@executor-js/emulate 0.6.0 → 0.7.0

package/dist/dist-IYZPDKJW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../@emulators/workos/src/store.ts","../../@emulators/core/src/store.ts","../../@emulators/core/src/http.ts","../../@emulators/core/src/webhooks.ts","../../@emulators/core/src/middleware/error-handler.ts","../../@emulators/core/src/middleware/auth.ts","../../@emulators/core/src/debug.ts","../../@emulators/core/src/fonts.ts","../../@emulators/core/src/ledger.ts","../../@emulators/core/src/manifest.ts","../../@emulators/core/src/ui.ts","../../@emulators/core/src/control-plane.ts","../../@emulators/core/src/server.ts","../../@emulators/core/src/service-host.ts","../../@emulators/core/src/middleware/pagination.ts","../../@emulators/core/src/oauth-helpers.ts","../../@emulators/core/src/persistence.ts","../../@emulators/workos/src/keys.ts","../../@emulators/workos/src/helpers.ts","../../@emulators/workos/src/routes/user-management.ts","../../@emulators/workos/src/routes/organizations.ts","../../@emulators/workos/src/routes/api-keys.ts","../../@emulators/workos/src/routes/vault.ts","../../@emulators/workos/src/routes/oauth.ts","../../@emulators/workos/src/manifest.ts","../../@emulators/workos/src/index.ts"],"sourcesContent":["import { Store, type Collection } from \"@emulators/core\";\n\nimport type {\n  WorkosApiKey,\n  WorkosAuthCode,\n  WorkosInvitation,\n  WorkosMembership,\n  WorkosOAuthClient,\n  WorkosOAuthCode,\n  WorkosOrganization,\n  WorkosSession,\n  WorkosUser,\n  WorkosVaultObject,\n} from \"./entities.js\";\n\nexport interface WorkosStore {\n  users: Collection<WorkosUser>;\n  organizations: Collection<WorkosOrganization>;\n  memberships: Collection<WorkosMembership>;\n  invitations: Collection<WorkosInvitation>;\n  apiKeys: Collection<WorkosApiKey>;\n  authCodes: Collection<WorkosAuthCode>;\n  sessions: Collection<WorkosSession>;\n  vaultObjects: Collection<WorkosVaultObject>;\n  oauthClients: Collection<WorkosOAuthClient>;\n  oauthCodes: Collection<WorkosOAuthCode>;\n}\n\nexport function getWorkosStore(store: Store): WorkosStore {\n  return {\n    users: store.collection<WorkosUser>(\"workos.users\", [\"workos_id\", \"email\"]),\n    organizations: store.collection<WorkosOrganization>(\"workos.organizations\", [\"workos_id\"]),\n    memberships: store.collection<WorkosMembership>(\"workos.memberships\", [\n      \"workos_id\",\n      \"user_id\",\n      \"organization_id\",\n    ]),\n    invitations: store.collection<WorkosInvitation>(\"workos.invitations\", [\n      \"workos_id\",\n      \"email\",\n      \"organization_id\",\n      \"token\",\n    ]),\n    apiKeys: store.collection<WorkosApiKey>(\"workos.api_keys\", [\"workos_id\", \"value\", \"user_id\"]),\n    authCodes: store.collection<WorkosAuthCode>(\"workos.auth_codes\", [\"code\"]),\n    sessions: store.collection<WorkosSession>(\"workos.sessions\", [\"refresh_token\", \"workos_id\"]),\n    vaultObjects: store.collection<WorkosVaultObject>(\"workos.vault_objects\", [\n      \"workos_id\",\n      \"name\",\n    ]),\n    oauthClients: store.collection<WorkosOAuthClient>(\"workos.oauth_clients\", [\"client_id\"]),\n    oauthCodes: store.collection<WorkosOAuthCode>(\"workos.oauth_codes\", [\"code\"]),\n  };\n}\n","export interface Entity {\n  id: number;\n  created_at: string;\n  updated_at: string;\n}\n\nexport type InsertInput<T extends Entity> = Omit<T, \"id\" | \"created_at\" | \"updated_at\"> & { id?: number };\n\nexport type FilterFn<T> = (item: T) => boolean;\nexport type SortFn<T> = (a: T, b: T) => number;\n\nexport interface QueryOptions<T> {\n  filter?: FilterFn<T>;\n  sort?: SortFn<T>;\n  page?: number;\n  per_page?: number;\n}\n\nexport interface PaginatedResult<T> {\n  items: T[];\n  total_count: number;\n  page: number;\n  per_page: number;\n  has_next: boolean;\n  has_prev: boolean;\n}\n\nexport interface CollectionSnapshot<T extends Entity = Entity> {\n  items: T[];\n  autoId: number;\n  indexFields: string[];\n}\n\nexport interface StoreSnapshot {\n  collections: Record<string, CollectionSnapshot>;\n  data: Record<string, unknown>;\n}\n\nexport function serializeValue(value: unknown): unknown {\n  if (value instanceof Map) {\n    return { __type: \"Map\" as const, entries: [...value.entries()].map(([k, v]) => [k, serializeValue(v)]) };\n  }\n  if (value instanceof Set) {\n    return { __type: \"Set\" as const, values: [...value.values()] };\n  }\n  return value;\n}\n\nexport function deserializeValue(value: unknown): unknown {\n  if (value !== null && typeof value === \"object\" && \"__type\" in value) {\n    const tagged = value as Record<string, unknown>;\n    if (tagged.__type === \"Map\") {\n      const entries = tagged.entries as [unknown, unknown][];\n      return new Map(entries.map(([k, v]) => [k, deserializeValue(v)]));\n    }\n    if (tagged.__type === \"Set\") {\n      return new Set(tagged.values as unknown[]);\n    }\n  }\n  return value;\n}\n\nexport class Collection<T extends Entity> {\n  private items = new Map<number, T>();\n  private indexes = new Map<string, Map<string | number, Set<number>>>();\n  private autoId = 1;\n  readonly fieldNames: string[];\n\n  constructor(private indexFields: (keyof T)[] = []) {\n    this.fieldNames = indexFields.map(String).sort();\n    for (const field of indexFields) {\n      this.indexes.set(String(field), new Map());\n    }\n  }\n\n  private addToIndex(item: T): void {\n    for (const field of this.indexFields) {\n      const value = item[field];\n      if (value === undefined || value === null) continue;\n      const indexMap = this.indexes.get(String(field))!;\n      const key = String(value);\n      if (!indexMap.has(key)) {\n        indexMap.set(key, new Set());\n      }\n      indexMap.get(key)!.add(item.id);\n    }\n  }\n\n  private removeFromIndex(item: T): void {\n    for (const field of this.indexFields) {\n      const value = item[field];\n      if (value === undefined || value === null) continue;\n      const indexMap = this.indexes.get(String(field))!;\n      const key = String(value);\n      indexMap.get(key)?.delete(item.id);\n    }\n  }\n\n  insert(data: InsertInput<T>): T {\n    const now = new Date().toISOString();\n    const explicitId = data.id != null && data.id > 0 ? data.id : undefined;\n    const id = explicitId ?? this.autoId++;\n    if (id >= this.autoId) {\n      this.autoId = id + 1;\n    }\n    const item = {\n      ...data,\n      id,\n      created_at: now,\n      updated_at: now,\n    } as unknown as T;\n    this.items.set(id, item);\n    this.addToIndex(item);\n    return item;\n  }\n\n  get(id: number): T | undefined {\n    return this.items.get(id);\n  }\n\n  findBy(field: keyof T, value: T[keyof T] | string | number): T[] {\n    if (this.indexes.has(String(field))) {\n      const ids = this.indexes.get(String(field))!.get(String(value));\n      if (!ids) return [];\n      return Array.from(ids)\n        .map((id) => this.items.get(id)!)\n        .filter(Boolean);\n    }\n    return this.all().filter((item) => item[field] === value);\n  }\n\n  findOneBy(field: keyof T, value: T[keyof T] | string | number): T | undefined {\n    return this.findBy(field, value)[0];\n  }\n\n  update(id: number, data: Partial<T>): T | undefined {\n    const existing = this.items.get(id);\n    if (!existing) return undefined;\n    this.removeFromIndex(existing);\n    const updated = {\n      ...existing,\n      ...data,\n      id,\n      updated_at: new Date().toISOString(),\n    } as T;\n    this.items.set(id, updated);\n    this.addToIndex(updated);\n    return updated;\n  }\n\n  delete(id: number): boolean {\n    const existing = this.items.get(id);\n    if (!existing) return false;\n    this.removeFromIndex(existing);\n    return this.items.delete(id);\n  }\n\n  all(): T[] {\n    return Array.from(this.items.values());\n  }\n\n  query(options: QueryOptions<T> = {}): PaginatedResult<T> {\n    let results = this.all();\n\n    if (options.filter) {\n      results = results.filter(options.filter);\n    }\n\n    const total_count = results.length;\n\n    if (options.sort) {\n      results.sort(options.sort);\n    }\n\n    const page = options.page ?? 1;\n    const per_page = Math.min(options.per_page ?? 30, 100);\n    const start = (page - 1) * per_page;\n    const paged = results.slice(start, start + per_page);\n\n    return {\n      items: paged,\n      total_count,\n      page,\n      per_page,\n      has_next: start + per_page < total_count,\n      has_prev: page > 1,\n    };\n  }\n\n  count(filter?: FilterFn<T>): number {\n    if (!filter) return this.items.size;\n    return this.all().filter(filter).length;\n  }\n\n  clear(): void {\n    this.items.clear();\n    for (const indexMap of this.indexes.values()) {\n      indexMap.clear();\n    }\n    this.autoId = 1;\n  }\n\n  snapshot(): CollectionSnapshot<T> {\n    return {\n      items: this.all(),\n      autoId: this.autoId,\n      indexFields: this.fieldNames,\n    };\n  }\n\n  restore(snap: CollectionSnapshot<T>): void {\n    this.clear();\n    this.autoId = snap.autoId;\n    for (const item of snap.items) {\n      this.items.set(item.id, item);\n      this.addToIndex(item);\n    }\n  }\n}\n\nexport class Store {\n  private collections = new Map<string, Collection<any>>();\n  private _data = new Map<string, unknown>();\n\n  collection<T extends Entity>(name: string, indexFields: (keyof T)[] = []): Collection<T> {\n    const existing = this.collections.get(name);\n    if (existing) {\n      if (indexFields.length > 0) {\n        const requested = indexFields.map(String).sort();\n        if (existing.fieldNames.length !== requested.length || existing.fieldNames.some((f, i) => f !== requested[i])) {\n          throw new Error(\n            `Collection \"${name}\" already exists with indexes [${existing.fieldNames}] but was requested with [${requested}]`,\n          );\n        }\n      }\n      return existing as Collection<T>;\n    }\n    const col = new Collection<T>(indexFields);\n    this.collections.set(name, col);\n    return col;\n  }\n\n  getData<V>(key: string): V | undefined {\n    return this._data.get(key) as V | undefined;\n  }\n\n  setData<V>(key: string, value: V): void {\n    this._data.set(key, value);\n  }\n\n  reset(): void {\n    for (const collection of this.collections.values()) {\n      collection.clear();\n    }\n    this._data.clear();\n  }\n\n  snapshot(): StoreSnapshot {\n    const collections: Record<string, CollectionSnapshot> = {};\n    for (const [name, col] of this.collections) {\n      collections[name] = col.snapshot();\n    }\n    const data: Record<string, unknown> = {};\n    for (const [key, value] of this._data) {\n      data[key] = serializeValue(value);\n    }\n    return { collections, data };\n  }\n\n  restore(snap: StoreSnapshot): void {\n    const snapshotNames = new Set(Object.keys(snap.collections));\n    for (const name of this.collections.keys()) {\n      if (!snapshotNames.has(name)) {\n        this.collections.delete(name);\n      }\n    }\n    for (const [name, colSnap] of Object.entries(snap.collections)) {\n      const indexFields = colSnap.indexFields as (keyof Entity)[];\n      const col = this.collection(name, indexFields);\n      col.restore(colSnap as CollectionSnapshot<any>);\n    }\n    this._data.clear();\n    for (const [key, value] of Object.entries(snap.data)) {\n      this._data.set(key, deserializeValue(value));\n    }\n  }\n}\n","import { createServer as createNodeServer, type IncomingMessage, type Server, type ServerResponse } from \"node:http\";\n\ntype BodyInit = ConstructorParameters<typeof Response>[0];\ntype HeadersInit = ConstructorParameters<typeof Headers>[0];\ntype FormDataEntryValue = string | File;\n\nexport type ContentfulStatusCode = number;\nexport type Next = () => Promise<Response | void>;\n\ntype VariablesOf<E> = unknown extends E\n  ? Record<string, any>\n  : E extends { Variables: infer V }\n    ? V\n    : Record<string, any>;\ntype HandlerResult = Response | void | Promise<Response | void>;\n\nexport type Handler<E = unknown, P extends string = string> = (c: Context<E, P>, next: Next) => HandlerResult;\nexport type MiddlewareHandler<E = unknown> = Handler<E>;\nexport type ErrorHandler<E = unknown> = (err: unknown, c: Context<E>) => Response | Promise<Response>;\nexport type FetchHandler = (request: Request) => Response | Promise<Response>;\n\ninterface CompiledPath {\n  pattern: string;\n  regex: RegExp;\n  paramNames: string[];\n}\n\ninterface Route<E> {\n  method: string;\n  compiled: CompiledPath;\n  handlers: Handler<E>[];\n}\n\ninterface MatchedHandler<E> {\n  handler: Handler<E>;\n  params: Record<string, string>;\n}\n\nexport interface ServeOptions {\n  fetch: FetchHandler;\n  port?: number;\n  hostname?: string;\n}\n\nexport interface CorsOptions {\n  origin?: string;\n  allowMethods?: string[];\n  allowHeaders?: string[];\n  credentials?: boolean;\n  maxAge?: number;\n}\n\nexport class HonoRequest {\n  readonly raw: Request;\n  readonly url: string;\n  readonly method: string;\n  readonly path: string;\n  /** The matched route pattern (e.g. /repos/:owner/:repo), when a route matched. */\n  readonly routePath?: string;\n\n  constructor(\n    request: Request,\n    private readonly params: Record<string, string>,\n    routePath?: string,\n  ) {\n    this.raw = request;\n    this.url = request.url;\n    this.method = request.method;\n    this.path = new URL(request.url).pathname;\n    this.routePath = routePath;\n  }\n\n  header(): Record<string, string>;\n  header(name: string): string | undefined;\n  header(name?: string): Record<string, string> | string | undefined {\n    if (name) return this.raw.headers.get(name) ?? undefined;\n    const headers: Record<string, string> = {};\n    this.raw.headers.forEach((value, key) => {\n      headers[key] = value;\n    });\n    return headers;\n  }\n\n  query(name: string): string | undefined {\n    return new URL(this.url).searchParams.get(name) ?? undefined;\n  }\n\n  queries(name: string): string[] | undefined {\n    const values = new URL(this.url).searchParams.getAll(name);\n    return values.length > 0 ? values : undefined;\n  }\n\n  param(): Record<string, string>;\n  param(name: string): string;\n  param(name?: string): Record<string, string> | string {\n    if (!name) return { ...this.params };\n    return this.params[name] ?? \"\";\n  }\n\n  json<T = any>(): Promise<T> {\n    return this.raw.json() as Promise<T>;\n  }\n\n  text(): Promise<string> {\n    return this.raw.text();\n  }\n\n  arrayBuffer(): Promise<ArrayBuffer> {\n    return this.raw.arrayBuffer();\n  }\n\n  async parseBody(): Promise<Record<string, FormDataEntryValue | FormDataEntryValue[]>> {\n    const contentType = this.header(\"Content-Type\") ?? \"\";\n    if (contentType.includes(\"multipart/form-data\")) {\n      return formDataToObject(await this.raw.formData());\n    }\n    if (contentType.includes(\"application/x-www-form-urlencoded\")) {\n      const params = new URLSearchParams(await this.raw.text());\n      const out: Record<string, string | string[]> = {};\n      for (const [key, value] of params) {\n        appendBodyValue(out, key, value);\n      }\n      return out;\n    }\n    if (contentType.includes(\"application/json\")) {\n      const body = await this.raw.json().catch(() => ({}));\n      return body && typeof body === \"object\" && !Array.isArray(body)\n        ? (body as Record<string, FormDataEntryValue | FormDataEntryValue[]>)\n        : {};\n    }\n    return {};\n  }\n}\n\nexport class Context<E = unknown, _P extends string = string> {\n  readonly req: HonoRequest;\n  private readonly vars = new Map<string, unknown>();\n  private readonly responseHeaders = new Headers();\n  private responseStatus = 200;\n\n  constructor(\n    request: Request,\n    params: Record<string, string>,\n    private readonly notFoundHandler: (c: Context<E>) => Response | Promise<Response>,\n    routePath?: string,\n  ) {\n    this.req = new HonoRequest(request, params, routePath);\n  }\n\n  get<K extends keyof VariablesOf<E> & string>(key: K): VariablesOf<E>[K] | undefined {\n    return this.vars.get(key) as VariablesOf<E>[K] | undefined;\n  }\n\n  set<K extends keyof VariablesOf<E> & string>(key: K, value: VariablesOf<E>[K]): void {\n    this.vars.set(key, value);\n  }\n\n  header(name: string, value: string): void {\n    this.responseHeaders.set(name, value);\n  }\n\n  status(status: number): void {\n    this.responseStatus = status;\n  }\n\n  json(data: unknown, status?: ContentfulStatusCode, headers?: HeadersInit): Response {\n    return this.response(JSON.stringify(data), status, defaultContentType(headers, \"application/json; charset=UTF-8\"));\n  }\n\n  text(text: string, status?: ContentfulStatusCode, headers?: HeadersInit): Response {\n    return this.response(text, status, defaultContentType(headers, \"text/plain; charset=UTF-8\"));\n  }\n\n  html(html: string, status?: ContentfulStatusCode, headers?: HeadersInit): Response {\n    return this.response(html, status, defaultContentType(headers, \"text/html; charset=UTF-8\"));\n  }\n\n  body(body: BodyInit | null, status?: ContentfulStatusCode, headers?: HeadersInit): Response {\n    return this.response(body, status, headers);\n  }\n\n  redirect(location: string, status: ContentfulStatusCode = 302): Response {\n    return this.response(null, status, { Location: location });\n  }\n\n  notFound(): Response | Promise<Response> {\n    return this.notFoundHandler(this);\n  }\n\n  finalize(response: Response): Response {\n    if (!hasHeaders(this.responseHeaders)) return response;\n    const headers = new Headers(response.headers);\n    this.responseHeaders.forEach((value, key) => {\n      headers.set(key, value);\n    });\n    return new Response(response.body, {\n      status: response.status,\n      statusText: response.statusText,\n      headers,\n    });\n  }\n\n  private response(body: BodyInit | null, status?: ContentfulStatusCode, headers?: HeadersInit): Response {\n    const merged = new Headers(headers);\n    this.responseHeaders.forEach((value, key) => {\n      merged.set(key, value);\n    });\n    return new Response(body, {\n      status: status ?? this.responseStatus,\n      headers: merged,\n    });\n  }\n}\n\nexport class Hono<E = unknown> {\n  private readonly middleware: Route<E>[] = [];\n  private readonly routes: Route<E>[] = [];\n  private errorHandler: ErrorHandler<E> = (err) => {\n    const message = err instanceof Error ? err.message : \"Internal Server Error\";\n    return new Response(message, { status: 500 });\n  };\n  private notFoundHandler: (c: Context<E>) => Response | Promise<Response> = () =>\n    new Response(\"404 Not Found\", { status: 404 });\n\n  use<P extends string = string>(path: string, ...handlers: Handler<E, P>[]): this;\n  use(...handlers: Handler<E>[]): this;\n  use<P extends string = string>(pathOrHandler: string | Handler<E>, ...handlers: Handler<E, P>[]): this {\n    if (typeof pathOrHandler === \"string\") {\n      this.middleware.push({ method: \"ALL\", compiled: compilePath(pathOrHandler), handlers: handlers as Handler<E>[] });\n    } else {\n      this.middleware.push({ method: \"ALL\", compiled: compilePath(\"*\"), handlers: [pathOrHandler, ...handlers] });\n    }\n    return this;\n  }\n\n  on<P extends string = string>(method: string, path: string, ...handlers: Handler<E, P>[]): this {\n    this.routes.push({ method: method.toUpperCase(), compiled: compilePath(path), handlers: handlers as Handler<E>[] });\n    return this;\n  }\n\n  get<P extends string = string>(path: string, ...handlers: Handler<E, P>[]): this {\n    return this.on(\"GET\", path, ...handlers);\n  }\n\n  post<P extends string = string>(path: string, ...handlers: Handler<E, P>[]): this {\n    return this.on(\"POST\", path, ...handlers);\n  }\n\n  put<P extends string = string>(path: string, ...handlers: Handler<E, P>[]): this {\n    return this.on(\"PUT\", path, ...handlers);\n  }\n\n  patch<P extends string = string>(path: string, ...handlers: Handler<E, P>[]): this {\n    return this.on(\"PATCH\", path, ...handlers);\n  }\n\n  delete<P extends string = string>(path: string, ...handlers: Handler<E, P>[]): this {\n    return this.on(\"DELETE\", path, ...handlers);\n  }\n\n  onError(handler: ErrorHandler<E>): this {\n    this.errorHandler = handler;\n    return this;\n  }\n\n  notFound(handler: (c: Context<E>) => Response | Promise<Response>): this {\n    this.notFoundHandler = handler;\n    return this;\n  }\n\n  async request(input: string | Request, init?: RequestInit): Promise<Response> {\n    if (input instanceof Request) return this.fetch(input);\n    const url = input.startsWith(\"/\") ? `http://localhost${input}` : input;\n    return this.fetch(new Request(url, init));\n  }\n\n  fetch = async (request: Request): Promise<Response> => {\n    const url = new URL(request.url);\n    const path = url.pathname;\n    const method = request.method.toUpperCase();\n    const matched = this.match(method, path);\n    const context = new Context<E>(request, matched.params, this.notFoundHandler, matched.routePattern);\n\n    try {\n      const response = await this.dispatch(context, matched.handlers);\n      return context.finalize(response ?? (await this.notFoundHandler(context)));\n    } catch (err) {\n      return context.finalize(await this.errorHandler(err, context));\n    }\n  };\n\n  private match(\n    method: string,\n    path: string,\n  ): { handlers: MatchedHandler<E>[]; params: Record<string, string>; routePattern?: string } {\n    const handlers: MatchedHandler<E>[] = [];\n    const params: Record<string, string> = {};\n\n    for (const route of this.middleware) {\n      const match = matchPath(route.compiled, path);\n      if (!match) continue;\n      Object.assign(params, match);\n      for (const handler of route.handlers) {\n        handlers.push({ handler, params: match });\n      }\n    }\n\n    const route =\n      this.routes.find((candidate) => candidate.method === method && matchPath(candidate.compiled, path) != null) ??\n      (method === \"HEAD\"\n        ? this.routes.find((candidate) => candidate.method === \"GET\" && matchPath(candidate.compiled, path) != null)\n        : undefined);\n\n    if (route) {\n      const match = matchPath(route.compiled, path) ?? {};\n      Object.assign(params, match);\n      for (const handler of route.handlers) {\n        handlers.push({ handler, params: match });\n      }\n    }\n\n    return { handlers, params, routePattern: route?.compiled.pattern };\n  }\n\n  private async dispatch(context: Context<E>, handlers: MatchedHandler<E>[]): Promise<Response | void> {\n    let index = -1;\n    const run = async (nextIndex: number): Promise<Response | void> => {\n      if (nextIndex <= index) throw new Error(\"next() called multiple times\");\n      index = nextIndex;\n      const matched = handlers[nextIndex];\n      if (!matched) return undefined;\n\n      const originalParams = context.req.param();\n      Object.assign(originalParams, matched.params);\n\n      let nextResponse: Response | void = undefined;\n      let nextCalled = false;\n      const next: Next = async () => {\n        nextCalled = true;\n        nextResponse = await run(nextIndex + 1);\n        return nextResponse;\n      };\n\n      const response = await matched.handler(context, next);\n      if (response instanceof Response) return response;\n      if (nextCalled) return nextResponse;\n      return response;\n    };\n\n    return run(0);\n  }\n}\n\nexport function cors(options: CorsOptions = {}): MiddlewareHandler {\n  const origin = options.origin ?? \"*\";\n  const allowMethods = options.allowMethods ?? [\"GET\", \"HEAD\", \"PUT\", \"POST\", \"DELETE\", \"PATCH\", \"OPTIONS\"];\n\n  return async (c, next) => {\n    c.header(\"Access-Control-Allow-Origin\", origin);\n    if (options.credentials) c.header(\"Access-Control-Allow-Credentials\", \"true\");\n\n    if (c.req.method.toUpperCase() === \"OPTIONS\") {\n      c.header(\"Access-Control-Allow-Methods\", allowMethods.join(\",\"));\n      const allowHeaders = options.allowHeaders?.join(\",\") ?? c.req.header(\"Access-Control-Request-Headers\");\n      if (allowHeaders) c.header(\"Access-Control-Allow-Headers\", allowHeaders);\n      if (options.maxAge != null) c.header(\"Access-Control-Max-Age\", String(options.maxAge));\n      return c.body(null, 204);\n    }\n\n    await next();\n  };\n}\n\nexport function serve(options: ServeOptions): Server {\n  const port = options.port ?? 3000;\n  const server = createNodeServer(async (req, res) => {\n    try {\n      const request = nodeRequestToFetchRequest(req);\n      const response = await options.fetch(request);\n      await writeFetchResponse(res, response, req.method?.toUpperCase() === \"HEAD\");\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Internal Server Error\";\n      res.statusCode = 500;\n      res.setHeader(\"Content-Type\", \"text/plain; charset=UTF-8\");\n      res.end(message);\n    }\n  });\n  server.listen(port, options.hostname);\n  return server;\n}\n\nfunction compilePath(pattern: string): CompiledPath {\n  if (pattern === \"*\" || pattern === \"/*\") {\n    return { pattern, regex: /^.*$/, paramNames: [] };\n  }\n\n  const paramNames: string[] = [];\n  let source = \"^\";\n  for (let i = 0; i < pattern.length; i++) {\n    const char = pattern[i];\n    if (char !