@hexclave/shared 1.0.41 → 1.0.42

package/dist/interface/client-interface.js.map

@@ -1 +1 @@
-{"version":3,"file":"client-interface.js","names":["KnownErrors","HexclaveAssertionError","globalVar","KnownError","Result","publishableClientKeyNotNecessarySentinel","oauth.ClientSecretPost","oauth.refreshTokenGrantRequest","oauth.allowInsecureRequests","oauth.processRefreshTokenResponse","oauth.ResponseBodyError","AccessToken","InternalSession","HTTP_METHODS","oauth.validateAuthResponse","oauth.AuthorizationResponseError","oauth.authorizationCodeGrantRequest","oauth.processAuthorizationCodeResponse"],"sources":["../../../../node_modules/.pnpm/oauth4webapi@3.8.5/node_modules/oauth4webapi/build/index.js","../../src/interface/client-interface.ts"],"sourcesContent":["let USER_AGENT;\nif (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {\n    const NAME = 'oauth4webapi';\n    const VERSION = 'v3.8.5';\n    USER_AGENT = `${NAME}/${VERSION}`;\n}\nfunction looseInstanceOf(input, expected) {\n    if (input == null) {\n        return false;\n    }\n    try {\n        return (input instanceof expected ||\n            Object.getPrototypeOf(input)[Symbol.toStringTag] === expected.prototype[Symbol.toStringTag]);\n    }\n    catch {\n        return false;\n    }\n}\nconst ERR_INVALID_ARG_VALUE = 'ERR_INVALID_ARG_VALUE';\nconst ERR_INVALID_ARG_TYPE = 'ERR_INVALID_ARG_TYPE';\nfunction CodedTypeError(message, code, cause) {\n    const err = new TypeError(message, { cause });\n    Object.assign(err, { code });\n    return err;\n}\nexport const allowInsecureRequests = Symbol();\nexport const clockSkew = Symbol();\nexport const clockTolerance = Symbol();\nexport const customFetch = Symbol();\nexport const modifyAssertion = Symbol();\nexport const jweDecrypt = Symbol();\nexport const jwksCache = Symbol();\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\nfunction buf(input) {\n    if (typeof input === 'string') {\n        return encoder.encode(input);\n    }\n    return decoder.decode(input);\n}\nlet encodeBase64Url;\nif (Uint8Array.prototype.toBase64) {\n    encodeBase64Url = (input) => {\n        if (input instanceof ArrayBuffer) {\n            input = new Uint8Array(input);\n        }\n        return input.toBase64({ alphabet: 'base64url', omitPadding: true });\n    };\n}\nelse {\n    const CHUNK_SIZE = 0x8000;\n    encodeBase64Url = (input) => {\n        if (input instanceof ArrayBuffer) {\n            input = new Uint8Array(input);\n        }\n        const arr = [];\n        for (let i = 0; i < input.byteLength; i += CHUNK_SIZE) {\n            arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n        }\n        return btoa(arr.join('')).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n    };\n}\nlet decodeBase64Url;\nif (Uint8Array.fromBase64) {\n    decodeBase64Url = (input) => {\n        try {\n            return Uint8Array.fromBase64(input, { alphabet: 'base64url' });\n        }\n        catch (cause) {\n            throw CodedTypeError('The input to be decoded is not correctly encoded.', ERR_INVALID_ARG_VALUE, cause);\n        }\n    };\n}\nelse {\n    decodeBase64Url = (input) => {\n        try {\n            const binary = atob(input.replace(/-/g, '+').replace(/_/g, '/').replace(/\\s/g, ''));\n            const bytes = new Uint8Array(binary.length);\n            for (let i = 0; i < binary.length; i++) {\n                bytes[i] = binary.charCodeAt(i);\n            }\n            return bytes;\n        }\n        catch (cause) {\n            throw CodedTypeError('The input to be decoded is not correctly encoded.', ERR_INVALID_ARG_VALUE, cause);\n        }\n    };\n}\nfunction b64u(input) {\n    if (typeof input === 'string') {\n        return decodeBase64Url(input);\n    }\n    return encodeBase64Url(input);\n}\nexport class UnsupportedOperationError extends Error {\n    code;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        this.code = UNSUPPORTED_OPERATION;\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class OperationProcessingError extends Error {\n    code;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        if (options?.code) {\n            this.code = options?.code;\n        }\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nfunction OPE(message, code, cause) {\n    return new OperationProcessingError(message, { code, cause });\n}\nasync function calculateJwkThumbprint(jwk) {\n    let components;\n    switch (jwk.kty) {\n        case 'EC':\n            components = {\n                crv: jwk.crv,\n                kty: jwk.kty,\n                x: jwk.x,\n                y: jwk.y,\n            };\n            break;\n        case 'OKP':\n            components = {\n                crv: jwk.crv,\n                kty: jwk.kty,\n                x: jwk.x,\n            };\n            break;\n        case 'AKP':\n            components = {\n                alg: jwk.alg,\n                kty: jwk.kty,\n                pub: jwk.pub,\n            };\n            break;\n        case 'RSA':\n            components = {\n                e: jwk.e,\n                kty: jwk.kty,\n                n: jwk.n,\n            };\n            break;\n        default:\n            throw new UnsupportedOperationError('unsupported JWK key type', { cause: jwk });\n    }\n    return b64u(await crypto.subtle.digest('SHA-256', buf(JSON.stringify(components))));\n}\nfunction assertCryptoKey(key, it) {\n    if (!(key instanceof CryptoKey)) {\n        throw CodedTypeError(`${it} must be a CryptoKey`, ERR_INVALID_ARG_TYPE);\n    }\n}\nfunction assertPrivateKey(key, it) {\n    assertCryptoKey(key, it);\n    if (key.type !== 'private') {\n        throw CodedTypeError(`${it} must be a private CryptoKey`, ERR_INVALID_ARG_VALUE);\n    }\n}\nfunction assertPublicKey(key, it) {\n    assertCryptoKey(key, it);\n    if (key.type !== 'public') {\n        throw CodedTypeError(`${it} must be a public CryptoKey`, ERR_INVALID_ARG_VALUE);\n    }\n}\nfunction normalizeTyp(value) {\n    return value.toLowerCase().replace(/^application\\//, '');\n}\nfunction isJsonObject(input) {\n    if (input === null || typeof input !== 'object' || Array.isArray(input)) {\n        return false;\n    }\n    return true;\n}\nfunction prepareHeaders(input) {\n    if (looseInstanceOf(input, Headers)) {\n        input = Object.fromEntries(input.entries());\n    }\n    const headers = new Headers(input ?? {});\n    if (USER_AGENT && !headers.has('user-agent')) {\n        headers.set('user-agent', USER_AGENT);\n    }\n    if (headers.has('authorization')) {\n        throw CodedTypeError('\"options.headers\" must not include the \"authorization\" header name', ERR_INVALID_ARG_VALUE);\n    }\n    return headers;\n}\nfunction signal(url, value) {\n    if (value !== undefined) {\n        if (typeof value === 'function') {\n            value = value(url.href);\n        }\n        if (!(value instanceof AbortSignal)) {\n            throw CodedTypeError('\"options.signal\" must return or be an instance of AbortSignal', ERR_INVALID_ARG_TYPE);\n        }\n        return value;\n    }\n    return undefined;\n}\nfunction replaceDoubleSlash(pathname) {\n    if (pathname.includes('//')) {\n        return pathname.replace('//', '/');\n    }\n    return pathname;\n}\nfunction prependWellKnown(url, wellKnown, allowTerminatingSlash = false) {\n    if (url.pathname === '/') {\n        url.pathname = wellKnown;\n    }\n    else {\n        url.pathname = replaceDoubleSlash(`${wellKnown}/${allowTerminatingSlash ? url.pathname : url.pathname.replace(/(\\/)$/, '')}`);\n    }\n    return url;\n}\nfunction appendWellKnown(url, wellKnown) {\n    url.pathname = replaceDoubleSlash(`${url.pathname}/${wellKnown}`);\n    return url;\n}\nasync function performDiscovery(input, urlName, transform, options) {\n    if (!(input instanceof URL)) {\n        throw CodedTypeError(`\"${urlName}\" must be an instance of URL`, ERR_INVALID_ARG_TYPE);\n    }\n    checkProtocol(input, options?.[allowInsecureRequests] !== true);\n    const url = transform(new URL(input.href));\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    return (options?.[customFetch] || fetch)(url.href, {\n        body: undefined,\n        headers: Object.fromEntries(headers.entries()),\n        method: 'GET',\n        redirect: 'manual',\n        signal: signal(url, options?.signal),\n    });\n}\nexport async function discoveryRequest(issuerIdentifier, options) {\n    return performDiscovery(issuerIdentifier, 'issuerIdentifier', (url) => {\n        switch (options?.algorithm) {\n            case undefined:\n            case 'oidc':\n                appendWellKnown(url, '.well-known/openid-configuration');\n                break;\n            case 'oauth2':\n                prependWellKnown(url, '.well-known/oauth-authorization-server');\n                break;\n            default:\n                throw CodedTypeError('\"options.algorithm\" must be \"oidc\" (default), or \"oauth2\"', ERR_INVALID_ARG_VALUE);\n        }\n        return url;\n    }, options);\n}\nfunction assertNumber(input, allow0, it, code, cause) {\n    try {\n        if (typeof input !== 'number' || !Number.isFinite(input)) {\n            throw CodedTypeError(`${it} must be a number`, ERR_INVALID_ARG_TYPE, cause);\n        }\n        if (input > 0)\n            return;\n        if (allow0) {\n            if (input !== 0) {\n                throw CodedTypeError(`${it} must be a non-negative number`, ERR_INVALID_ARG_VALUE, cause);\n            }\n            return;\n        }\n        throw CodedTypeError(`${it} must be a positive number`, ERR_INVALID_ARG_VALUE, cause);\n    }\n    catch (err) {\n        if (code) {\n            throw OPE(err.message, code, cause);\n        }\n        throw err;\n    }\n}\nfunction assertString(input, it, code, cause) {\n    try {\n        if (typeof input !== 'string') {\n            throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE, cause);\n        }\n        if (input.length === 0) {\n            throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE, cause);\n        }\n    }\n    catch (err) {\n        if (code) {\n            throw OPE(err.message, code, cause);\n        }\n        throw err;\n    }\n}\nexport async function processDiscoveryResponse(expectedIssuerIdentifier, response) {\n    const expected = expectedIssuerIdentifier;\n    if (!(expected instanceof URL) && expected !== _nodiscoverycheck) {\n        throw CodedTypeError('\"expectedIssuerIdentifier\" must be an instance of URL', ERR_INVALID_ARG_TYPE);\n    }\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    if (response.status !== 200) {\n        throw OPE('\"response\" is not a conform Authorization Server Metadata response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);\n    }\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.issuer, '\"response\" body \"issuer\" property', INVALID_RESPONSE, { body: json });\n    if (expected !== _nodiscoverycheck && new URL(json.issuer).href !== expected.href) {\n        throw OPE('\"response\" body \"issuer\" property does not match the expected value', JSON_ATTRIBUTE_COMPARISON, { expected: expected.href, body: json, attribute: 'issuer' });\n    }\n    return json;\n}\nfunction assertApplicationJson(response) {\n    assertContentType(response, 'application/json');\n}\nfunction notJson(response, ...types) {\n    let msg = '\"response\" content-type must be ';\n    if (types.length > 2) {\n        const last = types.pop();\n        msg += `${types.join(', ')}, or ${last}`;\n    }\n    else if (types.length === 2) {\n        msg += `${types[0]} or ${types[1]}`;\n    }\n    else {\n        msg += types[0];\n    }\n    return OPE(msg, RESPONSE_IS_NOT_JSON, response);\n}\nfunction assertContentTypes(response, ...types) {\n    if (!types.includes(getContentType(response))) {\n        throw notJson(response, ...types);\n    }\n}\nfunction assertContentType(response, contentType) {\n    if (getContentType(response) !== contentType) {\n        throw notJson(response, contentType);\n    }\n}\nfunction randomBytes() {\n    return b64u(crypto.getRandomValues(new Uint8Array(32)));\n}\nexport function generateRandomCodeVerifier() {\n    return randomBytes();\n}\nexport function generateRandomState() {\n    return randomBytes();\n}\nexport function generateRandomNonce() {\n    return randomBytes();\n}\nexport async function calculatePKCECodeChallenge(codeVerifier) {\n    assertString(codeVerifier, 'codeVerifier');\n    return b64u(await crypto.subtle.digest('SHA-256', buf(codeVerifier)));\n}\nfunction getKeyAndKid(input) {\n    if (input instanceof CryptoKey) {\n        return { key: input };\n    }\n    if (!(input?.key instanceof CryptoKey)) {\n        return {};\n    }\n    if (input.kid !== undefined) {\n        assertString(input.kid, '\"kid\"');\n    }\n    return {\n        key: input.key,\n        kid: input.kid,\n    };\n}\nfunction psAlg(key) {\n    switch (key.algorithm.hash.name) {\n        case 'SHA-256':\n            return 'PS256';\n        case 'SHA-384':\n            return 'PS384';\n        case 'SHA-512':\n            return 'PS512';\n        default:\n            throw new UnsupportedOperationError('unsupported RsaHashedKeyAlgorithm hash name', {\n                cause: key,\n            });\n    }\n}\nfunction rsAlg(key) {\n    switch (key.algorithm.hash.name) {\n        case 'SHA-256':\n            return 'RS256';\n        case 'SHA-384':\n            return 'RS384';\n        case 'SHA-512':\n            return 'RS512';\n        default:\n            throw new UnsupportedOperationError('unsupported RsaHashedKeyAlgorithm hash name', {\n                cause: key,\n            });\n    }\n}\nfunction esAlg(key) {\n    switch (key.algorithm.namedCurve) {\n        case 'P-256':\n            return 'ES256';\n        case 'P-384':\n            return 'ES384';\n        case 'P-521':\n            return 'ES512';\n        default:\n            throw new UnsupportedOperationError('unsupported EcKeyAlgorithm namedCurve', { cause: key });\n    }\n}\nfunction keyToJws(key) {\n    switch (key.algorithm.name) {\n        case 'RSA-PSS':\n            return psAlg(key);\n        case 'RSASSA-PKCS1-v1_5':\n            return rsAlg(key);\n        case 'ECDSA':\n            return esAlg(key);\n        case 'Ed25519':\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            return key.algorithm.name;\n        case 'EdDSA':\n            return 'Ed25519';\n        default:\n            throw new UnsupportedOperationError('unsupported CryptoKey algorithm name', { cause: key });\n    }\n}\nfunction getClockSkew(client) {\n    const skew = client?.[clockSkew];\n    return typeof skew === 'number' && Number.isFinite(skew) ? skew : 0;\n}\nfunction getClockTolerance(client) {\n    const tolerance = client?.[clockTolerance];\n    return typeof tolerance === 'number' && Number.isFinite(tolerance) && Math.sign(tolerance) !== -1\n        ? tolerance\n        : 30;\n}\nfunction epochTime() {\n    return Math.floor(Date.now() / 1000);\n}\nfunction assertAs(as) {\n    if (typeof as !== 'object' || as === null) {\n        throw CodedTypeError('\"as\" must be an object', ERR_INVALID_ARG_TYPE);\n    }\n    assertString(as.issuer, '\"as.issuer\"');\n}\nfunction assertClient(client) {\n    if (typeof client !== 'object' || client === null) {\n        throw CodedTypeError('\"client\" must be an object', ERR_INVALID_ARG_TYPE);\n    }\n    assertString(client.client_id, '\"client.client_id\"');\n}\nfunction formUrlEncode(token) {\n    return encodeURIComponent(token).replace(/(?:[-_.!~*'()]|%20)/g, (substring) => {\n        switch (substring) {\n            case '-':\n            case '_':\n            case '.':\n            case '!':\n            case '~':\n            case '*':\n            case \"'\":\n            case '(':\n            case ')':\n                return `%${substring.charCodeAt(0).toString(16).toUpperCase()}`;\n            case '%20':\n                return '+';\n            default:\n                throw new Error();\n        }\n    });\n}\nexport function ClientSecretPost(clientSecret) {\n    assertString(clientSecret, '\"clientSecret\"');\n    return (_as, client, body, _headers) => {\n        body.set('client_id', client.client_id);\n        body.set('client_secret', clientSecret);\n    };\n}\nexport function ClientSecretBasic(clientSecret) {\n    assertString(clientSecret, '\"clientSecret\"');\n    return (_as, client, _body, headers) => {\n        const username = formUrlEncode(client.client_id);\n        const password = formUrlEncode(clientSecret);\n        const credentials = btoa(`${username}:${password}`);\n        headers.set('authorization', `Basic ${credentials}`);\n    };\n}\nfunction clientAssertionPayload(as, client) {\n    const now = epochTime() + getClockSkew(client);\n    return {\n        jti: randomBytes(),\n        aud: as.issuer,\n        exp: now + 60,\n        iat: now,\n        nbf: now,\n        iss: client.client_id,\n        sub: client.client_id,\n    };\n}\nexport function PrivateKeyJwt(clientPrivateKey, options) {\n    const { key, kid } = getKeyAndKid(clientPrivateKey);\n    assertPrivateKey(key, '\"clientPrivateKey.key\"');\n    return async (as, client, body, _headers) => {\n        const header = { alg: keyToJws(key), kid };\n        const payload = clientAssertionPayload(as, client);\n        options?.[modifyAssertion]?.(header, payload);\n        body.set('client_id', client.client_id);\n        body.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');\n        body.set('client_assertion', await signJwt(header, payload, key));\n    };\n}\nexport function ClientSecretJwt(clientSecret, options) {\n    assertString(clientSecret, '\"clientSecret\"');\n    const modify = options?.[modifyAssertion];\n    let key;\n    return async (as, client, body, _headers) => {\n        key ||= await crypto.subtle.importKey('raw', buf(clientSecret), { hash: 'SHA-256', name: 'HMAC' }, false, ['sign']);\n        const header = { alg: 'HS256' };\n        const payload = clientAssertionPayload(as, client);\n        modify?.(header, payload);\n        const data = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(payload)))}`;\n        const hmac = await crypto.subtle.sign(key.algorithm, key, buf(data));\n        body.set('client_id', client.client_id);\n        body.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');\n        body.set('client_assertion', `${data}.${b64u(new Uint8Array(hmac))}`);\n    };\n}\nexport function None() {\n    return (_as, client, body, _headers) => {\n        body.set('client_id', client.client_id);\n    };\n}\nexport function TlsClientAuth() {\n    return None();\n}\nasync function signJwt(header, payload, key) {\n    if (!key.usages.includes('sign')) {\n        throw CodedTypeError('CryptoKey instances used for signing assertions must include \"sign\" in their \"usages\"', ERR_INVALID_ARG_VALUE);\n    }\n    const input = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(payload)))}`;\n    const signature = b64u(await crypto.subtle.sign(keyToSubtle(key), key, buf(input)));\n    return `${input}.${signature}`;\n}\nexport async function issueRequestObject(as, client, parameters, privateKey, options) {\n    assertAs(as);\n    assertClient(client);\n    parameters = new URLSearchParams(parameters);\n    const { key, kid } = getKeyAndKid(privateKey);\n    assertPrivateKey(key, '\"privateKey.key\"');\n    parameters.set('client_id', client.client_id);\n    const now = epochTime() + getClockSkew(client);\n    const claims = {\n        ...Object.fromEntries(parameters.entries()),\n        jti: randomBytes(),\n        aud: as.issuer,\n        exp: now + 60,\n        iat: now,\n        nbf: now,\n        iss: client.client_id,\n    };\n    let resource;\n    if (parameters.has('resource') &&\n        (resource = parameters.getAll('resource')) &&\n        resource.length > 1) {\n        claims.resource = resource;\n    }\n    {\n        let value = parameters.get('max_age');\n        if (value !== null) {\n            claims.max_age = parseInt(value, 10);\n            assertNumber(claims.max_age, true, '\"max_age\" parameter');\n        }\n    }\n    {\n        let value = parameters.get('claims');\n        if (value !== null) {\n            try {\n                claims.claims = JSON.parse(value);\n            }\n            catch (cause) {\n                throw OPE('failed to parse the \"claims\" parameter as JSON', PARSE_ERROR, cause);\n            }\n            if (!isJsonObject(claims.claims)) {\n                throw CodedTypeError('\"claims\" parameter must be a JSON with a top level object', ERR_INVALID_ARG_VALUE);\n            }\n        }\n    }\n    {\n        let value = parameters.get('authorization_details');\n        if (value !== null) {\n            try {\n                claims.authorization_details = JSON.parse(value);\n            }\n            catch (cause) {\n                throw OPE('failed to parse the \"authorization_details\" parameter as JSON', PARSE_ERROR, cause);\n            }\n            if (!Array.isArray(claims.authorization_details)) {\n                throw CodedTypeError('\"authorization_details\" parameter must be a JSON with a top level array', ERR_INVALID_ARG_VALUE);\n            }\n        }\n    }\n    const header = {\n        alg: keyToJws(key),\n        typ: 'oauth-authz-req+jwt',\n        kid,\n    };\n    options?.[modifyAssertion]?.(header, claims);\n    return signJwt(header, claims, key);\n}\nlet jwkCache;\nasync function getSetPublicJwkCache(key, alg) {\n    const { kty, e, n, x, y, crv, pub } = await crypto.subtle.exportKey('jwk', key);\n    const jwk = { kty, e, n, x, y, crv, pub };\n    if (kty === 'AKP')\n        jwk.alg = alg;\n    jwkCache.set(key, jwk);\n    return jwk;\n}\nasync function publicJwk(key, alg) {\n    jwkCache ||= new WeakMap();\n    return jwkCache.get(key) || getSetPublicJwkCache(key, alg);\n}\nconst URLParse = URL.parse\n    ?\n        (url, base) => URL.parse(url, base)\n    : (url, base) => {\n        try {\n            return new URL(url, base);\n        }\n        catch {\n            return null;\n        }\n    };\nexport function checkProtocol(url, enforceHttps) {\n    if (enforceHttps && url.protocol !== 'https:') {\n        throw OPE('only requests to HTTPS are allowed', HTTP_REQUEST_FORBIDDEN, url);\n    }\n    if (url.protocol !== 'https:' && url.protocol !== 'http:') {\n        throw OPE('only HTTP and HTTPS requests are allowed', REQUEST_PROTOCOL_FORBIDDEN, url);\n    }\n}\nfunction validateEndpoint(value, endpoint, useMtlsAlias, enforceHttps) {\n    let url;\n    if (typeof value !== 'string' || !(url = URLParse(value))) {\n        throw OPE(`authorization server metadata does not contain a valid ${useMtlsAlias ? `\"as.mtls_endpoint_aliases.${endpoint}\"` : `\"as.${endpoint}\"`}`, value === undefined ? MISSING_SERVER_METADATA : INVALID_SERVER_METADATA, { attribute: useMtlsAlias ? `mtls_endpoint_aliases.${endpoint}` : endpoint });\n    }\n    checkProtocol(url, enforceHttps);\n    return url;\n}\nexport function resolveEndpoint(as, endpoint, useMtlsAlias, enforceHttps) {\n    if (useMtlsAlias && as.mtls_endpoint_aliases && endpoint in as.mtls_endpoint_aliases) {\n        return validateEndpoint(as.mtls_endpoint_aliases[endpoint], endpoint, useMtlsAlias, enforceHttps);\n    }\n    return validateEndpoint(as[endpoint], endpoint, useMtlsAlias, enforceHttps);\n}\nexport async function pushedAuthorizationRequest(as, client, clientAuthentication, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'pushed_authorization_request_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(parameters);\n    body.set('client_id', client.client_id);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    if (options?.DPoP !== undefined) {\n        assertDPoP(options.DPoP);\n        await options.DPoP.addProof(url, headers, 'POST');\n    }\n    const response = await authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n    options?.DPoP?.cacheNonce(response, url);\n    return response;\n}\nclass DPoPHandler {\n    #header;\n    #privateKey;\n    #publicKey;\n    #clockSkew;\n    #modifyAssertion;\n    #map;\n    #jkt;\n    constructor(client, keyPair, options) {\n        assertPrivateKey(keyPair?.privateKey, '\"DPoP.privateKey\"');\n        assertPublicKey(keyPair?.publicKey, '\"DPoP.publicKey\"');\n        if (!keyPair.publicKey.extractable) {\n            throw CodedTypeError('\"DPoP.publicKey.extractable\" must be true', ERR_INVALID_ARG_VALUE);\n        }\n        this.#modifyAssertion = options?.[modifyAssertion];\n        this.#clockSkew = getClockSkew(client);\n        this.#privateKey = keyPair.privateKey;\n        this.#publicKey = keyPair.publicKey;\n        branded.add(this);\n    }\n    #get(key) {\n        this.#map ||= new Map();\n        let item = this.#map.get(key);\n        if (item) {\n            this.#map.delete(key);\n            this.#map.set(key, item);\n        }\n        return item;\n    }\n    #set(key, val) {\n        this.#map ||= new Map();\n        this.#map.delete(key);\n        if (this.#map.size === 100) {\n            this.#map.delete(this.#map.keys().next().value);\n        }\n        this.#map.set(key, val);\n    }\n    async calculateThumbprint() {\n        if (!this.#jkt) {\n            const jwk = await crypto.subtle.exportKey('jwk', this.#publicKey);\n            this.#jkt ||= await calculateJwkThumbprint(jwk);\n        }\n        return this.#jkt;\n    }\n    async addProof(url, headers, htm, accessToken) {\n        const alg = keyToJws(this.#privateKey);\n        this.#header ||= {\n            alg,\n            typ: 'dpop+jwt',\n            jwk: await publicJwk(this.#publicKey, alg),\n        };\n        const nonce = this.#get(url.origin);\n        const now = epochTime() + this.#clockSkew;\n        const payload = {\n            iat: now,\n            jti: randomBytes(),\n            htm,\n            nonce,\n            htu: `${url.origin}${url.pathname}`,\n            ath: accessToken\n                ? b64u(await crypto.subtle.digest('SHA-256', buf(accessToken)))\n                : undefined,\n        };\n        this.#modifyAssertion?.(this.#header, payload);\n        headers.set('dpop', await signJwt(this.#header, payload, this.#privateKey));\n    }\n    cacheNonce(response, url) {\n        try {\n            const nonce = response.headers.get('dpop-nonce');\n            if (nonce) {\n                this.#set(url.origin, nonce);\n            }\n        }\n        catch { }\n    }\n}\nexport function isDPoPNonceError(err) {\n    if (err instanceof WWWAuthenticateChallengeError) {\n        const { 0: challenge, length } = err.cause;\n        return (length === 1 && challenge.scheme === 'dpop' && challenge.parameters.error === 'use_dpop_nonce');\n    }\n    if (err instanceof ResponseBodyError) {\n        return err.error === 'use_dpop_nonce';\n    }\n    return false;\n}\nexport function DPoP(client, keyPair, options) {\n    return new DPoPHandler(client, keyPair, options);\n}\nexport class ResponseBodyError extends Error {\n    cause;\n    code;\n    error;\n    status;\n    error_description;\n    response;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        this.code = RESPONSE_BODY_ERROR;\n        this.cause = options.cause;\n        this.error = options.cause.error;\n        this.status = options.response.status;\n        this.error_description = options.cause.error_description;\n        Object.defineProperty(this, 'response', { enumerable: false, value: options.response });\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class AuthorizationResponseError extends Error {\n    cause;\n    code;\n    error;\n    error_description;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        this.code = AUTHORIZATION_RESPONSE_ERROR;\n        this.cause = options.cause;\n        this.error = options.cause.get('error');\n        this.error_description = options.cause.get('error_description') ?? undefined;\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class WWWAuthenticateChallengeError extends Error {\n    cause;\n    code;\n    response;\n    status;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        this.code = WWW_AUTHENTICATE_CHALLENGE;\n        this.cause = options.cause;\n        this.status = options.response.status;\n        this.response = options.response;\n        Object.defineProperty(this, 'response', { enumerable: false });\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nconst tokenMatch = \"[a-zA-Z0-9!#$%&\\\\'\\\\*\\\\+\\\\-\\\\.\\\\^_`\\\\|~]+\";\nconst token68Match = '[a-zA-Z0-9\\\\-\\\\._\\\\~\\\\+\\\\/]+={0,2}';\nconst quotedMatch = '\"((?:[^\"\\\\\\\\]|\\\\\\\\[\\\\s\\\\S])*)\"';\nconst quotedParamMatcher = '(' + tokenMatch + ')\\\\s*=\\\\s*' + quotedMatch;\nconst paramMatcher = '(' + tokenMatch + ')\\\\s*=\\\\s*(' + tokenMatch + ')';\nconst schemeRE = new RegExp('^[,\\\\s]*(' + tokenMatch + ')');\nconst quotedParamRE = new RegExp('^[,\\\\s]*' + quotedParamMatcher + '[,\\\\s]*(.*)');\nconst unquotedParamRE = new RegExp('^[,\\\\s]*' + paramMatcher + '[,\\\\s]*(.*)');\nconst token68ParamRE = new RegExp('^(' + token68Match + ')(?:$|[,\\\\s])(.*)');\nfunction parseWwwAuthenticateChallenges(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    const header = response.headers.get('www-authenticate');\n    if (header === null) {\n        return undefined;\n    }\n    const challenges = [];\n    let rest = header;\n    while (rest) {\n        let match = rest.match(schemeRE);\n        const scheme = match?.['1'].toLowerCase();\n        if (!scheme) {\n            return undefined;\n        }\n        const afterScheme = rest.substring(match[0].length);\n        if (afterScheme && !afterScheme.match(/^[\\s,]/)) {\n            return undefined;\n        }\n        const spaceMatch = afterScheme.match(/^\\s+(.*)$/);\n        const hasParameters = !!spaceMatch;\n        rest = spaceMatch ? spaceMatch[1] : undefined;\n        const parameters = {};\n        let token68;\n        if (hasParameters) {\n            while (rest) {\n                let key;\n                let value;\n                if ((match = rest.match(quotedParamRE))) {\n                    ;\n                    [, key, value, rest] = match;\n                    if (value.includes('\\\\')) {\n                        try {\n                            value = JSON.parse(`\"${value}\"`);\n                        }\n                        catch { }\n                    }\n                    parameters[key.toLowerCase()] = value;\n                    continue;\n                }\n                if ((match = rest.match(unquotedParamRE))) {\n                    ;\n                    [, key, value, rest] = match;\n                    parameters[key.toLowerCase()] = value;\n                    continue;\n                }\n                if ((match = rest.match(token68ParamRE))) {\n                    if (Object.keys(parameters).length) {\n                        break;\n                    }\n                    ;\n                    [, token68, rest] = match;\n                    break;\n                }\n                return undefined;\n            }\n        }\n        else {\n            rest = afterScheme || undefined;\n        }\n        const challenge = { scheme, parameters };\n        if (token68) {\n            challenge.token68 = token68;\n        }\n        challenges.push(challenge);\n    }\n    if (!challenges.length) {\n        return undefined;\n    }\n    return challenges;\n}\nexport async function processPushedAuthorizationResponse(as, client, response) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 201, 'Pushed Authorization Request Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.request_uri, '\"response\" body \"request_uri\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    let expiresIn = typeof json.expires_in !== 'number' ? parseFloat(json.expires_in) : json.expires_in;\n    assertNumber(expiresIn, true, '\"response\" body \"expires_in\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    json.expires_in = expiresIn;\n    return json;\n}\nasync function parseOAuthResponseErrorBody(response) {\n    if (response.status > 399 && response.status < 500) {\n        assertReadableResponse(response);\n        assertApplicationJson(response);\n        try {\n            const json = await response.clone().json();\n            if (isJsonObject(json) && typeof json.error === 'string' && json.error.length) {\n                return json;\n            }\n        }\n        catch { }\n    }\n    return undefined;\n}\nasync function checkOAuthBodyError(response, expected, label) {\n    if (response.status !== expected) {\n        checkAuthenticationChallenges(response);\n        let err;\n        if ((err = await parseOAuthResponseErrorBody(response))) {\n            await response.body?.cancel();\n            throw new ResponseBodyError('server responded with an error in the response body', {\n                cause: err,\n                response,\n            });\n        }\n        throw OPE(`\"response\" is not a conform ${label} response (unexpected HTTP status code)`, RESPONSE_IS_NOT_CONFORM, response);\n    }\n}\nfunction assertDPoP(option) {\n    if (!branded.has(option)) {\n        throw CodedTypeError('\"options.DPoP\" is not a valid DPoPHandle', ERR_INVALID_ARG_VALUE);\n    }\n}\nasync function resourceRequest(accessToken, method, url, headers, body, options) {\n    assertString(accessToken, '\"accessToken\"');\n    if (!(url instanceof URL)) {\n        throw CodedTypeError('\"url\" must be an instance of URL', ERR_INVALID_ARG_TYPE);\n    }\n    checkProtocol(url, options?.[allowInsecureRequests] !== true);\n    headers = prepareHeaders(headers);\n    if (options?.DPoP) {\n        assertDPoP(options.DPoP);\n        await options.DPoP.addProof(url, headers, method.toUpperCase(), accessToken);\n    }\n    headers.set('authorization', `${headers.has('dpop') ? 'DPoP' : 'Bearer'} ${accessToken}`);\n    const response = await (options?.[customFetch] || fetch)(url.href, {\n        duplex: looseInstanceOf(body, ReadableStream) ? 'half' : undefined,\n        body,\n        headers: Object.fromEntries(headers.entries()),\n        method,\n        redirect: 'manual',\n        signal: signal(url, options?.signal),\n    });\n    options?.DPoP?.cacheNonce(response, url);\n    return response;\n}\nexport async function protectedResourceRequest(accessToken, method, url, headers, body, options) {\n    const response = await resourceRequest(accessToken, method, url, headers, body, options);\n    checkAuthenticationChallenges(response);\n    return response;\n}\nexport async function userInfoRequest(as, client, accessToken, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'userinfo_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const headers = prepareHeaders(options?.headers);\n    if (client.userinfo_signed_response_alg) {\n        headers.set('accept', 'application/jwt');\n    }\n    else {\n        headers.set('accept', 'application/json');\n        headers.append('accept', 'application/jwt');\n    }\n    return resourceRequest(accessToken, 'GET', url, headers, null, {\n        ...options,\n        [clockSkew]: getClockSkew(client),\n    });\n}\nlet jwksMap;\nfunction setJwksCache(as, jwks, uat, cache) {\n    jwksMap ||= new WeakMap();\n    jwksMap.set(as, {\n        jwks,\n        uat,\n        get age() {\n            return epochTime() - this.uat;\n        },\n    });\n    if (cache) {\n        Object.assign(cache, { jwks: structuredClone(jwks), uat });\n    }\n}\nfunction isFreshJwksCache(input) {\n    if (typeof input !== 'object' || input === null) {\n        return false;\n    }\n    if (!('uat' in input) || typeof input.uat !== 'number' || epochTime() - input.uat >= 300) {\n        return false;\n    }\n    if (!('jwks' in input) ||\n        !isJsonObject(input.jwks) ||\n        !Array.isArray(input.jwks.keys) ||\n        !Array.prototype.every.call(input.jwks.keys, isJsonObject)) {\n        return false;\n    }\n    return true;\n}\nfunction clearJwksCache(as, cache) {\n    jwksMap?.delete(as);\n    delete cache?.jwks;\n    delete cache?.uat;\n}\nasync function getPublicSigKeyFromIssuerJwksUri(as, options, header) {\n    const { alg, kid } = header;\n    checkSupportedJwsAlg(header);\n    if (!jwksMap?.has(as) && isFreshJwksCache(options?.[jwksCache])) {\n        setJwksCache(as, options?.[jwksCache].jwks, options?.[jwksCache].uat);\n    }\n    let jwks;\n    let age;\n    if (jwksMap?.has(as)) {\n        ;\n        ({ jwks, age } = jwksMap.get(as));\n        if (age >= 300) {\n            clearJwksCache(as, options?.[jwksCache]);\n            return getPublicSigKeyFromIssuerJwksUri(as, options, header);\n        }\n    }\n    else {\n        jwks = await jwksRequest(as, options).then(processJwksResponse);\n        age = 0;\n        setJwksCache(as, jwks, epochTime(), options?.[jwksCache]);\n    }\n    let kty;\n    switch (alg.slice(0, 2)) {\n        case 'RS':\n        case 'PS':\n            kty = 'RSA';\n            break;\n        case 'ES':\n            kty = 'EC';\n            break;\n        case 'Ed':\n            kty = 'OKP';\n            break;\n        case 'ML':\n            kty = 'AKP';\n            break;\n        default:\n            throw new UnsupportedOperationError('unsupported JWS algorithm', { cause: { alg } });\n    }\n    const candidates = jwks.keys.filter((jwk) => {\n        if (jwk.kty !== kty) {\n            return false;\n        }\n        if (kid !== undefined && kid !== jwk.kid) {\n            return false;\n        }\n        if (jwk.alg !== undefined && alg !== jwk.alg) {\n            return false;\n        }\n        if (jwk.use !== undefined && jwk.use !== 'sig') {\n            return false;\n        }\n        if (jwk.key_ops?.includes('verify') === false) {\n            return false;\n        }\n        switch (true) {\n            case alg === 'ES256' && jwk.crv !== 'P-256':\n            case alg === 'ES384' && jwk.crv !== 'P-384':\n            case alg === 'ES512' && jwk.crv !== 'P-521':\n            case alg === 'Ed25519' && jwk.crv !== 'Ed25519':\n            case alg === 'EdDSA' && jwk.crv !== 'Ed25519':\n                return false;\n        }\n        return true;\n    });\n    const { 0: jwk, length } = candidates;\n    if (!length) {\n        if (age >= 60) {\n            clearJwksCache(as, options?.[jwksCache]);\n            return getPublicSigKeyFromIssuerJwksUri(as, options, header);\n        }\n        throw OPE('error when selecting a JWT verification key, no applicable keys found', KEY_SELECTION, { header, candidates, jwks_uri: new URL(as.jwks_uri) });\n    }\n    if (length !== 1) {\n        throw OPE('error when selecting a JWT verification key, multiple applicable keys found, a \"kid\" JWT Header Parameter is required', KEY_SELECTION, { header, candidates, jwks_uri: new URL(as.jwks_uri) });\n    }\n    return importJwk(alg, jwk);\n}\nexport const skipSubjectCheck = Symbol();\nexport function getContentType(input) {\n    return input.headers.get('content-type')?.split(';')[0];\n}\nexport async function processUserInfoResponse(as, client, expectedSubject, response, options) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    checkAuthenticationChallenges(response);\n    if (response.status !== 200) {\n        throw OPE('\"response\" is not a conform UserInfo Endpoint response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);\n    }\n    assertReadableResponse(response);\n    let json;\n    if (getContentType(response) === 'application/jwt') {\n        const { claims, jwt } = await validateJwt(await response.text(), checkSigningAlgorithm.bind(undefined, client.userinfo_signed_response_alg, as.userinfo_signing_alg_values_supported, undefined), getClockSkew(client), getClockTolerance(client), options?.[jweDecrypt])\n            .then(validateOptionalAudience.bind(undefined, client.client_id))\n            .then(validateOptionalIssuer.bind(undefined, as));\n        jwtRefs.set(response, jwt);\n        json = claims;\n    }\n    else {\n        if (client.userinfo_signed_response_alg) {\n            throw OPE('JWT UserInfo Response expected', JWT_USERINFO_EXPECTED, response);\n        }\n        json = await getResponseJsonBody(response);\n    }\n    assertString(json.sub, '\"response\" body \"sub\" property', INVALID_RESPONSE, { body: json });\n    switch (expectedSubject) {\n        case skipSubjectCheck:\n            break;\n        default:\n            assertString(expectedSubject, '\"expectedSubject\"');\n            if (json.sub !