declarations.cssText) {\n        declarations.cssText = rewritten;\n      }\n    }\n  });\n};\n\nconst rescopeDocumentRootRules = (sheet: CSSStyleSheet): void => {\n  walkRules(sheet, (rule) => {\n    if (!('selectorText' in rule) || typeof rule.selectorText !== 'string') {\n      return;\n    }\n    const { selectorText } = rescopeDocumentRootSelectors(rule.selectorText);\n    if (selectorText !== rule.selectorText) {\n      (rule as CSSStyleRule).selectorText = selectorText;\n    }\n  });\n};\n\nconst declaresRootFontSize = (sheet: CSSStyleSheet): boolean => {\n  let declares = false;\n  walkRules(sheet, (rule) => {\n    declares ||= !!declarationsOf(rule)?.getPropertyValue(MF_ROOT_FONT_SIZE_PROPERTY);\n  });\n  return declares;\n};\n\n// Inline styles carry rem too, from templates (`style=\"padding-bottom: 0.25rem !important\"`) and from style bindings\n// and code. The whole declaration block is rewritten through element.style, as for sheet rules: !important stays with\n// its value, and a shorthand that also holds var() (whose longhands read empty) is still seen. Material sets inline\n// styles constantly (ripples, overlay positions), so anything without an unfollowed rem length returns at once, and a\n// followed value never looks like work again, which is also why a second observer on the same root writes nothing.\nconst followInlineStyle = (element: Element): void => {\n  const attribute = element.getAttribute('style');\n  if (!attribute || !UNFOLLOWED_REM_PATTERN.test(attribute)) {\n    return;\n  }\n  const style = (element as HTMLElement).style;\n  const declarations = style?.cssText;\n  if (!declarations) {\n    return;\n  }\n  const rewritten = rewriteRemLengths(declarations);\n  if (rewritten !== declarations) {\n    style.cssText = rewritten;\n  }\n};\n\nconst followInlineStylesWithin = (node: Node): void => {\n  if (node.nodeType !== 1) {\n    return;\n  }\n  const element = node as Element;\n  followInlineStyle(element);\n  if (element.firstElementChild) {\n    for (const descendant of Array.from(element.querySelectorAll(INLINE_REM_SELECTOR))) {\n      followInlineStyle(descendant);\n    }\n  }\n};\n\ntype TStyleOwner = HTMLLinkElement | HTMLStyleElement;\n\nconst isStyleOwner = (node: Node): node is TStyleOwner => {\n  return node.nodeName === 'STYLE' || (node.nodeName === 'LINK' && (node as HTMLLinkElement).rel.split(/\\s+/).includes('stylesheet'));\n};\n\ninterface IAdaptStylesOptions {\n  documentRootRules: boolean;\n}\n\nconst adaptShadowRootStyles = (root: ShadowRoot, { documentRootRules }: IAdaptStylesOptions): (() => void) => {\n  // The root's own window, which need not be the global one (a frame, or a test's own window).\n  const RootMutationObserver = root.ownerDocument.defaultView?.MutationObserver ?? MutationObserver;\n  let followingRem = false;\n  const remSheets = new WeakSet<CSSStyleSheet>();\n  const rescopedSheets = new WeakSet<CSSStyleSheet>();\n  const watchedStyles = new WeakSet<HTMLStyleElement>();\n\n  const owners = (): TStyleOwner[] => Array.from(root.childNodes).filter(isStyleOwner);\n\n  const sheetsOf = (styleOwners: TStyleOwner[]): CSSStyleSheet[] => {\n    return [...(root.adoptedStyleSheets ?? []), ...styleOwners.map((owner) => owner.sheet).filter((sheet): sheet is CSSStyleSheet => !!sheet)];\n  };\n\n  // A <style>'s own text is the cheap check; linked and adopted sheets have only their rules.\n  const findsRootFontSize = (styleOwners: TStyleOwner[]): boolean => {\n    const styles = styleOwners.filter((owner): owner is HTMLStyleElement => owner.nodeName === 'STYLE');\n    if (styles.some((style) => ROOT_FONT_SIZE_DECLARATION_PATTERN.test(style.textContent ?? ''))) {\n      return true;\n    }\n    const linkedSheets = styleOwners.filter((owner) => owner.nodeName === 'LINK').map((owner) => owner.sheet);\n    return [...(root.adoptedStyleSheets ?? []), ...linkedSheets].some((sheet) => !!sheet && declaresRootFontSize(sheet));\n  };\n\n  // Started only once the module's CSS declares a root size, so a module without one pays nothing. An element gets its\n  // template styles before it is inserted, so insertions are scanned as well as later style attribute changes.\n  let inlineObserver: MutationObserver | undefined;\n  const followInlineStyles = (): void => {\n    for (const element of Array.from(root.querySelectorAll(INLINE_REM_SELECTOR))) {\n      followInlineStyle(element);\n    }\n    inlineObserver = new RootMutationObserver((records) => {\n      for (const record of records) {\n        if (record.type === 'attributes') {\n          followInlineStyle(record.target as Element);\n        } else {\n          for (const node of Array.from(record.addedNodes)) {\n            followInlineStylesWithin(node);\n          }\n        }\n      }\n      // Only this callback ran since the records were delivered, so what is queued now are its own rewrites.\n      inlineObserver?.takeRecords();\n    });\n    inlineObserver.observe(root, { attributeFilter: ['style'], attributes: true, childList: true, subtree: true });\n  };\n\n  const observer = new RootMutationObserver(() => update());\n\n  const update = (): void => {\n    const styleOwners = owners();\n    for (const owner of styleOwners) {\n      if (owner.nodeName === 'STYLE' && !watchedStyles.has(owner as HTMLStyleElement)) {\n        // Replacing a <style>'s text gives it a new sheet, which must be adapted again.\n        observer.observe(owner, { characterData: true, childList: true, subtree: true });\n        watchedStyles.add(owner as HTMLStyleElement);\n      }\n    }\n\n    const sheets = sheetsOf(styleOwners);\n    if (documentRootRules) {\n      for (const sheet of sheets) {\n        if (!rescopedSheets.has(sheet)) {\n          rescopeDocumentRootRules(sheet);\n          rescopedSheets.add(sheet);\n        }\n      }\n    }\n\n    followingRem ||= findsRootFontSize(styleOwners);\n    if (!followingRem) {\n      return;\n    }\n    if (!inlineObserver) {\n      followInlineStyles();\n    }\n    for (const sheet of sheets) {\n      if (!remSheets.has(sheet)) {\n        followRemInSheet(sheet);\n        remSheets.add(sheet);\n      }\n    }\n  };\n\n  // A <link> sheet has no rules until it loads; load does not bubble, so it is caught on the way down.\n  const onLoad = (event: Event): void => {\n    if (event.target instanceof Node && isStyleOwner(event.target)) {\n      update();\n    }\n  };\n\n  observer.observe(root, { childList: true });\n  root.addEventListener('load', onLoad, true);\n  update();\n\n  return () => {\n    observer.disconnect();\n    inlineObserver?.disconnect();\n    root.removeEventListener('load', onLoad, true);\n  };\n};\n\n/**\n * Makes rem lengths in a hosted module's shadow root follow the root font size its own page had, once the module's\n * CSS declares one (see MF_ROOT_FONT_SIZE_PROPERTY): in stylesheets already in the root and every one added or changed\n * later, such as the component styles Angular adds as components first render, and in inline style attributes,\n * including ones inserted or changed later. A module whose CSS never sizes its root is left untouched. Returns a\n * function that stops following; rewritten rules and styles stay rewritten.\n */\nexport const followModuleRootFontSize = (root: ShadowRoot): (() => void) => {\n  return adaptShadowRootStyles(root, { documentRootRules: false });\n};\n\n/**\n * Adapts the CSS a module brings into its shadow root at runtime to the hosted page, for a host to call on each module\n * shadow root it creates and stop on unmount: rem follows the module's own root font size (as followModuleRootFontSize\n * does), and rules a library injects for the document root (`html { --mat-focus-indicator-display: block; }`), which\n * never match inside a shadow root, move onto `:host` (see rescopeDocumentRootSelectors). Safe beside a module's own\n * followModuleRootFontSize on the same root: every step is idempotent, and neither writes anything the other acts on.\n */\nexport const adaptHostedModuleStyles = (root: ShadowRoot): (() => void) => {\n  return adaptShadowRootStyles(root, { documentRootRules: true });\n};\n"]}
+{"version":3,"file":"hosted-module-styles.js","sourceRoot":"","sources":["../src/hosted-module-styles.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,4BAA4B,EAAE,MAAM,8BAA8B,CAAC;AAC5E,OAAO,EACL,0BAA0B,EAC1B,uBAAuB,EACvB,kCAAkC,EAClC,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,MAAM,mBAAmB,GAAG,kBAAkB,CAAC;AAC/C,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAErD,yHAAyH;AACzH,yHAAyH;AACzH,qGAAqG;AACrG,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,MAAM,oBAAoB,GAAG,sBAAsB,CAAC;AAEpD,sHAAsH;AACtH,qHAAqH;AACrH,wBAAwB;AACxB,MAAM,aAAa,GAAG,CAAC,YAAiC,EAAW,EAAE;IACnE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IACjD,IAAI,CAAC,CAAC,MAAM,IAAI,4BAA4B,CAAC,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,YAAY,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,MAAM,GAAG,4BAA4B,IAAI,EAAE,YAAY,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;IACvH,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,yHAAyH;AACzH,MAAM,cAAc,GAAG,CAAC,IAAa,EAAW,EAAE;IAChD,OAAO,IAAI,CAAC,WAAW,EAAE,IAAI,KAAK,iBAAiB,CAAC;AACtD,CAAC,CAAC;AAEF,iHAAiH;AACjH,kHAAkH;AAClH,MAAM,eAAe,GAAG,CAAC,IAAa,EAA6B,EAAE;IACnE,OAAO,YAAY,IAAI,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAE,IAAI,CAAC,UAA4B,CAAC,CAAC,CAAC,SAAS,CAAC;AAClG,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,IAAa,EAAmC,EAAE;IACxE,OAAO,OAAO,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAA6B,CAAC,CAAC,CAAC,SAAS,CAAC;AAClH,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,IAAa,EAA2B,EAAE;IAC9D,OAAO,UAAU,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,QAAwB,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1F,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,KAAoB,EAA2B,EAAE;IAClE,IAAI,CAAC;QACH,OAAO,KAAK,CAAC,QAAQ,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,kHAAkH;QAClH,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,KAAoB,EAAE,KAA8B,EAAQ,EAAE;IAC/E,MAAM,IAAI,GAAG,CAAC,KAAkB,EAAQ,EAAE;QACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,aAAa,GAAG,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,IAAI,aAAa,EAAE,CAAC;gBAClB,IAAI,CAAC,aAAa,CAAC,CAAC;YACtB,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,CAAC;YACZ,MAAM,UAAU,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,UAAU,EAAE,CAAC;gBACf,IAAI,CAAC,UAAU,CAAC,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,KAAK,CAAC,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,uHAAuH;AACvH,sHAAsH;AACtH,wGAAwG;AACxG,MAAM,gBAAgB,GAAG,CAAC,KAAoB,EAAQ,EAAE;IACtD,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,YAAY,IAAI,uBAAuB,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YACvE,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAC1D,IAAI,SAAS,KAAK,YAAY,CAAC,OAAO,EAAE,CAAC;gBACvC,YAAY,CAAC,OAAO,GAAG,SAAS,CAAC;YACnC,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,KAAoB,EAAQ,EAAE;IAC9D,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACvE,OAAO;QACT,CAAC;QACD,MAAM,EAAE,YAAY,EAAE,GAAG,4BAA4B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzE,IAAI,YAAY,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,IAAqB,CAAC,YAAY,GAAG,YAAY,CAAC;QACrD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,KAAoB,EAAQ,EAAE;IAC3D,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;QACxB,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,YAAY,IAAI,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,aAAa,CAAC,YAAY,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,KAAoB,EAAW,EAAE;IAC7D,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,SAAS,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE;QACxB,QAAQ,KAAK,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,qHAAqH;AACrH,sHAAsH;AACtH,oHAAoH;AACpH,sHAAsH;AACtH,mHAAmH;AACnH,MAAM,iBAAiB,GAAG,CAAC,OAAgB,EAAQ,EAAE;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAAI,OAAuB,CAAC,KAAK,CAAC;IAC7C,MAAM,YAAY,GAAG,KAAK,EAAE,OAAO,CAAC;IACpC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAClD,IAAI,SAAS,KAAK,YAAY,EAAE,CAAC;QAC/B,KAAK,CAAC,OAAO,GAAG,SAAS,CAAC;IAC5B,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,CAAC,IAAU,EAAQ,EAAE;IACpD,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,IAAe,CAAC;IAChC,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAC9B,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;YACnF,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;AACH,CAAC,CAAC;AAIF,MAAM,YAAY,GAAG,CAAC,IAAU,EAAuB,EAAE;IACvD,OAAO,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAK,IAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;AACtI,CAAC,CAAC;AAOF,uHAAuH;AACvH,wHAAwH;AACxH,0GAA0G;AAC1G,MAAM,oBAAoB,GAAG,CAAC,IAAgB,EAAE,oBAA6C,EAAoB,EAAE;IACjH,MAAM,MAAM,GAAG,IAAI,OAAO,EAAmB,CAAC;IAC9C,MAAM,IAAI,GAAG,CAAC,OAAgB,EAAQ,EAAE;QACtC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;YAClF,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAI,OAAuB,CAAC,KAAK,CAAC;QAC7C,IAAI,KAAK,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,CAAC,IAAU,EAAQ,EAAE;QACtC,IAAI,IAAI,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAe,CAAC,CAAC;QACtB,KAAK,MAAM,UAAU,IAAI,KAAK,CAAC,IAAI,CAAE,IAAgB,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC;YAChG,IAAI,CAAC,UAAU,CAAC,CAAC;QACnB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC;QAChF,IAAI,CAAC,OAAO,CAAC,CAAC;IAChB,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC,CAAC,OAAO,EAAE,EAAE;QACpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,IAAI,CAAC,MAAM,CAAC,MAAiB,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;oBACjD,UAAU,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IACH,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACzG,OAAO,QAAQ,CAAC;AAClB,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,IAAgB,EAAE,EAAE,iBAAiB,EAAE,UAAU,EAAuB,EAAgB,EAAE;IACvH,6FAA6F;IAC7F,MAAM,oBAAoB,GAAG,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,gBAAgB,IAAI,gBAAgB,CAAC;IAClG,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,SAAS,GAAG,IAAI,OAAO,EAAiB,CAAC;IAC/C,MAAM,cAAc,GAAG,IAAI,OAAO,EAAiB,CAAC;IACpD,MAAM,YAAY,GAAG,IAAI,OAAO,EAAiB,CAAC;IAClD,MAAM,aAAa,GAAG,IAAI,OAAO,EAAoB,CAAC;IAEtD,MAAM,MAAM,GAAG,GAAkB,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAErF,MAAM,QAAQ,GAAG,CAAC,WAA0B,EAAmB,EAAE;QAC/D,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA0B,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7I,CAAC,CAAC;IAEF,4FAA4F;IAC5F,MAAM,iBAAiB,GAAG,CAAC,WAA0B,EAAW,EAAE;QAChE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;QACpG,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;YAC7F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1G,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;IACvH,CAAC,CAAC;IAEF,qHAAqH;IACrH,6GAA6G;IAC7G,IAAI,cAA4C,CAAC;IACjD,MAAM,kBAAkB,GAAG,GAAS,EAAE;QACpC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;YAC7E,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,cAAc,GAAG,IAAI,oBAAoB,CAAC,CAAC,OAAO,EAAE,EAAE;YACpD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;oBACjC,iBAAiB,CAAC,MAAM,CAAC,MAAiB,CAAC,CAAC;gBAC9C,CAAC;qBAAM,CAAC;oBACN,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;wBACjD,wBAAwB,CAAC,IAAI,CAAC,CAAC;oBACjC,CAAC;gBACH,CAAC;YACH,CAAC;YACD,uGAAuG;YACvG,cAAc,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,cAAc,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,eAAe,EAAE,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACjH,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAE1D,MAAM,MAAM,GAAG,GAAS,EAAE;QACxB,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC;QAC7B,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAyB,CAAC,EAAE,CAAC;gBAChF,gFAAgF;gBAChF,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjF,aAAa,CAAC,GAAG,CAAC,KAAyB,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,iBAAiB,EAAE,CAAC;YACtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/B,wBAAwB,CAAC,KAAK,CAAC,CAAC;oBAChC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC7B,qBAAqB,CAAC,KAAK,CAAC,CAAC;oBAC7B,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC1B,CAAC;YACH,CAAC;QACH,CAAC;QAED,YAAY,KAAK,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,kBAAkB,EAAE,CAAC;QACvB,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1B,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACxB,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,qGAAqG;IACrG,MAAM,MAAM,GAAG,CAAC,KAAY,EAAQ,EAAE;QACpC,IAAI,KAAK,CAAC,MAAM,YAAY,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/D,MAAM,EAAE,CAAC;QACX,CAAC;IACH,CAAC,CAAC;IAEF,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC5C,MAAM,EAAE,CAAC;IACT,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjG,OAAO,GAAG,EAAE;QACV,QAAQ,CAAC,UAAU,EAAE,CAAC;QACtB,cAAc,EAAE,UAAU,EAAE,CAAC;QAC7B,cAAc,EAAE,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAgB,EAAgB,EAAE;IACzE,OAAO,qBAAqB,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;AACtF,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAgB,EAAgB,EAAE;IACxE,OAAO,qBAAqB,CAAC,IAAI,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AACpF,CAAC,CAAC","sourcesContent":["import { rescopeDocumentRootSelectors } from './document-root-selectors.js';\nimport {\n  MF_ROOT_FONT_SIZE_PROPERTY,\n  REM_LENGTH_HINT_PATTERN,\n  ROOT_FONT_SIZE_DECLARATION_PATTERN,\n  rewriteRemLengths,\n  UNFOLLOWED_REM_PATTERN,\n} from './root-font-size.js';\n\nconst INLINE_REM_SELECTOR = '[style*=\"rem\" i]';\nconst INLINE_STICKY_SELECTOR = '[style*=\"sticky\" i]';\n\n// The legacy navigation's top bar (@edyn/navigation: `.mat-sidenav-container { padding-top: 49px }`). Old pages scrolled\n// under it, so their sticky headers stuck below it with `top: 49px` (or 50px, one pixel lower). Hosted, a module scrolls\n// in the host's content area, which has no bar inside it, so those headers would stick 49px too low.\nconst LEGACY_NAVIGATION_BAR_HEIGHT = 49;\nconst PIXEL_LENGTH_PATTERN = /^(\\d+(?:\\.\\d+)?)px$/i;\n\n// A sticky top of at least the bar's height moves up by the bar; smaller ones (0, 1px) belong to pages or panels that\n// scrolled below the bar already, and anything else (var(), %, calc()) is a module's own choice. Returns whether the\n// declarations changed.\nconst liftStickyTop = (declarations: CSSStyleDeclaration): boolean => {\n  if (!/sticky/i.test(declarations.getPropertyValue('position'))) {\n    return false;\n  }\n  const top = PIXEL_LENGTH_PATTERN.exec(declarations.getPropertyValue('top').trim());\n  const pixels = top ? Number(top[1]) : Number.NaN;\n  if (!(pixels >= LEGACY_NAVIGATION_BAR_HEIGHT)) {\n    return false;\n  }\n  declarations.setProperty('top', `${pixels - LEGACY_NAVIGATION_BAR_HEIGHT}px`, declarations.getPropertyPriority('top'));\n  return true;\n};\n\n// By class name, not instanceof: a root in another window (a frame, or a test's own window) has its own CSSFontFaceRule.\nconst isFontFaceRule = (rule: CSSRule): boolean => {\n  return rule.constructor?.name === 'CSSFontFaceRule';\n};\n\n// Rule kinds are told apart by what they carry, not by class: @import has a sheet, style and keyframe rules have\n// declarations, and grouping rules (@media, @supports, @container, @layer, @keyframes, nesting) have child rules.\nconst importedSheetOf = (rule: CSSRule): CSSStyleSheet | undefined => {\n  return 'styleSheet' in rule && rule.styleSheet ? (rule.styleSheet as CSSStyleSheet) : undefined;\n};\n\nconst declarationsOf = (rule: CSSRule): CSSStyleDeclaration | undefined => {\n  return 'style' in rule && rule.style && !isFontFaceRule(rule) ? (rule.style as CSSStyleDeclaration) : undefined;\n};\n\nconst childRulesOf = (rule: CSSRule): CSSRuleList | undefined => {\n  return 'cssRules' in rule && rule.cssRules ? (rule.cssRules as CSSRuleList) : undefined;\n};\n\nconst readRules = (sheet: CSSStyleSheet): CSSRuleList | undefined => {\n  try {\n    return sheet.cssRules;\n  } catch {\n    // A cross-origin sheet (a font service's @font-face list) cannot be read, and none of its rules are module rules.\n    return undefined;\n  }\n};\n\nconst walkRules = (sheet: CSSStyleSheet, visit: (rule: CSSRule) => void): void => {\n  const walk = (rules: CSSRuleList): void => {\n    for (const rule of Array.from(rules)) {\n      const importedSheet = importedSheetOf(rule);\n      const importedRules = importedSheet ? readRules(importedSheet) : undefined;\n      if (importedRules) {\n        walk(importedRules);\n      }\n      visit(rule);\n      const childRules = childRulesOf(rule);\n      if (childRules) {\n        walk(childRules);\n      }\n    }\n  };\n  const rules = readRules(sheet);\n  if (rules) {\n    walk(rules);\n  }\n};\n\n// Only declaration blocks change, through the CSSOM: @media, @container and @supports conditions keep their rem (var()\n// is invalid there, and a media query rem is the browser's initial size anyway), and !important stays with its value.\n// CSSOM changes are not DOM mutations, so no observer, this one or another on the same root, sees them.\nconst followRemInSheet = (sheet: CSSStyleSheet): void => {\n  walkRules(sheet, (rule) => {\n    const declarations = declarationsOf(rule);\n    if (declarations && REM_LENGTH_HINT_PATTERN.test(declarations.cssText)) {\n      const rewritten = rewriteRemLengths(declarations.cssText);\n      if (rewritten !== declarations.cssText) {\n        declarations.cssText = rewritten;\n      }\n    }\n  });\n};\n\nconst rescopeDocumentRootRules = (sheet: CSSStyleSheet): void => {\n  walkRules(sheet, (rule) => {\n    if (!('selectorText' in rule) || typeof rule.selectorText !== 'string') {\n      return;\n    }\n    const { selectorText } = rescopeDocumentRootSelectors(rule.selectorText);\n    if (selectorText !== rule.selectorText) {\n      (rule as CSSStyleRule).selectorText = selectorText;\n    }\n  });\n};\n\nconst liftStickyTopsInSheet = (sheet: CSSStyleSheet): void => {\n  walkRules(sheet, (rule) => {\n    const declarations = declarationsOf(rule);\n    if (declarations && /sticky/i.test(declarations.cssText)) {\n      liftStickyTop(declarations);\n    }\n  });\n};\n\nconst declaresRootFontSize = (sheet: CSSStyleSheet): boolean => {\n  let declares = false;\n  walkRules(sheet, (rule) => {\n    declares ||= !!declarationsOf(rule)?.getPropertyValue(MF_ROOT_FONT_SIZE_PROPERTY);\n  });\n  return declares;\n};\n\n// Inline styles carry rem too, from templates (`style=\"padding-bottom: 0.25rem !important\"`) and from style bindings\n// and code. The whole declaration block is rewritten through element.style, as for sheet rules: !important stays with\n// its value, and a shorthand that also holds var() (whose longhands read empty) is still seen. Material sets inline\n// styles constantly (ripples, overlay positions), so anything without an unfollowed rem length returns at once, and a\n// followed value never looks like work again, which is also why a second observer on the same root writes nothing.\nconst followInlineStyle = (element: Element): void => {\n  const attribute = element.getAttribute('style');\n  if (!attribute || !UNFOLLOWED_REM_PATTERN.test(attribute)) {\n    return;\n  }\n  const style = (element as HTMLElement).style;\n  const declarations = style?.cssText;\n  if (!declarations) {\n    return;\n  }\n  const rewritten = rewriteRemLengths(declarations);\n  if (rewritten !== declarations) {\n    style.cssText = rewritten;\n  }\n};\n\nconst followInlineStylesWithin = (node: Node): void => {\n  if (node.nodeType !== 1) {\n    return;\n  }\n  const element = node as Element;\n  followInlineStyle(element);\n  if (element.firstElementChild) {\n    for (const descendant of Array.from(element.querySelectorAll(INLINE_REM_SELECTOR))) {\n      followInlineStyle(descendant);\n    }\n  }\n};\n\ntype TStyleOwner = HTMLLinkElement | HTMLStyleElement;\n\nconst isStyleOwner = (node: Node): node is TStyleOwner => {\n  return node.nodeName === 'STYLE' || (node.nodeName === 'LINK' && (node as HTMLLinkElement).rel.split(/\\s+/).includes('stylesheet'));\n};\n\ninterface IAdaptStylesOptions {\n  documentRootRules: boolean;\n  stickyTops: boolean;\n}\n\n// Sticky headers set from code carry their top inline (`style.cssText = 'position: sticky; top: 50px'` in the modules'\n// position-sticky directives). Each value a module writes moves up once: the attribute this wrote is remembered, so its\n// own change, which the observer sees too, is not lifted again, while a value the module writes later is.\nconst liftInlineStickyTops = (root: ShadowRoot, RootMutationObserver: typeof MutationObserver): MutationObserver => {\n  const lifted = new WeakMap<Element, string>();\n  const lift = (element: Element): void => {\n    const attribute = element.getAttribute('style');\n    if (!attribute || !/sticky/i.test(attribute) || lifted.get(element) === attribute) {\n      return;\n    }\n    const style = (element as HTMLElement).style;\n    if (style && liftStickyTop(style)) {\n      lifted.set(element, element.getAttribute('style') ?? '');\n    }\n  };\n  const liftWithin = (node: Node): void => {\n    if (node.nodeType !== 1) {\n      return;\n    }\n    lift(node as Element);\n    for (const descendant of Array.from((node as Element).querySelectorAll(INLINE_STICKY_SELECTOR))) {\n      lift(descendant);\n    }\n  };\n\n  for (const element of Array.from(root.querySelectorAll(INLINE_STICKY_SELECTOR))) {\n    lift(element);\n  }\n  const observer = new RootMutationObserver((records) => {\n    for (const record of records) {\n      if (record.type === 'attributes') {\n        lift(record.target as Element);\n      } else {\n        for (const node of Array.from(record.addedNodes)) {\n          liftWithin(node);\n        }\n      }\n    }\n  });\n  observer.observe(root, { attributeFilter: ['style'], attributes: true, childList: true, subtree: true });\n  return observer;\n};\n\nconst adaptShadowRootStyles = (root: ShadowRoot, { documentRootRules, stickyTops }: IAdaptStylesOptions): (() => void) => {\n  // The root's own window, which need not be the global one (a frame, or a test's own window).\n  const RootMutationObserver = root.ownerDocument.defaultView?.MutationObserver ?? MutationObserver;\n  let followingRem = false;\n  const remSheets = new WeakSet<CSSStyleSheet>();\n  const rescopedSheets = new WeakSet<CSSStyleSheet>();\n  const stickySheets = new WeakSet<CSSStyleSheet>();\n  const watchedStyles = new WeakSet<HTMLStyleElement>();\n\n  const owners = (): TStyleOwner[] => Array.from(root.childNodes).filter(isStyleOwner);\n\n  const sheetsOf = (styleOwners: TStyleOwner[]): CSSStyleSheet[] => {\n    return [...(root.adoptedStyleSheets ?? []), ...styleOwners.map((owner) => owner.sheet).filter((sheet): sheet is CSSStyleSheet => !!sheet)];\n  };\n\n  // A <style>'s own text is the cheap check; linked and adopted sheets have only their rules.\n  const findsRootFontSize = (styleOwners: TStyleOwner[]): boolean => {\n    const styles = styleOwners.filter((owner): owner is HTMLStyleElement => owner.nodeName === 'STYLE');\n    if (styles.some((style) => ROOT_FONT_SIZE_DECLARATION_PATTERN.test(style.textContent ?? ''))) {\n      return true;\n    }\n    const linkedSheets = styleOwners.filter((owner) => owner.nodeName === 'LINK').map((owner) => owner.sheet);\n    return [...(root.adoptedStyleSheets ?? []), ...linkedSheets].some((sheet) => !!sheet && declaresRootFontSize(sheet));\n  };\n\n  // Started only once the module's CSS declares a root size, so a module without one pays nothing. An element gets its\n  // template styles before it is inserted, so insertions are scanned as well as later style attribute changes.\n  let inlineObserver: MutationObserver | undefined;\n  const followInlineStyles = (): void => {\n    for (const element of Array.from(root.querySelectorAll(INLINE_REM_SELECTOR))) {\n      followInlineStyle(element);\n    }\n    inlineObserver = new RootMutationObserver((records) => {\n      for (const record of records) {\n        if (record.type === 'attributes') {\n          followInlineStyle(record.target as Element);\n        } else {\n          for (const node of Array.from(record.addedNodes)) {\n            followInlineStylesWithin(node);\n          }\n        }\n      }\n      // Only this callback ran since the records were delivered, so what is queued now are its own rewrites.\n      inlineObserver?.takeRecords();\n    });\n    inlineObserver.observe(root, { attributeFilter: ['style'], attributes: true, childList: true, subtree: true });\n  };\n\n  const observer = new RootMutationObserver(() => update());\n\n  const update = (): void => {\n    const styleOwners = owners();\n    for (const owner of styleOwners) {\n      if (owner.nodeName === 'STYLE' && !watchedStyles.has(owner as HTMLStyleElement)) {\n        // Replacing a <style>'s text gives it a new sheet, which must be adapted again.\n        observer.observe(owner, { characterData: true, childList: true, subtree: true });\n        watchedStyles.add(owner as HTMLStyleElement);\n      }\n    }\n\n    const sheets = sheetsOf(styleOwners);\n    if (documentRootRules) {\n      for (const sheet of sheets) {\n        if (!rescopedSheets.has(sheet)) {\n          rescopeDocumentRootRules(sheet);\n          rescopedSheets.add(sheet);\n        }\n      }\n    }\n\n    if (stickyTops) {\n      for (const sheet of sheets) {\n        if (!stickySheets.has(sheet)) {\n          liftStickyTopsInSheet(sheet);\n          stickySheets.add(sheet);\n        }\n      }\n    }\n\n    followingRem ||= findsRootFontSize(styleOwners);\n    if (!followingRem) {\n      return;\n    }\n    if (!inlineObserver) {\n      followInlineStyles();\n    }\n    for (const sheet of sheets) {\n      if (!remSheets.has(sheet)) {\n        followRemInSheet(sheet);\n        remSheets.add(sheet);\n      }\n    }\n  };\n\n  // A <link> sheet has no rules until it loads; load does not bubble, so it is caught on the way down.\n  const onLoad = (event: Event): void => {\n    if (event.target instanceof Node && isStyleOwner(event.target)) {\n      update();\n    }\n  };\n\n  observer.observe(root, { childList: true });\n  root.addEventListener('load', onLoad, true);\n  update();\n  const stickyObserver = stickyTops ? liftInlineStickyTops(root, RootMutationObserver) : undefined;\n\n  return () => {\n    observer.disconnect();\n    inlineObserver?.disconnect();\n    stickyObserver?.disconnect();\n    root.removeEventListener('load', onLoad, true);\n  };\n};\n\n/**\n * Makes rem lengths in a hosted module's shadow root follow the root font size its own page had, once the module's\n * CSS declares one (see MF_ROOT_FONT_SIZE_PROPERTY): in stylesheets already in the root and every one added or changed\n * later, such as the component styles Angular adds as components first render, and in inline style attributes,\n * including ones inserted or changed later. A module whose CSS never sizes its root is left untouched. Returns a\n * function that stops following; rewritten rules and styles stay rewritten.\n */\nexport const followModuleRootFontSize = (root: ShadowRoot): (() => void) => {\n  return adaptShadowRootStyles(root, { documentRootRules: false, stickyTops: false });\n};\n\n/**\n * Adapts the CSS a module brings into its shadow root at runtime to the hosted page, for a host to call on each module\n * shadow root it creates and stop on unmount: rem follows the module's own root font size (as followModuleRootFontSize\n * does), and rules a library injects for the document root (`html { --mat-focus-indicator-display: block; }`), which\n * never match inside a shadow root, move onto `:host` (see rescopeDocumentRootSelectors), and sticky tops written for\n * the legacy navigation's top bar (`top: 49px`), in rules and inline styles, move up by that bar, which a hosted page\n * does not have. Safe beside a module's own followModuleRootFontSize on the same root: every step is idempotent, and\n * neither writes anything the other acts on.\n */\nexport const adaptHostedModuleStyles = (root: ShadowRoot): (() => void) => {\n  return adaptShadowRootStyles(root, { documentRootRules: true, stickyTops: true });\n};\n"]}