== \":\") {\n      source += escapeRegex(char);\n      continue;\n    }\n\n    let name = \"\";\n    i++;\n    while (i < pattern.length && /[A-Za-z0-9_]/.test(pattern[i])) {\n      name += pattern[i];\n      i++;\n    }\n    i--;\n    paramNames.push(name);\n\n    if (pattern[i + 1] === \"{\") {\n      const close = pattern.indexOf(\"}\", i + 2);\n      if (close < 0) throw new Error(`Invalid route pattern: ${pattern}`);\n      const expr = pattern.slice(i + 2, close);\n      source += `(${expr})`;\n      i = close;\n    } else {\n      source += \"([^/]+)\";\n    }\n  }\n  source += \"$\";\n  return { pattern, regex: new RegExp(source), paramNames };\n}\n\nfunction matchPath(compiled: CompiledPath, path: string): Record<string, string> | null {\n  const match = compiled.regex.exec(path);\n  if (!match) return null;\n  const params: Record<string, string> = {};\n  for (let i = 0; i < compiled.paramNames.length; i++) {\n    params[compiled.paramNames[i]] = decodePathParam(match[i + 1] ?? \"\");\n  }\n  return params;\n}\n\nfunction decodePathParam(value: string): string {\n  try {\n    return decodeURIComponent(value);\n  } catch {\n    return value;\n  }\n}\n\nfunction escapeRegex(value: string): string {\n  return value.replace(/[|\\\\{}()[\\]^$+*?.]/g, \"\\\\$&\");\n}\n\nfunction hasHeaders(headers: Headers): boolean {\n  for (const _ of headers) return true;\n  return false;\n}\n\nfunction defaultContentType(headers: HeadersInit | undefined, contentType: string): Headers {\n  const out = new Headers(headers);\n  if (!out.has(\"Content-Type\")) {\n    out.set(\"Content-Type\", contentType);\n  }\n  return out;\n}\n\nfunction formDataToObject(formData: FormData): Record<string, FormDataEntryValue | FormDataEntryValue[]> {\n  const out: Record<string, FormDataEntryValue | FormDataEntryValue[]> = {};\n  for (const [key, value] of formData) {\n    appendBodyValue(out, key, value);\n  }\n  return out;\n}\n\nfunction appendBodyValue<T>(target: Record<string, T | T[]>, key: string, value: T): void {\n  const existing = target[key];\n  if (existing === undefined) {\n    target[key] = value;\n  } else if (Array.isArray(existing)) {\n    existing.push(value);\n  } else {\n    target[key] = [existing, value];\n  }\n}\n\nfunction nodeRequestToFetchRequest(req: IncomingMessage): Request {\n  const host = req.headers.host ?? \"localhost\";\n  const url = new URL(req.url ?? \"/\", `http://${host}`);\n  const headers = new Headers();\n  for (const [key, value] of Object.entries(req.headers)) {\n    if (value == null) continue;\n    if (Array.isArray(value)) {\n      for (const item of value) headers.append(key, item);\n    } else {\n      headers.set(key, value);\n    }\n  }\n\n  const method = req.method ?? \"GET\";\n  const hasBody = method !== \"GET\" && method !== \"HEAD\";\n  return new Request(url.toString(), {\n    method,\n    headers,\n    body: hasBody ? (req as unknown as BodyInit) : undefined,\n    duplex: \"half\",\n  } as RequestInit & { duplex: string });\n}\n\nasync function writeFetchResponse(res: ServerResponse, response: Response, headOnly: boolean): Promise<void> {\n  res.statusCode = response.status;\n  res.statusMessage = response.statusText;\n\n  const headersWithCookies = response.headers as Headers & { getSetCookie?: () => string[] };\n  const cookies = headersWithCookies.getSetCookie?.();\n  response.headers.forEach((value, key) => {\n    if (key.toLowerCase() === \"set-cookie\" && cookies && cookies.length > 0) return;\n    res.setHeader(key, value);\n  });\n  if (cookies && cookies.length > 0) {\n    res.setHeader(\"Set-Cookie\", cookies);\n  }\n\n  if (headOnly || !response.body) {\n    res.end();\n    return;\n  }\n\n  const reader = response.body.getReader();\n  try {\n    while (true) {\n      const { done, value } = await reader.read();\n      if (done) break;\n      if (!res.write(value)) {\n        await new Promise<void>((resolve) => res.once(\"drain\", resolve));\n      }\n    }\n    res.end();\n  } catch (err) {\n    res.destroy(err instanceof Error ? err : undefined);\n  }\n}\n","import { createHmac } from \"crypto\";\n\nexport interface WebhookSubscription {\n  id: number;\n  url: string;\n  events: string[];\n  active: boolean;\n  secret?: string;\n  owner: string;\n  repo?: string;\n}\n\nexport interface WebhookDelivery {\n  id: number;\n  hook_id: number;\n  event: string;\n  action?: string;\n  payload: unknown;\n  status_code: number | null;\n  delivered_at: string;\n  duration: number | null;\n  success: boolean;\n}\n\nconst MAX_DELIVERIES = 1000;\n\nexport class WebhookDispatcher {\n  private subscriptions: WebhookSubscription[] = [];\n  private deliveries: WebhookDelivery[] = [];\n  private subscriptionIdCounter = 1;\n  private deliveryIdCounter = 1;\n\n  register(sub: Omit<WebhookSubscription, \"id\"> & { id?: number }): WebhookSubscription {\n    const { id: explicitId, ...rest } = sub;\n    const id = explicitId !== undefined ? explicitId : this.subscriptionIdCounter++;\n    if (id >= this.subscriptionIdCounter) {\n      this.subscriptionIdCounter = id + 1;\n    }\n    const subscription: WebhookSubscription = { ...rest, id };\n    this.subscriptions.push(subscription);\n    return subscription;\n  }\n\n  unregister(id: number): boolean {\n    const idx = this.subscriptions.findIndex((s) => s.id === id);\n    if (idx === -1) return false;\n    this.subscriptions.splice(idx, 1);\n    return true;\n  }\n\n  getSubscription(id: number): WebhookSubscription | undefined {\n    return this.subscriptions.find((s) => s.id === id);\n  }\n\n  getSubscriptions(owner?: string, repo?: string): WebhookSubscription[] {\n    return this.subscriptions.filter((s) => {\n      if (owner && s.owner !== owner) return false;\n      if (repo !== undefined && s.repo !== repo) return false;\n      return true;\n    });\n  }\n\n  updateSubscription(\n    id: number,\n    data: Partial<Pick<WebhookSubscription, \"url\" | \"events\" | \"active\" | \"secret\">>,\n  ): WebhookSubscription | undefined {\n    const sub = this.subscriptions.find((s) => s.id === id);\n    if (!sub) return undefined;\n    Object.assign(sub, data);\n    return sub;\n  }\n\n  async dispatch(\n    event: string,\n    action: string | undefined,\n    payload: unknown,\n    owner: string,\n    repo?: string,\n  ): Promise<void> {\n    const matchingSubs = this.subscriptions.filter((s) => {\n      if (!s.active) return false;\n      if (s.owner !== owner) return false;\n      if (repo !== undefined) {\n        if (s.repo !== repo) return false;\n      } else if (s.repo !== undefined) {\n        return false;\n      }\n      return event === \"ping\" || s.events.includes(\"*\") || s.events.includes(event);\n    });\n\n    for (const sub of matchingSubs) {\n      const delivery: WebhookDelivery = {\n        id: this.deliveryIdCounter++,\n        hook_id: sub.id,\n        event,\n        action,\n        payload,\n        status_code: null,\n        delivered_at: new Date().toISOString(),\n        duration: null,\n        success: false,\n      };\n\n      const body = JSON.stringify(payload);\n\n      const signatureHeaders: Record<string, string> = {};\n      if (sub.secret) {\n        const hmac = createHmac(\"sha256\", sub.secret).update(body).digest(\"hex\");\n        signatureHeaders[\"X-Hub-Signature-256\"] = `sha256=${hmac}`;\n      }\n\n      try {\n        const start = Date.now();\n        const response = await fetch(sub.url, {\n          method: \"POST\",\n          headers: {\n            \"Content-Type\": \"application/json\",\n            \"X-GitHub-Event\": event,\n            \"X-GitHub-Delivery\": String(delivery.id),\n            ...signatureHeaders,\n          },\n          body,\n          signal: AbortSignal.timeout(10000),\n        });\n        delivery.duration = Date.now() - start;\n        delivery.status_code = response.status;\n        delivery.success = response.ok;\n      } catch {\n        delivery.duration = 0;\n        delivery.success = false;\n      }\n\n      this.deliveries.push(delivery);\n      if (this.deliveries.length > MAX_DELIVERIES) {\n        this.deliveries.splice(0, this.deliveries.length - MAX_DELIVERIES);\n      }\n    }\n  }\n\n  getDeliveries(hookId?: number): WebhookDelivery[] {\n    if (hookId !== undefined) {\n      return this.deliveries.filter((d) => d.hook_id === hookId);\n    }\n    return [...this.deliveries];\n  }\n\n  clear(): void {\n    this.subscriptions.length = 0;\n    this.deliveries.length = 0;\n    this.subscriptionIdCounter = 1;\n    this.deliveryIdCounter = 1;\n  }\n}\n","import type { Context, ContentfulStatusCode, ErrorHandler, MiddlewareHandler } from \"../http.js\";\n\nconst DEFAULT_DOCS_URL = \"https://emulate.dev\";\n\nfunction getDocsUrl(c: Context): string {\n  return (c.get(\"docsUrl\") as string | undefined) ?? DEFAULT_DOCS_URL;\n}\n\nfunction errorStatus(err: unknown): number {\n  if (err && typeof err === \"object\" && \"status\" in err) {\n    const s = (err as { status: unknown }).status;\n    if (typeof s === \"number\" && Number.isFinite(s)) return s;\n  }\n  return 500;\n}\n\n/**\n * Use with `app.onError(...)`. Route handlers throw to the app error handler.\n */\nexport function createApiErrorHandler(documentationUrl?: string): ErrorHandler {\n  return (err, c) => {\n    if (documentationUrl) {\n      c.set(\"docsUrl\", documentationUrl);\n    }\n    const status = errorStatus(err);\n    const message = err instanceof Error ? err.message : \"Internal Server Error\";\n    return c.json(\n      {\n        message,\n        documentation_url: getDocsUrl(c),\n      },\n      status as ContentfulStatusCode,\n    );\n  };\n}\n\n/** Sets `docsUrl` on the context for successful responses; register `createApiErrorHandler` for thrown `ApiError`s. */\nexport function createErrorHandler(documentationUrl?: string): MiddlewareHandler {\n  return async (c, next) => {\n    if (documentationUrl) {\n      c.set(\"docsUrl\", documentationUrl);\n    }\n    await next();\n  };\n}\n\nexport const errorHandler: MiddlewareHandler = createErrorHandler();\n\nexport class ApiError extends Error {\n  constructor(\n    public status: number,\n    message: string,\n    public errors?: Array<{ resource: string; field: string; code: string }>,\n  ) {\n    super(message);\n    this.name = \"ApiError\";\n  }\n}\n\nexport function notFound(resource?: string): ApiError {\n  return new ApiError(404, resource ? `${resource} not found` : \"Not Found\");\n}\n\nexport function validationError(message: string, errors?: ApiError[\"errors\"]): ApiError {\n  return new ApiError(422, message, errors);\n}\n\nexport function unauthorized(): ApiError {\n  return new ApiError(401, \"Requires authentication\");\n}\n\nexport function forbidden(): ApiError {\n  return new ApiError(403, \"Forbidden\");\n}\n\nexport async function parseJsonBody(c: Context): Promise<Record<string, unknown>> {\n  try {\n    const body = await c.req.json();\n    if (body && typeof body === \"object\" && !Array.isArray(body)) {\n      return body as Record<string, unknown>;\n    }\n    return {};\n  } catch {\n    throw new ApiError(400, \"Problems parsing JSON\");\n  }\n}\n","import type { Context, Next } from \"../http.js\";\nimport { jwtVerify, importPKCS8 } from \"jose\";\nimport { debug } from \"../debug.js\";\n\nexport interface AuthUser {\n  login: string;\n  id: number;\n  scopes: string[];\n}\n\nexport interface AuthApp {\n  appId: number;\n  slug: string;\n  name: string;\n}\n\nexport interface AuthInstallation {\n  installationId: number;\n  appId: number;\n  permissions: Record<string, string>;\n  repositoryIds: number[];\n  repositorySelection: \"all\" | \"selected\";\n}\n\nexport type TokenMap = Map<string, AuthUser>;\n\nexport interface TokenEntry {\n  token: string;\n  login: string;\n  id: number;\n  scopes: string[];\n}\n\nexport function serializeTokenMap(tokenMap: TokenMap): TokenEntry[] {\n  return [...tokenMap.entries()].map(([token, user]) => ({\n    token,\n    login: user.login,\n    id: user.id,\n    scopes: user.scopes,\n  }));\n}\n\nexport function restoreTokenMap(tokenMap: TokenMap, tokens: TokenEntry[]): void {\n  tokenMap.clear();\n  for (const t of tokens) {\n    tokenMap.set(t.token, { login: t.login, id: t.id, scopes: t.scopes });\n  }\n}\n\nexport type AppEnv = {\n  Variables: {\n    authUser?: AuthUser;\n    authApp?: AuthApp;\n    authToken?: string;\n    authScopes?: string[];\n    docsUrl?: string;\n    /** Correlation id for the active request, set by the ledger middleware. */\n    correlationId?: string;\n    /** Provider operation id a handler can advertise for the ledger. */\n    operationId?: string;\n    /** Side effects a handler records onto the active request's ledger entry. */\n    ledgerEffects?: import(\"../ledger.js\").LedgerSideEffect[];\n  };\n};\n\nexport interface AppKeyResolver {\n  (appId: number): { privateKey: string; slug: string; name: string } | null;\n}\n\nexport interface AuthFallback {\n  login: string;\n  id: number;\n  scopes: string[];\n}\n\nexport function authMiddleware(tokens: TokenMap, appKeyResolver?: AppKeyResolver, fallbackUser?: AuthFallback) {\n  return async (c: Context, next: Next) => {\n    const authHeader = c.req.header(\"Authorization\");\n    if (authHeader) {\n      const token = authHeader.replace(/^(Bearer|token)\\s+/i, \"\").trim();\n\n      if (token.startsWith(\"eyJ\") && appKeyResolver) {\n        try {\n          const [, payloadB64] = token.split(\".\");\n          const payload = JSON.parse(Buffer.from(payloadB64, \"base64url\").toString());\n          const appId = typeof payload.iss === \"string\" ? parseInt(payload.iss, 10) : payload.iss;\n\n          if (typeof appId === \"number\" && !isNaN(appId)) {\n            const appInfo = appKeyResolver(appId);\n            if (appInfo) {\n              const key = await importPKCS8(appInfo.privateKey, \"RS256\");\n              await jwtVerify(token, key, { algorithms: [\"RS256\"] });\n              c.set(\"authApp\", {\n                appId,\n                slug: appInfo.slug,\n                name: appInfo.name,\n              } satisfies AuthApp);\n            }\n          }\n        } catch {\n          // JWT verification failed\n        }\n      } else {\n        let user = tokens.get(token);\n        if (!user && fallbackUser && token.length > 0) {\n          debug(\"auth\", \"fallback user for unknown token\", { login: fallbackUser.login, id: fallbackUser.id });\n          user = { login: fallbackUser.login, id: fallbackUser.id, scopes: fallbackUser.scopes };\n        }\n        if (user) {\n          c.set(\"authUser\", user);\n          c.set(\"authToken\", token);\n          c.set(\"authScopes\", user.scopes);\n        }\n      }\n    }\n    await next();\n  };\n}\n\nexport function requireAuth() {\n  return async (c: Context, next: Next) => {\n    if (!c.get(\"authUser\")) {\n      const docsUrl = (c.get(\"docsUrl\") as string | undefined) ?? \"https://emulate.dev\";\n      return c.json(\n        {\n          message: \"Requires authentication\",\n          documentation_url: docsUrl,\n        },\n        401,\n      );\n    }\n    await next();\n  };\n}\n\nexport function requireAppAuth() {\n  return async (c: Context, next: Next) => {\n    if (!c.get(\"authApp\")) {\n      const docsUrl = (c.get(\"docsUrl\") as string | undefined) ?? \"https://emulate.dev\";\n      return c.json(\n        {\n          message: \"A JSON web token could not be decoded\",\n          documentation_url: docsUrl,\n        },\n        401,\n      );\n    }\n    await next();\n  };\n}\n","const isDebug =\n  typeof process !== \"undefined\" &&\n  (process.env.DEBUG === \"1\" || process.env.DEBUG === \"true\" || process.env.EMULATE_DEBUG === \"1\");\n\nexport function debug(label: string, ...args: unknown[]): void {\n  if (isDebug) {\n    console.log(`[${label}]`, ...args);\n  }\n}\n","import { readFileSync } from \"node:fs\";\nimport { fileURLToPath } from \"node:url\";\nimport { dirname, join } from \"node:path\";\nimport type { Hono } from \"./http.js\";\nimport type { AppEnv } from \"./middleware/auth.js\";\n\n// Read the cosmetic font/favicon assets lazily and defensively: on a real\n// filesystem (Node/Bun hosts) this serves them; on filesystem-less runtimes\n// (e.g. Cloudflare Workers) the read fails and the route 404s, but — crucially —\n// importing this module touches neither fs NOR import.meta.url at load time\n// (workerd leaves import.meta.url undefined, which would crash `fileURLToPath`),\n// so `createServer` boots everywhere. API emulation never needs these assets.\nconst assetCache = new Map<string, Buffer | null>();\nfunction loadAsset(name: string): Buffer | null {\n  if (assetCache.has(name)) return assetCache.get(name)!;\n  let buf: Buffer | null = null;\n  try {\n    const dir = dirname(fileURLToPath(import.meta.url));\n    buf = readFileSync(join(dir, \"fonts\", name));\n  } catch {\n    buf = null;\n  }\n  assetCache.set(name, buf);\n  return buf;\n}\n\nconst FONT_NAMES = new Set([\"geist-sans.woff2\", \"GeistPixel-Square.woff2\"]);\n\nexport function registerFontRoutes(app: Hono<AppEnv>): void {\n  app.get(\"/_emulate/fonts/:name\", (c) => {\n    const name = c.req.param(\"name\");\n    if (!FONT_NAMES.has(name)) return c.notFound();\n    const buf = loadAsset(name);\n    if (!buf) return c.notFound();\n    return new Response(buf, {\n      headers: {\n        \"Content-Type\": \"font/woff2\",\n        \"Cache-Control\": \"public, max-age=31536000, immutable\",\n        \"Access-Control-Allow-Origin\": \"*\",\n      },\n    });\n  });\n\n  app.get(\"/_emulate/favicon.ico\", (c) => {\n    const buf = loadAsset(\"favicon.ico\");\n    if (!buf) return c.notFound();\n    return new Response(buf, {\n      headers: {\n        \"Content-Type\": \"image/x-icon\",\n        \"Cache-Control\": \"public, max-age=31536000, immutable\",\n      },\n    });\n  });\n}\n","import type { MiddlewareHandler } from \"./http.js\";\nimport type { AppEnv, AuthUser, AuthApp } from \"./middleware/auth.js\";\nimport type { WebhookDispatcher } from \"./webhooks.js\";\n\nexport interface LedgerIdentity {\n  user?: Pick<AuthUser, \"login\" | \"id\" | \"scopes\">;\n  app?: Pick<AuthApp, \"appId\" | \"slug\" | \"name\">;\n}\n\nexport interface LedgerSideEffect {\n  type: \"create\" | \"update\" | \"delete\" | \"custom\";\n  collection?: string;\n  id?: string | number;\n  summary?: string;\n}\n\nexport interface LedgerWebhookDelivery {\n  id: number;\n  hook_id: number;\n  event: string;\n  action?: string;\n  status_code: number | null;\n  success: boolean;\n}\n\nexport interface LedgerEntry {\n  id: string;\n  /** Correlation id: honored from X-Correlation-Id / X-Request-Id or generated. */\n  correlationId: string;\n  timestamp: string;\n  method: string;\n  host: string;\n  path: string;\n  query: string;\n  /** Matched route pattern, e.g. /repos/:owner/:repo/issues. */\n  route?: string;\n  /** Provider operation id, when the handler advertises one. */\n  operationId?: string;\n  request: {\n    headers: Record<string, string>;\n    body?: unknown;\n    bodyTruncated?: boolean;\n  };\n  identity: LedgerIdentity;\n  response: {\n    status: number;\n    headers: Record<string, string>;\n    body?: unknown;\n    bodyTruncated?: boolean;\n  };\n  /** Human/agent-readable one-liner, e.g. \"POST /repos/:owner/:repo -> 201\". */\n  summary: string;\n  sideEffects: LedgerSideEffect[];\n  webhookDeliveries: LedgerWebhookDelivery[];\n  durationMs: number;\n}\n\nexport interface LedgerOptions {\n  maxEntries?: number;\n  maxBodyChars?: number;\n  /** When provided, webhook deliveries fired during a request are correlated onto its entry. */\n  webhooks?: WebhookDispatcher;\n}\n\nexport interface LedgerSnapshot {\n  entries: LedgerEntry[];\n  counter: number;\n}\n\nconst DEFAULT_MAX_ENTRIES = 1000;\nconst DEFAULT_MAX_BODY_CHARS = 20000;\nconst REDACTED = \"[redacted]\";\nconst SENSITIVE_HEADERS = new Set([\n  \"authorization\",\n  \"cookie\",\n  \"set-cookie\",\n  \"x-api-key\",\n  \"x-github-token\",\n  \"stripe-signature\",\n]);\nconst SENSITIVE_KEYS = /token|secret|password|authorization|api[_-]?key|client[_-]?secret|private[_-]?key/i;\n\nexport class RequestLedger {\n  private entries: LedgerEntry[] = [];\n  private counter = 1;\n\n  constructor(private readonly options: LedgerOptions = {}) {}\n\n  add(entry: Omit<LedgerEntry, \"id\">): LedgerEntry {\n    const saved = { ...entry, id: `req_${this.counter++}` };\n    this.entries.push(saved);\n    const max = this.options.maxEntries ?? DEFAULT_MAX_ENTRIES;\n    if (this.entries.length > max) {\n      this.entries.splice(0, this.entries.length - max);\n    }\n    return saved;\n  }\n\n  list(limit?: number): LedgerEntry[] {\n    const all = [...this.entries].reverse();\n    return limit != null ? all.slice(0, limit) : all;\n  }\n\n  clear(): void {\n    this.entries.length = 0;\n    this.counter = 1;\n  }\n\n  /** Serialize for durable persistence (e.g. a Cloudflare Durable Object). */\n  serialize(): LedgerSnapshot {\n    return { entries: [...this.entries], counter: this.counter };\n  }\n\n  restore(snapshot: LedgerSnapshot | undefined): void {\n    if (!snapshot) return;\n    this.entries = Array.isArray(snapshot.entries) ? [...snapshot.entries] : [];\n    this.counter = typeof snapshot.counter === \"number\" ? snapshot.counter : this.entries.length + 1;\n  }\n}\n\nfunction correlationIdFor(headers: Record<string, string>): string {\n  const provided = headers[\"x-correlation-id\"] ?? headers[\"x-request-id\"];\n  if (provided && provided.length <= 200) return provided;\n  return `cor_${crypto.randomUUID().replace(/-/g, \"\")}`;\n}\n\nexport function createLedgerMiddleware(ledger: RequestLedger, options: LedgerOptions = {}): MiddlewareHandler<AppEnv> {\n  const maxBodyChars = options.maxBodyChars ?? DEFAULT_MAX_BODY_CHARS;\n  const webhooks = options.webhooks;\n\n  return async (c, next) => {\n    if (c.req.path.startsWith(\"/_emulate\")) {\n      await next();\n      return;\n    }\n\n    const started = Date.now();\n    const url = new URL(c.req.url);\n    const rawHeaders = c.req.header();\n    const correlationId = correlationIdFor(rawHeaders);\n    c.set(\"correlationId\", correlationId);\n    c.set(\"ledgerEffects\", []);\n    c.header(\"X-Correlation-Id\", correlationId);\n\n    const requestBody = await readBody(c.req.raw.clone(), maxBodyChars);\n    const requestHeaders = redactHeaders(rawHeaders);\n\n    // Snapshot existing webhook delivery ids so we can correlate the ones this\n    // request fires. Exact under the serialized execution of a Durable Object;\n    // best-effort on the concurrent local dev server.\n    const beforeDeliveryIds = webhooks ? new Set(webhooks.getDeliveries().map((d) => d.id)) : undefined;\n\n    const response = await next();\n    if (!response) return;\n\n    const responseBody = await readBody(response.clone(), maxBodyChars);\n    const route = c.req.routePath;\n    const operationId = c.get(\"operationId\");\n    const sideEffects = (c.get(\"ledgerEffects\") as LedgerSideEffect[] | undefined) ?? [];\n    const webhookDeliveries: LedgerWebhookDelivery[] =\n      webhooks && beforeDeliveryIds\n        ? webhooks\n            .getDeliveries()\n            .filter((d) => !beforeDeliveryIds.has(d.id))\n            .map((d) => ({\n              id: d.id,\n              hook_id: d.hook_id,\n              event: d.event,\n              action: d.action,\n              status_code: d.status_code,\n              success: d.success,\n            }))\n        : [];\n\n    ledger.add({\n      correlationId,\n      timestamp: new Date().toISOString(),\n      method: c.req.method.toUpperCase(),\n      host: url.host,\n      path: url.pathname,\n      query: url.search,\n      route,\n      operationId,\n      request: {\n        headers: requestHeaders,\n        ...requestBody,\n      },\n      identity: {\n        user: c.get(\"authUser\"),\n        app: c.get(\"authApp\"),\n      },\n      response: {\n        status: response.status,\n        headers: redactHeaders(headersToRecord(response.headers)),\n        ...responseBody,\n      },\n      summary: `${c.req.method.toUpperCase()} ${route ?? url.pathname} -> ${response.status}`,\n      sideEffects,\n      webhookDeliveries,\n      durationMs: Date.now() - started,\n    });\n\n    return response;\n  };\n}\n\n/** Record a side effect onto the active request's ledger entry. */\nexport function recordSideEffect(\n  c: { get: (key: \"ledgerEffects\") => LedgerSideEffect[] | undefined },\n  effect: LedgerSideEffect,\n): void {\n  const effects = c.get(\"ledgerEffects\");\n  if (effects) effects.push(effect);\n}\n\nasync function readBody(\n  responseOrRequest: Request | Response,\n  maxChars: number,\n): Promise<{ body?: unknown; bodyTruncated?: boolean }> {\n  const method = responseOrRequest instanceof Request ? responseOrRequest.method.toUpperCase() : undefined;\n  if (method === \"GET\" || method === \"HEAD\") return {};\n\n  const contentType = responseOrRequest.headers.get(\"content-type\") ?? \"\";\n  if (responseOrRequest instanceof Response && responseOrRequest.status === 204) return {};\n\n  let text: string;\n  try {\n    text = await responseOrRequest.text();\n  } catch {\n    return {};\n  }\n  if (!text) return {};\n\n  const truncated = text.length > maxChars;\n  const clipped = truncated ? text.slice(0, maxChars) : text;\n  if (contentType.includes(\"application/json\")) {\n    try {\n      return { body: redactValue(JSON.parse(clipped)), bodyTruncated: truncated || undefined };\n    } catch {\n      return { body: clipped, bodyTruncated: truncated || undefined };\n    }\n  }\n  if (contentType.includes(\"application/x-www-form-urlencoded\")) {\n    const params: Record<string, string> = {};\n    for (const [key, value] of new URLSearchParams(clipped)) {\n      params[key] = SENSITIVE_KEYS.test(key) ? REDACTED : value;\n    }\n    return { body: params, bodyTruncated: truncated || undefined };\n  }\n  return { body: clipped, bodyTruncated: truncated || undefined };\n}\n\nfunction headersToRecord(headers: Headers): Record<string, string> {\n  const out: Record<string, string> = {};\n  headers.forEach((value, key) => {\n    out[key] = value;\n  });\n  return out;\n}\n\nfunction redactHeaders(headers: Record<string, string>): Record<string, string> {\n  const out: Record<string, string> = {};\n  for (const [key, value] of Object.entries(headers)) {\n    out[key] = SENSITIVE_HEADERS.has(key.toLowerCase()) ? REDACTED : value;\n  }\n  return out;\n}\n\nfunction redactValue(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(redactValue);\n  if (!value || typeof value !