== expectedSubject) {\n                throw OPE('unexpected \"response\" body \"sub\" property value', JSON_ATTRIBUTE_COMPARISON, {\n                    expected: expectedSubject,\n                    body: json,\n                    attribute: 'sub',\n                });\n            }\n    }\n    return json;\n}\nasync function authenticatedRequest(as, client, clientAuthentication, url, body, headers, options) {\n    await clientAuthentication(as, client, body, headers);\n    headers.set('content-type', 'application/x-www-form-urlencoded;charset=UTF-8');\n    return (options?.[customFetch] || fetch)(url.href, {\n        body,\n        headers: Object.fromEntries(headers.entries()),\n        method: 'POST',\n        redirect: 'manual',\n        signal: signal(url, options?.signal),\n    });\n}\nasync function tokenEndpointRequest(as, client, clientAuthentication, grantType, parameters, options) {\n    const url = resolveEndpoint(as, 'token_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    parameters.set('grant_type', grantType);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    if (options?.DPoP !== undefined) {\n        assertDPoP(options.DPoP);\n        await options.DPoP.addProof(url, headers, 'POST');\n    }\n    const response = await authenticatedRequest(as, client, clientAuthentication, url, parameters, headers, options);\n    options?.DPoP?.cacheNonce(response, url);\n    return response;\n}\nexport async function refreshTokenGrantRequest(as, client, clientAuthentication, refreshToken, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(refreshToken, '\"refreshToken\"');\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('refresh_token', refreshToken);\n    return tokenEndpointRequest(as, client, clientAuthentication, 'refresh_token', parameters, options);\n}\nconst idTokenClaims = new WeakMap();\nconst jwtRefs = new WeakMap();\nexport function getValidatedIdTokenClaims(ref) {\n    if (!ref.id_token) {\n        return undefined;\n    }\n    const claims = idTokenClaims.get(ref);\n    if (!claims) {\n        throw CodedTypeError('\"ref\" was already garbage collected or did not resolve from the proper sources', ERR_INVALID_ARG_VALUE);\n    }\n    return claims;\n}\nexport async function validateApplicationLevelSignature(as, ref, options) {\n    assertAs(as);\n    if (!jwtRefs.has(ref)) {\n        throw CodedTypeError('\"ref\" does not contain a processed JWT Response to verify the signature of', ERR_INVALID_ARG_VALUE);\n    }\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = jwtRefs.get(ref).split('.');\n    const header = JSON.parse(buf(b64u(protectedHeader)));\n    if (header.alg.startsWith('HS')) {\n        throw new UnsupportedOperationError('unsupported JWS algorithm', { cause: { alg: header.alg } });\n    }\n    let key;\n    key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);\n    await validateJwsSignature(protectedHeader, payload, key, b64u(encodedSignature));\n}\nasync function processGenericAccessTokenResponse(as, client, response, additionalRequiredIdTokenClaims, decryptFn, recognizedTokenTypes) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Token Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.access_token, '\"response\" body \"access_token\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    assertString(json.token_type, '\"response\" body \"token_type\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    json.token_type = json.token_type.toLowerCase();\n    if (json.expires_in !== undefined) {\n        let expiresIn = typeof json.expires_in !== 'number' ? parseFloat(json.expires_in) : json.expires_in;\n        assertNumber(expiresIn, true, '\"response\" body \"expires_in\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n        json.expires_in = expiresIn;\n    }\n    if (json.refresh_token !== undefined) {\n        assertString(json.refresh_token, '\"response\" body \"refresh_token\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    if (json.scope !== undefined && typeof json.scope !== 'string') {\n        throw OPE('\"response\" body \"scope\" property must be a string', INVALID_RESPONSE, { body: json });\n    }\n    if (json.id_token !== undefined) {\n        assertString(json.id_token, '\"response\" body \"id_token\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n        const requiredClaims = ['aud', 'exp', 'iat', 'iss', 'sub'];\n        if (client.require_auth_time === true) {\n            requiredClaims.push('auth_time');\n        }\n        if (client.default_max_age !== undefined) {\n            assertNumber(client.default_max_age, true, '\"client.default_max_age\"');\n            requiredClaims.push('auth_time');\n        }\n        if (additionalRequiredIdTokenClaims?.length) {\n            requiredClaims.push(...additionalRequiredIdTokenClaims);\n        }\n        const { claims, jwt } = await validateJwt(json.id_token, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported, 'RS256'), getClockSkew(client), getClockTolerance(client), decryptFn)\n            .then(validatePresence.bind(undefined, requiredClaims))\n            .then(validateIssuer.bind(undefined, as))\n            .then(validateAudience.bind(undefined, client.client_id));\n        if (Array.isArray(claims.aud) && claims.aud.length !== 1) {\n            if (claims.azp === undefined) {\n                throw OPE('ID Token \"aud\" (audience) claim includes additional untrusted audiences', JWT_CLAIM_COMPARISON, { claims, claim: 'aud' });\n            }\n            if (claims.azp !== client.client_id) {\n                throw OPE('unexpected ID Token \"azp\" (authorized party) claim value', JWT_CLAIM_COMPARISON, { expected: client.client_id, claims, claim: 'azp' });\n            }\n        }\n        if (claims.auth_time !== undefined) {\n            assertNumber(claims.auth_time, true, 'ID Token \"auth_time\" (authentication time)', INVALID_RESPONSE, { claims });\n        }\n        jwtRefs.set(response, jwt);\n        idTokenClaims.set(json, claims);\n    }\n    if (recognizedTokenTypes?.[json.token_type] !== undefined) {\n        recognizedTokenTypes[json.token_type](response, json);\n    }\n    else if (json.token_type !== 'dpop' && json.token_type !== 'bearer') {\n        throw new UnsupportedOperationError('unsupported `token_type` value', { cause: { body: json } });\n    }\n    return json;\n}\nfunction checkAuthenticationChallenges(response) {\n    let challenges;\n    if ((challenges = parseWwwAuthenticateChallenges(response))) {\n        throw new WWWAuthenticateChallengeError('server responded with a challenge in the WWW-Authenticate HTTP Header', { cause: challenges, response });\n    }\n}\nexport async function processRefreshTokenResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nfunction validateOptionalAudience(expected, result) {\n    if (result.claims.aud !== undefined) {\n        return validateAudience(expected, result);\n    }\n    return result;\n}\nfunction validateAudience(expected, result) {\n    if (Array.isArray(result.claims.aud)) {\n        if (!result.claims.aud.includes(expected)) {\n            throw OPE('unexpected JWT \"aud\" (audience) claim value', JWT_CLAIM_COMPARISON, {\n                expected,\n                claims: result.claims,\n                claim: 'aud',\n            });\n        }\n    }\n    else if (result.claims.aud !== expected) {\n        throw OPE('unexpected JWT \"aud\" (audience) claim value', JWT_CLAIM_COMPARISON, {\n            expected,\n            claims: result.claims,\n            claim: 'aud',\n        });\n    }\n    return result;\n}\nfunction validateOptionalIssuer(as, result) {\n    if (result.claims.iss !== undefined) {\n        return validateIssuer(as, result);\n    }\n    return result;\n}\nfunction validateIssuer(as, result) {\n    const expected = as[_expectedIssuer]?.(result) ?? as.issuer;\n    if (result.claims.iss !== expected) {\n        throw OPE('unexpected JWT \"iss\" (issuer) claim value', JWT_CLAIM_COMPARISON, {\n            expected,\n            claims: result.claims,\n            claim: 'iss',\n        });\n    }\n    return result;\n}\nconst branded = new WeakSet();\nfunction brand(searchParams) {\n    branded.add(searchParams);\n    return searchParams;\n}\nexport const nopkce = Symbol();\nexport async function authorizationCodeGrantRequest(as, client, clientAuthentication, callbackParameters, redirectUri, codeVerifier, options) {\n    assertAs(as);\n    assertClient(client);\n    if (!branded.has(callbackParameters)) {\n        throw CodedTypeError('\"callbackParameters\" must be an instance of URLSearchParams obtained from \"validateAuthResponse()\", or \"validateJwtAuthResponse()', ERR_INVALID_ARG_VALUE);\n    }\n    assertString(redirectUri, '\"redirectUri\"');\n    const code = getURLSearchParameter(callbackParameters, 'code');\n    if (!code) {\n        throw OPE('no authorization code in \"callbackParameters\"', INVALID_RESPONSE);\n    }\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('redirect_uri', redirectUri);\n    parameters.set('code', code);\n    if (codeVerifier !== nopkce) {\n        assertString(codeVerifier, '\"codeVerifier\"');\n        parameters.set('code_verifier', codeVerifier);\n    }\n    return tokenEndpointRequest(as, client, clientAuthentication, 'authorization_code', parameters, options);\n}\nconst jwtClaimNames = {\n    aud: 'audience',\n    c_hash: 'code hash',\n    client_id: 'client id',\n    exp: 'expiration time',\n    iat: 'issued at',\n    iss: 'issuer',\n    jti: 'jwt id',\n    nonce: 'nonce',\n    s_hash: 'state hash',\n    sub: 'subject',\n    ath: 'access token hash',\n    htm: 'http method',\n    htu: 'http uri',\n    cnf: 'confirmation',\n    auth_time: 'authentication time',\n};\nfunction validatePresence(required, result) {\n    for (const claim of required) {\n        if (result.claims[claim] === undefined) {\n            throw OPE(`JWT \"${claim}\" (${jwtClaimNames[claim]}) claim missing`, INVALID_RESPONSE, {\n                claims: result.claims,\n            });\n        }\n    }\n    return result;\n}\nexport const expectNoNonce = Symbol();\nexport const skipAuthTimeCheck = Symbol();\nexport async function processAuthorizationCodeResponse(as, client, response, options) {\n    if (typeof options?.expectedNonce === 'string' ||\n        typeof options?.maxAge === 'number' ||\n        options?.requireIdToken) {\n        return processAuthorizationCodeOpenIDResponse(as, client, response, options.expectedNonce, options.maxAge, options[jweDecrypt], options.recognizedTokenTypes);\n    }\n    return processAuthorizationCodeOAuth2Response(as, client, response, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nasync function processAuthorizationCodeOpenIDResponse(as, client, response, expectedNonce, maxAge, decryptFn, recognizedTokenTypes) {\n    const additionalRequiredClaims = [];\n    switch (expectedNonce) {\n        case undefined:\n            expectedNonce = expectNoNonce;\n            break;\n        case expectNoNonce:\n            break;\n        default:\n            assertString(expectedNonce, '\"expectedNonce\" argument');\n            additionalRequiredClaims.push('nonce');\n    }\n    maxAge ??= client.default_max_age;\n    switch (maxAge) {\n        case undefined:\n            maxAge = skipAuthTimeCheck;\n            break;\n        case skipAuthTimeCheck:\n            break;\n        default:\n            assertNumber(maxAge, true, '\"maxAge\" argument');\n            additionalRequiredClaims.push('auth_time');\n    }\n    const result = await processGenericAccessTokenResponse(as, client, response, additionalRequiredClaims, decryptFn, recognizedTokenTypes);\n    assertString(result.id_token, '\"response\" body \"id_token\" property', INVALID_RESPONSE, {\n        body: result,\n    });\n    const claims = getValidatedIdTokenClaims(result);\n    if (maxAge !== skipAuthTimeCheck) {\n        const now = epochTime() + getClockSkew(client);\n        const tolerance = getClockTolerance(client);\n        if (claims.auth_time + maxAge < now - tolerance) {\n            throw OPE('too much time has elapsed since the last End-User authentication', JWT_TIMESTAMP_CHECK, { claims, now, tolerance, claim: 'auth_time' });\n        }\n    }\n    if (expectedNonce === expectNoNonce) {\n        if (claims.nonce !== undefined) {\n            throw OPE('unexpected ID Token \"nonce\" claim value', JWT_CLAIM_COMPARISON, {\n                expected: undefined,\n                claims,\n                claim: 'nonce',\n            });\n        }\n    }\n    else if (claims.nonce !== expectedNonce) {\n        throw OPE('unexpected ID Token \"nonce\" claim value', JWT_CLAIM_COMPARISON, {\n            expected: expectedNonce,\n            claims,\n            claim: 'nonce',\n        });\n    }\n    return result;\n}\nasync function processAuthorizationCodeOAuth2Response(as, client, response, decryptFn, recognizedTokenTypes) {\n    const result = await processGenericAccessTokenResponse(as, client, response, undefined, decryptFn, recognizedTokenTypes);\n    const claims = getValidatedIdTokenClaims(result);\n    if (claims) {\n        if (client.default_max_age !== undefined) {\n            assertNumber(client.default_max_age, true, '\"client.default_max_age\"');\n            const now = epochTime() + getClockSkew(client);\n            const tolerance = getClockTolerance(client);\n            if (claims.auth_time + client.default_max_age < now - tolerance) {\n                throw OPE('too much time has elapsed since the last End-User authentication', JWT_TIMESTAMP_CHECK, { claims, now, tolerance, claim: 'auth_time' });\n            }\n        }\n        if (claims.nonce !== undefined) {\n            throw OPE('unexpected ID Token \"nonce\" claim value', JWT_CLAIM_COMPARISON, {\n                expected: undefined,\n                claims,\n                claim: 'nonce',\n            });\n        }\n    }\n    return result;\n}\nexport const WWW_AUTHENTICATE_CHALLENGE = 'OAUTH_WWW_AUTHENTICATE_CHALLENGE';\nexport const RESPONSE_BODY_ERROR = 'OAUTH_RESPONSE_BODY_ERROR';\nexport const UNSUPPORTED_OPERATION = 'OAUTH_UNSUPPORTED_OPERATION';\nexport const AUTHORIZATION_RESPONSE_ERROR = 'OAUTH_AUTHORIZATION_RESPONSE_ERROR';\nexport const JWT_USERINFO_EXPECTED = 'OAUTH_JWT_USERINFO_EXPECTED';\nexport const PARSE_ERROR = 'OAUTH_PARSE_ERROR';\nexport const INVALID_RESPONSE = 'OAUTH_INVALID_RESPONSE';\nexport const INVALID_REQUEST = 'OAUTH_INVALID_REQUEST';\nexport const RESPONSE_IS_NOT_JSON = 'OAUTH_RESPONSE_IS_NOT_JSON';\nexport const RESPONSE_IS_NOT_CONFORM = 'OAUTH_RESPONSE_IS_NOT_CONFORM';\nexport const HTTP_REQUEST_FORBIDDEN = 'OAUTH_HTTP_REQUEST_FORBIDDEN';\nexport const REQUEST_PROTOCOL_FORBIDDEN = 'OAUTH_REQUEST_PROTOCOL_FORBIDDEN';\nexport const JWT_TIMESTAMP_CHECK = 'OAUTH_JWT_TIMESTAMP_CHECK_FAILED';\nexport const JWT_CLAIM_COMPARISON = 'OAUTH_JWT_CLAIM_COMPARISON_FAILED';\nexport const JSON_ATTRIBUTE_COMPARISON = 'OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED';\nexport const KEY_SELECTION = 'OAUTH_KEY_SELECTION_FAILED';\nexport const MISSING_SERVER_METADATA = 'OAUTH_MISSING_SERVER_METADATA';\nexport const INVALID_SERVER_METADATA = 'OAUTH_INVALID_SERVER_METADATA';\nfunction checkJwtType(expected, result) {\n    if (typeof result.header.typ !== 'string' || normalizeTyp(result.header.typ) !== expected) {\n        throw OPE('unexpected JWT \"typ\" header parameter value', INVALID_RESPONSE, {\n            header: result.header,\n        });\n    }\n    return result;\n}\nexport async function clientCredentialsGrantRequest(as, client, clientAuthentication, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    return tokenEndpointRequest(as, client, clientAuthentication, 'client_credentials', new URLSearchParams(parameters), options);\n}\nexport async function genericTokenEndpointRequest(as, client, clientAuthentication, grantType, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(grantType, '\"grantType\"');\n    return tokenEndpointRequest(as, client, clientAuthentication, grantType, new URLSearchParams(parameters), options);\n}\nexport async function processGenericTokenEndpointResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nexport async function processClientCredentialsResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nexport async function revocationRequest(as, client, clientAuthentication, token, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(token, '\"token\"');\n    const url = resolveEndpoint(as, 'revocation_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(options?.additionalParameters);\n    body.set('token', token);\n    const headers = prepareHeaders(options?.headers);\n    headers.delete('accept');\n    return authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n}\nexport async function processRevocationResponse(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Revocation Endpoint');\n    return undefined;\n}\nfunction assertReadableResponse(response) {\n    if (response.bodyUsed) {\n        throw CodedTypeError('\"response\" body has been used already', ERR_INVALID_ARG_VALUE);\n    }\n}\nexport async function introspectionRequest(as, client, clientAuthentication, token, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(token, '\"token\"');\n    const url = resolveEndpoint(as, 'introspection_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(options?.additionalParameters);\n    body.set('token', token);\n    const headers = prepareHeaders(options?.headers);\n    if (options?.requestJwtResponse ?? client.introspection_signed_response_alg) {\n        headers.set('accept', 'application/token-introspection+jwt');\n    }\n    else {\n        headers.set('accept', 'application/json');\n    }\n    return authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n}\nexport async function processIntrospectionResponse(as, client, response, options) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Introspection Endpoint');\n    let json;\n    if (getContentType(response) === 'application/token-introspection+jwt') {\n        assertReadableResponse(response);\n        const { claims, jwt } = await validateJwt(await response.text(), checkSigningAlgorithm.bind(undefined, client.introspection_signed_response_alg, as.introspection_signing_alg_values_supported, 'RS256'), getClockSkew(client), getClockTolerance(client), options?.[jweDecrypt])\n            .then(checkJwtType.bind(undefined, 'token-introspection+jwt'))\n            .then(validatePresence.bind(undefined, ['aud', 'iat', 'iss']))\n            .then(validateIssuer.bind(undefined, as))\n            .then(validateAudience.bind(undefined, client.client_id));\n        jwtRefs.set(response, jwt);\n        if (!isJsonObject(claims.token_introspection)) {\n            throw OPE('JWT \"token_introspection\" claim must be a JSON object', INVALID_RESPONSE, {\n                claims,\n            });\n        }\n        json = claims.token_introspection;\n    }\n    else {\n        assertReadableResponse(response);\n        json = await getResponseJsonBody(response);\n    }\n    if (typeof json.active !== 'boolean') {\n        throw OPE('\"response\" body \"active\" property must be a boolean', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    return json;\n}\nasync function jwksRequest(as, options) {\n    assertAs(as);\n    const url = resolveEndpoint(as, 'jwks_uri', false, options?.[allowInsecureRequests] !== true);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    headers.append('accept', 'application/jwk-set+json');\n    return (options?.[customFetch] || fetch)(url.href, {\n        body: undefined,\n        headers: Object.fromEntries(headers.entries()),\n        method: 'GET',\n        redirect: 'manual',\n        signal: signal(url, options?.signal),\n    });\n}\nasync function processJwksResponse(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    if (response.status !== 200) {\n        throw OPE('\"response\" is not a conform JSON Web Key Set response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);\n    }\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response, (response) => assertContentTypes(response, 'application/json', 'application/jwk-set+json'));\n    if (!Array.isArray(json.keys)) {\n        throw OPE('\"response\" body \"keys\" property must be an array', INVALID_RESPONSE, { body: json });\n    }\n    if (!Array.prototype.every.call(json.keys, isJsonObject)) {\n        throw OPE('\"response\" body \"keys\" property members must be JWK formatted objects', INVALID_RESPONSE, { body: json });\n    }\n    return json;\n}\nfunction supported(alg) {\n    switch (alg) {\n        case 'PS256':\n        case 'ES256':\n        case 'RS256':\n        case 'PS384':\n        case 'ES384':\n        case 'RS384':\n        case 'PS512':\n        case 'ES512':\n        case 'RS512':\n        case 'Ed25519':\n        case 'EdDSA':\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            return true;\n        default:\n            return false;\n    }\n}\nfunction checkSupportedJwsAlg(header) {\n    if (!supported(header.alg)) {\n        throw new UnsupportedOperationError('unsupported JWS \"alg\" identifier', {\n            cause: { alg: header.alg },\n        });\n    }\n}\nfunction checkRsaKeyAlgorithm(key) {\n    const { algorithm } = key;\n    if (typeof algorithm.modulusLength !== 'number' || algorithm.modulusLength < 2048) {\n        throw new UnsupportedOperationError(`unsupported ${algorithm.name} modulusLength`, {\n            cause: key,\n        });\n    }\n}\nfunction ecdsaHashName(key) {\n    const { algorithm } = key;\n    switch (algorithm.namedCurve) {\n        case 'P-256':\n            return 'SHA-256';\n        case 'P-384':\n            return 'SHA-384';\n        case 'P-521':\n            return 'SHA-512';\n        default:\n            throw new UnsupportedOperationError('unsupported ECDSA namedCurve', { cause: key });\n    }\n}\nfunction keyToSubtle(key) {\n    switch (key.algorithm.name) {\n        case 'ECDSA':\n            return {\n                name: key.algorithm.name,\n                hash: ecdsaHashName(key),\n            };\n        case 'RSA-PSS': {\n            checkRsaKeyAlgorithm(key);\n            switch (key.algorithm.hash.name) {\n                case 'SHA-256':\n                case 'SHA-384':\n                case 'SHA-512':\n                    return {\n                        name: key.algorithm.name,\n                        saltLength: parseInt(key.algorithm.hash.name.slice(-3), 10) >> 3,\n                    };\n                default:\n                    throw new UnsupportedOperationError('unsupported RSA-PSS hash name', { cause: key });\n            }\n        }\n        case 'RSASSA-PKCS1-v1_5':\n            checkRsaKeyAlgorithm(key);\n            return key.algorithm.name;\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n        case 'Ed25519':\n            return key.algorithm.name;\n    }\n    throw new UnsupportedOperationError('unsupported CryptoKey algorithm name', { cause: key });\n}\nasync function validateJwsSignature(protectedHeader, payload, key, signature) {\n    const data = buf(`${protectedHeader}.${payload}`);\n    const algorithm = keyToSubtle(key);\n    const verified = await crypto.subtle.verify(algorithm, key, signature, data);\n    if (!verified) {\n        throw OPE('JWT signature verification failed', INVALID_RESPONSE, {\n            key,\n            data,\n            signature,\n            algorithm,\n        });\n    }\n}\nasync function validateJwt(jws, checkAlg, clockSkew, clockTolerance, decryptJwt) {\n    let { 0: protectedHeader, 1: payload, length } = jws.split('.');\n    if (length === 5) {\n        if (decryptJwt !== undefined) {\n            jws = await decryptJwt(jws);\n            ({ 0: protectedHeader, 1: payload, length } = jws.split('.'));\n        }\n        else {\n            throw new UnsupportedOperationError('JWE decryption is not configured', { cause: jws });\n        }\n    }\n    if (length !== 3) {\n        throw OPE('Invalid JWT', INVALID_RESPONSE, jws);\n    }\n    let header;\n    try {\n        header = JSON.parse(buf(b64u(protectedHeader)));\n    }\n    catch (cause) {\n        throw OPE('failed to parse JWT Header body as base64url encoded JSON', PARSE_ERROR, cause);\n    }\n    if (!isJsonObject(header)) {\n        throw OPE('JWT Header must be a top level object', INVALID_RESPONSE, jws);\n    }\n    checkAlg(header);\n    if (header.crit !== undefined) {\n        throw new UnsupportedOperationError('no JWT \"crit\" header parameter extensions are supported', {\n            cause: { header },\n        });\n    }\n    let claims;\n    try {\n        claims = JSON.parse(buf(b64u(payload)));\n    }\n    catch (cause) {\n        throw OPE('failed to parse JWT Payload body as base64url encoded JSON', PARSE_ERROR, cause);\n    }\n    if (!isJsonObject(claims)) {\n        throw OPE('JWT Payload must be a top level object', INVALID_RESPONSE, jws);\n    }\n    const now = epochTime() + clockSkew;\n    if (claims.exp !== undefined) {\n        if (typeof claims.exp !== 'number') {\n            throw OPE('unexpected JWT \"exp\" (expiration time) claim type', INVALID_RESPONSE, { claims });\n        }\n        if (claims.exp <= now - clockTolerance) {\n            throw OPE('unexpected JWT \"exp\" (expiration time) claim value, expiration is past current timestamp', JWT_TIMESTAMP_CHECK, { claims, now, tolerance: clockTolerance, claim: 'exp' });\n        }\n    }\n    if (claims.iat !== undefined) {\n        if (typeof claims.iat !== 'number') {\n            throw OPE('unexpected JWT \"iat\" (issued at) claim type', INVALID_RESPONSE, { claims });\n        }\n    }\n    if (claims.iss !== undefined) {\n        if (typeof claims.iss !== 'string') {\n            throw OPE('unexpected JWT \"iss\" (issuer) claim type', INVALID_RESPONSE, { claims });\n        }\n    }\n    if (claims.nbf !== undefined) {\n        if (typeof claims.nbf !== 'number') {\n            throw OPE('unexpected JWT \"nbf\" (not before) claim type', INVALID_RESPONSE, { claims });\n        }\n        if (claims.nbf > now + clockTolerance) {\n            throw OPE('unexpected JWT \"nbf\" (not before) claim value', JWT_TIMESTAMP_CHECK, {\n                claims,\n                now,\n                tolerance: clockTolerance,\n                claim: 'nbf',\n            });\n        }\n    }\n    if (claims.aud !== undefined) {\n        if (typeof claims.aud !== 'string' && !Array.isArray(claims.aud)) {\n            throw OPE('unexpected JWT \"aud\" (audience) claim type', INVALID_RESPONSE, { claims });\n        }\n    }\n    return { header, claims, jwt: jws };\n}\nexport async function validateJwtAuthResponse(as, client, parameters, expectedState, options) {\n    assertAs(as);\n    assertClient(client);\n    if (parameters instanceof URL) {\n        parameters = parameters.searchParams;\n    }\n    if (!(parameters instanceof URLSearchParams)) {\n        throw CodedTypeError('\"parameters\" must be an instance of URLSearchParams, or URL', ERR_INVALID_ARG_TYPE);\n    }\n    const response = getURLSearchParameter(parameters, 'response');\n    if (!response) {\n        throw OPE('\"parameters\" does not contain a JARM response', INVALID_RESPONSE);\n    }\n    const { claims, header, jwt } = await validateJwt(response, checkSigningAlgorithm.bind(undefined, client.authorization_signed_response_alg, as.authorization_signing_alg_values_supported, 'RS256'), getClockSkew(client), getClockTolerance(client), options?.[jweDecrypt])\n        .then(validatePresence.bind(undefined, ['aud', 'exp', 'iss']))\n        .then(validateIssuer.bind(undefined, as))\n        .then(validateAudience.bind(undefined, client.client_id));\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = jwt.split('.');\n    const signature = b64u(encodedSignature);\n    const key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);\n    await validateJwsSignature(protectedHeader, payload, key, signature);\n    const result = new URLSearchParams();\n    for (const [key, value] of Object.entries(claims)) {\n        if (typeof value === 'string' && key !== 'aud') {\n            result.set(key, value);\n        }\n    }\n    return validateAuthResponse(as, client, result, expectedState);\n}\nasync function idTokenHash(data, header, claimName) {\n    let algorithm;\n    switch (header.alg) {\n        case 'RS256':\n        case 'PS256':\n        case 'ES256':\n            algorithm = 'SHA-256';\n            break;\n        case 'RS384':\n        case 'PS384':\n        case 'ES384':\n            algorithm = 'SHA-384';\n            break;\n        case 'RS512':\n        case 'PS512':\n        case 'ES512':\n        case 'Ed25519':\n        case 'EdDSA':\n            algorithm = 'SHA-512';\n            break;\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            algorithm = { name: 'cSHAKE256', length: 512, outputLength: 512 };\n            break;\n        default:\n            throw new UnsupportedOperationError(`unsupported JWS algorithm for ${claimName} calculation`, { cause: { alg: header.alg } });\n    }\n    const digest = await crypto.subtle.digest(algorithm, buf(data));\n    return b64u(digest.slice(0, digest.byteLength / 2));\n}\nasync function idTokenHashMatches(data, actual, header, claimName) {\n    const expected = await idTokenHash(data, header, claimName);\n    return actual === expected;\n}\nexport async function validateDetachedSignatureResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options) {\n    return validateHybridResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options, true);\n}\nexport async function validateCodeIdTokenResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options) {\n    return validateHybridResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options, false);\n}\nasync function consumeStream(request) {\n    if (request.bodyUsed) {\n        throw CodedTypeError('form_post Request instances must contain a readable body', ERR_INVALID_ARG_VALUE, { cause: request });\n    }\n    return request.text();\n}\nexport async function formPostResponse(request) {\n    if (request.method !== 'POST') {\n        throw CodedTypeError('form_post responses are expected to use the POST method', ERR_INVALID_ARG_VALUE, { cause: request });\n    }\n    if (getContentType(request) !== 'application/x-www-form-urlencoded') {\n        throw CodedTypeError('form_post responses are expected to use the application/x-www-form-urlencoded content-type', ERR_INVALID_ARG_VALUE, { cause: request });\n    }\n    return consumeStream(request);\n}\nasync function validateHybridResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options, fapi) {\n    assertAs(as);\n    assertClient(client);\n    if (parameters instanceof URL) {\n        if (!parameters.hash.length) {\n            throw CodedTypeError('\"parameters\" as an instance of URL must contain a hash (fragment) with the Authorization Response parameters', ERR_INVALID_ARG_VALUE);\n        }\n        parameters = new URLSearchParams(parameters.hash.slice(1));\n    }\n    else if (looseInstanceOf(parameters, Request)) {\n        parameters = new URLSearchParams(await formPostResponse(parameters));\n    }\n    else if (parameters instanceof URLSearchParams) {\n        parameters = new URLSearchParams(parameters);\n    }\n    else {\n        throw CodedTypeError('\"parameters\" must be an instance of URLSearchParams, URL, or Response', ERR_INVALID_ARG_TYPE);\n    }\n    const id_token = getURLSearchParameter(parameters, 'id_token');\n    parameters.delete('id_token');\n    switch (expectedState) {\n        case undefined:\n        case expectNoState:\n            break;\n        default:\n            assertString(expectedState, '\"expectedState\" argument');\n    }\n    const result = validateAuthResponse({\n        ...as,\n        authorization_response_iss_parameter_supported: false,\n    }, client, parameters, expectedState);\n    if (!id_token) {\n        throw OPE('\"parameters\" does not contain an ID Token', INVALID_RESPONSE);\n    }\n    const code = getURLSearchParameter(parameters, 'code');\n    if (!code) {\n        throw OPE('\"parameters\" does not contain an Authorization Code', INVALID_RESPONSE);\n    }\n    const requiredClaims = [\n        'aud',\n        'exp',\n        'iat',\n        'iss',\n        'sub',\n        'nonce',\n        'c_hash',\n    ];\n    const state = parameters.get('state');\n    if (fapi && (typeof expectedState === 'string' || state !== null)) {\n        requiredClaims.push('s_hash');\n    }\n    if (maxAge !== undefined) {\n        assertNumber(maxAge, true, '\"maxAge\" argument');\n    }\n    else if (client.default_max_age !== undefined) {\n        assertNumber(client.default_max_age, true, '\"client.default_max_age\"');\n    }\n    maxAge ??= client.default_max_age ?? skipAuthTimeCheck;\n    if (client.require_auth_time || maxAge !== skipAuthTimeCheck) {\n        requiredClaims.push('auth_time');\n    }\n    const { claims, header, jwt } = await validateJwt(id_token, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported, 'RS256'), getClockSkew(client), getClockTolerance(client), options?.[jweDecrypt])\n        .then(validatePresence.bind(undefined, requiredClaims))\n        .then(validateIssuer.bind(undefined, as))\n        .then(validateAudience.bind(undefined, client.client_id));\n    const clockSkew = getClockSkew(client);\n    const now = epochTime() + clockSkew;\n    if (claims.iat < now - 3600) {\n        throw OPE('unexpected JWT \"iat\" (issued at) claim value, it is too far in the past', JWT_TIMESTAMP_CHECK, { now, claims, claim: 'iat' });\n    }\n    assertString(claims.c_hash, 'ID Token \"c_hash\" (code hash) claim value', INVALID_RESPONSE, {\n        claims,\n    });\n    if (claims.auth_time !== undefined) {\n        assertNumber(claims.auth_time, true, 'ID Token \"auth_time\" (authentication time)', INVALID_RESPONSE, { claims });\n    }\n    if (maxAge !== skipAuthTimeCheck) {\n        const now = epochTime() + getClockSkew(client);\n        const tolerance = getClockTolerance(client);\n        if (claims.auth_time + maxAge < now - tolerance) {\n            throw OPE('too much time has elapsed since the last End-User authentication', JWT_TIMESTAMP_CHECK, { claims, now, tolerance, claim: 'auth_time' });\n        }\n    }\n    assertString(expectedNonce, '\"expectedNonce\" argument');\n    if (claims.nonce !== expectedNonce) {\n        throw OPE('unexpected ID Token \"nonce\" claim value', JWT_CLAIM_COMPARISON, {\n            expected: expectedNonce,\n            claims,\n            claim: 'nonce',\n        });\n    }\n    if (Array.isArray(claims.aud) && claims.aud.length !== 1) {\n        if (claims.azp === undefined) {\n            throw OPE('ID Token \"aud\" (audience) claim includes additional untrusted audiences', JWT_CLAIM_COMPARISON, { claims, claim: 'aud' });\n        }\n        if (claims.azp !== client.client_id) {\n            throw OPE('unexpected ID Token \"azp\" (authorized party) claim value', JWT_CLAIM_COMPARISON, {\n                expected: client.client_id,\n                claims,\n                claim: 'azp',\n            });\n        }\n    }\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = jwt.split('.');\n    const signature = b64u(encodedSignature);\n    const key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);\n    await validateJwsSignature(protectedHeader, payload, key, signature);\n    if ((await idTokenHashMatches(code, claims.c_hash, header, 'c_hash')) !== true) {\n        throw OPE('invalid ID Token \"c_hash\" (code hash) claim value', JWT_CLAIM_COMPARISON, {\n            code,\n            alg: header.alg,\n            claim: 'c_hash',\n            claims,\n        });\n    }\n    if ((fapi && state !== null) || claims.s_hash !== undefined) {\n        assertString(claims.s_hash, 'ID Token \"s_hash\" (state hash) claim value', INVALID_RESPONSE, {\n            claims,\n        });\n        assertString(state, '\"state\" response parameter', INVALID_RESPONSE, { parameters });\n        if ((await idTokenHashMatches(state, claims.s_hash, header, 's_hash')) !== true) {\n            throw OPE('invalid ID Token \"s_hash\" (state hash) claim value', JWT_CLAIM_COMPARISON, {\n                state,\n                alg: header.alg,\n                claim: 's_hash',\n                claims,\n            });\n        }\n    }\n    return result;\n}\nfunction checkSigningAlgorithm(client, issuer, fallback, header) {\n    if (client !== undefined) {\n        if (typeof client === 'string' ? header.alg !== client : !client.includes(header.alg)) {\n            throw OPE('unexpected JWT \"alg\" header parameter', INVALID_RESPONSE, {\n                header,\n                expected: client,\n                reason: 'client configuration',\n            });\n        }\n        return;\n    }\n    if (Array.isArray(issuer)) {\n        if (!issuer.includes(header.alg)) {\n            throw OPE('unexpected JWT \"alg\" header parameter', INVALID_RESPONSE, {\n                header,\n                expected: issuer,\n                reason: 'authorization server metadata',\n            });\n        }\n        return;\n    }\n    if (fallback !== undefined) {\n        if (typeof fallback === 'string'\n            ? header.alg !== fallback\n            : typeof fallback === 'function'\n                ? !fallback(header.alg)\n                : !fallback.includes(header.alg)) {\n            throw OPE('unexpected JWT \"alg\" header parameter', INVALID_RESPONSE, {\n                header,\n                expected: fallback,\n                reason: 'default value',\n            });\n        }\n        return;\n    }\n    throw OPE('missing client or server configuration to verify used JWT \"alg\" header parameter', undefined, { client, issuer, fallback });\n}\nfunction getURLSearchParameter(parameters, name) {\n    const { 0: value, length } = parameters.getAll(name);\n    if (length > 1) {\n        throw OPE(`\"${name}\" parameter must be provided only once`, INVALID_RESPONSE);\n    }\n    return value;\n}\nexport const skipStateCheck = Symbol();\nexport const expectNoState = Symbol();\nexport function validateAuthResponse(as, client, parameters, expectedState) {\n    assertAs(as);\n    assertClient(client);\n    if (parameters instanceof URL) {\n        parameters = parameters.searchParams;\n    }\n    if (!(parameters instanceof URLSearchParams)) {\n        throw CodedTypeError('\"parameters\" must be an instance of URLSearchParams, or URL', ERR_INVALID_ARG_TYPE);\n    }\n    if (getURLSearchParameter(parameters, 'response')) {\n        throw OPE('\"parameters\" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()', INVALID_RESPONSE, { parameters });\n    }\n    const iss = getURLSearchParameter(parameters, 'iss');\n    const state = getURLSearchParameter(parameters, 'state');\n    if (!iss && as.authorization_response_iss_parameter_supported) {\n        throw OPE('response parameter \"iss\" (issuer) missing', INVALID_RESPONSE, { parameters });\n    }\n    if (iss && iss !== as.issuer) {\n        throw OPE('unexpected \"iss\" (issuer) response parameter value', INVALID_RESPONSE, {\n            expected: as.issuer,\n            parameters,\n        });\n    }\n    switch (expectedState) {\n        case undefined:\n        case expectNoState:\n            if (state !== undefined) {\n                throw OPE('unexpected \"state\" response parameter encountered', INVALID_RESPONSE, {\n                    expected: undefined,\n                    parameters,\n                });\n            }\n            break;\n        case skipStateCheck:\n            break;\n        default:\n            assertString(expectedState, '\"expectedState\" argument');\n            if (state !== expectedState) {\n                throw OPE(state === undefined\n                    ? 'response parameter \"state\" missing'\n                    : 'unexpected \"state\" response parameter value', INVALID_RESPONSE, { expected: expectedState, parameters });\n            }\n    }\n    const error = getURLSearchParameter(parameters, 'error');\n    if (error) {\n        throw new AuthorizationResponseError('authorization response from the server is an error', {\n            cause: parameters,\n        });\n    }\n    const id_token = getURLSearchParameter(parameters, 'id_token');\n    const token = getURLSearchParameter(parameters, 'token');\n    if (id_token !== undefined || token !