package/dist/vite-development.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vite-development.d.ts","sourceRoot":"","sources":["../src/vite-development.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAUnC,eAAO,MAAM,mCAAmC,sCAAsC,CAAC;AAsFvF,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;CACvB;AAi4BD,eAAO,MAAM,sBAAsB,GAAI,SAAS,8BAA8B,KAAG,MAmBhF,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,KAAK,IAAI,CAAC;AAExI,eAAO,MAAM,gCAAgC,GAAI,SAAS,8BAA8B,KAAG,2BAK1F,CAAC","sourcesContent":["import { createHash, randomBytes } from 'node:crypto';\nimport type { IncomingMessage, ServerResponse } from 'node:http';\nimport { Readable } from 'node:stream';\nimport { createRemoteJWKSet, jwtVerify } from 'jose';\nimport type { Plugin } from 'vite';\n\nconst SESSION_COOKIE = '__Host-edyn_dev_session';\nconst REFRESH_COOKIE = '__Host-edyn_dev_refresh';\nconst FLOW_COOKIE = '__Host-edyn_oidc_flow';\nconst LOGOUT_COOKIE = '__Host-edyn_oidc_logout';\nconst CALLBACK_PATH = '/callback';\nconst LOGGED_OUT_PATH = '/logged-out';\nconst LOGIN_PATH = '/api/dev-auth/login';\nconst LEGACY_LOGIN_PATH = '/login';\nexport const MF_DEVELOPMENT_HOST_NAVIGATION_PATH = '/api/dev-host-navigation/index.js';\nconst HOST_ICON_PATH = '/exsto-icon.svg';\nconst HOST_NAVIGATION_ASSET_PATHS = new Set([HOST_ICON_PATH, '/exsto-text.svg']);\nconst ICON_LINK_PATTERN = /<link\\b[^>]*\\brel=[\"'](?:shortcut\\s+)?icon[\"'][^>]*>\\s*/gi;\nconst MAX_HOST_NAVIGATION_BYTES = 5 * 1024 * 1024;\nconst MAX_HOST_NAVIGATION_ASSET_BYTES = 512 * 1024;\nconst SESSION_MAX_AGE_SECONDS = 8 * 60 * 60;\nconst REFRESH_COOKIE_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;\nconst FLOW_MAX_AGE_SECONDS = 10 * 60;\nconst TOKEN_REFRESH_SKEW_MS = 30_000;\nconst SPENT_REFRESH_TOKEN_REUSE_MS = 30_000;\nconst NAVIGATION_GROUP_HEADER = 'X-Edyn-Navigation-Group-Id';\nconst NAVIGATION_DEALER_HEADER = 'X-Edyn-Navigation-Dealer-Id';\nconst NAVIGATION_DEALERS_HEADER = 'X-Edyn-Navigation-Dealer-Ids';\nconst NAVIGATION_HEADERS = [NAVIGATION_GROUP_HEADER, NAVIGATION_DEALER_HEADER, NAVIGATION_DEALERS_HEADER].map((name) => name.toLowerCase());\nconst MAX_NAVIGATION_EVENT_BYTES = 5 * 1024 * 1024;\nconst MAX_REQUEST_BODY_BYTES = 100 * 1024 * 1024;\nconst EVENT_SEPARATOR = /\\r?\\n\\r?\\n/;\nconst COOKIE_NAME_PATTERN = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\nconst COOKIE_VALUE_PATTERN = /^[\\x20-\\x7e]*$/;\nconst ALLOWED_HOST_API_PATHS = [\n  '/api/auth/me',\n  '/api/navigation',\n  '/api/navigation/access-check',\n  '/api/navigation/access-request',\n  '/api/navigation/counter-stream',\n] as const;\n\ninterface IOidcClientConfiguration {\n  clientId: string;\n  issuer: string;\n  scope: string;\n}\n\ninterface IOidcDiscovery {\n  authorizationEndpoint: string;\n  endSessionEndpoint: string;\n  issuer: string;\n  jwksUri: string;\n  revocationEndpoint: string | null;\n  tokenEndpoint: string;\n}\n\ninterface IOidcFlow {\n  codeVerifier: string;\n  createdAt: number;\n  nonce: string;\n  returnTo: string;\n  state: string;\n}\n\ninterface IModuleNavigationContext {\n  dealerIds: readonly number[];\n  groupId: number;\n}\n\ninterface IModuleProxyContext {\n  cookies: Map<string, string>;\n  navigationContext: IModuleNavigationContext | null;\n}\n\ninterface ITokenSession {\n  accessToken: string;\n  expiresAt: number;\n  idToken: string | null;\n  moduleBootstrapTail: Promise<void>;\n  moduleCookies: Map<string, string>;\n  moduleNavigationContext: IModuleNavigationContext | null;\n  navigationContextPromise?: Promise<void>;\n  refreshPromise?: Promise<void>;\n  refreshToken: string | null;\n}\n\ninterface ILogoutFlow {\n  createdAt: number;\n  idToken: string | null;\n}\n\ninterface ITokenResponse {\n  accessToken: string;\n  expiresIn: number;\n  idToken: string | null;\n  refreshToken: string | null;\n  tokenType: string;\n}\n\nexport interface IMfDevelopmentBffPluginOptions {\n  developmentOrigin?: string;\n  hostNavigationUrl: string;\n  moduleApiOrigin: string;\n  moduleApiPath: string;\n}\n\nconst isRecord = (value: unknown): value is Record<string, unknown> => typeof value === 'object' && value !== null && !Array.isArray(value);\n\nconst requiredString = (value: Record<string, unknown>, key: string): string => {\n  const candidate = value[key];\n  if (typeof candidate !== 'string' || candidate.trim() === '') {\n    throw new Error(`OIDC response is missing ${key}.`);\n  }\n  return candidate;\n};\n\nconst optionalString = (value: Record<string, unknown>, key: string): string | null => {\n  const candidate = value[key];\n  if (candidate === undefined || candidate === null) {\n    return null;\n  }\n  if (typeof candidate !== 'string' || candidate.trim() === '') {\n    throw new Error(`OIDC response contains an invalid ${key}.`);\n  }\n  return candidate;\n};\n\nconst absoluteHttpsUrl = (candidate: string, label: string, allowLocalHttp = false): URL => {\n  let url: URL;\n  try {\n    url = new URL(candidate);\n  } catch {\n    throw new Error(`${label} must be an absolute URL.`);\n  }\n  const isLocalHttp = allowLocalHttp && url.protocol === 'http:' && (url.hostname === 'localhost' || url.hostname === '127.0.0.1');\n  if (url.protocol !== 'https:' && !isLocalHttp) {\n    throw new Error(`${label} must use HTTPS.`);\n  }\n  if (url.username || url.password || url.hash) {\n    throw new Error(`${label} must not contain credentials or a fragment.`);\n  }\n  return url;\n};\n\nconst moduleApiPrefix = (candidate: string): string => {\n  if (!/^\\/[a-z][a-z0-9-]*\\/api\\/$/.test(candidate)) {\n    throw new Error('moduleApiPath must use the canonical /module/api/ boundary.');\n  }\n  return candidate;\n};\n\nconst base64Url = (size = 32): string => randomBytes(size).toString('base64url');\nconst codeChallengeOf = (verifier: string): string => createHash('sha256').update(verifier).digest('base64url');\n\nconst cookiesOf = (request: IncomingMessage): ReadonlyMap<string, string> => {\n  const cookies = new Map<string, string>();\n  for (const part of (request.headers.cookie ?? '').split(';')) {\n    const separator = part.indexOf('=');\n    if (separator <= 0) {\n      continue;\n    }\n    const name = part.slice(0, separator).trim();\n    const value = part.slice(separator + 1).trim();\n    if (name && value) {\n      cookies.set(name, value);\n    }\n  }\n  return cookies;\n};\n\nconst cookie = (name: string, value: string, maxAge: number): string => `${name}=${value}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge}`;\n\nconst clearCookie = (name: string): string => cookie(name, '', 0);\n\n// The refresh token stays in an HttpOnly cookie for this origin, which every module's development server shares, so\n// one sign-in survives restarts and module switches until the token expires; page scripts can never read it.\nconst refreshCookieOf = (session: ITokenSession): string =>\n  session.refreshToken\n    ? cookie(REFRESH_COOKIE, encodeURIComponent(session.refreshToken), REFRESH_COOKIE_MAX_AGE_SECONDS)\n    : clearCookie(REFRESH_COOKIE);\n\nconst decodedCookieValue = (value: string | undefined): string | null => {\n  if (!value) {\n    return null;\n  }\n  try {\n    return decodeURIComponent(value);\n  } catch {\n    return null;\n  }\n};\n\nconst writeJson = (response: ServerResponse, status: number, body: unknown): void => {\n  response.statusCode = status;\n  response.setHeader('Cache-Control', 'no-store');\n  response.setHeader('Content-Type', 'application/json; charset=utf-8');\n  response.end(JSON.stringify(body));\n};\n\nconst redirect = (response: ServerResponse, location: string, cookies: string[] = []): void => {\n  response.statusCode = 302;\n  response.setHeader('Cache-Control', 'no-store');\n  response.setHeader('Location', location);\n  if (cookies.length > 0) {\n    response.setHeader('Set-Cookie', cookies);\n  }\n  response.end();\n};\n\nconst safeReturnTo = (candidate: string | null): string => {\n  if (!candidate?.startsWith('/') || candidate.startsWith('//')) {\n    return '/';\n  }\n  try {\n    const parsed = new URL(candidate, 'https://localhost');\n    return `${parsed.pathname}${parsed.search}${parsed.hash}`;\n  } catch {\n    return '/';\n  }\n};\n\nconst parseTokenResponse = (value: unknown, requireIdToken: boolean): ITokenResponse => {\n  if (!isRecord(value)) {\n    throw new Error('OIDC token endpoint returned an invalid response.');\n  }\n  const expiresIn = value.expires_in;\n  if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0) {\n    throw new Error('OIDC token endpoint returned an invalid expires_in value.');\n  }\n  const idToken = optionalString(value, 'id_token');\n  if (requireIdToken && !idToken) {\n    throw new Error('OIDC token endpoint did not return an ID token.');\n  }\n  const tokenType = requiredString(value, 'token_type');\n  if (tokenType.toLowerCase() !== 'bearer') {\n    throw new Error('OIDC token endpoint returned an unsupported token type.');\n  }\n  return {\n    accessToken: requiredString(value, 'access_token'),\n    expiresIn,\n    idToken,\n    refreshToken: optionalString(value, 'refresh_token'),\n    tokenType,\n  };\n};\n\nconst pathIsHostApi = (path: string): boolean => {\n  return ALLOWED_HOST_API_PATHS.some((candidate) => path === candidate || path.startsWith(`${candidate}/`));\n};\n\n// The host validates a selection the browser sends it, so host requests keep the navigation headers. A module trusts\n// them, so its requests carry only the selection the host last confirmed.\nconst proxyHeaders = (request: IncomingMessage, accessToken: string, module?: IModuleProxyContext): Headers => {\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(request.headers)) {\n    const lowerName = name.toLowerCase();\n    if (\n      !value ||\n      name.startsWith(':') ||\n      ['authorization', 'connection', 'content-length', 'cookie', 'host', 'origin', 'transfer-encoding'].includes(lowerName) ||\n      (module && NAVIGATION_HEADERS.includes(lowerName))\n    ) {\n      continue;\n    }\n    if (Array.isArray(value)) {\n      for (const item of value) {\n        headers.append(name, item);\n      }\n    } else {\n      headers.set(name, value);\n    }\n  }\n  headers.set('Authorization', `Bearer ${accessToken}`);\n  if (module?.cookies.size) {\n    headers.set('Cookie', [...module.cookies.values()].join('; '));\n  }\n  const navigationContext = module?.navigationContext;\n  if (navigationContext) {\n    headers.set(NAVIGATION_GROUP_HEADER, String(navigationContext.groupId));\n    headers.set(NAVIGATION_DEALERS_HEADER, navigationContext.dealerIds.join(','));\n    if (navigationContext.dealerIds.length === 1) {\n      headers.set(NAVIGATION_DEALER_HEADER, String(navigationContext.dealerIds[0]));\n    }\n  }\n  return headers;\n};\n\nconst navigationContextIn = (value: unknown): IModuleNavigationContext | null => {\n  if (!isRecord(value) || !isRecord(value.context)) {\n    return null;\n  }\n  const { selectedDealerId, selectedDealerIds, selectedGroupId } = value.context;\n  const dealerIds: unknown[] = Array.isArray(selectedDealerIds) ? selectedDealerIds : [selectedDealerId];\n  if (\n    !Number.isSafeInteger(selectedGroupId) ||\n    (selectedGroupId as number) <= 0 ||\n    dealerIds.length === 0 ||\n    !dealerIds.every((dealerId) => Number.isSafeInteger(dealerId) && (dealerId as number) >= 0)\n  ) {\n    return null;\n  }\n  return { dealerIds: dealerIds as number[], groupId: selectedGroupId as number };\n};\n\n// Reads the selection each `navigation` event of the host's navigation stream confirms, chunk by chunk as it passes.\nconst navigationEventReader = (onContext: (context: IModuleNavigationContext) => void): ((chunk: Buffer) => void) => {\n  const decoder = new TextDecoder();\n  let pending = '';\n  return (chunk) => {\n    pending += decoder.decode(chunk, { stream: true });\n    for (let separator = EVENT_SEPARATOR.exec(pending); separator; separator = EVENT_SEPARATOR.exec(pending)) {\n      const block = pending.slice(0, separator.index);\n      pending = pending.slice(separator.index + separator[0].length);\n      const lines = block.split(/\\r?\\n/);\n      if (!lines.includes('event: navigation') && !lines.includes('event:navigation')) {\n        continue;\n      }\n      const data = lines\n        .filter((line) => line.startsWith('data:'))\n        .map((line) => line.slice(5).replace(/^ /, ''))\n        .join('\\n');\n      let payload: unknown = null;\n      try {\n        payload = JSON.parse(data);\n      } catch {\n        continue;\n      }\n      const context = navigationContextIn(payload);\n      if (context) {\n        onContext(context);\n      }\n    }\n    if (pending.length > MAX_NAVIGATION_EVENT_BYTES) {\n      pending = '';\n    }\n  };\n};\n\nconst updateModuleCookies = (cookies: Map<string, string>, headers: Headers): void => {\n  const values = headers.getSetCookie();\n  for (const value of values) {\n    if (value.length > 4096) {\n      continue;\n    }\n    const [pair, ...attributes] = value.split(';');\n    const separator = pair?.indexOf('=') ?? -1;\n    if (!pair || separator <= 0) {\n      continue;\n    }\n    const name = pair.slice(0, separator).trim();\n    const cookieValue = pair.slice(separator + 1).trim();\n    if (!COOKIE_NAME_PATTERN.test(name) || !COOKIE_VALUE_PATTERN.test(cookieValue) || cookieValue.includes(';')) {\n      continue;\n    }\n    const deleted = cookieValue === '' || attributes.some((attribute) => /^\\s*max-age\\s*=\\s*0\\s*$/i.test(attribute));\n    if (deleted) {\n      cookies.delete(name);\n      continue;\n    }\n    if (!cookies.has(name) && cookies.size >= 32) {\n      continue;\n    }\n    cookies.set(name, `${name}=${cookieValue}`);\n  }\n};\n\nconst requestBodyOf = async (request: IncomingMessage): Promise<Buffer | null> => {\n  const chunks: Buffer[] = [];\n  let size = 0;\n  for await (const chunk of request) {\n    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk as string);\n    size += buffer.length;\n    if (size > MAX_REQUEST_BODY_BYTES) {\n      return null;\n    }\n    chunks.push(buffer);\n  }\n  return Buffer.concat(chunks);\n};\n\nconst copyProxyResponse = async (upstream: Response, response: ServerResponse, onChunk?: (chunk: Buffer) => void): Promise<void> => {\n  response.statusCode = upstream.status;\n  for (const [name, value] of upstream.headers) {\n    if (!['connection', 'content-encoding', 'content-length', 'set-cookie', 'transfer-encoding'].includes(name.toLowerCase())) {\n      response.setHeader(name, value);\n    }\n  }\n  response.setHeader('Cache-Control', upstream.headers.get('cache-control') ?? 'no-store');\n  if (!upstream.body) {\n    response.end();\n    return;\n  }\n  await new Promise<void>((resolve, reject) => {\n    const readable = Readable.fromWeb(upstream.body as never);\n    if (onChunk) {\n      readable.on('data', onChunk);\n    }\n    readable.once('error', reject);\n    response.once('error', reject);\n    response.once('finish', resolve);\n    readable.pipe(response);\n  });\n};\n\nconst readResponseBody = async (response: Response, maximumBytes: number, label: string): Promise<Buffer> => {\n  const declaredLength = Number(response.headers.get('content-length'));\n  if (Number.isFinite(declaredLength) && declaredLength > maximumBytes) {\n    await response.body?.cancel();\n    throw new Error(`${label} exceeded the configured size limit.`);\n  }\n  if (!response.body) {\n    return Buffer.alloc(0);\n  }\n\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let totalBytes = 0;\n  try {\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) {\n        break;\n      }\n      totalBytes += value.byteLength;\n      if (totalBytes > maximumBytes) {\n        await reader.cancel();\n        throw new Error(`${label} exceeded the configured size limit.`);\n      }\n      chunks.push(value);\n    }\n  } finally {\n    reader.releaseLock();\n  }\n  return Buffer.concat(chunks, totalBytes);\n};\n\nclass MfDevelopmentBff {\n  readonly #configurationUrl: URL;\n  readonly #developmentOrigin: URL;\n  readonly #flows = new Map<string, IOidcFlow>();\n  readonly #hostOrigin: URL;\n  readonly #hostNavigationUrl: URL;\n  readonly #jwks = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n  readonly #logoutFlows = new Map<string, ILogoutFlow>();\n  readonly #moduleApiOrigin: URL;\n  readonly #moduleApiPath: string;\n  readonly #sessions = new Map<string, ITokenSession>();\n  readonly #restores = new Map<string, Promise<{ session: ITokenSession; sessionId: string } | null>>();\n  #configurationPromise: Promise<IOidcClientConfiguration> | null = null;\n  #discoveryPromise: Promise<IOidcDiscovery> | null = null;\n\n  constructor(options: IMfDevelopmentBffPluginOptions) {\n    const hostNavigation = absoluteHttpsUrl(options.hostNavigationUrl, 'hostNavigationUrl', true);\n    this.#hostNavigationUrl = hostNavigation;\n    this.#hostOrigin = new URL(hostNavigation.origin);\n    this.#configurationUrl = new URL('/api/auth/oidc-configuration', this.#hostOrigin);\n    this.#developmentOrigin = absoluteHttpsUrl(options.developmentOrigin ?? 'https://localhost:4200', 'developmentOrigin');\n    if (this.#developmentOrigin.pathname !== '/' || this.#developmentOrigin.search || this.#developmentOrigin.hash) {\n      throw new Error('developmentOrigin must be an origin without a path, query, or fragment.');\n    }\n    this.#moduleApiOrigin = absoluteHttpsUrl(options.moduleApiOrigin, 'moduleApiOrigin', true);\n    if (this.#moduleApiOrigin.pathname !== '/' || this.#moduleApiOrigin.search || this.#moduleApiOrigin.hash) {\n      throw new Error('moduleApiOrigin must be an origin without a path, query, or fragment.');\n    }\n    this.#moduleApiPath = moduleApiPrefix(options.moduleApiPath);\n  }\n\n  async handle(request: IncomingMessage, response: ServerResponse, next: (error?: unknown) => void): Promise<void> {\n    if (!request.url || !request.method) {\n      next();\n      return;\n    }\n    const url = new URL(request.url, this.#developmentOrigin);\n    this.#prune();\n\n    try {\n      if (request.method === 'GET' && url.pathname === MF_DEVELOPMENT_HOST_NAVIGATION_PATH) {\n        await this.#hostNavigationResource(response, this.#hostNavigationUrl, 'script');\n        return;\n      }\n      if (request.method === 'GET' && HOST_NAVIGATION_ASSET_PATHS.has(url.pathname)) {\n        await this.#hostNavigationResource(response, new URL(url.pathname, this.#hostOrigin), 'asset');\n        return;\n      }\n      if (request.method === 'GET' && url.pathname.toLowerCase() === LEGACY_LOGIN_PATH) {\n        await this.#legacyLogin(request, response);\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === LOGIN_PATH) {\n        await this.#login(request, response, safeReturnTo(url.searchParams.get('returnTo')));\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === CALLBACK_PATH) {\n        await this.#callback(request, response, url);\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === LOGGED_OUT_PATH) {\n        const returnTo = safeReturnTo(url.searchParams.get('state'));\n        redirect(response, `${LOGIN_PATH}?returnTo=${encodeURIComponent(returnTo)}`, [clearCookie(LOGOUT_COOKIE)]);\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === '/frontchannel-logout') {\n        const sessionId = cookiesOf(request).get(SESSION_COOKIE);\n        if (sessionId) {\n          this.#sessions.delete(sessionId);\n        }\n        response.statusCode = 204;\n        response.setHeader('Set-Cookie', [clearCookie(SESSION_COOKIE), clearCookie(REFRESH_COOKIE)]);\n        response.end();\n        return;\n      }\n      if (request.method === 'POST' && url.pathname === '/api/auth/logout') {\n        await this.#logout(request, response);\n        return;\n      }\n      if (pathIsHostApi(url.pathname) || url.pathname.startsWith(this.#moduleApiPath)) {\n        await this.#proxy(request, response, url);\n        return;\n      }\n      next();\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Development authentication failed.';\n      writeJson(response, 502, { code: 'development_authentication_failed', error: message });\n    }\n  }\n\n  async #hostNavigationResource(response: ServerResponse, upstreamUrl: URL, kind: 'asset' | 'script'): Promise<void> {\n    const upstream = await fetch(upstreamUrl, {\n      headers: { Accept: kind === 'script' ? 'text/javascript, application/javascript' : 'image/svg+xml' },\n      redirect: 'error',\n    });\n    if (!upstream.ok) {\n      throw new Error(`Host navigation ${kind} failed (${upstream.status}).`);\n    }\n    const contentType = upstream.headers.get('content-type') ?? '';\n    const validContentType =\n      kind === 'script' ? /^(?:text|application)\\/javascript(?:;|$)/i.test(contentType) : /^image\\/svg\\+xml(?:;|$)/i.test(contentType);\n    if (!validContentType) {\n      throw new Error(`Host navigation ${kind} returned an invalid content type.`);\n    }\n    const maximumBytes = kind === 'script' ? MAX_HOST_NAVIGATION_BYTES : MAX_HOST_NAVIGATION_ASSET_BYTES;\n    const body = await readResponseBody(upstream, maximumBytes, `Host navigation ${kind}`);\n    response.statusCode = 200;\n    response.setHeader('Cache-Control', 'no-store');\n    response.setHeader('Content-Type', contentType);\n    response.setHeader('X-Content-Type-Options', 'nosniff');\n    response.end(body);\n  }\n\n  async #configuration(): Promise<IOidcClientConfiguration> {\n    this.#configurationPromise ??= fetch(this.#configurationUrl, { headers: { Accept: 'application/json' }, redirect: 'error' })\n      .then(async (response) => {\n        if (!response.ok) {\n          throw new Error(`Host OIDC configuration failed (${response.status}).`);\n        }\n        const value: unknown = await response.json();\n        if (!isRecord(value)) {\n          throw new Error('Host OIDC configuration returned an invalid response.');\n        }\n        const issuer = absoluteHttpsUrl(requiredString(value, 'issuer'), 'OIDC issuer', true).href.replace(/\\/$/, '');\n        return { clientId: requiredString(value, 'clientId'), issuer, scope: requiredString(value, 'scope') };\n      })\n      .catch((error) => {\n        this.#configurationPromise = null;\n        throw error;\n      });\n    return this.#configurationPromise;\n  }\n\n  async #discovery(): Promise<IOidcDiscovery> {\n    this.#discoveryPromise ??= this.#configuration()\n      .then(async (configuration) => {\n        const response = await fetch(`${configuration.issuer}/.well-known/openid-configuration`, {\n          headers: { Accept: 'application/json' },\n          redirect: 'error',\n        });\n        if (!response.ok) {\n          throw new Error(`OIDC discovery failed (${response.status}).`);\n        }\n        const value: unknown = await response.json();\n        if (!isRecord(value)) {\n          throw new Error('OIDC discovery returned an invalid response.');\n        }\n        const issuer = absoluteHttpsUrl(requiredString(value, 'issuer'), 'OIDC discovery issuer', true).href.replace(/\\/$/, '');\n        if (issuer !== configuration.issuer) {\n          throw new Error('OIDC discovery issuer does not match the host configuration.');\n        }\n        const endpoint = (key: string): string => {\n          const url = absoluteHttpsUrl(requiredString(value, key), `OIDC ${key}`, true);\n          if (url.origin !== new URL(issuer).origin) {\n            throw new Error(`OIDC ${key} must use the configured issuer origin.`);\n          }\n          return url.href;\n        };\n        const revocation = optionalString(value, 'revocation_endpoint');\n        return {\n          authorizationEndpoint: endpoint('authorization_endpoint'),\n          endSessionEndpoint: endpoint('end_session_endpoint'),\n          issuer,\n          jwksUri: endpoint('jwks_uri'),\n          revocationEndpoint: revocation ? endpoint('revocation_endpoint') : null,\n          tokenEndpoint: endpoint('token_endpoint'),\n        };\n      })\n      .catch((error) => {\n        this.#discoveryPromise = null;\n        throw error;\n      });\n    return this.#discoveryPromise;\n  }\n\n  async #login(request: IncomingMessage, response: ServerResponse, returnTo: string): Promise<void> {\n    const logoutId = cookiesOf(request).get(LOGOUT_COOKIE);\n    if (logoutId) {\n      const logout = this.#logoutFlows.get(logoutId);\n      this.#logoutFlows.delete(logoutId);\n      if (logout) {\n        const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n        const endpoint = new URL(discovery.endSessionEndpoint);\n        endpoint.searchParams.set('client_id', configuration.clientId);\n        endpoint.searchParams.set('post_logout_redirect_uri', new URL(LOGGED_OUT_PATH, this.#developmentOrigin).href);\n        endpoint.searchParams.set('state', returnTo);\n        if (logout.idToken) {\n          endpoint.searchParams.set('id_token_hint', logout.idToken);\n        }\n        redirect(response, endpoint.href, [clearCookie(LOGOUT_COOKIE)]);\n        return;\n      }\n    }\n\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const flowId = base64Url();\n    const codeVerifier = base64Url(48);\n    const flow: IOidcFlow = { codeVerifier, createdAt: Date.now(), nonce: base64Url(), returnTo, state: base64Url() };\n    this.#flows.set(flowId, flow);\n\n    const endpoint = new URL(discovery.authorizationEndpoint);\n    endpoint.searchParams.set('response_type', 'code');\n    endpoint.searchParams.set('client_id', configuration.clientId);\n    endpoint.searchParams.set('redirect_uri', new URL(CALLBACK_PATH, this.#developmentOrigin).href);\n    endpoint.searchParams.set('scope', configuration.scope);\n    endpoint.searchParams.set('state', flow.state);\n    endpoint.searchParams.set('nonce', flow.nonce);\n    endpoint.searchParams.set('code_challenge', codeChallengeOf(codeVerifier));\n    endpoint.searchParams.set('code_challenge_method', 'S256');\n    redirect(response, endpoint.href, [cookie(FLOW_COOKIE, flowId, FLOW_MAX_AGE_SECONDS)]);\n  }\n\n  async #callback(request: IncomingMessage, response: ServerResponse, url: URL): Promise<void> {\n    const flowId = cookiesOf(request).get(FLOW_COOKIE);\n    const flow = flowId ? this.#flows.get(flowId) : undefined;\n    if (flowId) {\n      this.#flows.delete(flowId);\n    }\n    if (!flow || url.searchParams.get('state') !== flow.state) {\n      writeJson(response, 400, { code: 'invalid_oidc_state', error: 'The OIDC callback state is invalid or expired.' });\n      return;\n    }\n    const providerError = url.searchParams.get('error');\n    if (providerError) {\n      writeJson(response, 401, { code: providerError, error: url.searchParams.get('error_description') ?? 'Sign-in was rejected.' });\n      return;\n    }\n    const code = url.searchParams.get('code');\n    if (!code) {\n      writeJson(response, 400, { code: 'missing_authorization_code', error: 'The OIDC callback did not include an authorization code.' });\n      return;\n    }\n\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const fields = new URLSearchParams({\n      client_id: configuration.clientId,\n      code,\n      code_verifier: flow.codeVerifier,\n      grant_type: 'authorization_code',\n      redirect_uri: new URL(CALLBACK_PATH, this.#developmentOrigin).href,\n    });\n    const tokenResponse = await fetch(discovery.tokenEndpoint, {\n      body: fields,\n      headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },\n      method: 'POST',\n      redirect: 'error',\n    });\n    if (!tokenResponse.ok) {\n      throw new Error(`OIDC token exchange failed (${tokenResponse.status}).`);\n    }\n    const tokens = parseTokenResponse(await tokenResponse.json(), true);\n    const idToken = tokens.idToken;\n    if (!idToken) {\n      throw new Error('OIDC token endpoint did not return an ID token.');\n    }\n    const jwks = this.#jwks.get(discovery.jwksUri) ?? createRemoteJWKSet(new URL(discovery.jwksUri));\n    this.#jwks.set(discovery.jwksUri, jwks);\n    const verified = await jwtVerify(idToken, jwks, {\n      audience: configuration.clientId,\n      issuer: discovery.issuer,\n      requiredClaims: ['sub', 'nonce'],\n    });\n    if (verified.payload.nonce !== flow.nonce) {\n      throw new Error('OIDC ID token nonce does not match the authorization request.');\n    }\n\n    const sessionId = base64Url();\n    const session: ITokenSession = {\n      accessToken: tokens.accessToken,\n      expiresAt: Date.now() + tokens.expiresIn * 1000,\n      idToken,\n      moduleBootstrapTail: Promise.resolve(),\n      moduleCookies: new Map(),\n      moduleNavigationContext: null,\n      refreshToken: tokens.refreshToken,\n    };\n    this.#sessions.set(sessionId, session);\n    redirect(response, flow.returnTo, [\n      cookie(SESSION_COOKIE, sessionId, SESSION_MAX_AGE_SECONDS),\n      refreshCookieOf(session),\n      clearCookie(FLOW_COOKIE),\n    ]);\n  }\n\n  async #logout(request: IncomingMessage, response: ServerResponse): Promise<void> {\n    const sessionId = cookiesOf(request).get(SESSION_COOKIE);\n    const session = sessionId ? this.#sessions.get(sessionId) : undefined;\n    if (sessionId) {\n      this.#sessions.delete(sessionId);\n    }\n    if (session) {\n      void this.#revoke(session).catch(() => undefined);\n    }\n    const logoutId = base64Url();\n    this.