== \"object\") return value;\n  const out: Record<string, unknown> = {};\n  for (const [key, child] of Object.entries(value)) {\n    out[key] = SENSITIVE_KEYS.test(key) ? REDACTED : redactValue(child);\n  }\n  return out;\n}\n","export type SpecKind = \"openapi\" | \"graphql\" | \"mcp\" | \"google-discovery\" | \"oauth-metadata\" | \"manual\";\nexport type SpecCoverage = \"generated\" | \"hand-authored\" | \"partial\" | \"unsupported\";\n\n/**\n * Per-operation coverage. The vision asks for honest, operation-level coverage\n * boundaries (generated / hand-authored / partial / unsupported) instead of a\n * single label stamped across an entire spec. A plugin declares the operations\n * it actually implements; `GET /_emulate/coverage` reports them with a summary.\n */\nexport interface OperationCoverage {\n  operationId: string;\n  method?: string;\n  path?: string;\n  status: SpecCoverage;\n  summary?: string;\n}\n\nexport interface SpecManifest {\n  kind: SpecKind;\n  title: string;\n  url?: string;\n  coverage: SpecCoverage;\n  operations?: OperationCoverage[];\n  notes?: string;\n}\n\nexport interface SurfaceManifest {\n  id: string;\n  kind: \"rest\" | \"oauth\" | \"oidc\" | \"graphql\" | \"mcp\" | \"webhooks\" | \"ui\" | \"provider-specific\";\n  title: string;\n  basePath?: string;\n  status: \"supported\" | \"partial\" | \"unsupported\";\n  notes?: string;\n}\n\nexport interface AuthCapabilityManifest {\n  id: string;\n  title: string;\n  type:\n    | \"api-key\"\n    | \"bearer-token\"\n    | \"oauth-client-credentials\"\n    | \"oauth-authorization-code\"\n    | \"oidc\"\n    | \"jwt-app\"\n    | \"dynamic-client-registration\"\n    | \"webhook-secret\"\n    | \"provider-specific\";\n  status: \"supported\" | \"partial\" | \"unsupported\";\n  notes?: string;\n}\n\nexport interface ScenarioManifest {\n  id: string;\n  title: string;\n  description?: string;\n}\n\n/** A seedable area of the instance, surfaced so agents can discover the seed shape. */\nexport interface SeedFieldManifest {\n  key: string;\n  title: string;\n  description?: string;\n  example?: unknown;\n}\n\nexport interface SeedSchemaManifest {\n  description?: string;\n  fields: SeedFieldManifest[];\n  /** A full example seed body that can be POSTed to /_emulate/seed. */\n  example?: unknown;\n}\n\nexport interface StateCollectionManifest {\n  name: string;\n  title?: string;\n  description?: string;\n}\n\nexport interface StateModelManifest {\n  description?: string;\n  collections: StateCollectionManifest[];\n}\n\nexport interface ResetBehaviorManifest {\n  description: string;\n  reseeds: boolean;\n  clearsLedger: boolean;\n  clearsWebhooks: boolean;\n}\n\nexport type InspectorTabKind = \"landing\" | \"ledger\" | \"state\" | \"logs\" | \"credentials\" | \"seed\" | \"spec\" | \"custom\";\n\nexport interface InspectorTabManifest {\n  id: string;\n  title: string;\n  kind: InspectorTabKind;\n  description?: string;\n}\n\n/** Describes what the request ledger records and how durable it is. */\nexport interface LedgerCapabilitiesManifest {\n  description?: string;\n  recordsFields: string[];\n  redactsSensitive: boolean;\n  correlationId: boolean;\n  webhookDeliveries: boolean;\n  sideEffects: boolean;\n  persistent: boolean;\n  maxEntries?: number;\n}\n\nexport type ConnectionKind = \"sdk\" | \"cli\" | \"env\" | \"curl\" | \"config\" | \"mcp\";\n\n/**\n * A copyable connection snippet. The `template` uses {{placeholders}} that the\n * control plane resolves against the live instance ({{baseUrl}}, {{controlBaseUrl}},\n * {{service}}, {{instance}}, {{token}}, {{clientId}}, {{clientSecret}}). This is\n * how a human or agent copies ready-to-run SDK / CLI / app config without repo\n * context.\n */\nexport interface ConnectionSnippet {\n  id: string;\n  title: string;\n  kind: ConnectionKind;\n  language?: string;\n  description?: string;\n  template: string;\n}\n\nexport interface ServiceManifest {\n  id: string;\n  name: string;\n  description: string;\n  surfaces: SurfaceManifest[];\n  auth: AuthCapabilityManifest[];\n  specs: SpecManifest[];\n  scenarios?: ScenarioManifest[];\n  seedSchema?: SeedSchemaManifest;\n  stateModel?: StateModelManifest;\n  resetBehavior?: ResetBehaviorManifest;\n  inspectorTabs?: InspectorTabManifest[];\n  ledger?: LedgerCapabilitiesManifest;\n  connections?: ConnectionSnippet[];\n  docsUrl?: string;\n}\n\nexport interface EmulatorInstanceInfo {\n  service: string;\n  instance?: string;\n  baseUrl: string;\n  controlBaseUrl: string;\n  providerBaseUrl: string;\n}\n\n/**\n * Reset, ledger capabilities, inspector tabs and base connection snippets are the\n * same for every emulator because they all run on the shared core control plane.\n * Defining them once here keeps per-plugin manifests focused on service-specific\n * surface, auth, seed, and SDK details, and guarantees the control plane never\n * lies about a capability it actually provides.\n */\nexport const CORE_RESET_BEHAVIOR: ResetBehaviorManifest = {\n  description: \"Resets the instance to its seeded baseline.\",\n  reseeds: true,\n  clearsLedger: true,\n  clearsWebhooks: true,\n};\n\nexport function coreLedgerCapabilities(persistent: boolean): LedgerCapabilitiesManifest {\n  return {\n    description: \"Recent provider requests with sensitive headers and fields redacted.\",\n    recordsFields: [\n      \"timestamp\",\n      \"method\",\n      \"host\",\n      \"path\",\n      \"route\",\n      \"operationId\",\n      \"correlationId\",\n      \"identity\",\n      \"request\",\n      \"response\",\n      \"summary\",\n      \"sideEffects\",\n      \"webhookDeliveries\",\n      \"durationMs\",\n    ],\n    redactsSensitive: true,\n    correlationId: true,\n    webhookDeliveries: true,\n    sideEffects: true,\n    persistent,\n    maxEntries: 1000,\n  };\n}\n\nexport function coreInspectorTabs(manifest: ServiceManifest): InspectorTabManifest[] {\n  const tabs: InspectorTabManifest[] = [\n    {\n      id: \"overview\",\n      title: \"Overview\",\n      kind: \"landing\",\n      description: \"Service surfaces, base URLs, and connection snippets.\",\n    },\n    {\n      id: \"ledger\",\n      title: \"Ledger\",\n      kind: \"ledger\",\n      description: \"Recent provider requests recorded by the emulator.\",\n    },\n    { id: \"state\", title: \"State\", kind: \"state\", description: \"Current seeded and mutated instance state.\" },\n    {\n      id: \"credentials\",\n      title: \"Credentials\",\n      kind: \"credentials\",\n      description: \"Mint tokens, API keys, or OAuth clients.\",\n    },\n  ];\n  if (manifest.seedSchema || (manifest.scenarios && manifest.scenarios.length > 0)) {\n    tabs.push({ id: \"seed\", title: \"Seed\", kind: \"seed\", description: \"Seed state or load a scenario.\" });\n  }\n  if (manifest.specs.some((s) => s.kind === \"openapi\" || s.kind === \"graphql\")) {\n    tabs.push({ id: \"spec\", title: \"Spec\", kind: \"spec\", description: \"OpenAPI / GraphQL spec sources and coverage.\" });\n  }\n  if (manifest.surfaces.some((s) => s.kind === \"webhooks\")) {\n    tabs.push({\n      id: \"logs\",\n      title: \"Webhooks\",\n      kind: \"logs\",\n      description: \"Webhook deliveries dispatched by the emulator.\",\n    });\n  }\n  return tabs;\n}\n\n/** Connection snippets every emulator can offer (env + curl against the control plane). */\nexport function coreConnections(): ConnectionSnippet[] {\n  return [\n    {\n      id: \"base-url\",\n      title: \"Base URL (env)\",\n      kind: \"env\",\n      language: \"bash\",\n      description: \"Point your SDK or app at the emulator instead of the real provider.\",\n      template: \"{{SERVICE_UPPER}}_BASE_URL={{baseUrl}}\",\n    },\n    {\n      id: \"create-credential\",\n      title: \"Create a credential\",\n      kind: \"curl\",\n      language: \"bash\",\n      description: \"Mint a working credential for this instance.\",\n      template:\n        'curl -s -X POST {{controlBaseUrl}}/credentials \\\\\\n  -H \"content-type: application/json\" \\\\\\n  -d \\'{\"type\":\"{{defaultAuthType}}\"}\\'',\n    },\n    {\n      id: \"inspect-ledger\",\n      title: \"Inspect requests\",\n      kind: \"curl\",\n      language: \"bash\",\n      description: \"Read the request ledger to validate how your app called the service.\",\n      template: \"curl -s {{controlBaseUrl}}/ledger\",\n    },\n  ];\n}\n\n/**\n * Merge the shared core capabilities into a plugin manifest so every served\n * manifest fully describes reset behavior, ledger capabilities, inspector tabs,\n * and at least the base connection snippets, without each plugin repeating them.\n */\nexport function enrichManifest(manifest: ServiceManifest, opts: { ledgerPersistent?: boolean } = {}): ServiceManifest {\n  return {\n    ...manifest,\n    resetBehavior: manifest.resetBehavior ?? CORE_RESET_BEHAVIOR,\n    ledger: manifest.ledger ?? coreLedgerCapabilities(opts.ledgerPersistent ?? false),\n    inspectorTabs: manifest.inspectorTabs ?? coreInspectorTabs(manifest),\n    connections: [...(manifest.connections ?? []), ...coreConnections()],\n  };\n}\n\nexport interface ConnectionVars {\n  baseUrl: string;\n  providerBaseUrl: string;\n  controlBaseUrl: string;\n  service: string;\n  instance?: string;\n  token?: string;\n  clientId?: string;\n  clientSecret?: string;\n  defaultAuthType?: string;\n}\n\nexport interface ResolvedConnection extends ConnectionSnippet {\n  body: string;\n}\n\n/** Interpolate a connection snippet template against live instance values. */\nexport function resolveConnections(connections: ConnectionSnippet[], vars: ConnectionVars): ResolvedConnection[] {\n  const map: Record<string, string> = {\n    baseUrl: vars.baseUrl,\n    providerBaseUrl: vars.providerBaseUrl,\n    controlBaseUrl: vars.controlBaseUrl,\n    service: vars.service,\n    SERVICE_UPPER: vars.service.toUpperCase().replace(/[^A-Z0-9]+/g, \"_\"),\n    instance: vars.instance ?? \"default\",\n    token: vars.token ?? \"<token>\",\n    clientId: vars.clientId ?? \"<client_id>\",\n    clientSecret: vars.clientSecret ?? \"<client_secret>\",\n    defaultAuthType: vars.defaultAuthType ?? \"bearer-token\",\n  };\n  return connections.map((snippet) => ({\n    ...snippet,\n    body: snippet.template.replace(/\\{\\{(\\w+)\\}\\}/g, (_, key: string) => map[key] ?? `{{${key}}}`),\n  }));\n}\n\n/** A summary of declared per-operation coverage across a manifest's specs. */\nexport function coverageReport(manifest: ServiceManifest): {\n  operations: OperationCoverage[];\n  summary: Record<SpecCoverage, number>;\n  specs: Array<{ kind: SpecKind; title: string; coverage: SpecCoverage; operationCount: number }>;\n} {\n  const operations: OperationCoverage[] = [];\n  const summary: Record<SpecCoverage, number> = {\n    generated: 0,\n    \"hand-authored\": 0,\n    partial: 0,\n    unsupported: 0,\n  };\n  const specs = manifest.specs.map((spec) => {\n    const ops = spec.operations ?? [];\n    for (const op of ops) {\n      operations.push(op);\n      summary[op.status] += 1;\n    }\n    return { kind: spec.kind, title: spec.title, coverage: spec.coverage, operationCount: ops.length };\n  });\n  return { operations, summary, specs };\n}\n\nexport function createDefaultManifest(service: string): ServiceManifest {\n  return {\n    id: service,\n    name: service,\n    description: `Stateful ${service} API emulator.`,\n    surfaces: [{ id: \"rest\", kind: \"rest\", title: \"REST API\", status: \"partial\" }],\n    auth: [{ id: \"bearer\", title: \"Bearer token\", type: \"bearer-token\", status: \"partial\" }],\n    specs: [{ kind: \"manual\", title: \"Hand-authored emulator behavior\", coverage: \"partial\" }],\n  };\n}\n","export function escapeHtml(s: string): string {\n  return s.replace(/&/g, \"&amp;\").replace(/</g, \"&lt;\").replace(/>/g, \"&gt;\").replace(/\"/g, \"&quot;\");\n}\n\nexport function escapeAttr(s: string): string {\n  return escapeHtml(s).replace(/'/g, \"&#39;\");\n}\n\nconst CSS = `\n@font-face{\n  font-family:'Geist';font-style:normal;font-weight:100 900;font-display:swap;\n  src:url('/_emulate/fonts/geist-sans.woff2') format('woff2');\n}\n@font-face{\n  font-family:'Geist Pixel';font-style:normal;font-weight:400;font-display:swap;\n  src:url('/_emulate/fonts/GeistPixel-Square.woff2') format('woff2');\n}\n*{box-sizing:border-box;margin:0;padding:0}\nbody{\n  font-family:'Geist',-apple-system,BlinkMacSystemFont,sans-serif;\n  background:#000;color:#33ff00;min-height:100vh;\n  -webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;\n}\n.emu-bar{\n  border-bottom:1px solid #0a3300;padding:10px 20px;\n  display:flex;align-items:center;gap:10px;font-size:.8125rem;color:#1a8c00;\n}\n.emu-bar-title{font-weight:600;color:#33ff00;font-family:'Geist Pixel',monospace;}\n.emu-bar-links{margin-left:auto;display:flex;gap:16px;}\n.emu-bar-links a{\n  color:#1a8c00;font-size:.75rem;text-decoration:none;transition:color .15s;\n}\n.emu-bar-links a:hover{color:#33ff00;}\n.emu-bar-links a .full{display:inline;}\n.emu-bar-links a .short{display:none;}\n@media(max-width:600px){\n  .emu-bar-links a .full{display:none;}\n  .emu-bar-links a .short{display:inline;}\n}\n\n.content{\n  display:flex;align-items:center;justify-content:center;\n  min-height:calc(100vh - 42px);padding:24px 16px;\n}\n.content-inner{width:100%;max-width:420px;}\n.card-title{\n  font-family:'Geist Pixel',monospace;\n  font-size:1.125rem;font-weight:600;margin-bottom:4px;color:#33ff00;\n}\n.card-subtitle{color:#1a8c00;font-size:.8125rem;margin-bottom:18px;line-height:1.45;}\n.powered-by{\n  position:fixed;bottom:0;left:0;right:0;\n  text-align:center;padding:12px;font-size:.6875rem;color:#0a3300;\n  font-family:'Geist Pixel',monospace;\n}\n.powered-by a{color:#1a8c00;text-decoration:none;transition:color .15s;}\n.powered-by a:hover{color:#33ff00;}\n\n.error-title{\n  font-family:'Geist Pixel',monospace;\n  color:#ff4444;font-size:1.125rem;font-weight:600;margin-bottom:8px;\n}\n.error-msg{color:#1a8c00;font-size:.875rem;line-height:1.5;}\n.error-card{text-align:center;}\n\n.user-form{margin-bottom:8px;}\n.user-form:last-of-type{margin-bottom:0;}\n.user-btn{\n  width:100%;display:flex;align-items:center;gap:12px;\n  padding:10px 12px;border:1px solid #0a3300;border-radius:8px;\n  background:#000;color:inherit;cursor:pointer;text-align:left;\n  font:inherit;transition:border-color .15s;\n}\n.user-btn:hover{border-color:#33ff00;}\n.avatar{\n  width:36px;height:36px;border-radius:50%;\n  background:#0a3300;color:#33ff00;font-weight:600;font-size:.875rem;\n  display:flex;align-items:center;justify-content:center;flex-shrink:0;\n  font-family:'Geist Pixel',monospace;\n}\n.user-text{min-width:0;}\n.user-login{font-weight:600;font-size:.875rem;display:block;color:#33ff00;}\n.user-meta{color:#1a8c00;font-size:.75rem;margin-top:1px;}\n.user-email{font-size:.6875rem;color:#116600;word-break:break-all;margin-top:1px;}\n\n.settings-layout{\n  max-width:920px;margin:0 auto;padding:28px 20px;\n  display:flex;gap:28px;\n}\n.settings-sidebar{width:200px;flex-shrink:0;}\n.settings-sidebar a{\n  display:block;padding:6px 10px;border-radius:6px;color:#1a8c00;\n  text-decoration:none;font-size:.8125rem;transition:color .15s;\n}\n.settings-sidebar a:hover{color:#33ff00;}\n.settings-sidebar a.active{color:#33ff00;font-weight:600;}\n.settings-main{flex:1;min-width:0;}\n\n.s-card{\n  padding:18px 0;margin-bottom:14px;border-bottom:1px solid #0a3300;\n}\n.s-card:last-child{border-bottom:none;}\n.s-card-header{display:flex;align-items:center;gap:14px;margin-bottom:14px;}\n.s-icon{\n  width:42px;height:42px;border-radius:8px;\n  background:#0a3300;display:flex;align-items:center;justify-content:center;\n  font-size:1.125rem;font-weight:700;color:#116600;flex-shrink:0;\n  font-family:'Geist Pixel',monospace;\n}\n.s-title{\n  font-family:'Geist Pixel',monospace;\n  font-size:1.25rem;font-weight:600;color:#33ff00;\n}\n.s-subtitle{font-size:.75rem;color:#1a8c00;margin-top:2px;}\n.section-heading{\n  font-size:.9375rem;font-weight:600;margin-bottom:10px;color:#33ff00;\n  display:flex;align-items:center;justify-content:space-between;\n}\n.perm-list{list-style:none;}\n.perm-list li{padding:5px 0;font-size:.8125rem;display:flex;align-items:center;gap:6px;color:#1a8c00;}\n.check{color:#33ff00;}\n.org-row{\n  display:flex;align-items:center;gap:8px;padding:7px 0;\n  border-bottom:1px solid #0a3300;font-size:.8125rem;\n}\n.org-row:last-child{border-bottom:none;}\n.org-icon{\n  width:22px;height:22px;border-radius:4px;background:#0a3300;\n  display:flex;align-items:center;justify-content:center;\n  font-size:.625rem;font-weight:700;color:#116600;flex-shrink:0;\n  font-family:'Geist Pixel',monospace;\n}\n.org-name{font-weight:600;color:#33ff00;}\n.badge{font-size:.6875rem;padding:1px 7px;border-radius:999px;font-weight:500;}\n.badge-granted{background:#0a3300;color:#33ff00;}\n.badge-denied{background:#1a0a0a;color:#ff4444;}\n.badge-requested{background:#0a3300;color:#1a8c00;}\n.btn-revoke{\n  display:inline-block;padding:5px 14px;border-radius:6px;\n  border:1px solid #0a3300;background:transparent;color:#ff4444;\n  font-size:.75rem;font-weight:600;cursor:pointer;transition:border-color .15s;\n}\n.btn-revoke:hover{border-color:#ff4444;}\n.info-text{color:#1a8c00;font-size:.75rem;line-height:1.5;margin-top:10px;}\n.info-text a,.section-heading a{color:#1a8c00;text-decoration:none;transition:color .15s;}\n.info-text a:hover,.section-heading a:hover{color:#33ff00;}\ncode{font-family:'Geist Mono','SF Mono',ui-monospace,monospace;font-size:.8125rem;color:#33ff00;word-break:break-all;}\n.code-block{\n  background:#020;border:1px solid #0a3300;border-radius:6px;padding:10px 12px;\n  margin:8px 0 12px;overflow-x:auto;\n}\n.code-block code{white-space:pre;word-break:normal;display:block;line-height:1.5;}\n.app-link{\n  display:flex;align-items:center;gap:12px;padding:12px;\n  border:1px solid #0a3300;border-radius:8px;background:#000;\n  text-decoration:none;color:inherit;margin-bottom:8px;transition:border-color .15s;\n}\n.app-link:hover{border-color:#33ff00;}\n.app-link-name{font-weight:600;font-size:.875rem;color:#33ff00;}\n.app-link-scopes{font-size:.6875rem;color:#1a8c00;margin-top:1px;}\n.empty{color:#1a8c00;text-align:center;padding:28px 0;font-size:.875rem;}\n\n.inspector-layout{max-width:960px;margin:0 auto;padding:28px 20px;}\n.inspector-tabs{display:flex;gap:4px;margin-bottom:20px;}\n.inspector-tabs a{\n  padding:7px 16px;border-radius:6px;text-decoration:none;\n  font-size:.8125rem;color:#1a8c00;border:1px solid transparent;\n  transition:color .15s,border-color .15s;\n}\n.inspector-tabs a:hover{color:#33ff00;}\n.inspector-tabs a.active{color:#33ff00;font-weight:600;border-color:#0a3300;background:#0a3300;}\n.inspector-section{margin-bottom:24px;}\n.inspector-section h2{\n  font-family:'Geist Pixel',monospace;\n  font-size:1rem;font-weight:600;color:#33ff00;margin-bottom:10px;\n}\n.inspector-section h3{\n  font-family:'Geist Pixel',monospace;\n  font-size:.875rem;font-weight:600;color:#1a8c00;margin:16px 0 8px;\n}\n.inspector-table{width:100%;border-collapse:collapse;margin-bottom:12px;}\n.inspector-table th,.inspector-table td{\n  text-align:left;padding:8px 12px;border-bottom:1px solid #0a3300;\n  font-size:.8125rem;\n}\n.inspector-table th{color:#1a8c00;font-weight:600;font-size:.75rem;text-transform:uppercase;letter-spacing:.04em;}\n.inspector-table td{color:#33ff00;}\n.inspector-table tbody tr{transition:background .1s;}\n.inspector-table tbody tr:hover{background:#0a3300;}\n.inspector-empty{color:#1a8c00;text-align:center;padding:20px 0;font-size:.8125rem;}\n\n.checkout-layout{\n  display:flex;min-height:calc(100vh - 42px);\n}\n.checkout-summary{\n  flex:1;background:#020;padding:48px 40px 48px 10%;\n  display:flex;flex-direction:column;justify-content:center;\n  border-right:1px solid #0a3300;\n}\n.checkout-form-side{\n  flex:1;background:#000;padding:48px 10% 48px 40px;\n  display:flex;flex-direction:column;justify-content:center;\n}\n.checkout-merchant{\n  display:flex;align-items:center;gap:10px;margin-bottom:6px;\n}\n.checkout-merchant-name{\n  font-family:'Geist Pixel',monospace;\n  font-size:.9375rem;font-weight:600;color:#33ff00;\n}\n.checkout-test-badge{\n  font-size:.625rem;font-weight:700;letter-spacing:.04em;text-transform:uppercase;\n  background:#0a3300;color:#1a8c00;padding:2px 8px;border-radius:4px;\n}\n.checkout-total{\n  font-family:'Geist Pixel',monospace;\n  font-size:2rem;font-weight:700;color:#33ff00;margin:8px 0 28px;\n}\n.checkout-line-item{\n  display:flex;align-items:center;gap:14px;padding:14px 0;\n  border-bottom:1px solid #0a3300;\n}\n.checkout-line-item:first-child{border-top:1px solid #0a3300;}\n.checkout-item-icon{\n  width:42px;height:42px;border-radius:6px;background:#0a3300;\n  display:flex;align-items:center;justify-content:center;flex-shrink:0;\n  font-family:'Geist Pixel',monospace;font-size:.875rem;font-weight:700;color:#116600;\n}\n.checkout-item-details{flex:1;min-width:0;}\n.checkout-item-name{font-size:.875rem;font-weight:600;color:#33ff00;}\n.checkout-item-qty{font-size:.75rem;color:#1a8c00;margin-top:2px;}\n.checkout-item-price{\n  font-size:.875rem;font-weight:600;color:#33ff00;text-align:right;white-space:nowrap;\n}\n.checkout-item-unit{font-size:.6875rem;color:#1a8c00;text-align:right;margin-top:2px;}\n.checkout-totals{margin-top:20px;}\n.checkout-totals-row{\n  display:flex;justify-content:space-between;padding:6px 0;\n  font-size:.8125rem;color:#1a8c00;\n}\n.checkout-totals-row.total{\n  border-top:1px solid #0a3300;margin-top:8px;padding-top:14px;\n  font-size:.9375rem;font-weight:600;color:#33ff00;\n}\n.checkout-form-section{margin-bottom:24px;}\n.checkout-form-label{\n  font-size:.8125rem;font-weight:600;color:#33ff00;margin-bottom:8px;display:block;\n}\n.checkout-input{\n  width:100%;padding:10px 12px;border:1px solid #0a3300;border-radius:6px;\n  background:#020;color:#33ff00;font:inherit;font-size:.875rem;\n  transition:border-color .15s;outline:none;\n}\n.checkout-input:focus{border-color:#33ff00;}\n.checkout-input::placeholder{color:#116600;}\n.checkout-card-box{\n  border:1px solid #0a3300;border-radius:6px;padding:14px;\n  background:#020;\n}\n.checkout-card-row{\n  display:flex;gap:12px;margin-top:10px;\n}\n.checkout-card-row .checkout-input{flex:1;}\n.checkout-sim-note{\n  font-size:.6875rem;color:#1a8c00;margin-top:10px;text-align:center;\n  font-style:italic;\n}\n.checkout-pay-btn{\n  width:100%;padding:14px;border:none;border-radius:8px;\n  background:#33ff00;color:#000;font:inherit;font-size:.9375rem;font-weight:700;\n  cursor:pointer;transition:background .15s;\n  font-family:'Geist Pixel',monospace;\n}\n.checkout-pay-btn:hover{background:#44ff22;}\n.checkout-cancel{\n  text-align:center;margin-top:14px;\n}\n.checkout-cancel a{\n  color:#1a8c00;text-decoration:none;font-size:.8125rem;\n  transition:color .15s;\n}\n.checkout-cancel a:hover{color:#33ff00;}\n@media(max-width:768px){\n  .checkout-layout{flex-direction:column;}\n  .checkout-summary{padding:32px 20px;border-right:none;border-bottom:1px solid #0a3300;}\n  .checkout-form-side{padding:32px 20px;}\n}\n`;\n\nconst POWERED_BY = `<div class=\"powered-by\">Powered by <a href=\"https://emulate.dev\" target=\"_blank\" rel=\"noopener\">emulate</a></div>`;\n\nfunction emuBar(service?: string): string {\n  const title = service ? `${escapeHtml(service)} Emulator` : \"Emulator\";\n  return `<div class=\"emu-bar\">\n  <span class=\"emu-bar-title\">${title}</span>\n  <nav class=\"emu-bar-links\">\n    <a href=\"https://github.com/vercel-labs/emulate/issues\" target=\"_blank\" rel=\"noopener\"><span class=\"full\">Report Issue</span><span class=\"short\">Report</span></a>\n    <a href=\"https://github.com/vercel-labs/emulate\" target=\"_blank\" rel=\"noopener\"><span