== undefined) {\n        throw new UnsupportedOperationError('implicit and hybrid flows are not supported');\n    }\n    return brand(new URLSearchParams(parameters));\n}\nfunction algToSubtle(alg) {\n    switch (alg) {\n        case 'PS256':\n        case 'PS384':\n        case 'PS512':\n            return { name: 'RSA-PSS', hash: `SHA-${alg.slice(-3)}` };\n        case 'RS256':\n        case 'RS384':\n        case 'RS512':\n            return { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${alg.slice(-3)}` };\n        case 'ES256':\n        case 'ES384':\n            return { name: 'ECDSA', namedCurve: `P-${alg.slice(-3)}` };\n        case 'ES512':\n            return { name: 'ECDSA', namedCurve: 'P-521' };\n        case 'EdDSA':\n            return 'Ed25519';\n        case 'Ed25519':\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            return alg;\n        default:\n            throw new UnsupportedOperationError('unsupported JWS algorithm', { cause: { alg } });\n    }\n}\nasync function importJwk(alg, jwk) {\n    const { ext, key_ops, use, ...key } = jwk;\n    return crypto.subtle.importKey('jwk', key, algToSubtle(alg), true, ['verify']);\n}\nexport async function deviceAuthorizationRequest(as, client, clientAuthentication, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'device_authorization_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(parameters);\n    body.set('client_id', client.client_id);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    return authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n}\nexport async function processDeviceAuthorizationResponse(as, client, response) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Device Authorization Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.device_code, '\"response\" body \"device_code\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    assertString(json.user_code, '\"response\" body \"user_code\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    assertString(json.verification_uri, '\"response\" body \"verification_uri\" property', INVALID_RESPONSE, { body: json });\n    let expiresIn = typeof json.expires_in !== 'number' ? parseFloat(json.expires_in) : json.expires_in;\n    assertNumber(expiresIn, true, '\"response\" body \"expires_in\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    json.expires_in = expiresIn;\n    if (json.verification_uri_complete !== undefined) {\n        assertString(json.verification_uri_complete, '\"response\" body \"verification_uri_complete\" property', INVALID_RESPONSE, { body: json });\n    }\n    if (json.interval !== undefined) {\n        assertNumber(json.interval, false, '\"response\" body \"interval\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    return json;\n}\nexport async function deviceCodeGrantRequest(as, client, clientAuthentication, deviceCode, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(deviceCode, '\"deviceCode\"');\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('device_code', deviceCode);\n    return tokenEndpointRequest(as, client, clientAuthentication, 'urn:ietf:params:oauth:grant-type:device_code', parameters, options);\n}\nexport async function processDeviceCodeResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nexport async function generateKeyPair(alg, options) {\n    assertString(alg, '\"alg\"');\n    const algorithm = algToSubtle(alg);\n    if (alg.startsWith('PS') || alg.startsWith('RS')) {\n        Object.assign(algorithm, {\n            modulusLength: options?.modulusLength ?? 2048,\n            publicExponent: new Uint8Array([0x01, 0x00, 0x01]),\n        });\n    }\n    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, [\n        'sign',\n        'verify',\n    ]);\n}\nfunction normalizeHtu(htu) {\n    const url = new URL(htu);\n    url.search = '';\n    url.hash = '';\n    return url.href;\n}\nasync function validateDPoP(request, accessToken, accessTokenClaims, options) {\n    const headerValue = request.headers.get('dpop');\n    if (headerValue === null) {\n        throw OPE('operation indicated DPoP use but the request has no DPoP HTTP Header', INVALID_REQUEST, { headers: request.headers });\n    }\n    if (request.headers.get('authorization')?.toLowerCase().startsWith('dpop ') === false) {\n        throw OPE(`operation indicated DPoP use but the request's Authorization HTTP Header scheme is not DPoP`, INVALID_REQUEST, { headers: request.headers });\n    }\n    if (typeof accessTokenClaims.cnf?.jkt !== 'string') {\n        throw OPE('operation indicated DPoP use but the JWT Access Token has no jkt confirmation claim', INVALID_REQUEST, { claims: accessTokenClaims });\n    }\n    const clockSkew = getClockSkew(options);\n    const proof = await validateJwt(headerValue, checkSigningAlgorithm.bind(undefined, options?.signingAlgorithms, undefined, supported), clockSkew, getClockTolerance(options), undefined)\n        .then(checkJwtType.bind(undefined, 'dpop+jwt'))\n        .then(validatePresence.bind(undefined, ['iat', 'jti', 'ath', 'htm', 'htu']));\n    const now = epochTime() + clockSkew;\n    const diff = Math.abs(now - proof.claims.iat);\n    if (diff > 300) {\n        throw OPE('DPoP Proof iat is not recent enough', JWT_TIMESTAMP_CHECK, {\n            now,\n            claims: proof.claims,\n            claim: 'iat',\n        });\n    }\n    if (proof.claims.htm !== request.method) {\n        throw OPE('DPoP Proof htm mismatch', JWT_CLAIM_COMPARISON, {\n            expected: request.method,\n            claims: proof.claims,\n            claim: 'htm',\n        });\n    }\n    if (typeof proof.claims.htu !== 'string' ||\n        normalizeHtu(proof.claims.htu) !== normalizeHtu(request.url)) {\n        throw OPE('DPoP Proof htu mismatch', JWT_CLAIM_COMPARISON, {\n            expected: normalizeHtu(request.url),\n            claims: proof.claims,\n            claim: 'htu',\n        });\n    }\n    {\n        const expected = b64u(await crypto.subtle.digest('SHA-256', buf(accessToken)));\n        if (proof.claims.ath !== expected) {\n            throw OPE('DPoP Proof ath mismatch', JWT_CLAIM_COMPARISON, {\n                expected,\n                claims: proof.claims,\n                claim: 'ath',\n            });\n        }\n    }\n    {\n        const expected = await calculateJwkThumbprint(proof.header.jwk);\n        if (accessTokenClaims.cnf.jkt !== expected) {\n            throw OPE('JWT Access Token confirmation mismatch', JWT_CLAIM_COMPARISON, {\n                expected,\n                claims: accessTokenClaims,\n                claim: 'cnf.jkt',\n            });\n        }\n    }\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = headerValue.split('.');\n    const signature = b64u(encodedSignature);\n    const { jwk, alg } = proof.header;\n    if (!jwk) {\n        throw OPE('DPoP Proof is missing the jwk header parameter', INVALID_REQUEST, {\n            header: proof.header,\n        });\n    }\n    const key = await importJwk(alg, jwk);\n    if (key.type !== 'public') {\n        throw OPE('DPoP Proof jwk header parameter must contain a public key', INVALID_REQUEST, {\n            header: proof.header,\n        });\n    }\n    await validateJwsSignature(protectedHeader, payload, key, signature);\n}\nexport async function validateJwtAccessToken(as, request, expectedAudience, options) {\n    assertAs(as);\n    if (!looseInstanceOf(request, Request)) {\n        throw CodedTypeError('\"request\" must be an instance of Request', ERR_INVALID_ARG_TYPE);\n    }\n    assertString(expectedAudience, '\"expectedAudience\"');\n    const authorization = request.headers.get('authorization');\n    if (authorization === null) {\n        throw OPE('\"request\" is missing an Authorization HTTP Header', INVALID_REQUEST, {\n            headers: request.headers,\n        });\n    }\n    let { 0: scheme, 1: accessToken, length } = authorization.split(' ');\n    scheme = scheme.toLowerCase();\n    switch (scheme) {\n        case 'dpop':\n        case 'bearer':\n            break;\n        default:\n            throw new UnsupportedOperationError('unsupported Authorization HTTP Header scheme', {\n                cause: { headers: request.headers },\n            });\n    }\n    if (length !== 2) {\n        throw OPE('invalid Authorization HTTP Header format', INVALID_REQUEST, {\n            headers: request.headers,\n        });\n    }\n    const requiredClaims = [\n        'iss',\n        'exp',\n        'aud',\n        'sub',\n        'iat',\n        'jti',\n        'client_id',\n    ];\n    if (options?.requireDPoP || scheme === 'dpop' || request.headers.has('dpop')) {\n        requiredClaims.push('cnf');\n    }\n    const { claims, header } = await validateJwt(accessToken, checkSigningAlgorithm.bind(undefined, options?.signingAlgorithms, undefined, supported), getClockSkew(options), getClockTolerance(options), undefined)\n        .then(checkJwtType.bind(undefined, 'at+jwt'))\n        .then(validatePresence.bind(undefined, requiredClaims))\n        .then(validateIssuer.bind(undefined, as))\n        .then(validateAudience.bind(undefined, expectedAudience))\n        .catch(reassignRSCode);\n    for (const claim of ['client_id', 'jti', 'sub']) {\n        if (typeof claims[claim] !== 'string') {\n            throw OPE(`unexpected JWT \"${claim}\" claim type`, INVALID_REQUEST, { claims });\n        }\n    }\n    if ('cnf' in claims) {\n        if (!isJsonObject(claims.cnf)) {\n            throw OPE('unexpected JWT \"cnf\" (confirmation) claim value', INVALID_REQUEST, { claims });\n        }\n        const { 0: cnf, length } = Object.keys(claims.cnf);\n        if (length) {\n            if (length !== 1) {\n                throw new UnsupportedOperationError('multiple confirmation claims are not supported', {\n                    cause: { claims },\n                });\n            }\n            if (cnf !== 'jkt') {\n                throw new UnsupportedOperationError('unsupported JWT Confirmation method', {\n                    cause: { claims },\n                });\n            }\n        }\n    }\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = accessToken.split('.');\n    const signature = b64u(encodedSignature);\n    const key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);\n    await validateJwsSignature(protectedHeader, payload, key, signature);\n    if (options?.requireDPoP ||\n        scheme === 'dpop' ||\n        claims.cnf?.jkt !== undefined ||\n        request.headers.has('dpop')) {\n        await validateDPoP(request, accessToken, claims, options).catch(reassignRSCode);\n    }\n    return claims;\n}\nfunction reassignRSCode(err) {\n    if (err instanceof OperationProcessingError && err?.code === INVALID_REQUEST) {\n        err.code = INVALID_RESPONSE;\n    }\n    throw err;\n}\nexport async function backchannelAuthenticationRequest(as, client, clientAuthentication, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'backchannel_authentication_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(parameters);\n    body.set('client_id', client.client_id);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    return authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n}\nexport async function processBackchannelAuthenticationResponse(as, client, response) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Backchannel Authentication Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.auth_req_id, '\"response\" body \"auth_req_id\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    let expiresIn = typeof json.expires_in !== 'number' ? parseFloat(json.expires_in) : json.expires_in;\n    assertNumber(expiresIn, true, '\"response\" body \"expires_in\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    json.expires_in = expiresIn;\n    if (json.interval !== undefined) {\n        assertNumber(json.interval, false, '\"response\" body \"interval\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    return json;\n}\nexport async function backchannelAuthenticationGrantRequest(as, client, clientAuthentication, authReqId, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(authReqId, '\"authReqId\"');\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('auth_req_id', authReqId);\n    return tokenEndpointRequest(as, client, clientAuthentication, 'urn:openid:params:grant-type:ciba', parameters, options);\n}\nexport async function processBackchannelAuthenticationGrantResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nexport async function dynamicClientRegistrationRequest(as, metadata, options) {\n    assertAs(as);\n    const url = resolveEndpoint(as, 'registration_endpoint', metadata.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    headers.set('content-type', 'application/json');\n    const method = 'POST';\n    if (options?.DPoP) {\n        assertDPoP(options.DPoP);\n        await options.DPoP.addProof(url, headers, method, options.initialAccessToken);\n    }\n    if (options?.initialAccessToken) {\n        headers.set('authorization', `${headers.has('dpop') ? 'DPoP' : 'Bearer'} ${options.initialAccessToken}`);\n    }\n    const response = await (options?.[customFetch] || fetch)(url.href, {\n        body: JSON.stringify(metadata),\n        headers: Object.fromEntries(headers.entries()),\n        method,\n        redirect: 'manual',\n        signal: signal(url, options?.signal),\n    });\n    options?.DPoP?.cacheNonce(response, url);\n    return response;\n}\nexport async function processDynamicClientRegistrationResponse(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 201, 'Dynamic Client Registration Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.client_id, '\"response\" body \"client_id\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    if (json.client_secret !== undefined) {\n        assertString(json.client_secret, '\"response\" body \"client_secret\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    if (json.client_secret) {\n        assertNumber(json.client_secret_expires_at, true, '\"response\" body \"client_secret_expires_at\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    return json;\n}\nexport async function resourceDiscoveryRequest(resourceIdentifier, options) {\n    return performDiscovery(resourceIdentifier, 'resourceIdentifier', (url) => {\n        prependWellKnown(url, '.well-known/oauth-protected-resource', true);\n        return url;\n    }, options);\n}\nexport async function processResourceDiscoveryResponse(expectedResourceIdentifier, response) {\n    const expected = expectedResourceIdentifier;\n    if (!(expected instanceof URL) && expected !== _nodiscoverycheck) {\n        throw CodedTypeError('\"expectedResourceIdentifier\" must be an instance of URL', ERR_INVALID_ARG_TYPE);\n    }\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    if (response.status !== 200) {\n        throw OPE('\"response\" is not a conform Resource Server Metadata response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);\n    }\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.resource, '\"response\" body \"resource\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    if (expected !== _nodiscoverycheck && new URL(json.resource).href !== expected.href) {\n        throw OPE('\"response\" body \"resource\" property does not match the expected value', JSON_ATTRIBUTE_COMPARISON, { expected: expected.href, body: json, attribute: 'resource' });\n    }\n    return json;\n}\nasync function getResponseJsonBody(response, check = assertApplicationJson) {\n    let json;\n    try {\n        json = await response.json();\n    }\n    catch (cause) {\n        check(response);\n        throw OPE('failed to parse \"response\" body as JSON', PARSE_ERROR, cause);\n    }\n    if (!isJsonObject(json)) {\n        throw OPE('\"response\" body must be a top level object', INVALID_RESPONSE, { body: json });\n    }\n    return json;\n}\nexport const _nopkce = nopkce;\nexport const _nodiscoverycheck = Symbol();\nexport const _expectedIssuer = Symbol();\n//# sourceMappingURL=index.js.map","import * as oauth from 'oauth4webapi';\n\nimport * as yup from 'yup';\nimport { KnownError, KnownErrors } from '../known-errors';\nimport { inlineProductSchema } from '../schema-fields';\nimport { AccessToken, InternalSession, RefreshToken } from '../sessions';\nimport { generateSecureRandomString } from '../utils/crypto';\nimport { HexclaveAssertionError, throwErr } from '../utils/errors';\nimport { globalVar } from '../utils/globals';\nimport { HTTP_METHODS, HttpMethod } from '../utils/http';\nimport { ReadonlyJson } from '../utils/json';\nimport { publishableClientKeyNotNecessarySentinel } from '../utils/oauth';\nimport { filterUndefined, filterUndefinedOrNull } from '../utils/objects';\nimport { AuthenticationResponseJSON, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON } from '../utils/passkey';\nimport { wait } from '../utils/promises';\nimport { Result } from \"../utils/results\";\nimport { deindent } from '../utils/strings';\nimport { urlString } from '../utils/urls';\nimport { ConnectedAccountAccessTokenCrud, ConnectedAccountCrud } from './crud/connected-accounts';\nimport { ContactChannelsCrud } from './crud/contact-channels';\nimport { CurrentUserCrud } from './crud/current-user';\nimport { CustomerInvoicesListResponse, ListCustomerInvoicesOptions } from './crud/invoices';\nimport { ItemCrud } from './crud/items';\nimport { NotificationPreferenceCrud } from './crud/notification-preferences';\nimport { OAuthProviderCrud } from './crud/oauth-providers';\nimport { CustomerProductsListResponse, ListCustomerProductsOptions } from './crud/products';\nimport { TeamApiKeysCrud, UserApiKeysCrud, teamApiKeysCreateInputSchema, teamApiKeysCreateOutputSchema, userApiKeysCreateInputSchema, userApiKeysCreateOutputSchema } from './crud/project-api-keys';\nimport { ProjectPermissionsCrud } from './crud/project-permissions';\nimport { AdminUserProjectsCrud, ClientProjectsCrud } from './crud/projects';\nimport { SessionsCrud } from './crud/sessions';\nimport { TeamInvitationCrud } from './crud/team-invitation';\nimport { TeamMemberProfilesCrud } from './crud/team-member-profiles';\nimport { TeamPermissionsCrud } from './crud/team-permissions';\nimport { TeamsCrud } from './crud/teams';\n\nexport type RequestLogEntry = {\n  path: string,\n  method: string,\n  status?: number,\n  duration: number,\n  error?: string,\n};\n\nexport type RequestListener = (entry: RequestLogEntry) => void;\n\nexport type ClientInterfaceOptions = {\n  clientVersion: string,\n  // This is a function instead of a string because it might be different based on the environment (for example client vs server)\n  getBaseUrl: () => string,\n  getAnalyticsBaseUrl?: () => string,\n  /**\n   * Ordered list of base URLs for request routing with fallback.\n   * Index 0 = primary, index 1..N = fallbacks in priority order.\n   * A single-element array means no fallback occurs.\n   */\n  getApiUrls: () => string[],\n  /**\n   * When a fallback succeeds and becomes the active server, this is the initial probability\n   * (0–1) that any given request will probe the primary to check if it's back.\n   * Halves on each failed probe, resets on success. Default: 0.3 (30%).\n   */\n  probeRate?: number,\n  extraRequestHeaders: Record<string, string>,\n  projectId: string,\n  prepareRequest?: () => Promise<void>,\n} & ({\n  publishableClientKey?: string,\n} | {\n  projectOwnerSession: InternalSession | (() => Promise<string | null>),\n});\n\ntype BotChallengeInput = {\n  token?: string,\n  phase?: \"invisible\" | \"visible\",\n  unavailable?: true,\n};\n\nconst botChallengeKnownErrors = [\n  KnownErrors.BotChallengeRequired,\n  KnownErrors.BotChallengeFailed,\n] as const;\n\nfunction isBotChallengeKnownError(error: unknown): error is KnownErrors[\"BotChallengeRequired\"] | KnownErrors[\"BotChallengeFailed\"] {\n  return KnownErrors.BotChallengeRequired.isInstance(error) || KnownErrors.BotChallengeFailed.isInstance(error);\n}\n\nfunction getBotChallengeRequestFields(botChallenge: BotChallengeInput | undefined, context: string) {\n  if (botChallenge?.unavailable) {\n    if (botChallenge.token != null || botChallenge.phase != null) {\n      throw new HexclaveAssertionError(`${context} bot challenge unavailability cannot be combined with a token or phase.`);\n    }\n\n    return {\n      bot_challenge_unavailable: \"true\" as const,\n    };\n  }\n\n  const challengeToken = botChallenge?.token?.trim() || undefined;\n  if (botChallenge?.phase === \"visible\") {\n    if (challengeToken == null) {\n      // Backward-compatible fallback for older callers; prefer `unavailable: true`.\n      return {\n        bot_challenge_unavailable: \"true\",\n      };\n    }\n\n    return {\n      bot_challenge_token: challengeToken,\n      bot_challenge_phase: \"visible\" as const,\n    };\n  }\n\n  if (challengeToken == null) {\n    if (botChallenge?.phase != null) {\n      throw new HexclaveAssertionError(`${context} bot challenge phase options require a token.`);\n    }\n\n    return {};\n  }\n\n  if (botChallenge?.phase == null) {\n    return {\n      bot_challenge_token: challengeToken,\n    };\n  }\n\n  return {\n    bot_challenge_token: challengeToken,\n    bot_challenge_phase: \"invisible\" as const,\n  };\n}\n\nasync function encodeAnalyticsBody(\n  jsonBody: string,\n  options: { keepalive: boolean },\n): Promise<{ body: BodyInit, contentType: string }> {\n  // pagehide/visibilitychange flushes use keepalive: true. The browser must\n  // dispatch the fetch before tearing the page down — awaiting async gzip\n  // first lets the request slip past tear-down and never start.\n  if (options.keepalive) {\n    return { body: jsonBody, contentType: \"application/json\" };\n  }\n  const CompressionStreamCtor: typeof CompressionStream | undefined =\n    (globalVar as { CompressionStream?: typeof CompressionStream }).CompressionStream;\n  if (typeof CompressionStreamCtor !== \"function\" || typeof Blob === \"undefined\" || typeof Response === \"undefined\") {\n    return { body: jsonBody, contentType: \"application/json\" };\n  }\n  try {\n    const stream = new Blob([jsonBody]).stream().pipeThrough(new CompressionStreamCtor(\"gzip\"));\n    const buffer = await new Response(stream).arrayBuffer();\n    return { body: new Uint8Array(buffer), contentType: \"application/octet-stream\" };\n  } catch {\n    // Partial/broken CompressionStream support: fall back to plain JSON so\n    // EventTracker._flush() doesn't drop the batch via Result.error.\n    return { body: jsonBody, contentType: \"application/json\" };\n  }\n}\n\nexport class HexclaveClientInterface {\n  private pendingNetworkDiagnostics?: ReturnType<HexclaveClientInterface[\"_runNetworkDiagnosticsInner\"]>;\n  private _requestListeners = new Set<RequestListener>();\n\n  /**\n   * Fallback state. When null, we're in normal mode (primary first).\n   * When set, we skip straight to `stickyIndex` and only probe primary occasionally.\n   */\n  private _sticky: { index: number, probeRate: number } | null = null;\n  private readonly _initialProbeRate: number;\n\n  constructor(public readonly options: ClientInterfaceOptions) {\n    this._initialProbeRate = options.probeRate ?? 0.3;\n  }\n\n  addRequestListener(listener: RequestListener): () => void {\n    this._requestListeners.add(listener);\n    return () => {\n      this._requestListeners.delete(listener);\n    };\n  }\n\n  get projectId() {\n    return this.options.projectId;\n  }\n\n  getApiUrl() {\n    return this.options.getBaseUrl() + \"/api/v1\";\n  }\n\n  getApiUrls(): string[] {\n    return this.options.getApiUrls().map(u => u + \"/api/v1\");\n  }\n\n  /**\n   * Returns the best-known-good API URL: the sticky fallback if we're in\n   * fallback mode, otherwise the primary. Use for browser-navigated URLs\n   * (e.g. OAuth authorize) where _withFallback can't help.\n   */\n  getBestApiUrl(): string {\n    const apiUrls = this.getApiUrls();\n    if (this._sticky && apiUrls[this._sticky.index]) {\n      return apiUrls[this._sticky.index];\n    }\n    return apiUrls[0];\n  }\n\n  /**\n   * Routes a request through an ordered URL list with automatic failover.\n   *\n   * The URL list is [primary, ...fallbacks]. The logic has two modes:\n   *\n   * **Normal mode** (`_sticky` is null) — try each URL in order. If a\n   * non-primary URL succeeds, enter sticky mode on that index.\n   *\n   * **Sticky mode** — a previous request already failed over. We remember\n   * which URL worked and go there directly. Occasionally (controlled by a\n   * decaying probe rate) we probe the primary to see if it recovered:\n   *   - Probe succeeds → exit sticky mode, use result.\n   *   - Probe fails → halve probe rate, use sticky URL.\n   *   - Sticky URL fails → exit sticky mode, do a full iteration.\n   *\n   * In both modes, a full iteration tries every URL once per pass for 2\n   * passes before giving up. KnownErrors and 4xx API responses (except 429)\n   * are never retried (they're application-level, not network-level).\n   *\n   * Single-URL lists skip all of this and use 5-retry behavior directly.\n   */\n  protected async _withFallback<T>(cb: (apiUrl: string, retryOptions: { maxAttempts: number, skipDiagnostics: boolean }) => Promise<T>): Promise<T> {\n    const apiUrls = this.getApiUrls();\n\n    // Single URL — no fallback, just retry normally.\n    if (apiUrls.length <= 1) {\n      return await cb(apiUrls[0], { maxAttempts: 5, skipDiagnostics: false });\n    }\n\n    // If we're in sticky mode, try the remembered URL (with an optional primary probe first).\n    if (this._sticky) {\n      const result = await this._tryStickyUrl(apiUrls, cb);\n      if (result !== undefined) return result;\n      // Sticky URL failed — _sticky was cleared, fall through to full iteration.\n    }\n\n    // Full iteration: try every URL in order, 2 passes.\n    return await this._iterateUrls(apiUrls, cb);\n  }\n\n  private _shouldSkipFallback(error: unknown) {\n    return error instanceof KnownError || this._isNonRetryableApiResponseError(error);\n  }\n\n  private _isNonRetryableApiResponseError(error: unknown) {\n    const response = this._getApiResponseFromError(error);\n    return response != null && response.status >= 400 && response.status < 500;\n  }\n\n  private _getApiResponseFromError(error: unknown, seenErrors = new Set<Error>()): Response | null {\n    if (error instanceof Response) {\n      return error;\n    }\n    if (!(error instanceof Error) || seenErrors.has(error)) {\n      return null;\n    }\n\n    seenErrors.add(error);\n    return this._getApiResponseFromError(error.cause, seenErrors);\n  }\n\n  /**\n   * Attempts the sticky URL, optionally probing primary first.\n   * Returns the result on success, or `undefined` if we should fall through to full iteration.\n   */\n  private async _tryStickyUrl<T>(\n    apiUrls: string[],\n    cb: (apiUrl: string, retryOptions: { maxAttempts: number, skipDiagnostics: boolean }) => Promise<T>,\n  ): Promise<T | undefined> {\n    const sticky = this._sticky!;\n\n    // Probabilistically probe primary to check if it's back.\n    if (Math.random() < sticky.probeRate) {\n      try {\n        const result = await cb(apiUrls[0], { maxAttempts: 1, skipDiagnostics: true });\n        this._sticky = null;\n        return result;\n      } catch (e) {\n        if (this._shouldSkipFallback(e)) throw e;\n        sticky.probeRate = Math.max(sticky.probeRate * 0.5, 0.01);\n      }\n    }\n\n    // Try the sticky URL itself.\n    try {\n      return await cb(apiUrls[sticky.index], { maxAttempts: 1, skipDiagnostics: true });\n    } catch (e) {\n      if (this._shouldSkipFallback(e)) throw e;\n      this._sticky = null;\n      return undefined;\n    }\n  }\n\n  /**\n   * Tries every URL in order for up to 2 passes.\n   * If a non-primary URL (index > 0) succeeds, enters sticky mode on it.\n   */\n  private async _iterateUrls<T>(\n    apiUrls: string[],\n    cb: (apiUrl: string, retryOptions: { maxAttempts: number, skipDiagnostics: boolean }) => Promise<T>,\n  ): Promise<T> {\n    let lastError: Error | undefined;\n\n    for (let pass = 0; pass < 2; pass++) {\n      for (let i = 0; i < apiUrls.length; i++) {\n        try {\n          const result = await cb(apiUrls[i], { maxAttempts: 1, skipDiagnostics: true });\n          if (i > 0) {\n            this._sticky = { index: i, probeRate: this._initialProbeRate };\n          }\n          return result;\n        } catch (e) {\n          if (this._shouldSkipFallback(e)) throw e;\n          lastError = e instanceof Error ? e : new Error(String(e));\n        }\n      }\n    }\n\n    throw lastError!;\n  }\n\n  getAnalyticsApiUrl() {\n    return (this.options.getAnalyticsBaseUrl ?? this.options.getBaseUrl)() + \"/api/v1\";\n  }\n\n  public async runNetworkDiagnostics(session?: InternalSession | null, requestType?: \"client\" | \"server\" | \"admin\") {\n    if (this.pendingNetworkDiagnostics) {\n      return await this.pendingNetworkDiagnostics;\n    }\n\n    this.pendingNetworkDiagnostics = this._runNetworkDiagnosticsInner(session, requestType);\n    try {\n      return await this.pendingNetworkDiagnostics;\n    } finally {\n      this.pendingNetworkDiagnostics = undefined;\n    }\n  }\n\n  private async _runNetworkDiagnosticsInner(session?: InternalSession | null, requestType?: \"client\" | \"server\" | \"admin\") {\n    const tryRequest = async (cb: () => Promise<void>) => {\n      try {\n        await cb();\n        return \"OK\";\n      } catch (e) {\n        return `${e}`;\n      }\n    };\n    const cfTrace = await tryRequest(async () => {\n      const res = await fetch(\"https://1.1.1.1/cdn-cgi/trace\");\n      if (!res.ok) {\n        throw new Error(`${res.status} ${res.statusText}: ${await res.text()}`);\n      }\n    });\n    const baseUrlBackend = await tryRequest(async () => {\n      const res = await fetch(new URL(\"/health\", this.getApiUrl()));\n      if (!res.ok) {\n        throw new Error(`${res.status} ${res.statusText}: ${await res.text()}`);\n      }\n    });\n    const prodDashboard = await tryRequest(async () => {\n      const res = await fetch(\"https://app.hexclave.com/health\");\n      if (!res.ok) {\n        throw new Error(`${res.status} ${res.statusText}: ${await res.text()}`);\n      }\n    });\n    const prodBackend = await tryRequest(async () => {\n      const res = await fetch(\"https://api.hexclave.com/health\");\n      if (!res.ok) {\n        throw new Error(`${res.status} ${res.statusText}: ${await res.text()}`);\n      }\n    });\n    return {\n      \"navigator?.onLine\": globalVar.navigator?.onLine,\n      cfTrace,\n      baseUrlBackend,\n      prodDashboard,\n      prodBackend,\n    };\n  }\n\n  protected async _createNetworkError(cause: Error, session?: InternalSession | null, requestType?: \"client\" | \"server\" | \"admin\") {\n    return new Error(deindent`\n      Hexclave is unable to connect to the server. Please check your internet connection and try again.\n\n      If the problem persists, please contact support and provide a screenshot of your entire browser console.\n\n      ${cause}\n\n      ${JSON.stringify(await this.runNetworkDiagnostics(session, requestType), null, 2)}\n    `, { cause: cause });\n  }\n\n  protected async _networkRetry<T>(\n    cb: () => Promise<Result<T, any>>,\n    session?: InternalSession | null,\n    requestType?: \"client\" | \"server\" | \"admin\",\n    options?: { maxAttempts?: number, skipDiagnostics?: boolean },\n  ): Promise<T> {\n    const retriedResult = await Result.retry(\n      cb,\n      options?.maxAttempts ?? 5,\n      { exponentialDelayBase: 1000 },\n    );\n\n    // try to diagnose the error for the user\n    if (retriedResult.status === \"error\") {\n      if (globalVar.navigator && globalVar.navigator.onLine === false) {\n        throw new Error(\"You are offline. Please check your internet connection and try again. (window.navigator.onLine is false)\", { cause: retriedResult.error });\n      }\n      if (options?.skipDiagnostics) {\n        throw retriedResult.error;\n      }\n      throw await this._createNetworkError(retriedResult.error, session, requestType);\n    }\n    return retriedResult.data;\n  }\n\n  protected async _networkRetryException<T>(\n    cb: () => Promise<T>,\n    session?: InternalSession | null,\n    requestType?: \"client\" | \"server\" | \"admin\",\n    options?: { maxAttempts?: number, skipDiagnostics?: boolean },\n  ): Promise<T> {\n    return await this._networkRetry(async () => await Result.fromThrowingAsync(cb), session, requestType, options);\n  }\n\n  public async fetchNewAccessToken(refreshToken: RefreshToken) {\n    if (\"projectOwnerSession\" in this.options) {\n      // TODO support it\n      throw new Error(\"Admin session token is currently not supported for fetching new access token. Did you try to log in on a StackApp initiated with the admin session?\");\n    }\n\n    const clientSecret = this.options.publishableClientKey ?? publishableClientKeyNotNecessarySentinel;\n    return await this._withFallback(async (apiUrl, retryOptions) => {\n      return await this._fetchNewAccessTokenInner(refreshToken, clientSecret, apiUrl, retryOptions);\n    });\n  }\n\n  private async _fetchNewAccessTokenInner(refreshToken: RefreshToken, clientSecret: string, apiUrl: string, retryOptions?: { maxAttempts?: number, skipDiagnostics?: boolean }) {\n    const tokenEndpoint = apiUrl + '/auth/oauth/token';\n    const as = {\n      issuer: this.options.getBaseUrl(),\n      algorithm: 'oauth2',\n      token_endpoint: tokenEndpoint,\n    };\n    const client: oauth.Client = {\n      client_id: this.projectId,\n      client_secret: clientSecret,\n    };\n\n    const clientAuthentication = oauth.ClientSecretPost(clientSecret);\n    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition\n    const allowInsecure = tokenEndpoint.startsWith('http://');\n\n    const response = await this._networkRetryException(async () => {\n      const rawResponse = await oauth.refreshTokenGrantRequest(\n        as,\n        client,\n        clientAuthentication,\n        refreshToken.token,\n        allowInsecure ? { [oauth.allowInsecureRequests]: true } : undefined,\n      );\n\n      const response = await this._processResponse(rawResponse);\n\n      if (response.status === \"error\") {\n        const error = response.error;\n        if (KnownErrors.RefreshTokenError.isInstance(error)) {\n          return null;\n        }\n        throw error;\n      }\n\n      if (!response.data.ok) {\n        const body = await response.data.text();\n        throw new Error(`Failed to send refresh token request: ${response.status} ${body}`, { cause: response.data });\n      }\n\n      return response.data;\n    }, undefined, undefined, retryOptions);\n    if (!response) return null;\n\n    let result: oauth.TokenEndpointResponse;\n    try {\n      result = await oauth.processRefreshTokenResponse(as, client, response);\n    } catch (e){\n      if (e instanceof oauth.ResponseBodyError) {\n        throw new HexclaveAssertionError(\"ResponseBodyError when processing refresh token response\", {\n          cause: e.cause,\n          code: e.code,\n          error: e.error,\n        });\n      }\n      throw new HexclaveAssertionError(\"Unexpected error when processing refresh token response\", { cause: e });\n    }\n\n    if (!result.access_token) {\n      throw new HexclaveAssertionError(\"Access token not found in token endpoint response, this is weird!\");\n    }\n\n    return AccessToken.createIfValid(result.access_token) ?? throwErr(\"Access token in fetchNewAccessToken is invalid, looks like the backend is returning an invalid token!\", { result });\n  }\n\n  public async sendClientRequest(\n    path: string,\n    requestOptions: RequestInit,\n    session: InternalSession | null,\n    requestType: \"client\" | \"server\" | \"admin\" = \"client\",\n    apiUrlOverride?: string,\n    retryOptions?: { maxAttempts?: number, skipDiagnostics?: boolean },\n  ) {\n    session ??= this.createSession({\n      refreshToken: null,\n    });\n\n    if (apiUrlOverride) {\n      return await this._networkRetry(\n        () => this.sendClientRequestInner(path, requestOptions, session!, requestType, apiUrlOverride, retryOptions),\n        session,\n        requestType,\n        retryOptions,\n      );\n    }\n\n    return await this._withFallback(async (apiUrl, fallbackRetryOptions) => {\n      return await this._networkRetry(\n        () => this.sendClientRequestInner(path, requestOptions, session!, requestType, apiUrl, retryOptions),\n        session,\n        requestType,\n        { ...fallbackRetryOptions, ...retryOptions },\n      );\n    });\n  }\n\n  public createSession(options: Omit<ConstructorParameters<typeof InternalSession>[0], \"refreshAccessTokenCallback\">): InternalSession {\n    const session = new InternalSession({\n      refreshAccessTokenCallback: async (refreshToken) => await this.fetchNewAccessToken(refreshToken),\n      ...options,\n    });\n    return session;\n  }\n\n  async sendSessionReplayBatch(\n    body: string,\n    session: InternalSession | null,\n    options: { keepalive: boolean },\n  ): Promise<Result<Response, Error>> {\n    try {\n      const response = await this.sendClientRequest(\n        \"/session-replays/batch\",\n        {\n          method: \"POST\",\n          headers: { \"Content-Type\": \"application/json\" },\n          body,\n          keepalive: options.keepalive,\n        },\n        session,\n        \"client\",\n        this.getAnalyticsApiUrl(),\n        { maxAttempts: 1, skipDiagnostics: true },\n      );\n      return Result.ok(response);\n    } catch (e) {\n      return Result.error(e instanceof Error ? e : new Error(String(e)));\n    }\n  }\n\n  async sendAnalyticsEventBatch(\n    body: string,\n    session: InternalSession | null,\n    options: { keepalive: boolean },\n  ): Promise<Result<Response, Error>> {\n    try {\n      const encoded = await encodeAnalyticsBody(body, { keepalive: options.keepalive });\n      const response = await this.sendClientRequest(\n        \"/analytics/events/batch\",\n        {\n          method: \"POST\",\n          headers: { \"Content-Type\": encoded.contentType },\n          body: encoded.body,\n          keepalive: options.keepalive,\n        },\n        session,\n        \"client\",\n        this.getAnalyticsApiUrl(),\n        { maxAttempts: 1, skipDiagnostics: true },\n      );\n      return Result.ok(response);\n    } catch (e) {\n      return Result.error(e instanceof Error ? e : new Error(String(e)));\n    }\n  }\n\n  protected async sendClientRequestAndCatchKnownError<E extends typeof KnownErrors[keyof KnownErrors]>(\n    path: string,\n    requestOptions: RequestInit,\n    tokenStoreOrNull: InternalSession | null,\n    errorsToCatch: readonly E[],\n  ): Promise<Result<\n    Response & {\n      usedTokens: {\n        accessToken: AccessToken,\n        refreshToken: RefreshToken | null,\n      } | null,\n    },\n    InstanceType<E>\n  >> {\n    try {\n      return Result.ok(await this.sendClientRequest(path, requestOptions, tokenStoreOrNull));\n    } catch (e) {\n      for (const errorType of errorsToCatch) {\n        if (errorType.isInstance(e)) {\n          return Result.error(e as InstanceType<E>);\n        }\n      }\n      throw e;\n    }\n  }\n\n  private async sendClientRequestInner(\n    path: string,\n    options: RequestInit,\n    session: InternalSession,\n    requestType: \"client\" | \"server\" | \"admin\",\n    apiUrlOverride?: string,\n    innerOptions?: { skipDiagnostics?: boolean },\n  ): Promise<Result<Response & {\n    usedTokens: {\n      accessToken: AccessToken,\n      refreshToken: RefreshToken | null,\n    } | null,\n  }>> {\n    /**\n     * `tokenObj === null` means the session is invalid/not logged in\n     */\n    let tokenObj = await session.getOrFetchLikelyValidTokens(20_000, null);\n\n    let adminSession: InternalSession | null = null;\n    let adminTokenObj: { accessToken: AccessToken, refreshToken: RefreshToken | null } | null = null;\n\n    if (\"projectOwnerSession\" in this.options) {\n      const projectOwnerSession = this.options.projectOwnerSession;\n\n      if (typeof projectOwnerSession === 'function') {\n        const accessTokenString = await projectOwnerSession();\n        if (accessTokenString) {\n          const accessToken = AccessToken.createIfValid(accessTokenString);\n          if (accessToken) {\n            adminTokenObj = { accessToken, refreshToken: null };\n          }\n        }\n      } else {\n        adminSession = projectOwnerSession;\n        adminTokenObj = await projectOwnerSession.getOrFetchLikelyValidTokens(20_000, null);\n      }\n    }\n\n    // all requests should be dynamic to prevent Next.js caching\n    await this.options.prepareRequest?.();\n\n    let url = (apiUrlOverride ?? this.getApiUrl()) + path;\n    if (url.endsWith(\"/\")) {\n      url = url.slice(0, -1);\n    }\n    const params: RequestInit = {\n      /**\n       * This fetch may be cross-origin, in which case we don't want to send cookies of the\n       * original origin (this is the default behavior of `credentials`).\n       *\n       * To help debugging, also omit cookies on same-origin, so we don't accidentally\n       * implement reliance on cookies anywhere.