#logoutFlows.set(logoutId, { createdAt: Date.now(), idToken: session?.idToken ?? null });\n    response.setHeader('Set-Cookie', [\n      clearCookie(SESSION_COOKIE),\n      clearCookie(REFRESH_COOKIE),\n      cookie(LOGOUT_COOKIE, logoutId, FLOW_MAX_AGE_SECONDS),\n    ]);\n    writeJson(response, 200, { loggedOut: true });\n  }\n\n  async #revoke(session: ITokenSession): Promise<void> {\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const revocationEndpoint = discovery.revocationEndpoint;\n    if (!revocationEndpoint) {\n      return;\n    }\n    const revoke = async (token: string, hint: string): Promise<void> => {\n      await fetch(revocationEndpoint, {\n        body: new URLSearchParams({ client_id: configuration.clientId, token, token_type_hint: hint }),\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        method: 'POST',\n        redirect: 'error',\n      });\n    };\n    await Promise.all([\n      revoke(session.accessToken, 'access_token'),\n      session.refreshToken ? revoke(session.refreshToken, 'refresh_token') : Promise.resolve(),\n    ]);\n  }\n\n  // Standalone modules send the browser to their legacy /login page when an API call answers 401, and locally no such\n  // page exists: serving the module again would repeat the 401 in a reload loop. Signed out, this is the development\n  // sign-in; signed in, the module API itself refused the session, so the page says so and redirects nowhere.\n  async #legacyLogin(request: IncomingMessage, response: ServerResponse): Promise<void> {\n    if (!(await this.#authenticatedSession(request, response))) {\n      redirect(response, `${LOGIN_PATH}?returnTo=%2F`);\n      return;\n    }\n    response.statusCode = 401;\n    response.setHeader('Cache-Control', 'no-store');\n    response.setHeader('Content-Type', 'text/html; charset=utf-8');\n    response.end(\n      '<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\"><title>Module sign-in refused</title></head>' +\n        '<body style=\"font-family:system-ui,sans-serif;margin:3rem;line-height:1.5\">' +\n        '<h1 style=\"font-size:1.25rem\">The module API refused your session</h1>' +\n        '<p>You are signed in, but a module API request answered 401 and the module asked for its legacy sign-in page. ' +\n        'Check the module backend (MODULE_API_ORIGIN) and its dev server output.</p>' +\n        `<p><a href=\"${LOGIN_PATH}?returnTo=%2F\">Sign in again</a> &middot; <a href=\"/\">Back to the module</a></p>` +\n        '</body></html>',\n    );\n  }\n\n  async #authenticatedSession(request: IncomingMessage, response: ServerResponse): Promise<ITokenSession | null> {\n    const cookies = cookiesOf(request);\n    const sessionId = cookies.get(SESSION_COOKIE);\n    const session = sessionId ? this.#sessions.get(sessionId) : undefined;\n    if (!session) {\n      return this.#restoredSession(decodedCookieValue(cookies.get(REFRESH_COOKIE)), response);\n    }\n    if (session.expiresAt > Date.now() + TOKEN_REFRESH_SKEW_MS) {\n      return session;\n    }\n    if (!session.refreshToken) {\n      if (sessionId) {\n        this.#sessions.delete(sessionId);\n      }\n      return null;\n    }\n    session.refreshPromise ??= this.#refresh(session).finally(() => {\n      session.refreshPromise = undefined;\n    });\n    try {\n      await session.refreshPromise;\n      response.setHeader('Set-Cookie', refreshCookieOf(session));\n      return session;\n    } catch {\n      if (sessionId) {\n        this.#sessions.delete(sessionId);\n      }\n      response.setHeader('Set-Cookie', clearCookie(REFRESH_COOKIE));\n      return null;\n    }\n  }\n\n  // Starts a session from the browser's refresh cookie after this server restarted or another module's server signed\n  // the developer in. Parallel requests carrying the same token share one refresh, and so, for a short while, do\n  // requests the browser sent before the rotated cookie reached it: the sign-in service accepts a refresh token once,\n  // so spending it again would fail and clear the cookie that replaced it.\n  async #restoredSession(refreshToken: string | null, response: ServerResponse): Promise<ITokenSession | null> {\n    if (!refreshToken) {\n      return null;\n    }\n    let restore = this.#restores.get(refreshToken);\n    if (!restore) {\n      restore = this.#restore(refreshToken);\n      this.#restores.set(refreshToken, restore);\n      void restore.then((restoredSession) => {\n        if (!restoredSession) {\n          this.#restores.delete(refreshToken);\n          return;\n        }\n        setTimeout(() => this.#restores.delete(refreshToken), SPENT_REFRESH_TOKEN_REUSE_MS).unref();\n      });\n    }\n    const restored = await restore;\n    if (!restored || this.#sessions.get(restored.sessionId) !== restored.session) {\n      response.setHeader('Set-Cookie', clearCookie(REFRESH_COOKIE));\n      return null;\n    }\n    response.setHeader('Set-Cookie', [cookie(SESSION_COOKIE, restored.sessionId, SESSION_MAX_AGE_SECONDS), refreshCookieOf(restored.session)]);\n    return restored.session;\n  }\n\n  async #restore(refreshToken: string): Promise<{ session: ITokenSession; sessionId: string } | null> {\n    const session: ITokenSession = {\n      accessToken: '',\n      expiresAt: 0,\n      idToken: null,\n      moduleBootstrapTail: Promise.resolve(),\n      moduleCookies: new Map(),\n      moduleNavigationContext: null,\n      refreshToken,\n    };\n    try {\n      await this.#refresh(session);\n    } catch {\n      return null;\n    }\n    const sessionId = base64Url();\n    this.#sessions.set(sessionId, session);\n    return { session, sessionId };\n  }\n\n  async #refresh(session: ITokenSession): Promise<void> {\n    const refreshToken = session.refreshToken;\n    if (!refreshToken) {\n      throw new Error('OIDC refresh token is unavailable.');\n    }\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const response = await fetch(discovery.tokenEndpoint, {\n      body: new URLSearchParams({\n        client_id: configuration.clientId,\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n      }),\n      headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },\n      method: 'POST',\n      redirect: 'error',\n    });\n    if (!response.ok) {\n      throw new Error(`OIDC refresh failed (${response.status}).`);\n    }\n    const tokens = parseTokenResponse(await response.json(), false);\n    session.accessToken = tokens.accessToken;\n    session.expiresAt = Date.now() + tokens.expiresIn * 1000;\n    session.refreshToken = tokens.refreshToken ?? session.refreshToken;\n    session.idToken = tokens.idToken ?? session.idToken;\n  }\n\n  async #proxy(request: IncomingMessage, response: ServerResponse, localUrl: URL): Promise<void> {\n    const session = await this.#authenticatedSession(request, response);\n    if (!session) {\n      // This server refreshes the session's tokens itself, so the browser can only sign in again. A refreshable code\n      // would send the host client to a refresh endpoint that only the host has.\n      writeJson(response, 401, { code: 'sign_in_required', error: 'Sign in is required.' });\n      return;\n    }\n    const isModuleApi = localUrl.pathname.startsWith(this.#moduleApiPath);\n    if (isModuleApi && !session.moduleNavigationContext) {\n      // The host mounts a module only once the selection is known, so its first API calls already carry it. Locally\n      // the module starts beside the navigation, so its first calls can arrive first: ask the host before forwarding.\n      session.navigationContextPromise ??= this.#loadNavigationContext(session).finally(() => {\n        session.navigationContextPromise = undefined;\n      });\n      await session.navigationContextPromise;\n    }\n    if (isModuleApi && session.moduleCookies.size === 0) {\n      const previous = session.moduleBootstrapTail;\n      let release = (): void => {};\n      const current = new Promise<void>((resolve) => {\n        release = resolve;\n      });\n      session.moduleBootstrapTail = previous.catch(() => undefined).then(() => current);\n      await previous.catch(() => undefined);\n      try {\n        await this.#proxyAuthenticated(request, response, localUrl, session, true);\n      } finally {\n        release();\n      }\n      return;\n    }\n    await this.#proxyAuthenticated(request, response, localUrl, session, isModuleApi);\n  }\n\n  async #loadNavigationContext(session: ITokenSession): Promise<void> {\n    const upstream = await fetch(new URL('/api/navigation', this.#hostOrigin), {\n      headers: { Accept: 'application/json', Authorization: `Bearer ${session.accessToken}` },\n      redirect: 'manual',\n    }).catch(() => null);\n    if (!upstream?.ok || session.moduleNavigationContext) {\n      return;\n    }\n    session.moduleNavigationContext = navigationContextIn(await upstream.json().catch(() => null));\n  }\n\n  async #proxyAuthenticated(\n    request: IncomingMessage,\n    response: ServerResponse,\n    localUrl: URL,\n    session: ITokenSession,\n    isModuleApi: boolean,\n  ): Promise<void> {\n    const upstreamOrigin = isModuleApi ? this.#moduleApiOrigin : this.#hostOrigin;\n    const upstreamUrl = new URL(`${localUrl.pathname}${localUrl.search}`, upstreamOrigin);\n    const method = request.method ?? 'GET';\n    const init: RequestInit = {\n      headers: proxyHeaders(\n        request,\n        session.accessToken,\n        isModuleApi ? { cookies: session.moduleCookies, navigationContext: session.moduleNavigationContext } : undefined,\n      ),\n      method,\n      redirect: 'manual',\n    };\n    if (method !== 'GET' && method !== 'HEAD') {\n      // A fixed-length body: the web front ends of the deployed module servers answer chunked request bodies with 404.\n      const body = await requestBodyOf(request);\n      if (!body) {\n        writeJson(response, 413, { code: 'request_body_too_large', error: 'The request body exceeds the development proxy limit.' });\n        return;\n      }\n      init.body = body;\n    }\n    const upstream = await fetch(upstreamUrl, init);\n    let onChunk: ((chunk: Buffer) => void) | undefined;\n    if (isModuleApi) {\n      updateModuleCookies(session.moduleCookies, upstream.headers);\n    } else if (localUrl.pathname === '/api/navigation' && upstream.ok) {\n      session.moduleNavigationContext = navigationContextIn(\n        await upstream\n          .clone()\n          .json()\n          .catch(() => null),\n      );\n    } else if (localUrl.pathname === '/api/navigation/stream' && upstream.ok) {\n      onChunk = navigationEventReader((context) => {\n        session.moduleNavigationContext = context;\n      });\n    }\n    await copyProxyResponse(upstream, response, onChunk);\n  }\n\n  #prune(): void {\n    const now = Date.now();\n    for (const [id, flow] of this.#flows) {\n      if (flow.createdAt + FLOW_MAX_AGE_SECONDS * 1000 < now) {\n        this.#flows.delete(id);\n      }\n    }\n    for (const [id, flow] of this.#logoutFlows) {\n      if (flow.createdAt + FLOW_MAX_AGE_SECONDS * 1000 < now) {\n        this.#logoutFlows.delete(id);\n      }\n    }\n    for (const [id, session] of this.#sessions) {\n      if (!session.refreshToken && session.expiresAt + TOKEN_REFRESH_SKEW_MS < now) {\n        this.#sessions.delete(id);\n      }\n    }\n  }\n}\n\nexport const mfDevelopmentBffPlugin = (options: IMfDevelopmentBffPluginOptions): Plugin => {\n  const middleware = createMfDevelopmentBffMiddleware(options);\n  return {\n    apply: 'serve',\n    name: 'edynamix-mf-development-bff',\n    configureServer(server) {\n      server.middlewares.use((request, response, next) => {\n        middleware(request, response, next);\n      });\n    },\n    // Locally the module runs inside the host shell, so its page shows the host's icon. The module's own favicon is\n    // only copied into the build output, so this server has none to answer the browser's favicon request with.\n    transformIndexHtml(html) {\n      return {\n        html: html.replace(ICON_LINK_PATTERN, ''),\n        tags: [{ tag: 'link', attrs: { rel: 'icon', type: 'image/svg+xml', href: HOST_ICON_PATH }, injectTo: 'head' }],\n      };\n    },\n  };\n};\n\nexport type TMfDevelopmentBffMiddleware = (request: IncomingMessage, response: ServerResponse, next: (error?: unknown) => void) => void;\n\nexport const createMfDevelopmentBffMiddleware = (options: IMfDevelopmentBffPluginOptions): TMfDevelopmentBffMiddleware => {\n  const bff = new MfDevelopmentBff(options);\n  return (request, response, next) => {\n    void bff.handle(request, response, next);\n  };\n};\n"]}
+{"version":3,"file":"vite-development.d.ts","sourceRoot":"","sources":["../src/vite-development.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAGjE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAUnC,eAAO,MAAM,mCAAmC,sCAAsC,CAAC;AA2FvF,MAAM,WAAW,8BAA8B;IAC7C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;CACvB;AA66BD,eAAO,MAAM,sBAAsB,GAAI,SAAS,8BAA8B,KAAG,MAmBhF,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,IAAI,KAAK,IAAI,CAAC;AAExI,eAAO,MAAM,gCAAgC,GAAI,SAAS,8BAA8B,KAAG,2BAK1F,CAAC","sourcesContent":["import { createHash, randomBytes } from 'node:crypto';\nimport type { IncomingMessage, ServerResponse } from 'node:http';\nimport { Readable } from 'node:stream';\nimport { createRemoteJWKSet, jwtVerify } from 'jose';\nimport type { Plugin } from 'vite';\n\nconst SESSION_COOKIE = '__Host-edyn_dev_session';\nconst REFRESH_COOKIE = '__Host-edyn_dev_refresh';\nconst FLOW_COOKIE = '__Host-edyn_oidc_flow';\nconst LOGOUT_COOKIE = '__Host-edyn_oidc_logout';\nconst CALLBACK_PATH = '/callback';\nconst LOGGED_OUT_PATH = '/logged-out';\nconst LOGIN_PATH = '/api/dev-auth/login';\nconst LEGACY_LOGIN_PATH = '/login';\nexport const MF_DEVELOPMENT_HOST_NAVIGATION_PATH = '/api/dev-host-navigation/index.js';\nconst HOST_ICON_PATH = '/exsto-icon.svg';\nconst HOST_NAVIGATION_ASSET_PATHS = new Set([HOST_ICON_PATH, '/exsto-text.svg']);\nconst ICON_LINK_PATTERN = /<link\\b[^>]*\\brel=[\"'](?:shortcut\\s+)?icon[\"'][^>]*>\\s*/gi;\nconst MAX_HOST_NAVIGATION_BYTES = 5 * 1024 * 1024;\nconst MAX_HOST_NAVIGATION_ASSET_BYTES = 512 * 1024;\nconst SESSION_MAX_AGE_SECONDS = 8 * 60 * 60;\nconst REFRESH_COOKIE_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;\nconst FLOW_MAX_AGE_SECONDS = 10 * 60;\nconst TOKEN_REFRESH_SKEW_MS = 30_000;\nconst SPENT_REFRESH_TOKEN_REUSE_MS = 30_000;\nconst NAVIGATION_GROUP_HEADER = 'X-Edyn-Navigation-Group-Id';\nconst NAVIGATION_DEALER_HEADER = 'X-Edyn-Navigation-Dealer-Id';\nconst NAVIGATION_DEALERS_HEADER = 'X-Edyn-Navigation-Dealer-Ids';\nconst NAVIGATION_HEADERS = [NAVIGATION_GROUP_HEADER, NAVIGATION_DEALER_HEADER, NAVIGATION_DEALERS_HEADER].map((name) => name.toLowerCase());\nconst MAX_NAVIGATION_EVENT_BYTES = 5 * 1024 * 1024;\nconst MAX_REQUEST_BODY_BYTES = 100 * 1024 * 1024;\nconst EVENT_SEPARATOR = /\\r?\\n\\r?\\n/;\nconst COOKIE_NAME_PATTERN = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\nconst COOKIE_VALUE_PATTERN = /^[\\x20-\\x7e]*$/;\nconst ALLOWED_HOST_API_PATHS = [\n  '/api/auth/me',\n  '/api/navigation',\n  '/api/navigation/access-check',\n  '/api/navigation/access-request',\n  '/api/navigation/counter-stream',\n] as const;\n// The standalone navigation reads the portal menus under the host's /api/navigation/portal, which only a host running\n// in development relays to the portal. Every host also serves the portal API itself at /portal/api, a deployed one too,\n// so those calls go there.\nconst PORTAL_MENU_PATH = '/api/navigation/portal';\nconst PORTAL_API_PATH = '/portal/api';\n\ninterface IOidcClientConfiguration {\n  clientId: string;\n  issuer: string;\n  scope: string;\n}\n\ninterface IOidcDiscovery {\n  authorizationEndpoint: string;\n  endSessionEndpoint: string;\n  issuer: string;\n  jwksUri: string;\n  revocationEndpoint: string | null;\n  tokenEndpoint: string;\n}\n\ninterface IOidcFlow {\n  codeVerifier: string;\n  createdAt: number;\n  nonce: string;\n  returnTo: string;\n  state: string;\n}\n\ninterface IModuleNavigationContext {\n  dealerIds: readonly number[];\n  groupId: number;\n}\n\ninterface IModuleProxyContext {\n  cookies: Map<string, string>;\n  navigationContext: IModuleNavigationContext | null;\n}\n\ninterface ITokenSession {\n  accessToken: string;\n  expiresAt: number;\n  idToken: string | null;\n  moduleBootstrapTail: Promise<void>;\n  moduleCookies: Map<string, string>;\n  moduleNavigationContext: IModuleNavigationContext | null;\n  navigationContextPromise?: Promise<void>;\n  refreshPromise?: Promise<void>;\n  refreshToken: string | null;\n}\n\ninterface ILogoutFlow {\n  createdAt: number;\n  idToken: string | null;\n}\n\ninterface ITokenResponse {\n  accessToken: string;\n  expiresIn: number;\n  idToken: string | null;\n  refreshToken: string | null;\n  tokenType: string;\n}\n\nexport interface IMfDevelopmentBffPluginOptions {\n  developmentOrigin?: string;\n  hostNavigationUrl: string;\n  moduleApiOrigin: string;\n  moduleApiPath: string;\n}\n\nconst isRecord = (value: unknown): value is Record<string, unknown> => typeof value === 'object' && value !== null && !Array.isArray(value);\n\nconst requiredString = (value: Record<string, unknown>, key: string): string => {\n  const candidate = value[key];\n  if (typeof candidate !== 'string' || candidate.trim() === '') {\n    throw new Error(`OIDC response is missing ${key}.`);\n  }\n  return candidate;\n};\n\nconst optionalString = (value: Record<string, unknown>, key: string): string | null => {\n  const candidate = value[key];\n  if (candidate === undefined || candidate === null) {\n    return null;\n  }\n  if (typeof candidate !== 'string' || candidate.trim() === '') {\n    throw new Error(`OIDC response contains an invalid ${key}.`);\n  }\n  return candidate;\n};\n\nconst absoluteHttpsUrl = (candidate: string, label: string, allowLocalHttp = false): URL => {\n  let url: URL;\n  try {\n    url = new URL(candidate);\n  } catch {\n    throw new Error(`${label} must be an absolute URL.`);\n  }\n  const isLocalHttp = allowLocalHttp && url.protocol === 'http:' && (url.hostname === 'localhost' || url.hostname === '127.0.0.1');\n  if (url.protocol !== 'https:' && !isLocalHttp) {\n    throw new Error(`${label} must use HTTPS.`);\n  }\n  if (url.username || url.password || url.hash) {\n    throw new Error(`${label} must not contain credentials or a fragment.`);\n  }\n  return url;\n};\n\nconst moduleApiPrefix = (candidate: string): string => {\n  if (!/^\\/[a-z][a-z0-9-]*\\/api\\/$/.test(candidate)) {\n    throw new Error('moduleApiPath must use the canonical /module/api/ boundary.');\n  }\n  return candidate;\n};\n\nconst base64Url = (size = 32): string => randomBytes(size).toString('base64url');\nconst codeChallengeOf = (verifier: string): string => createHash('sha256').update(verifier).digest('base64url');\n\nconst cookiesOf = (request: IncomingMessage): ReadonlyMap<string, string> => {\n  const cookies = new Map<string, string>();\n  for (const part of (request.headers.cookie ?? '').split(';')) {\n    const separator = part.indexOf('=');\n    if (separator <= 0) {\n      continue;\n    }\n    const name = part.slice(0, separator).trim();\n    const value = part.slice(separator + 1).trim();\n    if (name && value) {\n      cookies.set(name, value);\n    }\n  }\n  return cookies;\n};\n\nconst cookie = (name: string, value: string, maxAge: number): string => `${name}=${value}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge}`;\n\nconst clearCookie = (name: string): string => cookie(name, '', 0);\n\n// The refresh token stays in an HttpOnly cookie for this origin, which every module's development server shares, so\n// one sign-in survives restarts and module switches until the token expires; page scripts can never read it.\nconst refreshCookieOf = (session: ITokenSession): string =>\n  session.refreshToken\n    ? cookie(REFRESH_COOKIE, encodeURIComponent(session.refreshToken), REFRESH_COOKIE_MAX_AGE_SECONDS)\n    : clearCookie(REFRESH_COOKIE);\n\nconst decodedCookieValue = (value: string | undefined): string | null => {\n  if (!value) {\n    return null;\n  }\n  try {\n    return decodeURIComponent(value);\n  } catch {\n    return null;\n  }\n};\n\nconst writeJson = (response: ServerResponse, status: number, body: unknown): void => {\n  response.statusCode = status;\n  response.setHeader('Cache-Control', 'no-store');\n  response.setHeader('Content-Type', 'application/json; charset=utf-8');\n  response.end(JSON.stringify(body));\n};\n\nconst redirect = (response: ServerResponse, location: string, cookies: string[] = []): void => {\n  response.statusCode = 302;\n  response.setHeader('Cache-Control', 'no-store');\n  response.setHeader('Location', location);\n  if (cookies.length > 0) {\n    response.setHeader('Set-Cookie', cookies);\n  }\n  response.end();\n};\n\nconst safeReturnTo = (candidate: string | null): string => {\n  if (!candidate?.startsWith('/') || candidate.startsWith('//')) {\n    return '/';\n  }\n  try {\n    const parsed = new URL(candidate, 'https://localhost');\n    return `${parsed.pathname}${parsed.search}${parsed.hash}`;\n  } catch {\n    return '/';\n  }\n};\n\nconst parseTokenResponse = (value: unknown, requireIdToken: boolean): ITokenResponse => {\n  if (!isRecord(value)) {\n    throw new Error('OIDC token endpoint returned an invalid response.');\n  }\n  const expiresIn = value.expires_in;\n  if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0) {\n    throw new Error('OIDC token endpoint returned an invalid expires_in value.');\n  }\n  const idToken = optionalString(value, 'id_token');\n  if (requireIdToken && !idToken) {\n    throw new Error('OIDC token endpoint did not return an ID token.');\n  }\n  const tokenType = requiredString(value, 'token_type');\n  if (tokenType.toLowerCase() !== 'bearer') {\n    throw new Error('OIDC token endpoint returned an unsupported token type.');\n  }\n  return {\n    accessToken: requiredString(value, 'access_token'),\n    expiresIn,\n    idToken,\n    refreshToken: optionalString(value, 'refresh_token'),\n    tokenType,\n  };\n};\n\nconst pathIsHostApi = (path: string): boolean => {\n  return ALLOWED_HOST_API_PATHS.some((candidate) => path === candidate || path.startsWith(`${candidate}/`));\n};\n\n// The host validates a selection the browser sends it, so host requests keep the navigation headers. A module trusts\n// them, so its requests carry only the selection the host last confirmed.\nconst portalApiPathOf = (path: string): string | null =>\n  path === PORTAL_MENU_PATH || path.startsWith(`${PORTAL_MENU_PATH}/`) ? `${PORTAL_API_PATH}${path.slice(PORTAL_MENU_PATH.length)}` : null;\n\n// Node reports the reason on the error's cause (ECONNREFUSED), Bun on the error itself.\nconst errorCodeOf = (error: unknown): string | null => {\n  for (const candidate of [isRecord(error) ? error.cause : undefined, error]) {\n    if (isRecord(candidate) && typeof candidate.code === 'string') {\n      return candidate.code;\n    }\n  }\n  return null;\n};\n\nconst proxyHeaders = (request: IncomingMessage, accessToken: string, module?: IModuleProxyContext): Headers => {\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(request.headers)) {\n    const lowerName = name.toLowerCase();\n    if (\n      !value ||\n      name.startsWith(':') ||\n      ['authorization', 'connection', 'content-length', 'cookie', 'host', 'origin', 'transfer-encoding'].includes(lowerName) ||\n      (module && NAVIGATION_HEADERS.includes(lowerName))\n    ) {\n      continue;\n    }\n    if (Array.isArray(value)) {\n      for (const item of value) {\n        headers.append(name, item);\n      }\n    } else {\n      headers.set(name, value);\n    }\n  }\n  headers.set('Authorization', `Bearer ${accessToken}`);\n  if (module?.cookies.size) {\n    headers.set('Cookie', [...module.cookies.values()].join('; '));\n  }\n  const navigationContext = module?.navigationContext;\n  if (navigationContext) {\n    headers.set(NAVIGATION_GROUP_HEADER, String(navigationContext.groupId));\n    headers.set(NAVIGATION_DEALERS_HEADER, navigationContext.dealerIds.join(','));\n    if (navigationContext.dealerIds.length === 1) {\n      headers.set(NAVIGATION_DEALER_HEADER, String(navigationContext.dealerIds[0]));\n    }\n  }\n  return headers;\n};\n\nconst navigationContextIn = (value: unknown): IModuleNavigationContext | null => {\n  if (!isRecord(value) || !isRecord(value.context)) {\n    return null;\n  }\n  const { selectedDealerId, selectedDealerIds, selectedGroupId } = value.context;\n  const dealerIds: unknown[] = Array.isArray(selectedDealerIds) ? selectedDealerIds : [selectedDealerId];\n  if (\n    !Number.isSafeInteger(selectedGroupId) ||\n    (selectedGroupId as number) <= 0 ||\n    dealerIds.length === 0 ||\n    !dealerIds.every((dealerId) => Number.isSafeInteger(dealerId) && (dealerId as number) >= 0)\n  ) {\n    return null;\n  }\n  return { dealerIds: dealerIds as number[], groupId: selectedGroupId as number };\n};\n\n// Reads the selection each `navigation` event of the host's navigation stream confirms, chunk by chunk as it passes.\nconst navigationEventReader = (onContext: (context: IModuleNavigationContext) => void): ((chunk: Buffer) => void) => {\n  const decoder = new TextDecoder();\n  let pending = '';\n  return (chunk) => {\n    pending += decoder.decode(chunk, { stream: true });\n    for (let separator = EVENT_SEPARATOR.exec(pending); separator; separator = EVENT_SEPARATOR.exec(pending)) {\n      const block = pending.slice(0, separator.index);\n      pending = pending.slice(separator.index + separator[0].length);\n      const lines = block.split(/\\r?\\n/);\n      if (!lines.includes('event: navigation') && !lines.includes('event:navigation')) {\n        continue;\n      }\n      const data = lines\n        .filter((line) => line.startsWith('data:'))\n        .map((line) => line.slice(5).replace(/^ /, ''))\n        .join('\\n');\n      let payload: unknown = null;\n      try {\n        payload = JSON.parse(data);\n      } catch {\n        continue;\n      }\n      const context = navigationContextIn(payload);\n      if (context) {\n        onContext(context);\n      }\n    }\n    if (pending.length > MAX_NAVIGATION_EVENT_BYTES) {\n      pending = '';\n    }\n  };\n};\n\nconst updateModuleCookies = (cookies: Map<string, string>, headers: Headers): void => {\n  const values = headers.getSetCookie();\n  for (const value of values) {\n    if (value.length > 4096) {\n      continue;\n    }\n    const [pair, ...attributes] = value.split(';');\n    const separator = pair?.indexOf('=') ?? -1;\n    if (!pair || separator <= 0) {\n      continue;\n    }\n    const name = pair.slice(0, separator).trim();\n    const cookieValue = pair.slice(separator + 1).trim();\n    if (!COOKIE_NAME_PATTERN.test(name) || !COOKIE_VALUE_PATTERN.test(cookieValue) || cookieValue.includes(';')) {\n      continue;\n    }\n    const deleted = cookieValue === '' || attributes.some((attribute) => /^\\s*max-age\\s*=\\s*0\\s*$/i.test(attribute));\n    if (deleted) {\n      cookies.delete(name);\n      continue;\n    }\n    if (!cookies.has(name) && cookies.size >= 32) {\n      continue;\n    }\n    cookies.set(name, `${name}=${cookieValue}`);\n  }\n};\n\nconst requestBodyOf = async (request: IncomingMessage): Promise<Buffer | null> => {\n  const chunks: Buffer[] = [];\n  let size = 0;\n  for await (const chunk of request) {\n    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk as string);\n    size += buffer.length;\n    if (size > MAX_REQUEST_BODY_BYTES) {\n      return null;\n    }\n    chunks.push(buffer);\n  }\n  return Buffer.concat(chunks);\n};\n\nconst copyProxyResponse = async (upstream: Response, response: ServerResponse, onChunk?: (chunk: Buffer) => void): Promise<void> => {\n  response.statusCode = upstream.status;\n  for (const [name, value] of upstream.headers) {\n    if (!['connection', 'content-encoding', 'content-length', 'set-cookie', 'transfer-encoding'].includes(name.toLowerCase())) {\n      response.setHeader(name, value);\n    }\n  }\n  response.setHeader('Cache-Control', upstream.headers.get('cache-control') ?? 'no-store');\n  if (!upstream.body) {\n    response.end();\n    return;\n  }\n  await new Promise<void>((resolve, reject) => {\n    const readable = Readable.fromWeb(upstream.body as never);\n    if (onChunk) {\n      readable.on('data', onChunk);\n    }\n    readable.once('error', reject);\n    response.once('error', reject);\n    response.once('finish', resolve);\n    readable.pipe(response);\n  });\n};\n\nconst readResponseBody = async (response: Response, maximumBytes: number, label: string): Promise<Buffer> => {\n  const declaredLength = Number(response.headers.get('content-length'));\n  if (Number.isFinite(declaredLength) && declaredLength > maximumBytes) {\n    await response.body?.cancel();\n    throw new Error(`${label} exceeded the configured size limit.`);\n  }\n  if (!response.body) {\n    return Buffer.alloc(0);\n  }\n\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let totalBytes = 0;\n  try {\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) {\n        break;\n      }\n      totalBytes += value.byteLength;\n      if (totalBytes > maximumBytes) {\n        await reader.cancel();\n        throw new Error(`${label} exceeded the configured size limit.`);\n      }\n      chunks.push(value);\n    }\n  } finally {\n    reader.releaseLock();\n  }\n  return Buffer.concat(chunks, totalBytes);\n};\n\nclass MfDevelopmentBff {\n  readonly #configurationUrl: URL;\n  readonly #developmentOrigin: URL;\n  readonly #flows = new Map<string, IOidcFlow>();\n  readonly #hostOrigin: URL;\n  readonly #hostNavigationUrl: URL;\n  readonly #jwks = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n  readonly #logoutFlows = new Map<string, ILogoutFlow>();\n  readonly #moduleApiOrigin: URL;\n  readonly #moduleApiPath: string;\n  #moduleApiUnreachable = false;\n  readonly #sessions = new Map<string, ITokenSession>();\n  readonly #restores = new Map<string, Promise<{ session: ITokenSession; sessionId: string } | null>>();\n  #configurationPromise: Promise<IOidcClientConfiguration> | null = null;\n  #discoveryPromise: Promise<IOidcDiscovery> | null = null;\n\n  constructor(options: IMfDevelopmentBffPluginOptions) {\n    const hostNavigation = absoluteHttpsUrl(options.hostNavigationUrl, 'hostNavigationUrl', true);\n    this.#hostNavigationUrl = hostNavigation;\n    this.#hostOrigin = new URL(hostNavigation.origin);\n    this.#configurationUrl = new URL('/api/auth/oidc-configuration', this.#hostOrigin);\n    this.#developmentOrigin = absoluteHttpsUrl(options.developmentOrigin ?? 'https://localhost:4200', 'developmentOrigin');\n    if (this.#developmentOrigin.pathname !== '/' || this.#developmentOrigin.search || this.#developmentOrigin.hash) {\n      throw new Error('developmentOrigin must be an origin without a path, query, or fragment.');\n    }\n    this.#moduleApiOrigin = absoluteHttpsUrl(options.moduleApiOrigin, 'moduleApiOrigin', true);\n    if (this.#moduleApiOrigin.pathname !== '/' || this.#moduleApiOrigin.search || this.#moduleApiOrigin.hash) {\n      throw new Error('moduleApiOrigin must be an origin without a path, query, or fragment.');\n    }\n    this.