class=\"full\">Source Code</span><span class=\"short\">Source</span></a>\n    <a href=\"https://emulate.dev\" target=\"_blank\" rel=\"noopener\"><span class=\"full\">Learn More</span><span class=\"short\">Learn</span></a>\n  </nav>\n</div>`;\n}\n\nfunction head(title: string): string {\n  return `<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\"/>\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1\"/>\n<link rel=\"icon\" href=\"/_emulate/favicon.ico\"/>\n<title>${escapeHtml(title)} | emulate</title>\n<style>${CSS}</style>\n</head>`;\n}\n\nexport function renderCardPage(title: string, subtitle: string, body: string, service?: string): string {\n  return `${head(title)}\n<body>\n${emuBar(service)}\n<div class=\"content\">\n  <div class=\"content-inner\">\n    <div class=\"card-title\">${escapeHtml(title)}</div>\n    <div class=\"card-subtitle\">${subtitle}</div>\n    ${body}\n  </div>\n</div>\n${POWERED_BY}\n</body></html>`;\n}\n\nexport function renderErrorPage(title: string, message: string, service?: string): string {\n  return `${head(title)}\n<body>\n${emuBar(service)}\n<div class=\"content\">\n  <div class=\"content-inner error-card\">\n    <div class=\"error-title\">${escapeHtml(title)}</div>\n    <div class=\"error-msg\">${escapeHtml(message)}</div>\n  </div>\n</div>\n${POWERED_BY}\n</body></html>`;\n}\n\nexport function renderSettingsPage(title: string, sidebarHtml: string, bodyHtml: string, service?: string): string {\n  return `${head(title)}\n<body>\n${emuBar(service)}\n<div class=\"settings-layout\">\n  <nav class=\"settings-sidebar\">${sidebarHtml}</nav>\n  <div class=\"settings-main\">${bodyHtml}</div>\n</div>\n${POWERED_BY}\n</body></html>`;\n}\n\nexport interface InspectorTab {\n  id: string;\n  label: string;\n  href: string;\n}\n\nexport function renderInspectorPage(\n  title: string,\n  tabs: InspectorTab[],\n  activeTab: string,\n  body: string,\n  service?: string,\n): string {\n  const tabLinks = tabs\n    .map(\n      (t) => `<a href=\"${escapeAttr(t.href)}\" class=\"${t.id === activeTab ? \"active\" : \"\"}\">${escapeHtml(t.label)}</a>`,\n    )\n    .join(\"\");\n\n  return `${head(title)}\n<body>\n${emuBar(service)}\n<div class=\"inspector-layout\">\n  <nav class=\"inspector-tabs\">${tabLinks}</nav>\n  ${body}\n</div>\n${POWERED_BY}\n</body></html>`;\n}\n\nexport function renderFormPostPage(action: string, fields: Record<string, string>, service?: string): string {\n  const hiddens = Object.entries(fields)\n    .filter(([, v]) => v != null)\n    .map(([k, v]) => `<input type=\"hidden\" name=\"${escapeAttr(k)}\" value=\"${escapeAttr(v)}\"/>`)\n    .join(\"\\n\");\n\n  return `${head(\"Redirecting\")}\n<body onload=\"document.forms[0].submit()\">\n${emuBar(service)}\n<div class=\"content\">\n  <div class=\"content-inner\" style=\"text-align:center\">\n    <div class=\"card-subtitle\">Redirecting&hellip;</div>\n    <form method=\"POST\" action=\"${escapeAttr(action)}\">\n${hiddens}\n    <noscript><button type=\"submit\" class=\"user-btn\" style=\"margin-top:12px;justify-content:center\">\n      <span class=\"user-login\">Continue</span>\n    </button></noscript>\n    </form>\n  </div>\n</div>\n${POWERED_BY}\n</body></html>`;\n}\n\nexport interface CheckoutLineItem {\n  name: string;\n  quantity: number;\n  unitPrice: number;\n  totalPrice: number;\n  currency: string;\n}\n\nexport interface CheckoutPageOptions {\n  merchantName?: string;\n  lineItems: CheckoutLineItem[];\n  subtotal: number;\n  total: number;\n  currency: string;\n  sessionId: string;\n  cancelUrl?: string | null;\n}\n\nexport function renderCheckoutPage(opts: CheckoutPageOptions, service?: string): string {\n  const fmt = (cents: number, cur: string) => `$${(cents / 100).toFixed(2)} ${cur.toUpperCase()}`;\n  const fmtShort = (cents: number) => `$${(cents / 100).toFixed(2)}`;\n\n  const itemsHtml =\n    opts.lineItems.length > 0\n      ? opts.lineItems\n          .map((li) => {\n            const initial = li.name.charAt(0).toUpperCase();\n            const unitNote =\n              li.quantity > 1 ? `<div class=\"checkout-item-unit\">${fmtShort(li.unitPrice)} each</div>` : \"\";\n            return `<div class=\"checkout-line-item\">\n  <div class=\"checkout-item-icon\">${escapeHtml(initial)}</div>\n  <div class=\"checkout-item-details\">\n    <div class=\"checkout-item-name\">${escapeHtml(li.name)}</div>\n    <div class=\"checkout-item-qty\">Qty ${li.quantity}</div>\n  </div>\n  <div>\n    <div class=\"checkout-item-price\">${fmtShort(li.totalPrice)}</div>\n    ${unitNote}\n  </div>\n</div>`;\n          })\n          .join(\"\")\n      : '<p class=\"empty\">No line items</p>';\n\n  const totalsHtml = `<div class=\"checkout-totals\">\n  <div class=\"checkout-totals-row\">\n    <span>Subtotal</span><span>${fmtShort(opts.subtotal)}</span>\n  </div>\n  <div class=\"checkout-totals-row total\">\n    <span>Total due</span><span>${fmt(opts.total, opts.currency)}</span>\n  </div>\n</div>`;\n\n  const cancelHtml = opts.cancelUrl\n    ? `<div class=\"checkout-cancel\"><a href=\"${escapeAttr(opts.cancelUrl)}\">Cancel</a></div>`\n    : \"\";\n\n  const merchant = opts.merchantName ? escapeHtml(opts.merchantName) : \"Checkout\";\n\n  return `${head(\"Checkout\")}\n<body>\n${emuBar(service)}\n<div class=\"checkout-layout\">\n  <div class=\"checkout-summary\">\n    <div class=\"checkout-merchant\">\n      <span class=\"checkout-merchant-name\">${merchant}</span>\n      <span class=\"checkout-test-badge\">Test Mode</span>\n    </div>\n    <div class=\"checkout-total\">${fmtShort(opts.total)}</div>\n    ${itemsHtml}\n    ${totalsHtml}\n  </div>\n  <div class=\"checkout-form-side\">\n    <form method=\"post\" action=\"/checkout/${escapeAttr(opts.sessionId)}/complete\">\n      <div class=\"checkout-form-section\">\n        <label class=\"checkout-form-label\">Email</label>\n        <input type=\"email\" name=\"email\" class=\"checkout-input\" placeholder=\"you@example.com\"/>\n      </div>\n      <div class=\"checkout-form-section\">\n        <label class=\"checkout-form-label\">Card information</label>\n        <div class=\"checkout-card-box\">\n          <input type=\"text\" class=\"checkout-input\" placeholder=\"1234 1234 1234 1234\" disabled/>\n          <div class=\"checkout-card-row\">\n            <input type=\"text\" class=\"checkout-input\" placeholder=\"MM / YY\" disabled/>\n            <input type=\"text\" class=\"checkout-input\" placeholder=\"CVC\" disabled/>\n          </div>\n        </div>\n        <div class=\"checkout-sim-note\">Card fields are simulated. Payment will be auto-approved.</div>\n      </div>\n      <button type=\"submit\" class=\"checkout-pay-btn\">Pay ${fmtShort(opts.total)}</button>\n    </form>\n    ${cancelHtml}\n  </div>\n</div>\n${POWERED_BY}\n</body></html>`;\n}\n\nexport interface UserButtonOptions {\n  letter: string;\n  login: string;\n  name?: string;\n  email?: string;\n  formAction: string;\n  hiddenFields: Record<string, string>;\n}\n\nexport function renderUserButton(opts: UserButtonOptions): string {\n  const hiddens = Object.entries(opts.hiddenFields)\n    .map(([k, v]) => `<input type=\"hidden\" name=\"${escapeAttr(k)}\" value=\"${escapeAttr(v)}\"/>`)\n    .join(\"\");\n\n  const nameLine = opts.name ? `<div class=\"user-meta\">${escapeHtml(opts.name)}</div>` : \"\";\n  const emailLine = opts.email ? `<div class=\"user-email\">${escapeHtml(opts.email)}</div>` : \"\";\n\n  return `<form class=\"user-form\" method=\"post\" action=\"${escapeAttr(opts.formAction)}\">\n${hiddens}\n<button type=\"submit\" class=\"user-btn\">\n  <span class=\"avatar\">${escapeHtml(opts.letter)}</span>\n  <span class=\"user-text\">\n    <span class=\"user-login\">${escapeHtml(opts.login)}</span>\n    ${nameLine}${emailLine}\n  </span>\n</button>\n</form>`;\n}\n","import type { Context, Hono } from \"./http.js\";\nimport type { AppEnv } from \"./middleware/auth.js\";\nimport type { Store } from \"./store.js\";\nimport type { WebhookDispatcher } from \"./webhooks.js\";\nimport type { RequestLedger } from \"./ledger.js\";\nimport type { ConnectionVars, EmulatorInstanceInfo, ResolvedConnection, ServiceManifest } from \"./manifest.js\";\nimport { coverageReport, enrichManifest, resolveConnections } from \"./manifest.js\";\nimport type { TokenMap } from \"./middleware/auth.js\";\nimport { escapeHtml, renderCardPage } from \"./ui.js\";\n\nexport interface CredentialRequest {\n  type?: string;\n  login?: string;\n  name?: string;\n  scopes?: string[];\n  client_id?: string;\n  client_secret?: string;\n  redirect_uris?: string[];\n  [key: string]: unknown;\n}\n\nexport interface IssuedCredential {\n  type: string;\n  token?: string;\n  login?: string;\n  scopes?: string[];\n  client_id?: string;\n  client_secret?: string;\n  redirect_uris?: string[];\n  token_url?: string;\n  authorization_url?: string;\n  notes?: string;\n  [key: string]: unknown;\n}\n\nexport interface ControlPlaneOptions {\n  manifest: ServiceManifest;\n  instance: EmulatorInstanceInfo;\n  store: Store;\n  webhooks: WebhookDispatcher;\n  ledger: RequestLedger;\n  tokenMap?: TokenMap;\n  /** True when the host persists the ledger across eviction (e.g. a Durable Object). */\n  ledgerPersistent?: boolean;\n  /** Host suffix for the deployed form, e.g. \"emulators.dev\". */\n  hostSuffix?: string;\n  reset?: () => void | Promise<void>;\n  seed?: (seed: unknown) => void | Promise<void>;\n  issueCredential?: (request: CredentialRequest) => IssuedCredential | Promise<IssuedCredential>;\n}\n\nexport const INSTANCE_NOTES = \"Hosted deployments create instances lazily when the returned URL is first used.\";\n\nexport interface InstanceCreation {\n  service: string;\n  instance: string;\n  providerBaseUrl: string;\n  controlBaseUrl: string;\n  pathUrl: string;\n  hostHint: string;\n  notes: string;\n}\n\n/** The single, canonical shape for POST /_emulate/instances, shared by every host. */\nexport function buildInstanceCreation(args: {\n  service: string;\n  instance: string;\n  providerBaseUrl: string;\n  pathOrigin: string;\n  hostSuffix: string;\n}): InstanceCreation {\n  return {\n    service: args.service,\n    instance: args.instance,\n    providerBaseUrl: args.providerBaseUrl,\n    controlBaseUrl: `${args.providerBaseUrl}/_emulate`,\n    pathUrl: `${args.pathOrigin}/${args.service}/${args.instance}`,\n    hostHint: `${args.service}.${args.instance}.${args.hostSuffix}`,\n    notes: INSTANCE_NOTES,\n  };\n}\n\nfunction connectionVars(\n  manifest: ServiceManifest,\n  instance: EmulatorInstanceInfo,\n  overrides?: Partial<ConnectionVars>,\n): ConnectionVars {\n  return {\n    baseUrl: instance.providerBaseUrl,\n    providerBaseUrl: instance.providerBaseUrl,\n    controlBaseUrl: instance.controlBaseUrl,\n    service: manifest.id,\n    instance: instance.instance,\n    defaultAuthType: manifest.auth[0]?.type ?? \"bearer-token\",\n    ...overrides,\n  };\n}\n\nexport function registerControlPlane(app: Hono<AppEnv>, options: ControlPlaneOptions): void {\n  const { instance, store, webhooks, ledger } = options;\n  const manifest = enrichManifest(options.manifest, { ledgerPersistent: options.ledgerPersistent });\n  const hostSuffix = options.hostSuffix ?? \"emulators.dev\";\n\n  app.get(\"/_emulate\", (c) => c.html(renderLandingPage(manifest, instance)));\n  app.get(\"/_emulate/manifest\", (c) =>\n    c.json({\n      manifest,\n      instance,\n      connections: resolveConnections(manifest.connections ?? [], connectionVars(manifest, instance)),\n    }),\n  );\n  app.get(\"/_emulate/quickstart\", (c) => c.text(renderQuickstart(manifest, instance)));\n  app.get(\"/_emulate/specs\", (c) => c.json({ specs: manifest.specs, surfaces: manifest.surfaces }));\n  app.get(\"/_emulate/coverage\", (c) => c.json(coverageReport(manifest)));\n  app.get(\"/_emulate/connections\", (c) => {\n    const overrides: Partial<ConnectionVars> = {};\n    const token = c.req.query(\"token\");\n    const clientId = c.req.query(\"client_id\");\n    const clientSecret = c.req.query(\"client_secret\");\n    if (token) overrides.token = token;\n    if (clientId) overrides.clientId = clientId;\n    if (clientSecret) overrides.clientSecret = clientSecret;\n    return c.json({\n      connections: resolveConnections(manifest.connections ?? [], connectionVars(manifest, instance, overrides)),\n    });\n  });\n  app.get(\"/_emulate/openapi\", (c) => redirectToSpec(c, manifest, instance, \"openapi\"));\n  app.get(\"/_emulate/graphql\", (c) => endpointForSurface(c, manifest, instance, \"graphql\"));\n  app.get(\"/_emulate/mcp\", (c) => endpointForSurface(c, manifest, instance, \"mcp\"));\n  app.get(\"/_emulate/state\", (c) => c.json(store.snapshot()));\n  app.get(\"/_emulate/ledger\", (c) => {\n    const limitParam = c.req.query(\"limit\");\n    const limit = limitParam ? Number.parseInt(limitParam, 10) : undefined;\n    return c.json({ entries: ledger.list(Number.isFinite(limit) ? limit : undefined) });\n  });\n  app.delete(\"/_emulate/ledger\", (c) => {\n    ledger.clear();\n    return c.json({ ok: true });\n  });\n  app.get(\"/_emulate/logs\", (c) => c.json({ webhooks: webhooks.getDeliveries(), requests: ledger.list(100) }));\n  app.post(\"/_emulate/reset\", async (c) => {\n    if (options.reset) {\n      await options.reset();\n    } else {\n      store.reset();\n      webhooks.clear();\n      ledger.clear();\n    }\n    return c.json({ ok: true });\n  });\n  app.post(\"/_emulate/seed\", async (c) => {\n    if (!options.seed) {\n      return c.json({ error: \"unsupported\", message: \"This emulator does not support runtime seeding.\" }, 501);\n    }\n    const body = await c.req.json().catch(() => undefined);\n    try {\n      await options.seed(body);\n    } catch (err) {\n      return c.json({ error: \"invalid_seed\", message: err instanceof Error ? err.message : \"Seed failed.\" }, 400);\n    }\n    return c.json({ ok: true });\n  });\n  app.post(\"/_emulate/credentials\", async (c) => {\n    const body = (await c.req.json().catch(() => ({}))) as CredentialRequest;\n    try {\n      if (options.issueCredential) {\n        const credential = await options.issueCredential(body);\n        return c.json({ credential });\n      }\n      const credential = issueDefaultCredential(body, manifest, options.tokenMap);\n      if (!credential) {\n        return c.json({ error: \"unsupported\", message: \"This emulator cannot create that credential type.\" }, 501);\n      }\n      return c.json({ credential });\n    } catch (err) {\n      return c.json(\n        { error: \"unsupported\", message: err instanceof Error ? err.message : \"Credential creation failed.\" },\n        400,\n      );\n    }\n  });\n  app.post(\"/_emulate/instances\", async (c) => {\n    const body = (await c.req.json().catch(() => ({}))) as { instance?: string; service?: string };\n    const nextInstance = slug(body.instance ?? `${manifest.id}-${randomId().slice(0, 8)}`);\n    const service = slug(body.service ?? manifest.id);\n    const origin = new URL(instance.providerBaseUrl).origin;\n    return c.json(\n      buildInstanceCreation({\n        service,\n        instance: nextInstance,\n        providerBaseUrl: `${origin}/${service}/${nextInstance}`,\n        pathOrigin: origin,\n        hostSuffix,\n      }),\n    );\n  });\n}\n\nexport function renderLandingPage(manifest: ServiceManifest, instance: EmulatorInstanceInfo): string {\n  const surfaces = manifest.surfaces\n    .map(\n      (surface) =>\n        `<tr><td>${escapeHtml(surface.title)}</td><td><span class=\"badge\">${escapeHtml(surface.status)}</span></td><td><code>${escapeHtml(surface.basePath ?? \"\")}</code></td></tr>`,\n    )\n    .join(\"\");\n  const auth = manifest.auth\n    .map((cap) => `<li><span class=\"badge\">${escapeHtml(cap.status)}</span> ${escapeHtml(cap.title)}</li>`)\n    .join(\"\");\n  const connections = resolveConnections(manifest.connections ?? [], connectionVars(manifest, instance));\n  const instanceLabel = instance.instance ? ` · instance <code>${escapeHtml(instance.instance)}</code>` : \"\";\n\n  return renderCardPage(\n    `${manifest.name} Emulator`,\n    escapeHtml(manifest.description),\n    `\n      <div class=\"s-card\">\n        <div class=\"section-heading\">Base URLs${instanceLabel}</div>\n        <p class=\"info-text\">Provider: <code>${escapeHtml(instance.providerBaseUrl)}</code></p>\n        <p class=\"info-text\">Control: <code>${escapeHtml(instance.controlBaseUrl)}</code></p>\n      </div>\n      <div class=\"s-card\">\n        <div class=\"section-heading\">Surfaces</div>\n        <table class=\"inspector-table\">\n          <thead><tr><th>Surface</th><th>Status</th><th>Path</th></tr></thead>\n          <tbody>${surfaces}</tbody>\n        </table>\n      </div>\n      <div class=\"s-card\">\n        <div class=\"section-heading\">Credentials</div>\n        <ul class=\"perm-list\">${auth}</ul>\n      </div>\n      ${renderConnectionsHtml(connections)}\n      <div class=\"s-card\">\n        <div class=\"section-heading\">Control API</div>\n        <p class=\"info-text\">${controlLinks()}</p>\n      </div>\n    `,\n    manifest.id,\n  );\n}\n\nfunction renderConnectionsHtml(connections: ResolvedConnection[]): string {\n  if (connections.length === 0) return \"\";\n  const blocks = connections\n    .map(\n      (c) =>\n        `<div class=\"section-heading\">${escapeHtml(c.title)}</div><pre class=\"code-block\"><code>${escapeHtml(c.body)}</code></pre>`,\n    )\n    .join(\"\");\n  return `<div class=\"s-card\"><div class=\"section-heading\">Connect</div>${blocks}</div>`;\n}\n\nfunction controlLinks(): string {\n  const routes = [\"manifest\", \"quickstart\", \"specs\", \"coverage\", \"connections\", \"state\", \"ledger\", \"logs\"];\n  return routes.map((r) => `<a href=\"/_emulate/${r}\">${r}</a>`).join(\" | \");\n}\n\nexport function renderQuickstart(manifest: ServiceManifest, instance: EmulatorInstanceInfo): string {\n  const connections = resolveConnections(manifest.connections ?? [], connectionVars(manifest, instance));\n  const lines = [\n    `# ${manifest.name} Emulator`,\n    \"\",\n    manifest.description,\n    \"\",\n    `Provider base URL: ${instance.providerBaseUrl}`,\n    `Control base URL: ${instance.controlBaseUrl}`,\n    \"\",\n    \"Supported surfaces:\",\n    ...manifest.surfaces.map((s) => `- ${s.title}: ${s.status}${s.basePath ? ` at ${s.basePath}` : \"\"}`),\n    \"\",\n    \"Control endpoints:\",\n    `- ${instance.controlBaseUrl}/manifest`,\n    `- ${instance.controlBaseUrl}/coverage`,\n    `- ${instance.controlBaseUrl}/connections`,\n    `- ${instance.controlBaseUrl}/state`,\n    `- ${instance.controlBaseUrl}/ledger`,\n    `- POST ${instance.controlBaseUrl}/credentials`,\n    `- POST ${instance.controlBaseUrl}/seed`,\n    `- POST ${instance.controlBaseUrl}/reset`,\n    \"\",\n    \"Connect:\",\n    ...connections.flatMap((c) => [\"\", `## ${c.title}`, c.body]),\n  ];\n  return lines.join(\"\\n\");\n}\n\nfunction issueDefaultCredential(\n  request: CredentialRequest,\n  manifest: ServiceManifest,\n  tokenMap: TokenMap | undefined,\n): IssuedCredential | null {\n  const type = request.type ?? manifest.auth[0]?.type ?? \"bearer-token\";\n  if (type !== \"bearer-token\" && type !== \"api-key\") return null;\n  if (!tokenMap) return null;\n  const token = typeof request.token === \"string\" && request.token ? request.token : `emu_${manifest.id}_${randomId()}`;\n  const login = request.login ?? \"admin\";\n  const scopes = Array.isArray(request.scopes) ? request.scopes.filter((s): s is string => typeof s === \"string\") : [];\n  tokenMap.set(token, { login, id: Date.now(), scopes });\n  return { type, token, login, scopes };\n}\n\nfunction redirectToSpec(c: Context<AppEnv>, manifest: ServiceManifest, instance: EmulatorInstanceInfo, kind: string) {\n  const spec = manifest.specs.find((s) => s.kind === kind && s.url);\n  if (spec?.url) return c.redirect(resolveUrl(instance.providerBaseUrl, spec.url));\n  const advertised = manifest.specs.some((s) => s.kind === kind);\n  if (kind === \"openapi\" && advertised) return c.redirect(`${instance.providerBaseUrl}/openapi.json`);\n  return c.json({ error: \"not_found\", message: `No ${kind} spec is advertised for this emulator.` }, 404);\n}\n\nfunction endpointForSurface(\n  c: Context<AppEnv>,\n  manifest: ServiceManifest,\n  instance: EmulatorInstanceInfo,\n  kind: \"graphql\" | \"mcp\",\n) {\n  const surface = manifest.surfaces.find((s) => s.kind === kind && s.basePath);\n  if (!surface?.basePath) {\n    return c.json({ error: \"not_found\", message: `No ${kind} surface is advertised for this emulator.` }, 404);\n  }\n  return c.json({ endpoint: resolveUrl(instance.providerBaseUrl, surface.basePath), surface });\n}\n\nfunction resolveUrl(baseUrl: string, pathOrUrl: string): string {\n  if (/^https?:\\/\\//i.test(pathOrUrl)) return pathOrUrl;\n  return `${baseUrl}${pathOrUrl.startsWith(\"/\") ? \"\" : \"/\"}${pathOrUrl}`;\n}\n\nfunction randomId(): string {\n  return crypto.randomUUID().replace(/-/g, \"\");\n}\n\nfunction slug(value: string): string {\n  return value\n    .toLowerCase()\n    .replace(/[^a-z0-9-]/g, \"-\")\n    .replace(/-+/g, \"-\")\n    .replace(/^-|-$/g, \"\");\n}\n","import { Hono, cors } from \"./http.js\";\nimport { Store } from \"./store.js\";\nimport { WebhookDispatcher } from \"./webhooks.js\";\nimport { createApiErrorHandler, createErrorHandler } from \"./middleware/error-handler.js\";\nimport {\n  authMiddleware,\n  type AuthFallback,\n  type TokenMap,\n  type AppKeyResolver,\n  type AppEnv,\n} from \"./middleware/auth.js\";\nimport type { ServicePlugin } from \"./plugin.js\";\nimport { registerFontRoutes } from \"./fonts.js\";\nimport { RequestLedger, createLedgerMiddleware } from \"./ledger.js\";\nimport { registerControlPlane, type CredentialRequest, type IssuedCredential } from \"./control-plane.js\";\nimport { createDefaultManifest, type ServiceManifest } from \"./manifest.js\";\n\nexport interface ServerOptions {\n  port?: number;\n  baseUrl?: string;\n  docsUrl?: string;\n  tokens?: Record<string, { login: string; id: number; scopes?: string[] }>;\n  appKeyResolver?: AppKeyResolver;\n  fallbackUser?: AuthFallback;\n  manifest?: ServiceManifest;\n  instance?: string;\n  enableControlPlane?: boolean;\n  /** True when the host persists the ledger across eviction (e.g. a Durable Object). */\n  ledgerPersistent?: boolean;\n  /** Host suffix for the deployed form surfaced in control-plane responses. */\n  hostSuffix?: string;\n  reset?: () => void | Promise<void>;\n  seed?: (seed: unknown) => void | Promise<void>;\n  issueCredential?: (request: CredentialRequest) => IssuedCredential | Promise<IssuedCredential>;\n}\n\nexport function createServer(plugin: ServicePlugin, options: ServerOptions = {}) {\n  const port = options.port ?? 4000;\n  const baseUrl = options.baseUrl ?? `http://localhost:${port}`;\n\n  const app = new Hono<AppEnv>();\n  const store = new Store();\n  const webhooks = new WebhookDispatcher();\n  const ledger = new RequestLedger();\n\n  const tokenMap: TokenMap = new Map();\n  if (options.tokens) {\n    for (const [token, user] of Object.entries(options.tokens)) {\n      tokenMap.set(token, {\n        login: user.login,\n        id: user.id,\n        scopes: user.scopes ?? [\"repo\", \"user\", \"admin:org\", \"admin:repo_hook\"],\n      });\n    }\n  }\n\n  const docsUrl = options.docsUrl ?? `https://docs.emulators.dev/${plugin.name}`;\n\n  registerFontRoutes(app);\n\n  app.onError(createApiErrorHandler(docsUrl));\n  app.use(\"*\", cors());\n  app.use(\"*\", createErrorHandler(docsUrl));\n  app.use(\"*\", authMiddleware(tokenMap, options.appKeyResolver, options.fallbackUser));\n\n  if (options.enableControlPlane !