\n       *\n       * However, Cloudflare Workers don't actually support `credentials`, so we only set it\n       * if Cloudflare-exclusive globals are not detected. https://github.com/cloudflare/workers-sdk/issues/2514\n       */\n      ...(\"WebSocketPair\" in globalVar ? {} : {\n        credentials: \"omit\",\n      }),\n      ...options,\n      headers: {\n        // Hexclave rebrand: emit x-hexclave-* request headers; the backend proxy dual-accepts both x-hexclave-* and x-stack-*.\n        \"X-Hexclave-Override-Error-Status\": \"true\",\n        \"X-Hexclave-Project-Id\": this.projectId,\n        \"X-Hexclave-Access-Type\": requestType,\n        \"X-Hexclave-Client-Version\": this.options.clientVersion,\n        ...(tokenObj ? {\n          \"X-Hexclave-Access-Token\": tokenObj.accessToken.token,\n        } : {}),\n        ...(tokenObj?.refreshToken ? {\n          \"X-Hexclave-Refresh-Token\": tokenObj.refreshToken.token,\n        } : {}),\n        \"X-Hexclave-Allow-Anonymous-User\": \"true\",\n        ...(\"publishableClientKey\" in this.options && this.options.publishableClientKey ? {\n          \"X-Hexclave-Publishable-Client-Key\": this.options.publishableClientKey,\n        } : {}),\n        ...(adminTokenObj ? {\n          \"X-Hexclave-Admin-Access-Token\": adminTokenObj.accessToken.token,\n        } : {}),\n        /**\n         * Next.js until v15 would cache fetch requests by default, and forcefully disabling it was nearly impossible.\n         *\n         * This header is used to change the cache key and hence always disable it, because we do our own caching.\n         *\n         * When we drop support for Next.js <15, we may be able to remove this header, but please make sure that this is\n         * the case (I haven't actually tested.)\n         */\n        \"X-Hexclave-Random-Nonce\": generateSecureRandomString(),\n        // don't show a warning when proxying the API through ngrok (only relevant if the API url is an ngrok site)\n        'ngrok-skip-browser-warning': 'true',\n        ...this.options.extraRequestHeaders,\n        ...options.headers,\n      },\n      /**\n       * Cloudflare Workers does not support cache, so don't pass it there\n       */\n      ...(\"WebSocketPair\" in globalVar ? {} : {\n        cache: \"no-store\",\n      }),\n    };\n\n    const startTime = performance.now();\n    let rawRes;\n    try {\n      rawRes = await fetch(url, params);\n    } catch (e) {\n      if (this._requestListeners.size > 0) {\n        const entry: RequestLogEntry = { path, method: (params.method ?? \"GET\").toUpperCase(), duration: Math.round(performance.now() - startTime), error: e instanceof Error ? e.message : \"Network error\" };\n        this._requestListeners.forEach((l) => l(entry));\n      }\n      if (e instanceof TypeError) {\n        // Likely to be a network error. Retry if the request is idempotent, throw network error otherwise.\n        if (HTTP_METHODS[(params.method ?? \"GET\") as HttpMethod].idempotent) {\n          return Result.error(e);\n        } else if (innerOptions?.skipDiagnostics) {\n          throw e;\n        } else {\n          throw await this._createNetworkError(e, session, requestType);\n        }\n      }\n      throw e;\n    }\n\n    const preprocessedRes = await this._preprocessResponse(rawRes);\n\n    if (this._requestListeners.size > 0) {\n      const entry: RequestLogEntry = { path, method: (params.method ?? \"GET\").toUpperCase(), status: preprocessedRes.status, duration: Math.round(performance.now() - startTime) };\n      this._requestListeners.forEach((l) => l(entry));\n    }\n\n    const processedRes = await this._processResponse(preprocessedRes);\n\n    if (processedRes.status === \"error\") {\n      // If the access token is invalid, reset it and retry\n      if (KnownErrors.InvalidAccessToken.isInstance(processedRes.error)) {\n        if (!tokenObj) {\n          throw new HexclaveAssertionError(\"Received invalid access token, but session is not logged in\", { tokenObj, processedRes });\n        }\n        session.markAccessTokenExpired(tokenObj.accessToken);\n        return Result.error(processedRes.error);\n      }\n\n      // Same for the admin access token\n      // TODO HACK: Some of the backend hasn't been ported to use the new error codes, so if we have project owner tokens we need to check for ApiKeyNotFound too. Once the migration to smartRouteHandlers is complete, we can check for InvalidAdminAccessToken only.\n      if (adminSession && (KnownErrors.InvalidAdminAccessToken.isInstance(processedRes.error) || KnownErrors.ApiKeyNotFound.isInstance(processedRes.error))) {\n        if (!adminTokenObj) {\n          throw new HexclaveAssertionError(\"Received invalid admin access token, but admin session is not logged in\", { adminTokenObj, processedRes });\n        }\n        adminSession.markAccessTokenExpired(adminTokenObj.accessToken);\n        return Result.error(processedRes.error);\n      }\n\n      // Known errors are client side errors, so except for the ones above they should not be retried\n      // Hence, throw instead of returning an error\n      throw processedRes.error;\n    }\n\n\n    const res = Object.assign(processedRes.data, {\n      usedTokens: tokenObj,\n    });\n    if (res.ok) {\n      return Result.ok(res);\n    } else if (res.status === 429) {\n      const retryAfter = res.headers.get(\"Retry-After\");\n      if (retryAfter !== null) {\n        console.log(`Rate limited while sending request to ${url}. Will retry after ${retryAfter} seconds...`);\n        await wait(Number(retryAfter) * 1000);\n        return Result.error(new Error(`Rate limited, retrying after ${retryAfter} seconds`));\n      }\n\n      console.log(`Rate limited while sending request to ${url}, no retry-after header received. Retrying with default backoff...`);\n      return Result.error(new Error(\"Rate limited, no retry-after header received\"));\n    } else {\n      const error = await res.text();\n\n      // Do not retry, throw error instead of returning one\n      if (res.status >= 400 && res.status < 500) {\n        throw new Error(`Failed to send request to ${url}: ${res.status} ${error}`, { cause: res });\n      }\n      const errorObj = new HexclaveAssertionError(`Failed to send request to ${url}: ${res.status} ${error}`, { request: params, res, path });\n\n      if (res.status === 508 && error.includes(\"INFINITE_LOOP_DETECTED\")) {\n        // Some Vercel deployments seem to have an odd infinite loop bug. In that case, retry.\n        // See: https://github.com/hexclave/hexclave/issues/319\n        return Result.error(errorObj);\n      }\n\n      // Do not retry, throw error instead of returning one\n      throw errorObj;\n    }\n  }\n\n  private async _preprocessResponse(rawRes: Response): Promise<Response> {\n    let res = rawRes;\n    // Hexclave rebrand: prefer the x-hexclave-* response header, fall back to the legacy x-stack-* name.\n    if (rawRes.headers.has(\"x-hexclave-actual-status\") || rawRes.headers.has(\"x-stack-actual-status\")) {\n      const actualStatus = Number(rawRes.headers.get(\"x-hexclave-actual-status\") ?? rawRes.headers.get(\"x-stack-actual-status\"));\n      res = new Response(rawRes.body, {\n        status: actualStatus,\n        statusText: rawRes.statusText,\n        headers: rawRes.headers,\n      });\n    }\n    return res;\n  }\n\n  private async _processResponse(res: Response): Promise<Result<Response, KnownError>> {\n    // Handle known errors\n    // Hexclave rebrand: prefer the x-hexclave-* response header, fall back to the legacy x-stack-* name.\n    if (res.headers.has(\"x-hexclave-known-error\") || res.headers.has(\"x-stack-known-error\")) {\n      const errorJson = await res.json();\n      const knownErrorHeader = res.headers.get(\"x-hexclave-known-error\") ?? res.headers.get(\"x-stack-known-error\");\n      if (knownErrorHeader !== errorJson.code) {\n        throw new HexclaveAssertionError(\"Mismatch between x-hexclave-known-error/x-stack-known-error header and error code in body; the server's response is invalid\");\n      }\n      const error = KnownError.fromJson(errorJson);\n      return Result.error(error);\n    }\n\n    return Result.ok(res);\n  }\n\n  public async checkFeatureSupport(options: { featureName?: string } & ReadonlyJson): Promise<never> {\n    const res = await this.sendClientRequest(\"/check-feature-support\", {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify(options),\n    }, null);\n\n    throw new HexclaveAssertionError(await res.text());\n  }\n\n  async sendForgotPasswordEmail(\n    email: string,\n    callbackUrl: string,\n  ): Promise<Result<undefined, KnownErrors[\"UserNotFound\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/password/send-reset-code\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          email,\n          callback_url: callbackUrl,\n        }),\n      },\n      null,\n      [KnownErrors.UserNotFound],\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    } else {\n      return Result.ok(undefined);\n    }\n  }\n\n  async sendVerificationEmail(\n    email: string,\n    callbackUrl: string,\n    session: InternalSession\n  ): Promise<KnownErrors[\"EmailAlreadyVerified\"] | undefined> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/contact-channels/send-verification-code\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          email,\n          callback_url: callbackUrl,\n        }),\n      },\n      session,\n      [KnownErrors.EmailAlreadyVerified]\n    );\n\n    if (res.status === \"error\") {\n      return res.error;\n    }\n  }\n\n  async sendMagicLinkEmail(\n    email: string,\n    callbackUrl: string,\n    botChallenge?: BotChallengeInput,\n  ): Promise<Result<{ nonce: string }, KnownErrors[\"RedirectUrlNotWhitelisted\"] | KnownErrors[\"BotChallengeRequired\"] | KnownErrors[\"BotChallengeFailed\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/otp/send-sign-in-code\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          email,\n          callback_url: callbackUrl,\n          ...getBotChallengeRequestFields(botChallenge, \"Magic link sign-in\"),\n        }),\n      },\n      null,\n      [KnownErrors.RedirectUrlNotWhitelisted, ...botChallengeKnownErrors]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    } else {\n      return Result.ok(await res.data.json());\n    }\n  }\n\n  async resetPassword(\n    options: { code: string } & ({ password: string } | { onlyVerifyCode: true })\n  ): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"onlyVerifyCode\" in options ? \"/auth/password/reset/check-code\" : \"/auth/password/reset\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          code: options.code,\n          ...(\"password\" in options ? { password: options.password } : {}),\n        }),\n      },\n      null,\n      [KnownErrors.VerificationCodeError]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    } else {\n      return Result.ok(undefined);\n    }\n  }\n\n  async updatePassword(\n    options: { oldPassword: string, newPassword: string },\n    session: InternalSession\n  ): Promise<KnownErrors[\"PasswordConfirmationMismatch\"] | KnownErrors[\"PasswordRequirementsNotMet\"] | undefined> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/password/update\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          old_password: options.oldPassword,\n          new_password: options.newPassword,\n        }),\n      },\n      session,\n      [KnownErrors.PasswordConfirmationMismatch, KnownErrors.PasswordRequirementsNotMet]\n    );\n\n    if (res.status === \"error\") {\n      return res.error;\n    }\n  }\n\n  async setPassword(\n    options: { password: string },\n    session: InternalSession\n  ): Promise<KnownErrors[\"PasswordRequirementsNotMet\"] | undefined> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/password/set\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify(options),\n      },\n      session,\n      [KnownErrors.PasswordRequirementsNotMet]\n    );\n\n    if (res.status === \"error\") {\n      return res.error;\n    }\n  }\n\n  async verifyPasswordResetCode(code: string): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"]>> {\n    const res = await this.resetPassword({ code, onlyVerifyCode: true });\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    } else {\n      return Result.ok(undefined);\n    }\n  }\n\n  async verifyEmail(code: string): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/contact-channels/verify\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          code,\n        }),\n      },\n      null,\n      [KnownErrors.VerificationCodeError]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    } else {\n      return Result.ok(undefined);\n    }\n  }\n\n  async initiatePasskeyRegistration(\n    options: {},\n    session: InternalSession\n  ): Promise<Result<{ options_json: PublicKeyCredentialCreationOptionsJSON, code: string }, KnownErrors[]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/passkey/initiate-passkey-registration\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify(options),\n      },\n      session,\n      []\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    return Result.ok(await res.data.json());\n  }\n\n  async registerPasskey(\n    options: { credential: RegistrationResponseJSON, code: string },\n    session: InternalSession\n  ): Promise<Result<undefined, KnownErrors[\"PasskeyRegistrationFailed\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/passkey/register\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify(options),\n      },\n      session,\n      [KnownErrors.PasskeyRegistrationFailed]\n    );\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n    return Result.ok(undefined);\n  }\n\n  async initiatePasskeyAuthentication(\n    options: {\n    },\n    session: InternalSession\n  ): Promise<Result<{ options_json: PublicKeyCredentialRequestOptionsJSON, code: string }, KnownErrors[]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/passkey/initiate-passkey-authentication\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify(options),\n      },\n      session,\n      []\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    return Result.ok(await res.data.json());\n  }\n\n  async sendTeamInvitation(options: {\n    email: string,\n    teamId: string,\n    callbackUrl: string,\n    session: InternalSession,\n  }): Promise<void> {\n    await this.sendClientRequest(\n      \"/team-invitations/send-code\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          email: options.email,\n          team_id: options.teamId,\n          callback_url: options.callbackUrl,\n        }),\n      },\n      options.session,\n    );\n  }\n\n  async acceptTeamInvitation<T extends 'use' | 'details' | 'check'>(options: {\n    code: string,\n    session: InternalSession,\n    type: T,\n  }): Promise<Result<T extends 'details' ? { team_display_name: string } : undefined, KnownErrors[\"VerificationCodeError\"] | KnownErrors[\"TeamInvitationEmailMismatch\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      options.type === 'check' ?\n        \"/team-invitations/accept/check-code\" :\n        options.type === 'details' ?\n          \"/team-invitations/accept/details\" :\n          \"/team-invitations/accept\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          code: options.code,\n        }),\n      },\n      options.session,\n      [KnownErrors.VerificationCodeError, KnownErrors.TeamInvitationEmailMismatch]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    } else {\n      return Result.ok(await res.data.json());\n    }\n  }\n\n  async totpMfa(\n    attemptCode: string,\n    totp: string,\n    session: InternalSession\n  ) {\n    const res = await this.sendClientRequest(\"/auth/mfa/sign-in\", {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\"\n      },\n      body: JSON.stringify({\n        code: attemptCode,\n        type: \"totp\",\n        totp: totp,\n      }),\n    }, session);\n\n    const result = await res.json();\n    return {\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token,\n      newUser: result.is_new_user,\n    };\n  }\n\n  async signInWithCredential(\n    email: string,\n    password: string,\n    session: InternalSession\n  ): Promise<Result<{ accessToken: string, refreshToken: string }, KnownErrors[\"EmailPasswordMismatch\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/password/sign-in\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          email,\n          password,\n        }),\n      },\n      session,\n      [KnownErrors.EmailPasswordMismatch]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    const result = await res.data.json();\n    return Result.ok({\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token,\n    });\n  }\n\n  async signUpWithCredential(\n    email: string,\n    password: string,\n    emailVerificationRedirectUrl: string | undefined,\n    session: InternalSession,\n    botChallenge?: BotChallengeInput,\n  ): Promise<Result<{ accessToken: string, refreshToken: string }, KnownErrors[\"UserWithEmailAlreadyExists\"] | KnownErrors[\"PasswordRequirementsNotMet\"] | KnownErrors[\"BotChallengeRequired\"] | KnownErrors[\"BotChallengeFailed\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/password/sign-up\",\n      {\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        method: \"POST\",\n        body: JSON.stringify({\n          email,\n          password,\n          verification_callback_url: emailVerificationRedirectUrl,\n          ...getBotChallengeRequestFields(botChallenge, \"Credential sign-up\"),\n        }),\n      },\n      session,\n      [KnownErrors.UserWithEmailAlreadyExists, KnownErrors.PasswordRequirementsNotMet, ...botChallengeKnownErrors]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    const result = await res.data.json();\n    return Result.ok({\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token,\n    });\n  }\n\n  async signUpAnonymously(session: InternalSession): Promise<Result<{ accessToken: string, refreshToken: string }, never>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/anonymous/sign-up\",\n      {\n        method: \"POST\",\n      },\n      session,\n      [],\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    const result = await res.data.json();\n    return Result.ok({\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token,\n    });\n  }\n\n  async signInWithMagicLink(code: string, session: InternalSession): Promise<Result<{ newUser: boolean, accessToken: string, refreshToken: string }, KnownErrors[\"VerificationCodeError\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/otp/sign-in\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          code,\n        }),\n      },\n      session,\n      [KnownErrors.VerificationCodeError]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    const result = await res.data.json();\n    return Result.ok({\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token,\n      newUser: result.is_new_user,\n    });\n  }\n\n  async signInWithMfa(totp: string, code: string, session: InternalSession): Promise<Result<{ newUser: boolean, accessToken: string, refreshToken: string }, KnownErrors[\"VerificationCodeError\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/mfa/sign-in\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          type: \"totp\",\n          totp,\n          code,\n        }),\n      },\n      session,\n      [KnownErrors.VerificationCodeError]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    const result = await res.data.json();\n    return Result.ok({\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token,\n      newUser: result.is_new_user,\n    });\n  }\n\n  async signInWithPasskey(body: { authentication_response: AuthenticationResponseJSON, code: string }, session: InternalSession): Promise<Result<{accessToken: string, refreshToken: string }, KnownErrors[\"PasskeyAuthenticationFailed\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/passkey/sign-in\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify(body),\n      },\n      session,\n      [KnownErrors.PasskeyAuthenticationFailed]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    const result = await res.data.json();\n    return Result.ok({\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token,\n    });\n  }\n\n  async getOAuthUrl(\n    options: {\n      provider: string,\n      redirectUrl: string,\n      errorRedirectUrl: string,\n      afterCallbackRedirectUrl?: string,\n      codeChallenge: string,\n      state: string,\n      type: \"authenticate\" | \"link\",\n      providerScope?: string,\n      botChallenge?: BotChallengeInput,\n      session: InternalSession,\n    }\n  ): Promise<string> {\n    const updatedRedirectUrl = new URL(options.redirectUrl);\n    for (const key of [\"code\", \"state\"]) {\n      if (updatedRedirectUrl.searchParams.has(key)) {\n        console.warn(\"Redirect URL already contains \" + key + \" parameter, removing it as it will be overwritten by the OAuth callback\");\n      }\n      updatedRedirectUrl.searchParams.delete(key);\n    }\n\n    if (\"projectOwnerSession\" in this.options) {\n      // TODO fix\n      throw new Error(\"Admin session token is currently not supported for OAuth\");\n    }\n    const clientSecret = this.options.publishableClientKey ?? publishableClientKeyNotNecessarySentinel;\n    const url = new URL(this.getBestApiUrl() + \"/auth/oauth/authorize/\" + options.provider.toLowerCase());\n    url.searchParams.set(\"client_id\", this.projectId);\n    url.searchParams.set(\"client_secret\", clientSecret);\n    url.searchParams.set(\"redirect_uri\", updatedRedirectUrl.toString());\n    url.searchParams.set(\"scope\", \"legacy\");\n    url.searchParams.set(\"state\", options.state);\n    url.searchParams.set(\"grant_type\", \"authorization_code\");\n    url.searchParams.set(\"code_challenge\", options.codeChallenge);\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"type\", options.type);\n    url.searchParams.set(\"error_redirect_url\", options.errorRedirectUrl);\n\n    // TODO: This token will expire after 45s if the token lifetime is 60s, which may be shorter than the OAuth flow.\n    // We should probably find a way to request a longer-lived token here.\n    const tokens = await options.session.getOrFetchLikelyValidTokens(45_000, 60_000);\n    if (tokens) {\n      url.searchParams.set(\"token\", tokens.accessToken.token);\n    }\n\n    if (options.afterCallbackRedirectUrl) {\n      url.searchParams.set(\"after_callback_redirect_url\", options.afterCallbackRedirectUrl);\n    }\n    if (options.providerScope) {\n      url.searchParams.set(\"provider_scope\", options.providerScope);\n    }\n    for (const [key, value] of Object.entries(getBotChallengeRequestFields(options.botChallenge, `OAuth ${options.type}`))) {\n      url.searchParams.set(key, value);\n    }\n\n    return url.toString();\n  }\n\n  async authorizeOAuth(options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    afterCallbackRedirectUrl?: string,\n    codeChallenge: string,\n    state: string,\n    type: \"authenticate\" | \"link\",\n    providerScope?: string,\n    botChallenge?: BotChallengeInput,\n    session: InternalSession,\n  }): Promise<Result<string, KnownErrors[\"BotChallengeRequired\"] | KnownErrors[\"BotChallengeFailed\"]>> {\n    if (typeof window === \"undefined\") {\n      throw new HexclaveAssertionError(\"authorizeOAuth can currently only be called in a browser environment\");\n    }\n\n    await this.options.prepareRequest?.();\n\n    const url = new URL(await this.getOAuthUrl(options));\n    // Hexclave rebrand: dual-emit both query param names. The current backend accepts either, but\n    // a new SDK calling an OLDER backend (during deploy ordering, or a self-hoster on a stale\n    // image) only recognizes `stack_response_mode` — without it the route silently falls back to\n    // redirect mode and the SDK gets HTML where it expected JSON. Emit both to keep that working.\n    url.searchParams.set(\"hexclave_response_mode\", \"json\");\n    url.searchParams.set(\"stack_response_mode\", \"json\");\n\n    let rawRes;\n    try {\n      rawRes = await fetch(url, {\n        method: \"GET\",\n      });\n    } catch (error) {\n      if (error instanceof TypeError) {\n        throw await this._createNetworkError(error, options.session, \"client\");\n      }\n      throw error;\n    }\n\n    const processedResponse = await this._processResponse(rawRes);\n    if (processedResponse.status === \"error\") {\n      if (isBotChallengeKnownError(processedResponse.error)) {\n        return Result.error(processedResponse.error);\n      }\n      throw processedResponse.error;\n    }\n\n    if (processedResponse.data.status !== 200) {\n      throw new HexclaveAssertionError(`OAuth authorize returned an unexpected status: ${processedResponse.data.status}`);\n    }\n\n    const body = await processedResponse.data.json();\n    if (body == null || typeof body !== \"object\" || Array.isArray(body)) {\n      throw new HexclaveAssertionError(\"OAuth authorize response body must be an object\", { body });\n    }\n\n    const location = body.location;\n    if (typeof location !== \"string\") {\n      throw new HexclaveAssertionError(\"OAuth authorize response is missing a redirect location\", { body });\n    }\n\n    return Result.ok(location);\n  }\n\n  async callOAuthCallback(options: {\n    oauthParams: URLSearchParams,\n    redirectUri: string,\n    codeVerifier: string,\n    state: string,\n  }): Promise<{ newUser: boolean, afterCallbackRedirectUrl?: string, accessToken: string, refreshToken: string }> {\n    if (\"projectOwnerSession\" in this.options) {\n      // TODO fix\n      throw new Error(\"Admin session token is currently not supported for OAuth\");\n    }\n\n    const clientSecret = this.options.publishableClientKey ?? publishableClientKeyNotNecessarySentinel;\n    return await this._withFallback(async (apiUrl) => {\n      return await this._callOAuthCallbackInner(options, clientSecret, apiUrl);\n    });\n  }\n\n  private async _callOAuthCallbackInner(options: {\n    oauthParams: URLSearchParams,\n    redirectUri: string,\n    codeVerifier: string,\n    state: string,\n  }, clientSecret: string, apiUrl: string): Promise<{ newUser: boolean, afterCallbackRedirectUrl?: string, accessToken: string, refreshToken: string }> {\n    const tokenEndpoint = apiUrl + '/auth/oauth/token';\n    const as = {\n      issuer: this.options.getBaseUrl(),\n      algorithm: 'oauth2',\n      token_endpoint: tokenEndpoint,\n    };\n    const client: oauth.Client = {\n      client_id: this.projectId,\n      client_secret: clientSecret,\n    };\n    const clientAuthentication = oauth.ClientSecretPost(clientSecret);\n    // Allow insecure HTTP requests only in test environment (for localhost testing)\n    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition\n    const allowInsecure = tokenEndpoint.startsWith('http://');\n\n    let params: URLSearchParams;\n    try {\n      params = oauth.validateAuthResponse(as, client, options.oauthParams, options.state);\n    } catch (e) {\n      if (e instanceof oauth.AuthorizationResponseError) {\n        throw new HexclaveAssertionError(\"Authorization response error when validating outer OAuth response\", {\n          //cause is a URLSearchParams object for this error, so we need to serialize it better\n          cause: Object.fromEntries(e.cause),\n          code: e.code,\n          error: e.error,\n        });\n      }\n      throw new HexclaveAssertionError(\"Unexpected error when validating outer OAuth response\", { cause: e });\n    }\n    const response = await oauth.authorizationCodeGrantRequest(\n      as,\n      client,\n      clientAuthentication,\n      params,\n      options.redirectUri,\n      options.codeVerifier,\n      allowInsecure ? { [oauth.allowInsecureRequests]: true } : undefined,\n    );\n\n    let result;\n    try {\n      result = await oauth.processAuthorizationCodeResponse(as, client, response);\n    } catch (e) {\n      if (e instanceof oauth.ResponseBodyError) {\n        if ((e.cause as any).code === \"MULTI_FACTOR_AUTHENTICATION_REQUIRED\") {\n          throw new KnownErrors.MultiFactorAuthenticationRequired((e.cause as any).details.attempt_code);\n        }\n        // TODO Handle OAuth 2.0 response body error\n        throw new HexclaveAssertionError(\"Outer OAuth error during authorization code response\", {\n          cause: e.cause,\n          code: e.code,\n          error: e.error,\n        });\n      }\n      throw new HexclaveAssertionError(\"Unexpected error when processing authorization code response\", { cause: e });\n    }\n    return {\n      newUser: result.is_new_user as boolean,\n      afterCallbackRedirectUrl: result.after_callback_redirect_url as string | undefined,\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token ?? throwErr(\"Refresh token not found in outer OAuth response\"),\n    };\n  }\n\n  async signOut(session: InternalSession): Promise<void> {\n    const tokenObj = await session.getOrFetchLikelyValidTokens(20_000, null);\n    if (tokenObj) {\n      const resOrError = await this.sendClientRequestAndCatchKnownError(\n        \"/auth/sessions/current\",\n        {\n          method: \"DELETE\",\n          headers: {\n            \"Content-Type\": \"application/json\"\n          },\n          body: JSON.stringify({}),\n        },\n        session,\n        [KnownErrors.RefreshTokenError]\n      );\n      if (resOrError.status === \"error\") {\n        if (KnownErrors.RefreshTokenError.isInstance(resOrError.error)) {\n          // refresh token was already invalid, just continue like nothing happened\n        } else {\n          // this should never happen\n          throw new HexclaveAssertionError(\"Unexpected error\", { cause: resOrError.error });\n        }\n      } else {\n        // user was signed out successfully, all good\n      }\n    }\n    session.markInvalid();\n  }\n\n  async getClientUserByToken(session: InternalSession): Promise<CurrentUserCrud[\"Client\"][\"Read\"] | null> {\n    const responseOrError = await this.sendClientRequestAndCatchKnownError(\n      \"/users/me\",\n      {},\n      session,\n      [KnownErrors.CannotGetOwnUserWithoutUser],\n    );\n    if (responseOrError.status === \"error\") {\n      if (KnownErrors.CannotGetOwnUserWithoutUser.isInstance(responseOrError.error)) {\n        return null;\n      } else {\n        throw new HexclaveAssertionError(\"Unexpected uncaught error\", { cause: responseOrError.error });\n      }\n    }\n    const response = responseOrError.data;\n    const user: CurrentUserCrud[\"Client\"][\"Read\"] = await response.json();\n    if (!(user as any)) throw new HexclaveAssertionError(\"User endpoint returned null; this should never happen\");\n    return user;\n  }\n\n  async listTeamInvitations(\n    options: {\n      teamId: string,\n    },\n    session: InternalSession,\n  ): Promise<TeamInvitationCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\n      \"/team-invitations?\" + new URLSearchParams({ team_id: options.teamId }),\n      {},\n      session,\n    );\n    const result = await response.json() as TeamInvitationCrud['Client']['List'];\n    return result.items;\n  }\n\n  async listCurrentUserTeamInvitations(\n    session: InternalSession,\n  ): Promise<TeamInvitationCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\n      \"/team-invitations?\" + new URLSearchParams({ user_id: 'me' }),\n      {},\n      session,\n    );\n    const result = await response.json() as TeamInvitationCrud['Client']['List'];\n    return result.items;\n  }\n\n  async acceptTeamInvitationById(\n    invitationId: string,\n    session: InternalSession,\n  ) {\n    await this.sendClientRequest(\n      urlString`/team-invitations/${invitationId}/accept` + \"?\" + new URLSearchParams({ user_id: 'me' }),\n      { method: \"POST\" },\n      session,\n    );\n  }\n\n  async revokeTeamInvitation(\n    invitationId: string,\n    teamId: string,\n    session: InternalSession,\n  ) {\n    await this.sendClientRequest(\n      `/team-invitations/${invitationId}?team_id=${teamId}`,\n      { method: \"DELETE\" },\n      session,\n    );\n  }\n\n  async listTeamMemberProfiles(\n    options: {\n      teamId?: string,\n      userId?: string,\n    },\n    session: InternalSession,\n  ): Promise<TeamMemberProfilesCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\n      \"/team-member-profiles?\" + new URLSearchParams(filterUndefined({\n        team_id: options.teamId,\n        user_id: options.userId,\n      })),\n      {},\n      session,\n    );\n    const result = await response.json() as TeamMemberProfilesCrud['Client']['List'];\n    return result.items;\n  }\n\n  async getTeamMemberProfile(\n    options: {\n      teamId: string,\n      userId: string,\n    },\n    session: InternalSession,\n  ): Promise<TeamMemberProfilesCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      `/team-member-profiles/${options.teamId}/${options.userId}`,\n      {},\n      session,\n    );\n    return await response.json();\n  }\n\n  async leaveTeam(\n    teamId: string,\n    session: InternalSession,\n  ) {\n    await this.sendClientRequest(\n      `/team-memberships/${teamId}/me`,\n      {\n        method: \"DELETE\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({}),\n      },\n      session,\n    );\n  }\n\n  async updateTeamMemberProfile(\n    options: {\n      teamId: string,\n      userId: string,\n      profile: TeamMemberProfilesCrud['Client']['Update'],\n    },\n    session: InternalSession,\n  ) {\n    await this.sendClientRequest(\n      `/team-member-profiles/${options.teamId}/${options.userId}`,\n      {\n        method: \"PATCH\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(options.profile),\n      },\n      session,\n    );\n  }\n\n  async updateTeam(\n    options: {\n      teamId: string,\n      data: TeamsCrud['Client']['Update'],\n    },\n    session: InternalSession,\n  ) {\n    await this.sendClientRequest(\n      `/teams/${options.teamId}`,\n      {\n        method: \"PATCH\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(options.data),\n      },\n      session,\n    );\n  }\n\n  async listCurrentUserTeamPermissions(\n    options: {\n      teamId: string,\n      recursive: boolean,\n    },\n    session: InternalSession\n  ): Promise<TeamPermissionsCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\n      `/team-permissions?team_id=${options.teamId}&user_id=me&recursive=${options.recursive}`,\n      {},\n      session,\n    );\n    const result = await response.json() as TeamPermissionsCrud['Client']['List'];\n    return result.items;\n  }\n\n  async listCurrentUserProjectPermissions(\n    options: {\n      recursive: boolean,\n    },\n    session: InternalSession\n  ): Promise<ProjectPermissionsCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\n      `/project-permissions?user_id=me&recursive=${options.recursive}`,\n      {},\n      session,\n    );\n    const result = await response.json() as ProjectPermissionsCrud['Client']['List'];\n    return result.items;\n  }\n\n  async listCurrentUserTeams(session: InternalSession): Promise<TeamsCrud[\"Client\"][\"Read\"][]> {\n    const response = await this.sendClientRequest(\n      \"/teams?user_id=me\",\n      {},\n      session,\n    );\n    const result = await response.json() as TeamsCrud[\"Client\"][\"List\"];\n    return result.items;\n  }\n\n  async getClientProject(): Promise<Result<ClientProjectsCrud['Client']['Read'], KnownErrors[\"ProjectNotFound\"]>> {\n    const responseOrError = await this.sendClientRequestAndCatchKnownError(\"/projects/current\", {}, null, [KnownErrors.ProjectNotFound]);\n    if (responseOrError.status === \"error\") {\n      return Result.error(responseOrError.error);\n    }\n    const response = responseOrError.data;\n    const project: ClientProjectsCrud['Client']['Read'] = await response.json();\n    return Result.ok(project);\n  }\n\n  async updateClientUser(update: CurrentUserCrud[\"Client\"][\"Update\"], session: InternalSession) {\n    await this.sendClientRequest(\n      \"/users/me\",\n      {\n        method: \"PATCH\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(update),\n      },\n      session,\n    );\n  }\n\n  async listProjects(session: InternalSession): Promise<AdminUserProjectsCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\"/internal/projects\", {}, session);\n    if (!response.ok) {\n      throw new Error(\"Failed to list projects: \" + response.status + \" \" + (await response.text()));\n    }\n\n    const json = await response.json() as AdminUserProjectsCrud['Client']['List'];\n    return json.items;\n  }\n\n  async createProject(\n    project: AdminUserProjectsCrud['Client']['Create'],\n    session: InternalSession,\n  ): Promise<AdminUserProjectsCrud['Client']['Read']> {\n    const fetchResponse = await this.sendClientRequest(\n      \"/internal/projects\",\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(project),\n      },\n      session,\n    );\n    if (!fetchResponse.ok) {\n      throw new Error(\"Failed to create project: \" + fetchResponse.status + \" \" + (await fetchResponse.text()));\n    }\n\n    const json = await fetchResponse.json();\n    return json;\n  }\n\n  async createProviderAccessToken(\n    provider: string,\n    scope: string,\n    session: InternalSession,\n  ): Promise<ConnectedAccountAccessTokenCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      `/connected-accounts/me/${provider}/access-token`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({ scope }),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  /**\n   * Get access token for a specific connected account by provider ID and provider account ID.\n   * This is the preferred method when dealing with multiple accounts of the same provider.\n   */\n  async createProviderAccessTokenByAccount(\n    providerId: string,\n    providerAccountId: string,\n    scope: string,\n    session: InternalSession,\n  ): Promise<ConnectedAccountAccessTokenCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      `/connected-accounts/me/${encodeURIComponent(providerId)}/${encodeURIComponent(providerAccountId)}/access-token`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({ scope }),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  /**\n   * List all connected accounts for the current user.