#moduleApiPath = moduleApiPrefix(options.moduleApiPath);\n  }\n\n  async handle(request: IncomingMessage, response: ServerResponse, next: (error?: unknown) => void): Promise<void> {\n    if (!request.url || !request.method) {\n      next();\n      return;\n    }\n    const url = new URL(request.url, this.#developmentOrigin);\n    this.#prune();\n\n    try {\n      if (request.method === 'GET' && url.pathname === MF_DEVELOPMENT_HOST_NAVIGATION_PATH) {\n        await this.#hostNavigationResource(response, this.#hostNavigationUrl, 'script');\n        return;\n      }\n      if (request.method === 'GET' && HOST_NAVIGATION_ASSET_PATHS.has(url.pathname)) {\n        await this.#hostNavigationResource(response, new URL(url.pathname, this.#hostOrigin), 'asset');\n        return;\n      }\n      if (request.method === 'GET' && url.pathname.toLowerCase() === LEGACY_LOGIN_PATH) {\n        await this.#legacyLogin(request, response);\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === LOGIN_PATH) {\n        await this.#login(request, response, safeReturnTo(url.searchParams.get('returnTo')));\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === CALLBACK_PATH) {\n        await this.#callback(request, response, url);\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === LOGGED_OUT_PATH) {\n        const returnTo = safeReturnTo(url.searchParams.get('state'));\n        redirect(response, `${LOGIN_PATH}?returnTo=${encodeURIComponent(returnTo)}`, [clearCookie(LOGOUT_COOKIE)]);\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === '/frontchannel-logout') {\n        const sessionId = cookiesOf(request).get(SESSION_COOKIE);\n        if (sessionId) {\n          this.#sessions.delete(sessionId);\n        }\n        response.statusCode = 204;\n        response.setHeader('Set-Cookie', [clearCookie(SESSION_COOKIE), clearCookie(REFRESH_COOKIE)]);\n        response.end();\n        return;\n      }\n      if (request.method === 'POST' && url.pathname === '/api/auth/logout') {\n        await this.#logout(request, response);\n        return;\n      }\n      if (pathIsHostApi(url.pathname) || url.pathname.startsWith(this.#moduleApiPath)) {\n        await this.#proxy(request, response, url);\n        return;\n      }\n      next();\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Development authentication failed.';\n      writeJson(response, 502, { code: 'development_authentication_failed', error: message });\n    }\n  }\n\n  async #hostNavigationResource(response: ServerResponse, upstreamUrl: URL, kind: 'asset' | 'script'): Promise<void> {\n    const upstream = await fetch(upstreamUrl, {\n      headers: { Accept: kind === 'script' ? 'text/javascript, application/javascript' : 'image/svg+xml' },\n      redirect: 'error',\n    });\n    if (!upstream.ok) {\n      throw new Error(`Host navigation ${kind} failed (${upstream.status}).`);\n    }\n    const contentType = upstream.headers.get('content-type') ?? '';\n    const validContentType =\n      kind === 'script' ? /^(?:text|application)\\/javascript(?:;|$)/i.test(contentType) : /^image\\/svg\\+xml(?:;|$)/i.test(contentType);\n    if (!validContentType) {\n      throw new Error(`Host navigation ${kind} returned an invalid content type.`);\n    }\n    const maximumBytes = kind === 'script' ? MAX_HOST_NAVIGATION_BYTES : MAX_HOST_NAVIGATION_ASSET_BYTES;\n    const body = await readResponseBody(upstream, maximumBytes, `Host navigation ${kind}`);\n    response.statusCode = 200;\n    response.setHeader('Cache-Control', 'no-store');\n    response.setHeader('Content-Type', contentType);\n    response.setHeader('X-Content-Type-Options', 'nosniff');\n    response.end(body);\n  }\n\n  async #configuration(): Promise<IOidcClientConfiguration> {\n    this.#configurationPromise ??= fetch(this.#configurationUrl, { headers: { Accept: 'application/json' }, redirect: 'error' })\n      .then(async (response) => {\n        if (!response.ok) {\n          throw new Error(`Host OIDC configuration failed (${response.status}).`);\n        }\n        const value: unknown = await response.json();\n        if (!isRecord(value)) {\n          throw new Error('Host OIDC configuration returned an invalid response.');\n        }\n        const issuer = absoluteHttpsUrl(requiredString(value, 'issuer'), 'OIDC issuer', true).href.replace(/\\/$/, '');\n        return { clientId: requiredString(value, 'clientId'), issuer, scope: requiredString(value, 'scope') };\n      })\n      .catch((error) => {\n        this.#configurationPromise = null;\n        throw error;\n      });\n    return this.#configurationPromise;\n  }\n\n  async #discovery(): Promise<IOidcDiscovery> {\n    this.#discoveryPromise ??= this.#configuration()\n      .then(async (configuration) => {\n        const response = await fetch(`${configuration.issuer}/.well-known/openid-configuration`, {\n          headers: { Accept: 'application/json' },\n          redirect: 'error',\n        });\n        if (!response.ok) {\n          throw new Error(`OIDC discovery failed (${response.status}).`);\n        }\n        const value: unknown = await response.json();\n        if (!isRecord(value)) {\n          throw new Error('OIDC discovery returned an invalid response.');\n        }\n        const issuer = absoluteHttpsUrl(requiredString(value, 'issuer'), 'OIDC discovery issuer', true).href.replace(/\\/$/, '');\n        if (issuer !== configuration.issuer) {\n          throw new Error('OIDC discovery issuer does not match the host configuration.');\n        }\n        const endpoint = (key: string): string => {\n          const url = absoluteHttpsUrl(requiredString(value, key), `OIDC ${key}`, true);\n          if (url.origin !== new URL(issuer).origin) {\n            throw new Error(`OIDC ${key} must use the configured issuer origin.`);\n          }\n          return url.href;\n        };\n        const revocation = optionalString(value, 'revocation_endpoint');\n        return {\n          authorizationEndpoint: endpoint('authorization_endpoint'),\n          endSessionEndpoint: endpoint('end_session_endpoint'),\n          issuer,\n          jwksUri: endpoint('jwks_uri'),\n          revocationEndpoint: revocation ? endpoint('revocation_endpoint') : null,\n          tokenEndpoint: endpoint('token_endpoint'),\n        };\n      })\n      .catch((error) => {\n        this.#discoveryPromise = null;\n        throw error;\n      });\n    return this.#discoveryPromise;\n  }\n\n  async #login(request: IncomingMessage, response: ServerResponse, returnTo: string): Promise<void> {\n    const logoutId = cookiesOf(request).get(LOGOUT_COOKIE);\n    if (logoutId) {\n      const logout = this.#logoutFlows.get(logoutId);\n      this.#logoutFlows.delete(logoutId);\n      if (logout) {\n        const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n        const endpoint = new URL(discovery.endSessionEndpoint);\n        endpoint.searchParams.set('client_id', configuration.clientId);\n        endpoint.searchParams.set('post_logout_redirect_uri', new URL(LOGGED_OUT_PATH, this.#developmentOrigin).href);\n        endpoint.searchParams.set('state', returnTo);\n        if (logout.idToken) {\n          endpoint.searchParams.set('id_token_hint', logout.idToken);\n        }\n        redirect(response, endpoint.href, [clearCookie(LOGOUT_COOKIE)]);\n        return;\n      }\n    }\n\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const flowId = base64Url();\n    const codeVerifier = base64Url(48);\n    const flow: IOidcFlow = { codeVerifier, createdAt: Date.now(), nonce: base64Url(), returnTo, state: base64Url() };\n    this.#flows.set(flowId, flow);\n\n    const endpoint = new URL(discovery.authorizationEndpoint);\n    endpoint.searchParams.set('response_type', 'code');\n    endpoint.searchParams.set('client_id', configuration.clientId);\n    endpoint.searchParams.set('redirect_uri', new URL(CALLBACK_PATH, this.#developmentOrigin).href);\n    endpoint.searchParams.set('scope', configuration.scope);\n    endpoint.searchParams.set('state', flow.state);\n    endpoint.searchParams.set('nonce', flow.nonce);\n    endpoint.searchParams.set('code_challenge', codeChallengeOf(codeVerifier));\n    endpoint.searchParams.set('code_challenge_method', 'S256');\n    redirect(response, endpoint.href, [cookie(FLOW_COOKIE, flowId, FLOW_MAX_AGE_SECONDS)]);\n  }\n\n  async #callback(request: IncomingMessage, response: ServerResponse, url: URL): Promise<void> {\n    const flowId = cookiesOf(request).get(FLOW_COOKIE);\n    const flow = flowId ? this.#flows.get(flowId) : undefined;\n    if (flowId) {\n      this.#flows.delete(flowId);\n    }\n    if (!flow || url.searchParams.get('state') !== flow.state) {\n      writeJson(response, 400, { code: 'invalid_oidc_state', error: 'The OIDC callback state is invalid or expired.' });\n      return;\n    }\n    const providerError = url.searchParams.get('error');\n    if (providerError) {\n      writeJson(response, 401, { code: providerError, error: url.searchParams.get('error_description') ?? 'Sign-in was rejected.' });\n      return;\n    }\n    const code = url.searchParams.get('code');\n    if (!code) {\n      writeJson(response, 400, { code: 'missing_authorization_code', error: 'The OIDC callback did not include an authorization code.' });\n      return;\n    }\n\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const fields = new URLSearchParams({\n      client_id: configuration.clientId,\n      code,\n      code_verifier: flow.codeVerifier,\n      grant_type: 'authorization_code',\n      redirect_uri: new URL(CALLBACK_PATH, this.#developmentOrigin).href,\n    });\n    const tokenResponse = await fetch(discovery.tokenEndpoint, {\n      body: fields,\n      headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },\n      method: 'POST',\n      redirect: 'error',\n    });\n    if (!tokenResponse.ok) {\n      throw new Error(`OIDC token exchange failed (${tokenResponse.status}).`);\n    }\n    const tokens = parseTokenResponse(await tokenResponse.json(), true);\n    const idToken = tokens.idToken;\n    if (!idToken) {\n      throw new Error('OIDC token endpoint did not return an ID token.');\n    }\n    const jwks = this.#jwks.get(discovery.jwksUri) ?? createRemoteJWKSet(new URL(discovery.jwksUri));\n    this.#jwks.set(discovery.jwksUri, jwks);\n    const verified = await jwtVerify(idToken, jwks, {\n      audience: configuration.clientId,\n      issuer: discovery.issuer,\n      requiredClaims: ['sub', 'nonce'],\n    });\n    if (verified.payload.nonce !== flow.nonce) {\n      throw new Error('OIDC ID token nonce does not match the authorization request.');\n    }\n\n    const sessionId = base64Url();\n    const session: ITokenSession = {\n      accessToken: tokens.accessToken,\n      expiresAt: Date.now() + tokens.expiresIn * 1000,\n      idToken,\n      moduleBootstrapTail: Promise.resolve(),\n      moduleCookies: new Map(),\n      moduleNavigationContext: null,\n      refreshToken: tokens.refreshToken,\n    };\n    this.#sessions.set(sessionId, session);\n    redirect(response, flow.returnTo, [\n      cookie(SESSION_COOKIE, sessionId, SESSION_MAX_AGE_SECONDS),\n      refreshCookieOf(session),\n      clearCookie(FLOW_COOKIE),\n    ]);\n  }\n\n  async #logout(request: IncomingMessage, response: ServerResponse): Promise<void> {\n    const sessionId = cookiesOf(request).get(SESSION_COOKIE);\n    const session = sessionId ? this.#sessions.get(sessionId) : undefined;\n    if (sessionId) {\n      this.#sessions.delete(sessionId);\n    }\n    if (session) {\n      void this.#revoke(session).catch(() => undefined);\n    }\n    const logoutId = base64Url();\n    this.#logoutFlows.set(logoutId, { createdAt: Date.now(), idToken: session?.idToken ?? null });\n    response.setHeader('Set-Cookie', [\n      clearCookie(SESSION_COOKIE),\n      clearCookie(REFRESH_COOKIE),\n      cookie(LOGOUT_COOKIE, logoutId, FLOW_MAX_AGE_SECONDS),\n    ]);\n    writeJson(response, 200, { loggedOut: true });\n  }\n\n  async #revoke(session: ITokenSession): Promise<void> {\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const revocationEndpoint = discovery.revocationEndpoint;\n    if (!revocationEndpoint) {\n      return;\n    }\n    const revoke = async (token: string, hint: string): Promise<void> => {\n      await fetch(revocationEndpoint, {\n        body: new URLSearchParams({ client_id: configuration.clientId, token, token_type_hint: hint }),\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        method: 'POST',\n        redirect: 'error',\n      });\n    };\n    await Promise.all([\n      revoke(session.accessToken, 'access_token'),\n      session.refreshToken ? revoke(session.refreshToken, 'refresh_token') : Promise.resolve(),\n    ]);\n  }\n\n  // Standalone modules send the browser to their legacy /login page when an API call answers 401, and locally no such\n  // page exists: serving the module again would repeat the 401 in a reload loop. Signed out, this is the development\n  // sign-in; signed in, the module API itself refused the session, so the page says so and redirects nowhere.\n  async #legacyLogin(request: IncomingMessage, response: ServerResponse): Promise<void> {\n    if (!(await this.#authenticatedSession(request, response))) {\n      redirect(response, `${LOGIN_PATH}?returnTo=%2F`);\n      return;\n    }\n    response.statusCode = 401;\n    response.setHeader('Cache-Control', 'no-store');\n    response.setHeader('Content-Type', 'text/html; charset=utf-8');\n    response.end(\n      '<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\"><title>Module sign-in refused</title></head>' +\n        '<body style=\"font-family:system-ui,sans-serif;margin:3rem;line-height:1.5\">' +\n        '<h1 style=\"font-size:1.25rem\">The module API refused your session</h1>' +\n        '<p>You are signed in, but a module API request answered 401 and the module asked for its legacy sign-in page. ' +\n        'Check the module backend (MODULE_API_ORIGIN) and its dev server output.</p>' +\n        `<p><a href=\"${LOGIN_PATH}?returnTo=%2F\">Sign in again</a> &middot; <a href=\"/\">Back to the module</a></p>` +\n        '</body></html>',\n    );\n  }\n\n  async #authenticatedSession(request: IncomingMessage, response: ServerResponse): Promise<ITokenSession | null> {\n    const cookies = cookiesOf(request);\n    const sessionId = cookies.get(SESSION_COOKIE);\n    const session = sessionId ? this.#sessions.get(sessionId) : undefined;\n    if (!session) {\n      return this.#restoredSession(decodedCookieValue(cookies.get(REFRESH_COOKIE)), response);\n    }\n    if (session.expiresAt > Date.now() + TOKEN_REFRESH_SKEW_MS) {\n      return session;\n    }\n    if (!session.refreshToken) {\n      if (sessionId) {\n        this.#sessions.delete(sessionId);\n      }\n      return null;\n    }\n    session.refreshPromise ??= this.#refresh(session).finally(() => {\n      session.refreshPromise = undefined;\n    });\n    try {\n      await session.refreshPromise;\n      response.setHeader('Set-Cookie', refreshCookieOf(session));\n      return session;\n    } catch {\n      if (sessionId) {\n        this.#sessions.delete(sessionId);\n      }\n      response.setHeader('Set-Cookie', clearCookie(REFRESH_COOKIE));\n      return null;\n    }\n  }\n\n  // Starts a session from the browser's refresh cookie after this server restarted or another module's server signed\n  // the developer in. Parallel requests carrying the same token share one refresh, and so, for a short while, do\n  // requests the browser sent before the rotated cookie reached it: the sign-in service accepts a refresh token once,\n  // so spending it again would fail and clear the cookie that replaced it.\n  async #restoredSession(refreshToken: string | null, response: ServerResponse): Promise<ITokenSession | null> {\n    if (!refreshToken) {\n      return null;\n    }\n    let restore = this.#restores.get(refreshToken);\n    if (!restore) {\n      restore = this.#restore(refreshToken);\n      this.#restores.set(refreshToken, restore);\n      void restore.then((restoredSession) => {\n        if (!restoredSession) {\n          this.#restores.delete(refreshToken);\n          return;\n        }\n        setTimeout(() => this.#restores.delete(refreshToken), SPENT_REFRESH_TOKEN_REUSE_MS).unref();\n      });\n    }\n    const restored = await restore;\n    if (!restored || this.#sessions.get(restored.sessionId) !== restored.session) {\n      response.setHeader('Set-Cookie', clearCookie(REFRESH_COOKIE));\n      return null;\n    }\n    response.setHeader('Set-Cookie', [cookie(SESSION_COOKIE, restored.sessionId, SESSION_MAX_AGE_SECONDS), refreshCookieOf(restored.session)]);\n    return restored.session;\n  }\n\n  async #restore(refreshToken: string): Promise<{ session: ITokenSession; sessionId: string } | null> {\n    const session: ITokenSession = {\n      accessToken: '',\n      expiresAt: 0,\n      idToken: null,\n      moduleBootstrapTail: Promise.resolve(),\n      moduleCookies: new Map(),\n      moduleNavigationContext: null,\n      refreshToken,\n    };\n    try {\n      await this.#refresh(session);\n    } catch {\n      return null;\n    }\n    const sessionId = base64Url();\n    this.#sessions.set(sessionId, session);\n    return { session, sessionId };\n  }\n\n  async #refresh(session: ITokenSession): Promise<void> {\n    const refreshToken = session.refreshToken;\n    if (!refreshToken) {\n      throw new Error('OIDC refresh token is unavailable.');\n    }\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const response = await fetch(discovery.tokenEndpoint, {\n      body: new URLSearchParams({\n        client_id: configuration.clientId,\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n      }),\n      headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },\n      method: 'POST',\n      redirect: 'error',\n    });\n    if (!response.ok) {\n      throw new Error(`OIDC refresh failed (${response.status}).`);\n    }\n    const tokens = parseTokenResponse(await response.json(), false);\n    session.accessToken = tokens.accessToken;\n    session.expiresAt = Date.now() + tokens.expiresIn * 1000;\n    session.refreshToken = tokens.refreshToken ?? session.refreshToken;\n    session.idToken = tokens.idToken ?? session.idToken;\n  }\n\n  async #proxy(request: IncomingMessage, response: ServerResponse, localUrl: URL): Promise<void> {\n    const session = await this.#authenticatedSession(request, response);\n    if (!session) {\n      // This server refreshes the session's tokens itself, so the browser can only sign in again. A refreshable code\n      // would send the host client to a refresh endpoint that only the host has.\n      writeJson(response, 401, { code: 'sign_in_required', error: 'Sign in is required.' });\n      return;\n    }\n    const isModuleApi = localUrl.pathname.startsWith(this.#moduleApiPath);\n    const isPortalApi = !isModuleApi && portalApiPathOf(localUrl.pathname) !== null;\n    if ((isModuleApi || isPortalApi) && !session.moduleNavigationContext) {\n      // The host mounts a module only once the selection is known, so its first API calls already carry it. Locally\n      // the module starts beside the navigation, so its first calls can arrive first: ask the host before forwarding.\n      session.navigationContextPromise ??= this.#loadNavigationContext(session).finally(() => {\n        session.navigationContextPromise = undefined;\n      });\n      await session.navigationContextPromise;\n    }\n    if (isModuleApi && session.moduleCookies.size === 0) {\n      const previous = session.moduleBootstrapTail;\n      let release = (): void => {};\n      const current = new Promise<void>((resolve) => {\n        release = resolve;\n      });\n      session.moduleBootstrapTail = previous.catch(() => undefined).then(() => current);\n      await previous.catch(() => undefined);\n      try {\n        await this.#proxyAuthenticated(request, response, localUrl, session, true);\n      } finally {\n        release();\n      }\n      return;\n    }\n    await this.#proxyAuthenticated(request, response, localUrl, session, isModuleApi);\n  }\n\n  async #loadNavigationContext(session: ITokenSession): Promise<void> {\n    const upstream = await fetch(new URL('/api/navigation', this.#hostOrigin), {\n      headers: { Accept: 'application/json', Authorization: `Bearer ${session.accessToken}` },\n      redirect: 'manual',\n    }).catch(() => null);\n    if (!upstream?.ok || session.moduleNavigationContext) {\n      return;\n    }\n    session.moduleNavigationContext = navigationContextIn(await upstream.json().catch(() => null));\n  }\n\n  async #proxyAuthenticated(\n    request: IncomingMessage,\n    response: ServerResponse,\n    localUrl: URL,\n    session: ITokenSession,\n    isModuleApi: boolean,\n  ): Promise<void> {\n    const portalApiPath = isModuleApi ? null : portalApiPathOf(localUrl.pathname);\n    const upstreamOrigin = isModuleApi ? this.#moduleApiOrigin : this.#hostOrigin;\n    const upstreamUrl = new URL(`${portalApiPath ?? localUrl.pathname}${localUrl.search}`, upstreamOrigin);\n    const method = request.method ?? 'GET';\n    // The portal is a module too: it gets the selection the host confirmed, and no module session of this one.\n    const moduleContext = isModuleApi\n      ? { cookies: session.moduleCookies, navigationContext: session.moduleNavigationContext }\n      : portalApiPath\n        ? { cookies: new Map<string, string>(), navigationContext: session.moduleNavigationContext }\n        : undefined;\n    const init: RequestInit = {\n      headers: proxyHeaders(request, session.accessToken, moduleContext),\n      method,\n      redirect: 'manual',\n    };\n    if (method !== 'GET' && method !== 'HEAD') {\n      // A fixed-length body: the web front ends of the deployed module servers answer chunked request bodies with 404.\n      const body = await requestBodyOf(request);\n      if (!body) {\n        writeJson(response, 413, { code: 'request_body_too_large', error: 'The request body exceeds the development proxy limit.' });\n        return;\n      }\n      init.body = body;\n    }\n    let upstream: Response;\n    try {\n      upstream = await fetch(upstreamUrl, init);\n    } catch (error) {\n      if (!isModuleApi) {\n        throw error;\n      }\n      this.#answerModuleApiUnreachable(response, error);\n      return;\n    }\n    if (isModuleApi) {\n      this.#moduleApiUnreachable = false;\n    }\n    let onChunk: ((chunk: Buffer) => void) | undefined;\n    if (isModuleApi) {\n      updateModuleCookies(session.moduleCookies, upstream.headers);\n    } else if (localUrl.pathname === '/api/navigation' && upstream.ok) {\n      session.moduleNavigationContext = navigationContextIn(\n        await upstream\n          .clone()\n          .json()\n          .catch(() => null),\n      );\n    } else if (localUrl.pathname === '/api/navigation/stream' && upstream.ok) {\n      onChunk = navigationEventReader((context) => {\n        session.moduleNavigationContext = context;\n      });\n    }\n    await copyProxyResponse(upstream, response, onChunk);\n  }\n\n  // Without this, a module server that is not running shows only as the catch-all's development_authentication_failed.\n  // The terminal says it once per outage; every refused call answers with the same explanation.\n  #answerModuleApiUnreachable(response: ServerResponse, error: unknown): void {\n    const reason = errorCodeOf(error) ?? (error instanceof Error ? error.message : 'no answer');\n    const message =\n      `Cannot reach the module server at ${this.#moduleApiOrigin.origin} (MODULE_API_ORIGIN, ${reason}). ` +\n      \"Start the module's server, or point MODULE_API_ORIGIN at one that runs.\";\n    if (!this.#moduleApiUnreachable) {\n      this.#moduleApiUnreachable = true;\n      console.warn(`[mf-isolation] ${message}`);\n    }\n    writeJson(response, 502, { code: 'module_api_unreachable', error: message });\n  }\n\n  #prune(): void {\n    const now = Date.now();\n    for (const [id, flow] of this.#flows) {\n      if (flow.createdAt + FLOW_MAX_AGE_SECONDS * 1000 < now) {\n        this.#flows.delete(id);\n      }\n    }\n    for (const [id, flow] of this.#logoutFlows) {\n      if (flow.createdAt + FLOW_MAX_AGE_SECONDS * 1000 < now) {\n        this.#logoutFlows.delete(id);\n      }\n    }\n    for (const [id, session] of this.#sessions) {\n      if (!session.refreshToken && session.expiresAt + TOKEN_REFRESH_SKEW_MS < now) {\n        this.#sessions.delete(id);\n      }\n    }\n  }\n}\n\nexport const mfDevelopmentBffPlugin = (options: IMfDevelopmentBffPluginOptions): Plugin => {\n  const middleware = createMfDevelopmentBffMiddleware(options);\n  return {\n    apply: 'serve',\n    name: 'edynamix-mf-development-bff',\n    configureServer(server) {\n      server.middlewares.use((request, response, next) => {\n        middleware(request, response, next);\n      });\n    },\n    // Locally the module runs inside the host shell, so its page shows the host's icon. The module's own favicon is\n    // only copied into the build output, so this server has none to answer the browser's favicon request with.\n    transformIndexHtml(html) {\n      return {\n        html: html.replace(ICON_LINK_PATTERN, ''),\n        tags: [{ tag: 'link', attrs: { rel: 'icon', type: 'image/svg+xml', href: HOST_ICON_PATH }, injectTo: 'head' }],\n      };\n    },\n  };\n};\n\nexport type TMfDevelopmentBffMiddleware = (request: IncomingMessage, response: ServerResponse, next: (error?: unknown) => void) => void;\n\nexport const createMfDevelopmentBffMiddleware = (options: IMfDevelopmentBffPluginOptions): TMfDevelopmentBffMiddleware => {\n  const bff = new MfDevelopmentBff(options);\n  return (request, response, next) => {\n    void bff.handle(request, response, next);\n  };\n};\n"]}

package/dist/vite-development.js

@@ -36,6 +36,11 @@ const ALLOWED_HOST_API_PATHS = [
     '/api/navigation/access-request',
     '/api/navigation/counter-stream',
 ];
+// The standalone navigation reads the portal menus under the host's /api/navigation/portal, which only a host running
+// in development relays to the portal. Every host also serves the portal API itself at /portal/api, a deployed one too,
+// so those calls go there.
+const PORTAL_MENU_PATH = '/api/navigation/portal';
+const PORTAL_API_PATH = '/portal/api';
 const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
 const requiredString = (value, key) => {
     const candidate = value[key];
@@ -168,6 +173,16 @@ const pathIsHostApi = (path) => {
 };
 // The host validates a selection the browser sends it, so host requests keep the navigation headers. A module trusts
 // them, so its requests carry only the selection the host last confirmed.
+const portalApiPathOf = (path) => path === PORTAL_MENU_PATH || path.startsWith(`${PORTAL_MENU_PATH}/`) ? `${PORTAL_API_PATH}${path.slice(PORTAL_MENU_PATH.length)}` : null;
+// Node reports the reason on the error's cause (ECONNREFUSED), Bun on the error itself.
+const errorCodeOf = (error) => {
+    for (const candidate of [isRecord(error) ? error.cause : undefined, error]) {
+        if (isRecord(candidate) && typeof candidate.code === 'string') {
+            return candidate.code;
+        }
+    }
+    return null;
+};
 const proxyHeaders = (request, accessToken, module) => {
     const headers = new Headers();
     for (const [name, value] of Object.entries(request.headers)) {
@@ -353,6 +368,7 @@ class MfDevelopmentBff {
     #logoutFlows = new Map();
     #moduleApiOrigin;
     #moduleApiPath;
+    #moduleApiUnreachable = false;
     #sessions = new Map();
     #restores = new Map();
     #configurationPromise = null;
@@ -784,7 +800,8 @@ class MfDevelopmentBff {
             return;
         }
         const isModuleApi = localUrl.pathname.startsWith(this.#moduleApiPath);
-        if (isModuleApi && !session.moduleNavigationContext) {
+        const isPortalApi = !isModuleApi && portalApiPathOf(localUrl.pathname) !== null;
+        if ((isModuleApi || isPortalApi) && !session.moduleNavigationContext) {
             // The host mounts a module only once the selection is known, so its first API calls already carry it. Locally
             // the module starts beside the navigation, so its first calls can arrive first: ask the host before forwarding.
             session.navigationContextPromise ??= this.#loadNavigationContext(session).finally(() => {
@@ -821,11 +838,18 @@ class MfDevelopmentBff {
         session.moduleNavigationContext = navigationContextIn(await upstream.json().catch(() => null));
     }
     async #proxyAuthenticated(request, response, localUrl, session, isModuleApi) {
+        const portalApiPath = isModuleApi ? null : portalApiPathOf(localUrl.pathname);
         const upstreamOrigin = isModuleApi ? this.#moduleApiOrigin : this.#hostOrigin;
-        const upstreamUrl = new URL(`${localUrl.pathname}${localUrl.search}`, upstreamOrigin);
+        const upstreamUrl = new URL(`${portalApiPath ?? localUrl.pathname}${localUrl.search}`, upstreamOrigin);
         const method = request.method ?? 'GET';
+        // The portal is a module too: it gets the selection the host confirmed, and no module session of this one.
+        const moduleContext = isModuleApi
+            ? { cookies: session.moduleCookies, navigationContext: session.moduleNavigationContext }
+            : portalApiPath
+                ? { cookies: new Map(), navigationContext: session.moduleNavigationContext }
+                : undefined;
         const init = {
-            headers: proxyHeaders(request, session.accessToken, isModuleApi ? { cookies: session.moduleCookies, navigationContext: session.moduleNavigationContext } : undefined),
+            headers: proxyHeaders(request, session.accessToken, moduleContext),
             method,
             redirect: 'manual',
         };
@@ -838,7 +862,20 @@ class MfDevelopmentBff {
             }
             init.body = body;
         }
-        const upstream = await fetch(upstreamUrl, init);
+        let upstream;
+        try {
+            upstream = await fetch(upstreamUrl, init);
+        }
+        catch (error) {
+            if (!isModuleApi) {
+                throw error;
+            }
+            this.#answerModuleApiUnreachable(response, error);
+            return;
+        }
+        if (isModuleApi) {
+            this.#moduleApiUnreachable = false;
+        }
         let onChunk;
         if (isModuleApi) {
             updateModuleCookies(session.moduleCookies, upstream.headers);
@@ -856,6 +893,18 @@ class MfDevelopmentBff {
         }
         await copyProxyResponse(upstream, response, onChunk);
     }
+    // Without this, a module server that is not running shows only as the catch-all's development_authentication_failed.