== false) {\n    const manifest = options.manifest ?? createDefaultManifest(plugin.name);\n    registerControlPlane(app, {\n      manifest,\n      instance: {\n        service: manifest.id,\n        instance: options.instance,\n        baseUrl,\n        providerBaseUrl: baseUrl,\n        controlBaseUrl: `${baseUrl}/_emulate`,\n      },\n      store,\n      webhooks,\n      ledger,\n      tokenMap,\n      ledgerPersistent: options.ledgerPersistent,\n      hostSuffix: options.hostSuffix,\n      reset: options.reset,\n      seed: options.seed,\n      issueCredential: options.issueCredential,\n    });\n  }\n\n  app.use(\"*\", createLedgerMiddleware(ledger, { webhooks }));\n\n  const rateLimitCounters = new Map<string, { remaining: number; resetAt: number }>();\n  let lastPruneAt = Math.floor(Date.now() / 1000);\n\n  app.use(\"*\", async (c, next) => {\n    const token = c.get(\"authToken\") ?? \"__anonymous__\";\n    const now = Math.floor(Date.now() / 1000);\n\n    if (now - lastPruneAt > 3600) {\n      for (const [key, val] of rateLimitCounters) {\n        if (val.resetAt <= now) rateLimitCounters.delete(key);\n      }\n      lastPruneAt = now;\n    }\n\n    let counter = rateLimitCounters.get(token);\n    if (!counter || counter.resetAt <= now) {\n      counter = { remaining: 5000, resetAt: now + 3600 };\n      rateLimitCounters.set(token, counter);\n    }\n\n    counter.remaining = Math.max(0, counter.remaining - 1);\n\n    c.header(\"X-RateLimit-Limit\", \"5000\");\n    c.header(\"X-RateLimit-Remaining\", String(counter.remaining));\n    c.header(\"X-RateLimit-Reset\", String(counter.resetAt));\n    c.header(\"X-RateLimit-Resource\", \"core\");\n\n    if (counter.remaining === 0) {\n      return c.json(\n        {\n          message: \"API rate limit exceeded\",\n          documentation_url: docsUrl,\n        },\n        403,\n      );\n    }\n\n    await next();\n  });\n\n  plugin.register(app, store, webhooks, baseUrl, tokenMap);\n\n  app.notFound((c) =>\n    c.json(\n      {\n        message: \"Not Found\",\n        documentation_url: docsUrl,\n      },\n      404,\n    ),\n  );\n\n  return { app, store, webhooks, ledger, port, baseUrl, tokenMap };\n}\n","import type { EmulatorInstanceInfo, ServiceManifest } from \"./manifest.js\";\nimport { coverageReport, enrichManifest, resolveConnections } from \"./manifest.js\";\nimport { escapeHtml, renderCardPage } from \"./ui.js\";\nimport { renderQuickstart, INSTANCE_NOTES } from \"./control-plane.js\";\n\nexport interface ServiceHostContext {\n  manifest: ServiceManifest;\n  service: string;\n  /** Apex origin for the path form, e.g. https://emulators.dev. */\n  origin: string;\n  /** Request protocol including the colon, e.g. \"https:\". */\n  protocol: string;\n  /** Host suffix for the deployed form, e.g. \"emulators.dev\". */\n  hostSuffix: string;\n  /** Whether the deployed host persists the ledger across eviction. */\n  ledgerPersistent?: boolean;\n}\n\nconst SAMPLE_INSTANCE = \"your-instance\";\n\nfunction sampleInstanceInfo(ctx: ServiceHostContext): EmulatorInstanceInfo {\n  const providerBaseUrl = `${ctx.protocol}//${ctx.service}.${SAMPLE_INSTANCE}.${ctx.hostSuffix}`;\n  return {\n    service: ctx.service,\n    instance: SAMPLE_INSTANCE,\n    baseUrl: providerBaseUrl,\n    providerBaseUrl,\n    controlBaseUrl: `${providerBaseUrl}/_emulate`,\n  };\n}\n\nfunction json(data: unknown, status = 200): Response {\n  return new Response(JSON.stringify(data), {\n    status,\n    headers: { \"content-type\": \"application/json; charset=utf-8\" },\n  });\n}\n\n/**\n * Serve the service-level control plane on a bare service host (e.g.\n * github.emulators.dev) so a human or agent can read the manifest, quickstart,\n * specs, coverage, and connection snippets WITHOUT first creating an instance.\n * Returns null for paths this should not handle (so the caller can fall through\n * to the interactive console SPA).\n */\nexport function serviceHostControlPlane(path: string, method: string, ctx: ServiceHostContext): Response | null {\n  if (!path.startsWith(\"/_emulate\")) return null;\n  if (method !== \"GET\" && method !== \"HEAD\") return null;\n\n  const manifest = enrichManifest(ctx.manifest, { ledgerPersistent: ctx.ledgerPersistent });\n  const sample = sampleInstanceInfo(ctx);\n  const connections = resolveConnections(manifest.connections ?? [], {\n    baseUrl: sample.providerBaseUrl,\n    providerBaseUrl: sample.providerBaseUrl,\n    controlBaseUrl: sample.controlBaseUrl,\n    service: ctx.service,\n    instance: SAMPLE_INSTANCE,\n    defaultAuthType: manifest.auth[0]?.type ?? \"bearer-token\",\n  });\n\n  switch (path) {\n    case \"/_emulate\":\n      return new Response(renderServiceLanding(manifest, ctx, sample), {\n        headers: { \"content-type\": \"text/html; charset=utf-8\" },\n      });\n    case \"/_emulate/manifest\":\n      return json({ manifest, instance: null, sampleInstance: sample, connections });\n    case \"/_emulate/quickstart\":\n      return new Response(renderServiceQuickstart(manifest, ctx, sample), {\n        headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n      });\n    case \"/_emulate/specs\":\n      return json({ specs: manifest.specs, surfaces: manifest.surfaces });\n    case \"/_emulate/coverage\":\n      return json(coverageReport(manifest));\n    case \"/_emulate/connections\":\n      return json({ connections });\n    case \"/_emulate/openapi\": {\n      const spec = manifest.specs.find((s) => s.kind === \"openapi\");\n      if (!spec) return json({ error: \"not_found\", message: \"No OpenAPI spec is advertised for this emulator.\" }, 404);\n      return json({\n        openapi: `${sample.providerBaseUrl}${spec.url ?? \"/openapi.json\"}`,\n        note: \"Create an instance, then fetch this URL for the live spec.\",\n      });\n    }\n    default:\n      return null;\n  }\n}\n\nfunction renderServiceQuickstart(\n  manifest: ServiceManifest,\n  ctx: ServiceHostContext,\n  sample: EmulatorInstanceInfo,\n): string {\n  const base = renderQuickstart(manifest, sample);\n  const header = [\n    `# ${manifest.name} Emulator (service host)`,\n    \"\",\n    \"Create an instance:\",\n    `curl -s -X POST ${ctx.protocol}//${ctx.service}.${ctx.hostSuffix}/_emulate/instances -H 'content-type: application/json' -d '{\"instance\":\"my-run\"}'`,\n    `# ${INSTANCE_NOTES}`,\n    \"\",\n    \"Then use the returned providerBaseUrl / controlBaseUrl. Example below uses a sample instance.\",\n    \"\",\n  ];\n  return header.join(\"\\n\") + base;\n}\n\nfunction renderServiceLanding(\n  manifest: ServiceManifest,\n  ctx: ServiceHostContext,\n  sample: EmulatorInstanceInfo,\n): string {\n  const surfaces = manifest.surfaces\n    .map(\n      (s) =>\n        `<tr><td>${escapeHtml(s.title)}</td><td><span class=\"badge\">${escapeHtml(s.status)}</span></td><td><code>${escapeHtml(s.basePath ?? \"\")}</code></td></tr>`,\n    )\n    .join(\"\");\n  const createCurl = `curl -s -X POST ${ctx.protocol}//${ctx.service}.${ctx.hostSuffix}/_emulate/instances \\\\\n  -H \"content-type: application/json\" \\\\\n  -d '{\"instance\":\"my-run\"}'`;\n\n  return renderCardPage(\n    `${manifest.name} Emulator`,\n    escapeHtml(manifest.description),\n    `\n      <div class=\"s-card\">\n        <div class=\"section-heading\">Create an instance</div>\n        <p class=\"info-text\">Each instance is isolated, stateful, and addressable at its own host.</p>\n        <pre class=\"code-block\"><code>${escapeHtml(createCurl)}</code></pre>\n        <p class=\"info-text\">${escapeHtml(INSTANCE_NOTES)}</p>\n        <p class=\"info-text\">Sample instance host: <code>${escapeHtml(sample.providerBaseUrl)}</code></p>\n      </div>\n      <div class=\"s-card\">\n        <div class=\"section-heading\">Surfaces</div>\n        <table class=\"inspector-table\">\n          <thead><tr><th>Surface</th><th>Status</th><th>Path</th></tr></thead>\n          <tbody>${surfaces}</tbody>\n        </table>\n      </div>\n      <div class=\"s-card\">\n        <div class=\"section-heading\">Control API</div>\n        <p class=\"info-text\">\n          <a href=\"/_emulate/manifest\">manifest</a> | <a href=\"/_emulate/quickstart\">quickstart</a> |\n          <a href=\"/_emulate/specs\">specs</a> | <a href=\"/_emulate/coverage\">coverage</a> |\n          <a href=\"/_emulate/connections\">connections</a>\n        </p>\n      </div>\n    `,\n    manifest.id,\n  );\n}\n\nexport interface ServiceCatalogEntry {\n  id: string;\n  name: string;\n  description: string;\n}\n\n/**\n * Server-rendered catalog landing for the apex host. Readable by an agent over a\n * raw fetch (no JS): it lists every emulator with its host and manifest URL. The\n * interactive console SPA is served instead only for browser navigations.\n */\nexport function renderCatalogPage(\n  entries: ServiceCatalogEntry[],\n  ctx: { origin: string; protocol: string; hostSuffix: string },\n): string {\n  const rows = entries\n    .map((e) => {\n      const host = `${ctx.protocol}//${e.id}.${ctx.hostSuffix}`;\n      return `<a class=\"app-link\" href=\"${escapeHtml(host)}\">\n        <img src=\"/_emulate/icons/${escapeHtml(e.id)}\" alt=\"\" width=\"24\" height=\"24\" style=\"object-fit:contain\" />\n        <span><span class=\"app-link-name\">${escapeHtml(e.name)}</span><span class=\"app-link-scopes\">${escapeHtml(host)}</span></span>\n      </a>`;\n    })\n    .join(\"\");\n  return renderCardPage(\n    \"Emulate\",\n    \"Stateful integration emulators for real developer APIs. Each emulator has its own host; open one or fetch its manifest.\",\n    `\n      <div class=\"s-card\">\n        <div class=\"section-heading\">Emulators</div>\n        ${rows}\n      </div>\n      <div class=\"s-card\">\n        <div class=\"section-heading\">For agents</div>\n        <p class=\"info-text\">Machine-readable catalog: <a href=\"/_emulate/services\">/_emulate/services</a></p>\n        <p class=\"info-text\">Each service host serves <code>/_emulate/manifest</code>, <code>/_emulate/quickstart</code>, and <code>/_emulate/connections</code>, and the provider API directly against a default instance.</p>\n      </div>\n    `,\n  );\n}\n\n/** A machine-readable index of the services a host serves, with both URL forms. */\nexport function servicesCatalog(\n  entries: ServiceCatalogEntry[],\n  ctx: { origin: string; protocol: string; hostSuffix: string },\n): Response {\n  const services = entries.map((e) => ({\n    id: e.id,\n    name: e.name,\n    description: e.description,\n    icon: `${ctx.origin}/_emulate/icons/${e.id}`,\n    serviceHost: `${ctx.protocol}//${e.id}.${ctx.hostSuffix}`,\n    instanceHostPattern: `${ctx.protocol}//${e.id}.<instance>.${ctx.hostSuffix}`,\n    pathForm: `${ctx.origin}/${e.id}/<instance>`,\n    manifest: `${ctx.protocol}//${e.id}.${ctx.hostSuffix}/_emulate/manifest`,\n  }));\n  return new Response(JSON.stringify({ services }), {\n    headers: { \"content-type\": \"application/json; charset=utf-8\" },\n  });\n}\n","import type { Context } from \"../http.js\";\n\nexport interface PaginationParams {\n  page: number;\n  per_page: number;\n}\n\nexport function parsePagination(c: Context): PaginationParams {\n  const page = Math.max(1, parseInt(c.req.query(\"page\") ?? \"1\", 10) || 1);\n  const per_page = Math.min(100, Math.max(1, parseInt(c.req.query(\"per_page\") ?? \"30\", 10) || 30));\n  return { page, per_page };\n}\n\nexport function setLinkHeader(c: Context, totalCount: number, page: number, perPage: number): void {\n  const lastPage = Math.max(1, Math.ceil(totalCount / perPage));\n  const baseUrl = new URL(c.req.url);\n  const links: string[] = [];\n\n  const makeLink = (p: number, rel: string) => {\n    baseUrl.searchParams.set(\"page\", String(p));\n    baseUrl.searchParams.set(\"per_page\", String(perPage));\n    return `<${baseUrl.toString()}>; rel=\"${rel}\"`;\n  };\n\n  if (page < lastPage) {\n    links.push(makeLink(page + 1, \"next\"));\n    links.push(makeLink(lastPage, \"last\"));\n  }\n  if (page > 1) {\n    links.push(makeLink(1, \"first\"));\n    links.push(makeLink(page - 1, \"prev\"));\n  }\n\n  if (links.length > 0) {\n    c.header(\"Link\", links.join(\", \"));\n  }\n}\n","import { timingSafeEqual } from \"crypto\";\n\nexport function normalizeUri(uri: string): string {\n  try {\n    const u = new URL(uri);\n    return `${u.origin}${u.pathname.replace(/\\/+$/, \"\")}`;\n  } catch {\n    return uri.replace(/\\/+$/, \"\").split(\"?\")[0];\n  }\n}\n\nexport function matchesRedirectUri(incoming: string, registered: string[]): boolean {\n  const normalized = normalizeUri(incoming);\n  return registered.some((r) => normalizeUri(r) === normalized);\n}\n\nexport function constantTimeSecretEqual(a: string, b: string): boolean {\n  const bufA = Buffer.from(a, \"utf-8\");\n  const bufB = Buffer.from(b, \"utf-8\");\n  if (bufA.length !== bufB.length) return false;\n  return timingSafeEqual(bufA, bufB);\n}\n\nexport function bodyStr(v: unknown): string {\n  if (typeof v === \"string\") return v;\n  if (Array.isArray(v) && typeof v[0] === \"string\") return v[0];\n  return \"\";\n}\n\nexport function parseCookies(header: string): Record<string, string> {\n  const cookies: Record<string, string> = {};\n  for (const part of header.split(\";\")) {\n    const [k, ...v] = part.split(\"=\");\n    if (k) cookies[k.trim()] = v.join(\"=\").trim();\n  }\n  return cookies;\n}\n","import { readFile, writeFile, mkdir } from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\n\nexport interface PersistenceAdapter {\n  load(): Promise<string | null>;\n  save(data: string): Promise<void>;\n}\n\nexport function filePersistence(path: string): PersistenceAdapter {\n  return {\n    async load() {\n      try {\n        return await readFile(path, \"utf-8\");\n      } catch {\n        return null;\n      }\n    },\n    async save(data: string) {\n      await mkdir(dirname(path), { recursive: true });\n      await writeFile(path, data, \"utf-8\");\n    },\n  };\n}\n","import { SignJWT, exportJWK, generateKeyPair } from \"jose\";\n\n// One RS256 keypair per process; served from BOTH JWKS surfaces the WorkOS\n// stack reads: /sso/jwks/:clientId (the node SDK's sealed-session verify) and\n// /oauth2/jwks (AuthKit-domain consumers, e.g. MCP resource servers).\nconst keyPairPromise = generateKeyPair(\"RS256\", { extractable: true });\nexport const KID = \"emulate-workos-1\";\n\nexport async function jwksResponse(): Promise<{ keys: Record<string, unknown>[] }> {\n  const { publicKey } = await keyPairPromise;\n  const jwk = await exportJWK(publicKey);\n  return { keys: [{ ...jwk, kid: KID, use: \"sig\", alg: \"RS256\" }] };\n}\n\nexport interface AccessTokenClaims {\n  sub: string; // user id\n  sid: string; // session id\n  org_id?: string;\n  role?: string;\n  permissions?: string[];\n  [key: string]: unknown;\n}\n\nexport async function signAccessToken(\n  claims: AccessTokenClaims,\n  options: { issuer: string; audience?: string; expiresIn?: string },\n): Promise<string> {\n  const { privateKey } = await keyPairPromise;\n  let jwt = new SignJWT(claims)\n    .setProtectedHeader({ alg: \"RS256\", kid: KID, typ: \"JWT\" })\n    .setIssuer(options.issuer)\n    .setIssuedAt()\n    .setJti(`jti_${Math.random().toString(36).slice(2)}`)\n    .setExpirationTime(options.expiresIn ?? \"1h\");\n  if (options.audience) jwt = jwt.setAudience(options.audience);\n  return jwt.sign(privateKey);\n}\n","import type { Context } from \"@emulators/core\";\n\nimport type {\n  WorkosApiKey,\n  WorkosInvitation,\n  WorkosMembership,\n  WorkosOrganization,\n  WorkosUser,\n  WorkosVaultObject,\n} from \"./entities.js\";\n\nlet counter = 0;\n/** WorkOS-shaped ids: prefix + monotonic + entropy (readable in ledgers/tests). */\nexport function workosId(prefix: string): string {\n  counter += 1;\n  return `${prefix}_${String(counter).padStart(4, \"0\")}${Math.random().toString(36).slice(2, 8).toUpperCase()}`;\n}\n\nexport function randomToken(prefix: string): string {\n  return `${prefix}_${Math.random().toString(36).slice(2)}${Math.random().toString(36).slice(2)}`;\n}\n\n/** WorkOS error envelope. */\nexport function workosError(c: Context, status: number, code: string, message: string): Response {\n  return c.json({ code, message, error: code, error_description: message }, status as 404);\n}\n\n/** Single-page WorkOS list envelope. */\nexport function listEnvelope<T>(data: T[]): {\n  object: \"list\";\n  data: T[];\n  list_metadata: { before: null; after: null };\n  listMetadata: { before: null; after: null };\n} {\n  return {\n    object: \"list\",\n    data,\n    list_metadata: { before: null, after: null },\n    // Some SDK paths read the camelCase variant on raw responses.\n    listMetadata: { before: null, after: null },\n  };\n}\n\n// --- serializers: store entities → WorkOS wire shapes (snake_case) ---------\n\nexport function serializeUser(user: WorkosUser): Record<string, unknown> {\n  return {\n    object: \"user\",\n    id: user.workos_id,\n    email: user.email,\n    email_verified: user.email_verified,\n    first_name: user.first_name,\n    last_name: user.last_name,\n    profile_picture_url: user.profile_picture_url,\n    last_sign_in_at: user.updated_at,\n    external_id: null,\n    metadata: {},\n    created_at: user.created_at,\n    updated_at: user.updated_at,\n  };\n}\n\nexport function serializeOrganization(org: WorkosOrganization): Record<string, unknown> {\n  return {\n    object: \"organization\",\n    id: org.workos_id,\n    name: org.name,\n    allow_profiles_outside_organization: false,\n    domains: [],\n    stripe_customer_id: null,\n    external_id: org.external_id,\n    metadata: {},\n    created_at: org.created_at,\n    updated_at: org.updated_at,\n  };\n}\n\nexport function serializeMembership(\n  membership: WorkosMembership,\n  organizationName: string,\n): Record<string, unknown> {\n  return {\n    object: \"organization_membership\",\n    id: membership.workos_id,\n    user_id: membership.user_id,\n    organization_id: membership.organization_id,\n    organization_name: organizationName,\n    status: membership.status,\n    role: { slug: membership.role_slug },\n    created_at: membership.created_at,\n    updated_at: membership.updated_at,\n  };\n}\n\nexport function serializeInvitation(invitation: WorkosInvitation): Record<string, unknown> {\n  return {\n    object: \"invitation\",\n    id: invitation.workos_id,\n    email: invitation.email,\n    state: invitation.state,\n    organization_id: invitation.organization_id,\n    inviter_user_id: invitation.inviter_user_id,\n    accepted_user_id: null,\n    token: invitation.token,\n    accept_invitation_url: `https://example.invalid/invite/${invitation.token}`,\n    expires_at: invitation.expires_at,\n    created_at: invitation.created_at,\n    updated_at: invitation.updated_at,\n  };\n}\n\nexport function serializeApiKey(\n  key: WorkosApiKey,\n  options: { includeValue?: boolean } = {},\n): Record<string, unknown> {\n  return {\n    object: \"api_key\",\n    id: key.workos_id,\n    name: key.name,\n    obfuscated_value: `${key.value.slice(0, 7)}…${key.value.slice(-4)}`,\n    owner: { type: \"user\", id: key.user_id, organization_id: key.organization_id },\n    last_used_at: key.last_used_at,\n    created_at: key.created_at,\n    updated_at: key.updated_at,\n    ...(options.includeValue ? { value: key.value } : {}),\n  };\n}\n\nexport function serializeVaultMetadata(object: WorkosVaultObject): Record<string, unknown> {\n  return {\n    id: object.workos_id,\n    context: object.key_context,\n    environment_id: \"environment_emulate\",\n    key_id: \"key_emulate\",\n    updated_at: object.updated_at,\n    updated_by: { id: \"key_emulate\", name: \"emulate\" },\n    version_id: object.version_id,\n  };\n}\n\nexport function serializeVaultObject(object: WorkosVaultObject): Record<string, unknown> {\n  return {\n    id: object.workos_id,\n    name: object.name,\n    value: object.value,\n    metadata: serializeVaultMetadata(object),\n  };\n}\n\n/** Parse `statuses` from repeated params, comma lists, or bracket arrays. */\nexport function parseStatuses(c: Context): string[] {\n  const repeated = c.req.queries(\"statuses\") ?? [];\n  const bracketed = c.req.queries(\"statuses[]\") ?? [];\n  return [...repeated, ...bracketed].flatMap((value) => value.split(\",\")).filter(Boolean);\n}\n","import type { Context } from \"@emulators/core\";\nimport { renderCardPage, renderUserButton, escapeHtml, type RouteContext } from \"@emulators/core\";\n\nimport { getWorkosStore, type WorkosStore } from \"../store.js\";\nimport type { WorkosUser } from \"../entities.js\";\nimport { signAccessToken } from \"../keys.js\";\nimport {\n  listEnvelope,\n  parseStatuses,\n  randomToken,\n  serializeApiKey,\n  serializeInvitation,\n  serializeMembership,\n  serializeUser,\n  workosError,\n  workosId,\n} from \"../helpers.js\";\n\n/** Resolve a user by email, creating one when asked (the e2e fresh-identity path). */\nexport function ensureUserByEmail(ws: WorkosStore, email: string): WorkosUser {\n  const existing = ws.users.findOneBy(\"email\", email);\n  if (existing) return existing;\n  return ws.users.insert({\n    workos_id: workosId(\"user\"),\n    email,\n    first_name: \"Test\",\n    last_name: \"User\",\n    email_verified: true,\n    profile_picture_url: null,\n  });\n}\n\nasync function authenticationResponse(\n  c: Context,\n  ws: WorkosStore,\n  baseUrl: string,\n  user: WorkosUser,\n  organizationId: string | null,\n  clientId: string,\n): Promise<Response> {\n  const session = ws.sessions.insert({\n    workos_id: workosId(\"session\"),\n    refresh_token: randomToken(\"rt\"),\n    user_id: user.workos_id,\n    organization_id: organizationId,\n    client_id: clientId,\n    revoked: false,\n  });\n  const membership = organizationId\n    ? ws.memberships\n        .findBy(\"user_id\", user.workos_id)\n        .find((m) => m.organization_id === organizationId)\n    : undefined;\n  const accessToken = await signAccessToken(\n    {\n      sub: user.workos_id,\n      sid: session.workos_id,\n      ...(organizationId ? { org_id: organizationId } : {}),\n      ...(membership ? { role: membership.role_slug } : {}),\n      permissions: [],\n    },\n    { issuer: baseUrl, audience: clientId },\n  );\n  return c.json({\n    user: serializeUser(user),\n    organization_id: organizationId,\n    access_token: accessToken,\n    refresh_token: session.refresh_token,\n    authentication_method: \"SSO\",\n  });\n}\n\nexport function userManagementRoutes(ctx: RouteContext): void {\n  const { app, store, baseUrl } = ctx;\n  const ws = () => getWorkosStore(store);\n\n  // --- Hosted AuthKit login (the SDK's getAuthorizationUrl points here) ----\n  app.get(\"/user_management/authorize\", (c) => {\n    const clientId = c.req.query(\"client_id\") ?? \"\";\n    const redirectUri = c.req.query(\"redirect_uri\") ?? \"\";\n    const state = c.req.query(\"state\") ?? \"\";\n    // Headless path: ?login_hint=email signs that user straight in (creating\n    // them if new) — what e2e identity minting uses. No hint → hosted page.\n    const loginHint = c.req.query(\"login_hint\");\n    if (loginHint) {\n      return issueCodeRedirect(c, ws(), loginHint, clientId, redirectUri, state);\n    }\n    const users = ws().users.all();\n    const buttons = users\n      .map((user) =>\n        renderUserButton({\n          letter: (user.email[0] ?? \"?\").toUpperCase(),\n          login: user.email,\n          name: `${user.first_name ?? \"\"} ${user.last_name ?? \"\"}`.trim() || user.email,\n          email: user.email,\n          formAction: `${baseUrl}/user_management/authorize/submit`,\n          hiddenFields: { email: user.email, client_id: clientId, redirect_uri: redirectUri, state },\n        }),\n      )\n      .join(\"\\n\");\n    const newUserForm = `\n      <form method=\"post\" action=\"${baseUrl}/user_management/authorize/submit\" class=\"new-user\">\n        <input type=\"hidden\" name=\"client_id\" value=\"${escapeHtml(clientId)}\" />\n        <input type=\"hidden\" name=\"redirect_uri\" value=\"${escapeHtml(redirectUri)}\" />\n        <input type=\"hidden\" name=\"state\" value=\"${escapeHtml(state)}\" />\n        <input type=\"email\" name=\"email\" class=\"checkout-input\" placeholder=\"new-user@example.com\" required />\n        <button type=\"submit\" class=\"checkout-pay-btn\">Continue as new user</button>\n      </form>`;\n    return c.html(\n      renderCardPage(\n        \"Sign in with AuthKit\",\n        \"Pick an existing emulator user or continue as a new one.\",\n        `${buttons}${newUserForm}`,\n      ),\n      200,\n    );\n  });\n\n  app.post(\"/user_management/authorize/submit\", async (c) => {\n    const form = await c.req.parseBody();\n    const email = String(form.email ?? \"\");\n    if (!email) return workosError(c, 422, \"invalid_request\", \"email is required\");\n    return issueCodeRedirect(\n      c,\n      ws(),\n      email,\n      String(form.client_id ?? \"\"),\n      String(form.redirect_uri ?? \"\"),\n      String(form.state ?? \"\"),\n    );\n  });\n\n  function issueCodeRedirect(\n    c: Context,\n    storeRef: WorkosStore,\n    email: string,\n    clientId: string,\n    redirectUri: string,\n    state: string,\n  ): Response {\n    if (!redirectUri) return workosError(c, 422, \"invalid_request\", \"redirect_uri is required\");\n    const user = ensureUserByEmail(storeRef, email);\n    const code = randomToken(\"code\");\n    const activeMembership = storeRef.memberships\n      .findBy(\"user_id\", user.workos_id)\n      .find((m) => m.status === \"active\");\n    storeRef.authCodes.insert({\n      code,\n      user_id: user.workos_id,\n      organization_id: activeMembership?.organization_id ?? null,\n      client_id: clientId,\n      redirect_uri: redirectUri,\n      used: false,\n    });\n    const target = new URL(redirectUri);\n    target.searchParams.set(\"code\", code);\n    if (state) target.searchParams.set(\"state\", state);\n    return c.redirect(target.toString(), 302);\n  }\n\n  // --- Token endpoint: authorization_code + refresh_token grants -----------\n  app.post(\"/user_management/authenticate\", async (c) => {\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const grantType = String(body.grant_type ?? \"\");\n    const clientId = String(body.client_id ?? \"\");\n\n    if (grantType === \"authorization_code\") {\n      const code = String(body.code ?? \"\");\n      const authCode = ws().authCodes.findOneBy(\"code\", code);\n      if (!authCode || authCode.used) {\n        return workosError(c, 400, \"invalid_grant\", \"The code is invalid or has been used.\");\n      }\n      ws().authCodes.update(authCode.id, { used: true });\n      const user = ws().users.findOneBy(\"workos_id\", authCode.user_id);\n      if (!user) return workosError(c, 400, \"invalid_grant\", \"Unknown user for code.