\n   */\n  async listConnectedAccounts(\n    session: InternalSession,\n  ): Promise<ConnectedAccountCrud['Client']['List']> {\n    const response = await this.sendClientRequest(\n      `/connected-accounts/me`,\n      { method: \"GET\" },\n      session,\n    );\n    return await response.json();\n  }\n\n  async createClientTeam(\n    data: TeamsCrud['Client']['Create'],\n    session: InternalSession,\n  ): Promise<TeamsCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      \"/teams\",\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(data),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async deleteTeam(\n    teamId: string,\n    session: InternalSession,\n  ) {\n    await this.sendClientRequest(\n      `/teams/${teamId}`,\n      {\n        method: \"DELETE\",\n      },\n      session,\n    );\n  }\n\n  async deleteCurrentUser(session: InternalSession) {\n    await this.sendClientRequest(\n      \"/users/me\",\n      {\n        method: \"DELETE\",\n      },\n      session,\n    );\n  }\n\n  async createClientContactChannel(\n    data: ContactChannelsCrud['Client']['Create'],\n    session: InternalSession,\n  ): Promise<ContactChannelsCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      \"/contact-channels\",\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(data),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async updateClientContactChannel(\n    id: string,\n    data: ContactChannelsCrud['Client']['Update'],\n    session: InternalSession,\n  ): Promise<ContactChannelsCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      `/contact-channels/me/${id}`,\n      {\n        method: \"PATCH\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(data),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async deleteClientContactChannel(\n    id: string,\n    session: InternalSession,\n  ): Promise<void> {\n    await this.sendClientRequest(\n      `/contact-channels/me/${id}`,\n      {\n        method: \"DELETE\",\n      },\n      session,\n    );\n  }\n\n  async deleteSession(\n    sessionId: string,\n    session: InternalSession,\n  ): Promise<void> {\n    await this.sendClientRequest(\n      `/auth/sessions/${sessionId}?user_id=me`,\n      {\n        method: \"DELETE\",\n      },\n      session,\n    );\n  }\n\n  async listSessions(\n    session: InternalSession,\n  ): Promise<SessionsCrud['Client']['List']> {\n    const response = await this.sendClientRequest(\n      \"/auth/sessions?user_id=me\",\n      {\n        method: \"GET\",\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n\n  async listClientContactChannels(\n    session: InternalSession,\n  ): Promise<ContactChannelsCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\n      \"/contact-channels?user_id=me\",\n      {\n        method: \"GET\",\n      },\n      session,\n    );\n    const json = await response.json() as ContactChannelsCrud['Client']['List'];\n    return json.items;\n  }\n\n  async sendCurrentUserContactChannelVerificationEmail(\n    contactChannelId: string,\n    callbackUrl: string,\n    session: InternalSession,\n  ): Promise<Result<undefined, KnownErrors[\"EmailAlreadyVerified\"]>> {\n    const responseOrError = await this.sendClientRequestAndCatchKnownError(\n      `/contact-channels/me/${contactChannelId}/send-verification-code`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({ callback_url: callbackUrl }),\n      },\n      session,\n      [KnownErrors.EmailAlreadyVerified]\n    );\n\n    if (responseOrError.status === \"error\") {\n      return Result.error(responseOrError.error);\n    }\n    return Result.ok(undefined);\n  }\n\n  async cliLogin(\n    loginCode: string,\n    refreshToken: string,\n    session: InternalSession\n  ): Promise<Result<undefined, KnownErrors[\"SchemaError\"]>> {\n    const responseOrError = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/cli/complete\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          login_code: loginCode,\n          refresh_token: refreshToken,\n        }),\n      },\n      session,\n      [KnownErrors.SchemaError]\n    );\n\n    if (responseOrError.status === \"error\") {\n      return Result.error(responseOrError.error);\n    }\n    return Result.ok(undefined);\n  }\n\n  private async _getApiKeyRequestInfo(options: { user_id: string | null } | { team_id: string }) {\n    if (\"user_id\" in options && \"team_id\" in options) {\n      throw new HexclaveAssertionError(\"Cannot specify both user_id and team_id in _getApiKeyRequestInfo\");\n    }\n\n    return {\n      endpoint: \"team_id\" in options ? \"/team-api-keys\" : \"/user-api-keys\",\n      queryParams: new URLSearchParams(filterUndefinedOrNull(options)),\n    };\n  }\n\n  // API Keys CRUD operations\n  listProjectApiKeys(options: { user_id: string }, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read'][]>;\n  listProjectApiKeys(options: { team_id: string }, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<TeamApiKeysCrud['Client']['Read'][]>;\n  listProjectApiKeys(options: { user_id: string } | { team_id: string }, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<(UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read'])[]>;\n  async listProjectApiKeys(\n    options: { user_id: string } | { team_id: string },\n    session: InternalSession | null,\n    requestType: \"client\" | \"server\" | \"admin\",\n  ): Promise<(UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read'])[]> {\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequest : (this as any).sendServerRequest as never).bind(this);\n    const { endpoint, queryParams } = await this._getApiKeyRequestInfo(options);\n\n    const response = await sendRequest(\n      `${endpoint}?${queryParams.toString()}`,\n      {\n        method: \"GET\",\n      },\n      session,\n      requestType,\n    );\n    const json = await response.json();\n    return json.items;\n  }\n\n  createProjectApiKey(data: yup.InferType<typeof userApiKeysCreateInputSchema>, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<yup.InferType<typeof userApiKeysCreateOutputSchema>>;\n  createProjectApiKey(data: yup.InferType<typeof teamApiKeysCreateInputSchema>, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<yup.InferType<typeof teamApiKeysCreateOutputSchema>>;\n  createProjectApiKey(data: yup.InferType<typeof userApiKeysCreateInputSchema> | yup.InferType<typeof teamApiKeysCreateInputSchema>, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<yup.InferType<typeof userApiKeysCreateOutputSchema> | yup.InferType<typeof teamApiKeysCreateOutputSchema>>;\n  async createProjectApiKey(\n    data: yup.InferType<typeof userApiKeysCreateInputSchema> | yup.InferType<typeof teamApiKeysCreateInputSchema>,\n    session: InternalSession | null,\n    requestType: \"client\" | \"server\" | \"admin\",\n  ): Promise<yup.InferType<typeof userApiKeysCreateOutputSchema> | yup.InferType<typeof teamApiKeysCreateOutputSchema>> {\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequest : (this as any).sendServerRequest as never).bind(this);\n    const { endpoint } = await this._getApiKeyRequestInfo(data);\n\n    const response = await sendRequest(\n      `${endpoint}`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(data),\n      },\n      session,\n      requestType,\n    );\n    return await response.json();\n  }\n\n  getProjectApiKey(options: { user_id: string | null }, keyId: string, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read']>;\n  getProjectApiKey(options: { team_id: string }, keyId: string, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<TeamApiKeysCrud['Client']['Read']>;\n  getProjectApiKey(options: { user_id: string | null } | { team_id: string }, keyId: string, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read']>;\n  async getProjectApiKey(\n    options: { user_id: string | null } | { team_id: string },\n    keyId: string,\n    session: InternalSession | null,\n    requestType: \"client\" | \"server\" | \"admin\",\n  ): Promise<UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read']> {\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequest : (this as any).sendServerRequest as never).bind(this);\n    const { endpoint, queryParams } = await this._getApiKeyRequestInfo(options);\n\n    const response = await sendRequest(\n      `${endpoint}/${keyId}?${queryParams.toString()}`,\n      {\n        method: \"GET\",\n      },\n      session,\n      requestType,\n    );\n    return await response.json();\n  }\n\n  updateProjectApiKey(options: { user_id: string }, keyId: string, data: UserApiKeysCrud['Client']['Update'], session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read']>;\n  updateProjectApiKey(options: { team_id: string }, keyId: string, data: TeamApiKeysCrud['Client']['Update'], session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<TeamApiKeysCrud['Client']['Read']>;\n  updateProjectApiKey(options: { user_id: string } | { team_id: string }, keyId: string, data: UserApiKeysCrud['Client']['Update'] | TeamApiKeysCrud['Client']['Update'], session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read']>;\n  async updateProjectApiKey(\n    options: { user_id: string } | { team_id: string },\n    keyId: string,\n    data: UserApiKeysCrud['Client']['Update'] | TeamApiKeysCrud['Client']['Update'],\n    session: InternalSession | null,\n    requestType: \"client\" | \"server\" | \"admin\",\n  ): Promise<UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read']> {\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequest : (this as any).sendServerRequest as never).bind(this);\n    const { endpoint, queryParams } = await this._getApiKeyRequestInfo(options);\n\n    const response = await sendRequest(\n      `${endpoint}/${keyId}?${queryParams.toString()}`,\n      {\n        method: \"PATCH\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(data),\n      },\n      session,\n      requestType,\n    );\n    return await response.json();\n  }\n\n  checkProjectApiKey(type: \"user\", apiKey: string, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read'] | null>;\n  checkProjectApiKey(type: \"team\", apiKey: string, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<TeamApiKeysCrud['Client']['Read'] | null>;\n  checkProjectApiKey(type: \"user\" | \"team\", apiKey: string, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read'] | null>;\n  async checkProjectApiKey(type: \"user\" | \"team\", apiKey: string, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read'] | null> {\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequestAndCatchKnownError : (this as any).sendServerRequestAndCatchKnownError as never).bind(this);\n    const result = await sendRequest(\n      `/${type}-api-keys/check`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({ api_key: apiKey }),\n      },\n      session,\n      [KnownErrors.ApiKeyNotValid]\n    );\n    if (result.status === \"error\") {\n      return null;\n    }\n    return await result.data.json();\n  }\n\n  async listNotificationCategories(\n    session: InternalSession,\n  ): Promise<NotificationPreferenceCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\n      `/emails/notification-preference/me`,\n      {},\n      session,\n    );\n    const result = await response.json() as NotificationPreferenceCrud['Client']['List'];\n    return result.items;\n  }\n\n  async setNotificationsEnabled(\n    notificationCategoryId: string,\n    enabled: boolean,\n    session: InternalSession,\n  ): Promise<void> {\n    await this.sendClientRequest(\n      `/emails/notification-preference/me/${notificationCategoryId}`,\n      {\n        method: \"PATCH\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({\n          enabled,\n        }),\n      },\n      session,\n    );\n  }\n\n  async getOAuthProvider(\n    userId: string,\n    providerId: string,\n    session: InternalSession,\n  ): Promise<OAuthProviderCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      `/oauth-providers/${userId}/${providerId}`,\n      {\n        method: \"GET\",\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async updateOAuthProvider(\n    userId: string,\n    providerId: string,\n    data: OAuthProviderCrud['Client']['Update'],\n    session: InternalSession,\n  ): Promise<OAuthProviderCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      `/oauth-providers/${userId}/${providerId}`,\n      {\n        method: \"PATCH\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(data),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async listOAuthProviders(\n    options: {\n      user_id?: string,\n    } = {},\n    session: InternalSession,\n  ): Promise<OAuthProviderCrud['Client']['Read'][]> {\n    const queryParams = new URLSearchParams(filterUndefined(options));\n    const response = await this.sendClientRequest(\n      `/oauth-providers${queryParams.toString() ? `?${queryParams.toString()}` : ''}`,\n      {\n        method: \"GET\",\n      },\n      session,\n    );\n    const result = await response.json();\n    return result.items;\n  }\n\n  async deleteOAuthProvider(\n    userId: string,\n    providerId: string,\n    session: InternalSession,\n  ): Promise<void> {\n    const response = await this.sendClientRequest(\n      `/oauth-providers/${userId}/${providerId}`,\n      {\n        method: \"DELETE\",\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async getItem(\n    options: (\n      { itemId: string, userId: string } |\n      { itemId: string, teamId: string } |\n      { itemId: string, customCustomerId: string }\n    ),\n    session: InternalSession | null,\n    requestType: \"client\" | \"server\" | \"admin\" = \"client\",\n  ): Promise<ItemCrud['Client']['Read']> {\n    let customerType: \"user\" | \"team\" | \"custom\";\n    let customerId: string;\n    if (\"userId\" in options) {\n      customerType = \"user\";\n      customerId = options.userId;\n    } else if (\"teamId\" in options) {\n      customerType = \"team\";\n      customerId = options.teamId;\n    } else if (\"customCustomerId\" in options) {\n      customerType = \"custom\";\n      customerId = options.customCustomerId;\n    } else {\n      throw new HexclaveAssertionError(\"getItem requires one of userId, teamId, or customCustomerId\");\n    }\n\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequest : (this as any).sendServerRequest as never).bind(this);\n    const response = await sendRequest(\n      urlString`/payments/items/${customerType}/${customerId}/${options.itemId}`,\n      {},\n      session,\n      requestType,\n    );\n    return await response.json();\n  }\n\n  async listProducts(\n    options: ListCustomerProductsOptions,\n    session: InternalSession | null,\n    requestType: \"client\" | \"server\" | \"admin\" = \"client\",\n  ): Promise<CustomerProductsListResponse> {\n    const queryParams = new URLSearchParams(filterUndefined({\n      cursor: options.cursor,\n      limit: options.limit !== undefined ? options.limit.toString() : undefined,\n    }));\n    const path = urlString`/payments/products/${options.customer_type}/${options.customer_id}`;\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequest : (this as any).sendServerRequest as never).bind(this);\n    const response = await sendRequest(\n      `${path}${queryParams.toString() ? `?${queryParams.toString()}` : ''}`,\n      {},\n      session,\n      requestType,\n    );\n    return await response.json();\n  }\n\n  async listInvoices(\n    options: ListCustomerInvoicesOptions,\n    session: InternalSession | null,\n  ): Promise<CustomerInvoicesListResponse> {\n    const queryParams = new URLSearchParams(filterUndefined({\n      cursor: options.cursor,\n      limit: options.limit !== undefined ? options.limit.toString() : undefined,\n    }));\n    const path = urlString`/payments/invoices/${options.customer_type}/${options.customer_id}`;\n    const response = await this.sendClientRequest(\n      `${path}${queryParams.toString() ? `?${queryParams.toString()}` : ''}`,\n      {},\n      session,\n    );\n    return await response.json();\n  }\n\n  async cancelSubscription(\n    options: {\n      customer_type: \"user\" | \"team\" | \"custom\",\n      customer_id: string,\n      product_id: string,\n      subscription_id?: string,\n    },\n    session: InternalSession | null,\n  ): Promise<void> {\n    const queryParams = new URLSearchParams(filterUndefined({\n      subscription_id: options.subscription_id,\n    }));\n    const path = urlString`/payments/products/${options.customer_type}/${options.customer_id}/${options.product_id}`;\n    await this.sendClientRequest(\n      `${path}${queryParams.toString() ? `?${queryParams.toString()}` : ''}`,\n      {\n        method: \"DELETE\",\n      },\n      session,\n    );\n  }\n\n  async switchSubscription(\n    options: {\n      customer_type: \"user\" | \"team\",\n      customer_id: string,\n      from_product_id: string,\n      to_product_id: string,\n      price_id?: string,\n      quantity?: number,\n    },\n    session: InternalSession | null,\n  ): Promise<void> {\n    await this.sendClientRequest(\n      urlString`/payments/products/${options.customer_type}/${options.customer_id}/switch`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({\n          from_product_id: options.from_product_id,\n          to_product_id: options.to_product_id,\n          price_id: options.price_id,\n          quantity: options.quantity,\n        }),\n      },\n      session,\n    );\n  }\n\n  async createCheckoutUrl(\n    customer_type: \"user\" | \"team\" | \"custom\",\n    customer_id: string,\n    productIdOrInline: string | yup.InferType<typeof inlineProductSchema>,\n    session: InternalSession | null,\n    returnUrl?: string,\n    requestType: \"client\" | \"server\" | \"admin\" = \"client\",\n  ): Promise<string> {\n    const productBody = typeof productIdOrInline === \"string\" ?\n      { product_id: productIdOrInline } :\n      { product_inline: productIdOrInline };\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequest : (this as any).sendServerRequest as never).bind(this);\n    const response = await sendRequest(\n      \"/payments/purchases/create-purchase-url\",\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({ customer_type, customer_id, ...productBody, return_url: returnUrl }),\n      },\n      session,\n      requestType,\n    );\n    const { url } = await response.json() as { url: string };\n    return url;\n  }\n\n  async getCustomerBilling(\n    customerType: \"user\" | \"team\",\n    customerId: string,\n    session: InternalSession | null,\n  ): Promise<{\n    has_customer: boolean,\n    default_payment_method: {\n      id: string,\n      brand: string | null,\n      last4: string | null,\n      exp_month: number | null,\n      exp_year: number | null,\n    } | null,\n  }> {\n    const response = await this.sendClientRequest(\n      urlString`/payments/billing/${customerType}/${customerId}`,\n      {},\n      session,\n    );\n    return await response.json();\n  }\n\n  async createCustomerPaymentMethodSetupIntent(\n    customerType: \"user\" | \"team\",\n    customerId: string,\n    session: InternalSession | null,\n  ): Promise<{\n    client_secret: string,\n    stripe_account_id: string,\n  }> {\n    const response = await this.sendClientRequest(\n      urlString`/payments/payment-method/${customerType}/${customerId}/setup-intent`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({}),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async setDefaultCustomerPaymentMethodFromSetupIntent(\n    customerType: \"user\" | \"team\",\n    customerId: string,\n    setupIntentId: string,\n    session: InternalSession | null,\n  ): Promise<{\n    default_payment_method: {\n      id: string,\n      brand: string | null,\n      last4: string | null,\n      exp_month: number | null,\n      exp_year: number | null,\n    },\n  }> {\n    const response = await this.sendClientRequest(\n      urlString`/payments/payment-method/${customerType}/${customerId}/set-default`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({\n          setup_intent_id: setupIntentId,\n        }),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async transferProject(internalProjectSession: InternalSession, projectIdToTransfer: string, newTeamId: string): Promise<void> {\n    if (this.options.projectId !== \"internal\") {\n      throw new HexclaveAssertionError(\"HexclaveClientInterface.transferProject() is only available for internal projects (please specify the project ID in the constructor)\");\n    }\n    await this.sendClientRequest(\n      \"/internal/projects/transfer\",\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({\n          project_id: projectIdToTransfer,\n          new_team_id: newTeamId,\n        }),\n      },\n      internalProjectSession,\n    );\n  }\n}\n"],"x_google_ignoreList":[0],"mappings":";;;;;;;;;;;;;;;;AAAA,IAAI;AACJ,IAAI,OAAO,cAAc,eAAe,CAAC,UAAU,WAAW,aAAa,eAAe,CAGtF,cAAa;AAEjB,SAAS,gBAAgB,OAAO,UAAU;AACtC,KAAI,SAAS,KACT,QAAO;AAEX,KAAI;AACA,SAAQ,iBAAiB,YACrB,OAAO,eAAe,MAAM,CAAC,OAAO,iBAAiB,SAAS,UAAU,OAAO;SAEjF;AACF,SAAO;;;AAGf,MAAM,wBAAwB;AAC9B,MAAM,uBAAuB;AAC7B,SAAS,eAAe,SAAS,MAAM,OAAO;CAC1C,MAAM,MAAM,IAAI,UAAU,SAAS,EAAE,OAAO,CAAC;AAC7C,QAAO,OAAO,KAAK,EAAE,MAAM,CAAC;AAC5B,QAAO;;AAEX,MAAa,wBAAwB,QAAQ;AAC7C,MAAa,YAAY,QAAQ;AACjC,MAAa,iBAAiB,QAAQ;AACtC,MAAa,cAAc,QAAQ;AAEnC,MAAa,aAAa,QAAQ;AAElC,MAAM,UAAU,IAAI,aAAa;AACjC,MAAM,UAAU,IAAI,aAAa;AACjC,SAAS,IAAI,OAAO;AAChB,KAAI,OAAO,UAAU,SACjB,QAAO,QAAQ,OAAO,MAAM;AAEhC,QAAO,QAAQ,OAAO,MAAM;;AAEhC,IAAI;AACJ,IAAI,WAAW,UAAU,SACrB,oBAAmB,UAAU;AACzB,KAAI,iBAAiB,YACjB,SAAQ,IAAI,WAAW,MAAM;AAEjC,QAAO,MAAM,SAAS;EAAE,UAAU;EAAa,aAAa;EAAM,CAAC;;KAGtE;CACD,MAAM,aAAa;AACnB,oBAAmB,UAAU;AACzB,MAAI,iBAAiB,YACjB,SAAQ,IAAI,WAAW,MAAM;EAEjC,MAAM,MAAM,EAAE;AACd,OAAK,IAAI,IAAI,GAAG,IAAI,MAAM,YAAY,KAAK,WACvC,KAAI,KAAK,OAAO,aAAa,MAAM,MAAM,MAAM,SAAS,GAAG,IAAI,WAAW,CAAC,CAAC;AAEhF,SAAO,KAAK,IAAI,KAAK,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,OAAO,IAAI;;;AAG3F,IAAI;AACJ,IAAI,WAAW,WACX,oBAAmB,UAAU;AACzB,KAAI;AACA,SAAO,WAAW,WAAW,OAAO,EAAE,UAAU,aAAa,CAAC;UAE3D,OAAO;AACV,QAAM,eAAe,qDAAqD,uBAAuB,MAAM;;;IAK/G,oBAAmB,UAAU;AACzB,KAAI;EACA,MAAM,SAAS,KAAK,MAAM,QAAQ,MAAM,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,QAAQ,OAAO,GAAG,CAAC;EACnF,MAAM,QAAQ,IAAI,WAAW,OAAO,OAAO;AAC3C,OAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,IAC/B,OAAM,KAAK,OAAO,WAAW,EAAE;AAEnC,SAAO;UAEJ,OAAO;AACV,QAAM,eAAe,qDAAqD,uBAAuB,MAAM;;;AAInH,SAAS,KAAK,OAAO;AACjB,KAAI,OAAO,UAAU,SACjB,QAAO,gBAAgB,MAAM;AAEjC,QAAO,gBAAgB,MAAM;;AAEjC,IAAa,4BAAb,cAA+C,MAAM;CACjD;CACA,YAAY,SAAS,SAAS;AAC1B,QAAM,SAAS,QAAQ;AACvB,OAAK,OAAO,KAAK,YAAY;AAC7B,OAAK,OAAO;AACZ,QAAM,oBAAoB,MAAM,KAAK,YAAY;;;AAGzD,IAAa,2BAAb,cAA8C,MAAM;CAChD;CACA,YAAY,SAAS,SAAS;AAC1B,QAAM,SAAS,QAAQ;AACvB,OAAK,OAAO,KAAK,YAAY;AAC7B,MAAI,SAAS,KACT,MAAK,OAAO,SAAS;AAEzB,QAAM,oBAAoB,MAAM,KAAK,YAAY;;;AAGzD,SAAS,IAAI,SAAS,MAAM,OAAO;AAC/B,QAAO,IAAI,yBAAyB,SAAS;EAAE;EAAM;EAAO,CAAC;;AA2DjE,SAAS,aAAa,OAAO;AACzB,KAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,MAAM,CACnE,QAAO;AAEX,QAAO;;AAEX,SAAS,eAAe,OAAO;AAC3B,KAAI,gBAAgB,OAAO,QAAQ,CAC/B,SAAQ,OAAO,YAAY,MAAM,SAAS,CAAC;CAE/C,MAAM,UAAU,IAAI,QAAQ,SAAS,EAAE,CAAC;AACxC,KAAI,cAAc,CAAC,QAAQ,IAAI,aAAa,CACxC,SAAQ,IAAI,cAAc,WAAW;AAEzC,KAAI,QAAQ,IAAI,gBAAgB,CAC5B,OAAM,eAAe,0EAAsE,sBAAsB;AAErH,QAAO;;AAEX,SAAS,OAAO,KAAK,OAAO;AACxB,KAAI,UAAU,QAAW;AACrB,MAAI,OAAO,UAAU,WACjB,SAAQ,MAAM,IAAI,KAAK;AAE3B,MAAI,EAAE,iBAAiB,aACnB,OAAM,eAAe,mEAAiE,qBAAqB;AAE/G,SAAO;;;AAuDf,SAAS,aAAa,OAAO,QAAQ,IAAI,MAAM,OAAO;AAClD,KAAI;AACA,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,MAAM,CACpD,OAAM,eAAe,GAAG,GAAG,oBAAoB,sBAAsB,MAAM;AAE/E,MAAI,QAAQ,EACR;AACJ,MAAI,QAAQ;AACR,OAAI,UAAU,EACV,OAAM,eAAe,GAAG,GAAG,iCAAiC,uBAAuB,MAAM;AAE7F;;AAEJ,QAAM,eAAe,GAAG,GAAG,6BAA6B,uBAAuB,MAAM;UAElF,KAAK;AACR,MAAI,KACA,OAAM,IAAI,IAAI,SAAS,MAAM,MAAM;AAEvC,QAAM;;;AAGd,SAAS,aAAa,OAAO,IAAI,MAAM,OAAO;AAC1C,KAAI;AACA,MAAI,OAAO,UAAU,SACjB,OAAM,eAAe,GAAG,GAAG,oBAAoB,sBAAsB,MAAM;AAE/E,MAAI,MAAM,WAAW,EACjB,OAAM,eAAe,GAAG,GAAG,qBAAqB,uBAAuB,MAAM;UAG9E,KAAK;AACR,MAAI,KACA,OAAM,IAAI,IAAI,SAAS,MAAM,MAAM;AAEvC,QAAM;;;AAsBd,SAAS,sBAAsB,UAAU;AACrC,mBAAkB,UAAU,mBAAmB;;AAEnD,SAAS,QAAQ,UAAU,GAAG,OAAO;CACjC,IAAI,MAAM;AACV,KAAI,MAAM,SAAS,GAAG;EAClB,MAAM,OAAO,MAAM,KAAK;AACxB,SAAO,GAAG,MAAM,KAAK,KAAK,CAAC,OAAO;YAE7B,MAAM,WAAW,EACtB,QAAO,GAAG,MAAM,GAAG,MAAM,MAAM;KAG/B,QAAO,MAAM;AAEjB,QAAO,IAAI,KAAK,sBAAsB,SAAS;;AAOnD,SAAS,kBAAkB,UAAU,aAAa;AAC9C,KAAI,eAAe,SAAS,KAAK,YAC7B,OAAM,QAAQ,UAAU,YAAY;;AA6F5C,SAAS,aAAa,QAAQ;CAC1B,MAAM,OAAO,SAAS;AACtB,QAAO,OAAO,SAAS,YAAY,OAAO,SAAS,KAAK,GAAG,OAAO;;AAEtE,SAAS,kBAAkB,QAAQ;CAC/B,MAAM,YAAY,SAAS;AAC3B,QAAO,OAAO,cAAc,YAAY,OAAO,SAAS,UAAU,IAAI,KAAK,KAAK,UAAU,KAAK,KACzF,YACA;;AAEV,SAAS,YAAY;AACjB,QAAO,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;;AAExC,SAAS,SAAS,IAAI;AAClB,KAAI,OAAO,OAAO,YAAY,OAAO,KACjC,OAAM,eAAe,4BAA0B,qBAAqB;AAExE,cAAa,GAAG,QAAQ,gBAAc;;AAE1C,SAAS,aAAa,QAAQ;AAC1B,KAAI,OAAO,WAAW,YAAY,WAAW,KACzC,OAAM,eAAe,gCAA8B,qBAAqB;AAE5E,cAAa,OAAO,WAAW,uBAAqB;;AAsBxD,SAAgB,iBAAiB,cAAc;AAC3C,cAAa,cAAc,mBAAiB;AAC5C,SAAQ,KAAK,QAAQ,MAAM,aAAa;AACpC,OAAK,IAAI,aAAa,OAAO,UAAU;AACvC,OAAK,IAAI,iBAAiB,aAAa;;;AAmJ/C,MAAM,WAAW,IAAI,SAEZ,KAAK,SAAS,IAAI,MAAM,KAAK,KAAK,IACpC,KAAK,SAAS;AACb,KAAI;AACA,SAAO,IAAI,IAAI,KAAK,KAAK;SAEvB;AACF,SAAO;;;AAGnB,SAAgB,cAAc,KAAK,cAAc;AAC7C,KAAI,gBAAgB,IAAI,aAAa,SACjC,OAAM,IAAI,sCAAsC,wBAAwB,IAAI;AAEhF,KAAI,IAAI,aAAa,YAAY,IAAI,aAAa,QAC9C,OAAM,IAAI,4CAA4C,4BAA4B,IAAI;;AAG9F,SAAS,iBAAiB,OAAO,UAAU,cAAc,cAAc;CACnE,IAAI;AACJ,KAAI,OAAO,UAAU,YAAY,EAAE,MAAM,SAAS,MAAM,EACpD,OAAM,IAAI,0DAA0D,eAAe,6BAA6B,SAAS,KAAK,OAAO,SAAS,MAAM,UAAU,SAAY,0BAA0B,yBAAyB,EAAE,WAAW,eAAe,yBAAyB,aAAa,UAAU,CAAC;AAE9S,eAAc,KAAK,aAAa;AAChC,QAAO;;AAEX,SAAgB,gBAAgB,IAAI,UAAU,cAAc,cAAc;AACtE,KAAI,gBAAgB,GAAG,yBAAyB,YAAY,GAAG,sBAC3D,QAAO,iBAAiB,GAAG,sBAAsB,WAAW,UAAU,cAAc,aAAa;AAErG,QAAO,iBAAiB,GAAG,WAAW,UAAU,cAAc,aAAa;;AA2G/E,IAAa,oBAAb,cAAuC,MAAM;CACzC;CACA;CACA;CACA;CACA;CACA;CACA,YAAY,SAAS,SAAS;AAC1B,QAAM,SAAS,QAAQ;AACvB,OAAK,OAAO,KAAK,YAAY;AAC7B,OAAK,OAAO;AACZ,OAAK,QAAQ,QAAQ;AACrB,OAAK,QAAQ,QAAQ,MAAM;AAC3B,OAAK,SAAS,QAAQ,SAAS;AAC/B,OAAK,oBAAoB,QAAQ,MAAM;AACvC,SAAO,eAAe,MAAM,YAAY;GAAE,YAAY;GAAO,OAAO,QAAQ;GAAU,CAAC;AACvF,QAAM,oBAAoB,MAAM,KAAK,YAAY;;;AAGzD,IAAa,6BAAb,cAAgD,MAAM;CAClD;CACA;CACA;CACA;CACA,YAAY,SAAS,SAAS;AAC1B,QAAM,SAAS,QAAQ;AACvB,OAAK,OAAO,KAAK,YAAY;AAC7B,OAAK,OAAO;AACZ,OAAK,QAAQ,QAAQ;AACrB,OAAK,QAAQ,QAAQ,MAAM,IAAI,QAAQ;AACvC,OAAK,oBAAoB,QAAQ,MAAM,IAAI,oBAAoB,IAAI;AACnE,QAAM,oBAAoB,MAAM,KAAK,YAAY;;;AAGzD,IAAa,gCAAb,cAAmD,MAAM;CACrD;CACA;CACA;CACA;CACA,YAAY,SAAS,SAAS;AAC1B,QAAM,SAAS,QAAQ;AACvB,OAAK,OAAO,KAAK,YAAY;AAC7B,OAAK,OAAO;AACZ,OAAK,QAAQ,QAAQ;AACrB,OAAK,SAAS,QAAQ,SAAS;AAC/B,OAAK,WAAW,QAAQ;AACxB,SAAO,eAAe,MAAM,YAAY,EAAE,YAAY,OAAO,CAAC;AAC9D,QAAM,oBAAoB,MAAM,KAAK,YAAY;;;AAGzD,MAAM,aAAa;AACnB,MAAM,eAAe;AAErB,MAAM,qBAAqB,MAAM,aAAa;AAC9C,MAAM,eAAe,MAAM,aAAa;AACxC,MAAM,WAAW,IAAI,OAAO,cAAc,aAAa,IAAI;AAC3D,MAAM,gBAAgB,IAAI,OAAO,aAAa,qBAAqB,cAAc;AACjF,MAAM,kBAAkB,IAAI,OAAO,aAAa,eAAe,cAAc;AAC7E,MAAM,iBAAiB,IAAI,OAAO,OAAO,eAAe,oBAAoB;AAC5E,SAAS,+BAA+B,UAAU;AAC9C,KAAI,CAAC,gBAAgB,UAAU,SAAS,CACpC,OAAM,eAAe,gDAA8C,qBAAqB;CAE5F,MAAM,SAAS,SAAS,QAAQ,IAAI,mBAAmB;AACvD,KAAI,WAAW,KACX;CAEJ,MAAM,aAAa,EAAE;CACrB,IAAI,OAAO;AACX,QAAO,MAAM;EACT,IAAI,QAAQ,KAAK,MAAM,SAAS;EAChC,MAAM,SAAS,QAAQ,KAAK,aAAa;AACzC,MAAI,CAAC,OACD;EAEJ,MAAM,cAAc,KAAK,UAAU,MAAM,GAAG,OAAO;AACnD,MAAI,eAAe,CAAC,YAAY,MAAM,SAAS,CAC3C;EAEJ,MAAM,aAAa,YAAY,MAAM,YAAY;EACjD,MAAM,gBAAgB,CAAC,CAAC;AACxB,SAAO,aAAa,WAAW,KAAK;EACpC,MAAM,aAAa,EAAE;EACrB,IAAI;AACJ,MAAI,cACA,QAAO,MAAM;GACT,IAAI;GACJ,IAAI;AACJ,OAAK,QAAQ,KAAK,MAAM,cAAc,EAAG;AAErC,OAAG,KAAK,OAAO,QAAQ;AACvB,QAAI,MAAM,SAAS,KAAK,CACpB,KAAI;AACA,aAAQ,KAAK,MAAM,IAAI,MAAM,GAAG;YAE9B;AAEV,eAAW,IAAI,aAAa,IAAI;AAChC;;AAEJ,OAAK,QAAQ,KAAK,MAAM,gBAAgB,EAAG;AAEvC,OAAG,KAAK,OAAO,QAAQ;AACvB,eAAW,IAAI,aAAa,IAAI;AAChC;;AAEJ,OAAK,QAAQ,KAAK,MAAM,eAAe,EAAG;AACtC,QAAI,OAAO,KAAK,WAAW,CAAC,OACxB;AAGJ,OAAG,SAAS,QAAQ;AACpB;;AAEJ;;MAIJ,QAAO,eAAe;EAE1B,MAAM,YAAY;GAAE;GAAQ;GAAY;AACxC,MAAI,QACA,WAAU,UAAU;AAExB,aAAW,KAAK,UAAU;;AAE9B,KAAI,CAAC,WAAW,OACZ;AAEJ,QAAO;;AAqBX,eAAe,4BAA4B,UAAU;AACjD,KAAI,SAAS,SAAS,OAAO,SAAS,SAAS,KAAK;AAChD,yBAAuB,SAAS;AAChC,wBAAsB,SAAS;AAC/B,MAAI;GACA,MAAM,OAAO,MAAM,SAAS,OAAO,CAAC,MAAM;AAC1C,OAAI,aAAa,KAAK,IAAI,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,OACnE,QAAO;UAGT;;;AAId,eAAe,oBAAoB,UAAU,UAAU,OAAO;AAC1D,KAAI,SAAS,WAAW,UAAU;AAC9B,gCAA8B,SAAS;EACvC,IAAI;AACJ,MAAK,MAAM,MAAM,4BAA4B,SAAS,EAAG;AACrD,SAAM,SAAS,MAAM,QAAQ;AAC7B,SAAM,IAAI,kBAAkB,uDAAuD;IAC/E,OAAO;IACP;IACH,CAAC;;AAEN,QAAM,IAAI,+BAA+B,MAAM,0CAA0C,yBAAyB,SAAS;;;AAGnI,SAAS,WAAW,QAAQ;AACxB,KAAI,CAAC,QAAQ,IAAI,OAAO,CACpB,OAAM,eAAe,8CAA4C,sBAAsB;;AAiK/F,SAAgB,eAAe,OAAO;AAClC,QAAO,MAAM,QAAQ,IAAI,eAAe,EAAE,MAAM,IAAI,CAAC;;AA2CzD,eAAe,qBAAqB,IAAI,QAAQ,sBAAsB,KAAK,MAAM,SAAS,SAAS;AAC/F,OAAM,qBAAqB,IAAI,QAAQ,MAAM,QAAQ;AACrD,SAAQ,IAAI,gBAAgB,kDAAkD;AAC9E,SAAQ,UAAU,gBAAgB,OAAO,IAAI,MAAM;EAC/C;EACA,SAAS,OAAO,YAAY,QAAQ,SAAS,CAAC;EAC9C,QAAQ;EACR,UAAU;EACV,QAAQ,OAAO,KAAK,SAAS,OAAO;EACvC,CAAC;;AAEN,eAAe,qBAAqB,IAAI,QAAQ,sBAAsB,WAAW,YAAY,SAAS;CAClG,MAAM,MAAM,gBAAgB,IAAI,kBAAkB,OAAO,2BAA2B,UAAU,2BAA2B,KAAK;AAC9H,YAAW,IAAI,cAAc,UAAU;CACvC,MAAM,UAAU,eAAe,SAAS,QAAQ;AAChD,SAAQ,IAAI,UAAU,mBAAmB;AACzC,KAAI,SAAS,SAAS,QAAW;AAC7B,aAAW,QAAQ,KAAK;AACxB,QAAM,QAAQ,KAAK,SAAS,KAAK,SAAS,OAAO;;CAErD,MAAM,WAAW,MAAM,qBAAqB,IAAI,QAAQ,sBAAsB,KAAK,YAAY,SAAS,QAAQ;AAChH,UAAS,MAAM,WAAW,UAAU,IAAI;AACxC,QAAO;;AAEX,eAAsB,yBAAyB,IAAI,QAAQ,sBAAsB,cAAc,SAAS;AACpG,UAAS,GAAG;AACZ,cAAa,OAAO;AACpB,cAAa,cAAc,mBAAiB;CAC5C,MAAM,aAAa,IAAI,gBAAgB,SAAS,qBAAqB;AACrE,YAAW,IAAI,iBAAiB,aAAa;AAC7C,QAAO,qBAAqB,IAAI,QAAQ,sBAAsB,iBAAiB,YAAY,QAAQ;;AAEvG,MAAM,gCAAgB,IAAI,SAAS;AACnC,MAAM,0BAAU,IAAI,SAAS;AAC7B,SAAgB,0BAA0B,KAAK;AAC3C,KAAI,CAAC,IAAI,SACL;CAEJ,MAAM,SAAS,cAAc,IAAI,IAAI;AACrC,KAAI,CAAC,OACD,OAAM,eAAe,oFAAkF,sBAAsB;AAEjI,QAAO;;AAgBX,eAAe,kCAAkC,IAAI,QAAQ,UAAU,iCAAiC,WAAW,sBAAsB;AACrI,UAAS,GAAG;AACZ,cAAa,OAAO;AACpB,KAAI,CAAC,gBAAgB,UAAU,SAAS,CACpC,OAAM,eAAe,gDAA8C,qBAAqB;AAE5F,OAAM,oBAAoB,UAAU,KAAK,iBAAiB;AAC1D,wBAAuB,SAAS;CAChC,MAAM,OAAO,MAAM,oBAAoB,SAAS;AAChD,cAAa,KAAK,cAAc,+CAA2C,kBAAkB,EACzF,MAAM,MACT,CAAC;AACF,cAAa,KAAK,YAAY,6CAAyC,kBAAkB,EACrF,MAAM,MACT,CAAC;AACF,MAAK,aAAa,KAAK,WAAW,aAAa;AAC/C,KAAI,KAAK,eAAe,QAAW;EAC/B,IAAI,YAAY,OAAO,KAAK,eAAe,WAAW,WAAW,KAAK,WAAW,GAAG,KAAK;AACzF,eAAa,WAAW,MAAM,6CAAyC,kBAAkB,EACrF,MAAM,MACT,CAAC;AACF,OAAK,aAAa;;AAEtB,KAAI,KAAK,kBAAkB,OACvB,cAAa,KAAK,eAAe,gDAA4C,kBAAkB,EAC3F,MAAM,MACT,CAAC;AAEN,KAAI,KAAK,UAAU,UAAa,OAAO,KAAK,UAAU,SAClD,OAAM,IAAI,yDAAqD,kBAAkB,EAAE,MAAM,MAAM,CAAC;AAEpG,KAAI,KAAK,aAAa,QAAW;AAC7B,eAAa,KAAK,UAAU,2CAAuC,kBAAkB,EACjF,MAAM,MACT,CAAC;EACF,MAAM,iBAAiB;GAAC;GAAO;GAAO;GAAO;GAAO;GAAM;AAC1D,MAAI,OAAO,sBAAsB,KAC7B,gBAAe,KAAK,YAAY;AAEpC,MAAI,OAAO,oBAAoB,QAAW;AACtC,gBAAa,OAAO,iBAAiB,MAAM,6BAA2B;AACtE,kBAAe,KAAK,YAAY;;AAEpC,MAAI,iCAAiC,OACjC,gBAAe,KAAK,GAAG,gCAAgC;EAE3D,MAAM,EAAE,QAAQ,QAAQ,MAAM,YAAY,KAAK,UAAU,sBAAsB,KAAK,QAAW,OAAO,8BAA8B,GAAG,uCAAuC,QAAQ,EAAE,aAAa,OAAO,EAAE,kBAAkB,OAAO,EAAE,UAAU,CAC9O,KAAK,iBAAiB,KAAK,QAAW,eAAe,CAAC,CACtD,KAAK,eAAe,KAAK,QAAW,GAAG,CAAC,CACxC,KAAK,iBAAiB,KAAK,QAAW,OAAO,UAAU,CAAC;AAC7D,MAAI,MAAM,QAAQ,OAAO,IAAI,IAAI,OAAO,IAAI,WAAW,GAAG;AACtD,OAAI,OAAO,QAAQ,OACf,OAAM,IAAI,6EAA2E,sBAAsB;IAAE;IAAQ,OAAO;IAAO,CAAC;AAExI,OAAI,OAAO,QAAQ,OAAO,UACtB,OAAM,IAAI,8DAA4D,sBAAsB;IAAE,UAAU,OAAO;IAAW;IAAQ,OAAO;IAAO,CAAC;;AAGzJ,MAAI,OAAO,cAAc,OACrB,cAAa,OAAO,WAAW,MAAM,gDAA8C,kBAAkB,EAAE,QAAQ,CAAC;AAEpH,UAAQ,IAAI,UAAU,IAAI;AAC1B,gBAAc,IAAI,MAAM,OAAO;;AAEnC,KAAI,uBAAuB,KAAK,gBAAgB,OAC5C,sBAAqB,KAAK,YAAY,UAAU,KAAK;UAEhD,KAAK,eAAe,UAAU,KAAK,eAAe,SACvD,OAAM,IAAI,0BAA0B,kCAAkC,EAAE,OAAO,EAAE,MAAM,MAAM,EAAE,CAAC;AAEpG,QAAO;;AAEX,SAAS,8BAA8B,UAAU;CAC7C,IAAI;AACJ,KAAK,aAAa,+BAA+B,SAAS,CACtD,OAAM,IAAI,8BAA8B,yEAAyE;EAAE,OAAO;EAAY;EAAU,CAAC;;AAGzJ,eAAsB,4BAA4B,IAAI,QAAQ,UAAU,SAAS;AAC7E,QAAO,kCAAkC,IAAI,QAAQ,UAAU,QAAW,UAAU,aAAa,SAAS,qBAAqB;;AAQnI,SAAS,iBAAiB,UAAU,QAAQ;AACxC,KAAI,MAAM,QAAQ,OAAO,OAAO,IAAI,EAChC;MAAI,CAAC,OAAO,OAAO,IAAI,SAAS,SAAS,CACrC,OAAM,IAAI,iDAA+C,sBAAsB;GAC3E;GACA,QAAQ,OAAO;GACf,OAAO;GACV,CAAC;YAGD,OAAO,OAAO,QAAQ,SAC3B,OAAM,IAAI,iDAA+C,sBAAsB;EAC3E;EACA,QAAQ,OAAO;EACf,OAAO;EACV,CAAC;AAEN,QAAO;;AAQX,SAAS,eAAe,IAAI,QAAQ;CAChC,MAAM,WAAW,GAAG,mBAAmB,OAAO,IAAI,GAAG;AACrD,KAAI,OAAO,OAAO,QAAQ,SACtB,OAAM,IAAI,+CAA6C,sBAAsB;EACzE;EACA,QAAQ,OAAO;EACf,OAAO;EACV,CAAC;AAEN,QAAO;;AAEX,MAAM,0BAAU,IAAI,SAAS;AAC7B,SAAS,MAAM,cAAc;AACzB,SAAQ,IAAI,aAAa;AACzB,QAAO;;AAEX,MAAa,SAAS,QAAQ;AAC9B,eAAsB,8BAA8B,IAAI,QAAQ,sBAAsB,oBAAoB,aAAa,cAAc,SAAS;AAC1I,UAAS,GAAG;AACZ,cAAa,OAAO;AACpB,KAAI,CAAC,QAAQ,IAAI,mBAAmB,CAChC,OAAM,eAAe,0IAAqI,sBAAsB;AAEpL,cAAa,aAAa,kBAAgB;CAC1C,MAAM,OAAO,sBAAsB,oBAAoB,OAAO;AAC9D,KAAI,CAAC,KACD,OAAM,IAAI,mDAAiD,iBAAiB;CAEhF,MAAM,aAAa,IAAI,gBAAgB,SAAS,qBAAqB;AACrE,YAAW,IAAI,gBAAgB,YAAY;AAC3C,YAAW,IAAI,QAAQ,KAAK;AAC5B,KAAI,iBAAiB,QAAQ;AACzB,eAAa,cAAc,mBAAiB;AAC5C,aAAW,IAAI,iBAAiB,aAAa;;AAEjD,QAAO,qBAAqB,IAAI,QAAQ,sBAAsB,sBAAsB,YAAY,QAAQ;;AAE5G,MAAM,gBAAgB;CAClB,KAAK;CACL,QAAQ;CACR,WAAW;CACX,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,OAAO;CACP,QAAQ;CACR,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,WAAW;CACd;AACD,SAAS,iBAAiB,UAAU,QAAQ;AACxC,MAAK,MAAM,SAAS,SAChB,KAAI,OAAO,OAAO,WAAW,OACzB,OAAM,IAAI,QAAQ,MAAM,KAAK,cAAc,OAAO,kBAAkB,kBAAkB,EAClF,QAAQ,OAAO,QAClB,CAAC;AAGV,QAAO;;AAEX,MAAa,gBAAgB,QAAQ;AACrC,MAAa,oBAAoB,QAAQ;AACzC,eAAsB,iCAAiC,IAAI,QAAQ,UAAU,SAAS;AAClF,KAAI,OAAO,SAAS,kBAAkB,YAClC,OAAO,SAAS,WAAW,YAC3B,SAAS,eACT,QAAO,uCAAuC,IAAI,QAAQ,UAAU,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,aAAa,QAAQ,qBAAqB;AAEjK,QAAO,uCAAuC,IAAI,QAAQ,UAAU,UAAU,aAAa,SAAS,qBAAqB;;AAE7H,eAAe,uCAAuC,IAAI,QAAQ,UAAU,eAAe,QAAQ,WAAW,sBAAsB;CAChI,MAAM,2BAA2B,EAAE;AACnC,SAAQ,eAAR;EACI,KAAK;AACD,mBAAgB;AAChB;EACJ,KAAK,cACD;EACJ;AACI,gBAAa,eAAe,6BAA2B;AACvD,4BAAyB,KAAK,QAAQ;;AAE9C,YAAW,OAAO;AAClB,SAAQ,QAAR;EACI,KAAK;AACD,YAAS;AACT;EACJ,KAAK,kBACD;EACJ;AACI,gBAAa,QAAQ,MAAM,sBAAoB;AAC/C,4BAAyB,KAAK,YAAY;;CAElD,MAAM,SAAS,MAAM,kCAAkC,IAAI,QAAQ,UAAU,0BAA0B,WAAW,qBAAqB;AACvI,cAAa,OAAO,UAAU,2CAAuC,kBAAkB,EACnF,MAAM,QACT,CAAC;CACF,MAAM,SAAS,0BAA0B,OAAO;AAChD,KAAI,WAAW,mBAAmB;EAC9B,MAAM,MAAM,WAAW,GAAG,aAAa,OAAO;EAC9C,MAAM,YAAY,kBAAkB,OAAO;AAC3C,MAAI,OAAO,YAAY,SAAS,MAAM,UAClC,OAAM,IAAI,oEAAoE,qBAAqB;GAAE;GAAQ;GAAK;GAAW,OAAO;GAAa,CAAC;;AAG1J,KAAI,kBAAkB,eAClB;MAAI,OAAO,UAAU,OACjB,OAAM,IAAI,6CAA2C,sBAAsB;GACvE,UAAU;GACV;GACA,OAAO;GACV,CAAC;YAGD,OAAO,UAAU,cACtB,OAAM,IAAI,6CAA2C,sBAAsB;EACvE,UAAU;EACV;EACA,OAAO;EACV,CAAC;AAEN,QAAO;;AAEX,eAAe,uCAAuC,IAAI,QAAQ,UAAU,WAAW,sBAAsB;CACzG,MAAM,SAAS,MAAM,kCAAkC,IAAI,QAAQ,UAAU,QAAW,WAAW,qBAAqB;CACxH,MAAM,SAAS,0BAA0B,OAAO;AAChD,KAAI,QAAQ;AACR,MAAI,OAAO,oBAAoB,QAAW;AACtC,gBAAa,OAAO,iBAAiB,MAAM,6BAA2B;GACtE,MAAM,MAAM,WAAW,GAAG,aAAa,OAAO;GAC9C,MAAM,YAAY,kBAAkB,OAAO;AAC3C,OAAI,OAAO,YAAY,OAAO,kBAAkB,MAAM,UAClD,OAAM,IAAI,oEAAoE,qBAAqB;IAAE;IAAQ;IAAK;IAAW,OAAO;IAAa,CAAC;;AAG1J,MAAI,OAAO,UAAU,OACjB,OAAM,IAAI,6CAA2C,sBAAsB;GACvE,UAAU;GACV;GACA,OAAO;GACV,CAAC;;AAGV,QAAO;;AAEX,MAAa,6BAA6B;AAC1C,MAAa,sBAAsB;AACnC,MAAa,wBAAwB;AACrC,MAAa,+BAA+B;AAE5C,MAAa,cAAc;AAC3B,MAAa,mBAAmB;AAEhC,MAAa,uBAAuB;AACpC,MAAa,0BAA0B;AACvC,MAAa,yBAAyB;AACtC,MAAa,6BAA6B;AAC1C,MAAa,sBAAsB;AACnC,MAAa,uBAAuB;AAGpC,MAAa,0BAA0B;AACvC,MAAa,0BAA0B;AA4CvC,SAAS,uBAAuB,UAAU;AACtC,KAAI,SAAS,SACT,OAAM,eAAe,2CAAyC,sBAAsB;;AAkL5F,eAAe,YAAY,KAAK,UAAU,WAAW,gBAAgB,YAAY;CAC7E,IAAI,EAAE,GAAG,iBAAiB,GAAG,SAAS,WAAW,IAAI,MAAM,IAAI;AAC/D,KAAI,WAAW,EACX,KAAI,eAAe,QAAW;AAC1B,QAAM,MAAM,WAAW,IAAI;AAC3B,GAAC,CAAE,GAAG,iBAAiB,GAAG,SAAS,UAAW,IAAI,MAAM,IAAI;OAG5D,OAAM,IAAI,0BAA0B,oCAAoC,EAAE,OAAO,KAAK,CAAC;AAG/F,KAAI,WAAW,EACX,OAAM,IAAI,eAAe,kBAAkB,IAAI;CAEnD,IAAI;AACJ,KAAI;AACA,WAAS,KAAK,MAAM,IAAI,KAAK,gBAAgB,CAAC,CAAC;UAE5C,OAAO;AACV,QAAM,IAAI,6DAA6D,aAAa,MAAM;;AAE9F,KAAI,CAAC,aAAa,OAAO,CACrB,OAAM,IAAI,yCAAyC,kBAAkB,IAAI;AAE7E,UAAS,OAAO;AAChB,KAAI,OAAO,SAAS,OAChB,OAAM,IAAI,0BAA0B,6DAA2D,EAC3F,OAAO,EAAE,QAAQ,EACpB,CAAC;CAEN,IAAI;AACJ,KAAI;AACA,WAAS,KAAK,MAAM,IAAI,KAAK,QAAQ,CAAC,CAAC;UAEpC,OAAO;AACV,QAAM,IAAI,8DAA8D,aAAa,MAAM;;AAE/F,KAAI,CAAC,aAAa,OAAO,CACrB,OAAM,IAAI,0CAA0C,kBAAkB,IAAI;CAE9E,MAAM,MAAM,WAAW,GAAG;AAC1B,KAAI,OAAO,QAAQ,QAAW;AAC1B,MAAI,OAAO,OAAO,QAAQ,SACtB,OAAM,IAAI,uDAAqD,kBAAkB,EAAE,QAAQ,CAAC;AAEhG,MAAI,OAAO,OAAO,MAAM,eACpB,OAAM,IAAI,8FAA4F,qBAAqB;GAAE;GAAQ;GAAK,WAAW;GAAgB,OAAO;GAAO,CAAC;;AAG5L,KAAI,OAAO,QAAQ,QACf;MAAI,OAAO,OAAO,QAAQ,SACtB,OAAM,IAAI,iDAA+C,kBAAkB,EAAE,QAAQ,CAAC;;AAG9F,KAAI,OAAO,QAAQ,QACf;MAAI,OAAO,OAAO,QAAQ,SACtB,OAAM,IAAI,8CAA4C,kBAAkB,EAAE,QAAQ,CAAC;;AAG3F,KAAI,OAAO,QAAQ,QAAW;AAC1B,MAAI,OAAO,OAAO,QAAQ,SACtB,OAAM,IAAI,kDAAgD,kBAAkB,EAAE,QAAQ,CAAC;AAE3F,MAAI,OAAO,MAAM,MAAM,eACnB,OAAM,IAAI,mDAAiD,qBAAqB;GAC5E;GACA;GACA,WAAW;GACX,OAAO;GACV,CAAC;;AAGV,KAAI,OAAO,QAAQ,QACf;MAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,OAAO,IAAI,CAC5D,OAAM,IAAI,gDAA8C,kBAAkB,EAAE,QAAQ,CAAC;;AAG7F,QAAO;EAAE;EAAQ;EAAQ,KAAK;EAAK;;AA0NvC,SAAS,sBAAsB,QAAQ,QAAQ,UAAU,QAAQ;AAC7D,KAAI,WAAW,QAAW;AACtB,MAAI,OAAO,WAAW,WAAW,OAAO,QAAQ,SAAS,CAAC,OAAO,SAAS,OAAO,IAAI,CACjF,OAAM,IAAI,2CAAyC,kBAAkB;GACjE;GACA,UAAU;GACV,QAAQ;GACX,CAAC;AAEN;;AAEJ,KAAI,MAAM,QAAQ,OAAO,EAAE;AACvB,MAAI,CAAC,OAAO,SAAS,OAAO,IAAI,CAC5B,OAAM,IAAI,2CAAyC,kBAAkB;GACjE;GACA,UAAU;GACV,QAAQ;GACX,CAAC;AAEN;;AAEJ,KAAI,aAAa,QAAW;AACxB,MAAI,OAAO,aAAa,WAClB,OAAO,QAAQ,WACf,OAAO,aAAa,aAChB,CAAC,SAAS,OAAO,IAAI,GACrB,CAAC,SAAS,SAAS,OAAO,IAAI,CACpC,OAAM,IAAI,2CAAyC,kBAAkB;GACjE;GACA,UAAU;GACV,QAAQ;GACX,CAAC;AAEN;;AAEJ,OAAM,IAAI,sFAAoF,QAAW;EAAE;EAAQ;EAAQ;EAAU,CAAC;;AAE1I,SAAS,sBAAsB,YAAY,MAAM;CAC7C,MAAM,EAAE,GAAG,OAAO,WAAW,WAAW,OAAO,KAAK;AACpD,KAAI,SAAS,EACT,OAAM,IAAI,IAAI,KAAK,yCAAyC,iBAAiB;AAEjF,QAAO;;AAEX,MAAa,iBAAiB,QAAQ;AACtC,MAAa,gBAAgB,QAAQ;AACrC,SAAgB,qBAAqB,IAAI,QAAQ,YAAY,eAAe;AACxE,UAAS,GAAG;AACZ,cAAa,OAAO;AACpB,KAAI,sBAAsB,IACtB,cAAa,WAAW;AAE5B,KAAI,EAAE,sBAAsB,iBACxB,OAAM,eAAe,iEAA+D,qBAAqB;AAE7G,KAAI,sBAAsB,YAAY,WAAW,CAC7C,OAAM,IAAI,4GAA0G,kBAAkB,EAAE,YAAY,CAAC;CAEzJ,MAAM,MAAM,sBAAsB,YAAY,MAAM;CACpD,MAAM,QAAQ,sBAAsB,YAAY,QAAQ;AACxD,KAAI,CAAC,OAAO,GAAG,+CACX,OAAM,IAAI,+CAA6C,kBAAkB,EAAE,YAAY,CAAC;AAE5F,KAAI,OAAO,QAAQ,GAAG,OAClB,OAAM,IAAI,wDAAsD,kBAAkB;EAC9E,UAAU,GAAG;EACb;EACH,CAAC;AAEN,SAAQ,eAAR;EACI,KAAK;EACL,KAAK;AACD,OAAI,UAAU,OACV,OAAM,IAAI,uDAAqD,kBAAkB;IAC7E,UAAU;IACV;IACH,CAAC;AAEN;EACJ,KAAK,eACD;EACJ;AACI,gBAAa,eAAe,6BAA2B;AACvD,OAAI,UAAU,cACV,OAAM,IAAI,UAAU,SACd,yCACA,iDAA+C,kBAAkB;IAAE,UAAU;IAAe;IAAY,CAAC;;AAI3H,KADc,sBAAsB,YAAY,QAAQ,CAEpD,OAAM,IAAI,2BAA2B,sDAAsD,EACvF,OAAO,YACV,CAAC;CAEN,MAAM,WAAW,sBAAsB,YAAY,WAAW;CAC9D,MAAM,QAAQ,sBAAsB,YAAY,QAAQ;AACxD,KAAI,aAAa,UAAa,UAAU,OACpC,OAAM,IAAI,0BAA0B,8CAA8C;AAEtF,QAAO,MAAM,IAAI,gBAAgB,WAAW,CAAC;;AAgYjD,eAAe,oBAAoB,UAAU,QAAQ,uBAAuB;CACxE,IAAI;AACJ,KAAI;AACA,SAAO,MAAM,SAAS,MAAM;UAEzB,OAAO;AACV,QAAM,SAAS;AACf,QAAM,IAAI,6CAA2C,aAAa,MAAM;;AAE5E,KAAI,CAAC,aAAa,KAAK,CACnB,OAAM,IAAI,gDAA8C,kBAAkB,EAAE,MAAM,MAAM,CAAC;AAE7F,QAAO;;AAIX,MAAa,kBAAkB,QAAQ;;;;AC33EvC,MAAM,0BAA0B,CAC9BA,+BAAY,sBACZA,+BAAY,mBACb;AAED,SAAS,yBAAyB,OAAkG;AAClI,QAAOA,+BAAY,qBAAqB,WAAW,MAAM,IAAIA,+BAAY,mBAAmB,WAAW,MAAM;;AAG/G,SAAS,6BAA6B,cAA6C,SAAiB;AAClG,KAAI,cAAc,aAAa;AAC7B,MAAI,aAAa,SAAS,QAAQ,aAAa,SAAS,KACtD,OAAM,IAAIC,0CAAuB,GAAG,QAAQ,yEAAyE;AAGvH,SAAO,EACL,2BAA2B,QAC5B;;CAGH,MAAM,iBAAiB,cAAc,OAAO,MAAM,IAAI;AACtD,KAAI,cAAc,UAAU,WAAW;AACrC,MAAI,kBAAkB,KAEpB,QAAO,EACL,2BAA2B,QAC5B;AAGH,SAAO;GACL,qBAAqB;GACrB,qBAAqB;GACtB;;AAGH,KAAI,kBAAkB,MAAM;AAC1B,MAAI,cAAc,SAAS,KACzB,OAAM,IAAIA,0CAAuB,GAAG,QAAQ,+CAA+C;AAG7F,SAAO,EAAE;;AAGX,KAAI,cAAc,SAAS,KACzB,QAAO,EACL,qBAAqB,gBACtB;AAGH,QAAO;EACL,qBAAqB;EACrB,qBAAqB;EACtB;;AAGH,eAAe,oBACb,UACA,SACkD;AAIlD,KAAI,QAAQ,UACV,QAAO;EAAE,MAAM;EAAU,aAAa;EAAoB;CAE5D,MAAM,wBACHC,8BAA+D;AAClE,KAAI,OAAO,0BAA0B,cAAc,OAAO,SAAS,eAAe,OAAO,aAAa,YACpG,QAAO;EAAE,MAAM;EAAU,aAAa;EAAoB;AAE5D,KAAI;EACF,MAAM,SAAS,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,YAAY,IAAI,sBAAsB,OAAO,CAAC;EAC3F,MAAM,SAAS,MAAM,IAAI,SAAS,OAAO,CAAC,aAAa;AACvD,SAAO;GAAE,MAAM,IAAI,WAAW,OAAO;GAAE,aAAa;GAA4B;SAC1E;AAGN,SAAO;GAAE,MAAM;GAAU,aAAa;GAAoB;;;AAI9D,IAAa,0BAAb,MAAqC;CAWnC,YAAY,AAAgB,SAAiC;EAAjC;2CATA,IAAI,KAAsB;iBAMS;AAI7D,OAAK,oBAAoB,QAAQ,aAAa;;CAGhD,mBAAmB,UAAuC;AACxD,OAAK,kBAAkB,IAAI,SAAS;AACpC,eAAa;AACX,QAAK,kBAAkB,OAAO,SAAS;;;CAI3C,IAAI,YAAY;AACd,SAAO,KAAK,QAAQ;;CAGtB,YAAY;AACV,SAAO,KAAK,QAAQ,YAAY,GAAG;;CAGrC,aAAuB;AACrB,SAAO,KAAK,QAAQ,YAAY,CAAC,KAAI,MAAK,IAAI,UAAU;;;;;;;CAQ1D,gBAAwB;EACtB,MAAM,UAAU,KAAK,YAAY;AACjC,MAAI,KAAK,WAAW,QAAQ,KAAK,QAAQ,OACvC,QAAO,QAAQ,KAAK,QAAQ;AAE9B,SAAO,QAAQ;;;;;;;;;;;;;;;;;;;;;;;CAwBjB,MAAgB,cAAiB,IAAiH;EAChJ,MAAM,UAAU,KAAK,YAAY;AAGjC,MAAI,QAAQ,UAAU,EACpB,QAAO,MAAM,GAAG,QAAQ,IAAI;GAAE,aAAa;GAAG,iBAAiB;GAAO,CAAC;AAIzE,MAAI,KAAK,SAAS;GAChB,MAAM,SAAS,MAAM,KAAK,cAAc,SAAS,GAAG;AACpD,OAAI,WAAW,OAAW,QAAO;;AAKnC,SAAO,MAAM,KAAK,aAAa,SAAS,GAAG;;CAG7C,AAAQ,oBAAoB,OAAgB;AAC1C,SAAO,iBAAiBC,iCAAc,KAAK,gCAAgC,MAAM;;CAGnF,AAAQ,gCAAgC,OAAgB;EACtD,MAAM,WAAW,KAAK,yBAAyB,MAAM;AACrD,SAAO,YAAY,QAAQ,SAAS,UAAU,OAAO,SAAS,SAAS;;CAGzE,AAAQ,yBAAyB,OAAgB,6BAAa,IAAI,KAAY,EAAmB;AAC/F,MAAI,iBAAiB,SACnB,QAAO;AAET,MAAI,EAAE,iBAAiB,UAAU,WAAW,IAAI,MAAM,CACpD,QAAO;AAGT,aAAW,IAAI,MAAM;AACrB,SAAO,KAAK,yBAAyB,MAAM,OAAO,WAAW;;;;;;CAO/D,MAAc,cACZ,SACA,IACwB;EACxB,MAAM,SAAS,KAAK;AAGpB,MAAI,KAAK,QAAQ,GAAG,OAAO,UACzB,KAAI;GACF,MAAM,SAAS,MAAM,GAAG,QAAQ,IAAI;IAAE,aAAa;IAAG,iBAAiB;IAAM,CAAC;AAC9E,QAAK,UAAU;AACf,UAAO;WACA,GAAG;AACV,OAAI,KAAK,oBAAoB,EAAE,CAAE,OAAM;AACvC,UAAO,YAAY,KAAK,IAAI,OAAO,YAAY,IAAK,IAAK;;AAK7D,MAAI;AACF,UAAO,MAAM,GAAG,QAAQ,OAAO,QAAQ;IAAE,aAAa;IAAG,iBAAiB;IAAM,CAAC;WAC1E,GAAG;AACV,OAAI,KAAK,oBAAoB,EAAE,CAAE,OAAM;AACvC,QAAK,UAAU;AACf;;;;;;;CAQJ,MAAc,aACZ,SACA,IACY;EACZ,IAAI;AAEJ,OAAK,IAAI,OAAO,GAAG,OAAO,GAAG,OAC3B,MAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,IAClC,KAAI;GACF,MAAM,SAAS,MAAM,GAAG,QAAQ,IAAI;IAAE,aAAa;IAAG,iBAAiB;IAAM,CAAC;AAC9E,OAAI,IAAI,EACN,MAAK,UAAU;IAAE,OAAO;IAAG,WAAW,KAAK;IAAmB;AAEhE,UAAO;WACA,GAAG;AACV,OAAI,KAAK,oBAAoB,EAAE,CAAE,OAAM;AACvC,eAAY,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,EAAE,CAAC;;AAK/D,QAAM;;CAGR,qBAAqB;AACnB,UAAQ,KAAK,QAAQ,uBAAuB,KAAK,QAAQ,aAAa,GAAG;;CAG3E,MAAa,sBAAsB,SAAkC,aAA6C;AAChH,MAAI,KAAK,0BACP,QAAO,MAAM,KAAK;AAGpB,OAAK,4BAA4B,KAAK,4BAA4B,SAAS,YAAY;AACvF,MAAI;AACF,UAAO,MAAM,KAAK;YACV;AACR,QAAK,4BAA4B;;;CAIrC,MAAc,4BAA4B,SAAkC,aAA6C;EACvH,MAAM,aAAa,OAAO,OAA4B;AACpD,OAAI;AACF,UAAM,IAAI;AACV,WAAO;YACA,GAAG;AACV,WAAO,GAAG;;;EAGd,MAAM,UAAU,MAAM,WAAW,YAAY;GAC3C,MAAM,MAAM,MAAM,MAAM,gCAAgC;AACxD,OAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,GAAG,IAAI,OAAO,GAAG,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,GAAG;IAEzE;EACF,MAAM,iBAAiB,MAAM,WAAW,YAAY;GAClD,MAAM,MAAM,MAAM,MAAM,IAAI,IAAI,WAAW,KAAK,WAAW,CAAC,CAAC;AAC7D,OAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,GAAG,IAAI,OAAO,GAAG,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,GAAG;IAEzE;EACF,MAAM,gBAAgB,MAAM,WAAW,YAAY;GACjD,MAAM,MAAM,MAAM,MAAM,kCAAkC;AAC1D,OAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,GAAG,IAAI,OAAO,GAAG,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,GAAG;IAEzE;EACF,MAAM,cAAc,MAAM,WAAW,YAAY;GAC/C,MAAM,MAAM,MAAM,MAAM,kCAAkC;AAC1D,OAAI,CAAC,IAAI,GACP,OAAM,IAAI,MAAM,GAAG,IAAI,OAAO,GAAG,IAAI,WAAW,IAAI,MAAM,IAAI,MAAM,GAAG;IAEzE;AACF,SAAO;GACL,qBAAqBD,8BAAU,WAAW;GAC1C;GACA;GACA;GACA;GACD;;CAGH,MAAgB,oBAAoB,OAAc,SAAkC,aAA6C;AAC/H,SAAO,IAAI,MAAM,4BAAQ;;;;;QAKrB,MAAM;;QAEN,KAAK,UAAU,MAAM,KAAK,sBAAsB,SAAS,YAAY,EAAE,MAAM,EAAE,CAAC;OACjF,EAAS,OAAO,CAAC;;CAGtB,MAAgB,cACd,IACA,SACA,aACA,SACY;EACZ,MAAM,gBAAgB,MAAME,2BAAO,MACjC,IACA,SAAS,eAAe,GACxB,EAAE,sBAAsB,KAAM,CAC/B;AAGD,MAAI,cAAc,WAAW,SAAS;AACpC,OAAIF,8BAAU,aAAaA,8BAAU,UAAU,WAAW,MACxD,OAAM,IAAI,MAAM,4GAA4G,EAAE,OAAO,cAAc,OAAO,CAAC;AAE7J,OAAI,SAAS,gBACX,OAAM,cAAc;AAEtB,SAAM,MAAM,KAAK,oBAAoB,cAAc,OAAO,SAAS,YAAY;;AAEjF,SAAO,cAAc;;CAGvB,MAAgB,uBACd,IACA,SACA,aACA,SACY;AACZ,SAAO,MAAM,KAAK,cAAc,YAAY,MAAME,2BAAO,kBAAkB,GAAG,EAAE,SAAS,aAAa,QAAQ;;CAGhH,MAAa,oBAAoB,cAA4B;