+    // The terminal says it once per outage; every refused call answers with the same explanation.
+    #answerModuleApiUnreachable(response, error) {
+        const reason = errorCodeOf(error) ?? (error instanceof Error ? error.message : 'no answer');
+        const message = `Cannot reach the module server at ${this.#moduleApiOrigin.origin} (MODULE_API_ORIGIN, ${reason}). ` +
+            "Start the module's server, or point MODULE_API_ORIGIN at one that runs.";
+        if (!this.#moduleApiUnreachable) {
+            this.#moduleApiUnreachable = true;
+            console.warn(`[mf-isolation] ${message}`);
+        }
+        writeJson(response, 502, { code: 'module_api_unreachable', error: message });
+    }
     #prune() {
         const now = Date.now();
         for (const [id, flow] of this.#flows) {

package/dist/vite-development.js.map

@@ -1 +1 @@
-{"version":3,"file":"vite-development.js","sourceRoot":"","sources":["../src/vite-development.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAGrD,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAC5C,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAChD,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,eAAe,GAAG,aAAa,CAAC;AACtC,MAAM,UAAU,GAAG,qBAAqB,CAAC;AACzC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AACnC,MAAM,CAAC,MAAM,mCAAmC,GAAG,mCAAmC,CAAC;AACvF,MAAM,cAAc,GAAG,iBAAiB,CAAC;AACzC,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACjF,MAAM,iBAAiB,GAAG,2DAA2D,CAAC;AACtF,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAClD,MAAM,+BAA+B,GAAG,GAAG,GAAG,IAAI,CAAC;AACnD,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AAC5C,MAAM,8BAA8B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACxD,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,CAAC;AACrC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAC5C,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AAC7D,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAC/D,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AACjE,MAAM,kBAAkB,GAAG,CAAC,uBAAuB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAC5I,MAAM,0BAA0B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACnD,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACjD,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;AAC7D,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAC9C,MAAM,sBAAsB,GAAG;IAC7B,cAAc;IACd,iBAAiB;IACjB,8BAA8B;IAC9B,gCAAgC;IAChC,gCAAgC;CACxB,CAAC;AAmEX,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE5I,MAAM,cAAc,GAAG,CAAC,KAA8B,EAAE,GAAW,EAAU,EAAE;IAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,KAA8B,EAAE,GAAW,EAAiB,EAAE;IACpF,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAE,KAAa,EAAE,cAAc,GAAG,KAAK,EAAO,EAAE;IACzF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC;IACjI,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8CAA8C,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAU,EAAE;IACpD,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,IAAI,GAAG,EAAE,EAAU,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjF,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAEhH,MAAM,SAAS,GAAG,CAAC,OAAwB,EAA+B,EAAE;IAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc,EAAU,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,qDAAqD,MAAM,EAAE,CAAC;AAEtJ,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAElE,oHAAoH;AACpH,6GAA6G;AAC7G,MAAM,eAAe,GAAG,CAAC,OAAsB,EAAU,EAAE,CACzD,OAAO,CAAC,YAAY;IAClB,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,8BAA8B,CAAC;IAClG,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;AAElC,MAAM,kBAAkB,GAAG,CAAC,KAAyB,EAAiB,EAAE;IACtE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa,EAAQ,EAAE;IAClF,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IACtE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,QAAwB,EAAE,QAAgB,EAAE,UAAoB,EAAE,EAAQ,EAAE;IAC5F,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,SAAwB,EAAU,EAAE;IACxD,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACvD,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAE,cAAuB,EAAkB,EAAE;IACrF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC;IACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACtD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO;QACL,WAAW,EAAE,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC;QAClD,SAAS;QACT,OAAO;QACP,YAAY,EAAE,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC;QACpD,SAAS;KACV,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE;IAC9C,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC;AAC5G,CAAC,CAAC;AAEF,qHAAqH;AACrH,0EAA0E;AAC1E,MAAM,YAAY,GAAG,CAAC,OAAwB,EAAE,WAAmB,EAAE,MAA4B,EAAW,EAAE;IAC5G,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,IACE,CAAC,KAAK;YACN,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YACpB,CAAC,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YACtH,CAAC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAClD,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,WAAW,EAAE,CAAC,CAAC;IACtD,IAAI,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,EAAE,iBAAiB,CAAC;IACpD,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9E,IAAI,iBAAiB,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,KAAc,EAAmC,EAAE;IAC9E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IAC/E,MAAM,SAAS,GAAc,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACvG,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC;QACrC,eAA0B,IAAI,CAAC;QAChC,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAK,QAAmB,IAAI,CAAC,CAAC,EAC3F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAqB,EAAE,OAAO,EAAE,eAAyB,EAAE,CAAC;AAClF,CAAC,CAAC;AAEF,qHAAqH;AACrH,MAAM,qBAAqB,GAAG,CAAC,SAAsD,EAA6B,EAAE;IAClH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,KAAK,IAAI,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YAChD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAChF,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,KAAK;iBACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;iBAC1C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;iBAC9C,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,IAAI,OAAO,GAAY,IAAI,CAAC;YAC5B,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;YAChD,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,OAA4B,EAAE,OAAgB,EAAQ,EAAE;IACnF,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5G,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACjH,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,KAAK,EAAE,OAAwB,EAA0B,EAAE;IAC/E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QAC7E,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC;QACtB,IAAI,IAAI,GAAG,sBAAsB,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAkB,EAAE,QAAwB,EAAE,OAAiC,EAAiB,EAAE;IACjI,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC1H,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC;IACzF,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAa,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,QAAkB,EAAE,YAAoB,EAAE,KAAa,EAAmB,EAAE;IAC1G,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,YAAY,EAAE,CAAC;QACrE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM;YACR,CAAC;YACD,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC;YAC/B,IAAI,UAAU,GAAG,YAAY,EAAE,CAAC;gBAC9B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,gBAAgB;IACX,iBAAiB,CAAM;IACvB,kBAAkB,CAAM;IACxB,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IACtC,WAAW,CAAM;IACjB,kBAAkB,CAAM;IACxB,KAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;IACjE,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,gBAAgB,CAAM;IACtB,cAAc,CAAS;IACvB,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,SAAS,GAAG,IAAI,GAAG,EAAyE,CAAC;IACtG,qBAAqB,GAA6C,IAAI,CAAC;IACvE,iBAAiB,GAAmC,IAAI,CAAC;IAEzD,YAAY,OAAuC;QACjD,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAC9F,IAAI,CAAC,kBAAkB,GAAG,cAAc,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,iBAAiB,GAAG,IAAI,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnF,IAAI,CAAC,kBAAkB,GAAG,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,IAAI,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;QACvH,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,KAAK,GAAG,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;YAC/G,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,eAAe,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAC3F,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,KAAK,GAAG,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACzG,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE,QAAwB,EAAE,IAA+B;QAC9F,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QAEd,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,mCAAmC,EAAE,CAAC;gBACrF,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9E,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC/F,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,iBAAiB,EAAE,CAAC;gBACjF,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5D,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACrF,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC/D,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;gBACjE,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC7D,QAAQ,CAAC,QAAQ,EAAE,GAAG,UAAU,aAAa,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;gBAC3G,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,sBAAsB,EAAE,CAAC;gBACxE,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACzD,IAAI,SAAS,EAAE,CAAC;oBACd,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnC,CAAC;gBACD,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;gBAC7F,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;gBACrE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YACD,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;gBAChF,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC,CAAC;YAC9F,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,QAAwB,EAAE,WAAgB,EAAE,IAAwB;QAChG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YACxC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,eAAe,EAAE;YACpG,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,YAAY,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,gBAAgB,GACpB,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,2CAA2C,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,oCAAoC,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,+BAA+B,CAAC;QACrG,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,mBAAmB,IAAI,EAAE,CAAC,CAAC;QACvF,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACxD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,qBAAqB,KAAK,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;aACzH,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YACvB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,KAAK,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9G,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACxG,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC,cAAc,EAAE;aAC7C,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,CAAC,MAAM,mCAAmC,EAAE;gBACvF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,KAAK,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,uBAAuB,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxH,IAAI,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAU,EAAE;gBACvC,MAAM,GAAG,GAAG,gBAAgB,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,QAAQ,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;gBAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;oBAC1C,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,yCAAyC,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO,GAAG,CAAC,IAAI,CAAC;YAClB,CAAC,CAAC;YACF,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;YAChE,OAAO;gBACL,qBAAqB,EAAE,QAAQ,CAAC,wBAAwB,CAAC;gBACzD,kBAAkB,EAAE,QAAQ,CAAC,sBAAsB,CAAC;gBACpD,MAAM;gBACN,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC;gBAC7B,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI;gBACvE,aAAa,EAAE,QAAQ,CAAC,gBAAgB,CAAC;aAC1C,CAAC;QACJ,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE,QAAwB,EAAE,QAAgB;QAC/E,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBACjG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;gBACvD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC/D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC9G,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC7C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC7D,CAAC;gBACD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAc,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;QAClH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAC1D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACnD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC/D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC;QAChG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QACxD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC3D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAwB,EAAE,QAAwB,EAAE,GAAQ;QAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1D,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAClH,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,aAAa,EAAE,CAAC;YAClB,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,uBAAuB,EAAE,CAAC,CAAC;YAC/H,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC,CAAC;YACpI,OAAO;QACT,CAAC;QAED,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,aAAa,CAAC,QAAQ;YACjC,IAAI;YACJ,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,UAAU,EAAE,oBAAoB;YAChC,YAAY,EAAE,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI;SACnE,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE;YACzD,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAC5F,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,aAAa,CAAC,MAAM,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;YAC9C,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,cAAc,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;SACjC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAkB;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI;YAC/C,OAAO;YACP,mBAAmB,EAAE,OAAO,CAAC,OAAO,EAAE;YACtC,aAAa,EAAE,IAAI,GAAG,EAAE;YACxB,uBAAuB,EAAE,IAAI;YAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;YAChC,MAAM,CAAC,cAAc,EAAE,SAAS,EAAE,uBAAuB,CAAC;YAC1D,eAAe,CAAC,OAAO,CAAC;YACxB,WAAW,CAAC,WAAW,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAwB,EAAE,QAAwB;QAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9F,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;YAC/B,WAAW,CAAC,cAAc,CAAC;YAC3B,WAAW,CAAC,cAAc,CAAC;YAC3B,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,oBAAoB,CAAC;SACtD,CAAC,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAsB;QAClC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,kBAAkB,GAAG,SAAS,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAE,IAAY,EAAiB,EAAE;YAClE,MAAM,KAAK,CAAC,kBAAkB,EAAE;gBAC9B,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;gBAC9F,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC;YAC3C,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;SACzF,CAAC,CAAC;IACL,CAAC;IAED,oHAAoH;IACpH,mHAAmH;IACnH,4GAA4G;IAC5G,KAAK,CAAC,YAAY,CAAC,OAAwB,EAAE,QAAwB;QACnE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,QAAQ,EAAE,GAAG,UAAU,eAAe,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAC/D,QAAQ,CAAC,GAAG,CACV,yGAAyG;YACvG,6EAA6E;YAC7E,wEAAwE;YACxE,gHAAgH;YAChH,6EAA6E;YAC7E,eAAe,UAAU,kFAAkF;YAC3G,gBAAgB,CACnB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAwB,EAAE,QAAwB;QAC5E,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,EAAE,CAAC;YAC3D,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7D,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,cAAc,CAAC;YAC7B,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,mHAAmH;IACnH,+GAA+G;IAC/G,oHAAoH;IACpH,yEAAyE;IACzE,KAAK,CAAC,gBAAgB,CAAC,YAA2B,EAAE,QAAwB;QAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YACtC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC1C,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE;gBACpC,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;oBACpC,OAAO;gBACT,CAAC;gBACD,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,4BAA4B,CAAC,CAAC,KAAK,EAAE,CAAC;YAC9F,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC/B,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC7E,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3I,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,MAAM,OAAO,GAAkB;YAC7B,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI;YACb,mBAAmB,EAAE,OAAO,CAAC,OAAO,EAAE;YACtC,aAAa,EAAE,IAAI,GAAG,EAAE;YACxB,uBAAuB,EAAE,IAAI;YAC7B,YAAY;SACb,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAsB;QACnC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE;YACpD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,aAAa,CAAC,QAAQ;gBACjC,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;aAC5B,CAAC;YACF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAC5F,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAChE,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACzC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QACzD,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;QACnE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE,QAAwB,EAAE,QAAa;QAC5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,+GAA+G;YAC/G,2EAA2E;YAC3E,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtE,IAAI,WAAW,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpD,8GAA8G;YAC9G,gHAAgH;YAChH,OAAO,CAAC,wBAAwB,KAAK,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBACrF,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;YAC/C,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,CAAC,wBAAwB,CAAC;QACzC,CAAC;QACD,IAAI,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC;YAC7C,IAAI,OAAO,GAAG,GAAS,EAAE,GAAE,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5C,OAAO,GAAG,OAAO,CAAC;YACpB,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,mBAAmB,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YAClF,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC7E,CAAC;oBAAS,CAAC;gBACT,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,OAAsB;QACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE;YACzE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE;YACvF,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACrD,OAAO;QACT,CAAC;QACD,OAAO,CAAC,uBAAuB,GAAG,mBAAmB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,OAAwB,EACxB,QAAwB,EACxB,QAAa,EACb,OAAsB,EACtB,WAAoB;QAEpB,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAC9E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;QACvC,MAAM,IAAI,GAAgB;YACxB,OAAO,EAAE,YAAY,CACnB,OAAO,EACP,OAAO,CAAC,WAAW,EACnB,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAAC,CAAC,SAAS,CACjH;YACD,MAAM;YACN,QAAQ,EAAE,QAAQ;SACnB,CAAC;QACF,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1C,iHAAiH;YACjH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;gBAC7H,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,OAA8C,CAAC;QACnD,IAAI,WAAW,EAAE,CAAC;YAChB,mBAAmB,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,iBAAiB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClE,OAAO,CAAC,uBAAuB,GAAG,mBAAmB,CACnD,MAAM,QAAQ;iBACX,KAAK,EAAE;iBACP,IAAI,EAAE;iBACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CACrB,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,wBAAwB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACzE,OAAO,GAAG,qBAAqB,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC1C,OAAO,CAAC,uBAAuB,GAAG,OAAO,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,MAAM;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,SAAS,GAAG,oBAAoB,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;gBACvD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,SAAS,GAAG,oBAAoB,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;gBACvD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,SAAS,GAAG,qBAAqB,GAAG,GAAG,EAAE,CAAC;gBAC7E,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAuC,EAAU,EAAE;IACxF,MAAM,UAAU,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC7D,OAAO;QACL,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,6BAA6B;QACnC,eAAe,CAAC,MAAM;YACpB,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBACjD,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,gHAAgH;QAChH,2GAA2G;QAC3G,kBAAkB,CAAC,IAAI;YACrB,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBACzC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;aAC/G,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,OAAuC,EAA+B,EAAE;IACvH,MAAM,GAAG,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACjC,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { createHash, randomBytes } from 'node:crypto';\nimport type { IncomingMessage, ServerResponse } from 'node:http';\nimport { Readable } from 'node:stream';\nimport { createRemoteJWKSet, jwtVerify } from 'jose';\nimport type { Plugin } from 'vite';\n\nconst SESSION_COOKIE = '__Host-edyn_dev_session';\nconst REFRESH_COOKIE = '__Host-edyn_dev_refresh';\nconst FLOW_COOKIE = '__Host-edyn_oidc_flow';\nconst LOGOUT_COOKIE = '__Host-edyn_oidc_logout';\nconst CALLBACK_PATH = '/callback';\nconst LOGGED_OUT_PATH = '/logged-out';\nconst LOGIN_PATH = '/api/dev-auth/login';\nconst LEGACY_LOGIN_PATH = '/login';\nexport const MF_DEVELOPMENT_HOST_NAVIGATION_PATH = '/api/dev-host-navigation/index.js';\nconst HOST_ICON_PATH = '/exsto-icon.svg';\nconst HOST_NAVIGATION_ASSET_PATHS = new Set([HOST_ICON_PATH, '/exsto-text.svg']);\nconst ICON_LINK_PATTERN = /<link\\b[^>]*\\brel=[\"'](?:shortcut\\s+)?icon[\"'][^>]*>\\s*/gi;\nconst MAX_HOST_NAVIGATION_BYTES = 5 * 1024 * 1024;\nconst MAX_HOST_NAVIGATION_ASSET_BYTES = 512 * 1024;\nconst SESSION_MAX_AGE_SECONDS = 8 * 60 * 60;\nconst REFRESH_COOKIE_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;\nconst FLOW_MAX_AGE_SECONDS = 10 * 60;\nconst TOKEN_REFRESH_SKEW_MS = 30_000;\nconst SPENT_REFRESH_TOKEN_REUSE_MS = 30_000;\nconst NAVIGATION_GROUP_HEADER = 'X-Edyn-Navigation-Group-Id';\nconst NAVIGATION_DEALER_HEADER = 'X-Edyn-Navigation-Dealer-Id';\nconst NAVIGATION_DEALERS_HEADER = 'X-Edyn-Navigation-Dealer-Ids';\nconst NAVIGATION_HEADERS = [NAVIGATION_GROUP_HEADER, NAVIGATION_DEALER_HEADER, NAVIGATION_DEALERS_HEADER].map((name) => name.toLowerCase());\nconst MAX_NAVIGATION_EVENT_BYTES = 5 * 1024 * 1024;\nconst MAX_REQUEST_BODY_BYTES = 100 * 1024 * 1024;\nconst EVENT_SEPARATOR = /\\r?\\n\\r?\\n/;\nconst COOKIE_NAME_PATTERN = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\nconst COOKIE_VALUE_PATTERN = /^[\\x20-\\x7e]*$/;\nconst ALLOWED_HOST_API_PATHS = [\n  '/api/auth/me',\n  '/api/navigation',\n  '/api/navigation/access-check',\n  '/api/navigation/access-request',\n  '/api/navigation/counter-stream',\n] as const;\n\ninterface IOidcClientConfiguration {\n  clientId: string;\n  issuer: string;\n  scope: string;\n}\n\ninterface IOidcDiscovery {\n  authorizationEndpoint: string;\n  endSessionEndpoint: string;\n  issuer: string;\n  jwksUri: string;\n  revocationEndpoint: string | null;\n  tokenEndpoint: string;\n}\n\ninterface IOidcFlow {\n  codeVerifier: string;\n  createdAt: number;\n  nonce: string;\n  returnTo: string;\n  state: string;\n}\n\ninterface IModuleNavigationContext {\n  dealerIds: readonly number[];\n  groupId: number;\n}\n\ninterface IModuleProxyContext {\n  cookies: Map<string, string>;\n  navigationContext: IModuleNavigationContext | null;\n}\n\ninterface ITokenSession {\n  accessToken: string;\n  expiresAt: number;\n  idToken: string | null;\n  moduleBootstrapTail: Promise<void>;\n  moduleCookies: Map<string, string>;\n  moduleNavigationContext: IModuleNavigationContext | null;\n  navigationContextPromise?: Promise<void>;\n  refreshPromise?: Promise<void>;\n  refreshToken: string | null;\n}\n\ninterface ILogoutFlow {\n  createdAt: number;\n  idToken: string | null;\n}\n\ninterface ITokenResponse {\n  accessToken: string;\n  expiresIn: number;\n  idToken: string | null;\n  refreshToken: string | null;\n  tokenType: string;\n}\n\nexport interface IMfDevelopmentBffPluginOptions {\n  developmentOrigin?: string;\n  hostNavigationUrl: string;\n  moduleApiOrigin: string;\n  moduleApiPath: string;\n}\n\nconst isRecord = (value: unknown): value is Record<string, unknown> => typeof value === 'object' && value !== null && !Array.isArray(value);\n\nconst requiredString = (value: Record<string, unknown>, key: string): string => {\n  const candidate = value[key];\n  if (typeof candidate !== 'string' || candidate.trim() === '') {\n    throw new Error(`OIDC response is missing ${key}.`);\n  }\n  return candidate;\n};\n\nconst optionalString = (value: Record<string, unknown>, key: string): string | null => {\n  const candidate = value[key];\n  if (candidate === undefined || candidate === null) {\n    return null;\n  }\n  if (typeof candidate !== 'string' || candidate.trim() === '') {\n    throw new Error(`OIDC response contains an invalid ${key}.`);\n  }\n  return candidate;\n};\n\nconst absoluteHttpsUrl = (candidate: string, label: string, allowLocalHttp = false): URL => {\n  let url: URL;\n  try {\n    url = new URL(candidate);\n  } catch {\n    throw new Error(`${label} must be an absolute URL.`);\n  }\n  const isLocalHttp = allowLocalHttp && url.protocol === 'http:' && (url.hostname === 'localhost' || url.hostname === '127.0.0.1');\n  if (url.protocol !== 'https:' && !isLocalHttp) {\n    throw new Error(`${label} must use HTTPS.`);\n  }\n  if (url.username || url.password || url.hash) {\n    throw new Error(`${label} must not contain credentials or a fragment.`);\n  }\n  return url;\n};\n\nconst moduleApiPrefix = (candidate: string): string => {\n  if (!/^\\/[a-z][a-z0-9-]*\\/api\\/$/.test(candidate)) {\n    throw new Error('moduleApiPath must use the canonical /module/api/ boundary.');\n  }\n  return candidate;\n};\n\nconst base64Url = (size = 32): string => randomBytes(size).toString('base64url');\nconst codeChallengeOf = (verifier: string): string => createHash('sha256').update(verifier).digest('base64url');\n\nconst cookiesOf = (request: IncomingMessage): ReadonlyMap<string, string> => {\n  const cookies = new Map<string, string>();\n  for (const part of (request.headers.cookie ?? '').split(';')) {\n    const separator = part.indexOf('=');\n    if (separator <= 0) {\n      continue;\n    }\n    const name = part.slice(0, separator).trim();\n    const value = part.slice(separator + 1).trim();\n    if (name && value) {\n      cookies.set(name, value);\n    }\n  }\n  return cookies;\n};\n\nconst cookie = (name: string, value: string, maxAge: number): string => `${name}=${value}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge}`;\n\nconst clearCookie = (name: string): string => cookie(name, '', 0);\n\n// The refresh token stays in an HttpOnly cookie for this origin, which every module's development server shares, so\n// one sign-in survives restarts and module switches until the token expires; page scripts can never read it.\nconst refreshCookieOf = (session: ITokenSession): string =>\n  session.refreshToken\n    ? cookie(REFRESH_COOKIE, encodeURIComponent(session.refreshToken), REFRESH_COOKIE_MAX_AGE_SECONDS)\n    : clearCookie(REFRESH_COOKIE);\n\nconst decodedCookieValue = (value: string | undefined): string | null => {\n  if (!value) {\n    return null;\n  }\n  try {\n    return decodeURIComponent(value);\n  } catch {\n    return null;\n  }\n};\n\nconst writeJson = (response: ServerResponse, status: number, body: unknown): void => {\n  response.statusCode = status;\n  response.setHeader('Cache-Control', 'no-store');\n  response.setHeader('Content-Type', 'application/json; charset=utf-8');\n  response.end(JSON.stringify(body));\n};\n\nconst redirect = (response: ServerResponse, location: string, cookies: string[] = []): void => {\n  response.statusCode = 302;\n  response.setHeader('Cache-Control', 'no-store');\n  response.setHeader('Location', location);\n  if (cookies.length > 0) {\n    response.setHeader('Set-Cookie', cookies);\n  }\n  response.end();\n};\n\nconst safeReturnTo = (candidate: string | null): string => {\n  if (!candidate?.startsWith('/') || candidate.startsWith('//')) {\n    return '/';\n  }\n  try {\n    const parsed = new URL(candidate, 'https://localhost');\n    return `${parsed.pathname}${parsed.search}${parsed.hash}`;\n  } catch {\n    return '/';\n  }\n};\n\nconst parseTokenResponse = (value: unknown, requireIdToken: boolean): ITokenResponse => {\n  if (!isRecord(value)) {\n    throw new Error('OIDC token endpoint returned an invalid response.');\n  }\n  const expiresIn = value.expires_in;\n  if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0) {\n    throw new Error('OIDC token endpoint returned an invalid expires_in value.');\n  }\n  const idToken = optionalString(value, 'id_token');\n  if (requireIdToken && !idToken) {\n    throw new Error('OIDC token endpoint did not return an ID token.');\n  }\n  const tokenType = requiredString(value, 'token_type');\n  if (tokenType.toLowerCase() !== 'bearer') {\n    throw new Error('OIDC token endpoint returned an unsupported token type.');\n  }\n  return {\n    accessToken: requiredString(value, 'access_token'),\n    expiresIn,\n    idToken,\n    refreshToken: optionalString(value, 'refresh_token'),\n    tokenType,\n  };\n};\n\nconst pathIsHostApi = (path: string): boolean => {\n  return ALLOWED_HOST_API_PATHS.some((candidate) => path === candidate || path.startsWith(`${candidate}/`));\n};\n\n// The host validates a selection the browser sends it, so host requests keep the navigation headers. A module trusts\n// them, so its requests carry only the selection the host last confirmed.\nconst proxyHeaders = (request: IncomingMessage, accessToken: string, module?: IModuleProxyContext): Headers => {\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(request.headers)) {\n    const lowerName = name.toLowerCase();\n    if (\n      !value ||\n      name.startsWith(':') ||\n      ['authorization', 'connection', 'content-length', 'cookie', 'host', 'origin', 'transfer-encoding'].includes(lowerName) ||\n      (module && NAVIGATION_HEADERS.includes(lowerName))\n    ) {\n      continue;\n    }\n    if (Array.isArray(value)) {\n      for (const item of value) {\n        headers.append(name, item);\n      }\n    } else {\n      headers.set(name, value);\n    }\n  }\n  headers.set('Authorization', `Bearer ${accessToken}`);\n  if (module?.cookies.size) {\n    headers.set('Cookie', [...module.cookies.values()].join('; '));\n  }\n  const navigationContext = module?.navigationContext;\n  if (navigationContext) {\n    headers.set(NAVIGATION_GROUP_HEADER, String(navigationContext.groupId));\n    headers.set(NAVIGATION_DEALERS_HEADER, navigationContext.dealerIds.join(','));\n    if (navigationContext.dealerIds.length === 1) {\n      headers.set(NAVIGATION_DEALER_HEADER, String(navigationContext.dealerIds[0]));\n    }\n  }\n  return headers;\n};\n\nconst navigationContextIn = (value: unknown): IModuleNavigationContext | null => {\n  if (!isRecord(value) || !isRecord(value.context)) {\n    return null;\n  }\n  const { selectedDealerId, selectedDealerIds, selectedGroupId } = value.context;\n  const dealerIds: unknown[] = Array.isArray(selectedDealerIds) ? selectedDealerIds : [selectedDealerId];\n  if (\n    !Number.isSafeInteger(selectedGroupId) ||\n    (selectedGroupId as number) <= 0 ||\n    dealerIds.length === 0 ||\n    !dealerIds.every((dealerId) => Number.isSafeInteger(dealerId) && (dealerId as number) >= 0)\n  ) {\n    return null;\n  }\n  return { dealerIds: dealerIds as number[], groupId: selectedGroupId as number };\n};\n\n// Reads the selection each `navigation` event of the host's navigation stream confirms, chunk by chunk as it passes.\nconst navigationEventReader = (onContext: (context: IModuleNavigationContext) => void): ((chunk: Buffer) => void) => {\n  const decoder = new TextDecoder();\n  let pending = '';\n  return (chunk) => {\n    pending += decoder.decode(chunk, { stream: true });\n    for (let separator = EVENT_SEPARATOR.exec(pending); separator; separator = EVENT_SEPARATOR.exec(pending)) {\n      const block = pending.slice(0, separator.index);\n      pending = pending.slice(separator.index + separator[0].length);\n      const lines = block.split(/\\r?