\");\n      return authenticationResponse(c, ws(), baseUrl, user, authCode.organization_id, clientId);\n    }\n\n    if (grantType === \"refresh_token\") {\n      const refreshToken = String(body.refresh_token ?? \"\");\n      const session = ws().sessions.findOneBy(\"refresh_token\", refreshToken);\n      if (!session || session.revoked) {\n        return workosError(c, 400, \"invalid_grant\", \"Refresh token is invalid.\");\n      }\n      const user = ws().users.findOneBy(\"workos_id\", session.user_id);\n      if (!user) return workosError(c, 400, \"invalid_grant\", \"Unknown user for session.\");\n      const requestedOrg =\n        typeof body.organization_id === \"string\" && body.organization_id.length > 0\n          ? body.organization_id\n          : session.organization_id;\n      if (requestedOrg) {\n        const membership = ws()\n          .memberships.findBy(\"user_id\", user.workos_id)\n          .find((m) => m.organization_id === requestedOrg && m.status === \"active\");\n        if (!membership) {\n          return workosError(\n            c,\n            403,\n            \"sso_required\",\n            \"User does not have an active membership in the requested organization.\",\n          );\n        }\n        const organization = ws().organizations.findOneBy(\"workos_id\", requestedOrg);\n        if (!organization) return workosError(c, 404, \"not_found\", \"Organization not found.\");\n      }\n      ws().sessions.update(session.id, { revoked: true });\n      return authenticationResponse(c, ws(), baseUrl, user, requestedOrg ?? null, clientId);\n    }\n\n    return workosError(c, 400, \"unsupported_grant_type\", `Unsupported grant_type: ${grantType}`);\n  });\n\n  // --- Users ----------------------------------------------------------------\n  app.get(\"/user_management/users/:id\", (c) => {\n    const user = ws().users.findOneBy(\"workos_id\", c.req.param(\"id\"));\n    if (!user) return workosError(c, 404, \"entity_not_found\", \"User not found.\");\n    return c.json(serializeUser(user));\n  });\n\n  // --- Organization memberships ----------------------------------------------\n  app.get(\"/user_management/organization_memberships\", (c) => {\n    const userId = c.req.query(\"user_id\");\n    const organizationId = c.req.query(\"organization_id\");\n    const statuses = parseStatuses(c);\n    let memberships = ws().memberships.all();\n    if (userId) memberships = memberships.filter((m) => m.user_id === userId);\n    if (organizationId) {\n      memberships = memberships.filter((m) => m.organization_id === organizationId);\n    }\n    if (statuses.length > 0) memberships = memberships.filter((m) => statuses.includes(m.status));\n    return c.json(\n      listEnvelope(\n        memberships.map((m) =>\n          serializeMembership(\n            m,\n            ws().organizations.findOneBy(\"workos_id\", m.organization_id)?.name ??\n              m.organization_id,\n          ),\n        ),\n      ),\n    );\n  });\n\n  app.post(\"/user_management/organization_memberships\", async (c) => {\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const userId = String(body.user_id ?? \"\");\n    const organizationId = String(body.organization_id ?? \"\");\n    const user = ws().users.findOneBy(\"workos_id\", userId);\n    const organization = ws().organizations.findOneBy(\"workos_id\", organizationId);\n    if (!user) return workosError(c, 404, \"entity_not_found\", \"User not found.\");\n    if (!organization) return workosError(c, 404, \"entity_not_found\", \"Organization not found.\");\n    const existing = ws()\n      .memberships.findBy(\"user_id\", userId)\n      .find((m) => m.organization_id === organizationId);\n    if (existing) {\n      return workosError(c, 409, \"organization_membership_already_exists\", \"Already a member.\");\n    }\n    const membership = ws().memberships.insert({\n      workos_id: workosId(\"om\"),\n      user_id: userId,\n      organization_id: organizationId,\n      status: \"active\",\n      role_slug: typeof body.role_slug === \"string\" && body.role_slug ? body.role_slug : \"member\",\n    });\n    return c.json(serializeMembership(membership, organization.name), 201);\n  });\n\n  app.get(\"/user_management/organization_memberships/:id\", (c) => {\n    const membership = ws().memberships.findOneBy(\"workos_id\", c.req.param(\"id\"));\n    if (!membership) return workosError(c, 404, \"entity_not_found\", \"Membership not found.\");\n    const organizationName =\n      ws().organizations.findOneBy(\"workos_id\", membership.organization_id)?.name ??\n      membership.organization_id;\n    return c.json(serializeMembership(membership, organizationName));\n  });\n\n  app.put(\"/user_management/organization_memberships/:id\", async (c) => {\n    const membership = ws().memberships.findOneBy(\"workos_id\", c.req.param(\"id\"));\n    if (!membership) return workosError(c, 404, \"entity_not_found\", \"Membership not found.\");\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const updated = ws().memberships.update(membership.id, {\n      role_slug:\n        typeof body.role_slug === \"string\" && body.role_slug\n          ? body.role_slug\n          : membership.role_slug,\n    })!;\n    const organizationName =\n      ws().organizations.findOneBy(\"workos_id\", updated.organization_id)?.name ??\n      updated.organization_id;\n    return c.json(serializeMembership(updated, organizationName));\n  });\n\n  app.delete(\"/user_management/organization_memberships/:id\", (c) => {\n    const membership = ws().memberships.findOneBy(\"workos_id\", c.req.param(\"id\"));\n    if (!membership) return workosError(c, 404, \"entity_not_found\", \"Membership not found.\");\n    ws().memberships.delete(membership.id);\n    return c.body(null, 204);\n  });\n\n  // --- Invitations ------------------------------------------------------------\n  app.get(\"/user_management/invitations\", (c) => {\n    const email = c.req.query(\"email\");\n    const organizationId = c.req.query(\"organization_id\");\n    let invitations = ws().invitations.all();\n    if (email) invitations = invitations.filter((i) => i.email === email);\n    if (organizationId) {\n      invitations = invitations.filter((i) => i.organization_id === organizationId);\n    }\n    return c.json(listEnvelope(invitations.map(serializeInvitation)));\n  });\n\n  app.post(\"/user_management/invitations\", async (c) => {\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const email = String(body.email ?? \"\");\n    const organizationId = String(body.organization_id ?? \"\");\n    if (!email) return workosError(c, 422, \"invalid_request\", \"email is required\");\n    if (!ws().organizations.findOneBy(\"workos_id\", organizationId)) {\n      return workosError(c, 404, \"entity_not_found\", \"Organization not found.\");\n    }\n    const invitation = ws().invitations.insert({\n      workos_id: workosId(\"invitation\"),\n      email,\n      organization_id: organizationId,\n      inviter_user_id: typeof body.inviter_user_id === \"string\" ? body.inviter_user_id : null,\n      role_slug: typeof body.role_slug === \"string\" ? body.role_slug : null,\n      state: \"pending\",\n      token: randomToken(\"invite\"),\n      expires_at: new Date(Date.now() + 7 * 24 * 3600 * 1000).toISOString(),\n    });\n    return c.json(serializeInvitation(invitation), 201);\n  });\n\n  app.post(\"/user_management/invitations/:id/accept\", (c) => {\n    const invitation = ws().invitations.findOneBy(\"workos_id\", c.req.param(\"id\"));\n    if (!invitation) return workosError(c, 404, \"entity_not_found\", \"Invitation not found.\");\n    if (invitation.state !== \"pending\") {\n      return workosError(c, 400, \"invalid_request\", \"Invitation is not pending.\");\n    }\n    const updated = ws().invitations.update(invitation.id, { state: \"accepted\" })!;\n    const user = ws().users.findOneBy(\"email\", invitation.email);\n    if (user) {\n      const already = ws()\n        .memberships.findBy(\"user_id\", user.workos_id)\n        .find((m) => m.organization_id === invitation.organization_id);\n      if (!already) {\n        ws().memberships.insert({\n          workos_id: workosId(\"om\"),\n          user_id: user.workos_id,\n          organization_id: invitation.organization_id,\n          status: \"active\",\n          role_slug: invitation.role_slug ?? \"member\",\n        });\n      }\n    }\n    return c.json(serializeInvitation(updated));\n  });\n\n  // --- User API keys (the app calls these via raw workos.get/post) ------------\n  app.get(\"/user_management/users/:id/api_keys\", (c) => {\n    const userId = c.req.param(\"id\");\n    const organizationId = c.req.query(\"organization_id\");\n    let keys = ws().apiKeys.findBy(\"user_id\", userId);\n    if (organizationId) keys = keys.filter((k) => k.organization_id === organizationId);\n    return c.json(listEnvelope(keys.map((k) => serializeApiKey(k))));\n  });\n\n  app.post(\"/user_management/users/:id/api_keys\", async (c) => {\n    const userId = c.req.param(\"id\");\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const user = ws().users.findOneBy(\"workos_id\", userId);\n    if (!user) return workosError(c, 404, \"entity_not_found\", \"User not found.\");\n    const key = ws().apiKeys.insert({\n      workos_id: workosId(\"key\"),\n      name: String(body.name ?? \"api key\"),\n      value: randomToken(\"sk_emulate\"),\n      user_id: userId,\n      organization_id: String(body.organization_id ?? \"\"),\n      last_used_at: null,\n    });\n    return c.json(serializeApiKey(key, { includeValue: true }), 201);\n  });\n}\n","import type { RouteContext } from \"@emulators/core\";\n\nimport { getWorkosStore } from \"../store.js\";\nimport { listEnvelope, serializeOrganization, workosError, workosId } from \"../helpers.js\";\n\nexport function organizationRoutes(ctx: RouteContext): void {\n  const { app, store, baseUrl } = ctx;\n  const ws = () => getWorkosStore(store);\n\n  app.post(\"/organizations\", async (c) => {\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const name = String(body.name ?? \"\");\n    if (!name) return workosError(c, 422, \"invalid_request\", \"name is required\");\n    const organization = ws().organizations.insert({\n      workos_id: workosId(\"org\"),\n      name,\n      external_id: typeof body.external_id === \"string\" ? body.external_id : null,\n    });\n    return c.json(serializeOrganization(organization), 201);\n  });\n\n  app.get(\"/organizations/:id\", (c) => {\n    const organization = ws().organizations.findOneBy(\"workos_id\", c.req.param(\"id\"));\n    if (!organization) return workosError(c, 404, \"entity_not_found\", \"Organization not found.\");\n    return c.json(serializeOrganization(organization));\n  });\n\n  app.put(\"/organizations/:id\", async (c) => {\n    const organization = ws().organizations.findOneBy(\"workos_id\", c.req.param(\"id\"));\n    if (!organization) return workosError(c, 404, \"entity_not_found\", \"Organization not found.\");\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const updated = ws().organizations.update(organization.id, {\n      name: typeof body.name === \"string\" && body.name ? body.name : organization.name,\n    })!;\n    return c.json(serializeOrganization(updated));\n  });\n\n  app.get(\"/organizations/:id/roles\", (c) => {\n    const organization = ws().organizations.findOneBy(\"workos_id\", c.req.param(\"id\"));\n    if (!organization) return workosError(c, 404, \"entity_not_found\", \"Organization not found.\");\n    const now = new Date().toISOString();\n    const role = (slug: string, name: string) => ({\n      object: \"role\",\n      id: `role_${slug}`,\n      name,\n      slug,\n      description: null,\n      permissions: [],\n      resource_type_slug: \"organization\",\n      type: \"OrganizationRole\",\n      created_at: now,\n      updated_at: now,\n    });\n    return c.json(listEnvelope([role(\"admin\", \"Admin\"), role(\"member\", \"Member\")]));\n  });\n\n  // Domain-verification portal link (cloud's org routes call this).\n  app.post(\"/portal/generate_link\", async (c) => {\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const organization = String(body.organization ?? \"\");\n    return c.json({ link: `${baseUrl}/_portal/${organization}?intent=${body.intent ?? \"\"}` });\n  });\n\n  app.get(\"/organization_domains/:id\", (c) =>\n    c.json({\n      object: \"organization_domain\",\n      id: c.req.param(\"id\"),\n      organization_id: \"org_unknown\",\n      domain: \"example.com\",\n      state: \"verified\",\n      verification_strategy: \"dns\",\n      verification_token: \"token\",\n    }),\n  );\n\n  app.delete(\"/organization_domains/:id\", (c) => c.body(null, 204));\n}\n","import type { RouteContext } from \"@emulators/core\";\n\nimport { getWorkosStore } from \"../store.js\";\nimport { serializeApiKey, workosError } from \"../helpers.js\";\n\nexport function apiKeyRoutes(ctx: RouteContext): void {\n  const { app, store } = ctx;\n  const ws = () => getWorkosStore(store);\n\n  // The SDK's apiKeys.validateApiKey → POST /api_keys/validations\n  app.post(\"/api_keys/validations\", async (c) => {\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const value = String(body.value ?? \"\");\n    const key = ws().apiKeys.findOneBy(\"value\", value);\n    if (!key) return workosError(c, 404, \"invalid_api_key\", \"API key is invalid.\");\n    ws().apiKeys.update(key.id, { last_used_at: new Date().toISOString() });\n    return c.json({ api_key: serializeApiKey(key) });\n  });\n\n  app.delete(\"/api_keys/:id\", (c) => {\n    const key = ws().apiKeys.findOneBy(\"workos_id\", c.req.param(\"id\"));\n    if (!key) return workosError(c, 404, \"entity_not_found\", \"API key not found.\");\n    ws().apiKeys.delete(key.id);\n    return c.body(null, 204);\n  });\n}\n","import type { RouteContext } from \"@emulators/core\";\n\nimport { getWorkosStore } from \"../store.js\";\nimport {\n  listEnvelope,\n  randomToken,\n  serializeVaultMetadata,\n  serializeVaultObject,\n  workosError,\n  workosId,\n} from \"../helpers.js\";\n\n/** WorkOS Vault KV — the executor secret store's backend. */\nexport function vaultRoutes(ctx: RouteContext): void {\n  const { app, store } = ctx;\n  const ws = () => getWorkosStore(store);\n\n  app.post(\"/vault/v1/kv\", async (c) => {\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const name = String(body.name ?? \"\");\n    if (!name) return workosError(c, 400, \"invalid_request\", \"name is required\");\n    if (ws().vaultObjects.findOneBy(\"name\", name)) {\n      return workosError(c, 409, \"conflict\", `An object named '${name}' already exists.`);\n    }\n    const object = ws().vaultObjects.insert({\n      workos_id: workosId(\"kv\"),\n      name,\n      value: String(body.value ?? \"\"),\n      key_context: (body.key_context as Record<string, unknown>) ?? {},\n      version_id: randomToken(\"version\"),\n    });\n    return c.json(serializeVaultMetadata(object), 201);\n  });\n\n  app.get(\"/vault/v1/kv\", (c) =>\n    c.json(\n      listEnvelope(\n        ws()\n          .vaultObjects.all()\n          .map((object) => ({ id: object.workos_id, name: object.name })),\n      ),\n    ),\n  );\n\n  app.get(\"/vault/v1/kv/name/:name\", (c) => {\n    const object = ws().vaultObjects.findOneBy(\"name\", c.req.param(\"name\"));\n    if (!object) return workosError(c, 404, \"not_found\", \"Object not found.\");\n    return c.json(serializeVaultObject(object));\n  });\n\n  app.get(\"/vault/v1/kv/:id\", (c) => {\n    const object = ws().vaultObjects.findOneBy(\"workos_id\", c.req.param(\"id\"));\n    if (!object) return workosError(c, 404, \"not_found\", \"Object not found.\");\n    return c.json(serializeVaultObject(object));\n  });\n\n  app.put(\"/vault/v1/kv/:id\", async (c) => {\n    const object = ws().vaultObjects.findOneBy(\"workos_id\", c.req.param(\"id\"));\n    if (!object) return workosError(c, 404, \"not_found\", \"Object not found.\");\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const versionCheck = body.version_check;\n    if (typeof versionCheck === \"string\" && versionCheck !== object.version_id) {\n      return workosError(c, 409, \"conflict\", \"Version check failed.\");\n    }\n    const updated = ws().vaultObjects.update(object.id, {\n      value: String(body.value ?? object.value),\n      version_id: randomToken(\"version\"),\n    })!;\n    return c.json(serializeVaultObject(updated));\n  });\n\n  app.delete(\"/vault/v1/kv/:id\", (c) => {\n    const object = ws().vaultObjects.findOneBy(\"workos_id\", c.req.param(\"id\"));\n    if (!object) return workosError(c, 404, \"not_found\", \"Object not found.\");\n    ws().vaultObjects.delete(object.id);\n    return c.body(null, 204);\n  });\n}\n","import { renderCardPage, renderUserButton, escapeHtml, type RouteContext } from \"@emulators/core\";\n\nimport { getWorkosStore } from \"../store.js\";\nimport { ensureUserByEmail } from \"./user-management.js\";\nimport { jwksResponse, signAccessToken } from \"../keys.js\";\nimport { randomToken, workosError, workosId } from \"../helpers.js\";\n\n/**\n * The AuthKit-domain surface (what MCP_AUTHKIT_DOMAIN points at): JWKS, OAuth\n * authorization-server metadata, dynamic client registration, authorize, and\n * token — enough for an MCP client (mcporter, Claude, …) to complete OAuth\n * against the emulator, and for resource servers to verify the minted JWTs.\n * The SDK's sealed-session verify reads /sso/jwks/:clientId — same keypair.\n */\nexport function oauthRoutes(ctx: RouteContext): void {\n  const { app, store, baseUrl } = ctx;\n  const ws = () => getWorkosStore(store);\n\n  app.get(\"/sso/jwks/:clientId\", async (c) => c.json(await jwksResponse()));\n  app.get(\"/oauth2/jwks\", async (c) => c.json(await jwksResponse()));\n\n  app.get(\"/.well-known/oauth-authorization-server\", (c) =>\n    c.json({\n      issuer: baseUrl,\n      authorization_endpoint: `${baseUrl}/oauth2/authorize`,\n      token_endpoint: `${baseUrl}/oauth2/token`,\n      registration_endpoint: `${baseUrl}/oauth2/register`,\n      jwks_uri: `${baseUrl}/oauth2/jwks`,\n      response_types_supported: [\"code\"],\n      grant_types_supported: [\"authorization_code\", \"refresh_token\"],\n      code_challenge_methods_supported: [\"S256\"],\n      token_endpoint_auth_methods_supported: [\"client_secret_post\", \"none\"],\n    }),\n  );\n\n  app.post(\"/oauth2/register\", async (c) => {\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const client = ws().oauthClients.insert({\n      client_id: workosId(\"client\"),\n      client_secret: null,\n      redirect_uris: Array.isArray(body.redirect_uris) ? (body.redirect_uris as string[]) : [],\n      name: typeof body.client_name === \"string\" ? body.client_name : null,\n    });\n    return c.json(\n      {\n        client_id: client.client_id,\n        client_id_issued_at: Math.floor(Date.now() / 1000),\n        redirect_uris: client.redirect_uris,\n        grant_types: [\"authorization_code\", \"refresh_token\"],\n        response_types: [\"code\"],\n        token_endpoint_auth_method: \"none\",\n      },\n      201,\n    );\n  });\n\n  app.get(\"/oauth2/authorize\", (c) => {\n    const clientId = c.req.query(\"client_id\") ?? \"\";\n    const redirectUri = c.req.query(\"redirect_uri\") ?? \"\";\n    const state = c.req.query(\"state\") ?? \"\";\n    const codeChallenge = c.req.query(\"code_challenge\") ?? \"\";\n    const loginHint = c.req.query(\"login_hint\");\n    if (!redirectUri) return workosError(c, 422, \"invalid_request\", \"redirect_uri is required\");\n\n    const issue = (email: string) => {\n      const user = ensureUserByEmail(ws(), email);\n      const activeMembership = ws()\n        .memberships.findBy(\"user_id\", user.workos_id)\n        .find((m) => m.status === \"active\");\n      const code = randomToken(\"mcpcode\");\n      ws().oauthCodes.insert({\n        code,\n        user_id: user.workos_id,\n        organization_id: activeMembership?.organization_id ?? null,\n        client_id: clientId,\n        redirect_uri: redirectUri,\n        code_challenge: codeChallenge || null,\n        used: false,\n      });\n      const target = new URL(redirectUri);\n      target.searchParams.set(\"code\", code);\n      if (state) target.searchParams.set(\"state\", state);\n      return c.redirect(target.toString(), 302);\n    };\n\n    if (loginHint) return issue(loginHint);\n\n    const users = ws().users.all();\n    const buttons = users\n      .map((user) =>\n        renderUserButton({\n          letter: (user.email[0] ?? \"?\").toUpperCase(),\n          login: user.email,\n          name: `${user.first_name ?? \"\"} ${user.last_name ?? \"\"}`.trim() || user.email,\n          email: user.email,\n          formAction: `${baseUrl}/oauth2/authorize/submit`,\n          hiddenFields: {\n            email: user.email,\n            client_id: clientId,\n            redirect_uri: redirectUri,\n            state,\n            code_challenge: codeChallenge,\n          },\n        }),\n      )\n      .join(\"\\n\");\n    const newUserForm = `\n      <form method=\"post\" action=\"${baseUrl}/oauth2/authorize/submit\" class=\"new-user\">\n        <input type=\"hidden\" name=\"client_id\" value=\"${escapeHtml(clientId)}\" />\n        <input type=\"hidden\" name=\"redirect_uri\" value=\"${escapeHtml(redirectUri)}\" />\n        <input type=\"hidden\" name=\"state\" value=\"${escapeHtml(state)}\" />\n        <input type=\"hidden\" name=\"code_challenge\" value=\"${escapeHtml(codeChallenge)}\" />\n        <input type=\"email\" name=\"email\" class=\"checkout-input\" placeholder=\"new-user@example.com\" required />\n        <button type=\"submit\" class=\"checkout-pay-btn\">Continue as new user</button>\n      </form>`;\n    return c.html(\n      renderCardPage(\"Authorize MCP client\", \"Sign in to connect this MCP client.\", `${buttons}${newUserForm}`),\n      200,\n    );\n  });\n\n  app.post(\"/oauth2/authorize/submit\", async (c) => {\n    const form = await c.req.parseBody();\n    const email = String(form.email ?? \"\");\n    const redirectUri = String(form.redirect_uri ?? \"\");\n    if (!email || !redirectUri) {\n      return workosError(c, 422, \"invalid_request\", \"email and redirect_uri are required\");\n    }\n    const user = ensureUserByEmail(ws(), email);\n    const activeMembership = ws()\n      .memberships.findBy(\"user_id\", user.workos_id)\n      .find((m) => m.status === \"active\");\n    const code = randomToken(\"mcpcode\");\n    ws().oauthCodes.insert({\n      code,\n      user_id: user.workos_id,\n      organization_id: activeMembership?.organization_id ?? null,\n      client_id: String(form.client_id ?? \"\"),\n      redirect_uri: redirectUri,\n      code_challenge: String(form.code_challenge ?? \"\") || null,\n      used: false,\n    });\n    const target = new URL(redirectUri);\n    target.searchParams.set(\"code\", code);\n    const state = String(form.state ?? \"\");\n    if (state) target.searchParams.set(\"state\", state);\n    return c.redirect(target.toString(), 302);\n  });\n\n  app.post(\"/oauth2/token\", async (c) => {\n    const contentType = c.req.header(\"content-type\") ?? \"\";\n    const body = contentType.includes(\"json\")\n      ? ((await c.req.json().catch(() => ({}))) as Record<string, unknown>)\n      : ((await c.req.parseBody()) as Record<string, unknown>);\n    const grantType = String(body.grant_type ?? \"\");\n\n    if (grantType === \"refresh_token\") {\n      const refreshToken = String(body.refresh_token ?? \"\");\n      const session = ws().sessions.findOneBy(\"refresh_token\", refreshToken);\n      if (!session || session.revoked) {\n        return workosError(c, 400, \"invalid_grant\", \"Refresh token is invalid.\");\n      }\n      ws().sessions.update(session.id, { revoked: true });\n      const rotated = ws().sessions.insert({\n        workos_id: workosId(\"session\"),\n        refresh_token: randomToken(\"rt\"),\n        user_id: session.user_id,\n        organization_id: session.organization_id,\n        client_id: session.client_id,\n        revoked: false,\n      });\n      const audience = process.env.EMULATE_WORKOS_AUDIENCE ?? session.client_id;\n      const accessToken = await signAccessToken(\n        {\n          sub: session.user_id,\n          sid: rotated.workos_id,\n          ...(session.organization_id ? { org_id: session.organization_id } : {}),\n          permissions: [],\n        },\n        { issuer: baseUrl, audience },\n      );\n      return c.json({\n        access_token: accessToken,\n        token_type: \"Bearer\",\n        expires_in: 3600,\n        refresh_token: rotated.refresh_token,\n      });\n    }\n\n    if (grantType !== \"authorization_code\") {\n      return workosError(c, 400, \"unsupported_grant_type\", `Unsupported grant_type: ${grantType}`);\n    }\n    const code = String(body.code ?? \"\");\n    const oauthCode = ws().oauthCodes.findOneBy(\"code\", code);\n    if (!oauthCode || oauthCode.used) {\n      return workosError(c, 400, \"invalid_grant\", \"The code is invalid or has been used.