AAC3D,MAAI,yBAAyB,KAAK,QAEhC,OAAM,IAAI,MAAM,sJAAsJ;EAGxK,MAAM,eAAe,KAAK,QAAQ,wBAAwBC;AAC1D,SAAO,MAAM,KAAK,cAAc,OAAO,QAAQ,iBAAiB;AAC9D,UAAO,MAAM,KAAK,0BAA0B,cAAc,cAAc,QAAQ,aAAa;IAC7F;;CAGJ,MAAc,0BAA0B,cAA4B,cAAsB,QAAgB,cAAoE;EAC5K,MAAM,gBAAgB,SAAS;EAC/B,MAAM,KAAK;GACT,QAAQ,KAAK,QAAQ,YAAY;GACjC,WAAW;GACX,gBAAgB;GACjB;EACD,MAAM,SAAuB;GAC3B,WAAW,KAAK;GAChB,eAAe;GAChB;EAED,MAAM,uBAAuBC,iBAAuB,aAAa;EAEjE,MAAM,gBAAgB,cAAc,WAAW,UAAU;EAEzD,MAAM,WAAW,MAAM,KAAK,uBAAuB,YAAY;GAC7D,MAAM,cAAc,MAAMC,yBACxB,IACA,QACA,sBACA,aAAa,OACb,gBAAgB,GAAGC,wBAA8B,MAAM,GAAG,OAC3D;GAED,MAAM,WAAW,MAAM,KAAK,iBAAiB,YAAY;AAEzD,OAAI,SAAS,WAAW,SAAS;IAC/B,MAAM,QAAQ,SAAS;AACvB,QAAIR,+BAAY,kBAAkB,WAAW,MAAM,CACjD,QAAO;AAET,UAAM;;AAGR,OAAI,CAAC,SAAS,KAAK,IAAI;IACrB,MAAM,OAAO,MAAM,SAAS,KAAK,MAAM;AACvC,UAAM,IAAI,MAAM,yCAAyC,SAAS,OAAO,GAAG,QAAQ,EAAE,OAAO,SAAS,MAAM,CAAC;;AAG/G,UAAO,SAAS;KACf,QAAW,QAAW,aAAa;AACtC,MAAI,CAAC,SAAU,QAAO;EAEtB,IAAI;AACJ,MAAI;AACF,YAAS,MAAMS,4BAAkC,IAAI,QAAQ,SAAS;WAC/D,GAAE;AACT,OAAI,aAAaC,kBACf,OAAM,IAAIT,0CAAuB,4DAA4D;IAC3F,OAAO,EAAE;IACT,MAAM,EAAE;IACR,OAAO,EAAE;IACV,CAAC;AAEJ,SAAM,IAAIA,0CAAuB,2DAA2D,EAAE,OAAO,GAAG,CAAC;;AAG3G,MAAI,CAAC,OAAO,aACV,OAAM,IAAIA,0CAAuB,oEAAoE;AAGvG,SAAOU,2BAAY,cAAc,OAAO,aAAa,qCAAa,yGAAyG,EAAE,QAAQ,CAAC;;CAGxL,MAAa,kBACX,MACA,gBACA,SACA,cAA6C,UAC7C,gBACA,cACA;AACA,cAAY,KAAK,cAAc,EAC7B,cAAc,MACf,CAAC;AAEF,MAAI,eACF,QAAO,MAAM,KAAK,oBACV,KAAK,uBAAuB,MAAM,gBAAgB,SAAU,aAAa,gBAAgB,aAAa,EAC5G,SACA,aACA,aACD;AAGH,SAAO,MAAM,KAAK,cAAc,OAAO,QAAQ,yBAAyB;AACtE,UAAO,MAAM,KAAK,oBACV,KAAK,uBAAuB,MAAM,gBAAgB,SAAU,aAAa,QAAQ,aAAa,EACpG,SACA,aACA;IAAE,GAAG;IAAsB,GAAG;IAAc,CAC7C;IACD;;CAGJ,AAAO,cAAc,SAAgH;AAKnI,SAJgB,IAAIC,+BAAgB;GAClC,4BAA4B,OAAO,iBAAiB,MAAM,KAAK,oBAAoB,aAAa;GAChG,GAAG;GACJ,CAAC;;CAIJ,MAAM,uBACJ,MACA,SACA,SACkC;AAClC,MAAI;GACF,MAAM,WAAW,MAAM,KAAK,kBAC1B,0BACA;IACE,QAAQ;IACR,SAAS,EAAE,gBAAgB,oBAAoB;IAC/C;IACA,WAAW,QAAQ;IACpB,EACD,SACA,UACA,KAAK,oBAAoB,EACzB;IAAE,aAAa;IAAG,iBAAiB;IAAM,CAC1C;AACD,UAAOR,2BAAO,GAAG,SAAS;WACnB,GAAG;AACV,UAAOA,2BAAO,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;;;CAItE,MAAM,wBACJ,MACA,SACA,SACkC;AAClC,MAAI;GACF,MAAM,UAAU,MAAM,oBAAoB,MAAM,EAAE,WAAW,QAAQ,WAAW,CAAC;GACjF,MAAM,WAAW,MAAM,KAAK,kBAC1B,2BACA;IACE,QAAQ;IACR,SAAS,EAAE,gBAAgB,QAAQ,aAAa;IAChD,MAAM,QAAQ;IACd,WAAW,QAAQ;IACpB,EACD,SACA,UACA,KAAK,oBAAoB,EACzB;IAAE,aAAa;IAAG,iBAAiB;IAAM,CAC1C;AACD,UAAOA,2BAAO,GAAG,SAAS;WACnB,GAAG;AACV,UAAOA,2BAAO,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC;;;CAItE,MAAgB,oCACd,MACA,gBACA,kBACA,eASC;AACD,MAAI;AACF,UAAOA,2BAAO,GAAG,MAAM,KAAK,kBAAkB,MAAM,gBAAgB,iBAAiB,CAAC;WAC/E,GAAG;AACV,QAAK,MAAM,aAAa,cACtB,KAAI,UAAU,WAAW,EAAE,CACzB,QAAOA,2BAAO,MAAM,EAAqB;AAG7C,SAAM;;;CAIV,MAAc,uBACZ,MACA,SACA,SACA,aACA,gBACA,cAME;;;;EAIF,IAAI,WAAW,MAAM,QAAQ,4BAA4B,KAAQ,KAAK;EAEtE,IAAI,eAAuC;EAC3C,IAAI,gBAAwF;AAE5F,MAAI,yBAAyB,KAAK,SAAS;GACzC,MAAM,sBAAsB,KAAK,QAAQ;AAEzC,OAAI,OAAO,wBAAwB,YAAY;IAC7C,MAAM,oBAAoB,MAAM,qBAAqB;AACrD,QAAI,mBAAmB;KACrB,MAAM,cAAcO,2BAAY,cAAc,kBAAkB;AAChE,SAAI,YACF,iBAAgB;MAAE;MAAa,cAAc;MAAM;;UAGlD;AACL,mBAAe;AACf,oBAAgB,MAAM,oBAAoB,4BAA4B,KAAQ,KAAK;;;AAKvF,QAAM,KAAK,QAAQ,kBAAkB;EAErC,IAAI,OAAO,kBAAkB,KAAK,WAAW,IAAI;AACjD,MAAI,IAAI,SAAS,IAAI,CACnB,OAAM,IAAI,MAAM,GAAG,GAAG;EAExB,MAAM,SAAsB;GAW1B,GAAI,mBAAmBT,gCAAY,EAAE,GAAG,EACtC,aAAa,QACd;GACD,GAAG;GACH,SAAS;IAEP,oCAAoC;IACpC,yBAAyB,KAAK;IAC9B,0BAA0B;IAC1B,6BAA6B,KAAK,QAAQ;IAC1C,GAAI,WAAW,EACb,2BAA2B,SAAS,YAAY,OACjD,GAAG,EAAE;IACN,GAAI,UAAU,eAAe,EAC3B,4BAA4B,SAAS,aAAa,OACnD,GAAG,EAAE;IACN,mCAAmC;IACnC,GAAI,0BAA0B,KAAK,WAAW,KAAK,QAAQ,uBAAuB,EAChF,qCAAqC,KAAK,QAAQ,sBACnD,GAAG,EAAE;IACN,GAAI,gBAAgB,EAClB,iCAAiC,cAAc,YAAY,OAC5D,GAAG,EAAE;IASN,+EAAuD;IAEvD,8BAA8B;IAC9B,GAAG,KAAK,QAAQ;IAChB,GAAG,QAAQ;IACZ;GAID,GAAI,mBAAmBA,gCAAY,EAAE,GAAG,EACtC,OAAO,YACR;GACF;EAED,MAAM,YAAY,YAAY,KAAK;EACnC,IAAI;AACJ,MAAI;AACF,YAAS,MAAM,MAAM,KAAK,OAAO;WAC1B,GAAG;AACV,OAAI,KAAK,kBAAkB,OAAO,GAAG;IACnC,MAAM,QAAyB;KAAE;KAAM,SAAS,OAAO,UAAU,OAAO,aAAa;KAAE,UAAU,KAAK,MAAM,YAAY,KAAK,GAAG,UAAU;KAAE,OAAO,aAAa,QAAQ,EAAE,UAAU;KAAiB;AACrM,SAAK,kBAAkB,SAAS,MAAM,EAAE,MAAM,CAAC;;AAEjD,OAAI,aAAa,UAEf,KAAIW,8BAAc,OAAO,UAAU,OAAsB,WACvD,QAAOT,2BAAO,MAAM,EAAE;YACb,cAAc,gBACvB,OAAM;OAEN,OAAM,MAAM,KAAK,oBAAoB,GAAG,SAAS,YAAY;AAGjE,SAAM;;EAGR,MAAM,kBAAkB,MAAM,KAAK,oBAAoB,OAAO;AAE9D,MAAI,KAAK,kBAAkB,OAAO,GAAG;GACnC,MAAM,QAAyB;IAAE;IAAM,SAAS,OAAO,UAAU,OAAO,aAAa;IAAE,QAAQ,gBAAgB;IAAQ,UAAU,KAAK,MAAM,YAAY,KAAK,GAAG,UAAU;IAAE;AAC5K,QAAK,kBAAkB,SAAS,MAAM,EAAE,MAAM,CAAC;;EAGjD,MAAM,eAAe,MAAM,KAAK,iBAAiB,gBAAgB;AAEjE,MAAI,aAAa,WAAW,SAAS;AAEnC,OAAIJ,+BAAY,mBAAmB,WAAW,aAAa,MAAM,EAAE;AACjE,QAAI,CAAC,SACH,OAAM,IAAIC,0CAAuB,+DAA+D;KAAE;KAAU;KAAc,CAAC;AAE7H,YAAQ,uBAAuB,SAAS,YAAY;AACpD,WAAOG,2BAAO,MAAM,aAAa,MAAM;;AAKzC,OAAI,iBAAiBJ,+BAAY,wBAAwB,WAAW,aAAa,MAAM,IAAIA,+BAAY,eAAe,WAAW,aAAa,MAAM,GAAG;AACrJ,QAAI,CAAC,cACH,OAAM,IAAIC,0CAAuB,2EAA2E;KAAE;KAAe;KAAc,CAAC;AAE9I,iBAAa,uBAAuB,cAAc,YAAY;AAC9D,WAAOG,2BAAO,MAAM,aAAa,MAAM;;AAKzC,SAAM,aAAa;;EAIrB,MAAM,MAAM,OAAO,OAAO,aAAa,MAAM,EAC3C,YAAY,UACb,CAAC;AACF,MAAI,IAAI,GACN,QAAOA,2BAAO,GAAG,IAAI;WACZ,IAAI,WAAW,KAAK;GAC7B,MAAM,aAAa,IAAI,QAAQ,IAAI,cAAc;AACjD,OAAI,eAAe,MAAM;AACvB,YAAQ,IAAI,yCAAyC,IAAI,qBAAqB,WAAW,aAAa;AACtG,yCAAW,OAAO,WAAW,GAAG,IAAK;AACrC,WAAOA,2BAAO,sBAAM,IAAI,MAAM,gCAAgC,WAAW,UAAU,CAAC;;AAGtF,WAAQ,IAAI,yCAAyC,IAAI,oEAAoE;AAC7H,UAAOA,2BAAO,sBAAM,IAAI,MAAM,+CAA+C,CAAC;SACzE;GACL,MAAM,QAAQ,MAAM,IAAI,MAAM;AAG9B,OAAI,IAAI,UAAU,OAAO,IAAI,SAAS,IACpC,OAAM,IAAI,MAAM,6BAA6B,IAAI,IAAI,IAAI,OAAO,GAAG,SAAS,EAAE,OAAO,KAAK,CAAC;GAE7F,MAAM,WAAW,IAAIH,0CAAuB,6BAA6B,IAAI,IAAI,IAAI,OAAO,GAAG,SAAS;IAAE,SAAS;IAAQ;IAAK;IAAM,CAAC;AAEvI,OAAI,IAAI,WAAW,OAAO,MAAM,SAAS,yBAAyB,CAGhE,QAAOG,2BAAO,MAAM,SAAS;AAI/B,SAAM;;;CAIV,MAAc,oBAAoB,QAAqC;EACrE,IAAI,MAAM;AAEV,MAAI,OAAO,QAAQ,IAAI,2BAA2B,IAAI,OAAO,QAAQ,IAAI,wBAAwB,EAAE;GACjG,MAAM,eAAe,OAAO,OAAO,QAAQ,IAAI,2BAA2B,IAAI,OAAO,QAAQ,IAAI,wBAAwB,CAAC;AAC1H,SAAM,IAAI,SAAS,OAAO,MAAM;IAC9B,QAAQ;IACR,YAAY,OAAO;IACnB,SAAS,OAAO;IACjB,CAAC;;AAEJ,SAAO;;CAGT,MAAc,iBAAiB,KAAsD;AAGnF,MAAI,IAAI,QAAQ,IAAI,yBAAyB,IAAI,IAAI,QAAQ,IAAI,sBAAsB,EAAE;GACvF,MAAM,YAAY,MAAM,IAAI,MAAM;AAElC,QADyB,IAAI,QAAQ,IAAI,yBAAyB,IAAI,IAAI,QAAQ,IAAI,sBAAsB,MACnF,UAAU,KACjC,OAAM,IAAIH,0CAAuB,8HAA8H;GAEjK,MAAM,QAAQE,8BAAW,SAAS,UAAU;AAC5C,UAAOC,2BAAO,MAAM,MAAM;;AAG5B,SAAOA,2BAAO,GAAG,IAAI;;CAGvB,MAAa,oBAAoB,SAAkE;AASjG,QAAM,IAAIH,0CAAuB,OARrB,MAAM,KAAK,kBAAkB,0BAA0B;GACjE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,QAAQ;GAC9B,EAAE,KAAK,EAEmC,MAAM,CAAC;;CAGpD,MAAM,wBACJ,OACA,aACyD;EACzD,MAAM,MAAM,MAAM,KAAK,oCACrB,kCACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU;IACnB;IACA,cAAc;IACf,CAAC;GACH,EACD,MACA,CAACD,+BAAY,aAAa,CAC3B;AAED,MAAI,IAAI,WAAW,QACjB,QAAOI,2BAAO,MAAM,IAAI,MAAM;MAE9B,QAAOA,2BAAO,GAAG,OAAU;;CAI/B,MAAM,sBACJ,OACA,aACA,SAC0D;EAC1D,MAAM,MAAM,MAAM,KAAK,oCACrB,4CACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU;IACnB;IACA,cAAc;IACf,CAAC;GACH,EACD,SACA,CAACJ,+BAAY,qBAAqB,CACnC;AAED,MAAI,IAAI,WAAW,QACjB,QAAO,IAAI;;CAIf,MAAM,mBACJ,OACA,aACA,cACwJ;EACxJ,MAAM,MAAM,MAAM,KAAK,oCACrB,+BACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU;IACnB;IACA,cAAc;IACd,GAAG,6BAA6B,cAAc,qBAAqB;IACpE,CAAC;GACH,EACD,MACA,CAACA,+BAAY,2BAA2B,GAAG,wBAAwB,CACpE;AAED,MAAI,IAAI,WAAW,QACjB,QAAOI,2BAAO,MAAM,IAAI,MAAM;MAE9B,QAAOA,2BAAO,GAAG,MAAM,IAAI,KAAK,MAAM,CAAC;;CAI3C,MAAM,cACJ,SACkE;EAClE,MAAM,MAAM,MAAM,KAAK,oCACrB,oBAAoB,UAAU,oCAAoC,wBAClE;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU;IACnB,MAAM,QAAQ;IACd,GAAI,cAAc,UAAU,EAAE,UAAU,QAAQ,UAAU,GAAG,EAAE;IAChE,CAAC;GACH,EACD,MACA,CAACJ,+BAAY,sBAAsB,CACpC;AAED,MAAI,IAAI,WAAW,QACjB,QAAOI,2BAAO,MAAM,IAAI,MAAM;MAE9B,QAAOA,2BAAO,GAAG,OAAU;;CAI/B,MAAM,eACJ,SACA,SAC8G;EAC9G,MAAM,MAAM,MAAM,KAAK,oCACrB,yBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU;IACnB,cAAc,QAAQ;IACtB,cAAc,QAAQ;IACvB,CAAC;GACH,EACD,SACA,CAACJ,+BAAY,8BAA8BA,+BAAY,2BAA2B,CACnF;AAED,MAAI,IAAI,WAAW,QACjB,QAAO,IAAI;;CAIf,MAAM,YACJ,SACA,SACgE;EAChE,MAAM,MAAM,MAAM,KAAK,oCACrB,sBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,QAAQ;GAC9B,EACD,SACA,CAACA,+BAAY,2BAA2B,CACzC;AAED,MAAI,IAAI,WAAW,QACjB,QAAO,IAAI;;CAIf,MAAM,wBAAwB,MAAgF;EAC5G,MAAM,MAAM,MAAM,KAAK,cAAc;GAAE;GAAM,gBAAgB;GAAM,CAAC;AACpE,MAAI,IAAI,WAAW,QACjB,QAAOI,2BAAO,MAAM,IAAI,MAAM;MAE9B,QAAOA,2BAAO,GAAG,OAAU;;CAI/B,MAAM,YAAY,MAAgF;EAChG,MAAM,MAAM,MAAM,KAAK,oCACrB,4BACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,EACnB,MACD,CAAC;GACH,EACD,MACA,CAACJ,+BAAY,sBAAsB,CACpC;AAED,MAAI,IAAI,WAAW,QACjB,QAAOI,2BAAO,MAAM,IAAI,MAAM;MAE9B,QAAOA,2BAAO,GAAG,OAAU;;CAI/B,MAAM,4BACJ,SACA,SACwG;EACxG,MAAM,MAAM,MAAM,KAAK,oCACrB,+CACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,QAAQ;GAC9B,EACD,SACA,EAAE,CACH;AAED,MAAI,IAAI,WAAW,QACjB,QAAOA,2BAAO,MAAM,IAAI,MAAM;AAGhC,SAAOA,2BAAO,GAAG,MAAM,IAAI,KAAK,MAAM,CAAC;;CAGzC,MAAM,gBACJ,SACA,SACsE;EACtE,MAAM,MAAM,MAAM,KAAK,oCACrB,0BACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,QAAQ;GAC9B,EACD,SACA,CAACJ,+BAAY,0BAA0B,CACxC;AACD,MAAI,IAAI,WAAW,QACjB,QAAOI,2BAAO,MAAM,IAAI,MAAM;AAEhC,SAAOA,2BAAO,GAAG,OAAU;;CAG7B,MAAM,8BACJ,SAEA,SACuG;EACvG,MAAM,MAAM,MAAM,KAAK,oCACrB,iDACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,QAAQ;GAC9B,EACD,SACA,EAAE,CACH;AAED,MAAI,IAAI,WAAW,QACjB,QAAOA,2BAAO,MAAM,IAAI,MAAM;AAGhC,SAAOA,2BAAO,GAAG,MAAM,IAAI,KAAK,MAAM,CAAC;;CAGzC,MAAM,mBAAmB,SAKP;AAChB,QAAM,KAAK,kBACT,+BACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU;IACnB,OAAO,QAAQ;IACf,SAAS,QAAQ;IACjB,cAAc,QAAQ;IACvB,CAAC;GACH,EACD,QAAQ,QACT;;CAGH,MAAM,qBAA4D,SAIsG;EACtK,MAAM,MAAM,MAAM,KAAK,oCACrB,QAAQ,SAAS,UACf,wCACA,QAAQ,SAAS,YACf,qCACA,4BACJ;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,EACnB,MAAM,QAAQ,MACf,CAAC;GACH,EACD,QAAQ,SACR,CAACJ,+BAAY,uBAAuBA,+BAAY,4BAA4B,CAC7E;AAED,MAAI,IAAI,WAAW,QACjB,QAAOI,2BAAO,MAAM,IAAI,MAAM;MAE9B,QAAOA,2BAAO,GAAG,MAAM,IAAI,KAAK,MAAM,CAAC;;CAI3C,MAAM,QACJ,aACA,MACA,SACA;EAaA,MAAM,SAAS,OAZH,MAAM,KAAK,kBAAkB,qBAAqB;GAC5D,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU;IACnB,MAAM;IACN,MAAM;IACA;IACP,CAAC;GACH,EAAE,QAAQ,EAEc,MAAM;AAC/B,SAAO;GACL,aAAa,OAAO;GACpB,cAAc,OAAO;GACrB,SAAS,OAAO;GACjB;;CAGH,MAAM,qBACJ,OACA,UACA,SACsG;EACtG,MAAM,MAAM,MAAM,KAAK,oCACrB,0BACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU;IACnB;IACA;IACD,CAAC;GACH,EACD,SACA,CAACJ,+BAAY,sBAAsB,CACpC;AAED,MAAI,IAAI,WAAW,QACjB,QAAOI,2BAAO,MAAM,IAAI,MAAM;EAGhC,MAAM,SAAS,MAAM,IAAI,KAAK,MAAM;AACpC,SAAOA,2BAAO,GAAG;GACf,aAAa,OAAO;GACpB,cAAc,OAAO;GACtB,CAAC;;CAGJ,MAAM,qBACJ,OACA,UACA,8BACA,SACA,cACiO;EACjO,MAAM,MAAM,MAAM,KAAK,oCACrB,0BACA;GACE,SAAS,EACP,gBAAgB,oBACjB;GACD,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB;IACA;IACA,2BAA2B;IAC3B,GAAG,6BAA6B,cAAc,qBAAqB;IACpE,CAAC;GACH,EACD,SACA;GAACJ,+BAAY;GAA4BA,+BAAY;GAA4B,GAAG;GAAwB,CAC7G;AAED,MAAI,IAAI,WAAW,QACjB,QAAOI,2BAAO,MAAM,IAAI,MAAM;EAGhC,MAAM,SAAS,MAAM,IAAI,KAAK,MAAM;AACpC,SAAOA,2BAAO,GAAG;GACf,aAAa,OAAO;GACpB,cAAc,OAAO;GACtB,CAAC;;CAGJ,MAAM,kBAAkB,SAAiG;EACvH,MAAM,MAAM,MAAM,KAAK,oCACrB,2BACA,EACE,QAAQ,QACT,EACD,SACA,EAAE,CACH;AAED,MAAI,IAAI,WAAW,QACjB,QAAOA,2BAAO,MAAM,IAAI,MAAM;EAGhC,MAAM,SAAS,MAAM,IAAI,KAAK,MAAM;AACpC,SAAOA,2BAAO,GAAG;GACf,aAAa,OAAO;GACpB,cAAc,OAAO;GACtB,CAAC;;CAGJ,MAAM,oBAAoB,MAAc,SAAkJ;EACxL,MAAM,MAAM,MAAM,KAAK,oCACrB,qBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,EACnB,MACD,CAAC;GACH,EACD,SACA,CAACJ,+BAAY,sBAAsB,CACpC;AAED,MAAI,IAAI,WAAW,QACjB,QAAOI,2BAAO,MAAM,IAAI,MAAM;EAGhC,MAAM,SAAS,MAAM,IAAI,KAAK,MAAM;AACpC,SAAOA,2BAAO,GAAG;GACf,aAAa,OAAO;GACpB,cAAc,OAAO;GACrB,SAAS,OAAO;GACjB,CAAC;;CAGJ,MAAM,cAAc,MAAc,MAAc,SAAkJ;EAChM,MAAM,MAAM,MAAM,KAAK,oCACrB,qBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU;IACnB,MAAM;IACN;IACA;IACD,CAAC;GACH,EACD,SACA,CAACJ,+BAAY,sBAAsB,CACpC;AAED,MAAI,IAAI,WAAW,QACjB,QAAOI,2BAAO,MAAM,IAAI,MAAM;EAGhC,MAAM,SAAS,MAAM,IAAI,KAAK,MAAM;AACpC,SAAOA,2BAAO,GAAG;GACf,aAAa,OAAO;GACpB,cAAc,OAAO;GACrB,SAAS,OAAO;GACjB,CAAC;;CAGJ,MAAM,kBAAkB,MAA6E,SAAqI;EACxO,MAAM,MAAM,MAAM,KAAK,oCACrB,yBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,KAAK;GAC3B,EACD,SACA,CAACJ,+BAAY,4BAA4B,CAC1C;AAED,MAAI,IAAI,WAAW,QACjB,QAAOI,2BAAO,MAAM,IAAI,MAAM;EAGhC,MAAM,SAAS,MAAM,IAAI,KAAK,MAAM;AACpC,SAAOA,2BAAO,GAAG;GACf,aAAa,OAAO;GACpB,cAAc,OAAO;GACtB,CAAC;;CAGJ,MAAM,YACJ,SAYiB;EACjB,MAAM,qBAAqB,IAAI,IAAI,QAAQ,YAAY;AACvD,OAAK,MAAM,OAAO,CAAC,QAAQ,QAAQ,EAAE;AACnC,OAAI,mBAAmB,aAAa,IAAI,IAAI,CAC1C,SAAQ,KAAK,mCAAmC,MAAM,0EAA0E;AAElI,sBAAmB,aAAa,OAAO,IAAI;;AAG7C,MAAI,yBAAyB,KAAK,QAEhC,OAAM,IAAI,MAAM,2DAA2D;EAE7E,MAAM,eAAe,KAAK,QAAQ,wBAAwBC;EAC1D,MAAM,MAAM,IAAI,IAAI,KAAK,eAAe,GAAG,2BAA2B,QAAQ,SAAS,aAAa,CAAC;AACrG,MAAI,aAAa,IAAI,aAAa,KAAK,UAAU;AACjD,MAAI,aAAa,IAAI,iBAAiB,aAAa;AACnD,MAAI,aAAa,IAAI,gBAAgB,mBAAmB,UAAU,CAAC;AACnE,MAAI,aAAa,IAAI,SAAS,SAAS;AACvC,MAAI,aAAa,IAAI,SAAS,QAAQ,MAAM;AAC5C,MAAI,aAAa,IAAI,cAAc,qBAAqB;AACxD,MAAI,aAAa,IAAI,kBAAkB,QAAQ,cAAc;AAC7D,MAAI,aAAa,IAAI,yBAAyB,OAAO;AACrD,MAAI,aAAa,IAAI,iBAAiB,OAAO;AAC7C,MAAI,aAAa,IAAI,QAAQ,QAAQ,KAAK;AAC1C,MAAI,aAAa,IAAI,sBAAsB,QAAQ,iBAAiB;EAIpE,MAAM,SAAS,MAAM,QAAQ,QAAQ,4BAA4B,MAAQ,IAAO;AAChF,MAAI,OACF,KAAI,aAAa,IAAI,SAAS,OAAO,YAAY,MAAM;AAGzD,MAAI,QAAQ,yBACV,KAAI,aAAa,IAAI,+BAA+B,QAAQ,yBAAyB;AAEvF,MAAI,QAAQ,cACV,KAAI,aAAa,IAAI,kBAAkB,QAAQ,cAAc;AAE/D,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,6BAA6B,QAAQ,cAAc,SAAS,QAAQ,OAAO,CAAC,CACpH,KAAI,aAAa,IAAI,KAAK,MAAM;AAGlC,SAAO,IAAI,UAAU;;CAGvB,MAAM,eAAe,SAWgF;AACnG,MAAI,OAAO,WAAW,YACpB,OAAM,IAAIJ,0CAAuB,uEAAuE;AAG1G,QAAM,KAAK,QAAQ,kBAAkB;EAErC,MAAM,MAAM,IAAI,IAAI,MAAM,KAAK,YAAY,QAAQ,CAAC;AAKpD,MAAI,aAAa,IAAI,0BAA0B,OAAO;AACtD,MAAI,aAAa,IAAI,uBAAuB,OAAO;EAEnD,IAAI;AACJ,MAAI;AACF,YAAS,MAAM,MAAM,KAAK,EACxB,QAAQ,OACT,CAAC;WACK,OAAO;AACd,OAAI,iBAAiB,UACnB,OAAM,MAAM,KAAK,oBAAoB,OAAO,QAAQ,SAAS,SAAS;AAExE,SAAM;;EAGR,MAAM,oBAAoB,MAAM,KAAK,iBAAiB,OAAO;AAC7D,MAAI,kBAAkB,WAAW,SAAS;AACxC,OAAI,yBAAyB,kBAAkB,MAAM,CACnD,QAAOG,2BAAO,MAAM,kBAAkB,MAAM;AAE9C,SAAM,kBAAkB;;AAG1B,MAAI,kBAAkB,KAAK,WAAW,IACpC,OAAM,IAAIH,0CAAuB,kDAAkD,kBAAkB,KAAK,SAAS;EAGrH,MAAM,OAAO,MAAM,kBAAkB,KAAK,MAAM;AAChD,MAAI,QAAQ,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,KAAK,CACjE,OAAM,IAAIA,0CAAuB,mDAAmD,EAAE,MAAM,CAAC;EAG/F,MAAM,WAAW,KAAK;AACtB,MAAI,OAAO,aAAa,SACtB,OAAM,IAAIA,0CAAuB,2DAA2D,EAAE,MAAM,CAAC;AAGvG,SAAOG,2BAAO,GAAG,SAAS;;CAG5B,MAAM,kBAAkB,SAKwF;AAC9G,MAAI,yBAAyB,KAAK,QAEhC,OAAM,IAAI,MAAM,2DAA2D;EAG7E,MAAM,eAAe,KAAK,QAAQ,wBAAwBC;AAC1D,SAAO,MAAM,KAAK,cAAc,OAAO,WAAW;AAChD,UAAO,MAAM,KAAK,wBAAwB,SAAS,cAAc,OAAO;IACxE;;CAGJ,MAAc,wBAAwB,SAKnC,cAAsB,QAA6H;EACpJ,MAAM,gBAAgB,SAAS;EAC/B,MAAM,KAAK;GACT,QAAQ,KAAK,QAAQ,YAAY;GACjC,WAAW;GACX,gBAAgB;GACjB;EACD,MAAM,SAAuB;GAC3B,WAAW,KAAK;GAChB,eAAe;GAChB;EACD,MAAM,uBAAuBC,iBAAuB,aAAa;EAGjE,MAAM,gBAAgB,cAAc,WAAW,UAAU;EAEzD,IAAI;AACJ,MAAI;AACF,YAASQ,qBAA2B,IAAI,QAAQ,QAAQ,aAAa,QAAQ,MAAM;WAC5E,GAAG;AACV,OAAI,aAAaC,2BACf,OAAM,IAAId,0CAAuB,qEAAqE;IAEpG,OAAO,OAAO,YAAY,EAAE,MAAM;IAClC,MAAM,EAAE;IACR,OAAO,EAAE;IACV,CAAC;AAEJ,SAAM,IAAIA,0CAAuB,yDAAyD,EAAE,OAAO,GAAG,CAAC;;EAEzG,MAAM,WAAW,MAAMe,8BACrB,IACA,QACA,sBACA,QACA,QAAQ,aACR,QAAQ,cACR,gBAAgB,GAAGR,wBAA8B,MAAM,GAAG,OAC3D;EAED,IAAI;AACJ,MAAI;AACF,YAAS,MAAMS,iCAAuC,IAAI,QAAQ,SAAS;WACpE,GAAG;AACV,OAAI,aAAaP,mBAAyB;AACxC,QAAK,EAAE,MAAc,SAAS,uCAC5B,OAAM,IAAIV,+BAAY,kCAAmC,EAAE,MAAc,QAAQ,aAAa;AAGhG,UAAM,IAAIC,0CAAuB,wDAAwD;KACvF,OAAO,EAAE;KACT,MAAM,EAAE;KACR,OAAO,EAAE;KACV,CAAC;;AAEJ,SAAM,IAAIA,0CAAuB,gEAAgE,EAAE,OAAO,GAAG,CAAC;;AAEhH,SAAO;GACL,SAAS,OAAO;GAChB,0BAA0B,OAAO;GACjC,aAAa,OAAO;GACpB,cAAc,OAAO,kDAA0B,kDAAkD;GAClG;;CAGH,MAAM,QAAQ,SAAyC;AAErD,MADiB,MAAM,QAAQ,4BAA4B,KAAQ,KAAK,EAC1D;GACZ,MAAM,aAAa,MAAM,KAAK,oCAC5B,0BACA;IACE,QAAQ;IACR,SAAS,EACP,gBAAgB,oBACjB;IACD,MAAM,KAAK,UAAU,EAAE,CAAC;IACzB,EACD,SACA,CAACD,+BAAY,kBAAkB,CAChC;AACD,OAAI,WAAW,WAAW,QACxB,KAAIA,+BAAY,kBAAkB,WAAW,WAAW,MAAM,EAAE,OAI9D,OAAM,IAAIC,0CAAuB,oBAAoB,EAAE,OAAO,WAAW,OAAO,CAAC;;AAMvF,UAAQ,aAAa;;CAGvB,MAAM,qBAAqB,SAA6E;EACtG,MAAM,kBAAkB,MAAM,KAAK,oCACjC,aACA,EAAE,EACF,SACA,CAACD,+BAAY,4BAA4B,CAC1C;AACD,MAAI,gBAAgB,WAAW,QAC7B,KAAIA,+BAAY,4BAA4B,WAAW,gBAAgB,MAAM,CAC3E,QAAO;MAEP,OAAM,IAAIC,0CAAuB,6BAA6B,EAAE,OAAO,gBAAgB,OAAO,CAAC;EAInG,MAAM,OAA0C,MAD/B,gBAAgB,KAC8B,MAAM;AACrE,MAAI,CAAE,KAAc,OAAM,IAAIA,0CAAuB,wDAAwD;AAC7G,SAAO;;CAGT,MAAM,oBACJ,SAGA,SACiD;AAOjD,UADe,OALE,MAAM,KAAK,kBAC1B,uBAAuB,IAAI,gBAAgB,EAAE,SAAS,QAAQ,QAAQ,CAAC,EACvE,EAAE,EACF,QACD,EAC6B,MAAM,EACtB;;CAGhB,MAAM,+BACJ,SACiD;AAOjD,UADe,OALE,MAAM,KAAK,kBAC1B,uBAAuB,IAAI,gBAAgB,EAAE,SAAS,MAAM,CAAC,EAC7D,EAAE,EACF,QACD,EAC6B,MAAM,EACtB;;CAGhB,MAAM,yBACJ,cACA,SACA;AACA,QAAM,KAAK,kBACT,0BAAS,qBAAqB,aAAa,WAAW,MAAM,IAAI,gBAAgB,EAAE,SAAS,MAAM,CAAC,EAClG,EAAE,QAAQ,QAAQ,EAClB,QACD;;CAGH,MAAM,qBACJ,cACA,QACA,SACA;AACA,QAAM,KAAK,kBACT,qBAAqB,aAAa,WAAW,UAC7C,EAAE,QAAQ,UAAU,EACpB,QACD;;CAGH,MAAM,uBACJ,SAIA,SACqD;AAUrD,UADe,OARE,MAAM,KAAK,kBAC1B,2BAA2B,IAAI,yDAAgC;GAC7D,SAAS,QAAQ;GACjB,SAAS,QAAQ;GAClB,CAAC,CAAC,EACH,EAAE,EACF,QACD,EAC6B,MAAM,EACtB;;CAGhB,MAAM,qBACJ,SAIA,SACmD;AAMnD,SAAO,OALU,MAAM,KAAK,kBAC1B,yBAAyB,QAAQ,OAAO,GAAG,QAAQ,UACnD,EAAE,EACF,QACD,EACqB,MAAM;;CAG9B,MAAM,UACJ,QACA,SACA;AACA,QAAM,KAAK,kBACT,qBAAqB,OAAO,MAC5B;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,EAAE,CAAC;GACzB,EACD,QACD;;CAGH,MAAM,wBACJ,SAKA,SACA;AACA,QAAM,KAAK,kBACT,yBAAyB,QAAQ,OAAO,GAAG,QAAQ,UACnD;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,QAAQ,QAAQ;GACtC,EACD,QACD;;CAGH,MAAM,WACJ,SAIA,SACA;AACA,QAAM,KAAK,kBACT,UAAU,QAAQ,UAClB;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,QAAQ,KAAK;GACnC,EACD,QACD;;CAGH,MAAM,+BACJ,SAIA,SACkD;AAOlD,UADe,OALE,MAAM,KAAK,kBAC1B,6BAA6B,QAAQ,OAAO,wBAAwB,QAAQ,aAC5E,EAAE,EACF,QACD,EAC6B,MAAM,EACtB;;CAGhB,MAAM,kCACJ,SAGA,SACqD;AAOrD,UADe,OALE,MAAM,KAAK,kBAC1B,6CAA6C,QAAQ,aACrD,EAAE,EACF,QACD,EAC6B,MAAM,EACtB;;CAGhB,MAAM,qBAAqB,SAAkE;AAO3F,UADe,OALE,MAAM,KAAK,kBAC1B,qBACA,EAAE,EACF,QACD,EAC6B,MAAM,EACtB;;CAGhB,MAAM,mBAA0G;EAC9G,MAAM,kBAAkB,MAAM,KAAK,oCAAoC,qBAAqB,EAAE,EAAE,MAAM,CAACD,+BAAY,gBAAgB,CAAC;AACpI,MAAI,gBAAgB,WAAW,QAC7B,QAAOI,2BAAO,MAAM,gBAAgB,MAAM;EAG5C,MAAM,UAAgD,MADrC,gBAAgB,KACoC,MAAM;AAC3E,SAAOA,2BAAO,GAAG,QAAQ;;CAG3B,MAAM,iBAAiB,QAA6C,SAA0B;AAC5F,QAAM,KAAK,kBACT,aACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,OAAO;GAC7B,EACD,QACD;;CAGH,MAAM,aAAa,SAA8E;EAC/F,MAAM,WAAW,MAAM,KAAK,kBAAkB,sBAAsB,EAAE,EAAE,QAAQ;AAChF,MAAI,CAAC,SAAS,GACZ,OAAM,IAAI,MAAM,8BAA8B,SAAS,SAAS,MAAO,MAAM,SAAS,MAAM,CAAE;AAIhG,UADa,MAAM,SAAS,MAAM,EACtB;;CAGd,MAAM,cACJ,SACA,SACkD;EAClD,MAAM,gBAAgB,MAAM,KAAK,kBAC/B,sBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,QAAQ;GAC9B,EACD,QACD;AACD,MAAI,CAAC,cAAc,GACjB,OAAM,IAAI,MAAM,+BAA+B,cAAc,SAAS,MAAO,MAAM,cAAc,MAAM,CAAE;AAI3G,SADa,MAAM,cAAc,MAAM;;CAIzC,MAAM,0BACJ,UACA,OACA,SAC4D;AAY5D,SAAO,OAXU,MAAM,KAAK,kBAC1B,0BAA0B,SAAS,gBACnC;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;GAChC,EACD,QACD,EACqB,MAAM;;;;;;CAO9B,MAAM,mCACJ,YACA,mBACA,OACA,SAC4D;AAY5D,SAAO,OAXU,MAAM,KAAK,kBAC1B,0BAA0B,mBAAmB,WAAW,CAAC,GAAG,mBAAmB,kBAAkB,CAAC,gBAClG;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,EAAE,OAAO,CAAC;GAChC,EACD,QACD,EACqB,MAAM;;;;;CAM9B,MAAM,sBACJ,SACiD;AAMjD,SAAO,OALU,MAAM,KAAK,kBAC1B,0BACA,EAAE,QAAQ,OAAO,EACjB,QACD,EACqB,MAAM;;CAG9B,MAAM,iBACJ,MACA,SACsC;AAYtC,SAAO,OAXU,MAAM,KAAK,kBAC1B,UACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,KAAK;GAC3B,EACD,QACD,EACqB,MAAM;;CAG9B,MAAM,WACJ,QACA,SACA;AACA,QAAM,KAAK,kBACT,UAAU,UACV,EACE,QAAQ,UACT,EACD,QACD;;CAGH,MAAM,kBAAkB,SAA0B;AAChD,QAAM,KAAK,kBACT,aACA,EACE,QAAQ,UACT,EACD,QACD;;CAGH,MAAM,2BACJ,MACA,SACgD;AAYhD,SAAO,OAXU,MAAM,KAAK,kBAC1B,qBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,KAAK;GAC3B,EACD,QACD,EACqB,MAAM;;CAG9B,MAAM,2BACJ,IACA,MACA,SACgD;AAYhD,SAAO,OAXU,MAAM,KAAK,kBAC1B,wBAAwB,MACxB;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,KAAK;GAC3B,EACD,QACD,EACqB,MAAM;;CAG9B,MAAM,2BACJ,IACA,SACe;AACf,QAAM,KAAK,kBACT,wBAAwB,MACxB,EACE,QAAQ,UACT,EACD,QACD;;CAGH,MAAM,cACJ,WACA,SACe;AACf,QAAM,KAAK,kBACT,kBAAkB,UAAU,cAC5B,EACE,QAAQ,UACT,EACD,QACD;;CAGH,MAAM,aACJ,SACyC;AAQzC,SAAO,OAPU,MAAM,KAAK,kBAC1B,6BACA,EACE,QAAQ,OACT,EACD,QACD,EACqB,MAAM;;CAI9B,MAAM,0BACJ,SACkD;AASlD,UADa,OAPI,MAAM,KAAK,kBAC1B,gCACA,EACE,QAAQ,OACT,EACD,QACD,EAC2B,MAAM,EACtB;;CAGd,MAAM,+CACJ,kBACA,aACA,SACiE;EACjE,MAAM,kBAAkB,MAAM,KAAK,oCACjC,wBAAwB,iBAAiB,0BACzC;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,EAAE,cAAc,aAAa,CAAC;GACpD,EACD,SACA,CAACJ,+BAAY,qBAAqB,CACnC;AAED,MAAI,gBAAgB,WAAW,QAC7B,QAAOI,2BAAO,MAAM,gBAAgB,MAAM;AAE5C,SAAOA,2BAAO,GAAG,OAAU;;CAG7B,MAAM,SACJ,WACA,cACA,SACwD;EACxD,MAAM,kBAAkB,MAAM,KAAK,oCACjC,sBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU;IACnB,YAAY;IACZ,eAAe;IAChB,CAAC;GACH,EACD,SACA,CAACJ,+BAAY,YAAY,CAC1B;AAED,MAAI,gBAAgB,WAAW,QAC7B,QAAOI,2BAAO,MAAM,gBAAgB,MAAM;AAE5C,SAAOA,2BAAO,GAAG,OAAU;;CAG7B,MAAc,sBAAsB,SAA2D;AAC7F,MAAI,aAAa,WAAW,aAAa,QACvC,OAAM,IAAIH,0CAAuB,mEAAmE;AAGtG,SAAO;GACL,UAAU,aAAa,UAAU,mBAAmB;GACpD,aAAa,IAAI,+DAAsC,QAAQ,CAAC;GACjE;;CAOH,MAAM,mBACJ,SACA,SACA,aACoF;EACpF,MAAM,eAAe,gBAAgB,WAAW,KAAK,oBAAqB,KAAa,mBAA4B,KAAK,KAAK;EAC7H,MAAM,EAAE,UAAU,gBAAgB,MAAM,KAAK,sBAAsB,QAAQ;AAW3E,UADa,OARI,MAAM,YACrB,GAAG,SAAS,GAAG,YAAY,UAAU,IACrC,EACE,QAAQ,OACT,EACD,SACA,YACD,EAC2B,MAAM,EACtB;;CAMd,MAAM,oBACJ,MACA,SACA,aACoH;EACpH,MAAM,eAAe,gBAAgB,WAAW,KAAK,oBAAqB,KAAa,mBAA4B,KAAK,KAAK;EAC7H,MAAM,EAAE,aAAa,MAAM,KAAK,sBAAsB,KAAK;AAc3D,SAAO,OAZU,MAAM,YACrB,GAAG,YACH;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,KAAK;GAC3B,EACD,SACA,YACD,EACqB,MAAM;;CAM9B,MAAM,iBACJ,SACA,OACA,SACA,aACgF;EAChF,MAAM,eAAe,gBAAgB,WAAW,KAAK,oBAAqB,KAAa,mBAA4B,KAAK,KAAK;EAC7H,MAAM,EAAE,UAAU,gBAAgB,MAAM,KAAK,sBAAsB,QAAQ;AAU3E,SAAO,OARU,MAAM,YACrB,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,UAAU,IAC9C,EACE,QAAQ,OACT,EACD,SACA,YACD,EACqB,MAAM;;CAM9B,MAAM,oBACJ,SACA,OACA,MACA,SACA,aACgF;EAChF,MAAM,eAAe,gBAAgB,WAAW,KAAK,oBAAqB,KAAa,mBAA4B,KAAK,KAAK;EAC7H,MAAM,EAAE,UAAU,gBAAgB,MAAM,KAAK,sBAAsB,QAAQ;AAc3E,SAAO,OAZU,MAAM,YACrB,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,UAAU,IAC9C;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,KAAK;GAC3B,EACD,SACA,YACD,EACqB,MAAM;;CAM9B,MAAM,mBAAmB,MAAuB,QAAgB,SAAiC,aAAmI;EAElO,MAAM,SAAS,OADM,gBAAgB,WAAW,KAAK,sCAAuC,KAAa,qCAA8C,KAAK,KAAK,CAE/J,IAAI,KAAK,kBACT;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,EAAE,SAAS,QAAQ,CAAC;GAC1C,EACD,SACA,CAACD,+BAAY,eAAe,CAC7B;AACD,MAAI,OAAO,WAAW,QACpB,QAAO;AAET,SAAO,MAAM,OAAO,KAAK,MAAM;;CAGjC,MAAM,2BACJ,SACyD;AAOzD,UADe,OALE,MAAM,KAAK,kBAC1B,sCACA,EAAE,EACF,QACD,EAC6B,MAAM,EACtB;;CAGhB,MAAM,wBACJ,wBACA,SACA,SACe;AACf,QAAM,KAAK,kBACT,sCAAsC,0BACtC;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,EACnB,SACD,CAAC;GACH,EACD,QACD;;CAGH,MAAM,iBACJ,QACA,YACA,SAC8C;AAQ9C,SAAO,OAPU,MAAM,KAAK,kBAC1B,oBAAoB,OAAO,GAAG,cAC9B,EACE,QAAQ,OACT,EACD,QACD,EACqB,MAAM;;CAG9B,MAAM,oBACJ,QACA,YACA,MACA,SAC8C;AAY9C,SAAO,OAXU,MAAM,KAAK,kBAC1B,oBAAoB,OAAO,GAAG,cAC9B;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,KAAK;GAC3B,EACD,QACD,EACqB,MAAM;;CAG9B,MAAM,mBACJ,UAEI,EAAE,EACN,SACgD;EAChD,MAAM,cAAc,IAAI,yDAAgC,QAAQ,CAAC;AASjE,UADe,OAPE,MAAM,KAAK,kBAC1B,mBAAmB,YAAY,UAAU,GAAG,IAAI,YAAY,UAAU,KAAK,MAC3E,EACE,QAAQ,OACT,EACD,QACD,EAC6B,MAAM,EACtB;;CAGhB,MAAM,oBACJ,QACA,YACA,SACe;AAQf,SAAO,OAPU,MAAM,KAAK,kBAC1B,oBAAoB,OAAO,GAAG,cAC9B,EACE,QAAQ,UACT,EACD,QACD,EACqB,MAAM;;CAG9B,MAAM,QACJ,SAKA,SACA,cAA6C,UACR;EACrC,IAAI;EACJ,IAAI;AACJ,MAAI,YAAY,SAAS;AACvB,kBAAe;AACf,gBAAa,QAAQ;aACZ,YAAY,SAAS;AAC9B,kBAAe;AACf,gBAAa,QAAQ;aACZ,sBAAsB,SAAS;AACxC,kBAAe;AACf,gBAAa,QAAQ;QAErB,OAAM,IAAIC,0CAAuB,8DAA8D;AAUjG,SAAO,OANU,OADI,gBAAgB,WAAW,KAAK,oBAAqB,KAAa,mBAA4B,KAAK,KAAK,CAE3H,0BAAS,mBAAmB,aAAa,GAAG,WAAW,GAAG,QAAQ,UAClE,EAAE,EACF,SACA,YACD,EACqB,MAAM;;CAG9B,MAAM,aACJ,SACA,SACA,cAA6C,UACN;EACvC,MAAM,cAAc,IAAI,yDAAgC;GACtD,QAAQ,QAAQ;GAChB,OAAO,QAAQ,UAAU,SAAY,QAAQ,MAAM,UAAU,GAAG;GACjE,CAAC,CAAC;EACH,MAAM,OAAO,0BAAS,sBAAsB,QAAQ,cAAc,GAAG,QAAQ;AAQ7E,SAAO,OANU,OADI,gBAAgB,WAAW,KAAK,oBAAqB,KAAa,mBAA4B,KAAK,KAAK,CAE3H,GAAG,OAAO,YAAY,UAAU,GAAG,IAAI,YAAY,UAAU,KAAK,MAClE,EAAE,EACF,SACA,YACD,EACqB,MAAM;;CAG9B,MAAM,aACJ,SACA,SACuC;EACvC,MAAM,cAAc,IAAI,yDAAgC;GACtD,QAAQ,QAAQ;GAChB,OAAO,QAAQ,UAAU,SAAY,QAAQ,MAAM,UAAU,GAAG;GACjE,CAAC,CAAC;EACH,MAAM,OAAO,0BAAS,sBAAsB,QAAQ,cAAc,GAAG,QAAQ;AAM7E,SAAO,OALU,MAAM,KAAK,kBAC1B,GAAG,OAAO,YAAY,UAAU,GAAG,IAAI,YAAY,UAAU,KAAK,MAClE,EAAE,EACF,QACD,EACqB,MAAM;;CAG9B,MAAM,mBACJ,SAMA,SACe;EACf,MAAM,cAAc,IAAI,yDAAgC,EACtD,iBAAiB,QAAQ,iBAC1B,CAAC,CAAC;EACH,MAAM,OAAO,0BAAS,sBAAsB,QAAQ,cAAc,GAAG,QAAQ,YAAY,GAAG,QAAQ;AACpG,QAAM,KAAK,kBACT,GAAG,OAAO,YAAY,UAAU,GAAG,IAAI,YAAY,UAAU,KAAK,MAClE,EACE,QAAQ,UACT,EACD,QACD;;CAGH,MAAM,mBACJ,SAQA,SACe;AACf,QAAM,KAAK,kBACT,0BAAS,sBAAsB,QAAQ,cAAc,GAAG,QAAQ,YAAY,UAC5E;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU;IACnB,iBAAiB,QAAQ;IACzB,eAAe,QAAQ;IACvB,UAAU,QAAQ;IAClB,UAAU,QAAQ;IACnB,CAAC;GACH,EACD,QACD;;CAGH,MAAM,kBACJ,eACA,aACA,mBACA,SACA,WACA,cAA6C,UAC5B;EACjB,MAAM,cAAc,OAAO,sBAAsB,WAC/C,EAAE,YAAY,mBAAmB,GACjC,EAAE,gBAAgB,mBAAmB;EAcvC,MAAM,EAAE,QAAQ,OAZC,OADI,gBAAgB,WAAW,KAAK,oBAAqB,KAAa,mBAA4B,KAAK,KAAK,CAE3H,2CACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU;IAAE;IAAe;IAAa,GAAG;IAAa,YAAY;IAAW,CAAC;GAC5F,EACD,SACA,YACD,EAC8B,MAAM;AACrC,SAAO;;CAGT,MAAM,mBACJ,cACA,YACA,SAUC;AAMD,SAAO,OALU,MAAM,KAAK,kBAC1B,0BAAS,qBAAqB,aAAa,GAAG,cAC9C,EAAE,EACF,QACD,EACqB,MAAM;;CAG9B,MAAM,uCACJ,cACA,YACA,SAIC;AAYD,SAAO,OAXU,MAAM,KAAK,kBAC1B,0BAAS,4BAA4B,aAAa,GAAG,WAAW,gBAChE;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,EAAE,CAAC;GACzB,EACD,QACD,EACqB,MAAM;;CAG9B,MAAM,+CACJ,cACA,YACA,eACA,SASC;AAcD,SAAO,OAbU,MAAM,KAAK,kBAC1B,0BAAS,4BAA4B,aAAa,GAAG,WAAW,eAChE;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU,EACnB,iBAAiB,eAClB,CAAC;GACH,EACD,QACD,EACqB,MAAM;;CAG9B,MAAM,gBAAgB,wBAAyC,qBAA6B,WAAkC;AAC5H,MAAI,KAAK,QAAQ,cAAc,WAC7B,OAAM,IAAIA,0CAAuB,uIAAuI;AAE1K,QAAM,KAAK,kBACT,+BACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,oBACjB;GACD,MAAM,KAAK,UAAU;IACnB,YAAY;IACZ,aAAa;IACd,CAAC;GACH,EACD,uBACD"}
+{"version":3,"file":"client-interface.js","names":["KnownErrors","HexclaveAssertionError","globalVar","KnownError","Result","publishableClientKeyNotNecessarySentinel","oauth.ClientSecretPost","oauth.refreshTokenGrantRequest","oauth.allowInsecureRequests","oauth.processRefreshTokenResponse","oauth.ResponseBodyError","AccessToken","InternalSession","HTTP_METHODS","oauth.validateAuthResponse","oauth.AuthorizationResponseError","oauth.authorizationCodeGrantRequest","oauth.processAuthorizationCodeResponse"],"sources":["../../../../node_modules/.pnpm/oauth4webapi@3.8.5/node_modules/oauth4webapi/build/index.js","../../src/interface/client-interface.ts"],"sourcesContent":["let USER_AGENT;\nif (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {\n    const NAME = 'oauth4webapi';\n    const VERSION = 'v3.8.5';\n    USER_AGENT = `${NAME}/${VERSION}`;\n}\nfunction looseInstanceOf(input, expected) {\n    if (input == null) {\n        return false;\n    }\n    try {\n        return (input instanceof expected ||\n            Object.getPrototypeOf(input)[Symbol.toStringTag] === expected.prototype[Symbol.toStringTag]);\n    }\n    catch {\n        return false;\n    }\n}\nconst ERR_INVALID_ARG_VALUE = 'ERR_INVALID_ARG_VALUE';\nconst ERR_INVALID_ARG_TYPE = 'ERR_INVALID_ARG_TYPE';\nfunction CodedTypeError(message, code, cause) {\n    const err = new TypeError(message, { cause });\n    Object.assign(err, { code });\n    return err;\n}\nexport const allowInsecureRequests = Symbol();\nexport const clockSkew = Symbol();\nexport const clockTolerance = Symbol();\nexport const customFetch = Symbol();\nexport const modifyAssertion = Symbol();\nexport const jweDecrypt = Symbol();\nexport const jwksCache = Symbol();\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\nfunction buf(input) {\n    if (typeof input === 'string') {\n        return encoder.encode(input);\n    }\n    return decoder.decode(input);\n}\nlet encodeBase64Url;\nif (Uint8Array.prototype.toBase64) {\n    encodeBase64Url = (input) => {\n        if (input instanceof ArrayBuffer) {\n            input = new Uint8Array(input);\n        }\n        return input.toBase64({ alphabet: 'base64url', omitPadding: true });\n    };\n}\nelse {\n    const CHUNK_SIZE = 0x8000;\n    encodeBase64Url = (input) => {\n        if (input instanceof ArrayBuffer) {\n            input = new Uint8Array(input);\n        }\n        const arr = [];\n        for (let i = 0; i < input.byteLength; i += CHUNK_SIZE) {\n            arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n        }\n        return btoa(arr.join('')).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n    };\n}\nlet decodeBase64Url;\nif (Uint8Array.fromBase64) {\n    decodeBase64Url = (input) => {\n        try {\n            return Uint8Array.fromBase64(input, { alphabet: 'base64url' });\n        }\n        catch (cause) {\n            throw CodedTypeError('The input to be decoded is not correctly encoded.', ERR_INVALID_ARG_VALUE, cause);\n        }\n    };\n}\nelse {\n    decodeBase64Url = (input) => {\n        try {\n            const binary = atob(input.replace(/-/g, '+').replace(/_/g, '/').replace(/\\s/g, ''));\n            const bytes = new Uint8Array(binary.length);\n            for (let i = 0; i < binary.length; i++) {\n                bytes[i] = binary.charCodeAt(i);\n            }\n            return bytes;\n        }\n        catch (cause) {\n            throw CodedTypeError('The input to be decoded is not correctly encoded.', ERR_INVALID_ARG_VALUE, cause);\n        }\n    };\n}\nfunction b64u(input) {\n    if (typeof input === 'string') {\n        return decodeBase64Url(input);\n    }\n    return encodeBase64Url(input);\n}\nexport class UnsupportedOperationError extends Error {\n    code;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        this.code = UNSUPPORTED_OPERATION;\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class OperationProcessingError extends Error {\n    code;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        if (options?.code) {\n            this.code = options?.code;\n        }\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nfunction OPE(message, code, cause) {\n    return new OperationProcessingError(message, { code, cause });\n}\nasync function calculateJwkThumbprint(jwk) {\n    let components;\n    switch (jwk.kty) {\n        case 'EC':\n            components = {\n                crv: jwk.crv,\n                kty: jwk.kty,\n                x: jwk.x,\n                y: jwk.y,\n            };\n            break;\n        case 'OKP':\n            components = {\n                crv: jwk.crv,\n                kty: jwk.kty,\n                x: jwk.x,\n            };\n            break;\n        case 'AKP':\n            components = {\n                alg: jwk.alg,\n                kty: jwk.kty,\n                pub: jwk.pub,\n            };\n            break;\n        case 'RSA':\n            components = {\n                e: jwk.e,\n                kty: jwk.kty,\n                n: jwk.n,\n            };\n            break;\n        default:\n            throw new UnsupportedOperationError('unsupported JWK key type', { cause: jwk });\n    }\n    return b64u(await crypto.subtle.digest('SHA-256', buf(JSON.stringify(components))));\n}\nfunction assertCryptoKey(key, it) {\n    if (!(key instanceof CryptoKey)) {\n        throw CodedTypeError(`${it} must be a CryptoKey`, ERR_INVALID_ARG_TYPE);\n    }\n}\nfunction assertPrivateKey(key, it) {\n    assertCryptoKey(key, it);\n    if (key.type !== 'private') {\n        throw CodedTypeError(`${it} must be a private CryptoKey`, ERR_INVALID_ARG_VALUE);\n    }\n}\nfunction assertPublicKey(key, it) {\n    assertCryptoKey(key, it);\n    if (key.type !== 'public') {\n        throw CodedTypeError(`${it} must be a public CryptoKey`, ERR_INVALID_ARG_VALUE);\n    }\n}\nfunction normalizeTyp(value) {\n    return value.toLowerCase().replace(/^application\\//, '');\n}\nfunction isJsonObject(input) {\n    if (input === null || typeof input !== 'object' || Array.isArray(input)) {\n        return false;\n    }\n    return true;\n}\nfunction prepareHeaders(input) {\n    if (looseInstanceOf(input, Headers)) {\n        input = Object.fromEntries(input.entries());\n    }\n    const headers = new Headers(input ?? {});\n    if (USER_AGENT && !headers.has('user-agent')) {\n        headers.set('user-agent', USER_AGENT);\n    }\n    if (headers.has('authorization')) {\n        throw CodedTypeError('\"options.headers\" must not include the \"authorization\" header name', ERR_INVALID_ARG_VALUE);\n    }\n    return headers;\n}\nfunction signal(url, value) {\n    if (value !== undefined) {\n        if (typeof value === 'function') {\n            value = value(url.href);\n        }\n        if (!(value instanceof AbortSignal)) {\n            throw CodedTypeError('\"options.signal\" must return or be an instance of AbortSignal', ERR_INVALID_ARG_TYPE);\n        }\n        return value;\n    }\n    return undefined;\n}\nfunction replaceDoubleSlash(pathname) {\n    if (pathname.includes('//')) {\n        return pathname.replace('//', '/');\n    }\n    return pathname;\n}\nfunction prependWellKnown(url, wellKnown, allowTerminatingSlash = false) {\n    if (url.pathname === '/') {\n        url.pathname = wellKnown;\n    }\n    else {\n        url.pathname = replaceDoubleSlash(`${wellKnown}/${allowTerminatingSlash ? url.pathname : url.pathname.replace(/(\\/)$/, '')}`);\n    }\n    return url;\n}\nfunction appendWellKnown(url, wellKnown) {\n    url.pathname = replaceDoubleSlash(`${url.pathname}/${wellKnown}`);\n    return url;\n}\nasync function performDiscovery(input, urlName, transform, options) {\n    if (!(input instanceof URL)) {\n        throw CodedTypeError(`\"${urlName}\" must be an instance of URL`, ERR_INVALID_ARG_TYPE);\n    }\n    checkProtocol(input, options?.[allowInsecureRequests] !== true);\n    const url = transform(new URL(input.href));\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    return (options?.[customFetch] || fetch)(url.href, {\n        body: undefined,\n        headers: Object.fromEntries(headers.entries()),\n        method: 'GET',\n        redirect: 'manual',\n        signal: signal(url, options?.signal),\n    });\n}\nexport async function discoveryRequest(issuerIdentifier, options) {\n    return performDiscovery(issuerIdentifier, 'issuerIdentifier', (url) => {\n        switch (options?.algorithm) {\n            case undefined:\n            case 'oidc':\n                appendWellKnown(url, '.well-known/openid-configuration');\n                break;\n            case 'oauth2':\n                prependWellKnown(url, '.well-known/oauth-authorization-server');\n                break;\n            default:\n                throw CodedTypeError('\"options.algorithm\" must be \"oidc\" (default), or \"oauth2\"', ERR_INVALID_ARG_VALUE);\n        }\n        return url;\n    }, options);\n}\nfunction assertNumber(input, allow0, it, code, cause) {\n    try {\n        if (typeof input !== 'number' || !Number.isFinite(input)) {\n            throw CodedTypeError(`${it} must be a number`, ERR_INVALID_ARG_TYPE, cause);\n        }\n        if (input > 0)\n            return;\n        if (allow0) {\n            if (input !== 0) {\n                throw CodedTypeError(`${it} must be a non-negative number`, ERR_INVALID_ARG_VALUE, cause);\n            }\n            return;\n        }\n        throw CodedTypeError(`${it} must be a positive number`, ERR_INVALID_ARG_VALUE, cause);\n    }\n    catch (err) {\n        if (code) {\n            throw OPE(err.message, code, cause);\n        }\n        throw err;\n    }\n}\nfunction assertString(input, it, code, cause) {\n    try {\n        if (typeof input !== 'string') {\n            throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE, cause);\n        }\n        if (input.length === 0) {\n            throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE, cause);\n        }\n    }\n    catch (err) {\n        if (code) {\n            throw OPE(err.message, code, cause);\n        }\n        throw err;\n    }\n}\nexport async function processDiscoveryResponse(expectedIssuerIdentifier, response) {\n    const expected = expectedIssuerIdentifier;\n    if (!(expected instanceof URL) && expected !== _nodiscoverycheck) {\n        throw CodedTypeError('\"expectedIssuerIdentifier\" must be an instance of URL', ERR_INVALID_ARG_TYPE);\n    }\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    if (response.status !== 200) {\n        throw OPE('\"response\" is not a conform Authorization Server Metadata response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);\n    }\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.issuer, '\"response\" body \"issuer\" property', INVALID_RESPONSE, { body: json });\n    if (expected !== _nodiscoverycheck && new URL(json.issuer).href !== expected.href) {\n        throw OPE('\"response\" body \"issuer\" property does not match the expected value', JSON_ATTRIBUTE_COMPARISON, { expected: expected.href, body: json, attribute: 'issuer' });\n    }\n    return json;\n}\nfunction assertApplicationJson(response) {\n    assertContentType(response, 'application/json');\n}\nfunction notJson(response, ...types) {\n    let msg = '\"response\" content-type must be ';\n    if (types.length > 2) {\n        const last = types.pop();\n        msg += `${types.join(', ')}, or ${last}`;\n    }\n    else if (types.length === 2) {\n        msg += `${types[0]} or ${types[1]}`;\n    }\n    else {\n        msg += types[0];\n    }\n    return OPE(msg, RESPONSE_IS_NOT_JSON, response);\n}\nfunction assertContentTypes(response, ...types) {\n    if (!types.includes(getContentType(response))) {\n        throw notJson(response, ...types);\n    }\n}\nfunction assertContentType(response, contentType) {\n    if (getContentType(response) !== contentType) {\n        throw notJson(response, contentType);\n    }\n}\nfunction randomBytes() {\n    return b64u(crypto.getRandomValues(new Uint8Array(32)));\n}\nexport function generateRandomCodeVerifier() {\n    return randomBytes();\n}\nexport function generateRandomState() {\n    return randomBytes();\n}\nexport function generateRandomNonce() {\n    return randomBytes();\n}\nexport async function calculatePKCECodeChallenge(codeVerifier) {\n    assertString(codeVerifier, 'codeVerifier');\n    return b64u(await crypto.subtle.digest('SHA-256', buf(codeVerifier)));\n}\nfunction getKeyAndKid(input) {\n    if (input instanceof CryptoKey) {\n        return { key: input };\n    }\n    if (!(input?.key instanceof CryptoKey)) {\n        return {};\n    }\n    if (input.kid !== undefined) {\n        assertString(input.kid, '\"kid\"');\n    }\n    return {\n        key: input.key,\n        kid: input.kid,\n    };\n}\nfunction psAlg(key) {\n    switch (key.algorithm.hash.name) {\n        case 'SHA-256':\n            return 'PS256';\n        case 'SHA-384':\n            return 'PS384';\n        case 'SHA-512':\n            return 'PS512';\n        default:\n            throw new UnsupportedOperationError('unsupported RsaHashedKeyAlgorithm hash name', {\n                cause: key,\n            });\n    }\n}\nfunction rsAlg(key) {\n    switch (key.algorithm.hash.name) {\n        case 'SHA-256':\n            return 'RS256';\n        case 'SHA-384':\n            return 'RS384';\n        case 'SHA-512':\n            return 'RS512';\n        default:\n            throw new UnsupportedOperationError('unsupported RsaHashedKeyAlgorithm hash name', {\n                cause: key,\n            });\n    }\n}\nfunction esAlg(key) {\n    switch (key.algorithm.namedCurve) {\n        case 'P-256':\n            return 'ES256';\n        case 'P-384':\n            return 'ES384';\n        case 'P-521':\n            return 'ES512';\n        default:\n            throw new UnsupportedOperationError('unsupported EcKeyAlgorithm namedCurve', { cause: key });\n    }\n}\nfunction keyToJws(key) {\n    switch (key.algorithm.name) {\n        case 'RSA-PSS':\n            return psAlg(key);\n        case 'RSASSA-PKCS1-v1_5':\n            return rsAlg(key);\n        case 'ECDSA':\n            return esAlg(key);\n        case 'Ed25519':\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            return key.algorithm.name;\n        case 'EdDSA':\n            return 'Ed25519';\n        default:\n            throw new UnsupportedOperationError('unsupported CryptoKey algorithm name', { cause: key });\n    }\n}\nfunction getClockSkew(client) {\n    const skew = client?.[clockSkew];\n    return typeof skew === 'number' && Number.isFinite(skew) ? skew : 0;\n}\nfunction getClockTolerance(client) {\n    const tolerance = client?.[clockTolerance];\n    return typeof tolerance === 'number' && Number.isFinite(tolerance) && Math.sign(tolerance) !== -1\n        ? tolerance\n        : 30;\n}\nfunction epochTime() {\n    return Math.floor(Date.now() / 1000);\n}\nfunction assertAs(as) {\n    if (typeof as !== 'object' || as === null) {\n        throw CodedTypeError('\"as\" must be an object', ERR_INVALID_ARG_TYPE);\n    }\n    assertString(as.issuer, '\"as.issuer\"');\n}\nfunction assertClient(client) {\n    if (typeof client !== 'object' || client === null) {\n        throw CodedTypeError('\"client\" must be an object', ERR_INVALID_ARG_TYPE);\n    }\n    assertString(client.client_id, '\"client.client_id\"');\n}\nfunction formUrlEncode(token) {\n    return encodeURIComponent(token).replace(/(?:[-_.!