\\n/);\n      if (!lines.includes('event: navigation') && !lines.includes('event:navigation')) {\n        continue;\n      }\n      const data = lines\n        .filter((line) => line.startsWith('data:'))\n        .map((line) => line.slice(5).replace(/^ /, ''))\n        .join('\\n');\n      let payload: unknown = null;\n      try {\n        payload = JSON.parse(data);\n      } catch {\n        continue;\n      }\n      const context = navigationContextIn(payload);\n      if (context) {\n        onContext(context);\n      }\n    }\n    if (pending.length > MAX_NAVIGATION_EVENT_BYTES) {\n      pending = '';\n    }\n  };\n};\n\nconst updateModuleCookies = (cookies: Map<string, string>, headers: Headers): void => {\n  const values = headers.getSetCookie();\n  for (const value of values) {\n    if (value.length > 4096) {\n      continue;\n    }\n    const [pair, ...attributes] = value.split(';');\n    const separator = pair?.indexOf('=') ?? -1;\n    if (!pair || separator <= 0) {\n      continue;\n    }\n    const name = pair.slice(0, separator).trim();\n    const cookieValue = pair.slice(separator + 1).trim();\n    if (!COOKIE_NAME_PATTERN.test(name) || !COOKIE_VALUE_PATTERN.test(cookieValue) || cookieValue.includes(';')) {\n      continue;\n    }\n    const deleted = cookieValue === '' || attributes.some((attribute) => /^\\s*max-age\\s*=\\s*0\\s*$/i.test(attribute));\n    if (deleted) {\n      cookies.delete(name);\n      continue;\n    }\n    if (!cookies.has(name) && cookies.size >= 32) {\n      continue;\n    }\n    cookies.set(name, `${name}=${cookieValue}`);\n  }\n};\n\nconst requestBodyOf = async (request: IncomingMessage): Promise<Buffer | null> => {\n  const chunks: Buffer[] = [];\n  let size = 0;\n  for await (const chunk of request) {\n    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk as string);\n    size += buffer.length;\n    if (size > MAX_REQUEST_BODY_BYTES) {\n      return null;\n    }\n    chunks.push(buffer);\n  }\n  return Buffer.concat(chunks);\n};\n\nconst copyProxyResponse = async (upstream: Response, response: ServerResponse, onChunk?: (chunk: Buffer) => void): Promise<void> => {\n  response.statusCode = upstream.status;\n  for (const [name, value] of upstream.headers) {\n    if (!['connection', 'content-encoding', 'content-length', 'set-cookie', 'transfer-encoding'].includes(name.toLowerCase())) {\n      response.setHeader(name, value);\n    }\n  }\n  response.setHeader('Cache-Control', upstream.headers.get('cache-control') ?? 'no-store');\n  if (!upstream.body) {\n    response.end();\n    return;\n  }\n  await new Promise<void>((resolve, reject) => {\n    const readable = Readable.fromWeb(upstream.body as never);\n    if (onChunk) {\n      readable.on('data', onChunk);\n    }\n    readable.once('error', reject);\n    response.once('error', reject);\n    response.once('finish', resolve);\n    readable.pipe(response);\n  });\n};\n\nconst readResponseBody = async (response: Response, maximumBytes: number, label: string): Promise<Buffer> => {\n  const declaredLength = Number(response.headers.get('content-length'));\n  if (Number.isFinite(declaredLength) && declaredLength > maximumBytes) {\n    await response.body?.cancel();\n    throw new Error(`${label} exceeded the configured size limit.`);\n  }\n  if (!response.body) {\n    return Buffer.alloc(0);\n  }\n\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let totalBytes = 0;\n  try {\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) {\n        break;\n      }\n      totalBytes += value.byteLength;\n      if (totalBytes > maximumBytes) {\n        await reader.cancel();\n        throw new Error(`${label} exceeded the configured size limit.`);\n      }\n      chunks.push(value);\n    }\n  } finally {\n    reader.releaseLock();\n  }\n  return Buffer.concat(chunks, totalBytes);\n};\n\nclass MfDevelopmentBff {\n  readonly #configurationUrl: URL;\n  readonly #developmentOrigin: URL;\n  readonly #flows = new Map<string, IOidcFlow>();\n  readonly #hostOrigin: URL;\n  readonly #hostNavigationUrl: URL;\n  readonly #jwks = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n  readonly #logoutFlows = new Map<string, ILogoutFlow>();\n  readonly #moduleApiOrigin: URL;\n  readonly #moduleApiPath: string;\n  readonly #sessions = new Map<string, ITokenSession>();\n  readonly #restores = new Map<string, Promise<{ session: ITokenSession; sessionId: string } | null>>();\n  #configurationPromise: Promise<IOidcClientConfiguration> | null = null;\n  #discoveryPromise: Promise<IOidcDiscovery> | null = null;\n\n  constructor(options: IMfDevelopmentBffPluginOptions) {\n    const hostNavigation = absoluteHttpsUrl(options.hostNavigationUrl, 'hostNavigationUrl', true);\n    this.#hostNavigationUrl = hostNavigation;\n    this.#hostOrigin = new URL(hostNavigation.origin);\n    this.#configurationUrl = new URL('/api/auth/oidc-configuration', this.#hostOrigin);\n    this.#developmentOrigin = absoluteHttpsUrl(options.developmentOrigin ?? 'https://localhost:4200', 'developmentOrigin');\n    if (this.#developmentOrigin.pathname !== '/' || this.#developmentOrigin.search || this.#developmentOrigin.hash) {\n      throw new Error('developmentOrigin must be an origin without a path, query, or fragment.');\n    }\n    this.#moduleApiOrigin = absoluteHttpsUrl(options.moduleApiOrigin, 'moduleApiOrigin', true);\n    if (this.#moduleApiOrigin.pathname !== '/' || this.#moduleApiOrigin.search || this.#moduleApiOrigin.hash) {\n      throw new Error('moduleApiOrigin must be an origin without a path, query, or fragment.');\n    }\n    this.#moduleApiPath = moduleApiPrefix(options.moduleApiPath);\n  }\n\n  async handle(request: IncomingMessage, response: ServerResponse, next: (error?: unknown) => void): Promise<void> {\n    if (!request.url || !request.method) {\n      next();\n      return;\n    }\n    const url = new URL(request.url, this.#developmentOrigin);\n    this.#prune();\n\n    try {\n      if (request.method === 'GET' && url.pathname === MF_DEVELOPMENT_HOST_NAVIGATION_PATH) {\n        await this.#hostNavigationResource(response, this.#hostNavigationUrl, 'script');\n        return;\n      }\n      if (request.method === 'GET' && HOST_NAVIGATION_ASSET_PATHS.has(url.pathname)) {\n        await this.#hostNavigationResource(response, new URL(url.pathname, this.#hostOrigin), 'asset');\n        return;\n      }\n      if (request.method === 'GET' && url.pathname.toLowerCase() === LEGACY_LOGIN_PATH) {\n        await this.#legacyLogin(request, response);\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === LOGIN_PATH) {\n        await this.#login(request, response, safeReturnTo(url.searchParams.get('returnTo')));\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === CALLBACK_PATH) {\n        await this.#callback(request, response, url);\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === LOGGED_OUT_PATH) {\n        const returnTo = safeReturnTo(url.searchParams.get('state'));\n        redirect(response, `${LOGIN_PATH}?returnTo=${encodeURIComponent(returnTo)}`, [clearCookie(LOGOUT_COOKIE)]);\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === '/frontchannel-logout') {\n        const sessionId = cookiesOf(request).get(SESSION_COOKIE);\n        if (sessionId) {\n          this.#sessions.delete(sessionId);\n        }\n        response.statusCode = 204;\n        response.setHeader('Set-Cookie', [clearCookie(SESSION_COOKIE), clearCookie(REFRESH_COOKIE)]);\n        response.end();\n        return;\n      }\n      if (request.method === 'POST' && url.pathname === '/api/auth/logout') {\n        await this.#logout(request, response);\n        return;\n      }\n      if (pathIsHostApi(url.pathname) || url.pathname.startsWith(this.#moduleApiPath)) {\n        await this.#proxy(request, response, url);\n        return;\n      }\n      next();\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Development authentication failed.';\n      writeJson(response, 502, { code: 'development_authentication_failed', error: message });\n    }\n  }\n\n  async #hostNavigationResource(response: ServerResponse, upstreamUrl: URL, kind: 'asset' | 'script'): Promise<void> {\n    const upstream = await fetch(upstreamUrl, {\n      headers: { Accept: kind === 'script' ? 'text/javascript, application/javascript' : 'image/svg+xml' },\n      redirect: 'error',\n    });\n    if (!upstream.ok) {\n      throw new Error(`Host navigation ${kind} failed (${upstream.status}).`);\n    }\n    const contentType = upstream.headers.get('content-type') ?? '';\n    const validContentType =\n      kind === 'script' ? /^(?:text|application)\\/javascript(?:;|$)/i.test(contentType) : /^image\\/svg\\+xml(?:;|$)/i.test(contentType);\n    if (!validContentType) {\n      throw new Error(`Host navigation ${kind} returned an invalid content type.`);\n    }\n    const maximumBytes = kind === 'script' ? MAX_HOST_NAVIGATION_BYTES : MAX_HOST_NAVIGATION_ASSET_BYTES;\n    const body = await readResponseBody(upstream, maximumBytes, `Host navigation ${kind}`);\n    response.statusCode = 200;\n    response.setHeader('Cache-Control', 'no-store');\n    response.setHeader('Content-Type', contentType);\n    response.setHeader('X-Content-Type-Options', 'nosniff');\n    response.end(body);\n  }\n\n  async #configuration(): Promise<IOidcClientConfiguration> {\n    this.#configurationPromise ??= fetch(this.#configurationUrl, { headers: { Accept: 'application/json' }, redirect: 'error' })\n      .then(async (response) => {\n        if (!response.ok) {\n          throw new Error(`Host OIDC configuration failed (${response.status}).`);\n        }\n        const value: unknown = await response.json();\n        if (!isRecord(value)) {\n          throw new Error('Host OIDC configuration returned an invalid response.');\n        }\n        const issuer = absoluteHttpsUrl(requiredString(value, 'issuer'), 'OIDC issuer', true).href.replace(/\\/$/, '');\n        return { clientId: requiredString(value, 'clientId'), issuer, scope: requiredString(value, 'scope') };\n      })\n      .catch((error) => {\n        this.#configurationPromise = null;\n        throw error;\n      });\n    return this.#configurationPromise;\n  }\n\n  async #discovery(): Promise<IOidcDiscovery> {\n    this.#discoveryPromise ??= this.#configuration()\n      .then(async (configuration) => {\n        const response = await fetch(`${configuration.issuer}/.well-known/openid-configuration`, {\n          headers: { Accept: 'application/json' },\n          redirect: 'error',\n        });\n        if (!response.ok) {\n          throw new Error(`OIDC discovery failed (${response.status}).`);\n        }\n        const value: unknown = await response.json();\n        if (!isRecord(value)) {\n          throw new Error('OIDC discovery returned an invalid response.');\n        }\n        const issuer = absoluteHttpsUrl(requiredString(value, 'issuer'), 'OIDC discovery issuer', true).href.replace(/\\/$/, '');\n        if (issuer !== configuration.issuer) {\n          throw new Error('OIDC discovery issuer does not match the host configuration.');\n        }\n        const endpoint = (key: string): string => {\n          const url = absoluteHttpsUrl(requiredString(value, key), `OIDC ${key}`, true);\n          if (url.origin !== new URL(issuer).origin) {\n            throw new Error(`OIDC ${key} must use the configured issuer origin.`);\n          }\n          return url.href;\n        };\n        const revocation = optionalString(value, 'revocation_endpoint');\n        return {\n          authorizationEndpoint: endpoint('authorization_endpoint'),\n          endSessionEndpoint: endpoint('end_session_endpoint'),\n          issuer,\n          jwksUri: endpoint('jwks_uri'),\n          revocationEndpoint: revocation ? endpoint('revocation_endpoint') : null,\n          tokenEndpoint: endpoint('token_endpoint'),\n        };\n      })\n      .catch((error) => {\n        this.#discoveryPromise = null;\n        throw error;\n      });\n    return this.#discoveryPromise;\n  }\n\n  async #login(request: IncomingMessage, response: ServerResponse, returnTo: string): Promise<void> {\n    const logoutId = cookiesOf(request).get(LOGOUT_COOKIE);\n    if (logoutId) {\n      const logout = this.#logoutFlows.get(logoutId);\n      this.#logoutFlows.delete(logoutId);\n      if (logout) {\n        const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n        const endpoint = new URL(discovery.endSessionEndpoint);\n        endpoint.searchParams.set('client_id', configuration.clientId);\n        endpoint.searchParams.set('post_logout_redirect_uri', new URL(LOGGED_OUT_PATH, this.#developmentOrigin).href);\n        endpoint.searchParams.set('state', returnTo);\n        if (logout.idToken) {\n          endpoint.searchParams.set('id_token_hint', logout.idToken);\n        }\n        redirect(response, endpoint.href, [clearCookie(LOGOUT_COOKIE)]);\n        return;\n      }\n    }\n\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const flowId = base64Url();\n    const codeVerifier = base64Url(48);\n    const flow: IOidcFlow = { codeVerifier, createdAt: Date.now(), nonce: base64Url(), returnTo, state: base64Url() };\n    this.#flows.set(flowId, flow);\n\n    const endpoint = new URL(discovery.authorizationEndpoint);\n    endpoint.searchParams.set('response_type', 'code');\n    endpoint.searchParams.set('client_id', configuration.clientId);\n    endpoint.searchParams.set('redirect_uri', new URL(CALLBACK_PATH, this.#developmentOrigin).href);\n    endpoint.searchParams.set('scope', configuration.scope);\n    endpoint.searchParams.set('state', flow.state);\n    endpoint.searchParams.set('nonce', flow.nonce);\n    endpoint.searchParams.set('code_challenge', codeChallengeOf(codeVerifier));\n    endpoint.searchParams.set('code_challenge_method', 'S256');\n    redirect(response, endpoint.href, [cookie(FLOW_COOKIE, flowId, FLOW_MAX_AGE_SECONDS)]);\n  }\n\n  async #callback(request: IncomingMessage, response: ServerResponse, url: URL): Promise<void> {\n    const flowId = cookiesOf(request).get(FLOW_COOKIE);\n    const flow = flowId ? this.#flows.get(flowId) : undefined;\n    if (flowId) {\n      this.#flows.delete(flowId);\n    }\n    if (!flow || url.searchParams.get('state') !== flow.state) {\n      writeJson(response, 400, { code: 'invalid_oidc_state', error: 'The OIDC callback state is invalid or expired.' });\n      return;\n    }\n    const providerError = url.searchParams.get('error');\n    if (providerError) {\n      writeJson(response, 401, { code: providerError, error: url.searchParams.get('error_description') ?? 'Sign-in was rejected.' });\n      return;\n    }\n    const code = url.searchParams.get('code');\n    if (!code) {\n      writeJson(response, 400, { code: 'missing_authorization_code', error: 'The OIDC callback did not include an authorization code.' });\n      return;\n    }\n\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const fields = new URLSearchParams({\n      client_id: configuration.clientId,\n      code,\n      code_verifier: flow.codeVerifier,\n      grant_type: 'authorization_code',\n      redirect_uri: new URL(CALLBACK_PATH, this.#developmentOrigin).href,\n    });\n    const tokenResponse = await fetch(discovery.tokenEndpoint, {\n      body: fields,\n      headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },\n      method: 'POST',\n      redirect: 'error',\n    });\n    if (!tokenResponse.ok) {\n      throw new Error(`OIDC token exchange failed (${tokenResponse.status}).`);\n    }\n    const tokens = parseTokenResponse(await tokenResponse.json(), true);\n    const idToken = tokens.idToken;\n    if (!idToken) {\n      throw new Error('OIDC token endpoint did not return an ID token.');\n    }\n    const jwks = this.#jwks.get(discovery.jwksUri) ?? createRemoteJWKSet(new URL(discovery.jwksUri));\n    this.#jwks.set(discovery.jwksUri, jwks);\n    const verified = await jwtVerify(idToken, jwks, {\n      audience: configuration.clientId,\n      issuer: discovery.issuer,\n      requiredClaims: ['sub', 'nonce'],\n    });\n    if (verified.payload.nonce !== flow.nonce) {\n      throw new Error('OIDC ID token nonce does not match the authorization request.');\n    }\n\n    const sessionId = base64Url();\n    const session: ITokenSession = {\n      accessToken: tokens.accessToken,\n      expiresAt: Date.now() + tokens.expiresIn * 1000,\n      idToken,\n      moduleBootstrapTail: Promise.resolve(),\n      moduleCookies: new Map(),\n      moduleNavigationContext: null,\n      refreshToken: tokens.refreshToken,\n    };\n    this.#sessions.set(sessionId, session);\n    redirect(response, flow.returnTo, [\n      cookie(SESSION_COOKIE, sessionId, SESSION_MAX_AGE_SECONDS),\n      refreshCookieOf(session),\n      clearCookie(FLOW_COOKIE),\n    ]);\n  }\n\n  async #logout(request: IncomingMessage, response: ServerResponse): Promise<void> {\n    const sessionId = cookiesOf(request).get(SESSION_COOKIE);\n    const session = sessionId ? this.#sessions.get(sessionId) : undefined;\n    if (sessionId) {\n      this.#sessions.delete(sessionId);\n    }\n    if (session) {\n      void this.#revoke(session).catch(() => undefined);\n    }\n    const logoutId = base64Url();\n    this.#logoutFlows.set(logoutId, { createdAt: Date.now(), idToken: session?.idToken ?? null });\n    response.setHeader('Set-Cookie', [\n      clearCookie(SESSION_COOKIE),\n      clearCookie(REFRESH_COOKIE),\n      cookie(LOGOUT_COOKIE, logoutId, FLOW_MAX_AGE_SECONDS),\n    ]);\n    writeJson(response, 200, { loggedOut: true });\n  }\n\n  async #revoke(session: ITokenSession): Promise<void> {\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const revocationEndpoint = discovery.revocationEndpoint;\n    if (!revocationEndpoint) {\n      return;\n    }\n    const revoke = async (token: string, hint: string): Promise<void> => {\n      await fetch(revocationEndpoint, {\n        body: new URLSearchParams({ client_id: configuration.clientId, token, token_type_hint: hint }),\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        method: 'POST',\n        redirect: 'error',\n      });\n    };\n    await Promise.all([\n      revoke(session.accessToken, 'access_token'),\n      session.refreshToken ? revoke(session.refreshToken, 'refresh_token') : Promise.resolve(),\n    ]);\n  }\n\n  // Standalone modules send the browser to their legacy /login page when an API call answers 401, and locally no such\n  // page exists: serving the module again would repeat the 401 in a reload loop. Signed out, this is the development\n  // sign-in; signed in, the module API itself refused the session, so the page says so and redirects nowhere.\n  async #legacyLogin(request: IncomingMessage, response: ServerResponse): Promise<void> {\n    if (!(await this.#authenticatedSession(request, response))) {\n      redirect(response, `${LOGIN_PATH}?returnTo=%2F`);\n      return;\n    }\n    response.statusCode = 401;\n    response.setHeader('Cache-Control', 'no-store');\n    response.setHeader('Content-Type', 'text/html; charset=utf-8');\n    response.end(\n      '<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\"><title>Module sign-in refused</title></head>' +\n        '<body style=\"font-family:system-ui,sans-serif;margin:3rem;line-height:1.5\">' +\n        '<h1 style=\"font-size:1.25rem\">The module API refused your session</h1>' +\n        '<p>You are signed in, but a module API request answered 401 and the module asked for its legacy sign-in page. ' +\n        'Check the module backend (MODULE_API_ORIGIN) and its dev server output.</p>' +\n        `<p><a href=\"${LOGIN_PATH}?returnTo=%2F\">Sign in again</a> &middot; <a href=\"/\">Back to the module</a></p>` +\n        '</body></html>',\n    );\n  }\n\n  async #authenticatedSession(request: IncomingMessage, response: ServerResponse): Promise<ITokenSession | null> {\n    const cookies = cookiesOf(request);\n    const sessionId = cookies.get(SESSION_COOKIE);\n    const session = sessionId ? this.#sessions.get(sessionId) : undefined;\n    if (!session) {\n      return this.#restoredSession(decodedCookieValue(cookies.get(REFRESH_COOKIE)), response);\n    }\n    if (session.expiresAt > Date.now() + TOKEN_REFRESH_SKEW_MS) {\n      return session;\n    }\n    if (!session.refreshToken) {\n      if (sessionId) {\n        this.#sessions.delete(sessionId);\n      }\n      return null;\n    }\n    session.refreshPromise ??= this.#refresh(session).finally(() => {\n      session.refreshPromise = undefined;\n    });\n    try {\n      await session.refreshPromise;\n      response.setHeader('Set-Cookie', refreshCookieOf(session));\n      return session;\n    } catch {\n      if (sessionId) {\n        this.#sessions.delete(sessionId);\n      }\n      response.setHeader('Set-Cookie', clearCookie(REFRESH_COOKIE));\n      return null;\n    }\n  }\n\n  // Starts a session from the browser's refresh cookie after this server restarted or another module's server signed\n  // the developer in. Parallel requests carrying the same token share one refresh, and so, for a short while, do\n  // requests the browser sent before the rotated cookie reached it: the sign-in service accepts a refresh token once,\n  // so spending it again would fail and clear the cookie that replaced it.\n  async #restoredSession(refreshToken: string | null, response: ServerResponse): Promise<ITokenSession | null> {\n    if (!refreshToken) {\n      return null;\n    }\n    let restore = this.#restores.get(refreshToken);\n    if (!restore) {\n      restore = this.#restore(refreshToken);\n      this.#restores.set(refreshToken, restore);\n      void restore.then((restoredSession) => {\n        if (!restoredSession) {\n          this.#restores.delete(refreshToken);\n          return;\n        }\n        setTimeout(() => this.#restores.delete(refreshToken), SPENT_REFRESH_TOKEN_REUSE_MS).unref();\n      });\n    }\n    const restored = await restore;\n    if (!restored || this.#sessions.get(restored.sessionId) !== restored.session) {\n      response.setHeader('Set-Cookie', clearCookie(REFRESH_COOKIE));\n      return null;\n    }\n    response.setHeader('Set-Cookie', [cookie(SESSION_COOKIE, restored.sessionId, SESSION_MAX_AGE_SECONDS), refreshCookieOf(restored.session)]);\n    return restored.session;\n  }\n\n  async #restore(refreshToken: string): Promise<{ session: ITokenSession; sessionId: string } | null> {\n    const session: ITokenSession = {\n      accessToken: '',\n      expiresAt: 0,\n      idToken: null,\n      moduleBootstrapTail: Promise.resolve(),\n      moduleCookies: new Map(),\n      moduleNavigationContext: null,\n      refreshToken,\n    };\n    try {\n      await this.#refresh(session);\n    } catch {\n      return null;\n    }\n    const sessionId = base64Url();\n    this.#sessions.set(sessionId, session);\n    return { session, sessionId };\n  }\n\n  async #refresh(session: ITokenSession): Promise<void> {\n    const refreshToken = session.refreshToken;\n    if (!refreshToken) {\n      throw new Error('OIDC refresh token is unavailable.');\n    }\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const response = await fetch(discovery.tokenEndpoint, {\n      body: new URLSearchParams({\n        client_id: configuration.clientId,\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n      }),\n      headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },\n      method: 'POST',\n      redirect: 'error',\n    });\n    if (!response.ok) {\n      throw new Error(`OIDC refresh failed (${response.status}).`);\n    }\n    const tokens = parseTokenResponse(await response.json(), false);\n    session.accessToken = tokens.accessToken;\n    session.expiresAt = Date.now() + tokens.expiresIn * 1000;\n    session.refreshToken = tokens.refreshToken ?? session.refreshToken;\n    session.idToken = tokens.idToken ?? session.idToken;\n  }\n\n  async #proxy(request: IncomingMessage, response: ServerResponse, localUrl: URL): Promise<void> {\n    const session = await this.#authenticatedSession(request, response);\n    if (!session) {\n      // This server refreshes the session's tokens itself, so the browser can only sign in again. A refreshable code\n      // would send the host client to a refresh endpoint that only the host has.\n      writeJson(response, 401, { code: 'sign_in_required', error: 'Sign in is required.' });\n      return;\n    }\n    const isModuleApi = localUrl.pathname.startsWith(this.#moduleApiPath);\n    if (isModuleApi && !session.moduleNavigationContext) {\n      // The host mounts a module only once the selection is known, so its first API calls already carry it. Locally\n      // the module starts beside the navigation, so its first calls can arrive first: ask the host before forwarding.\n      session.navigationContextPromise ??= this.#loadNavigationContext(session).finally(() => {\n        session.navigationContextPromise = undefined;\n      });\n      await session.navigationContextPromise;\n    }\n    if (isModuleApi && session.moduleCookies.size === 0) {\n      const previous = session.moduleBootstrapTail;\n      let release = (): void => {};\n      const current = new Promise<void>((resolve) => {\n        release = resolve;\n      });\n      session.moduleBootstrapTail = previous.catch(() => undefined).then(() => current);\n      await previous.catch(() => undefined);\n      try {\n        await this.#proxyAuthenticated(request, response, localUrl, session, true);\n      } finally {\n        release();\n      }\n      return;\n    }\n    await this.#proxyAuthenticated(request, response, localUrl, session, isModuleApi);\n  }\n\n  async #loadNavigationContext(session: ITokenSession): Promise<void> {\n    const upstream = await fetch(new URL('/api/navigation', this.#hostOrigin), {\n      headers: { Accept: 'application/json', Authorization: `Bearer ${session.accessToken}` },\n      redirect: 'manual',\n    }).catch(() => null);\n    if (!upstream?.ok || session.moduleNavigationContext) {\n      return;\n    }\n    session.moduleNavigationContext = navigationContextIn(await upstream.json().catch(() => null));\n  }\n\n  async #proxyAuthenticated(\n    request: IncomingMessage,\n    response: ServerResponse,\n    localUrl: URL,\n    session: ITokenSession,\n    isModuleApi: boolean,\n  ): Promise<void> {\n    const upstreamOrigin = isModuleApi ? this.#moduleApiOrigin : this.#hostOrigin;\n    const upstreamUrl = new URL(`${localUrl.pathname}${localUrl.search}`, upstreamOrigin);\n    const method = request.method ?? 'GET';\n    const init: RequestInit = {\n      headers: proxyHeaders(\n        request,\n        session.accessToken,\n        isModuleApi ? { cookies: session.moduleCookies, navigationContext: session.moduleNavigationContext } : undefined,\n      ),\n      method,\n      redirect: 'manual',\n    };\n    if (method !== 'GET' && method !== 'HEAD') {\n      // A fixed-length body: the web front ends of the deployed module servers answer chunked request bodies with 404.\n      const body = await requestBodyOf(request);\n      if (!body) {\n        writeJson(response, 413, { code: 'request_body_too_large', error: 'The request body exceeds the development proxy limit.' });\n        return;\n      }\n      init.body = body;\n    }\n    const upstream = await fetch(upstreamUrl, init);\n    let onChunk: ((chunk: Buffer) => void) | undefined;\n    if (isModuleApi) {\n      updateModuleCookies(session.moduleCookies, upstream.headers);\n    } else if (localUrl.pathname === '/api/navigation' && upstream.ok) {\n      session.moduleNavigationContext = navigationContextIn(\n        await upstream\n          .clone()\n          .json()\n          .catch(() => null),\n      );\n    } else if (localUrl.pathname === '/api/navigation/stream' && upstream.ok) {\n      onChunk = navigationEventReader((context) => {\n        session.moduleNavigationContext = context;\n      });\n    }\n    await copyProxyResponse(upstream, response, onChunk);\n  }\n\n  #prune(): void {\n    const now = Date.now();\n    for (const [id, flow] of this.#flows) {\n      if (flow.createdAt + FLOW_MAX_AGE_SECONDS * 1000 < now) {\n        this.#flows.delete(id);\n      }\n    }\n    for (const [id, flow] of this.#logoutFlows) {\n      if (flow.createdAt + FLOW_MAX_AGE_SECONDS * 1000 < now) {\n        this.#logoutFlows.delete(id);\n      }\n    }\n    for (const [id, session] of this.#sessions) {\n      if (!session.refreshToken && session.expiresAt + TOKEN_REFRESH_SKEW_MS < now) {\n        this.#sessions.delete(id);\n      }\n    }\n  }\n}\n\nexport const mfDevelopmentBffPlugin = (options: IMfDevelopmentBffPluginOptions): Plugin => {\n  const middleware = createMfDevelopmentBffMiddleware(options);\n  return {\n    apply: 'serve',\n    name: 'edynamix-mf-development-bff',\n    configureServer(server) {\n      server.middlewares.use((request, response, next) => {\n        middleware(request, response, next);\n      });\n    },\n    // Locally the module runs inside the host shell, so its page shows the host's icon. The module's own favicon is\n    // only copied into the build output, so this server has none to answer the browser's favicon request with.\n    transformIndexHtml(html) {\n      return {\n        html: html.replace(ICON_LINK_PATTERN, ''),\n        tags: [{ tag: 'link', attrs: { rel: 'icon', type: 'image/svg+xml', href: HOST_ICON_PATH }, injectTo: 'head' }],\n      };\n    },\n  };\n};\n\nexport type TMfDevelopmentBffMiddleware = (request: IncomingMessage, response: ServerResponse, next: (error?: unknown) => void) => void;\n\nexport const createMfDevelopmentBffMiddleware = (options: IMfDevelopmentBffPluginOptions): TMfDevelopmentBffMiddleware => {\n  const bff = new MfDevelopmentBff(options);\n  return (request, response, next) => {\n    void bff.handle(request, response, next);\n  };\n};\n"]}