\");\n    }\n    ws().oauthCodes.update(oauthCode.id, { used: true });\n    // Resource servers verify audience against THEIR WorkOS client id, not the\n    // DCR client's — mirror AuthKit: EMULATE_WORKOS_AUDIENCE (the app's client\n    // id) when set, else the requesting client.\n    const audience = process.env.EMULATE_WORKOS_AUDIENCE ?? oauthCode.client_id;\n    const session = ws().sessions.insert({\n      workos_id: workosId(\"session\"),\n      refresh_token: randomToken(\"rt\"),\n      user_id: oauthCode.user_id,\n      organization_id: oauthCode.organization_id,\n      client_id: oauthCode.client_id,\n      revoked: false,\n    });\n    const accessToken = await signAccessToken(\n      {\n        sub: oauthCode.user_id,\n        sid: session.workos_id,\n        ...(oauthCode.organization_id ? { org_id: oauthCode.organization_id } : {}),\n        permissions: [],\n      },\n      { issuer: baseUrl, audience },\n    );\n    return c.json({\n      access_token: accessToken,\n      token_type: \"Bearer\",\n      expires_in: 3600,\n      refresh_token: session.refresh_token,\n    });\n  });\n}\n","import type { ServiceManifest } from \"@emulators/core\";\n\nexport const manifest: ServiceManifest = {\n  id: \"workos\",\n  name: \"WorkOS\",\n  description:\n    \"Stateful WorkOS emulator: AuthKit user management (hosted login, code + refresh grants, sealed-session JWKS), organizations, memberships, invitations, API keys, Vault KV, and an OAuth authorization server for MCP clients.\",\n  docsUrl: \"https://docs.emulators.dev/workos\",\n  surfaces: [\n    { id: \"rest\", kind: \"rest\", title: \"WorkOS REST API\", status: \"partial\", basePath: \"/\" },\n    { id: \"authkit\", kind: \"ui\", title: \"Hosted AuthKit login\", status: \"supported\", basePath: \"/user_management/authorize\" },\n    { id: \"oauth\", kind: \"rest\", title: \"OAuth authorization server (MCP)\", status: \"supported\", basePath: \"/oauth2\" },\n    { id: \"vault\", kind: \"rest\", title: \"Vault KV\", status: \"supported\", basePath: \"/vault/v1/kv\" },\n  ],\n  auth: [{ id: \"api-key\", title: \"WorkOS secret key\", type: \"api-key\", status: \"supported\" }],\n  specs: [\n    {\n      kind: \"manual\",\n      title: \"WorkOS User Management + Organizations subset\",\n      coverage: \"hand-authored\",\n      operations: [\n        { operationId: \"userManagement.authorize\", method: \"GET\", path: \"/user_management/authorize\", status: \"hand-authored\" },\n        { operationId: \"userManagement.authenticate\", method: \"POST\", path: \"/user_management/authenticate\", status: \"hand-authored\" },\n        { operationId: \"userManagement.getUser\", method: \"GET\", path: \"/user_management/users/:id\", status: \"hand-authored\" },\n        { operationId: \"memberships.list\", method: \"GET\", path: \"/user_management/organization_memberships\", status: \"hand-authored\" },\n        { operationId: \"memberships.create\", method: \"POST\", path: \"/user_management/organization_memberships\", status: \"hand-authored\" },\n        { operationId: \"memberships.get\", method: \"GET\", path: \"/user_management/organization_memberships/:id\", status: \"hand-authored\" },\n        { operationId: \"memberships.update\", method: \"PUT\", path: \"/user_management/organization_memberships/:id\", status: \"hand-authored\" },\n        { operationId: \"memberships.delete\", method: \"DELETE\", path: \"/user_management/organization_memberships/:id\", status: \"hand-authored\" },\n        { operationId: \"invitations.list\", method: \"GET\", path: \"/user_management/invitations\", status: \"hand-authored\" },\n        { operationId: \"invitations.send\", method: \"POST\", path: \"/user_management/invitations\", status: \"hand-authored\" },\n        { operationId: \"invitations.accept\", method: \"POST\", path: \"/user_management/invitations/:id/accept\", status: \"hand-authored\" },\n        { operationId: \"userApiKeys.list\", method: \"GET\", path: \"/user_management/users/:id/api_keys\", status: \"hand-authored\" },\n        { operationId: \"userApiKeys.create\", method: \"POST\", path: \"/user_management/users/:id/api_keys\", status: \"hand-authored\" },\n        { operationId: \"apiKeys.validate\", method: \"POST\", path: \"/api_keys/validations\", status: \"hand-authored\" },\n        { operationId: \"apiKeys.delete\", method: \"DELETE\", path: \"/api_keys/:id\", status: \"hand-authored\" },\n        { operationId: \"organizations.create\", method: \"POST\", path: \"/organizations\", status: \"hand-authored\" },\n        { operationId: \"organizations.get\", method: \"GET\", path: \"/organizations/:id\", status: \"hand-authored\" },\n        { operationId: \"organizations.update\", method: \"PUT\", path: \"/organizations/:id\", status: \"hand-authored\" },\n        { operationId: \"organizations.roles\", method: \"GET\", path: \"/organizations/:id/roles\", status: \"hand-authored\" },\n        { operationId: \"sso.jwks\", method: \"GET\", path: \"/sso/jwks/:clientId\", status: \"hand-authored\" },\n        { operationId: \"oauth.metadata\", method: \"GET\", path: \"/.well-known/oauth-authorization-server\", status: \"hand-authored\" },\n        { operationId: \"oauth.register\", method: \"POST\", path: \"/oauth2/register\", status: \"hand-authored\" },\n        { operationId: \"oauth.authorize\", method: \"GET\", path: \"/oauth2/authorize\", status: \"hand-authored\" },\n        { operationId: \"oauth.token\", method: \"POST\", path: \"/oauth2/token\", status: \"hand-authored\" },\n        { operationId: \"vault.create\", method: \"POST\", path: \"/vault/v1/kv\", status: \"hand-authored\" },\n        { operationId: \"vault.readByName\", method: \"GET\", path: \"/vault/v1/kv/name/:name\", status: \"hand-authored\" },\n        { operationId: \"vault.update\", method: \"PUT\", path: \"/vault/v1/kv/:id\", status: \"hand-authored\" },\n        { operationId: \"vault.delete\", method: \"DELETE\", path: \"/vault/v1/kv/:id\", status: \"hand-authored\" },\n      ],\n    },\n  ],\n  seedSchema: {\n    description: \"Seed users, organizations, and memberships.\",\n    fields: [\n      {\n        key: \"users\",\n        title: \"Users\",\n        description: \"AuthKit users (email is the identity; sign-in creates missing users on the fly).\",\n        example: [{ email: \"admin@example.com\", first_name: \"Admin\", last_name: \"User\" }],\n      },\n      {\n        key: \"organizations\",\n        title: \"Organizations\",\n        description: \"Organizations with optional member emails (memberships are created as active).\",\n        example: [{ name: \"Acme\", members: [\"admin@example.com\"] }],\n      },\n    ],\n    example: {\n      users: [{ email: \"admin@example.com\", first_name: \"Admin\", last_name: \"User\" }],\n      organizations: [{ name: \"Acme\", members: [\"admin@example.com\"] }],\n    },\n  },\n  stateModel: {\n    description: \"Entities mutated by WorkOS provider calls.\",\n    collections: [\n      { name: \"workos.users\" },\n      { name: \"workos.organizations\" },\n      { name: \"workos.memberships\" },\n      { name: \"workos.invitations\" },\n      { name: \"workos.api_keys\" },\n      { name: \"workos.sessions\" },\n      { name: \"workos.vault_objects\" },\n      { name: \"workos.oauth_clients\" },\n    ],\n  },\n  connections: [\n    {\n      id: \"workos-node\",\n      title: \"WorkOS Node SDK\",\n      kind: \"sdk\",\n      language: \"typescript\",\n      description: \"Point @workos-inc/node at the emulator via apiHostname — sealed sessions, JWKS, everything follows.\",\n      template:\n        'import { WorkOS } from \"@workos-inc/node\";\\n\\nconst url = new URL(\"{{baseUrl}}\");\\nconst workos = new WorkOS(\"{{token}}\", {\\n  clientId: \"client_emulate\",\\n  apiHostname: url.hostname,\\n  port: Number(url.port),\\n  https: url.protocol === \"https:\",\\n});',\n    },\n  ],\n};\n","import type { Hono, Store, WebhookDispatcher, TokenMap, AppEnv, RouteContext, ServicePlugin } from \"@emulators/core\";\n\nimport { getWorkosStore, type WorkosStore } from \"./store.js\";\nimport { userManagementRoutes, ensureUserByEmail } from \"./routes/user-management.js\";\nimport { organizationRoutes } from \"./routes/organizations.js\";\nimport { apiKeyRoutes } from \"./routes/api-keys.js\";\nimport { vaultRoutes } from \"./routes/vault.js\";\nimport { oauthRoutes } from \"./routes/oauth.js\";\nimport { workosId } from \"./helpers.js\";\nimport { manifest } from \"./manifest.js\";\n\nexport { getWorkosStore, type WorkosStore } from \"./store.js\";\nexport * from \"./entities.js\";\nexport { manifest } from \"./manifest.js\";\n\nexport interface WorkosSeedConfig {\n  users?: Array<{ email: string; first_name?: string; last_name?: string }>;\n  organizations?: Array<{ name: string; members?: string[] }>;\n}\n\nexport function seedFromConfig(store: Store, _baseUrl: string, config: WorkosSeedConfig): void {\n  const ws = getWorkosStore(store);\n  for (const user of config.users ?? []) {\n    const created = ensureUserByEmail(ws, user.email);\n    if (user.first_name || user.last_name) {\n      ws.users.update(created.id, {\n        first_name: user.first_name ?? created.first_name,\n        last_name: user.last_name ?? created.last_name,\n      });\n    }\n  }\n  for (const organization of config.organizations ?? []) {\n    const org = ws.organizations.insert({\n      workos_id: workosId(\"org\"),\n      name: organization.name,\n      external_id: null,\n    });\n    for (const email of organization.members ?? []) {\n      const member = ensureUserByEmail(ws, email);\n      ws.memberships.insert({\n        workos_id: workosId(\"om\"),\n        user_id: member.workos_id,\n        organization_id: org.workos_id,\n        status: \"active\",\n        role_slug: \"admin\",\n      });\n    }\n  }\n}\n\nexport const workosPlugin: ServicePlugin = {\n  name: \"workos\",\n  register(\n    app: Hono<AppEnv>,\n    store: Store,\n    webhooks: WebhookDispatcher,\n    baseUrl: string,\n    tokenMap?: TokenMap,\n  ): void {\n    const ctx: RouteContext = { app, store, webhooks, baseUrl, tokenMap };\n    oauthRoutes(ctx);\n    userManagementRoutes(ctx);\n    organizationRoutes(ctx);\n    apiKeyRoutes(ctx);\n    vaultRoutes(ctx);\n  },\n  seed(_store: Store, _baseUrl: string): void {\n    // No default seed — sign-in creates users on the fly.\n  },\n};\n\nexport default workosPlugin;\n"],"mappings":";;;;;;;AA4BO,SAAS,eAAe,OAA2B;AACxD,SAAO;IACL,OAAO,MAAM,WAAuB,gBAAgB,CAAC,aAAa,OAAO,CAAC;IAC1E,eAAe,MAAM,WAA+B,wBAAwB,CAAC,WAAW,CAAC;IACzF,aAAa,MAAM,WAA6B,sBAAsB;MACpE;MACA;MACA;IACF,CAAC;IACD,aAAa,MAAM,WAA6B,sBAAsB;MACpE;MACA;MACA;MACA;IACF,CAAC;IACD,SAAS,MAAM,WAAyB,mBAAmB,CAAC,aAAa,SAAS,SAAS,CAAC;IAC5F,WAAW,MAAM,WAA2B,qBAAqB,CAAC,MAAM,CAAC;IACzE,UAAU,MAAM,WAA0B,mBAAmB,CAAC,iBAAiB,WAAW,CAAC;IAC3F,cAAc,MAAM,WAA8B,wBAAwB;MACxE;MACA;IACF,CAAC;IACD,cAAc,MAAM,WAA8B,wBAAwB,CAAC,WAAW,CAAC;IACvF,YAAY,MAAM,WAA4B,sBAAsB,CAAC,MAAM,CAAC;EAC9E;AACF;AIhBO,SAAS,mBAAmB,kBAA8C;AAC/E,SAAO,OAAO,GAAG,SAAS;AACxB,QAAI,kBAAkB;AACpB,QAAE,IAAI,WAAW,gBAAgB;IACnC;AACA,UAAM,KAAK;EACb;AACF;AAEO,IAAM,eAAkC,mBAAmB;AE9ClE,IAAM,UACJ,OAAO,YAAY,gBAClB,QAAQ,IAAI,UAAU,OAAO,QAAQ,IAAI,UAAU,UAAU,QAAQ,IAAI,kBAAkB;AIFvF,SAAS,WAAW,GAAmB;AAC5C,SAAO,EAAE,QAAQ,MAAM,OAAO,EAAE,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,QAAQ;AACpG;AAEO,SAAS,WAAW,GAAmB;AAC5C,SAAO,WAAW,CAAC,EAAE,QAAQ,MAAM,OAAO;AAC5C;AAEA,IAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyRZ,IAAM,aAAa;AAEnB,SAAS,OAAO,SAA0B;AACxC,QAAM,QAAQ,UAAU,GAAG,WAAW,OAAO,CAAC,cAAc;AAC5D,SAAO;gCACuB,KAAK;;;;;;;AAOrC;AAEA,SAAS,KAAK,OAAuB;AACnC,SAAO;;;;;;SAMA,WAAW,KAAK,CAAC;SACjB,GAAG;;AAEZ;AAEO,SAAS,eAAe,OAAe,UAAkB,MAAc,SAA0B;AACtG,SAAO,GAAG,KAAK,KAAK,CAAC;;EAErB,OAAO,OAAO,CAAC;;;8BAGa,WAAW,KAAK,CAAC;iCACd,QAAQ;MACnC,IAAI;;;EAGR,UAAU;;AAEZ;AA6LO,SAAS,iBAAiB,MAAiC;AAChE,QAAM,UAAU,OAAO,QAAQ,KAAK,YAAY,EAC7C,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,8BAA8B,WAAW,CAAC,CAAC,YAAY,WAAW,CAAC,CAAC,KAAK,EACzF,KAAK,EAAE;AAEV,QAAM,WAAW,KAAK,OAAO,0BAA0B,WAAW,KAAK,IAAI,CAAC,WAAW;AACvF,QAAM,YAAY,KAAK,QAAQ,2BAA2B,WAAW,KAAK,KAAK,CAAC,WAAW;AAE3F,SAAO,iDAAiD,WAAW,KAAK,UAAU,CAAC;EACnF,OAAO;;yBAEgB,WAAW,KAAK,MAAM,CAAC;;+BAEjB,WAAW,KAAK,KAAK,CAAC;MAC/C,QAAQ,GAAG,SAAS;;;;AAI1B;AOlhBA,IAAM,iBAAiB,gBAAgB,SAAS,EAAE,aAAa,KAAK,CAAC;AAC9D,IAAM,MAAM;AAEnB,eAAsB,eAA6D;AACjF,QAAM,EAAE,UAAU,IAAI,MAAM;AAC5B,QAAM,MAAM,MAAM,UAAU,SAAS;AACrC,SAAO,EAAE,MAAM,CAAC,EAAE,GAAG,KAAK,KAAK,KAAK,KAAK,OAAO,KAAK,QAAQ,CAAC,EAAE;AAClE;AAWA,eAAsB,gBACpB,QACA,SACiB;AACjB,QAAM,EAAE,WAAW,IAAI,MAAM;AAC7B,MAAI,MAAM,IAAI,QAAQ,MAAM,EACzB,mBAAmB,EAAE,KAAK,SAAS,KAAK,KAAK,KAAK,MAAM,CAAC,EACzD,UAAU,QAAQ,MAAM,EACxB,YAAY,EACZ,OAAO,OAAO,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC,EAAE,EACnD,kBAAkB,QAAQ,aAAa,IAAI;AAC9C,MAAI,QAAQ,SAAU,OAAM,IAAI,YAAY,QAAQ,QAAQ;AAC5D,SAAO,IAAI,KAAK,UAAU;AAC5B;ACzBA,IAAI,UAAU;AAEP,SAAS,SAAS,QAAwB;AAC/C,aAAW;AACX,SAAO,GAAG,MAAM,IAAI,OAAO,OAAO,EAAE,SAAS,GAAG,GAAG,CAAC,GAAG,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,EAAE,YAAY,CAAC;AAC7G;AAEO,SAAS,YAAY,QAAwB;AAClD,SAAO,GAAG,MAAM,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC,GAAG,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAC/F;AAGO,SAAS,YAAY,GAAY,QAAgB,MAAc,SAA2B;AAC/F,SAAO,EAAE,KAAK,EAAE,MAAM,SAAS,OAAO,MAAM,mBAAmB,QAAQ,GAAG,MAAa;AACzF;AAGO,SAAS,aAAgB,MAK9B;AACA,SAAO;IACL,QAAQ;IACR;IACA,eAAe,EAAE,QAAQ,MAAM,OAAO,KAAK;;IAE3C,cAAc,EAAE,QAAQ,MAAM,OAAO,KAAK;EAC5C;AACF;AAIO,SAAS,cAAc,MAA2C;AACvE,SAAO;IACL,QAAQ;IACR,IAAI,KAAK;IACT,OAAO,KAAK;IACZ,gBAAgB,KAAK;IACrB,YAAY,KAAK;IACjB,WAAW,KAAK;IAChB,qBAAqB,KAAK;IAC1B,iBAAiB,KAAK;IACtB,aAAa;IACb,UAAU,CAAC;IACX,YAAY,KAAK;IACjB,YAAY,KAAK;EACnB;AACF;AAEO,SAAS,sBAAsB,KAAkD;AACtF,SAAO;IACL,QAAQ;IACR,IAAI,IAAI;IACR,MAAM,IAAI;IACV,qCAAqC;IACrC,SAAS,CAAC;IACV,oBAAoB;IACpB,aAAa,IAAI;IACjB,UAAU,CAAC;IACX,YAAY,IAAI;IAChB,YAAY,IAAI;EAClB;AACF;AAEO,SAAS,oBACd,YACA,kBACyB;AACzB,SAAO;IACL,QAAQ;IACR,IAAI,WAAW;IACf,SAAS,WAAW;IACpB,iBAAiB,WAAW;IAC5B,mBAAmB;IACnB,QAAQ,WAAW;IACnB,MAAM,EAAE,MAAM,WAAW,UAAU;IACnC,YAAY,WAAW;IACvB,YAAY,WAAW;EACzB;AACF;AAEO,SAAS,oBAAoB,YAAuD;AACzF,SAAO;IACL,QAAQ;IACR,IAAI,WAAW;IACf,OAAO,WAAW;IAClB,OAAO,WAAW;IAClB,iBAAiB,WAAW;IAC5B,iBAAiB,WAAW;IAC5B,kBAAkB;IAClB,OAAO,WAAW;IAClB,uBAAuB,kCAAkC,WAAW,KAAK;IACzE,YAAY,WAAW;IACvB,YAAY,WAAW;IACvB,YAAY,WAAW;EACzB;AACF;AAEO,SAAS,gBACd,KACA,UAAsC,CAAC,GACd;AACzB,SAAO;IACL,QAAQ;IACR,IAAI,IAAI;IACR,MAAM,IAAI;IACV,kBAAkB,GAAG,IAAI,MAAM,MAAM,GAAG,CAAC,CAAC,SAAI,IAAI,MAAM,MAAM,EAAE,CAAC;IACjE,OAAO,EAAE,MAAM,QAAQ,IAAI,IAAI,SAAS,iBAAiB,IAAI,gBAAgB;IAC7E,cAAc,IAAI;IAClB,YAAY,IAAI;IAChB,YAAY,IAAI;IAChB,GAAI,QAAQ,eAAe,EAAE,OAAO,IAAI,MAAM,IAAI,CAAC;EACrD;AACF;AAEO,SAAS,uBAAuB,QAAoD;AACzF,SAAO;IACL,IAAI,OAAO;IACX,SAAS,OAAO;IAChB,gBAAgB;IAChB,QAAQ;IACR,YAAY,OAAO;IACnB,YAAY,EAAE,IAAI,eAAe,MAAM,UAAU;IACjD,YAAY,OAAO;EACrB;AACF;AAEO,SAAS,qBAAqB,QAAoD;AACvF,SAAO;IACL,IAAI,OAAO;IACX,MAAM,OAAO;IACb,OAAO,OAAO;IACd,UAAU,uBAAuB,MAAM;EACzC;AACF;AAGO,SAAS,cAAc,GAAsB;AAClD,QAAM,WAAW,EAAE,IAAI,QAAQ,UAAU,KAAK,CAAC;AAC/C,QAAM,YAAY,EAAE,IAAI,QAAQ,YAAY,KAAK,CAAC;AAClD,SAAO,CAAC,GAAG,UAAU,GAAG,SAAS,EAAE,QAAQ,CAAC,UAAU,MAAM,MAAM,GAAG,CAAC,EAAE,OAAO,OAAO;AACxF;ACvIO,SAAS,kBAAkB,IAAiB,OAA2B;AAC5E,QAAM,WAAW,GAAG,MAAM,UAAU,SAAS,KAAK;AAClD,MAAI,SAAU,QAAO;AACrB,SAAO,GAAG,MAAM,OAAO;IACrB,WAAW,SAAS,MAAM;IAC1B;IACA,YAAY;IACZ,WAAW;IACX,gBAAgB;IAChB,qBAAqB;EACvB,CAAC;AACH;AAEA,eAAe,uBACb,GACA,IACA,SACA,MACA,gBACA,UACmB;AACnB,QAAM,UAAU,GAAG,SAAS,OAAO;IACjC,WAAW,SAAS,SAAS;IAC7B,eAAe,YAAY,IAAI;IAC/B,SAAS,KAAK;IACd,iBAAiB;IACjB,WAAW;IACX,SAAS;EACX,CAAC;AACD,QAAM,aAAa,iBACf,GAAG,YACA,OAAO,WAAW,KAAK,SAAS,EAChC,KAAK,CAAC,MAAM,EAAE,oBAAoB,cAAc,IACnD;AACJ,QAAM,cAAc,MAAM;IACxB;MACE,KAAK,KAAK;MACV,KAAK,QAAQ;MACb,GAAI,iBAAiB,EAAE,QAAQ,eAAe,IAAI,CAAC;MACnD,GAAI,aAAa,EAAE,MAAM,WAAW,UAAU,IAAI,CAAC;MACnD,aAAa,CAAC;IAChB;IACA,EAAE,QAAQ,SAAS,UAAU,SAAS;EACxC;AACA,SAAO,EAAE,KAAK;IACZ,MAAM,cAAc,IAAI;IACxB,iBAAiB;IACjB,cAAc;IACd,eAAe,QAAQ;IACvB,uBAAuB;EACzB,CAAC;AACH;AAEO,SAAS,qBAAqB,KAAyB;AAC5D,QAAM,EAAE,KAAK,OAAO,QAAQ,IAAI;AAChC,QAAM,KAAK,MAAM,eAAe,KAAK;AAGrC,MAAI,IAAI,8BAA8B,CAAC,MAAM;AAC3C,UAAM,WAAW,EAAE,IAAI,MAAM,WAAW,KAAK;AAC7C,UAAM,cAAc,EAAE,IAAI,MAAM,cAAc,KAAK;AACnD,UAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,KAAK;AAGtC,UAAM,YAAY,EAAE,IAAI,MAAM,YAAY;AAC1C,QAAI,WAAW;AACb,aAAO,kBAAkB,GAAG,GAAG,GAAG,WAAW,UAAU,aAAa,KAAK;IAC3E;AACA,UAAM,QAAQ,GAAG,EAAE,MAAM,IAAI;AAC7B,UAAM,UAAU,MACb;MAAI,CAAC,SACJ,iBAAiB;QACf,SAAS,KAAK,MAAM,CAAC,KAAK,KAAK,YAAY;QAC3C,OAAO,KAAK;QACZ,MAAM,GAAG,KAAK,cAAc,EAAE,IAAI,KAAK,aAAa,EAAE,GAAG,KAAK,KAAK,KAAK;QACxE,OAAO,KAAK;QACZ,YAAY,GAAG,OAAO;QACtB,cAAc,EAAE,OAAO,KAAK,OAAO,WAAW,UAAU,cAAc,aAAa,MAAM;MAC3F,CAAC;IACH,EACC,KAAK,IAAI;AACZ,UAAM,cAAc;oCACY,OAAO;uDACY,WAAW,QAAQ,CAAC;0DACjB,WAAW,WAAW,CAAC;mDAC9B,WAAW,KAAK,CAAC;;;;AAIhE,WAAO,EAAE;MACP;QACE;QACA;QACA,GAAG,OAAO,GAAG,WAAW;MAC1B;MACA;IACF;EACF,CAAC;AAED,MAAI,KAAK,qCAAqC,OAAO,MAAM;AACzD,UAAM,OAAO,MAAM,EAAE,IAAI,UAAU;AACnC,UAAM,QAAQ,OAAO,KAAK,SAAS,EAAE;AACrC,QAAI,CAAC,MAAO,QAAO,YAAY,GAAG,KAAK,mBAAmB,mBAAmB;AAC7E,WAAO;MACL;MACA,GAAG;MACH;MACA,OAAO,KAAK,aAAa,EAAE;MAC3B,OAAO,KAAK,gBAAgB,EAAE;MAC9B,OAAO,KAAK,SAAS,EAAE;IACzB;EACF,CAAC;AAED,WAAS,kBACP,GACA,UACA,OACA,UACA,aACA,OACU;AACV,QAAI,CAAC,YAAa,QAAO,YAAY,GAAG,KAAK,mBAAmB,0BAA0B;AAC1F,UAAM,OAAO,kBAAkB,UAAU,KAAK;AAC9C,UAAM,OAAO,YAAY,MAAM;AAC/B,UAAM,mBAAmB,SAAS,YAC/B,OAAO,WAAW,KAAK,SAAS,EAChC,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ;AACpC,aAAS,UAAU,OAAO;MACxB;MACA,SAAS,KAAK;MACd,iBAAiB,kBAAkB,mBAAmB;MACtD,WAAW;MACX,cAAc;MACd,MAAM;IACR,CAAC;AACD,UAAM,SAAS,IAAI,IAAI,WAAW;AAClC,WAAO,aAAa,IAAI,QAAQ,IAAI;AACpC,QAAI,MAAO,QAAO,aAAa,IAAI,SAAS,KAAK;AACjD,WAAO,EAAE,SAAS,OAAO,SAAS,GAAG,GAAG;EAC1C;AAGA,MAAI,KAAK,iCAAiC,OAAO,MAAM;AACrD,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,YAAY,OAAO,KAAK,cAAc,EAAE;AAC9C,UAAM,WAAW,OAAO,KAAK,aAAa,EAAE;AAE5C,QAAI,cAAc,sBAAsB;AACtC,YAAM,OAAO,OAAO,KAAK,QAAQ,EAAE;AACnC,YAAM,WAAW,GAAG,EAAE,UAAU,UAAU,QAAQ,IAAI;AACtD,UAAI,CAAC,YAAY,SAAS,MAAM;AAC9B,eAAO,YAAY,GAAG,KAAK,iBAAiB,uCAAuC;MACrF;AACA,SAAG,EAAE,UAAU,OAAO,SAAS,IAAI,EAAE,MAAM,KAAK,CAAC;AACjD,YAAM,OAAO,GAAG,EAAE,MAAM,UAAU,aAAa,SAAS,OAAO;AAC/D,UAAI,CAAC,KAAM,QAAO,YAAY,GAAG,KAAK,iBAAiB,wBAAwB;AAC/E,aAAO,uBAAuB,GAAG,GAAG,GAAG,SAAS,MAAM,SAAS,iBAAiB,QAAQ;IAC1F;AAEA,QAAI,cAAc,iBAAiB;AACjC,YAAM,eAAe,OAAO,KAAK,iBAAiB,EAAE;AACpD,YAAM,UAAU,GAAG,EAAE,SAAS,UAAU,iBAAiB,YAAY;AACrE,UAAI,CAAC,WAAW,QAAQ,SAAS;AAC/B,eAAO,YAAY,GAAG,KAAK,iBAAiB,2BAA2B;MACzE;AACA,YAAM,OAAO,GAAG,EAAE,MAAM,UAAU,aAAa,QAAQ,OAAO;AAC9D,UAAI,CAAC,KAAM,QAAO,YAAY,GAAG,KAAK,iBAAiB,2BAA2B;AAClF,YAAM,eACJ,OAAO,KAAK,oBAAoB,YAAY,KAAK,gBAAgB,SAAS,IACtE,KAAK,kBACL,QAAQ;AACd,UAAI,cAAc;AAChB,cAAM,aAAa,GAAG,EACnB,YAAY,OAAO,WAAW,KAAK,SAAS,EAC5C,KAAK,CAAC,MAAM,EAAE,oBAAoB,gBAAgB,EAAE,WAAW,QAAQ;AAC1E,YAAI,CAAC,YAAY;AACf,iBAAO;YACL;YACA;YACA;YACA;UACF;QACF;AACA,cAAM,eAAe,GAAG,EAAE,cAAc,UAAU,aAAa,YAAY;AAC3E,YAAI,CAAC,aAAc,QAAO,YAAY,GAAG,KAAK,aAAa,yBAAyB;MACtF;AACA,SAAG,EAAE,SAAS,OAAO,QAAQ,IAAI,EAAE,SAAS,KAAK,CAAC;AAClD,aAAO,uBAAuB,GAAG,GAAG,GAAG,SAAS,MAAM,gBAAgB,MAAM,QAAQ;IACtF;AAEA,WAAO,YAAY,GAAG,KAAK,0BAA0B,2BAA2B,SAAS,EAAE;EAC7F,CAAC;AAGD,MAAI,IAAI,8BAA8B,CAAC,MAAM;AAC3C,UAAM,OAAO,GAAG,EAAE,MAAM,UAAU,aAAa,EAAE,IAAI,MAAM,IAAI,CAAC;AAChE,QAAI,CAAC,KAAM,QAAO,YAAY,GAAG,KAAK,oBAAoB,iBAAiB;AAC3E,WAAO,EAAE,KAAK,cAAc,IAAI,CAAC;EACnC,CAAC;AAGD,MAAI,IAAI,6CAA6C,CAAC,MAAM;AAC1D,UAAM,SAAS,EAAE,IAAI,MAAM,SAAS;AACpC,UAAM,iBAAiB,EAAE,IAAI,MAAM,iBAAiB;AACpD,UAAM,WAAW,cAAc,CAAC;AAChC,QAAI,cAAc,GAAG,EAAE,YAAY,IAAI;AACvC,QAAI,OAAQ,eAAc,YAAY,OAAO,CAAC,MAAM,EAAE,YAAY,MAAM;AACxE,QAAI,gBAAgB;AAClB,oBAAc,YAAY,OAAO,CAAC,MAAM,EAAE,oBAAoB,cAAc;IAC9E;AACA,QAAI,SAAS,SAAS,EAAG,eAAc,YAAY,OAAO,CAAC,MAAM,SAAS,SAAS,EAAE,MAAM,CAAC;AAC5F,WAAO,EAAE;MACP;QACE,YAAY;UAAI,CAAC,MACf;YACE;YACA,GAAG,EAAE,cAAc,UAAU,aAAa,EAAE,eAAe,GAAG,QAC5D,EAAE;UACN;QACF;MACF;IACF;EACF,CAAC;AAED,MAAI,KAAK,6CAA6C,OAAO,MAAM;AACjE,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,OAAO,KAAK,WAAW,EAAE;AACxC,UAAM,iBAAiB,OAAO,KAAK,mBAAmB,EAAE;AACxD,UAAM,OAAO,GAAG,EAAE,MAAM,UAAU,aAAa,MAAM;AACrD,UAAM,eAAe,GAAG,EAAE,cAAc,UAAU,aAAa,cAAc;AAC7E,QAAI,CAAC,KAAM,QAAO,YAAY,GAAG,KAAK,oBAAoB,iBAAiB;AAC3E,QAAI,CAAC,aAAc,QAAO,YAAY,GAAG,KAAK,oBAAoB,yBAAyB;AAC3F,UAAM,WAAW,GAAG,EACjB,YAAY,OAAO,WAAW,MAAM,EACpC,KAAK,CAAC,MAAM,EAAE,oBAAoB,cAAc;AACnD,QAAI,UAAU;AACZ,aAAO,YAAY,GAAG,KAAK,0CAA0C,mBAAmB;IAC1F;AACA,UAAM,aAAa,GAAG,EAAE,YAAY,OAAO;MACzC,WAAW,SAAS,IAAI;MACxB,SAAS;MACT,iBAAiB;MACjB,QAAQ;MACR,WAAW,OAAO,KAAK,cAAc,YAAY,KAAK,YAAY,KAAK,YAAY;IACrF,CAAC;AACD,WAAO,EAAE,KAAK,oBAAoB,YAAY,aAAa,IAAI,GAAG,GAAG;EACvE,CAAC;AAED,MAAI,IAAI,iDAAiD,CAAC,MAAM;AAC9D,UAAM,aAAa,GAAG,EAAE,YAAY,UAAU,aAAa,EAAE,IAAI,MAAM,IAAI,CAAC;AAC5E,QAAI,CAAC,WAAY,QAAO,YAAY,GAAG,KAAK,oBAAoB,uBAAuB;AACvF,UAAM,mBACJ,GAAG,EAAE,cAAc,UAAU,aAAa,WAAW,eAAe,GAAG,QACvE,WAAW;AACb,WAAO,EAAE,KAAK,oBAAoB,YAAY,gBAAgB,CAAC;EACjE,CAAC;AAED,MAAI,IAAI,iDAAiD,OAAO,MAAM;AACpE,UAAM,aAAa,GAAG,EAAE,YAAY,UAAU,aAAa,EAAE,IAAI,MAAM,IAAI,CAAC;AAC5E,QAAI,CAAC,WAAY,QAAO,YAAY,GAAG,KAAK,oBAAoB,uBAAuB;AACvF,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,UAAU,GAAG,EAAE,YAAY,OAAO,WAAW,IAAI;MACrD,WACE,OAAO,KAAK,cAAc,YAAY,KAAK,YACvC,KAAK,YACL,WAAW;IACnB,CAAC;AACD,UAAM,mBACJ,GAAG,EAAE,cAAc,UAAU,aAAa,QAAQ,eAAe,GAAG,QACpE,QAAQ;AACV,WAAO,EAAE,KAAK,oBAAoB,SAAS,gBAAgB,CAAC;EAC9D,CAAC;AAED,MAAI,OAAO,iDAAiD,CAAC,MAAM;AACjE,UAAM,aAAa,GAAG,EAAE,YAAY,UAAU,aAAa,EAAE,IAAI,MAAM,IAAI,CAAC;AAC5E,QAAI,CAAC,WAAY,QAAO,YAAY,GAAG,KAAK,oBAAoB,uBAAuB;AACvF,OAAG,EAAE,YAAY,OAAO,WAAW,EAAE;AACrC,WAAO,EAAE,KAAK,MAAM,GAAG;EACzB,CAAC;AAGD,MAAI,IAAI,gCAAgC,CAAC,MAAM;AAC7C,UAAM,QAAQ,EAAE,IAAI,MAAM,OAAO;AACjC,UAAM,iBAAiB,EAAE,IAAI,MAAM,iBAAiB;AACpD,QAAI,cAAc,GAAG,EAAE,YAAY,IAAI;AACvC,QAAI,MAAO,eAAc,YAAY,OAAO,CAAC,MAAM,EAAE,UAAU,KAAK;AACpE,QAAI,gBAAgB;AAClB,oBAAc,YAAY,OAAO,CAAC,MAAM,EAAE,oBAAoB,cAAc;IAC9E;AACA,WAAO,EAAE,KAAK,aAAa,YAAY,IAAI,mBAAmB,CAAC,CAAC;EAClE,CAAC;AAED,MAAI,KAAK,gCAAgC,OAAO,MAAM;AACpD,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,QAAQ,OAAO,KAAK,SAAS,EAAE;AACrC,UAAM,iBAAiB,OAAO,KAAK,mBAAmB,EAAE;AACxD,QAAI,CAAC,MAAO,QAAO,YAAY,GAAG,KAAK,mBAAmB,mBAAmB;AAC7E,QAAI,CAAC,GAAG,EAAE,cAAc,UAAU,aAAa,cAAc,GAAG;AAC9D,aAAO,YAAY,GAAG,KAAK,oBAAoB,yBAAyB;IAC1E;AACA,UAAM,aAAa,GAAG,EAAE,YAAY,OAAO;MACzC,WAAW,SAAS,YAAY;MAChC;MACA,iBAAiB;MACjB,iBAAiB,OAAO,KAAK,oBAAoB,WAAW,KAAK,kBAAkB;MACnF,WAAW,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY;MACjE,OAAO;MACP,OAAO,YAAY,QAAQ;MAC3B,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,KAAK,OAAO,GAAI,EAAE,YAAY;IACtE,CAAC;AACD,WAAO,EAAE,KAAK,oBAAoB,UAAU,GAAG,GAAG;EACpD,CAAC;AAED,MAAI,KAAK,2CAA2C,CAAC,MAAM;AACzD,UAAM,aAAa,GAAG,EAAE,YAAY,UAAU,aAAa,EAAE,IAAI,MAAM,IAAI,CAAC;AAC5E,QAAI,CAAC,WAAY,QAAO,YAAY,GAAG,KAAK,oBAAoB,uBAAuB;AACvF,QAAI,WAAW,UAAU,WAAW;AAClC,aAAO,YAAY,GAAG,KAAK,mBAAmB,4BAA4B;IAC5E;AACA,UAAM,UAAU,GAAG,EAAE,YAAY,OAAO,WAAW,IAAI,EAAE,OAAO,WAAW,CAAC;AAC5E,UAAM,OAAO,GAAG,EAAE,MAAM,UAAU,SAAS,WAAW,KAAK;AAC3D,QAAI,MAAM;AACR,YAAM,UAAU,GAAG,EAChB,YAAY,OAAO,WAAW,KAAK,SAAS,EAC5C,KAAK,CAAC,MAAM,EAAE,oBAAoB,WAAW,eAAe;AAC/D,UAAI,CAAC,SAAS;AACZ,WAAG,EAAE,YAAY,OAAO;UACtB,WAAW,SAAS,IAAI;UACxB,SAAS,KAAK;UACd,iBAAiB,WAAW;UAC5B,QAAQ;UACR,WAAW,WAAW,aAAa;QACrC,CAAC;MACH;IACF;AACA,WAAO,EAAE,KAAK,oBAAoB,OAAO,CAAC;EAC5C,CAAC;AAGD,MAAI,IAAI,uCAAuC,CAAC,MAAM;AACpD,UAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAC/B,UAAM,iBAAiB,EAAE,IAAI,MAAM,iBAAiB;AACpD,QAAI,OAAO,GAAG,EAAE,QAAQ,OAAO,WAAW,MAAM;AAChD,QAAI,eAAgB,QAAO,KAAK,OAAO,CAAC,MAAM,EAAE,oBAAoB,cAAc;AAClF,WAAO,EAAE,KAAK,aAAa,KAAK,IAAI,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,CAAC;EACjE,CAAC;AAED,MAAI,KAAK,uCAAuC,OAAO,MAAM;AAC3D,UAAM,SAAS,EAAE,IAAI,MAAM,IAAI;AAC/B,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,OAAO,GAAG,EAAE,MAAM,UAAU,aAAa,MAAM;AACrD,QAAI,CAAC,KAAM,QAAO,YAAY,GAAG,KAAK,oBAAoB,iBAAiB;AAC3E,UAAM,MAAM,GAAG,EAAE,QAAQ,OAAO;MAC9B,WAAW,SAAS,KAAK;MACzB,MAAM,OAAO,KAAK,QAAQ,SAAS;MACnC,OAAO,YAAY,YAAY;MAC/B,SAAS;MACT,iBAAiB,OAAO,KAAK,mBAAmB,EAAE;MAClD,cAAc;IAChB,CAAC;AACD,WAAO,EAAE,KAAK,gBAAgB,KAAK,EAAE,cAAc,KAAK,CAAC,GAAG,GAAG;EACjE,CAAC;AACH;ACxXO,SAAS,mBAAmB,KAAyB;AAC1D,QAAM,EAAE,KAAK,OAAO,QAAQ,IAAI;AAChC,QAAM,KAAK,MAAM,eAAe,KAAK;AAErC,MAAI,KAAK,kBAAkB,OAAO,MAAM;AACtC,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,OAAO,OAAO,KAAK,QAAQ,EAAE;AACnC,QAAI,CAAC,KAAM,QAAO,YAAY,GAAG,KAAK,mBAAmB,kBAAkB;AAC3E,UAAM,eAAe,GAAG,EAAE,cAAc,OAAO;MAC7C,WAAW,SAAS,KAAK;MACzB;MACA,aAAa,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;IACzE,CAAC;AACD,WAAO,EAAE,KAAK,sBAAsB,YAAY,GAAG,GAAG;EACxD,CAAC;AAED,MAAI,IAAI,sBAAsB,CAAC,MAAM;AACnC,UAAM,eAAe,GAAG,EAAE,cAAc,UAAU,aAAa,EAAE,IAAI,MAAM,IAAI,CAAC;AAChF,QAAI,CAAC,aAAc,QAAO,YAAY,GAAG,KAAK,oBAAoB,yBAAyB;AAC3F,WAAO,EAAE,KAAK,sBAAsB,YAAY,CAAC;EACnD,CAAC;AAED,MAAI,IAAI,sBAAsB,OAAO,MAAM;AACzC,UAAM,eAAe,GAAG,EAAE,cAAc,UAAU,aAAa,EAAE,IAAI,MAAM,IAAI,CAAC;AAChF,QAAI,CAAC,aAAc,QAAO,YAAY,GAAG,KAAK,oBAAoB,yBAAyB;AAC3F,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,UAAU,GAAG,EAAE,cAAc,OAAO,aAAa,IAAI;MACzD,MAAM,OAAO,KAAK,SAAS,YAAY,KAAK,OAAO,KAAK,OAAO,aAAa;IAC9E,CAAC;AACD,WAAO,EAAE,KAAK,sBAAsB,OAAO,CAAC;EAC9C,CAAC;AAED,MAAI,IAAI,4BAA4B,CAAC,MAAM;AACzC,UAAM,eAAe,GAAG,EAAE,cAAc,UAAU,aAAa,EAAE,IAAI,MAAM,IAAI,CAAC;AAChF,QAAI,CAAC,aAAc,QAAO,YAAY,GAAG,KAAK,oBAAoB,yBAAyB;AAC3F,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,OAAO,CAAC,MAAc,UAAkB;MAC5C,QAAQ;MACR,IAAI,QAAQ,IAAI;MAChB;MACA;MACA,aAAa;MACb,aAAa,CAAC;MACd,oBAAoB;MACpB,MAAM;MACN,YAAY;MACZ,YAAY;IACd;AACA,WAAO,EAAE,KAAK,aAAa,CAAC,KAAK,SAAS,OAAO,GAAG,KAAK,UAAU,QAAQ,CAAC,CAAC,CAAC;EAChF,CAAC;AAGD,MAAI,KAAK,yBAAyB,OAAO,MAAM;AAC7C,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