~*'()]|%20)/g, (substring) => {\n        switch (substring) {\n            case '-':\n            case '_':\n            case '.':\n            case '!':\n            case '~':\n            case '*':\n            case \"'\":\n            case '(':\n            case ')':\n                return `%${substring.charCodeAt(0).toString(16).toUpperCase()}`;\n            case '%20':\n                return '+';\n            default:\n                throw new Error();\n        }\n    });\n}\nexport function ClientSecretPost(clientSecret) {\n    assertString(clientSecret, '\"clientSecret\"');\n    return (_as, client, body, _headers) => {\n        body.set('client_id', client.client_id);\n        body.set('client_secret', clientSecret);\n    };\n}\nexport function ClientSecretBasic(clientSecret) {\n    assertString(clientSecret, '\"clientSecret\"');\n    return (_as, client, _body, headers) => {\n        const username = formUrlEncode(client.client_id);\n        const password = formUrlEncode(clientSecret);\n        const credentials = btoa(`${username}:${password}`);\n        headers.set('authorization', `Basic ${credentials}`);\n    };\n}\nfunction clientAssertionPayload(as, client) {\n    const now = epochTime() + getClockSkew(client);\n    return {\n        jti: randomBytes(),\n        aud: as.issuer,\n        exp: now + 60,\n        iat: now,\n        nbf: now,\n        iss: client.client_id,\n        sub: client.client_id,\n    };\n}\nexport function PrivateKeyJwt(clientPrivateKey, options) {\n    const { key, kid } = getKeyAndKid(clientPrivateKey);\n    assertPrivateKey(key, '\"clientPrivateKey.key\"');\n    return async (as, client, body, _headers) => {\n        const header = { alg: keyToJws(key), kid };\n        const payload = clientAssertionPayload(as, client);\n        options?.[modifyAssertion]?.(header, payload);\n        body.set('client_id', client.client_id);\n        body.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');\n        body.set('client_assertion', await signJwt(header, payload, key));\n    };\n}\nexport function ClientSecretJwt(clientSecret, options) {\n    assertString(clientSecret, '\"clientSecret\"');\n    const modify = options?.[modifyAssertion];\n    let key;\n    return async (as, client, body, _headers) => {\n        key ||= await crypto.subtle.importKey('raw', buf(clientSecret), { hash: 'SHA-256', name: 'HMAC' }, false, ['sign']);\n        const header = { alg: 'HS256' };\n        const payload = clientAssertionPayload(as, client);\n        modify?.(header, payload);\n        const data = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(payload)))}`;\n        const hmac = await crypto.subtle.sign(key.algorithm, key, buf(data));\n        body.set('client_id', client.client_id);\n        body.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');\n        body.set('client_assertion', `${data}.${b64u(new Uint8Array(hmac))}`);\n    };\n}\nexport function None() {\n    return (_as, client, body, _headers) => {\n        body.set('client_id', client.client_id);\n    };\n}\nexport function TlsClientAuth() {\n    return None();\n}\nasync function signJwt(header, payload, key) {\n    if (!key.usages.includes('sign')) {\n        throw CodedTypeError('CryptoKey instances used for signing assertions must include \"sign\" in their \"usages\"', ERR_INVALID_ARG_VALUE);\n    }\n    const input = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(payload)))}`;\n    const signature = b64u(await crypto.subtle.sign(keyToSubtle(key), key, buf(input)));\n    return `${input}.${signature}`;\n}\nexport async function issueRequestObject(as, client, parameters, privateKey, options) {\n    assertAs(as);\n    assertClient(client);\n    parameters = new URLSearchParams(parameters);\n    const { key, kid } = getKeyAndKid(privateKey);\n    assertPrivateKey(key, '\"privateKey.key\"');\n    parameters.set('client_id', client.client_id);\n    const now = epochTime() + getClockSkew(client);\n    const claims = {\n        ...Object.fromEntries(parameters.entries()),\n        jti: randomBytes(),\n        aud: as.issuer,\n        exp: now + 60,\n        iat: now,\n        nbf: now,\n        iss: client.client_id,\n    };\n    let resource;\n    if (parameters.has('resource') &&\n        (resource = parameters.getAll('resource')) &&\n        resource.length > 1) {\n        claims.resource = resource;\n    }\n    {\n        let value = parameters.get('max_age');\n        if (value !== null) {\n            claims.max_age = parseInt(value, 10);\n            assertNumber(claims.max_age, true, '\"max_age\" parameter');\n        }\n    }\n    {\n        let value = parameters.get('claims');\n        if (value !== null) {\n            try {\n                claims.claims = JSON.parse(value);\n            }\n            catch (cause) {\n                throw OPE('failed to parse the \"claims\" parameter as JSON', PARSE_ERROR, cause);\n            }\n            if (!isJsonObject(claims.claims)) {\n                throw CodedTypeError('\"claims\" parameter must be a JSON with a top level object', ERR_INVALID_ARG_VALUE);\n            }\n        }\n    }\n    {\n        let value = parameters.get('authorization_details');\n        if (value !== null) {\n            try {\n                claims.authorization_details = JSON.parse(value);\n            }\n            catch (cause) {\n                throw OPE('failed to parse the \"authorization_details\" parameter as JSON', PARSE_ERROR, cause);\n            }\n            if (!Array.isArray(claims.authorization_details)) {\n                throw CodedTypeError('\"authorization_details\" parameter must be a JSON with a top level array', ERR_INVALID_ARG_VALUE);\n            }\n        }\n    }\n    const header = {\n        alg: keyToJws(key),\n        typ: 'oauth-authz-req+jwt',\n        kid,\n    };\n    options?.[modifyAssertion]?.(header, claims);\n    return signJwt(header, claims, key);\n}\nlet jwkCache;\nasync function getSetPublicJwkCache(key, alg) {\n    const { kty, e, n, x, y, crv, pub } = await crypto.subtle.exportKey('jwk', key);\n    const jwk = { kty, e, n, x, y, crv, pub };\n    if (kty === 'AKP')\n        jwk.alg = alg;\n    jwkCache.set(key, jwk);\n    return jwk;\n}\nasync function publicJwk(key, alg) {\n    jwkCache ||= new WeakMap();\n    return jwkCache.get(key) || getSetPublicJwkCache(key, alg);\n}\nconst URLParse = URL.parse\n    ?\n        (url, base) => URL.parse(url, base)\n    : (url, base) => {\n        try {\n            return new URL(url, base);\n        }\n        catch {\n            return null;\n        }\n    };\nexport function checkProtocol(url, enforceHttps) {\n    if (enforceHttps && url.protocol !== 'https:') {\n        throw OPE('only requests to HTTPS are allowed', HTTP_REQUEST_FORBIDDEN, url);\n    }\n    if (url.protocol !== 'https:' && url.protocol !== 'http:') {\n        throw OPE('only HTTP and HTTPS requests are allowed', REQUEST_PROTOCOL_FORBIDDEN, url);\n    }\n}\nfunction validateEndpoint(value, endpoint, useMtlsAlias, enforceHttps) {\n    let url;\n    if (typeof value !== 'string' || !(url = URLParse(value))) {\n        throw OPE(`authorization server metadata does not contain a valid ${useMtlsAlias ? `\"as.mtls_endpoint_aliases.${endpoint}\"` : `\"as.${endpoint}\"`}`, value === undefined ? MISSING_SERVER_METADATA : INVALID_SERVER_METADATA, { attribute: useMtlsAlias ? `mtls_endpoint_aliases.${endpoint}` : endpoint });\n    }\n    checkProtocol(url, enforceHttps);\n    return url;\n}\nexport function resolveEndpoint(as, endpoint, useMtlsAlias, enforceHttps) {\n    if (useMtlsAlias && as.mtls_endpoint_aliases && endpoint in as.mtls_endpoint_aliases) {\n        return validateEndpoint(as.mtls_endpoint_aliases[endpoint], endpoint, useMtlsAlias, enforceHttps);\n    }\n    return validateEndpoint(as[endpoint], endpoint, useMtlsAlias, enforceHttps);\n}\nexport async function pushedAuthorizationRequest(as, client, clientAuthentication, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'pushed_authorization_request_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(parameters);\n    body.set('client_id', client.client_id);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    if (options?.DPoP !== undefined) {\n        assertDPoP(options.DPoP);\n        await options.DPoP.addProof(url, headers, 'POST');\n    }\n    const response = await authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n    options?.DPoP?.cacheNonce(response, url);\n    return response;\n}\nclass DPoPHandler {\n    #header;\n    #privateKey;\n    #publicKey;\n    #clockSkew;\n    #modifyAssertion;\n    #map;\n    #jkt;\n    constructor(client, keyPair, options) {\n        assertPrivateKey(keyPair?.privateKey, '\"DPoP.privateKey\"');\n        assertPublicKey(keyPair?.publicKey, '\"DPoP.publicKey\"');\n        if (!keyPair.publicKey.extractable) {\n            throw CodedTypeError('\"DPoP.publicKey.extractable\" must be true', ERR_INVALID_ARG_VALUE);\n        }\n        this.#modifyAssertion = options?.[modifyAssertion];\n        this.#clockSkew = getClockSkew(client);\n        this.#privateKey = keyPair.privateKey;\n        this.#publicKey = keyPair.publicKey;\n        branded.add(this);\n    }\n    #get(key) {\n        this.#map ||= new Map();\n        let item = this.#map.get(key);\n        if (item) {\n            this.#map.delete(key);\n            this.#map.set(key, item);\n        }\n        return item;\n    }\n    #set(key, val) {\n        this.#map ||= new Map();\n        this.#map.delete(key);\n        if (this.#map.size === 100) {\n            this.#map.delete(this.#map.keys().next().value);\n        }\n        this.#map.set(key, val);\n    }\n    async calculateThumbprint() {\n        if (!this.#jkt) {\n            const jwk = await crypto.subtle.exportKey('jwk', this.#publicKey);\n            this.#jkt ||= await calculateJwkThumbprint(jwk);\n        }\n        return this.#jkt;\n    }\n    async addProof(url, headers, htm, accessToken) {\n        const alg = keyToJws(this.#privateKey);\n        this.#header ||= {\n            alg,\n            typ: 'dpop+jwt',\n            jwk: await publicJwk(this.#publicKey, alg),\n        };\n        const nonce = this.#get(url.origin);\n        const now = epochTime() + this.#clockSkew;\n        const payload = {\n            iat: now,\n            jti: randomBytes(),\n            htm,\n            nonce,\n            htu: `${url.origin}${url.pathname}`,\n            ath: accessToken\n                ? b64u(await crypto.subtle.digest('SHA-256', buf(accessToken)))\n                : undefined,\n        };\n        this.#modifyAssertion?.(this.#header, payload);\n        headers.set('dpop', await signJwt(this.#header, payload, this.#privateKey));\n    }\n    cacheNonce(response, url) {\n        try {\n            const nonce = response.headers.get('dpop-nonce');\n            if (nonce) {\n                this.#set(url.origin, nonce);\n            }\n        }\n        catch { }\n    }\n}\nexport function isDPoPNonceError(err) {\n    if (err instanceof WWWAuthenticateChallengeError) {\n        const { 0: challenge, length } = err.cause;\n        return (length === 1 && challenge.scheme === 'dpop' && challenge.parameters.error === 'use_dpop_nonce');\n    }\n    if (err instanceof ResponseBodyError) {\n        return err.error === 'use_dpop_nonce';\n    }\n    return false;\n}\nexport function DPoP(client, keyPair, options) {\n    return new DPoPHandler(client, keyPair, options);\n}\nexport class ResponseBodyError extends Error {\n    cause;\n    code;\n    error;\n    status;\n    error_description;\n    response;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        this.code = RESPONSE_BODY_ERROR;\n        this.cause = options.cause;\n        this.error = options.cause.error;\n        this.status = options.response.status;\n        this.error_description = options.cause.error_description;\n        Object.defineProperty(this, 'response', { enumerable: false, value: options.response });\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class AuthorizationResponseError extends Error {\n    cause;\n    code;\n    error;\n    error_description;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        this.code = AUTHORIZATION_RESPONSE_ERROR;\n        this.cause = options.cause;\n        this.error = options.cause.get('error');\n        this.error_description = options.cause.get('error_description') ?? undefined;\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class WWWAuthenticateChallengeError extends Error {\n    cause;\n    code;\n    response;\n    status;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        this.code = WWW_AUTHENTICATE_CHALLENGE;\n        this.cause = options.cause;\n        this.status = options.response.status;\n        this.response = options.response;\n        Object.defineProperty(this, 'response', { enumerable: false });\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nconst tokenMatch = \"[a-zA-Z0-9!#$%&\\\\'\\\\*\\\\+\\\\-\\\\.\\\\^_`\\\\|~]+\";\nconst token68Match = '[a-zA-Z0-9\\\\-\\\\._\\\\~\\\\+\\\\/]+={0,2}';\nconst quotedMatch = '\"((?:[^\"\\\\\\\\]|\\\\\\\\[\\\\s\\\\S])*)\"';\nconst quotedParamMatcher = '(' + tokenMatch + ')\\\\s*=\\\\s*' + quotedMatch;\nconst paramMatcher = '(' + tokenMatch + ')\\\\s*=\\\\s*(' + tokenMatch + ')';\nconst schemeRE = new RegExp('^[,\\\\s]*(' + tokenMatch + ')');\nconst quotedParamRE = new RegExp('^[,\\\\s]*' + quotedParamMatcher + '[,\\\\s]*(.*)');\nconst unquotedParamRE = new RegExp('^[,\\\\s]*' + paramMatcher + '[,\\\\s]*(.*)');\nconst token68ParamRE = new RegExp('^(' + token68Match + ')(?:$|[,\\\\s])(.*)');\nfunction parseWwwAuthenticateChallenges(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    const header = response.headers.get('www-authenticate');\n    if (header === null) {\n        return undefined;\n    }\n    const challenges = [];\n    let rest = header;\n    while (rest) {\n        let match = rest.match(schemeRE);\n        const scheme = match?.['1'].toLowerCase();\n        if (!scheme) {\n            return undefined;\n        }\n        const afterScheme = rest.substring(match[0].length);\n        if (afterScheme && !afterScheme.match(/^[\\s,]/)) {\n            return undefined;\n        }\n        const spaceMatch = afterScheme.match(/^\\s+(.*)$/);\n        const hasParameters = !!spaceMatch;\n        rest = spaceMatch ? spaceMatch[1] : undefined;\n        const parameters = {};\n        let token68;\n        if (hasParameters) {\n            while (rest) {\n                let key;\n                let value;\n                if ((match = rest.match(quotedParamRE))) {\n                    ;\n                    [, key, value, rest] = match;\n                    if (value.includes('\\\\')) {\n                        try {\n                            value = JSON.parse(`\"${value}\"`);\n                        }\n                        catch { }\n                    }\n                    parameters[key.toLowerCase()] = value;\n                    continue;\n                }\n                if ((match = rest.match(unquotedParamRE))) {\n                    ;\n                    [, key, value, rest] = match;\n                    parameters[key.toLowerCase()] = value;\n                    continue;\n                }\n                if ((match = rest.match(token68ParamRE))) {\n                    if (Object.keys(parameters).length) {\n                        break;\n                    }\n                    ;\n                    [, token68, rest] = match;\n                    break;\n                }\n                return undefined;\n            }\n        }\n        else {\n            rest = afterScheme || undefined;\n        }\n        const challenge = { scheme, parameters };\n        if (token68) {\n            challenge.token68 = token68;\n        }\n        challenges.push(challenge);\n    }\n    if (!challenges.length) {\n        return undefined;\n    }\n    return challenges;\n}\nexport async function processPushedAuthorizationResponse(as, client, response) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 201, 'Pushed Authorization Request Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.request_uri, '\"response\" body \"request_uri\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    let expiresIn = typeof json.expires_in !== 'number' ? parseFloat(json.expires_in) : json.expires_in;\n    assertNumber(expiresIn, true, '\"response\" body \"expires_in\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    json.expires_in = expiresIn;\n    return json;\n}\nasync function parseOAuthResponseErrorBody(response) {\n    if (response.status > 399 && response.status < 500) {\n        assertReadableResponse(response);\n        assertApplicationJson(response);\n        try {\n            const json = await response.clone().json();\n            if (isJsonObject(json) && typeof json.error === 'string' && json.error.length) {\n                return json;\n            }\n        }\n        catch { }\n    }\n    return undefined;\n}\nasync function checkOAuthBodyError(response, expected, label) {\n    if (response.status !== expected) {\n        checkAuthenticationChallenges(response);\n        let err;\n        if ((err = await parseOAuthResponseErrorBody(response))) {\n            await response.body?.cancel();\n            throw new ResponseBodyError('server responded with an error in the response body', {\n                cause: err,\n                response,\n            });\n        }\n        throw OPE(`\"response\" is not a conform ${label} response (unexpected HTTP status code)`, RESPONSE_IS_NOT_CONFORM, response);\n    }\n}\nfunction assertDPoP(option) {\n    if (!branded.has(option)) {\n        throw CodedTypeError('\"options.DPoP\" is not a valid DPoPHandle', ERR_INVALID_ARG_VALUE);\n    }\n}\nasync function resourceRequest(accessToken, method, url, headers, body, options) {\n    assertString(accessToken, '\"accessToken\"');\n    if (!(url instanceof URL)) {\n        throw CodedTypeError('\"url\" must be an instance of URL', ERR_INVALID_ARG_TYPE);\n    }\n    checkProtocol(url, options?.[allowInsecureRequests] !== true);\n    headers = prepareHeaders(headers);\n    if (options?.DPoP) {\n        assertDPoP(options.DPoP);\n        await options.DPoP.addProof(url, headers, method.toUpperCase(), accessToken);\n    }\n    headers.set('authorization', `${headers.has('dpop') ? 'DPoP' : 'Bearer'} ${accessToken}`);\n    const response = await (options?.[customFetch] || fetch)(url.href, {\n        duplex: looseInstanceOf(body, ReadableStream) ? 'half' : undefined,\n        body,\n        headers: Object.fromEntries(headers.entries()),\n        method,\n        redirect: 'manual',\n        signal: signal(url, options?.signal),\n    });\n    options?.DPoP?.cacheNonce(response, url);\n    return response;\n}\nexport async function protectedResourceRequest(accessToken, method, url, headers, body, options) {\n    const response = await resourceRequest(accessToken, method, url, headers, body, options);\n    checkAuthenticationChallenges(response);\n    return response;\n}\nexport async function userInfoRequest(as, client, accessToken, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'userinfo_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const headers = prepareHeaders(options?.headers);\n    if (client.userinfo_signed_response_alg) {\n        headers.set('accept', 'application/jwt');\n    }\n    else {\n        headers.set('accept', 'application/json');\n        headers.append('accept', 'application/jwt');\n    }\n    return resourceRequest(accessToken, 'GET', url, headers, null, {\n        ...options,\n        [clockSkew]: getClockSkew(client),\n    });\n}\nlet jwksMap;\nfunction setJwksCache(as, jwks, uat, cache) {\n    jwksMap ||= new WeakMap();\n    jwksMap.set(as, {\n        jwks,\n        uat,\n        get age() {\n            return epochTime() - this.uat;\n        },\n    });\n    if (cache) {\n        Object.assign(cache, { jwks: structuredClone(jwks), uat });\n    }\n}\nfunction isFreshJwksCache(input) {\n    if (typeof input !== 'object' || input === null) {\n        return false;\n    }\n    if (!('uat' in input) || typeof input.uat !== 'number' || epochTime() - input.uat >= 300) {\n        return false;\n    }\n    if (!('jwks' in input) ||\n        !isJsonObject(input.jwks) ||\n        !Array.isArray(input.jwks.keys) ||\n        !Array.prototype.every.call(input.jwks.keys, isJsonObject)) {\n        return false;\n    }\n    return true;\n}\nfunction clearJwksCache(as, cache) {\n    jwksMap?.delete(as);\n    delete cache?.jwks;\n    delete cache?.uat;\n}\nasync function getPublicSigKeyFromIssuerJwksUri(as, options, header) {\n    const { alg, kid } = header;\n    checkSupportedJwsAlg(header);\n    if (!jwksMap?.has(as) && isFreshJwksCache(options?.[jwksCache])) {\n        setJwksCache(as, options?.[jwksCache].jwks, options?.[jwksCache].uat);\n    }\n    let jwks;\n    let age;\n    if (jwksMap?.has(as)) {\n        ;\n        ({ jwks, age } = jwksMap.get(as));\n        if (age >= 300) {\n            clearJwksCache(as, options?.[jwksCache]);\n            return getPublicSigKeyFromIssuerJwksUri(as, options, header);\n        }\n    }\n    else {\n        jwks = await jwksRequest(as, options).then(processJwksResponse);\n        age = 0;\n        setJwksCache(as, jwks, epochTime(), options?.[jwksCache]);\n    }\n    let kty;\n    switch (alg.slice(0, 2)) {\n        case 'RS':\n        case 'PS':\n            kty = 'RSA';\n            break;\n        case 'ES':\n            kty = 'EC';\n            break;\n        case 'Ed':\n            kty = 'OKP';\n            break;\n        case 'ML':\n            kty = 'AKP';\n            break;\n        default:\n            throw new UnsupportedOperationError('unsupported JWS algorithm', { cause: { alg } });\n    }\n    const candidates = jwks.keys.filter((jwk) => {\n        if (jwk.kty !== kty) {\n            return false;\n        }\n        if (kid !== undefined && kid !== jwk.kid) {\n            return false;\n        }\n        if (jwk.alg !== undefined && alg !== jwk.alg) {\n            return false;\n        }\n        if (jwk.use !== undefined && jwk.use !== 'sig') {\n            return false;\n        }\n        if (jwk.key_ops?.includes('verify') === false) {\n            return false;\n        }\n        switch (true) {\n            case alg === 'ES256' && jwk.crv !== 'P-256':\n            case alg === 'ES384' && jwk.crv !== 'P-384':\n            case alg === 'ES512' && jwk.crv !== 'P-521':\n            case alg === 'Ed25519' && jwk.crv !== 'Ed25519':\n            case alg === 'EdDSA' && jwk.crv !== 'Ed25519':\n                return false;\n        }\n        return true;\n    });\n    const { 0: jwk, length } = candidates;\n    if (!length) {\n        if (age >= 60) {\n            clearJwksCache(as, options?.[jwksCache]);\n            return getPublicSigKeyFromIssuerJwksUri(as, options, header);\n        }\n        throw OPE('error when selecting a JWT verification key, no applicable keys found', KEY_SELECTION, { header, candidates, jwks_uri: new URL(as.jwks_uri) });\n    }\n    if (length !== 1) {\n        throw OPE('error when selecting a JWT verification key, multiple applicable keys found, a \"kid\" JWT Header Parameter is required', KEY_SELECTION, { header, candidates, jwks_uri: new URL(as.jwks_uri) });\n    }\n    return importJwk(alg, jwk);\n}\nexport const skipSubjectCheck = Symbol();\nexport function getContentType(input) {\n    return input.headers.get('content-type')?.split(';')[0];\n}\nexport async function processUserInfoResponse(as, client, expectedSubject, response, options) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    checkAuthenticationChallenges(response);\n    if (response.status !== 200) {\n        throw OPE('\"response\" is not a conform UserInfo Endpoint response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);\n    }\n    assertReadableResponse(response);\n    let json;\n    if (getContentType(response) === 'application/jwt') {\n        const { claims, jwt } = await validateJwt(await response.text(), checkSigningAlgorithm.bind(undefined, client.userinfo_signed_response_alg, as.userinfo_signing_alg_values_supported, undefined), getClockSkew(client), getClockTolerance(client), options?.[jweDecrypt])\n            .then(validateOptionalAudience.bind(undefined, client.client_id))\n            .then(validateOptionalIssuer.bind(undefined, as));\n        jwtRefs.set(response, jwt);\n        json = claims;\n    }\n    else {\n        if (client.userinfo_signed_response_alg) {\n            throw OPE('JWT UserInfo Response expected', JWT_USERINFO_EXPECTED, response);\n        }\n        json = await getResponseJsonBody(response);\n    }\n    assertString(json.sub, '\"response\" body \"sub\" property', INVALID_RESPONSE, { body: json });\n    switch (expectedSubject) {\n        case skipSubjectCheck:\n            break;\n        default:\n            assertString(expectedSubject, '\"expectedSubject\"');\n            if (json.sub !== expectedSubject) {\n                throw OPE('unexpected \"response\" body \"sub\" property value', JSON_ATTRIBUTE_COMPARISON, {\n                    expected: expectedSubject,\n                    body: json,\n                    attribute: 'sub',\n                });\n            }\n    }\n    return json;\n}\nasync function authenticatedRequest(as, client, clientAuthentication, url, body, headers, options) {\n    await clientAuthentication(as, client, body, headers);\n    headers.set('content-type', 'application/x-www-form-urlencoded;charset=UTF-8');\n    return (options?.[customFetch] || fetch)(url.href, {\n        body,\n        headers: Object.fromEntries(headers.entries()),\n        method: 'POST',\n        redirect: 'manual',\n        signal: signal(url, options?.signal),\n    });\n}\nasync function tokenEndpointRequest(as, client, clientAuthentication, grantType, parameters, options) {\n    const url = resolveEndpoint(as, 'token_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    parameters.set('grant_type', grantType);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    if (options?.DPoP !== undefined) {\n        assertDPoP(options.DPoP);\n        await options.DPoP.addProof(url, headers, 'POST');\n    }\n    const response = await authenticatedRequest(as, client, clientAuthentication, url, parameters, headers, options);\n    options?.DPoP?.cacheNonce(response, url);\n    return response;\n}\nexport async function refreshTokenGrantRequest(as, client, clientAuthentication, refreshToken, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(refreshToken, '\"refreshToken\"');\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('refresh_token', refreshToken);\n    return tokenEndpointRequest(as, client, clientAuthentication, 'refresh_token', parameters, options);\n}\nconst idTokenClaims = new WeakMap();\nconst jwtRefs = new WeakMap();\nexport function getValidatedIdTokenClaims(ref) {\n    if (!ref.id_token) {\n        return undefined;\n    }\n    const claims = idTokenClaims.get(ref);\n    if (!claims) {\n        throw CodedTypeError('\"ref\" was already garbage collected or did not resolve from the proper sources', ERR_INVALID_ARG_VALUE);\n    }\n    return claims;\n}\nexport async function validateApplicationLevelSignature(as, ref, options) {\n    assertAs(as);\n    if (!jwtRefs.has(ref)) {\n        throw CodedTypeError('\"ref\" does not contain a processed JWT Response to verify the signature of', ERR_INVALID_ARG_VALUE);\n    }\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = jwtRefs.get(ref).split('.');\n    const header = JSON.parse(buf(b64u(protectedHeader)));\n    if (header.alg.startsWith('HS')) {\n        throw new UnsupportedOperationError('unsupported JWS algorithm', { cause: { alg: header.alg } });\n    }\n    let key;\n    key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);\n    await validateJwsSignature(protectedHeader, payload, key, b64u(encodedSignature));\n}\nasync function processGenericAccessTokenResponse(as, client, response, additionalRequiredIdTokenClaims, decryptFn, recognizedTokenTypes) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Token Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.access_token, '\"response\" body \"access_token\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    assertString(json.token_type, '\"response\" body \"token_type\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    json.token_type = json.token_type.toLowerCase();\n    if (json.expires_in !== undefined) {\n        let expiresIn = typeof json.expires_in !== 'number' ? parseFloat(json.expires_in) : json.expires_in;\n        assertNumber(expiresIn, true, '\"response\" body \"expires_in\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n        json.expires_in = expiresIn;\n    }\n    if (json.refresh_token !== undefined) {\n        assertString(json.refresh_token, '\"response\" body \"refresh_token\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    if (json.scope !== undefined && typeof json.scope !== 'string') {\n        throw OPE('\"response\" body \"scope\" property must be a string', INVALID_RESPONSE, { body: json });\n    }\n    if (json.id_token !== undefined) {\n        assertString(json.id_token, '\"response\" body \"id_token\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n        const requiredClaims = ['aud', 'exp', 'iat', 'iss', 'sub'];\n        if (client.require_auth_time === true) {\n            requiredClaims.push('auth_time');\n        }\n        if (client.default_max_age !== undefined) {\n            assertNumber(client.default_max_age, true, '\"client.default_max_age\"');\n            requiredClaims.push('auth_time');\n        }\n        if (additionalRequiredIdTokenClaims?.length) {\n            requiredClaims.push(...additionalRequiredIdTokenClaims);\n        }\n        const { claims, jwt } = await validateJwt(json.id_token, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported, 'RS256'), getClockSkew(client), getClockTolerance(client), decryptFn)\n            .then(validatePresence.bind(undefined, requiredClaims))\n            .then(validateIssuer.bind(undefined, as))\n            .then(validateAudience.bind(undefined, client.client_id));\n        if (Array.isArray(claims.aud) && claims.aud.length !== 1) {\n            if (claims.azp === undefined) {\n                throw OPE('ID Token \"aud\" (audience) claim includes additional untrusted audiences', JWT_CLAIM_COMPARISON, { claims, claim: 'aud' });\n            }\n            if (claims.azp !== client.client_id) {\n                throw OPE('unexpected ID Token \"azp\" (authorized party) claim value', JWT_CLAIM_COMPARISON, { expected: client.client_id, claims, claim: 'azp' });\n            }\n        }\n        if (claims.auth_time !== undefined) {\n            assertNumber(claims.auth_time, true, 'ID Token \"auth_time\" (authentication time)', INVALID_RESPONSE, { claims });\n        }\n        jwtRefs.set(response, jwt);\n        idTokenClaims.set(json, claims);\n    }\n    if (recognizedTokenTypes?.[json.token_type] !== undefined) {\n        recognizedTokenTypes[json.token_type](response, json);\n    }\n    else if (json.token_type !== 'dpop' && json.token_type !== 'bearer') {\n        throw new UnsupportedOperationError('unsupported `token_type` value', { cause: { body: json } });\n    }\n    return json;\n}\nfunction checkAuthenticationChallenges(response) {\n    let challenges;\n    if ((challenges = parseWwwAuthenticateChallenges(response))) {\n        throw new WWWAuthenticateChallengeError('server responded with a challenge in the WWW-Authenticate HTTP Header', { cause: challenges, response });\n    }\n}\nexport async function processRefreshTokenResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nfunction validateOptionalAudience(expected, result) {\n    if (result.claims.aud !== undefined) {\n        return validateAudience(expected, result);\n    }\n    return result;\n}\nfunction validateAudience(expected, result) {\n    if (Array.isArray(result.claims.aud)) {\n        if (!result.claims.aud.includes(expected)) {\n            throw OPE('unexpected JWT \"aud\" (audience) claim value', JWT_CLAIM_COMPARISON, {\n                expected,\n                claims: result.claims,\n                claim: 'aud',\n            });\n        }\n    }\n    else if (result.claims.aud !== expected) {\n        throw OPE('unexpected JWT \"aud\" (audience) claim value', JWT_CLAIM_COMPARISON, {\n            expected,\n            claims: result.claims,\n            claim: 'aud',\n        });\n    }\n    return result;\n}\nfunction validateOptionalIssuer(as, result) {\n    if (result.claims.iss !== undefined) {\n        return validateIssuer(as, result);\n    }\n    return result;\n}\nfunction validateIssuer(as, result) {\n    const expected = as[_expectedIssuer]?.(result) ?? as.issuer;\n    if (result.claims.iss !== expected) {\n        throw OPE('unexpected JWT \"iss\" (issuer) claim value', JWT_CLAIM_COMPARISON, {\n            expected,\n            claims: result.claims,\n            claim: 'iss',\n        });\n    }\n    return result;\n}\nconst branded = new WeakSet();\nfunction brand(searchParams) {\n    branded.add(searchParams);\n    return searchParams;\n}\nexport const nopkce = Symbol();\nexport async function authorizationCodeGrantRequest(as, client, clientAuthentication, callbackParameters, redirectUri, codeVerifier, options) {\n    assertAs(as);\n    assertClient(client);\n    if (!branded.has(callbackParameters)) {\n        throw CodedTypeError('\"callbackParameters\" must be an instance of URLSearchParams obtained from \"validateAuthResponse()\", or \"validateJwtAuthResponse()', ERR_INVALID_ARG_VALUE);\n    }\n    assertString(redirectUri, '\"redirectUri\"');\n    const code = getURLSearchParameter(callbackParameters, 'code');\n    if (!code) {\n        throw OPE('no authorization code in \"callbackParameters\"', INVALID_RESPONSE);\n    }\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('redirect_uri', redirectUri);\n    parameters.set('code', code);\n    if (codeVerifier !== nopkce) {\n        assertString(codeVerifier, '\"codeVerifier\"');\n        parameters.set('code_verifier', codeVerifier);\n    }\n    return tokenEndpointRequest(as, client, clientAuthentication, 'authorization_code', parameters, options);\n}\nconst jwtClaimNames = {\n    aud: 'audience',\n    c_hash: 'code hash',\n    client_id: 'client id',\n    exp: 'expiration time',\n    iat: 'issued at',\n    iss: 'issuer',\n    jti: 'jwt id',\n    nonce: 'nonce',\n    s_hash: 'state hash',\n    sub: 'subject',\n    ath: 'access token hash',\n    htm: 'http method',\n    htu: 'http uri',\n    cnf: 'confirmation',\n    auth_time: 'authentication time',\n};\nfunction validatePresence(required, result) {\n    for (const claim of required) {\n        if (result.claims[claim] === undefined) {\n            throw OPE(`JWT \"${claim}\" (${jwtClaimNames[claim]}) claim missing`, INVALID_RESPONSE, {\n                claims: result.claims,\n            });\n        }\n    }\n    return result;\n}\nexport const expectNoNonce = Symbol();\nexport const skipAuthTimeCheck = Symbol();\nexport async function processAuthorizationCodeResponse(as, client, response, options) {\n    if (typeof options?.expectedNonce === 'string' ||\n        typeof options?.maxAge === 'number' ||\n        options?.requireIdToken) {\n        return processAuthorizationCodeOpenIDResponse(as, client, response, options.expectedNonce, options.maxAge, options[jweDecrypt], options.recognizedTokenTypes);\n    }\n    return processAuthorizationCodeOAuth2Response(as, client, response, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nasync function processAuthorizationCodeOpenIDResponse(as, client, response, expectedNonce, maxAge, decryptFn, recognizedTokenTypes) {\n    const additionalRequiredClaims = [];\n    switch (expectedNonce) {\n        case undefined:\n            expectedNonce = expectNoNonce;\n            break;\n        case expectNoNonce:\n            break;\n        default:\n            assertString(expectedNonce, '\"expectedNonce\" argument');\n            additionalRequiredClaims.push('nonce');\n    }\n    maxAge ??= client.default_max_age;\n    switch (maxAge) {\n        case undefined:\n            maxAge = skipAuthTimeCheck;\n            break;\n        case skipAuthTimeCheck:\n            break;\n        default:\n            assertNumber(maxAge, true, '\"maxAge\" argument');\n            additionalRequiredClaims.push('auth_time');\n    }\n    const result = await processGenericAccessTokenResponse(as, client, response, additionalRequiredClaims, decryptFn, recognizedTokenTypes);\n    assertString(result.id_token, '\"response\" body \"id_token\" property', INVALID_RESPONSE, {\n        body: result,\n    });\n    const claims = getValidatedIdTokenClaims(result);\n    if (maxAge !== skipAuthTimeCheck) {\n        const now = epochTime() + getClockSkew(client);\n        const tolerance = getClockTolerance(client);\n        if (claims.auth_time + maxAge < now - tolerance) {\n            throw OPE('too much time has elapsed since the last End-User authentication', JWT_TIMESTAMP_CHECK, { claims, now, tolerance, claim: 'auth_time' });\n        }\n    }\n    if (expectedNonce === expectNoNonce) {\n        if (claims.nonce !== undefined) {\n            throw OPE('unexpected ID Token \"nonce\" claim value', JWT_CLAIM_COMPARISON, {\n                expected: undefined,\n                claims,\n                claim: 'nonce',\n            });\n        }\n    }\n    else if (claims.nonce !== expectedNonce) {\n        throw OPE('unexpected ID Token \"nonce\" claim value', JWT_CLAIM_COMPARISON, {\n            expected: expectedNonce,\n            claims,\n            claim: 'nonce',\n        });\n    }\n    return result;\n}\nasync function processAuthorizationCodeOAuth2Response(as, client, response, decryptFn, recognizedTokenTypes) {\n    const result = await processGenericAccessTokenResponse(as, client, response, undefined, decryptFn, recognizedTokenTypes);\n    const claims = getValidatedIdTokenClaims(result);\n    if (claims) {\n        if (client.default_max_age !== undefined) {\n            assertNumber(client.default_max_age, true, '\"client.default_max_age\"');\n            const now = epochTime() + getClockSkew(client);\n            const tolerance = getClockTolerance(client);\n            if (claims.auth_time + client.default_max_age < now - tolerance) {\n                throw OPE('too much time has elapsed since the last End-User authentication', JWT_TIMESTAMP_CHECK, { claims, now, tolerance, claim: 'auth_time' });\n            }\n        }\n        if (claims.nonce !== undefined) {\n            throw OPE('unexpected ID Token \"nonce\" claim value', JWT_CLAIM_COMPARISON, {\n                expected: undefined,\n                claims,\n                claim: 'nonce',\n            });\n        }\n    }\n    return result;\n}\nexport const WWW_AUTHENTICATE_CHALLENGE = 'OAUTH_WWW_AUTHENTICATE_CHALLENGE';\nexport const RESPONSE_BODY_ERROR = 'OAUTH_RESPONSE_BODY_ERROR';\nexport const UNSUPPORTED_OPERATION = 'OAUTH_UNSUPPORTED_OPERATION';\nexport const AUTHORIZATION_RESPONSE_ERROR = 'OAUTH_AUTHORIZATION_RESPONSE_ERROR';\nexport const JWT_USERINFO_EXPECTED = 'OAUTH_JWT_USERINFO_EXPECTED';\nexport const PARSE_ERROR = 'OAUTH_PARSE_ERROR';\nexport const INVALID_RESPONSE = 'OAUTH_INVALID_RESPONSE';\nexport const INVALID_REQUEST = 'OAUTH_INVALID_REQUEST';\nexport const RESPONSE_IS_NOT_JSON = 'OAUTH_RESPONSE_IS_NOT_JSON';\nexport const RESPONSE_IS_NOT_CONFORM = 'OAUTH_RESPONSE_IS_NOT_CONFORM';\nexport const HTTP_REQUEST_FORBIDDEN = 'OAUTH_HTTP_REQUEST_FORBIDDEN';\nexport const REQUEST_PROTOCOL_FORBIDDEN = 'OAUTH_REQUEST_PROTOCOL_FORBIDDEN';\nexport const JWT_TIMESTAMP_CHECK = 'OAUTH_JWT_TIMESTAMP_CHECK_FAILED';\nexport const JWT_CLAIM_COMPARISON = 'OAUTH_JWT_CLAIM_COMPARISON_FAILED';\nexport const JSON_ATTRIBUTE_COMPARISON = 'OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED';\nexport const KEY_SELECTION = 'OAUTH_KEY_SELECTION_FAILED';\nexport const MISSING_SERVER_METADATA = 'OAUTH_MISSING_SERVER_METADATA';\nexport const INVALID_SERVER_METADATA = 'OAUTH_INVALID_SERVER_METADATA';\nfunction checkJwtType(expected, result) {\n    if (typeof result.header.typ !== 'string' || normalizeTyp(result.header.typ) !