+{"version":3,"file":"vite-development.js","sourceRoot":"","sources":["../src/vite-development.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAGrD,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,MAAM,cAAc,GAAG,yBAAyB,CAAC;AACjD,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAC5C,MAAM,aAAa,GAAG,yBAAyB,CAAC;AAChD,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,eAAe,GAAG,aAAa,CAAC;AACtC,MAAM,UAAU,GAAG,qBAAqB,CAAC;AACzC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AACnC,MAAM,CAAC,MAAM,mCAAmC,GAAG,mCAAmC,CAAC;AACvF,MAAM,cAAc,GAAG,iBAAiB,CAAC;AACzC,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC,CAAC;AACjF,MAAM,iBAAiB,GAAG,2DAA2D,CAAC;AACtF,MAAM,yBAAyB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAClD,MAAM,+BAA+B,GAAG,GAAG,GAAG,IAAI,CAAC;AACnD,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AAC5C,MAAM,8BAA8B,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AACxD,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,CAAC;AACrC,MAAM,qBAAqB,GAAG,MAAM,CAAC;AACrC,MAAM,4BAA4B,GAAG,MAAM,CAAC;AAC5C,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AAC7D,MAAM,wBAAwB,GAAG,6BAA6B,CAAC;AAC/D,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AACjE,MAAM,kBAAkB,GAAG,CAAC,uBAAuB,EAAE,wBAAwB,EAAE,yBAAyB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AAC5I,MAAM,0BAA0B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AACnD,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AACjD,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,mBAAmB,GAAG,gCAAgC,CAAC;AAC7D,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAC9C,MAAM,sBAAsB,GAAG;IAC7B,cAAc;IACd,iBAAiB;IACjB,8BAA8B;IAC9B,gCAAgC;IAChC,gCAAgC;CACxB,CAAC;AACX,sHAAsH;AACtH,wHAAwH;AACxH,2BAA2B;AAC3B,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAClD,MAAM,eAAe,GAAG,aAAa,CAAC;AAmEtC,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAE5I,MAAM,cAAc,GAAG,CAAC,KAA8B,EAAE,GAAW,EAAU,EAAE;IAC7E,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,4BAA4B,GAAG,GAAG,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CAAC,KAA8B,EAAE,GAAW,EAAiB,EAAE;IACpF,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,GAAG,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,SAAiB,EAAE,KAAa,EAAE,cAAc,GAAG,KAAK,EAAO,EAAE;IACzF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,2BAA2B,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,WAAW,GAAG,cAAc,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC;IACjI,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,8CAA8C,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAU,EAAE;IACpD,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,IAAI,GAAG,EAAE,EAAU,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjF,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAEhH,MAAM,SAAS,GAAG,CAAC,OAAwB,EAA+B,EAAE;IAC1E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YACnB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;YAClB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,MAAc,EAAU,EAAE,CAAC,GAAG,IAAI,IAAI,KAAK,qDAAqD,MAAM,EAAE,CAAC;AAEtJ,MAAM,WAAW,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAElE,oHAAoH;AACpH,6GAA6G;AAC7G,MAAM,eAAe,GAAG,CAAC,OAAsB,EAAU,EAAE,CACzD,OAAO,CAAC,YAAY;IAClB,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,8BAA8B,CAAC;IAClG,CAAC,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;AAElC,MAAM,kBAAkB,GAAG,CAAC,KAAyB,EAAiB,EAAE;IACtE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,SAAS,GAAG,CAAC,QAAwB,EAAE,MAAc,EAAE,IAAa,EAAQ,EAAE;IAClF,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,iCAAiC,CAAC,CAAC;IACtE,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,QAAQ,GAAG,CAAC,QAAwB,EAAE,QAAgB,EAAE,UAAoB,EAAE,EAAQ,EAAE;IAC5F,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;IAChD,QAAQ,CAAC,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IACD,QAAQ,CAAC,GAAG,EAAE,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,SAAwB,EAAU,EAAE;IACxD,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9D,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;QACvD,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,kBAAkB,GAAG,CAAC,KAAc,EAAE,cAAuB,EAAkB,EAAE;IACrF,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC;IACnC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,cAAc,IAAI,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IACtD,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO;QACL,WAAW,EAAE,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC;QAClD,SAAS;QACT,OAAO;QACP,YAAY,EAAE,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC;QACpD,SAAS;KACV,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,IAAY,EAAW,EAAE;IAC9C,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC;AAC5G,CAAC,CAAC;AAEF,qHAAqH;AACrH,0EAA0E;AAC1E,MAAM,eAAe,GAAG,CAAC,IAAY,EAAiB,EAAE,CACtD,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAE3I,wFAAwF;AACxF,MAAM,WAAW,GAAG,CAAC,KAAc,EAAiB,EAAE;IACpD,KAAK,MAAM,SAAS,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QAC3E,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC9D,OAAO,SAAS,CAAC,IAAI,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,OAAwB,EAAE,WAAmB,EAAE,MAA4B,EAAW,EAAE;IAC5G,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,IACE,CAAC,KAAK;YACN,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YACpB,CAAC,eAAe,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;YACtH,CAAC,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,EAClD,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,WAAW,EAAE,CAAC,CAAC;IACtD,IAAI,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,iBAAiB,GAAG,MAAM,EAAE,iBAAiB,CAAC;IACpD,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9E,IAAI,iBAAiB,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,KAAc,EAAmC,EAAE;IAC9E,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC;IAC/E,MAAM,SAAS,GAAc,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;IACvG,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC;QACrC,eAA0B,IAAI,CAAC;QAChC,SAAS,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAK,QAAmB,IAAI,CAAC,CAAC,EAC3F,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,SAAqB,EAAE,OAAO,EAAE,eAAyB,EAAE,CAAC;AAClF,CAAC,CAAC;AAEF,qHAAqH;AACrH,MAAM,qBAAqB,GAAG,CAAC,SAAsD,EAA6B,EAAE;IAClH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,OAAO,CAAC,KAAK,EAAE,EAAE;QACf,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,KAAK,IAAI,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACzG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;YAChD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBAChF,SAAS;YACX,CAAC;YACD,MAAM,IAAI,GAAG,KAAK;iBACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;iBAC1C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;iBAC9C,IAAI,CAAC,IAAI,CAAC,CAAC;YACd,IAAI,OAAO,GAAY,IAAI,CAAC;YAC5B,IAAI,CAAC;gBACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,OAAO,EAAE,CAAC;gBACZ,SAAS,CAAC,OAAO,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;YAChD,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,OAA4B,EAAE,OAAgB,EAAQ,EAAE;IACnF,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IACtC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,EAAE,GAAG,UAAU,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5G,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACjH,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,KAAK,EAAE,OAAwB,EAA0B,EAAE;IAC/E,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QAC7E,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC;QACtB,IAAI,IAAI,GAAG,sBAAsB,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,KAAK,EAAE,QAAkB,EAAE,QAAwB,EAAE,OAAiC,EAAiB,EAAE;IACjI,QAAQ,CAAC,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,YAAY,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC1H,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IACD,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,CAAC;IACzF,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,QAAQ,CAAC,GAAG,EAAE,CAAC;QACf,OAAO;IACT,CAAC;IACD,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAa,CAAC,CAAC;QAC1D,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,CAAC;QACD,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACjC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,KAAK,EAAE,QAAkB,EAAE,YAAoB,EAAE,KAAa,EAAmB,EAAE;IAC1G,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,YAAY,EAAE,CAAC;QACrE,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACzC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI,EAAE,CAAC;gBACT,MAAM;YACR,CAAC;YACD,UAAU,IAAI,KAAK,CAAC,UAAU,CAAC;YAC/B,IAAI,UAAU,GAAG,YAAY,EAAE,CAAC;gBAC9B,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,gBAAgB;IACX,iBAAiB,CAAM;IACvB,kBAAkB,CAAM;IACxB,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IACtC,WAAW,CAAM;IACjB,kBAAkB,CAAM;IACxB,KAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;IACjE,YAAY,GAAG,IAAI,GAAG,EAAuB,CAAC;IAC9C,gBAAgB,CAAM;IACtB,cAAc,CAAS;IAChC,qBAAqB,GAAG,KAAK,CAAC;IACrB,SAAS,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC7C,SAAS,GAAG,IAAI,GAAG,EAAyE,CAAC;IACtG,qBAAqB,GAA6C,IAAI,CAAC;IACvE,iBAAiB,GAAmC,IAAI,CAAC;IAEzD,YAAY,OAAuC;QACjD,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,EAAE,mBAAmB,EAAE,IAAI,CAAC,CAAC;QAC9F,IAAI,CAAC,kBAAkB,GAAG,cAAc,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,iBAAiB,GAAG,IAAI,GAAG,CAAC,8BAA8B,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACnF,IAAI,CAAC,kBAAkB,GAAG,gBAAgB,CAAC,OAAO,CAAC,iBAAiB,IAAI,wBAAwB,EAAE,mBAAmB,CAAC,CAAC;QACvH,IAAI,IAAI,CAAC,kBAAkB,CAAC,QAAQ,KAAK,GAAG,IAAI,IAAI,CAAC,kBAAkB,CAAC,MAAM,IAAI,IAAI,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;YAC/G,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,gBAAgB,GAAG,gBAAgB,CAAC,OAAO,CAAC,eAAe,EAAE,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAC3F,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,KAAK,GAAG,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACzG,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE,QAAwB,EAAE,IAA+B;QAC9F,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpC,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;QAEd,IAAI,CAAC;YACH,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,mCAAmC,EAAE,CAAC;gBACrF,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,CAAC;gBAChF,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC9E,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC/F,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,iBAAiB,EAAE,CAAC;gBACjF,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC5D,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBACrF,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC/D,MAAM,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC7C,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;gBACjE,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC7D,QAAQ,CAAC,QAAQ,EAAE,GAAG,UAAU,aAAa,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;gBAC3G,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,sBAAsB,EAAE,CAAC;gBACxE,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACzD,IAAI,SAAS,EAAE,CAAC;oBACd,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACnC,CAAC;gBACD,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;gBAC1B,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;gBAC7F,QAAQ,CAAC,GAAG,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;gBACrE,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YACD,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;gBAChF,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;gBAC1C,OAAO;YACT,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oCAAoC,CAAC;YAC9F,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,QAAwB,EAAE,WAAgB,EAAE,IAAwB;QAChG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YACxC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,eAAe,EAAE;YACpG,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,YAAY,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;QAC/D,MAAM,gBAAgB,GACpB,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,2CAA2C,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACnI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,oCAAoC,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,+BAA+B,CAAC;QACrG,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,YAAY,EAAE,mBAAmB,IAAI,EAAE,CAAC,CAAC;QACvF,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACxD,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,cAAc;QAClB,IAAI,CAAC,qBAAqB,KAAK,KAAK,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;aACzH,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;YACvB,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,mCAAmC,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,KAAK,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9G,OAAO,EAAE,QAAQ,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACxG,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;YAClC,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC,cAAc,EAAE;aAC7C,IAAI,CAAC,KAAK,EAAE,aAAa,EAAE,EAAE;YAC5B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,CAAC,MAAM,mCAAmC,EAAE;gBACvF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBACvC,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;YACjE,CAAC;YACD,MAAM,KAAK,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;YACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,uBAAuB,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxH,IAAI,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAU,EAAE;gBACvC,MAAM,GAAG,GAAG,gBAAgB,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,QAAQ,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;gBAC9E,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;oBAC1C,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,yCAAyC,CAAC,CAAC;gBACxE,CAAC;gBACD,OAAO,GAAG,CAAC,IAAI,CAAC;YAClB,CAAC,CAAC;YACF,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;YAChE,OAAO;gBACL,qBAAqB,EAAE,QAAQ,CAAC,wBAAwB,CAAC;gBACzD,kBAAkB,EAAE,QAAQ,CAAC,sBAAsB,CAAC;gBACpD,MAAM;gBACN,OAAO,EAAE,QAAQ,CAAC,UAAU,CAAC;gBAC7B,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI;gBACvE,aAAa,EAAE,QAAQ,CAAC,gBAAgB,CAAC;aAC1C,CAAC;QACJ,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;YACf,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;YAC9B,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE,QAAwB,EAAE,QAAgB;QAC/E,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC/C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;gBACjG,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;gBACvD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;gBAC/D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC9G,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC7C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC7D,CAAC;gBACD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAc,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC;QAClH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAE9B,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QAC1D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QACnD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC/D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,CAAC;QAChG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC;QACxD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,eAAe,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC3D,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAwB,EAAE,QAAwB,EAAE,GAAQ;QAC1E,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1D,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1D,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,gDAAgD,EAAE,CAAC,CAAC;YAClH,OAAO;QACT,CAAC;QACD,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpD,IAAI,aAAa,EAAE,CAAC;YAClB,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,uBAAuB,EAAE,CAAC,CAAC;YAC/H,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,0DAA0D,EAAE,CAAC,CAAC;YACpI,OAAO;QACT,CAAC;QAED,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,aAAa,CAAC,QAAQ;YACjC,IAAI;YACJ,aAAa,EAAE,IAAI,CAAC,YAAY;YAChC,UAAU,EAAE,oBAAoB;YAChC,YAAY,EAAE,IAAI,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI;SACnE,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE;YACzD,IAAI,EAAE,MAAM;YACZ,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAC5F,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,aAAa,CAAC,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,+BAA+B,aAAa,CAAC,MAAM,IAAI,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,kBAAkB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;YAC9C,QAAQ,EAAE,aAAa,CAAC,QAAQ;YAChC,MAAM,EAAE,SAAS,CAAC,MAAM;YACxB,cAAc,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;SACjC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,CAAC;QAED,MAAM,SAAS,GAAG,SAAS,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAkB;YAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI;YAC/C,OAAO;YACP,mBAAmB,EAAE,OAAO,CAAC,OAAO,EAAE;YACtC,aAAa,EAAE,IAAI,GAAG,EAAE;YACxB,uBAAuB,EAAE,IAAI;YAC7B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;YAChC,MAAM,CAAC,cAAc,EAAE,SAAS,EAAE,uBAAuB,CAAC;YAC1D,eAAe,CAAC,OAAO,CAAC;YACxB,WAAW,CAAC,WAAW,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAwB,EAAE,QAAwB;QAC9D,MAAM,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;QAC9F,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE;YAC/B,WAAW,CAAC,cAAc,CAAC;YAC3B,WAAW,CAAC,cAAc,CAAC;YAC3B,MAAM,CAAC,aAAa,EAAE,QAAQ,EAAE,oBAAoB,CAAC;SACtD,CAAC,CAAC;QACH,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAsB;QAClC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,kBAAkB,GAAG,SAAS,CAAC,kBAAkB,CAAC;QACxD,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,KAAa,EAAE,IAAY,EAAiB,EAAE;YAClE,MAAM,KAAK,CAAC,kBAAkB,EAAE;gBAC9B,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,QAAQ,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;gBAC9F,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,MAAM,EAAE,MAAM;gBACd,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;QACL,CAAC,CAAC;QACF,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC;YAC3C,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE;SACzF,CAAC,CAAC;IACL,CAAC;IAED,oHAAoH;IACpH,mHAAmH;IACnH,4GAA4G;IAC5G,KAAK,CAAC,YAAY,CAAC,OAAwB,EAAE,QAAwB;QACnE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC3D,QAAQ,CAAC,QAAQ,EAAE,GAAG,UAAU,eAAe,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,UAAU,GAAG,GAAG,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,cAAc,EAAE,0BAA0B,CAAC,CAAC;QAC/D,QAAQ,CAAC,GAAG,CACV,yGAAyG;YACvG,6EAA6E;YAC7E,wEAAwE;YACxE,gHAAgH;YAChH,6EAA6E;YAC7E,eAAe,UAAU,kFAAkF;YAC3G,gBAAgB,CACnB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,OAAwB,EAAE,QAAwB;QAC5E,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC1F,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,EAAE,CAAC;YAC3D,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC7D,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,cAAc,CAAC;YAC7B,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,CAAC;YACD,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,mHAAmH;IACnH,+GAA+G;IAC/G,oHAAoH;IACpH,yEAAyE;IACzE,KAAK,CAAC,gBAAgB,CAAC,YAA2B,EAAE,QAAwB;QAC1E,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;YACtC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YAC1C,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC,eAAe,EAAE,EAAE;gBACpC,IAAI,CAAC,eAAe,EAAE,CAAC;oBACrB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;oBACpC,OAAO;gBACT,CAAC;gBACD,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,4BAA4B,CAAC,CAAC,KAAK,EAAE,CAAC;YAC9F,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC;QAC/B,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,OAAO,EAAE,CAAC;YAC7E,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,QAAQ,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC,EAAE,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC3I,OAAO,QAAQ,CAAC,OAAO,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,YAAoB;QACjC,MAAM,OAAO,GAAkB;YAC7B,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI;YACb,mBAAmB,EAAE,OAAO,CAAC,OAAO,EAAE;YACtC,aAAa,EAAE,IAAI,GAAG,EAAE;YACxB,uBAAuB,EAAE,IAAI;YAC7B,YAAY;SACb,CAAC;QACF,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAsB;QACnC,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;QAC1C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,aAAa,EAAE;YACpD,IAAI,EAAE,IAAI,eAAe,CAAC;gBACxB,SAAS,EAAE,aAAa,CAAC,QAAQ;gBACjC,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;aAC5B,CAAC;YACF,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAC5F,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;QAChE,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QACzC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC;QACzD,OAAO,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;QACnE,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC;IACtD,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAwB,EAAE,QAAwB,EAAE,QAAa;QAC5E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,+GAA+G;YAC/G,2EAA2E;YAC3E,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YACtF,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACtE,MAAM,WAAW,GAAG,CAAC,WAAW,IAAI,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;QAChF,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACrE,8GAA8G;YAC9G,gHAAgH;YAChH,OAAO,CAAC,wBAAwB,KAAK,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;gBACrF,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC;YAC/C,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,CAAC,wBAAwB,CAAC;QACzC,CAAC;QACD,IAAI,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,QAAQ,GAAG,OAAO,CAAC,mBAAmB,CAAC;YAC7C,IAAI,OAAO,GAAG,GAAS,EAAE,GAAE,CAAC,CAAC;YAC7B,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC5C,OAAO,GAAG,OAAO,CAAC;YACpB,CAAC,CAAC,CAAC;YACH,OAAO,CAAC,mBAAmB,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC;YAClF,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC7E,CAAC;oBAAS,CAAC;gBACT,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,OAAO;QACT,CAAC;QACD,MAAM,IAAI,CAAC,mBAAmB,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,OAAsB;QACjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE;YACzE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE;YACvF,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACrD,OAAO;QACT,CAAC;QACD,OAAO,CAAC,uBAAuB,GAAG,mBAAmB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IACjG,CAAC;IAED,KAAK,CAAC,mBAAmB,CACvB,OAAwB,EACxB,QAAwB,EACxB,QAAa,EACb,OAAsB,EACtB,WAAoB;QAEpB,MAAM,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9E,MAAM,cAAc,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;QAC9E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,GAAG,aAAa,IAAI,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC;QACvG,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;QACvC,2GAA2G;QAC3G,MAAM,aAAa,GAAG,WAAW;YAC/B,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,aAAa,EAAE,iBAAiB,EAAE,OAAO,CAAC,uBAAuB,EAAE;YACxF,CAAC,CAAC,aAAa;gBACb,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,GAAG,EAAkB,EAAE,iBAAiB,EAAE,OAAO,CAAC,uBAAuB,EAAE;gBAC5F,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,IAAI,GAAgB;YACxB,OAAO,EAAE,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,EAAE,aAAa,CAAC;YAClE,MAAM;YACN,QAAQ,EAAE,QAAQ;SACnB,CAAC;QACF,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1C,iHAAiH;YACjH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,uDAAuD,EAAE,CAAC,CAAC;gBAC7H,OAAO;YACT,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACnB,CAAC;QACD,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,KAAK,CAAC;YACd,CAAC;YACD,IAAI,CAAC,2BAA2B,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAClD,OAAO;QACT,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,qBAAqB,GAAG,KAAK,CAAC;QACrC,CAAC;QACD,IAAI,OAA8C,CAAC;QACnD,IAAI,WAAW,EAAE,CAAC;YAChB,mBAAmB,CAAC,OAAO,CAAC,aAAa,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/D,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,iBAAiB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClE,OAAO,CAAC,uBAAuB,GAAG,mBAAmB,CACnD,MAAM,QAAQ;iBACX,KAAK,EAAE;iBACP,IAAI,EAAE;iBACN,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CACrB,CAAC;QACJ,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,wBAAwB,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACzE,OAAO,GAAG,qBAAqB,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC1C,OAAO,CAAC,uBAAuB,GAAG,OAAO,CAAC;YAC5C,CAAC,CAAC,CAAC;QACL,CAAC;QACD,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,qHAAqH;IACrH,8FAA8F;IAC9F,2BAA2B,CAAC,QAAwB,EAAE,KAAc;QAClE,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAC5F,MAAM,OAAO,GACX,qCAAqC,IAAI,CAAC,gBAAgB,CAAC,MAAM,wBAAwB,MAAM,KAAK;YACpG,yEAAyE,CAAC;QAC5E,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAChC,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,MAAM;QACJ,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,SAAS,GAAG,oBAAoB,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;gBACvD,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3C,IAAI,IAAI,CAAC,SAAS,GAAG,oBAAoB,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;gBACvD,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3C,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,SAAS,GAAG,qBAAqB,GAAG,GAAG,EAAE,CAAC;gBAC7E,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,OAAuC,EAAU,EAAE;IACxF,MAAM,UAAU,GAAG,gCAAgC,CAAC,OAAO,CAAC,CAAC;IAC7D,OAAO;QACL,KAAK,EAAE,OAAO;QACd,IAAI,EAAE,6BAA6B;QACnC,eAAe,CAAC,MAAM;YACpB,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;gBACjD,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC,CAAC,CAAC;QACL,CAAC;QACD,gHAAgH;QAChH,2GAA2G;QAC3G,kBAAkB,CAAC,IAAI;YACrB,OAAO;gBACL,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,EAAE,CAAC;gBACzC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;aAC/G,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,OAAuC,EAA+B,EAAE;IACvH,MAAM,GAAG,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE;QACjC,KAAK,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC,CAAC;AACJ,CAAC,CAAC","sourcesContent":["import { createHash, randomBytes } from 'node:crypto';\nimport type { IncomingMessage, ServerResponse } from 'node:http';\nimport { Readable } from 'node:stream';\nimport { createRemoteJWKSet, jwtVerify } from 'jose';\nimport type { Plugin } from 'vite';\n\nconst SESSION_COOKIE = '__Host-edyn_dev_session';\nconst REFRESH_COOKIE = '__Host-edyn_dev_refresh';\nconst FLOW_COOKIE = '__Host-edyn_oidc_flow';\nconst LOGOUT_COOKIE = '__Host-edyn_oidc_logout';\nconst CALLBACK_PATH = '/callback';\nconst LOGGED_OUT_PATH = '/logged-out';\nconst LOGIN_PATH = '/api/dev-auth/login';\nconst LEGACY_LOGIN_PATH = '/login';\nexport const MF_DEVELOPMENT_HOST_NAVIGATION_PATH = '/api/dev-host-navigation/index.js';\nconst HOST_ICON_PATH = '/exsto-icon.svg';\nconst HOST_NAVIGATION_ASSET_PATHS = new Set([HOST_ICON_PATH, '/exsto-text.svg']);\nconst ICON_LINK_PATTERN = /<link\\b[^>]*\\brel=[\"'](?:shortcut\\s+)?icon[\"'][^>]*>\\s*/gi;\nconst MAX_HOST_NAVIGATION_BYTES = 5 * 1024 * 1024;\nconst MAX_HOST_NAVIGATION_ASSET_BYTES = 512 * 1024;\nconst SESSION_MAX_AGE_SECONDS = 8 * 60 * 60;\nconst REFRESH_COOKIE_MAX_AGE_SECONDS = 7 * 24 * 60 * 60;\nconst FLOW_MAX_AGE_SECONDS = 10 * 60;\nconst TOKEN_REFRESH_SKEW_MS = 30_000;\nconst SPENT_REFRESH_TOKEN_REUSE_MS = 30_000;\nconst NAVIGATION_GROUP_HEADER = 'X-Edyn-Navigation-Group-Id';\nconst NAVIGATION_DEALER_HEADER = 'X-Edyn-Navigation-Dealer-Id';\nconst NAVIGATION_DEALERS_HEADER = 'X-Edyn-Navigation-Dealer-Ids';\nconst NAVIGATION_HEADERS = [NAVIGATION_GROUP_HEADER, NAVIGATION_DEALER_HEADER, NAVIGATION_DEALERS_HEADER].map((name) => name.toLowerCase());\nconst MAX_NAVIGATION_EVENT_BYTES = 5 * 1024 * 1024;\nconst MAX_REQUEST_BODY_BYTES = 100 * 1024 * 1024;\nconst EVENT_SEPARATOR = /\\r?\\n\\r?\\n/;\nconst COOKIE_NAME_PATTERN = /^[!#$%&'*+\\-.^_`|~0-9A-Za-z]+$/;\nconst COOKIE_VALUE_PATTERN = /^[\\x20-\\x7e]*$/;\nconst ALLOWED_HOST_API_PATHS = [\n  '/api/auth/me',\n  '/api/navigation',\n  '/api/navigation/access-check',\n  '/api/navigation/access-request',\n  '/api/navigation/counter-stream',\n] as const;\n// The standalone navigation reads the portal menus under the host's /api/navigation/portal, which only a host running\n// in development relays to the portal. Every host also serves the portal API itself at /portal/api, a deployed one too,\n// so those calls go there.\nconst PORTAL_MENU_PATH = '/api/navigation/portal';\nconst PORTAL_API_PATH = '/portal/api';\n\ninterface IOidcClientConfiguration {\n  clientId: string;\n  issuer: string;\n  scope: string;\n}\n\ninterface IOidcDiscovery {\n  authorizationEndpoint: string;\n  endSessionEndpoint: string;\n  issuer: string;\n  jwksUri: string;\n  revocationEndpoint: string | null;\n  tokenEndpoint: string;\n}\n\ninterface IOidcFlow {\n  codeVerifier: string;\n  createdAt: number;\n  nonce: string;\n  returnTo: string;\n  state: string;\n}\n\ninterface IModuleNavigationContext {\n  dealerIds: readonly number[];\n  groupId: number;\n}\n\ninterface IModuleProxyContext {\n  cookies: Map<string, string>;\n  navigationContext: IModuleNavigationContext | null;\n}\n\ninterface ITokenSession {\n  accessToken: string;\n  expiresAt: number;\n  idToken: string | null;\n  moduleBootstrapTail: Promise<void>;\n  moduleCookies: Map<string, string>;\n  moduleNavigationContext: IModuleNavigationContext | null;\n  navigationContextPromise?: Promise<void>;\n  refreshPromise?: Promise<void>;\n  refreshToken: string | null;\n}\n\ninterface ILogoutFlow {\n  createdAt: number;\n  idToken: string | null;\n}\n\ninterface ITokenResponse {\n  accessToken: string;\n  expiresIn: number;\n  idToken: string | null;\n  refreshToken: string | null;\n  tokenType: string;\n}\n\nexport interface IMfDevelopmentBffPluginOptions {\n  developmentOrigin?: string;\n  hostNavigationUrl: string;\n  moduleApiOrigin: string;\n  moduleApiPath: string;\n}\n\nconst isRecord = (value: unknown): value is Record<string, unknown> => typeof value === 'object' && value !== null && !Array.isArray(value);\n\nconst requiredString = (value: Record<string, unknown>, key: string): string => {\n  const candidate = value[key];\n  if (typeof candidate !== 'string' || candidate.trim() === '') {\n    throw new Error(`OIDC response is missing ${key}.`);\n  }\n  return candidate;\n};\n\nconst optionalString = (value: Record<string, unknown>, key: string): string | null => {\n  const candidate = value[key];\n  if (candidate === undefined || candidate === null) {\n    return null;\n  }\n  if (typeof candidate !== 'string' || candidate.trim() === '') {\n    throw new Error(`OIDC response contains an invalid ${key}.`);\n  }\n  return candidate;\n};\n\nconst absoluteHttpsUrl = (candidate: string, label: string, allowLocalHttp = false): URL => {\n  let url: URL;\n  try {\n    url = new URL(candidate);\n  } catch {\n    throw new Error(`${label} must be an absolute URL.`);\n  }\n  const isLocalHttp = allowLocalHttp && url.protocol === 'http:' && (url.hostname === 'localhost' || url.hostname === '127.0.0.1');\n  if (url.protocol !== 'https:' && !isLocalHttp) {\n    throw new Error(`${label} must use HTTPS.`);\n  }\n  if (url.username || url.password || url.hash) {\n    throw new Error(`${label} must not contain credentials or a fragment.`);\n  }\n  return url;\n};\n\nconst moduleApiPrefix = (candidate: string): string => {\n  if (!/^\\/[a-z][a-z0-9-]*\\/api\\/$/.test(candidate)) {\n    throw new Error('moduleApiPath must use the canonical /module/api/ boundary.');\n  }\n  return candidate;\n};\n\nconst base64Url = (size = 32): string => randomBytes(size).toString('base64url');\nconst codeChallengeOf = (verifier: string): string => createHash('sha256').update(verifier).digest('base64url');\n\nconst cookiesOf = (request: IncomingMessage): ReadonlyMap<string, string> => {\n  const cookies = new Map<string, string>();\n  for (const part of (request.headers.cookie ?? '').split(';')) {\n    const separator = part.indexOf('=');\n    if (separator <= 0) {\n      continue;\n    }\n    const name = part.slice(0, separator).trim();\n    const value = part.slice(separator + 1).trim();\n    if (name && value) {\n      cookies.set(name, value);\n    }\n  }\n  return cookies;\n};\n\nconst cookie = (name: string, value: string, maxAge: number): string => `${name}=${value}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge}`;\n\nconst clearCookie = (name: string): string => cookie(name, '', 0);\n\n// The refresh token stays in an HttpOnly cookie for this origin, which every module's development server shares, so\n// one sign-in survives restarts and module switches until the token expires; page scripts can never read it.\nconst refreshCookieOf = (session: ITokenSession): string =>\n  session.refreshToken\n    ? cookie(REFRESH_COOKIE, encodeURIComponent(session.refreshToken), REFRESH_COOKIE_MAX_AGE_SECONDS)\n    : clearCookie(REFRESH_COOKIE);\n\nconst decodedCookieValue = (value: string | undefined): string | null => {\n  if (!value) {\n    return null;\n  }\n  try {\n    return decodeURIComponent(value);\n  } catch {\n    return null;\n  }\n};\n\nconst writeJson = (response: ServerResponse, status: number, body: unknown): void => {\n  response.statusCode = status;\n  response.setHeader('Cache-Control', 'no-store');\n  response.setHeader('Content-Type', 'application/json; charset=utf-8');\n  response.end(JSON.stringify(body));\n};\n\nconst redirect = (response: ServerResponse, location: string, cookies: string[] = []): void => {\n  response.statusCode = 302;\n  response.setHeader('Cache-Control', 'no-store');\n  response.setHeader('Location', location);\n  if (cookies.length > 0) {\n    response.setHeader('Set-Cookie', cookies);\n  }\n  response.end();\n};\n\nconst safeReturnTo = (candidate: string | null): string => {\n  if (!candidate?.startsWith('/') || candidate.startsWith('//')) {\n    return '/';\n  }\n  try {\n    const parsed = new URL(candidate, 'https://localhost');\n    return `${parsed.pathname}${parsed.search}${parsed.hash}`;\n  } catch {\n    return '/';\n  }\n};\n\nconst parseTokenResponse = (value: unknown, requireIdToken: boolean): ITokenResponse => {\n  if (!isRecord(value)) {\n    throw new Error('OIDC token endpoint returned an invalid response.');\n  }\n  const expiresIn = value.expires_in;\n  if (typeof expiresIn !== 'number' || !Number.isFinite(expiresIn) || expiresIn <= 0) {\n    throw new Error('OIDC token endpoint returned an invalid expires_in value.');\n  }\n  const idToken = optionalString(value, 'id_token');\n  if (requireIdToken && !idToken) {\n    throw new Error('OIDC token endpoint did not return an ID token.');\n  }\n  const tokenType = requiredString(value, 'token_type');\n  if (tokenType.toLowerCase() !== 'bearer') {\n    throw new Error('OIDC token endpoint returned an unsupported token type.');\n  }\n  return {\n    accessToken: requiredString(value, 'access_token'),\n    expiresIn,\n    idToken,\n    refreshToken: optionalString(value, 'refresh_token'),\n    tokenType,\n  };\n};\n\nconst pathIsHostApi = (path: string): boolean => {\n  return ALLOWED_HOST_API_PATHS.some((candidate) => path === candidate || path.startsWith(`${candidate}/`));\n};\n\n// The host validates a selection the browser sends it, so host requests keep the navigation headers. A module trusts\n// them, so its requests carry only the selection the host last confirmed.\nconst portalApiPathOf = (path: string): string | null =>\n  path === PORTAL_MENU_PATH || path.startsWith(`${PORTAL_MENU_PATH}/`) ? `${PORTAL_API_PATH}${path.slice(PORTAL_MENU_PATH.length)}` : null;\n\n// Node reports the reason on the error's cause (ECONNREFUSED), Bun on the error itself.\nconst errorCodeOf = (error: unknown): string | null => {\n  for (const candidate of [isRecord(error) ? error.cause : undefined, error]) {\n    if (isRecord(candidate) && typeof candidate.code === 'string') {\n      return candidate.code;\n    }\n  }\n  return null;\n};\n\nconst proxyHeaders = (request: IncomingMessage, accessToken: string, module?: IModuleProxyContext): Headers => {\n  const headers = new Headers();\n  for (const [name, value] of Object.entries(request.headers)) {\n    const lowerName = name.toLowerCase();\n    if (\n      !value ||\n      name.startsWith(':') ||\n      ['authorization', 'connection', 'content-length', 'cookie', 'host', 'origin', 'transfer-encoding'].includes(lowerName) ||\n      (module && NAVIGATION_HEADERS.includes(lowerName))\n    ) {\n      continue;\n    }\n    if (Array.isArray(value)) {\n      for (const item of value) {\n        headers.append(name, item);\n      }\n    } else {\n      headers.set(name, value);\n    }\n  }\n  headers.set('Authorization', `Bearer ${accessToken}`);\n  if (module?.cookies.size) {\n    headers.set('Cookie', [...module.cookies.values()].join('; '));\n  }\n  const navigationContext = module?.navigationContext;\n  if (navigationContext) {\n    headers.set(NAVIGATION_GROUP_HEADER, String(navigationContext.groupId));\n    headers.set(NAVIGATION_DEALERS_HEADER, navigationContext.dealerIds.join(','));\n    if (navigationContext.dealerIds.length === 1) {\n      headers.set(NAVIGATION_DEALER_HEADER, String(navigationContext.dealerIds[0]));\n    }\n  }\n  return headers;\n};\n\nconst navigationContextIn = (value: unknown): IModuleNavigationContext | null => {\n  if (!isRecord(value) || !isRecord(value.context)) {\n    return null;\n  }\n  const { selectedDealerId, selectedDealerIds, selectedGroupId } = value.context;\n  const dealerIds: unknown[] = Array.isArray(selectedDealerIds) ? selectedDealerIds : [selectedDealerId];\n  if (\n    !Number.isSafeInteger(selectedGroupId) ||\n    (selectedGroupId as number) <= 0 ||\n    dealerIds.length === 0 ||\n    !dealerIds.every((dealerId) => Number.isSafeInteger(dealerId) && (dealerId as number) >= 0)\n  ) {\n    return null;\n  }\n  return { dealerIds: dealerIds as number[], groupId: selectedGroupId as number };\n};\n\n// Reads the selection each `navigation` event of the host's navigation stream confirms, chunk by chunk as it passes.