,eAAe,OAAO,KAAK,gBAAgB,EAAE;AACnD,WAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,YAAY,YAAY,WAAW,KAAK,UAAU,EAAE,GAAG,CAAC;EAC1F,CAAC;AAED,MAAI;IAAI;IAA6B,CAAC,MACpC,EAAE,KAAK;MACL,QAAQ;MACR,IAAI,EAAE,IAAI,MAAM,IAAI;MACpB,iBAAiB;MACjB,QAAQ;MACR,OAAO;MACP,uBAAuB;MACvB,oBAAoB;IACtB,CAAC;EACH;AAEA,MAAI,OAAO,6BAA6B,CAAC,MAAM,EAAE,KAAK,MAAM,GAAG,CAAC;AAClE;ACvEO,SAAS,aAAa,KAAyB;AACpD,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,KAAK,MAAM,eAAe,KAAK;AAGrC,MAAI,KAAK,yBAAyB,OAAO,MAAM;AAC7C,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,QAAQ,OAAO,KAAK,SAAS,EAAE;AACrC,UAAM,MAAM,GAAG,EAAE,QAAQ,UAAU,SAAS,KAAK;AACjD,QAAI,CAAC,IAAK,QAAO,YAAY,GAAG,KAAK,mBAAmB,qBAAqB;AAC7E,OAAG,EAAE,QAAQ,OAAO,IAAI,IAAI,EAAE,eAAc,oBAAI,KAAK,GAAE,YAAY,EAAE,CAAC;AACtE,WAAO,EAAE,KAAK,EAAE,SAAS,gBAAgB,GAAG,EAAE,CAAC;EACjD,CAAC;AAED,MAAI,OAAO,iBAAiB,CAAC,MAAM;AACjC,UAAM,MAAM,GAAG,EAAE,QAAQ,UAAU,aAAa,EAAE,IAAI,MAAM,IAAI,CAAC;AACjE,QAAI,CAAC,IAAK,QAAO,YAAY,GAAG,KAAK,oBAAoB,oBAAoB;AAC7E,OAAG,EAAE,QAAQ,OAAO,IAAI,EAAE;AAC1B,WAAO,EAAE,KAAK,MAAM,GAAG;EACzB,CAAC;AACH;ACZO,SAAS,YAAY,KAAyB;AACnD,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,KAAK,MAAM,eAAe,KAAK;AAErC,MAAI,KAAK,gBAAgB,OAAO,MAAM;AACpC,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,OAAO,OAAO,KAAK,QAAQ,EAAE;AACnC,QAAI,CAAC,KAAM,QAAO,YAAY,GAAG,KAAK,mBAAmB,kBAAkB;AAC3E,QAAI,GAAG,EAAE,aAAa,UAAU,QAAQ,IAAI,GAAG;AAC7C,aAAO,YAAY,GAAG,KAAK,YAAY,oBAAoB,IAAI,mBAAmB;IACpF;AACA,UAAM,SAAS,GAAG,EAAE,aAAa,OAAO;MACtC,WAAW,SAAS,IAAI;MACxB;MACA,OAAO,OAAO,KAAK,SAAS,EAAE;MAC9B,aAAc,KAAK,eAA2C,CAAC;MAC/D,YAAY,YAAY,SAAS;IACnC,CAAC;AACD,WAAO,EAAE,KAAK,uBAAuB,MAAM,GAAG,GAAG;EACnD,CAAC;AAED,MAAI;IAAI;IAAgB,CAAC,MACvB,EAAE;MACA;QACE,GAAG,EACA,aAAa,IAAI,EACjB,IAAI,CAAC,YAAY,EAAE,IAAI,OAAO,WAAW,MAAM,OAAO,KAAK,EAAE;MAClE;IACF;EACF;AAEA,MAAI,IAAI,2BAA2B,CAAC,MAAM;AACxC,UAAM,SAAS,GAAG,EAAE,aAAa,UAAU,QAAQ,EAAE,IAAI,MAAM,MAAM,CAAC;AACtE,QAAI,CAAC,OAAQ,QAAO,YAAY,GAAG,KAAK,aAAa,mBAAmB;AACxE,WAAO,EAAE,KAAK,qBAAqB,MAAM,CAAC;EAC5C,CAAC;AAED,MAAI,IAAI,oBAAoB,CAAC,MAAM;AACjC,UAAM,SAAS,GAAG,EAAE,aAAa,UAAU,aAAa,EAAE,IAAI,MAAM,IAAI,CAAC;AACzE,QAAI,CAAC,OAAQ,QAAO,YAAY,GAAG,KAAK,aAAa,mBAAmB;AACxE,WAAO,EAAE,KAAK,qBAAqB,MAAM,CAAC;EAC5C,CAAC;AAED,MAAI,IAAI,oBAAoB,OAAO,MAAM;AACvC,UAAM,SAAS,GAAG,EAAE,aAAa,UAAU,aAAa,EAAE,IAAI,MAAM,IAAI,CAAC;AACzE,QAAI,CAAC,OAAQ,QAAO,YAAY,GAAG,KAAK,aAAa,mBAAmB;AACxE,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,eAAe,KAAK;AAC1B,QAAI,OAAO,iBAAiB,YAAY,iBAAiB,OAAO,YAAY;AAC1E,aAAO,YAAY,GAAG,KAAK,YAAY,uBAAuB;IAChE;AACA,UAAM,UAAU,GAAG,EAAE,aAAa,OAAO,OAAO,IAAI;MAClD,OAAO,OAAO,KAAK,SAAS,OAAO,KAAK;MACxC,YAAY,YAAY,SAAS;IACnC,CAAC;AACD,WAAO,EAAE,KAAK,qBAAqB,OAAO,CAAC;EAC7C,CAAC;AAED,MAAI,OAAO,oBAAoB,CAAC,MAAM;AACpC,UAAM,SAAS,GAAG,EAAE,aAAa,UAAU,aAAa,EAAE,IAAI,MAAM,IAAI,CAAC;AACzE,QAAI,CAAC,OAAQ,QAAO,YAAY,GAAG,KAAK,aAAa,mBAAmB;AACxE,OAAG,EAAE,aAAa,OAAO,OAAO,EAAE;AAClC,WAAO,EAAE,KAAK,MAAM,GAAG;EACzB,CAAC;AACH;AC/DO,SAAS,YAAY,KAAyB;AACnD,QAAM,EAAE,KAAK,OAAO,QAAQ,IAAI;AAChC,QAAM,KAAK,MAAM,eAAe,KAAK;AAErC,MAAI,IAAI,uBAAuB,OAAO,MAAM,EAAE,KAAK,MAAM,aAAa,CAAC,CAAC;AACxE,MAAI,IAAI,gBAAgB,OAAO,MAAM,EAAE,KAAK,MAAM,aAAa,CAAC,CAAC;AAEjE,MAAI;IAAI;IAA2C,CAAC,MAClD,EAAE,KAAK;MACL,QAAQ;MACR,wBAAwB,GAAG,OAAO;MAClC,gBAAgB,GAAG,OAAO;MAC1B,uBAAuB,GAAG,OAAO;MACjC,UAAU,GAAG,OAAO;MACpB,0BAA0B,CAAC,MAAM;MACjC,uBAAuB,CAAC,sBAAsB,eAAe;MAC7D,kCAAkC,CAAC,MAAM;MACzC,uCAAuC,CAAC,sBAAsB,MAAM;IACtE,CAAC;EACH;AAEA,MAAI,KAAK,oBAAoB,OAAO,MAAM;AACxC,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,SAAS,GAAG,EAAE,aAAa,OAAO;MACtC,WAAW,SAAS,QAAQ;MAC5B,eAAe;MACf,eAAe,MAAM,QAAQ,KAAK,aAAa,IAAK,KAAK,gBAA6B,CAAC;MACvF,MAAM,OAAO,KAAK,gBAAgB,WAAW,KAAK,cAAc;IAClE,CAAC;AACD,WAAO,EAAE;MACP;QACE,WAAW,OAAO;QAClB,qBAAqB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;QACjD,eAAe,OAAO;QACtB,aAAa,CAAC,sBAAsB,eAAe;QACnD,gBAAgB,CAAC,MAAM;QACvB,4BAA4B;MAC9B;MACA;IACF;EACF,CAAC;AAED,MAAI,IAAI,qBAAqB,CAAC,MAAM;AAClC,UAAM,WAAW,EAAE,IAAI,MAAM,WAAW,KAAK;AAC7C,UAAM,cAAc,EAAE,IAAI,MAAM,cAAc,KAAK;AACnD,UAAM,QAAQ,EAAE,IAAI,MAAM,OAAO,KAAK;AACtC,UAAM,gBAAgB,EAAE,IAAI,MAAM,gBAAgB,KAAK;AACvD,UAAM,YAAY,EAAE,IAAI,MAAM,YAAY;AAC1C,QAAI,CAAC,YAAa,QAAO,YAAY,GAAG,KAAK,mBAAmB,0BAA0B;AAE1F,UAAM,QAAQ,CAAC,UAAkB;AAC/B,YAAM,OAAO,kBAAkB,GAAG,GAAG,KAAK;AAC1C,YAAM,mBAAmB,GAAG,EACzB,YAAY,OAAO,WAAW,KAAK,SAAS,EAC5C,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ;AACpC,YAAM,OAAO,YAAY,SAAS;AAClC,SAAG,EAAE,WAAW,OAAO;QACrB;QACA,SAAS,KAAK;QACd,iBAAiB,kBAAkB,mBAAmB;QACtD,WAAW;QACX,cAAc;QACd,gBAAgB,iBAAiB;QACjC,MAAM;MACR,CAAC;AACD,YAAM,SAAS,IAAI,IAAI,WAAW;AAClC,aAAO,aAAa,IAAI,QAAQ,IAAI;AACpC,UAAI,MAAO,QAAO,aAAa,IAAI,SAAS,KAAK;AACjD,aAAO,EAAE,SAAS,OAAO,SAAS,GAAG,GAAG;IAC1C;AAEA,QAAI,UAAW,QAAO,MAAM,SAAS;AAErC,UAAM,QAAQ,GAAG,EAAE,MAAM,IAAI;AAC7B,UAAM,UAAU,MACb;MAAI,CAAC,SACJ,iBAAiB;QACf,SAAS,KAAK,MAAM,CAAC,KAAK,KAAK,YAAY;QAC3C,OAAO,KAAK;QACZ,MAAM,GAAG,KAAK,cAAc,EAAE,IAAI,KAAK,aAAa,EAAE,GAAG,KAAK,KAAK,KAAK;QACxE,OAAO,KAAK;QACZ,YAAY,GAAG,OAAO;QACtB,cAAc;UACZ,OAAO,KAAK;UACZ,WAAW;UACX,cAAc;UACd;UACA,gBAAgB;QAClB;MACF,CAAC;IACH,EACC,KAAK,IAAI;AACZ,UAAM,cAAc;oCACY,OAAO;uDACY,WAAW,QAAQ,CAAC;0DACjB,WAAW,WAAW,CAAC;mDAC9B,WAAW,KAAK,CAAC;4DACR,WAAW,aAAa,CAAC;;;;AAIjF,WAAO,EAAE;MACP,eAAe,wBAAwB,uCAAuC,GAAG,OAAO,GAAG,WAAW,EAAE;MACxG;IACF;EACF,CAAC;AAED,MAAI,KAAK,4BAA4B,OAAO,MAAM;AAChD,UAAM,OAAO,MAAM,EAAE,IAAI,UAAU;AACnC,UAAM,QAAQ,OAAO,KAAK,SAAS,EAAE;AACrC,UAAM,cAAc,OAAO,KAAK,gBAAgB,EAAE;AAClD,QAAI,CAAC,SAAS,CAAC,aAAa;AAC1B,aAAO,YAAY,GAAG,KAAK,mBAAmB,qCAAqC;IACrF;AACA,UAAM,OAAO,kBAAkB,GAAG,GAAG,KAAK;AAC1C,UAAM,mBAAmB,GAAG,EACzB,YAAY,OAAO,WAAW,KAAK,SAAS,EAC5C,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ;AACpC,UAAM,OAAO,YAAY,SAAS;AAClC,OAAG,EAAE,WAAW,OAAO;MACrB;MACA,SAAS,KAAK;MACd,iBAAiB,kBAAkB,mBAAmB;MACtD,WAAW,OAAO,KAAK,aAAa,EAAE;MACtC,cAAc;MACd,gBAAgB,OAAO,KAAK,kBAAkB,EAAE,KAAK;MACrD,MAAM;IACR,CAAC;AACD,UAAM,SAAS,IAAI,IAAI,WAAW;AAClC,WAAO,aAAa,IAAI,QAAQ,IAAI;AACpC,UAAM,QAAQ,OAAO,KAAK,SAAS,EAAE;AACrC,QAAI,MAAO,QAAO,aAAa,IAAI,SAAS,KAAK;AACjD,WAAO,EAAE,SAAS,OAAO,SAAS,GAAG,GAAG;EAC1C,CAAC;AAED,MAAI,KAAK,iBAAiB,OAAO,MAAM;AACrC,UAAM,cAAc,EAAE,IAAI,OAAO,cAAc,KAAK;AACpD,UAAM,OAAO,YAAY,SAAS,MAAM,IAClC,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE,IACnC,MAAM,EAAE,IAAI,UAAU;AAC5B,UAAM,YAAY,OAAO,KAAK,cAAc,EAAE;AAE9C,QAAI,cAAc,iBAAiB;AACjC,YAAM,eAAe,OAAO,KAAK,iBAAiB,EAAE;AACpD,YAAMA,WAAU,GAAG,EAAE,SAAS,UAAU,iBAAiB,YAAY;AACrE,UAAI,CAACA,YAAWA,SAAQ,SAAS;AAC/B,eAAO,YAAY,GAAG,KAAK,iBAAiB,2BAA2B;MACzE;AACA,SAAG,EAAE,SAAS,OAAOA,SAAQ,IAAI,EAAE,SAAS,KAAK,CAAC;AAClD,YAAM,UAAU,GAAG,EAAE,SAAS,OAAO;QACnC,WAAW,SAAS,SAAS;QAC7B,eAAe,YAAY,IAAI;QAC/B,SAASA,SAAQ;QACjB,iBAAiBA,SAAQ;QACzB,WAAWA,SAAQ;QACnB,SAAS;MACX,CAAC;AACD,YAAMC,YAAW,QAAQ,IAAI,2BAA2BD,SAAQ;AAChE,YAAME,eAAc,MAAM;QACxB;UACE,KAAKF,SAAQ;UACb,KAAK,QAAQ;UACb,GAAIA,SAAQ,kBAAkB,EAAE,QAAQA,SAAQ,gBAAgB,IAAI,CAAC;UACrE,aAAa,CAAC;QAChB;QACA,EAAE,QAAQ,SAAS,UAAAC,UAAS;MAC9B;AACA,aAAO,EAAE,KAAK;QACZ,cAAcC;QACd,YAAY;QACZ,YAAY;QACZ,eAAe,QAAQ;MACzB,CAAC;IACH;AAEA,QAAI,cAAc,sBAAsB;AACtC,aAAO,YAAY,GAAG,KAAK,0BAA0B,2BAA2B,SAAS,EAAE;IAC7F;AACA,UAAM,OAAO,OAAO,KAAK,QAAQ,EAAE;AACnC,UAAM,YAAY,GAAG,EAAE,WAAW,UAAU,QAAQ,IAAI;AACxD,QAAI,CAAC,aAAa,UAAU,MAAM;AAChC,aAAO,YAAY,GAAG,KAAK,iBAAiB,uCAAuC;IACrF;AACA,OAAG,EAAE,WAAW,OAAO,UAAU,IAAI,EAAE,MAAM,KAAK,CAAC;AAInD,UAAM,WAAW,QAAQ,IAAI,2BAA2B,UAAU;AAClE,UAAM,UAAU,GAAG,EAAE,SAAS,OAAO;MACnC,WAAW,SAAS,SAAS;MAC7B,eAAe,YAAY,IAAI;MAC/B,SAAS,UAAU;MACnB,iBAAiB,UAAU;MAC3B,WAAW,UAAU;MACrB,SAAS;IACX,CAAC;AACD,UAAM,cAAc,MAAM;MACxB;QACE,KAAK,UAAU;QACf,KAAK,QAAQ;QACb,GAAI,UAAU,kBAAkB,EAAE,QAAQ,UAAU,gBAAgB,IAAI,CAAC;QACzE,aAAa,CAAC;MAChB;MACA,EAAE,QAAQ,SAAS,SAAS;IAC9B;AACA,WAAO,EAAE,KAAK;MACZ,cAAc;MACd,YAAY;MACZ,YAAY;MACZ,eAAe,QAAQ;IACzB,CAAC;EACH,CAAC;AACH;AChOO,IAAM,WAA4B;EACvC,IAAI;EACJ,MAAM;EACN,aACE;EACF,SAAS;EACT,UAAU;IACR,EAAE,IAAI,QAAQ,MAAM,QAAQ,OAAO,mBAAmB,QAAQ,WAAW,UAAU,IAAI;IACvF,EAAE,IAAI,WAAW,MAAM,MAAM,OAAO,wBAAwB,QAAQ,aAAa,UAAU,6BAA6B;IACxH,EAAE,IAAI,SAAS,MAAM,QAAQ,OAAO,oCAAoC,QAAQ,aAAa,UAAU,UAAU;IACjH,EAAE,IAAI,SAAS,MAAM,QAAQ,OAAO,YAAY,QAAQ,aAAa,UAAU,eAAe;EAChG;EACA,MAAM,CAAC,EAAE,IAAI,WAAW,OAAO,qBAAqB,MAAM,WAAW,QAAQ,YAAY,CAAC;EAC1F,OAAO;IACL;MACE,MAAM;MACN,OAAO;MACP,UAAU;MACV,YAAY;QACV,EAAE,aAAa,4BAA4B,QAAQ,OAAO,MAAM,8BAA8B,QAAQ,gBAAgB;QACtH,EAAE,aAAa,+BAA+B,QAAQ,QAAQ,MAAM,iCAAiC,QAAQ,gBAAgB;QAC7H,EAAE,aAAa,0BAA0B,QAAQ,OAAO,MAAM,8BAA8B,QAAQ,gBAAgB;QACpH,EAAE,aAAa,oBAAoB,QAAQ,OAAO,MAAM,6CAA6C,QAAQ,gBAAgB;QAC7H,EAAE,aAAa,sBAAsB,QAAQ,QAAQ,MAAM,6CAA6C,QAAQ,gBAAgB;QAChI,EAAE,aAAa,mBAAmB,QAAQ,OAAO,MAAM,iDAAiD,QAAQ,gBAAgB;QAChI,EAAE,aAAa,sBAAsB,QAAQ,OAAO,MAAM,iDAAiD,QAAQ,gBAAgB;QACnI,EAAE,aAAa,sBAAsB,QAAQ,UAAU,MAAM,iDAAiD,QAAQ,gBAAgB;QACtI,EAAE,aAAa,oBAAoB,QAAQ,OAAO,MAAM,gCAAgC,QAAQ,gBAAgB;QAChH,EAAE,aAAa,oBAAoB,QAAQ,QAAQ,MAAM,gCAAgC,QAAQ,gBAAgB;QACjH,EAAE,aAAa,sBAAsB,QAAQ,QAAQ,MAAM,2CAA2C,QAAQ,gBAAgB;QAC9H,EAAE,aAAa,oBAAoB,QAAQ,OAAO,MAAM,uCAAuC,QAAQ,gBAAgB;QACvH,EAAE,aAAa,sBAAsB,QAAQ,QAAQ,MAAM,uCAAuC,QAAQ,gBAAgB;QAC1H,EAAE,aAAa,oBAAoB,QAAQ,QAAQ,MAAM,yBAAyB,QAAQ,gBAAgB;QAC1G,EAAE,aAAa,kBAAkB,QAAQ,UAAU,MAAM,iBAAiB,QAAQ,gBAAgB;QAClG,EAAE,aAAa,wBAAwB,QAAQ,QAAQ,MAAM,kBAAkB,QAAQ,gBAAgB;QACvG,EAAE,aAAa,qBAAqB,QAAQ,OAAO,MAAM,sBAAsB,QAAQ,gBAAgB;QACvG,EAAE,aAAa,wBAAwB,QAAQ,OAAO,MAAM,sBAAsB,QAAQ,gBAAgB;QAC1G,EAAE,aAAa,uBAAuB,QAAQ,OAAO,MAAM,4BAA4B,QAAQ,gBAAgB;QAC/G,EAAE,aAAa,YAAY,QAAQ,OAAO,MAAM,uBAAuB,QAAQ,gBAAgB;QAC/F,EAAE,aAAa,kBAAkB,QAAQ,OAAO,MAAM,2CAA2C,QAAQ,gBAAgB;QACzH,EAAE,aAAa,kBAAkB,QAAQ,QAAQ,MAAM,oBAAoB,QAAQ,gBAAgB;QACnG,EAAE,aAAa,mBAAmB,QAAQ,OAAO,MAAM,qBAAqB,QAAQ,gBAAgB;QACpG,EAAE,aAAa,eAAe,QAAQ,QAAQ,MAAM,iBAAiB,QAAQ,gBAAgB;QAC7F,EAAE,aAAa,gBAAgB,QAAQ,QAAQ,MAAM,gBAAgB,QAAQ,gBAAgB;QAC7F,EAAE,aAAa,oBAAoB,QAAQ,OAAO,MAAM,2BAA2B,QAAQ,gBAAgB;QAC3G,EAAE,aAAa,gBAAgB,QAAQ,OAAO,MAAM,oBAAoB,QAAQ,gBAAgB;QAChG,EAAE,aAAa,gBAAgB,QAAQ,UAAU,MAAM,oBAAoB,QAAQ,gBAAgB;MACrG;IACF;EACF;EACA,YAAY;IACV,aAAa;IACb,QAAQ;MACN;QACE,KAAK;QACL,OAAO;QACP,aAAa;QACb,SAAS,CAAC,EAAE,OAAO,qBAAqB,YAAY,SAAS,WAAW,OAAO,CAAC;MAClF;MACA;QACE,KAAK;QACL,OAAO;QACP,aAAa;QACb,SAAS,CAAC,EAAE,MAAM,QAAQ,SAAS,CAAC,mBAAmB,EAAE,CAAC;MAC5D;IACF;IACA,SAAS;MACP,OAAO,CAAC,EAAE,OAAO,qBAAqB,YAAY,SAAS,WAAW,OAAO,CAAC;MAC9E,eAAe,CAAC,EAAE,MAAM,QAAQ,SAAS,CAAC,mBAAmB,EAAE,CAAC;IAClE;EACF;EACA,YAAY;IACV,aAAa;IACb,aAAa;MACX,EAAE,MAAM,eAAe;MACvB,EAAE,MAAM,uBAAuB;MAC/B,EAAE,MAAM,qBAAqB;MAC7B,EAAE,MAAM,qBAAqB;MAC7B,EAAE,MAAM,kBAAkB;MAC1B,EAAE,MAAM,kBAAkB;MAC1B,EAAE,MAAM,uBAAuB;MAC/B,EAAE,MAAM,uBAAuB;IACjC;EACF;EACA,aAAa;IACX;MACE,IAAI;MACJ,OAAO;MACP,MAAM;MACN,UAAU;MACV,aAAa;MACb,UACE;IACJ;EACF;AACF;AC7EO,SAAS,eAAe,OAAc,UAAkB,QAAgC;AAC7F,QAAM,KAAK,eAAe,KAAK;AAC/B,aAAW,QAAQ,OAAO,SAAS,CAAC,GAAG;AACrC,UAAM,UAAU,kBAAkB,IAAI,KAAK,KAAK;AAChD,QAAI,KAAK,cAAc,KAAK,WAAW;AACrC,SAAG,MAAM,OAAO,QAAQ,IAAI;QAC1B,YAAY,KAAK,cAAc,QAAQ;QACvC,WAAW,KAAK,aAAa,QAAQ;MACvC,CAAC;IACH;EACF;AACA,aAAW,gBAAgB,OAAO,iBAAiB,CAAC,GAAG;AACrD,UAAM,MAAM,GAAG,cAAc,OAAO;MAClC,WAAW,SAAS,KAAK;MACzB,MAAM,aAAa;MACnB,aAAa;IACf,CAAC;AACD,eAAW,SAAS,aAAa,WAAW,CAAC,GAAG;AAC9C,YAAM,SAAS,kBAAkB,IAAI,KAAK;AAC1C,SAAG,YAAY,OAAO;QACpB,WAAW,SAAS,IAAI;QACxB,SAAS,OAAO;QAChB,iBAAiB,IAAI;QACrB,QAAQ;QACR,WAAW;MACb,CAAC;IACH;EACF;AACF;AAEO,IAAM,eAA8B;EACzC,MAAM;EACN,SACE,KACA,OACA,UACA,SACA,UACM;AACN,UAAM,MAAoB,EAAE,KAAK,OAAO,UAAU,SAAS,SAAS;AACpE,gBAAY,GAAG;AACf,yBAAqB,GAAG;AACxB,uBAAmB,GAAG;AACtB,iBAAa,GAAG;AAChB,gBAAY,GAAG;EACjB;EACA,KAAK,QAAe,UAAwB;EAE5C;AACF;AAEA,IAAO,gBAAQ;","names":["session","audience","accessToken"]}

package/dist/dist-JJ2ZRCAX.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../@emulators/autumn/src/store.ts","../../@emulators/autumn/src/routes/api.ts","../../@emulators/autumn/src/manifest.ts","../../@emulators/autumn/src/index.ts"],"sourcesContent":["import { Store, type Collection } from \"@emulators/core\";\n\nimport type { AutumnCustomer, AutumnTrackEvent } from \"./entities.js\";\n\nexport interface AutumnStore {\n  customers: Collection<AutumnCustomer>;\n  events: Collection<AutumnTrackEvent>;\n}\n\nexport function getAutumnStore(store: Store): AutumnStore {\n  return {\n    customers: store.collection<AutumnCustomer>(\"autumn.customers\", [\"customer_id\"]),\n    events: store.collection<AutumnTrackEvent>(\"autumn.events\", [\"customer_id\", \"feature_id\"]),\n  };\n}\n","import type { RouteContext } from \"@emulators/core\";\n\nimport { getAutumnStore, type AutumnStore } from \"../store.js\";\nimport type { AutumnCustomer } from \"../entities.js\";\n\nfunction serializeCustomer(customer: AutumnCustomer): Record<string, unknown> {\n  return {\n    id: customer.customer_id,\n    created_at: Date.parse(customer.created_at),\n    name: customer.name,\n    email: customer.email,\n    fingerprint: null,\n    stripe_id: `cus_emulate_${customer.id}`,\n    env: \"sandbox\",\n    metadata: {},\n    subscriptions: customer.subscriptions,\n    products: [],\n    features: {},\n    invoices: [],\n    purchases: [],\n    balances: {},\n    flags: {},\n    billing_controls: {},\n  };\n}\n\nfunction ensureCustomer(\n  as: AutumnStore,\n  id: string,\n  data: { name?: unknown; email?: unknown },\n): AutumnCustomer {\n  const existing = as.customers.findOneBy(\"customer_id\", id);\n  if (existing) return existing;\n  return as.customers.insert({\n    customer_id: id,\n    name: typeof data.name === \"string\" ? data.name : null,\n    email: typeof data.email === \"string\" ? data.email : null,\n    subscriptions: [],\n  });\n}\n\n/** Autumn v1 RPC-style API (paths mirror autumn-js: /v1/<group>.<method>). */\nexport function autumnApiRoutes(ctx: RouteContext): void {\n  const { app, store } = ctx;\n  const as = () => getAutumnStore(store);\n\n  app.post(\"/v1/customers.get_or_create\", async (c) => {\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const id = String(body.customer_id ?? body.id ?? \"\");\n    if (!id) return c.json({ message: \"customer_id is required\", code: \"invalid_request\" }, 400);\n    const data = (body.customer_data as Record<string, unknown> | undefined) ?? body;\n    const customer = ensureCustomer(as(), id, data);\n    return c.json(serializeCustomer(customer));\n  });\n\n  app.post(\"/v1/customers.list\", async (c) => {\n    const customers = as().customers.all().map(serializeCustomer);\n    return c.json({ list: customers, total: customers.length, offset: 0, limit: 100 });\n  });\n\n  app.post(\"/v1/customers.update\", async (c) => {\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const id = String(body.customer_id ?? body.id ?? \"\");\n    const customer = as().customers.findOneBy(\"customer_id\", id);\n    if (!customer) return c.json({ message: \"Customer not found\", code: \"not_found\" }, 404);\n    const updated = as().customers.update(customer.id, {\n      name: typeof body.name === \"string\" ? body.name : customer.name,\n      email: typeof body.email === \"string\" ? body.email : customer.email,\n    })!;\n    return c.json(serializeCustomer(updated));\n  });\n\n  app.post(\"/v1/balances.track\", async (c) => {\n    const body = (await c.req.json().catch(() => ({}))) as Record<string, unknown>;\n    const customerId = String(body.customer_id ?? \"\");\n    const featureId = String(body.feature_id ?? body.event_name ?? \"\");\n    if (!customerId || !featureId) {\n      return c.json({ message: \"customer_id and feature_id are required\", code: \"invalid_request\" }, 400);\n    }\n    ensureCustomer(as(), customerId, {});\n    const event = as().events.insert({\n      customer_id: customerId,\n      feature_id: featureId,\n      value: typeof body.value === \"number\" ? body.value : 1,\n    });\n    return c.json({\n      id: `evt_emulate_${event.id}`,\n      code: \"event_received\",\n      customer_id: customerId,\n      feature_id: featureId,\n    });\n  });\n\n  app.post(\"/v1/plans.list\", async (c) => c.json({ list: [], total: 0, offset: 0, limit: 100 }));\n  app.post(\"/v1/features.list\", async (c) =>\n    c.json({ list: [], total: 0, offset: 0, limit: 100 }),\n  );\n  app.post(\"/v1/events.list\", async (c) => {\n    const events = as()\n      .events.all()\n      .map((event) => ({\n        id: `evt_emulate_${event.id}`,\n        customer_id: event.customer_id,\n        feature_id: event.feature_id,\n        value: event.value,\n        timestamp: Date.parse(event.created_at),\n      }));\n    return c.json({ list: events, total: events.length, offset: 0, limit: 100 });\n  });\n}\n","import type { ServiceManifest } from \"@emulators/core\";\n\nexport const manifest: ServiceManifest = {\n  id: \"autumn\",\n  name: \"Autumn\",\n  description:\n    \"Stateful Autumn billing emulator: customers (with seedable subscriptions), usage tracking, and list endpoints for plans, features, and events.\",\n  docsUrl: \"https://docs.emulators.dev/autumn\",\n  surfaces: [{ id: \"rest\", kind: \"rest\", title: \"Autumn v1 API\", status: \"partial\", basePath: \"/v1\" }],\n  auth: [{ id: \"api-key\", title: \"Autumn secret key\", type: \"api-key\", status: \"supported\" }],\n  specs: [\n    {\n      kind: \"manual\",\n      title: \"Autumn v1 subset\",\n      coverage: \"hand-authored\",\n      operations: [\n        { operationId: \"customers.get_or_create\", method: \"POST\", path: \"/v1/customers.get_or_create\", status: \"hand-authored\" },\n        { operationId: \"customers.list\", method: \"POST\", path: \"/v1/customers.list\", status: \"hand-authored\" },\n        { operationId: \"customers.update\", method: \"POST\", path: \"/v1/customers.update\", status: \"hand-authored\" },\n        { operationId: \"balances.track\", method: \"POST\", path: \"/v1/balances.track\", status: \"hand-authored\" },\n        { operationId: \"plans.list\", method: \"POST\", path: \"/v1/plans.list\", status: \"hand-authored\" },\n        { operationId: \"features.list\", method: \"POST\", path: \"/v1/features.list\", status: \"hand-authored\" },\n        { operationId: \"events.list\", method: \"POST\", path: \"/v1/events.list\", status: \"hand-authored\" },\n      ],\n    },\n  ],\n  seedSchema: {\n    description: \"Seed customers with subscriptions (e.g. a paid plan).\",\n    fields: [\n      {\n        key: \"customers\",\n        title: \"Customers\",\n        description: \"Customers keyed by id, each with optional subscriptions.\",\n        example: [{ id: \"org_123\", subscriptions: [{ plan_id: \"pro\", status: \"active\" }] }],\n      },\n    ],\n    example: {\n      customers: [{ id: \"org_123\", subscriptions: [{ plan_id: \"pro\", status: \"active\" }] }],\n    },\n  },\n  stateModel: {\n    description: \"Entities mutated by Autumn provider calls.\",\n    collections: [{ name: \"autumn.customers\" }, { name: \"autumn.events\" }],\n  },\n  connections: [\n    {\n      id: \"autumn-js\",\n      title: \"autumn-js SDK\",\n      kind: \"sdk\",\n      language: \"typescript\",\n      description: \"Point autumn-js at the emulator via serverURL.\",\n      template:\n        'import { Autumn } from \"autumn-js\";\\n\\nconst autumn = new Autumn({ secretKey: \"{{token}}\", serverURL: \"{{baseUrl}}\" });',\n    },\n  ],\n};\n","import type { Hono, Store, WebhookDispatcher, TokenMap, AppEnv, RouteContext, ServicePlugin } from \"@emulators/core\";\n\nimport { getAutumnStore, type AutumnStore } from \"./store.js\";\nimport { autumnApiRoutes } from \"./routes/api.js\";\nimport { manifest } from \"./manifest.js\";\nimport type { AutumnSubscription } from \"./entities.js\";\n\nexport { getAutumnStore, type AutumnStore } from \"./store.js\";\nexport * from \"./entities.js\";\nexport { manifest } from \"./manifest.js\";\n\nexport interface AutumnSeedConfig {\n  customers?: Array<{\n    id: string;\n    name?: string;\n    email?: string;\n    subscriptions?: AutumnSubscription[];\n  }>;\n}\n\nexport function seedFromConfig(store: Store, _baseUrl: string, config: AutumnSeedConfig): void {\n  const as = getAutumnStore(store);\n  for (const customer of config.customers ?? []) {\n    const existing = as.customers.findOneBy(\"customer_id\", customer.id);\n    if (existing) {\n      as.customers.update(existing.id, {\n        name: customer.name ?? existing.name,\n        email: customer.email ?? existing.email,\n        subscriptions: customer.subscriptions ?? existing.subscriptions,\n      });\n      continue;\n    }\n    as.customers.insert({\n      customer_id: customer.id,\n      name: customer.name ?? null,\n      email: customer.email ?? null,\n      subscriptions: customer.subscriptions ?? [],\n    });\n  }\n}\n\nexport const autumnPlugin: ServicePlugin = {\n  name: \"autumn\",\n  register(\n    app: Hono<AppEnv>,\n    store: Store,\n    webhooks: WebhookDispatcher,\n    baseUrl: string,\n    tokenMap?: TokenMap,\n  ): void {\n    const ctx: RouteContext = { app, store, webhooks, baseUrl, tokenMap };\n    autumnApiRoutes(ctx);\n  },\n  seed(_store: Store, _baseUrl: string): void {\n    // No default seed; customers are created on first get_or_create.\n  },\n};\n\nexport default autumnPlugin;\n"],"mappings":";AASO,SAAS,eAAe,OAA2B;AACxD,SAAO;IACL,WAAW,MAAM,WAA2B,oBAAoB,CAAC,aAAa,CAAC;IAC/E,QAAQ,MAAM,WAA6B,iBAAiB,CAAC,eAAe,YAAY,CAAC;EAC3F;AACF;ACTA,SAAS,kBAAkB,UAAmD;AAC5E,SAAO;IACL,IAAI,SAAS;IACb,YAAY,KAAK,MAAM,SAAS,UAAU;IAC1C,MAAM,SAAS;IACf,OAAO,SAAS;IAChB,aAAa;IACb,WAAW,eAAe,SAAS,EAAE;IACrC,KAAK;IACL,UAAU,CAAC;IACX,eAAe,SAAS;IACxB,UAAU,CAAC;IACX,UAAU,CAAC;IACX,UAAU,CAAC;IACX,WAAW,CAAC;IACZ,UAAU,CAAC;IACX,OAAO,CAAC;IACR,kBAAkB,CAAC;EACrB;AACF;AAEA,SAAS,eACP,IACA,IACA,MACgB;AAChB,QAAM,WAAW,GAAG,UAAU,UAAU,eAAe,EAAE;AACzD,MAAI,SAAU,QAAO;AACrB,SAAO,GAAG,UAAU,OAAO;IACzB,aAAa;IACb,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;IAClD,OAAO,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;IACrD,eAAe,CAAC;EAClB,CAAC;AACH;AAGO,SAAS,gBAAgB,KAAyB;AACvD,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,KAAK,MAAM,eAAe,KAAK;AAErC,MAAI,KAAK,+BAA+B,OAAO,MAAM;AACnD,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,KAAK,OAAO,KAAK,eAAe,KAAK,MAAM,EAAE;AACnD,QAAI,CAAC,GAAI,QAAO,EAAE,KAAK,EAAE,SAAS,2BAA2B,MAAM,kBAAkB,GAAG,GAAG;AAC3F,UAAM,OAAQ,KAAK,iBAAyD;AAC5E,UAAM,WAAW,eAAe,GAAG,GAAG,IAAI,IAAI;AAC9C,WAAO,EAAE,KAAK,kBAAkB,QAAQ,CAAC;EAC3C,CAAC;AAED,MAAI,KAAK,sBAAsB,OAAO,MAAM;AAC1C,UAAM,YAAY,GAAG,EAAE,UAAU,IAAI,EAAE,IAAI,iBAAiB;AAC5D,WAAO,EAAE,KAAK,EAAE,MAAM,WAAW,OAAO,UAAU,QAAQ,QAAQ,GAAG,OAAO,IAAI,CAAC;EACnF,CAAC;AAED,MAAI,KAAK,wBAAwB,OAAO,MAAM;AAC5C,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,KAAK,OAAO,KAAK,eAAe,KAAK,MAAM,EAAE;AACnD,UAAM,WAAW,GAAG,EAAE,UAAU,UAAU,eAAe,EAAE;AAC3D,QAAI,CAAC,SAAU,QAAO,EAAE,KAAK,EAAE,SAAS,sBAAsB,MAAM,YAAY,GAAG,GAAG;AACtF,UAAM,UAAU,GAAG,EAAE,UAAU,OAAO,SAAS,IAAI;MACjD,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,SAAS;MAC3D,OAAO,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,SAAS;IAChE,CAAC;AACD,WAAO,EAAE,KAAK,kBAAkB,OAAO,CAAC;EAC1C,CAAC;AAED,MAAI,KAAK,sBAAsB,OAAO,MAAM;AAC1C,UAAM,OAAQ,MAAM,EAAE,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,UAAM,aAAa,OAAO,KAAK,eAAe,EAAE;AAChD,UAAM,YAAY,OAAO,KAAK,cAAc,KAAK,cAAc,EAAE;AACjE,QAAI,CAAC,cAAc,CAAC,WAAW;AAC7B,aAAO,EAAE,KAAK,EAAE,SAAS,2CAA2C,MAAM,kBAAkB,GAAG,GAAG;IACpG;AACA,mBAAe,GAAG,GAAG,YAAY,CAAC,CAAC;AACnC,UAAM,QAAQ,GAAG,EAAE,OAAO,OAAO;MAC/B,aAAa;MACb,YAAY;MACZ,OAAO,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;IACvD,CAAC;AACD,WAAO,EAAE,KAAK;MACZ,IAAI,eAAe,MAAM,EAAE;MAC3B,MAAM;MACN,aAAa;MACb,YAAY;IACd,CAAC;EACH,CAAC;AAED,MAAI,KAAK,kBAAkB,OAAO,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,IAAI,CAAC,CAAC;AAC7F,MAAI;IAAK;IAAqB,OAAO,MACnC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,IAAI,CAAC;EACtD;AACA,MAAI,KAAK,mBAAmB,OAAO,MAAM;AACvC,UAAM,SAAS,GAAG,EACf,OAAO,IAAI,EACX,IAAI,CAAC,WAAW;MACf,IAAI,eAAe,MAAM,EAAE;MAC3B,aAAa,MAAM;MACnB,YAAY,MAAM;MAClB,OAAO,MAAM;MACb,WAAW,KAAK,MAAM,MAAM,UAAU;IACxC,EAAE;AACJ,WAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,OAAO,OAAO,QAAQ,QAAQ,GAAG,OAAO,IAAI,CAAC;EAC7E,CAAC;AACH;AC3GO,IAAM,WAA4B;EACvC,IAAI;EACJ,MAAM;EACN,aACE;EACF,SAAS;EACT,UAAU,CAAC,EAAE,IAAI,QAAQ,MAAM,QAAQ,OAAO,iBAAiB,QAAQ,WAAW,UAAU,MAAM,CAAC;EACnG,MAAM,CAAC,EAAE,IAAI,WAAW,OAAO,qBAAqB,MAAM,WAAW,QAAQ,YAAY,CAAC;EAC1F,OAAO;IACL;MACE,MAAM;MACN,OAAO;MACP,UAAU;MACV,YAAY;QACV,EAAE,aAAa,2BAA2B,QAAQ,QAAQ,MAAM,+BAA+B,QAAQ,gBAAgB;QACvH,EAAE,aAAa,kBAAkB,QAAQ,QAAQ,MAAM,sBAAsB,QAAQ,gBAAgB;QACrG,EAAE,aAAa,oBAAoB,QAAQ,QAAQ,MAAM,wBAAwB,QAAQ,gBAAgB;QACzG,EAAE,aAAa,kBAAkB,QAAQ,QAAQ,MAAM,sBAAsB,QAAQ,gBAAgB;QACrG,EAAE,aAAa,cAAc,QAAQ,QAAQ,MAAM,kBAAkB,QAAQ,gBAAgB;QAC7F,EAAE,aAAa,iBAAiB,QAAQ,QAAQ,MAAM,qBAAqB,QAAQ,gBAAgB;QACnG,EAAE,aAAa,eAAe,QAAQ,QAAQ,MAAM,mBAAmB,QAAQ,gBAAgB;MACjG;IACF;EACF;EACA,YAAY;IACV,aAAa;IACb,QAAQ;MACN;QACE,KAAK;QACL,OAAO;QACP,aAAa;QACb,SAAS,CAAC,EAAE,IAAI,WAAW,eAAe,CAAC,EAAE,SAAS,OAAO,QAAQ,SAAS,CAAC,EAAE,CAAC;MACpF;IACF;IACA,SAAS;MACP,WAAW,CAAC,EAAE,IAAI,WAAW,eAAe,CAAC,EAAE,SAAS,OAAO,QAAQ,SAAS,CAAC,EAAE,CAAC;IACtF;EACF;EACA,YAAY;IACV,aAAa;IACb,aAAa,CAAC,EAAE,MAAM,mBAAmB,GAAG,EAAE,MAAM,gBAAgB,CAAC;EACvE;EACA,aAAa;IACX;MACE,IAAI;MACJ,OAAO;MACP,MAAM;MACN,UAAU;MACV,aAAa;MACb,UACE;IACJ;EACF;AACF;ACnCO,SAAS,eAAe,OAAc,UAAkB,QAAgC;AAC7F,QAAM,KAAK,eAAe,KAAK;AAC/B,aAAW,YAAY,OAAO,aAAa,CAAC,GAAG;AAC7C,UAAM,WAAW,GAAG,UAAU,UAAU,eAAe,SAAS,EAAE;AAClE,QAAI,UAAU;AACZ,SAAG,UAAU,OAAO,SAAS,IAAI;QAC/B,MAAM,SAAS,QAAQ,SAAS;QAChC,OAAO,SAAS,SAAS,SAAS;QAClC,eAAe,SAAS,iBAAiB,SAAS;MACpD,CAAC;AACD;IACF;AACA,OAAG,UAAU,OAAO;MAClB,aAAa,SAAS;MACtB,MAAM,SAAS,QAAQ;MACvB,OAAO,SAAS,SAAS;MACzB,eAAe,SAAS,iBAAiB,CAAC;IAC5C,CAAC;EACH;AACF;AAEO,IAAM,eAA8B;EACzC,MAAM;EACN,SACE,KACA,OACA,UACA,SACA,UACM;AACN,UAAM,MAAoB,EAAE,KAAK,OAAO,UAAU,SAAS,SAAS;AACpE,oBAAgB,GAAG;EACrB;EACA,KAAK,QAAe,UAAwB;EAE5C;AACF;AAEA,IAAO,gBAAQ;","names":[]}