\nconst navigationEventReader = (onContext: (context: IModuleNavigationContext) => void): ((chunk: Buffer) => void) => {\n  const decoder = new TextDecoder();\n  let pending = '';\n  return (chunk) => {\n    pending += decoder.decode(chunk, { stream: true });\n    for (let separator = EVENT_SEPARATOR.exec(pending); separator; separator = EVENT_SEPARATOR.exec(pending)) {\n      const block = pending.slice(0, separator.index);\n      pending = pending.slice(separator.index + separator[0].length);\n      const lines = block.split(/\\r?\\n/);\n      if (!lines.includes('event: navigation') && !lines.includes('event:navigation')) {\n        continue;\n      }\n      const data = lines\n        .filter((line) => line.startsWith('data:'))\n        .map((line) => line.slice(5).replace(/^ /, ''))\n        .join('\\n');\n      let payload: unknown = null;\n      try {\n        payload = JSON.parse(data);\n      } catch {\n        continue;\n      }\n      const context = navigationContextIn(payload);\n      if (context) {\n        onContext(context);\n      }\n    }\n    if (pending.length > MAX_NAVIGATION_EVENT_BYTES) {\n      pending = '';\n    }\n  };\n};\n\nconst updateModuleCookies = (cookies: Map<string, string>, headers: Headers): void => {\n  const values = headers.getSetCookie();\n  for (const value of values) {\n    if (value.length > 4096) {\n      continue;\n    }\n    const [pair, ...attributes] = value.split(';');\n    const separator = pair?.indexOf('=') ?? -1;\n    if (!pair || separator <= 0) {\n      continue;\n    }\n    const name = pair.slice(0, separator).trim();\n    const cookieValue = pair.slice(separator + 1).trim();\n    if (!COOKIE_NAME_PATTERN.test(name) || !COOKIE_VALUE_PATTERN.test(cookieValue) || cookieValue.includes(';')) {\n      continue;\n    }\n    const deleted = cookieValue === '' || attributes.some((attribute) => /^\\s*max-age\\s*=\\s*0\\s*$/i.test(attribute));\n    if (deleted) {\n      cookies.delete(name);\n      continue;\n    }\n    if (!cookies.has(name) && cookies.size >= 32) {\n      continue;\n    }\n    cookies.set(name, `${name}=${cookieValue}`);\n  }\n};\n\nconst requestBodyOf = async (request: IncomingMessage): Promise<Buffer | null> => {\n  const chunks: Buffer[] = [];\n  let size = 0;\n  for await (const chunk of request) {\n    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk as string);\n    size += buffer.length;\n    if (size > MAX_REQUEST_BODY_BYTES) {\n      return null;\n    }\n    chunks.push(buffer);\n  }\n  return Buffer.concat(chunks);\n};\n\nconst copyProxyResponse = async (upstream: Response, response: ServerResponse, onChunk?: (chunk: Buffer) => void): Promise<void> => {\n  response.statusCode = upstream.status;\n  for (const [name, value] of upstream.headers) {\n    if (!['connection', 'content-encoding', 'content-length', 'set-cookie', 'transfer-encoding'].includes(name.toLowerCase())) {\n      response.setHeader(name, value);\n    }\n  }\n  response.setHeader('Cache-Control', upstream.headers.get('cache-control') ?? 'no-store');\n  if (!upstream.body) {\n    response.end();\n    return;\n  }\n  await new Promise<void>((resolve, reject) => {\n    const readable = Readable.fromWeb(upstream.body as never);\n    if (onChunk) {\n      readable.on('data', onChunk);\n    }\n    readable.once('error', reject);\n    response.once('error', reject);\n    response.once('finish', resolve);\n    readable.pipe(response);\n  });\n};\n\nconst readResponseBody = async (response: Response, maximumBytes: number, label: string): Promise<Buffer> => {\n  const declaredLength = Number(response.headers.get('content-length'));\n  if (Number.isFinite(declaredLength) && declaredLength > maximumBytes) {\n    await response.body?.cancel();\n    throw new Error(`${label} exceeded the configured size limit.`);\n  }\n  if (!response.body) {\n    return Buffer.alloc(0);\n  }\n\n  const reader = response.body.getReader();\n  const chunks: Uint8Array[] = [];\n  let totalBytes = 0;\n  try {\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) {\n        break;\n      }\n      totalBytes += value.byteLength;\n      if (totalBytes > maximumBytes) {\n        await reader.cancel();\n        throw new Error(`${label} exceeded the configured size limit.`);\n      }\n      chunks.push(value);\n    }\n  } finally {\n    reader.releaseLock();\n  }\n  return Buffer.concat(chunks, totalBytes);\n};\n\nclass MfDevelopmentBff {\n  readonly #configurationUrl: URL;\n  readonly #developmentOrigin: URL;\n  readonly #flows = new Map<string, IOidcFlow>();\n  readonly #hostOrigin: URL;\n  readonly #hostNavigationUrl: URL;\n  readonly #jwks = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n  readonly #logoutFlows = new Map<string, ILogoutFlow>();\n  readonly #moduleApiOrigin: URL;\n  readonly #moduleApiPath: string;\n  #moduleApiUnreachable = false;\n  readonly #sessions = new Map<string, ITokenSession>();\n  readonly #restores = new Map<string, Promise<{ session: ITokenSession; sessionId: string } | null>>();\n  #configurationPromise: Promise<IOidcClientConfiguration> | null = null;\n  #discoveryPromise: Promise<IOidcDiscovery> | null = null;\n\n  constructor(options: IMfDevelopmentBffPluginOptions) {\n    const hostNavigation = absoluteHttpsUrl(options.hostNavigationUrl, 'hostNavigationUrl', true);\n    this.#hostNavigationUrl = hostNavigation;\n    this.#hostOrigin = new URL(hostNavigation.origin);\n    this.#configurationUrl = new URL('/api/auth/oidc-configuration', this.#hostOrigin);\n    this.#developmentOrigin = absoluteHttpsUrl(options.developmentOrigin ?? 'https://localhost:4200', 'developmentOrigin');\n    if (this.#developmentOrigin.pathname !== '/' || this.#developmentOrigin.search || this.#developmentOrigin.hash) {\n      throw new Error('developmentOrigin must be an origin without a path, query, or fragment.');\n    }\n    this.#moduleApiOrigin = absoluteHttpsUrl(options.moduleApiOrigin, 'moduleApiOrigin', true);\n    if (this.#moduleApiOrigin.pathname !== '/' || this.#moduleApiOrigin.search || this.#moduleApiOrigin.hash) {\n      throw new Error('moduleApiOrigin must be an origin without a path, query, or fragment.');\n    }\n    this.#moduleApiPath = moduleApiPrefix(options.moduleApiPath);\n  }\n\n  async handle(request: IncomingMessage, response: ServerResponse, next: (error?: unknown) => void): Promise<void> {\n    if (!request.url || !request.method) {\n      next();\n      return;\n    }\n    const url = new URL(request.url, this.#developmentOrigin);\n    this.#prune();\n\n    try {\n      if (request.method === 'GET' && url.pathname === MF_DEVELOPMENT_HOST_NAVIGATION_PATH) {\n        await this.#hostNavigationResource(response, this.#hostNavigationUrl, 'script');\n        return;\n      }\n      if (request.method === 'GET' && HOST_NAVIGATION_ASSET_PATHS.has(url.pathname)) {\n        await this.#hostNavigationResource(response, new URL(url.pathname, this.#hostOrigin), 'asset');\n        return;\n      }\n      if (request.method === 'GET' && url.pathname.toLowerCase() === LEGACY_LOGIN_PATH) {\n        await this.#legacyLogin(request, response);\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === LOGIN_PATH) {\n        await this.#login(request, response, safeReturnTo(url.searchParams.get('returnTo')));\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === CALLBACK_PATH) {\n        await this.#callback(request, response, url);\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === LOGGED_OUT_PATH) {\n        const returnTo = safeReturnTo(url.searchParams.get('state'));\n        redirect(response, `${LOGIN_PATH}?returnTo=${encodeURIComponent(returnTo)}`, [clearCookie(LOGOUT_COOKIE)]);\n        return;\n      }\n      if (request.method === 'GET' && url.pathname === '/frontchannel-logout') {\n        const sessionId = cookiesOf(request).get(SESSION_COOKIE);\n        if (sessionId) {\n          this.#sessions.delete(sessionId);\n        }\n        response.statusCode = 204;\n        response.setHeader('Set-Cookie', [clearCookie(SESSION_COOKIE), clearCookie(REFRESH_COOKIE)]);\n        response.end();\n        return;\n      }\n      if (request.method === 'POST' && url.pathname === '/api/auth/logout') {\n        await this.#logout(request, response);\n        return;\n      }\n      if (pathIsHostApi(url.pathname) || url.pathname.startsWith(this.#moduleApiPath)) {\n        await this.#proxy(request, response, url);\n        return;\n      }\n      next();\n    } catch (error) {\n      const message = error instanceof Error ? error.message : 'Development authentication failed.';\n      writeJson(response, 502, { code: 'development_authentication_failed', error: message });\n    }\n  }\n\n  async #hostNavigationResource(response: ServerResponse, upstreamUrl: URL, kind: 'asset' | 'script'): Promise<void> {\n    const upstream = await fetch(upstreamUrl, {\n      headers: { Accept: kind === 'script' ? 'text/javascript, application/javascript' : 'image/svg+xml' },\n      redirect: 'error',\n    });\n    if (!upstream.ok) {\n      throw new Error(`Host navigation ${kind} failed (${upstream.status}).`);\n    }\n    const contentType = upstream.headers.get('content-type') ?? '';\n    const validContentType =\n      kind === 'script' ? /^(?:text|application)\\/javascript(?:;|$)/i.test(contentType) : /^image\\/svg\\+xml(?:;|$)/i.test(contentType);\n    if (!validContentType) {\n      throw new Error(`Host navigation ${kind} returned an invalid content type.`);\n    }\n    const maximumBytes = kind === 'script' ? MAX_HOST_NAVIGATION_BYTES : MAX_HOST_NAVIGATION_ASSET_BYTES;\n    const body = await readResponseBody(upstream, maximumBytes, `Host navigation ${kind}`);\n    response.statusCode = 200;\n    response.setHeader('Cache-Control', 'no-store');\n    response.setHeader('Content-Type', contentType);\n    response.setHeader('X-Content-Type-Options', 'nosniff');\n    response.end(body);\n  }\n\n  async #configuration(): Promise<IOidcClientConfiguration> {\n    this.#configurationPromise ??= fetch(this.#configurationUrl, { headers: { Accept: 'application/json' }, redirect: 'error' })\n      .then(async (response) => {\n        if (!response.ok) {\n          throw new Error(`Host OIDC configuration failed (${response.status}).`);\n        }\n        const value: unknown = await response.json();\n        if (!isRecord(value)) {\n          throw new Error('Host OIDC configuration returned an invalid response.');\n        }\n        const issuer = absoluteHttpsUrl(requiredString(value, 'issuer'), 'OIDC issuer', true).href.replace(/\\/$/, '');\n        return { clientId: requiredString(value, 'clientId'), issuer, scope: requiredString(value, 'scope') };\n      })\n      .catch((error) => {\n        this.#configurationPromise = null;\n        throw error;\n      });\n    return this.#configurationPromise;\n  }\n\n  async #discovery(): Promise<IOidcDiscovery> {\n    this.#discoveryPromise ??= this.#configuration()\n      .then(async (configuration) => {\n        const response = await fetch(`${configuration.issuer}/.well-known/openid-configuration`, {\n          headers: { Accept: 'application/json' },\n          redirect: 'error',\n        });\n        if (!response.ok) {\n          throw new Error(`OIDC discovery failed (${response.status}).`);\n        }\n        const value: unknown = await response.json();\n        if (!isRecord(value)) {\n          throw new Error('OIDC discovery returned an invalid response.');\n        }\n        const issuer = absoluteHttpsUrl(requiredString(value, 'issuer'), 'OIDC discovery issuer', true).href.replace(/\\/$/, '');\n        if (issuer !== configuration.issuer) {\n          throw new Error('OIDC discovery issuer does not match the host configuration.');\n        }\n        const endpoint = (key: string): string => {\n          const url = absoluteHttpsUrl(requiredString(value, key), `OIDC ${key}`, true);\n          if (url.origin !== new URL(issuer).origin) {\n            throw new Error(`OIDC ${key} must use the configured issuer origin.`);\n          }\n          return url.href;\n        };\n        const revocation = optionalString(value, 'revocation_endpoint');\n        return {\n          authorizationEndpoint: endpoint('authorization_endpoint'),\n          endSessionEndpoint: endpoint('end_session_endpoint'),\n          issuer,\n          jwksUri: endpoint('jwks_uri'),\n          revocationEndpoint: revocation ? endpoint('revocation_endpoint') : null,\n          tokenEndpoint: endpoint('token_endpoint'),\n        };\n      })\n      .catch((error) => {\n        this.#discoveryPromise = null;\n        throw error;\n      });\n    return this.#discoveryPromise;\n  }\n\n  async #login(request: IncomingMessage, response: ServerResponse, returnTo: string): Promise<void> {\n    const logoutId = cookiesOf(request).get(LOGOUT_COOKIE);\n    if (logoutId) {\n      const logout = this.#logoutFlows.get(logoutId);\n      this.#logoutFlows.delete(logoutId);\n      if (logout) {\n        const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n        const endpoint = new URL(discovery.endSessionEndpoint);\n        endpoint.searchParams.set('client_id', configuration.clientId);\n        endpoint.searchParams.set('post_logout_redirect_uri', new URL(LOGGED_OUT_PATH, this.#developmentOrigin).href);\n        endpoint.searchParams.set('state', returnTo);\n        if (logout.idToken) {\n          endpoint.searchParams.set('id_token_hint', logout.idToken);\n        }\n        redirect(response, endpoint.href, [clearCookie(LOGOUT_COOKIE)]);\n        return;\n      }\n    }\n\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const flowId = base64Url();\n    const codeVerifier = base64Url(48);\n    const flow: IOidcFlow = { codeVerifier, createdAt: Date.now(), nonce: base64Url(), returnTo, state: base64Url() };\n    this.#flows.set(flowId, flow);\n\n    const endpoint = new URL(discovery.authorizationEndpoint);\n    endpoint.searchParams.set('response_type', 'code');\n    endpoint.searchParams.set('client_id', configuration.clientId);\n    endpoint.searchParams.set('redirect_uri', new URL(CALLBACK_PATH, this.#developmentOrigin).href);\n    endpoint.searchParams.set('scope', configuration.scope);\n    endpoint.searchParams.set('state', flow.state);\n    endpoint.searchParams.set('nonce', flow.nonce);\n    endpoint.searchParams.set('code_challenge', codeChallengeOf(codeVerifier));\n    endpoint.searchParams.set('code_challenge_method', 'S256');\n    redirect(response, endpoint.href, [cookie(FLOW_COOKIE, flowId, FLOW_MAX_AGE_SECONDS)]);\n  }\n\n  async #callback(request: IncomingMessage, response: ServerResponse, url: URL): Promise<void> {\n    const flowId = cookiesOf(request).get(FLOW_COOKIE);\n    const flow = flowId ? this.#flows.get(flowId) : undefined;\n    if (flowId) {\n      this.#flows.delete(flowId);\n    }\n    if (!flow || url.searchParams.get('state') !== flow.state) {\n      writeJson(response, 400, { code: 'invalid_oidc_state', error: 'The OIDC callback state is invalid or expired.' });\n      return;\n    }\n    const providerError = url.searchParams.get('error');\n    if (providerError) {\n      writeJson(response, 401, { code: providerError, error: url.searchParams.get('error_description') ?? 'Sign-in was rejected.' });\n      return;\n    }\n    const code = url.searchParams.get('code');\n    if (!code) {\n      writeJson(response, 400, { code: 'missing_authorization_code', error: 'The OIDC callback did not include an authorization code.' });\n      return;\n    }\n\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const fields = new URLSearchParams({\n      client_id: configuration.clientId,\n      code,\n      code_verifier: flow.codeVerifier,\n      grant_type: 'authorization_code',\n      redirect_uri: new URL(CALLBACK_PATH, this.#developmentOrigin).href,\n    });\n    const tokenResponse = await fetch(discovery.tokenEndpoint, {\n      body: fields,\n      headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },\n      method: 'POST',\n      redirect: 'error',\n    });\n    if (!tokenResponse.ok) {\n      throw new Error(`OIDC token exchange failed (${tokenResponse.status}).`);\n    }\n    const tokens = parseTokenResponse(await tokenResponse.json(), true);\n    const idToken = tokens.idToken;\n    if (!idToken) {\n      throw new Error('OIDC token endpoint did not return an ID token.');\n    }\n    const jwks = this.#jwks.get(discovery.jwksUri) ?? createRemoteJWKSet(new URL(discovery.jwksUri));\n    this.#jwks.set(discovery.jwksUri, jwks);\n    const verified = await jwtVerify(idToken, jwks, {\n      audience: configuration.clientId,\n      issuer: discovery.issuer,\n      requiredClaims: ['sub', 'nonce'],\n    });\n    if (verified.payload.nonce !== flow.nonce) {\n      throw new Error('OIDC ID token nonce does not match the authorization request.');\n    }\n\n    const sessionId = base64Url();\n    const session: ITokenSession = {\n      accessToken: tokens.accessToken,\n      expiresAt: Date.now() + tokens.expiresIn * 1000,\n      idToken,\n      moduleBootstrapTail: Promise.resolve(),\n      moduleCookies: new Map(),\n      moduleNavigationContext: null,\n      refreshToken: tokens.refreshToken,\n    };\n    this.#sessions.set(sessionId, session);\n    redirect(response, flow.returnTo, [\n      cookie(SESSION_COOKIE, sessionId, SESSION_MAX_AGE_SECONDS),\n      refreshCookieOf(session),\n      clearCookie(FLOW_COOKIE),\n    ]);\n  }\n\n  async #logout(request: IncomingMessage, response: ServerResponse): Promise<void> {\n    const sessionId = cookiesOf(request).get(SESSION_COOKIE);\n    const session = sessionId ? this.#sessions.get(sessionId) : undefined;\n    if (sessionId) {\n      this.#sessions.delete(sessionId);\n    }\n    if (session) {\n      void this.#revoke(session).catch(() => undefined);\n    }\n    const logoutId = base64Url();\n    this.#logoutFlows.set(logoutId, { createdAt: Date.now(), idToken: session?.idToken ?? null });\n    response.setHeader('Set-Cookie', [\n      clearCookie(SESSION_COOKIE),\n      clearCookie(REFRESH_COOKIE),\n      cookie(LOGOUT_COOKIE, logoutId, FLOW_MAX_AGE_SECONDS),\n    ]);\n    writeJson(response, 200, { loggedOut: true });\n  }\n\n  async #revoke(session: ITokenSession): Promise<void> {\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const revocationEndpoint = discovery.revocationEndpoint;\n    if (!revocationEndpoint) {\n      return;\n    }\n    const revoke = async (token: string, hint: string): Promise<void> => {\n      await fetch(revocationEndpoint, {\n        body: new URLSearchParams({ client_id: configuration.clientId, token, token_type_hint: hint }),\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        method: 'POST',\n        redirect: 'error',\n      });\n    };\n    await Promise.all([\n      revoke(session.accessToken, 'access_token'),\n      session.refreshToken ? revoke(session.refreshToken, 'refresh_token') : Promise.resolve(),\n    ]);\n  }\n\n  // Standalone modules send the browser to their legacy /login page when an API call answers 401, and locally no such\n  // page exists: serving the module again would repeat the 401 in a reload loop. Signed out, this is the development\n  // sign-in; signed in, the module API itself refused the session, so the page says so and redirects nowhere.\n  async #legacyLogin(request: IncomingMessage, response: ServerResponse): Promise<void> {\n    if (!(await this.#authenticatedSession(request, response))) {\n      redirect(response, `${LOGIN_PATH}?returnTo=%2F`);\n      return;\n    }\n    response.statusCode = 401;\n    response.setHeader('Cache-Control', 'no-store');\n    response.setHeader('Content-Type', 'text/html; charset=utf-8');\n    response.end(\n      '<!doctype html><html lang=\"en\"><head><meta charset=\"utf-8\"><title>Module sign-in refused</title></head>' +\n        '<body style=\"font-family:system-ui,sans-serif;margin:3rem;line-height:1.5\">' +\n        '<h1 style=\"font-size:1.25rem\">The module API refused your session</h1>' +\n        '<p>You are signed in, but a module API request answered 401 and the module asked for its legacy sign-in page. ' +\n        'Check the module backend (MODULE_API_ORIGIN) and its dev server output.</p>' +\n        `<p><a href=\"${LOGIN_PATH}?returnTo=%2F\">Sign in again</a> &middot; <a href=\"/\">Back to the module</a></p>` +\n        '</body></html>',\n    );\n  }\n\n  async #authenticatedSession(request: IncomingMessage, response: ServerResponse): Promise<ITokenSession | null> {\n    const cookies = cookiesOf(request);\n    const sessionId = cookies.get(SESSION_COOKIE);\n    const session = sessionId ? this.#sessions.get(sessionId) : undefined;\n    if (!session) {\n      return this.#restoredSession(decodedCookieValue(cookies.get(REFRESH_COOKIE)), response);\n    }\n    if (session.expiresAt > Date.now() + TOKEN_REFRESH_SKEW_MS) {\n      return session;\n    }\n    if (!session.refreshToken) {\n      if (sessionId) {\n        this.#sessions.delete(sessionId);\n      }\n      return null;\n    }\n    session.refreshPromise ??= this.#refresh(session).finally(() => {\n      session.refreshPromise = undefined;\n    });\n    try {\n      await session.refreshPromise;\n      response.setHeader('Set-Cookie', refreshCookieOf(session));\n      return session;\n    } catch {\n      if (sessionId) {\n        this.#sessions.delete(sessionId);\n      }\n      response.setHeader('Set-Cookie', clearCookie(REFRESH_COOKIE));\n      return null;\n    }\n  }\n\n  // Starts a session from the browser's refresh cookie after this server restarted or another module's server signed\n  // the developer in. Parallel requests carrying the same token share one refresh, and so, for a short while, do\n  // requests the browser sent before the rotated cookie reached it: the sign-in service accepts a refresh token once,\n  // so spending it again would fail and clear the cookie that replaced it.\n  async #restoredSession(refreshToken: string | null, response: ServerResponse): Promise<ITokenSession | null> {\n    if (!refreshToken) {\n      return null;\n    }\n    let restore = this.#restores.get(refreshToken);\n    if (!restore) {\n      restore = this.#restore(refreshToken);\n      this.#restores.set(refreshToken, restore);\n      void restore.then((restoredSession) => {\n        if (!restoredSession) {\n          this.#restores.delete(refreshToken);\n          return;\n        }\n        setTimeout(() => this.#restores.delete(refreshToken), SPENT_REFRESH_TOKEN_REUSE_MS).unref();\n      });\n    }\n    const restored = await restore;\n    if (!restored || this.#sessions.get(restored.sessionId) !== restored.session) {\n      response.setHeader('Set-Cookie', clearCookie(REFRESH_COOKIE));\n      return null;\n    }\n    response.setHeader('Set-Cookie', [cookie(SESSION_COOKIE, restored.sessionId, SESSION_MAX_AGE_SECONDS), refreshCookieOf(restored.session)]);\n    return restored.session;\n  }\n\n  async #restore(refreshToken: string): Promise<{ session: ITokenSession; sessionId: string } | null> {\n    const session: ITokenSession = {\n      accessToken: '',\n      expiresAt: 0,\n      idToken: null,\n      moduleBootstrapTail: Promise.resolve(),\n      moduleCookies: new Map(),\n      moduleNavigationContext: null,\n      refreshToken,\n    };\n    try {\n      await this.#refresh(session);\n    } catch {\n      return null;\n    }\n    const sessionId = base64Url();\n    this.#sessions.set(sessionId, session);\n    return { session, sessionId };\n  }\n\n  async #refresh(session: ITokenSession): Promise<void> {\n    const refreshToken = session.refreshToken;\n    if (!refreshToken) {\n      throw new Error('OIDC refresh token is unavailable.');\n    }\n    const [configuration, discovery] = await Promise.all([this.#configuration(), this.#discovery()]);\n    const response = await fetch(discovery.tokenEndpoint, {\n      body: new URLSearchParams({\n        client_id: configuration.clientId,\n        grant_type: 'refresh_token',\n        refresh_token: refreshToken,\n      }),\n      headers: { Accept: 'application/json', 'Content-Type': 'application/x-www-form-urlencoded' },\n      method: 'POST',\n      redirect: 'error',\n    });\n    if (!response.ok) {\n      throw new Error(`OIDC refresh failed (${response.status}).`);\n    }\n    const tokens = parseTokenResponse(await response.json(), false);\n    session.accessToken = tokens.accessToken;\n    session.expiresAt = Date.now() + tokens.expiresIn * 1000;\n    session.refreshToken = tokens.refreshToken ?? session.refreshToken;\n    session.idToken = tokens.idToken ?? session.idToken;\n  }\n\n  async #proxy(request: IncomingMessage, response: ServerResponse, localUrl: URL): Promise<void> {\n    const session = await this.#authenticatedSession(request, response);\n    if (!session) {\n      // This server refreshes the session's tokens itself, so the browser can only sign in again. A refreshable code\n      // would send the host client to a refresh endpoint that only the host has.\n      writeJson(response, 401, { code: 'sign_in_required', error: 'Sign in is required.' });\n      return;\n    }\n    const isModuleApi = localUrl.pathname.startsWith(this.#moduleApiPath);\n    const isPortalApi = !isModuleApi && portalApiPathOf(localUrl.pathname) !== null;\n    if ((isModuleApi || isPortalApi) && !session.moduleNavigationContext) {\n      // The host mounts a module only once the selection is known, so its first API calls already carry it. Locally\n      // the module starts beside the navigation, so its first calls can arrive first: ask the host before forwarding.\n      session.navigationContextPromise ??= this.#loadNavigationContext(session).finally(() => {\n        session.navigationContextPromise = undefined;\n      });\n      await session.navigationContextPromise;\n    }\n    if (isModuleApi && session.moduleCookies.size === 0) {\n      const previous = session.moduleBootstrapTail;\n      let release = (): void => {};\n      const current = new Promise<void>((resolve) => {\n        release = resolve;\n      });\n      session.moduleBootstrapTail = previous.catch(() => undefined).then(() => current);\n      await previous.catch(() => undefined);\n      try {\n        await this.#proxyAuthenticated(request, response, localUrl, session, true);\n      } finally {\n        release();\n      }\n      return;\n    }\n    await this.#proxyAuthenticated(request, response, localUrl, session, isModuleApi);\n  }\n\n  async #loadNavigationContext(session: ITokenSession): Promise<void> {\n    const upstream = await fetch(new URL('/api/navigation', this.#hostOrigin), {\n      headers: { Accept: 'application/json', Authorization: `Bearer ${session.accessToken}` },\n      redirect: 'manual',\n    }).catch(() => null);\n    if (!upstream?.ok || session.moduleNavigationContext) {\n      return;\n    }\n    session.moduleNavigationContext = navigationContextIn(await upstream.json().catch(() => null));\n  }\n\n  async #proxyAuthenticated(\n    request: IncomingMessage,\n    response: ServerResponse,\n    localUrl: URL,\n    session: ITokenSession,\n    isModuleApi: boolean,\n  ): Promise<void> {\n    const portalApiPath = isModuleApi ? null : portalApiPathOf(localUrl.pathname);\n    const upstreamOrigin = isModuleApi ? this.#moduleApiOrigin : this.#hostOrigin;\n    const upstreamUrl = new URL(`${portalApiPath ?? localUrl.pathname}${localUrl.search}`, upstreamOrigin);\n    const method = request.method ?? 'GET';\n    // The portal is a module too: it gets the selection the host confirmed, and no module session of this one.\n    const moduleContext = isModuleApi\n      ? { cookies: session.moduleCookies, navigationContext: session.moduleNavigationContext }\n      : portalApiPath\n        ? { cookies: new Map<string, string>(), navigationContext: session.moduleNavigationContext }\n        : undefined;\n    const init: RequestInit = {\n      headers: proxyHeaders(request, session.accessToken, moduleContext),\n      method,\n      redirect: 'manual',\n    };\n    if (method !== 'GET' && method !== 'HEAD') {\n      // A fixed-length body: the web front ends of the deployed module servers answer chunked request bodies with 404.\n      const body = await requestBodyOf(request);\n      if (!body) {\n        writeJson(response, 413, { code: 'request_body_too_large', error: 'The request body exceeds the development proxy limit.' });\n        return;\n      }\n      init.body = body;\n    }\n    let upstream: Response;\n    try {\n      upstream = await fetch(upstreamUrl, init);\n    } catch (error) {\n      if (!isModuleApi) {\n        throw error;\n      }\n      this.#answerModuleApiUnreachable(response, error);\n      return;\n    }\n    if (isModuleApi) {\n      this.#moduleApiUnreachable = false;\n    }\n    let onChunk: ((chunk: Buffer) => void) | undefined;\n    if (isModuleApi) {\n      updateModuleCookies(session.moduleCookies, upstream.headers);\n    } else if (localUrl.pathname === '/api/navigation' && upstream.ok) {\n      session.moduleNavigationContext = navigationContextIn(\n        await upstream\n          .clone()\n          .json()\n          .catch(() => null),\n      );\n    } else if (localUrl.pathname === '/api/navigation/stream' && upstream.ok) {\n      onChunk = navigationEventReader((context) => {\n        session.moduleNavigationContext = context;\n      });\n    }\n    await copyProxyResponse(upstream, response, onChunk);\n  }\n\n  // Without this, a module server that is not running shows only as the catch-all's development_authentication_failed.\n  // The terminal says it once per outage; every refused call answers with the same explanation.\n  #answerModuleApiUnreachable(response: ServerResponse, error: unknown): void {\n    const reason = errorCodeOf(error) ?? (error instanceof Error ? error.message : 'no answer');\n    const message =\n      `Cannot reach the module server at ${this.#moduleApiOrigin.origin} (MODULE_API_ORIGIN, ${reason}). ` +\n      \"Start the module's server, or point MODULE_API_ORIGIN at one that runs.\";\n    if (!this.#moduleApiUnreachable) {\n      this.#moduleApiUnreachable = true;\n      console.warn(`[mf-isolation] ${message}`);\n    }\n    writeJson(response, 502, { code: 'module_api_unreachable', error: message });\n  }\n\n  #prune(): void {\n    const now = Date.now();\n    for (const [id, flow] of this.#flows) {\n      if (flow.createdAt + FLOW_MAX_AGE_SECONDS * 1000 < now) {\n        this.#flows.delete(id);\n      }\n    }\n    for (const [id, flow] of this.#logoutFlows) {\n      if (flow.createdAt + FLOW_MAX_AGE_SECONDS * 1000 < now) {\n        this.#logoutFlows.delete(id);\n      }\n    }\n    for (const [id, session] of this.#sessions) {\n      if (!session.refreshToken && session.expiresAt + TOKEN_REFRESH_SKEW_MS < now) {\n        this.#sessions.delete(id);\n      }\n    }\n  }\n}\n\nexport const mfDevelopmentBffPlugin = (options: IMfDevelopmentBffPluginOptions): Plugin => {\n  const middleware = createMfDevelopmentBffMiddleware(options);\n  return {\n    apply: 'serve',\n    name: 'edynamix-mf-development-bff',\n    configureServer(server) {\n      server.middlewares.use((request, response, next) => {\n        middleware(request, response, next);\n      });\n    },\n    // Locally the module runs inside the host shell, so its page shows the host's icon. The module's own favicon is\n    // only copied into the build output, so this server has none to answer the browser's favicon request with.\n    transformIndexHtml(html) {\n      return {\n        html: html.replace(ICON_LINK_PATTERN, ''),\n        tags: [{ tag: 'link', attrs: { rel: 'icon', type: 'image/svg+xml', href: HOST_ICON_PATH }, injectTo: 'head' }],\n      };\n    },\n  };\n};\n\nexport type TMfDevelopmentBffMiddleware = (request: IncomingMessage, response: ServerResponse, next: (error?: unknown) => void) => void;\n\nexport const createMfDevelopmentBffMiddleware = (options: IMfDevelopmentBffPluginOptions): TMfDevelopmentBffMiddleware => {\n  const bff = new MfDevelopmentBff(options);\n  return (request, response, next) => {\n    void bff.handle(request, response, next);\n  };\n};\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edynamix/mf-isolation",
-  "version": "0.0.33",
+  "version": "0.0.35",
   "description": "CSS and overlay isolation helpers for eDynamix microfrontends.",
   "license": "UNLICENSED",
   "type": "module",