== expected) {\n        throw OPE('unexpected JWT \"typ\" header parameter value', INVALID_RESPONSE, {\n            header: result.header,\n        });\n    }\n    return result;\n}\nexport async function clientCredentialsGrantRequest(as, client, clientAuthentication, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    return tokenEndpointRequest(as, client, clientAuthentication, 'client_credentials', new URLSearchParams(parameters), options);\n}\nexport async function genericTokenEndpointRequest(as, client, clientAuthentication, grantType, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(grantType, '\"grantType\"');\n    return tokenEndpointRequest(as, client, clientAuthentication, grantType, new URLSearchParams(parameters), options);\n}\nexport async function processGenericTokenEndpointResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nexport async function processClientCredentialsResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nexport async function revocationRequest(as, client, clientAuthentication, token, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(token, '\"token\"');\n    const url = resolveEndpoint(as, 'revocation_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(options?.additionalParameters);\n    body.set('token', token);\n    const headers = prepareHeaders(options?.headers);\n    headers.delete('accept');\n    return authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n}\nexport async function processRevocationResponse(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Revocation Endpoint');\n    return undefined;\n}\nfunction assertReadableResponse(response) {\n    if (response.bodyUsed) {\n        throw CodedTypeError('\"response\" body has been used already', ERR_INVALID_ARG_VALUE);\n    }\n}\nexport async function introspectionRequest(as, client, clientAuthentication, token, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(token, '\"token\"');\n    const url = resolveEndpoint(as, 'introspection_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(options?.additionalParameters);\n    body.set('token', token);\n    const headers = prepareHeaders(options?.headers);\n    if (options?.requestJwtResponse ?? client.introspection_signed_response_alg) {\n        headers.set('accept', 'application/token-introspection+jwt');\n    }\n    else {\n        headers.set('accept', 'application/json');\n    }\n    return authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n}\nexport async function processIntrospectionResponse(as, client, response, options) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Introspection Endpoint');\n    let json;\n    if (getContentType(response) === 'application/token-introspection+jwt') {\n        assertReadableResponse(response);\n        const { claims, jwt } = await validateJwt(await response.text(), checkSigningAlgorithm.bind(undefined, client.introspection_signed_response_alg, as.introspection_signing_alg_values_supported, 'RS256'), getClockSkew(client), getClockTolerance(client), options?.[jweDecrypt])\n            .then(checkJwtType.bind(undefined, 'token-introspection+jwt'))\n            .then(validatePresence.bind(undefined, ['aud', 'iat', 'iss']))\n            .then(validateIssuer.bind(undefined, as))\n            .then(validateAudience.bind(undefined, client.client_id));\n        jwtRefs.set(response, jwt);\n        if (!isJsonObject(claims.token_introspection)) {\n            throw OPE('JWT \"token_introspection\" claim must be a JSON object', INVALID_RESPONSE, {\n                claims,\n            });\n        }\n        json = claims.token_introspection;\n    }\n    else {\n        assertReadableResponse(response);\n        json = await getResponseJsonBody(response);\n    }\n    if (typeof json.active !== 'boolean') {\n        throw OPE('\"response\" body \"active\" property must be a boolean', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    return json;\n}\nasync function jwksRequest(as, options) {\n    assertAs(as);\n    const url = resolveEndpoint(as, 'jwks_uri', false, options?.[allowInsecureRequests] !== true);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    headers.append('accept', 'application/jwk-set+json');\n    return (options?.[customFetch] || fetch)(url.href, {\n        body: undefined,\n        headers: Object.fromEntries(headers.entries()),\n        method: 'GET',\n        redirect: 'manual',\n        signal: signal(url, options?.signal),\n    });\n}\nasync function processJwksResponse(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    if (response.status !== 200) {\n        throw OPE('\"response\" is not a conform JSON Web Key Set response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);\n    }\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response, (response) => assertContentTypes(response, 'application/json', 'application/jwk-set+json'));\n    if (!Array.isArray(json.keys)) {\n        throw OPE('\"response\" body \"keys\" property must be an array', INVALID_RESPONSE, { body: json });\n    }\n    if (!Array.prototype.every.call(json.keys, isJsonObject)) {\n        throw OPE('\"response\" body \"keys\" property members must be JWK formatted objects', INVALID_RESPONSE, { body: json });\n    }\n    return json;\n}\nfunction supported(alg) {\n    switch (alg) {\n        case 'PS256':\n        case 'ES256':\n        case 'RS256':\n        case 'PS384':\n        case 'ES384':\n        case 'RS384':\n        case 'PS512':\n        case 'ES512':\n        case 'RS512':\n        case 'Ed25519':\n        case 'EdDSA':\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            return true;\n        default:\n            return false;\n    }\n}\nfunction checkSupportedJwsAlg(header) {\n    if (!supported(header.alg)) {\n        throw new UnsupportedOperationError('unsupported JWS \"alg\" identifier', {\n            cause: { alg: header.alg },\n        });\n    }\n}\nfunction checkRsaKeyAlgorithm(key) {\n    const { algorithm } = key;\n    if (typeof algorithm.modulusLength !== 'number' || algorithm.modulusLength < 2048) {\n        throw new UnsupportedOperationError(`unsupported ${algorithm.name} modulusLength`, {\n            cause: key,\n        });\n    }\n}\nfunction ecdsaHashName(key) {\n    const { algorithm } = key;\n    switch (algorithm.namedCurve) {\n        case 'P-256':\n            return 'SHA-256';\n        case 'P-384':\n            return 'SHA-384';\n        case 'P-521':\n            return 'SHA-512';\n        default:\n            throw new UnsupportedOperationError('unsupported ECDSA namedCurve', { cause: key });\n    }\n}\nfunction keyToSubtle(key) {\n    switch (key.algorithm.name) {\n        case 'ECDSA':\n            return {\n                name: key.algorithm.name,\n                hash: ecdsaHashName(key),\n            };\n        case 'RSA-PSS': {\n            checkRsaKeyAlgorithm(key);\n            switch (key.algorithm.hash.name) {\n                case 'SHA-256':\n                case 'SHA-384':\n                case 'SHA-512':\n                    return {\n                        name: key.algorithm.name,\n                        saltLength: parseInt(key.algorithm.hash.name.slice(-3), 10) >> 3,\n                    };\n                default:\n                    throw new UnsupportedOperationError('unsupported RSA-PSS hash name', { cause: key });\n            }\n        }\n        case 'RSASSA-PKCS1-v1_5':\n            checkRsaKeyAlgorithm(key);\n            return key.algorithm.name;\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n        case 'Ed25519':\n            return key.algorithm.name;\n    }\n    throw new UnsupportedOperationError('unsupported CryptoKey algorithm name', { cause: key });\n}\nasync function validateJwsSignature(protectedHeader, payload, key, signature) {\n    const data = buf(`${protectedHeader}.${payload}`);\n    const algorithm = keyToSubtle(key);\n    const verified = await crypto.subtle.verify(algorithm, key, signature, data);\n    if (!verified) {\n        throw OPE('JWT signature verification failed', INVALID_RESPONSE, {\n            key,\n            data,\n            signature,\n            algorithm,\n        });\n    }\n}\nasync function validateJwt(jws, checkAlg, clockSkew, clockTolerance, decryptJwt) {\n    let { 0: protectedHeader, 1: payload, length } = jws.split('.');\n    if (length === 5) {\n        if (decryptJwt !== undefined) {\n            jws = await decryptJwt(jws);\n            ({ 0: protectedHeader, 1: payload, length } = jws.split('.'));\n        }\n        else {\n            throw new UnsupportedOperationError('JWE decryption is not configured', { cause: jws });\n        }\n    }\n    if (length !== 3) {\n        throw OPE('Invalid JWT', INVALID_RESPONSE, jws);\n    }\n    let header;\n    try {\n        header = JSON.parse(buf(b64u(protectedHeader)));\n    }\n    catch (cause) {\n        throw OPE('failed to parse JWT Header body as base64url encoded JSON', PARSE_ERROR, cause);\n    }\n    if (!isJsonObject(header)) {\n        throw OPE('JWT Header must be a top level object', INVALID_RESPONSE, jws);\n    }\n    checkAlg(header);\n    if (header.crit !== undefined) {\n        throw new UnsupportedOperationError('no JWT \"crit\" header parameter extensions are supported', {\n            cause: { header },\n        });\n    }\n    let claims;\n    try {\n        claims = JSON.parse(buf(b64u(payload)));\n    }\n    catch (cause) {\n        throw OPE('failed to parse JWT Payload body as base64url encoded JSON', PARSE_ERROR, cause);\n    }\n    if (!isJsonObject(claims)) {\n        throw OPE('JWT Payload must be a top level object', INVALID_RESPONSE, jws);\n    }\n    const now = epochTime() + clockSkew;\n    if (claims.exp !== undefined) {\n        if (typeof claims.exp !== 'number') {\n            throw OPE('unexpected JWT \"exp\" (expiration time) claim type', INVALID_RESPONSE, { claims });\n        }\n        if (claims.exp <= now - clockTolerance) {\n            throw OPE('unexpected JWT \"exp\" (expiration time) claim value, expiration is past current timestamp', JWT_TIMESTAMP_CHECK, { claims, now, tolerance: clockTolerance, claim: 'exp' });\n        }\n    }\n    if (claims.iat !== undefined) {\n        if (typeof claims.iat !== 'number') {\n            throw OPE('unexpected JWT \"iat\" (issued at) claim type', INVALID_RESPONSE, { claims });\n        }\n    }\n    if (claims.iss !== undefined) {\n        if (typeof claims.iss !== 'string') {\n            throw OPE('unexpected JWT \"iss\" (issuer) claim type', INVALID_RESPONSE, { claims });\n        }\n    }\n    if (claims.nbf !== undefined) {\n        if (typeof claims.nbf !== 'number') {\n            throw OPE('unexpected JWT \"nbf\" (not before) claim type', INVALID_RESPONSE, { claims });\n        }\n        if (claims.nbf > now + clockTolerance) {\n            throw OPE('unexpected JWT \"nbf\" (not before) claim value', JWT_TIMESTAMP_CHECK, {\n                claims,\n                now,\n                tolerance: clockTolerance,\n                claim: 'nbf',\n            });\n        }\n    }\n    if (claims.aud !== undefined) {\n        if (typeof claims.aud !== 'string' && !Array.isArray(claims.aud)) {\n            throw OPE('unexpected JWT \"aud\" (audience) claim type', INVALID_RESPONSE, { claims });\n        }\n    }\n    return { header, claims, jwt: jws };\n}\nexport async function validateJwtAuthResponse(as, client, parameters, expectedState, options) {\n    assertAs(as);\n    assertClient(client);\n    if (parameters instanceof URL) {\n        parameters = parameters.searchParams;\n    }\n    if (!(parameters instanceof URLSearchParams)) {\n        throw CodedTypeError('\"parameters\" must be an instance of URLSearchParams, or URL', ERR_INVALID_ARG_TYPE);\n    }\n    const response = getURLSearchParameter(parameters, 'response');\n    if (!response) {\n        throw OPE('\"parameters\" does not contain a JARM response', INVALID_RESPONSE);\n    }\n    const { claims, header, jwt } = await validateJwt(response, checkSigningAlgorithm.bind(undefined, client.authorization_signed_response_alg, as.authorization_signing_alg_values_supported, 'RS256'), getClockSkew(client), getClockTolerance(client), options?.[jweDecrypt])\n        .then(validatePresence.bind(undefined, ['aud', 'exp', 'iss']))\n        .then(validateIssuer.bind(undefined, as))\n        .then(validateAudience.bind(undefined, client.client_id));\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = jwt.split('.');\n    const signature = b64u(encodedSignature);\n    const key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);\n    await validateJwsSignature(protectedHeader, payload, key, signature);\n    const result = new URLSearchParams();\n    for (const [key, value] of Object.entries(claims)) {\n        if (typeof value === 'string' && key !== 'aud') {\n            result.set(key, value);\n        }\n    }\n    return validateAuthResponse(as, client, result, expectedState);\n}\nasync function idTokenHash(data, header, claimName) {\n    let algorithm;\n    switch (header.alg) {\n        case 'RS256':\n        case 'PS256':\n        case 'ES256':\n            algorithm = 'SHA-256';\n            break;\n        case 'RS384':\n        case 'PS384':\n        case 'ES384':\n            algorithm = 'SHA-384';\n            break;\n        case 'RS512':\n        case 'PS512':\n        case 'ES512':\n        case 'Ed25519':\n        case 'EdDSA':\n            algorithm = 'SHA-512';\n            break;\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            algorithm = { name: 'cSHAKE256', length: 512, outputLength: 512 };\n            break;\n        default:\n            throw new UnsupportedOperationError(`unsupported JWS algorithm for ${claimName} calculation`, { cause: { alg: header.alg } });\n    }\n    const digest = await crypto.subtle.digest(algorithm, buf(data));\n    return b64u(digest.slice(0, digest.byteLength / 2));\n}\nasync function idTokenHashMatches(data, actual, header, claimName) {\n    const expected = await idTokenHash(data, header, claimName);\n    return actual === expected;\n}\nexport async function validateDetachedSignatureResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options) {\n    return validateHybridResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options, true);\n}\nexport async function validateCodeIdTokenResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options) {\n    return validateHybridResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options, false);\n}\nasync function consumeStream(request) {\n    if (request.bodyUsed) {\n        throw CodedTypeError('form_post Request instances must contain a readable body', ERR_INVALID_ARG_VALUE, { cause: request });\n    }\n    return request.text();\n}\nexport async function formPostResponse(request) {\n    if (request.method !== 'POST') {\n        throw CodedTypeError('form_post responses are expected to use the POST method', ERR_INVALID_ARG_VALUE, { cause: request });\n    }\n    if (getContentType(request) !== 'application/x-www-form-urlencoded') {\n        throw CodedTypeError('form_post responses are expected to use the application/x-www-form-urlencoded content-type', ERR_INVALID_ARG_VALUE, { cause: request });\n    }\n    return consumeStream(request);\n}\nasync function validateHybridResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options, fapi) {\n    assertAs(as);\n    assertClient(client);\n    if (parameters instanceof URL) {\n        if (!parameters.hash.length) {\n            throw CodedTypeError('\"parameters\" as an instance of URL must contain a hash (fragment) with the Authorization Response parameters', ERR_INVALID_ARG_VALUE);\n        }\n        parameters = new URLSearchParams(parameters.hash.slice(1));\n    }\n    else if (looseInstanceOf(parameters, Request)) {\n        parameters = new URLSearchParams(await formPostResponse(parameters));\n    }\n    else if (parameters instanceof URLSearchParams) {\n        parameters = new URLSearchParams(parameters);\n    }\n    else {\n        throw CodedTypeError('\"parameters\" must be an instance of URLSearchParams, URL, or Response', ERR_INVALID_ARG_TYPE);\n    }\n    const id_token = getURLSearchParameter(parameters, 'id_token');\n    parameters.delete('id_token');\n    switch (expectedState) {\n        case undefined:\n        case expectNoState:\n            break;\n        default:\n            assertString(expectedState, '\"expectedState\" argument');\n    }\n    const result = validateAuthResponse({\n        ...as,\n        authorization_response_iss_parameter_supported: false,\n    }, client, parameters, expectedState);\n    if (!id_token) {\n        throw OPE('\"parameters\" does not contain an ID Token', INVALID_RESPONSE);\n    }\n    const code = getURLSearchParameter(parameters, 'code');\n    if (!code) {\n        throw OPE('\"parameters\" does not contain an Authorization Code', INVALID_RESPONSE);\n    }\n    const requiredClaims = [\n        'aud',\n        'exp',\n        'iat',\n        'iss',\n        'sub',\n        'nonce',\n        'c_hash',\n    ];\n    const state = parameters.get('state');\n    if (fapi && (typeof expectedState === 'string' || state !== null)) {\n        requiredClaims.push('s_hash');\n    }\n    if (maxAge !== undefined) {\n        assertNumber(maxAge, true, '\"maxAge\" argument');\n    }\n    else if (client.default_max_age !== undefined) {\n        assertNumber(client.default_max_age, true, '\"client.default_max_age\"');\n    }\n    maxAge ??= client.default_max_age ?? skipAuthTimeCheck;\n    if (client.require_auth_time || maxAge !== skipAuthTimeCheck) {\n        requiredClaims.push('auth_time');\n    }\n    const { claims, header, jwt } = await validateJwt(id_token, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported, 'RS256'), getClockSkew(client), getClockTolerance(client), options?.[jweDecrypt])\n        .then(validatePresence.bind(undefined, requiredClaims))\n        .then(validateIssuer.bind(undefined, as))\n        .then(validateAudience.bind(undefined, client.client_id));\n    const clockSkew = getClockSkew(client);\n    const now = epochTime() + clockSkew;\n    if (claims.iat < now - 3600) {\n        throw OPE('unexpected JWT \"iat\" (issued at) claim value, it is too far in the past', JWT_TIMESTAMP_CHECK, { now, claims, claim: 'iat' });\n    }\n    assertString(claims.c_hash, 'ID Token \"c_hash\" (code hash) claim value', INVALID_RESPONSE, {\n        claims,\n    });\n    if (claims.auth_time !== undefined) {\n        assertNumber(claims.auth_time, true, 'ID Token \"auth_time\" (authentication time)', INVALID_RESPONSE, { claims });\n    }\n    if (maxAge !== skipAuthTimeCheck) {\n        const now = epochTime() + getClockSkew(client);\n        const tolerance = getClockTolerance(client);\n        if (claims.auth_time + maxAge < now - tolerance) {\n            throw OPE('too much time has elapsed since the last End-User authentication', JWT_TIMESTAMP_CHECK, { claims, now, tolerance, claim: 'auth_time' });\n        }\n    }\n    assertString(expectedNonce, '\"expectedNonce\" argument');\n    if (claims.nonce !== expectedNonce) {\n        throw OPE('unexpected ID Token \"nonce\" claim value', JWT_CLAIM_COMPARISON, {\n            expected: expectedNonce,\n            claims,\n            claim: 'nonce',\n        });\n    }\n    if (Array.isArray(claims.aud) && claims.aud.length !== 1) {\n        if (claims.azp === undefined) {\n            throw OPE('ID Token \"aud\" (audience) claim includes additional untrusted audiences', JWT_CLAIM_COMPARISON, { claims, claim: 'aud' });\n        }\n        if (claims.azp !== client.client_id) {\n            throw OPE('unexpected ID Token \"azp\" (authorized party) claim value', JWT_CLAIM_COMPARISON, {\n                expected: client.client_id,\n                claims,\n                claim: 'azp',\n            });\n        }\n    }\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = jwt.split('.');\n    const signature = b64u(encodedSignature);\n    const key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);\n    await validateJwsSignature(protectedHeader, payload, key, signature);\n    if ((await idTokenHashMatches(code, claims.c_hash, header, 'c_hash')) !== true) {\n        throw OPE('invalid ID Token \"c_hash\" (code hash) claim value', JWT_CLAIM_COMPARISON, {\n            code,\n            alg: header.alg,\n            claim: 'c_hash',\n            claims,\n        });\n    }\n    if ((fapi && state !== null) || claims.s_hash !== undefined) {\n        assertString(claims.s_hash, 'ID Token \"s_hash\" (state hash) claim value', INVALID_RESPONSE, {\n            claims,\n        });\n        assertString(state, '\"state\" response parameter', INVALID_RESPONSE, { parameters });\n        if ((await idTokenHashMatches(state, claims.s_hash, header, 's_hash')) !== true) {\n            throw OPE('invalid ID Token \"s_hash\" (state hash) claim value', JWT_CLAIM_COMPARISON, {\n                state,\n                alg: header.alg,\n                claim: 's_hash',\n                claims,\n            });\n        }\n    }\n    return result;\n}\nfunction checkSigningAlgorithm(client, issuer, fallback, header) {\n    if (client !== undefined) {\n        if (typeof client === 'string' ? header.alg !== client : !client.includes(header.alg)) {\n            throw OPE('unexpected JWT \"alg\" header parameter', INVALID_RESPONSE, {\n                header,\n                expected: client,\n                reason: 'client configuration',\n            });\n        }\n        return;\n    }\n    if (Array.isArray(issuer)) {\n        if (!issuer.includes(header.alg)) {\n            throw OPE('unexpected JWT \"alg\" header parameter', INVALID_RESPONSE, {\n                header,\n                expected: issuer,\n                reason: 'authorization server metadata',\n            });\n        }\n        return;\n    }\n    if (fallback !== undefined) {\n        if (typeof fallback === 'string'\n            ? header.alg !== fallback\n            : typeof fallback === 'function'\n                ? !fallback(header.alg)\n                : !fallback.includes(header.alg)) {\n            throw OPE('unexpected JWT \"alg\" header parameter', INVALID_RESPONSE, {\n                header,\n                expected: fallback,\n                reason: 'default value',\n            });\n        }\n        return;\n    }\n    throw OPE('missing client or server configuration to verify used JWT \"alg\" header parameter', undefined, { client, issuer, fallback });\n}\nfunction getURLSearchParameter(parameters, name) {\n    const { 0: value, length } = parameters.getAll(name);\n    if (length > 1) {\n        throw OPE(`\"${name}\" parameter must be provided only once`, INVALID_RESPONSE);\n    }\n    return value;\n}\nexport const skipStateCheck = Symbol();\nexport const expectNoState = Symbol();\nexport function validateAuthResponse(as, client, parameters, expectedState) {\n    assertAs(as);\n    assertClient(client);\n    if (parameters instanceof URL) {\n        parameters = parameters.searchParams;\n    }\n    if (!(parameters instanceof URLSearchParams)) {\n        throw CodedTypeError('\"parameters\" must be an instance of URLSearchParams, or URL', ERR_INVALID_ARG_TYPE);\n    }\n    if (getURLSearchParameter(parameters, 'response')) {\n        throw OPE('\"parameters\" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()', INVALID_RESPONSE, { parameters });\n    }\n    const iss = getURLSearchParameter(parameters, 'iss');\n    const state = getURLSearchParameter(parameters, 'state');\n    if (!iss && as.authorization_response_iss_parameter_supported) {\n        throw OPE('response parameter \"iss\" (issuer) missing', INVALID_RESPONSE, { parameters });\n    }\n    if (iss && iss !== as.issuer) {\n        throw OPE('unexpected \"iss\" (issuer) response parameter value', INVALID_RESPONSE, {\n            expected: as.issuer,\n            parameters,\n        });\n    }\n    switch (expectedState) {\n        case undefined:\n        case expectNoState:\n            if (state !== undefined) {\n                throw OPE('unexpected \"state\" response parameter encountered', INVALID_RESPONSE, {\n                    expected: undefined,\n                    parameters,\n                });\n            }\n            break;\n        case skipStateCheck:\n            break;\n        default:\n            assertString(expectedState, '\"expectedState\" argument');\n            if (state !== expectedState) {\n                throw OPE(state === undefined\n                    ? 'response parameter \"state\" missing'\n                    : 'unexpected \"state\" response parameter value', INVALID_RESPONSE, { expected: expectedState, parameters });\n            }\n    }\n    const error = getURLSearchParameter(parameters, 'error');\n    if (error) {\n        throw new AuthorizationResponseError('authorization response from the server is an error', {\n            cause: parameters,\n        });\n    }\n    const id_token = getURLSearchParameter(parameters, 'id_token');\n    const token = getURLSearchParameter(parameters, 'token');\n    if (id_token !== undefined || token !== undefined) {\n        throw new UnsupportedOperationError('implicit and hybrid flows are not supported');\n    }\n    return brand(new URLSearchParams(parameters));\n}\nfunction algToSubtle(alg) {\n    switch (alg) {\n        case 'PS256':\n        case 'PS384':\n        case 'PS512':\n            return { name: 'RSA-PSS', hash: `SHA-${alg.slice(-3)}` };\n        case 'RS256':\n        case 'RS384':\n        case 'RS512':\n            return { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${alg.slice(-3)}` };\n        case 'ES256':\n        case 'ES384':\n            return { name: 'ECDSA', namedCurve: `P-${alg.slice(-3)}` };\n        case 'ES512':\n            return { name: 'ECDSA', namedCurve: 'P-521' };\n        case 'EdDSA':\n            return 'Ed25519';\n        case 'Ed25519':\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            return alg;\n        default:\n            throw new UnsupportedOperationError('unsupported JWS algorithm', { cause: { alg } });\n    }\n}\nasync function importJwk(alg, jwk) {\n    const { ext, key_ops, use, ...key } = jwk;\n    return crypto.subtle.importKey('jwk', key, algToSubtle(alg), true, ['verify']);\n}\nexport async function deviceAuthorizationRequest(as, client, clientAuthentication, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'device_authorization_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(parameters);\n    body.set('client_id', client.client_id);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    return authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n}\nexport async function processDeviceAuthorizationResponse(as, client, response) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Device Authorization Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.device_code, '\"response\" body \"device_code\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    assertString(json.user_code, '\"response\" body \"user_code\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    assertString(json.verification_uri, '\"response\" body \"verification_uri\" property', INVALID_RESPONSE, { body: json });\n    let expiresIn = typeof json.expires_in !== 'number' ? parseFloat(json.expires_in) : json.expires_in;\n    assertNumber(expiresIn, true, '\"response\" body \"expires_in\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    json.expires_in = expiresIn;\n    if (json.verification_uri_complete !== undefined) {\n        assertString(json.verification_uri_complete, '\"response\" body \"verification_uri_complete\" property', INVALID_RESPONSE, { body: json });\n    }\n    if (json.interval !== undefined) {\n        assertNumber(json.interval, false, '\"response\" body \"interval\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    return json;\n}\nexport async function deviceCodeGrantRequest(as, client, clientAuthentication, deviceCode, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(deviceCode, '\"deviceCode\"');\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('device_code', deviceCode);\n    return tokenEndpointRequest(as, client, clientAuthentication, 'urn:ietf:params:oauth:grant-type:device_code', parameters, options);\n}\nexport async function processDeviceCodeResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nexport async function generateKeyPair(alg, options) {\n    assertString(alg, '\"alg\"');\n    const algorithm = algToSubtle(alg);\n    if (alg.startsWith('PS') || alg.startsWith('RS')) {\n        Object.assign(algorithm, {\n            modulusLength: options?.modulusLength ?? 2048,\n            publicExponent: new Uint8Array([0x01, 0x00, 0x01]),\n        });\n    }\n    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, [\n        'sign',\n        'verify',\n    ]);\n}\nfunction normalizeHtu(htu) {\n    const url = new URL(htu);\n    url.search = '';\n    url.hash = '';\n    return url.href;\n}\nasync function validateDPoP(request, accessToken, accessTokenClaims, options) {\n    const headerValue = request.headers.get('dpop');\n    if (headerValue === null) {\n        throw OPE('operation indicated DPoP use but the request has no DPoP HTTP Header', INVALID_REQUEST, { headers: request.headers });\n    }\n    if (request.headers.get('authorization')?.toLowerCase().startsWith('dpop ') === false) {\n        throw OPE(`operation indicated DPoP use but the request's Authorization HTTP Header scheme is not DPoP`, INVALID_REQUEST, { headers: request.headers });\n    }\n    if (typeof accessTokenClaims.cnf?.jkt !== 'string') {\n        throw OPE('operation indicated DPoP use but the JWT Access Token has no jkt confirmation claim', INVALID_REQUEST, { claims: accessTokenClaims });\n    }\n    const clockSkew = getClockSkew(options);\n    const proof = await validateJwt(headerValue, checkSigningAlgorithm.bind(undefined, options?.signingAlgorithms, undefined, supported), clockSkew, getClockTolerance(options), undefined)\n        .then(checkJwtType.bind(undefined, 'dpop+jwt'))\n        .then(validatePresence.bind(undefined, ['iat', 'jti', 'ath', 'htm', 'htu']));\n    const now = epochTime() + clockSkew;\n    const diff = Math.abs(now - proof.claims.iat);\n    if (diff > 300) {\n        throw OPE('DPoP Proof iat is not recent enough', JWT_TIMESTAMP_CHECK, {\n            now,\n            claims: proof.claims,\n            claim: 'iat',\n        });\n    }\n    if (proof.claims.htm !== request.method) {\n        throw OPE('DPoP Proof htm mismatch', JWT_CLAIM_COMPARISON, {\n            expected: request.method,\n            claims: proof.claims,\n            claim: 'htm',\n        });\n    }\n    if (typeof proof.claims.htu !== 'string' ||\n        normalizeHtu(proof.claims.htu) !== normalizeHtu(request.url)) {\n        throw OPE('DPoP Proof htu mismatch', JWT_CLAIM_COMPARISON, {\n            expected: normalizeHtu(request.url),\n            claims: proof.claims,\n            claim: 'htu',\n        });\n    }\n    {\n        const expected = b64u(await crypto.subtle.digest('SHA-256', buf(accessToken)));\n        if (proof.claims.ath !== expected) {\n            throw OPE('DPoP Proof ath mismatch', JWT_CLAIM_COMPARISON, {\n                expected,\n                claims: proof.claims,\n                claim: 'ath',\n            });\n        }\n    }\n    {\n        const expected = await calculateJwkThumbprint(proof.header.jwk);\n        if (accessTokenClaims.cnf.jkt !== expected) {\n            throw OPE('JWT Access Token confirmation mismatch', JWT_CLAIM_COMPARISON, {\n                expected,\n                claims: accessTokenClaims,\n                claim: 'cnf.jkt',\n            });\n        }\n    }\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = headerValue.split('.');\n    const signature = b64u(encodedSignature);\n    const { jwk, alg } = proof.header;\n    if (!jwk) {\n        throw OPE('DPoP Proof is missing the jwk header parameter', INVALID_REQUEST, {\n            header: proof.header,\n        });\n    }\n    const key = await importJwk(alg, jwk);\n    if (key.type !== 'public') {\n        throw OPE('DPoP Proof jwk header parameter must contain a public key', INVALID_REQUEST, {\n            header: proof.header,\n        });\n    }\n    await validateJwsSignature(protectedHeader, payload, key, signature);\n}\nexport async function validateJwtAccessToken(as, request, expectedAudience, options) {\n    assertAs(as);\n    if (!looseInstanceOf(request, Request)) {\n        throw CodedTypeError('\"request\" must be an instance of Request', ERR_INVALID_ARG_TYPE);\n    }\n    assertString(expectedAudience, '\"expectedAudience\"');\n    const authorization = request.headers.get('authorization');\n    if (authorization === null) {\n        throw OPE('\"request\" is missing an Authorization HTTP Header', INVALID_REQUEST, {\n            headers: request.headers,\n        });\n    }\n    let { 0: scheme, 1: accessToken, length } = authorization.split(' ');\n    scheme = scheme.toLowerCase();\n    switch (scheme) {\n        case 'dpop':\n        case 'bearer':\n            break;\n        default:\n            throw new UnsupportedOperationError('unsupported Authorization HTTP Header scheme', {\n                cause: { headers: request.headers },\n            });\n    }\n    if (length !== 2) {\n        throw OPE('invalid Authorization HTTP Header format', INVALID_REQUEST, {\n            headers: request.headers,\n        });\n    }\n    const requiredClaims = [\n        'iss',\n        'exp',\n        'aud',\n        'sub',\n        'iat',\n        'jti',\n        'client_id',\n    ];\n    if (options?.requireDPoP || scheme === 'dpop' || request.headers.has('dpop')) {\n        requiredClaims.push('cnf');\n    }\n    const { claims, header } = await validateJwt(accessToken, checkSigningAlgorithm.bind(undefined, options?.signingAlgorithms, undefined, supported), getClockSkew(options), getClockTolerance(options), undefined)\n        .then(checkJwtType.bind(undefined, 'at+jwt'))\n        .then(validatePresence.bind(undefined, requiredClaims))\n        .then(validateIssuer.bind(undefined, as))\n        .then(validateAudience.bind(undefined, expectedAudience))\n        .catch(reassignRSCode);\n    for (const claim of ['client_id', 'jti', 'sub']) {\n        if (typeof claims[claim] !== 'string') {\n            throw OPE(`unexpected JWT \"${claim}\" claim type`, INVALID_REQUEST, { claims });\n        }\n    }\n    if ('cnf' in claims) {\n        if (!isJsonObject(claims.cnf)) {\n            throw OPE('unexpected JWT \"cnf\" (confirmation) claim value', INVALID_REQUEST, { claims });\n        }\n        const { 0: cnf, length } = Object.keys(claims.cnf);\n        if (length) {\n            if (length !== 1) {\n                throw new UnsupportedOperationError('multiple confirmation claims are not supported', {\n                    cause: { claims },\n                });\n            }\n            if (cnf !== 'jkt') {\n                throw new UnsupportedOperationError('unsupported JWT Confirmation method', {\n                    cause: { claims },\n                });\n            }\n        }\n    }\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = accessToken.split('.');\n    const signature = b64u(encodedSignature);\n    const key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);\n    await validateJwsSignature(protectedHeader, payload, key, signature);\n    if (options?.requireDPoP ||\n        scheme === 'dpop' ||\n        claims.cnf?.jkt !== undefined ||\n        request.headers.has('dpop')) {\n        await validateDPoP(request, accessToken, claims, options).catch(reassignRSCode);\n    }\n    return claims;\n}\nfunction reassignRSCode(err) {\n    if (err instanceof OperationProcessingError && err?.code === INVALID_REQUEST) {\n        err.code = INVALID_RESPONSE;\n    }\n    throw err;\n}\nexport async function backchannelAuthenticationRequest(as, client, clientAuthentication, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'backchannel_authentication_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(parameters);\n    body.set('client_id', client.client_id);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    return authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n}\nexport async function processBackchannelAuthenticationResponse(as, client, response) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Backchannel Authentication Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.auth_req_id, '\"response\" body \"auth_req_id\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    let expiresIn = typeof json.expires_in !== 'number' ? parseFloat(json.expires_in) : json.expires_in;\n    assertNumber(expiresIn, true, '\"response\" body \"expires_in\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    json.expires_in = expiresIn;\n    if (json.interval !== undefined) {\n        assertNumber(json.interval, false, '\"response\" body \"interval\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    return json;\n}\nexport async function backchannelAuthenticationGrantRequest(as, client, clientAuthentication, authReqId, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(authReqId, '\"authReqId\"');\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('auth_req_id', authReqId);\n    return tokenEndpointRequest(as, client, clientAuthentication, 'urn:openid:params:grant-type:ciba', parameters, options);\n}\nexport async function processBackchannelAuthenticationGrantResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nexport async function dynamicClientRegistrationRequest(as, metadata, options) {\n    assertAs(as);\n    const url = resolveEndpoint(as, 'registration_endpoint', metadata.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    headers.set('content-type', 'application/json');\n    const method = 'POST';\n    if (options?.DPoP) {\n        assertDPoP(options.DPoP);\n        await options.DPoP.addProof(url, headers, method, options.initialAccessToken);\n    }\n    if (options?.initialAccessToken) {\n        headers.set('authorization', `${headers.has('dpop') ? 'DPoP' : 'Bearer'} ${options.initialAccessToken}`);\n    }\n    const response = await (options?.[customFetch] || fetch)(url.href, {\n        body: JSON.stringify(metadata),\n        headers: Object.fromEntries(headers.entries()),\n        method,\n        redirect: 'manual',\n        signal: signal(url, options?.signal),\n    });\n    options?.DPoP?.cacheNonce(response, url);\n    return response;\n}\nexport async function processDynamicClientRegistrationResponse(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 201, 'Dynamic Client Registration Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.client_id, '\"response\" body \"client_id\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    if (json.client_secret !== undefined) {\n        assertString(json.client_secret, '\"response\" body \"client_secret\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    if (json.client_secret) {\n        assertNumber(json.client_secret_expires_at, true, '\"response\" body \"client_secret_expires_at\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    return json;\n}\nexport async function resourceDiscoveryRequest(resourceIdentifier, options) {\n    return performDiscovery(resourceIdentifier, 'resourceIdentifier', (url) => {\n        prependWellKnown(url, '.well-known/oauth-protected-resource', true);\n        return url;\n    }, options);\n}\nexport async function processResourceDiscoveryResponse(expectedResourceIdentifier, response) {\n    const expected = expectedResourceIdentifier;\n    if (!(expected instanceof URL) && expected !== _nodiscoverycheck) {\n        throw CodedTypeError('\"expectedResourceIdentifier\" must be an instance of URL', ERR_INVALID_ARG_TYPE);\n    }\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    if (response.status !== 200) {\n        throw OPE('\"response\" is not a conform Resource Server Metadata response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);\n    }\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.resource, '\"response\" body \"resource\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    if (expected !== _nodiscoverycheck && new URL(json.resource).href !== expected.href) {\n        throw OPE('\"response\" body \"resource\" property does not match the expected value', JSON_ATTRIBUTE_COMPARISON, { expected: expected.href, body: json, attribute: 'resource' });\n    }\n    return json;\n}\nasync function getResponseJsonBody(response, check = assertApplicationJson) {\n    let json;\n    try {\n        json = await response.json();\n    }\n    catch (cause) {\n        check(response);\n        throw OPE('failed to parse \"response\" body as JSON', PARSE_ERROR, cause);\n    }\n    if (!isJsonObject(json)) {\n        throw OPE('\"response\" body must be a top level object', INVALID_RESPONSE, { body: json });\n    }\n    return json;\n}\nexport const _nopkce = nopkce;\nexport const _nodiscoverycheck = Symbol();\nexport const _expectedIssuer = Symbol();\n//# sourceMappingURL=index.js.map","import * as oauth from 'oauth4webapi';\n\nimport * as yup from 'yup';\nimport { KnownError, KnownErrors } from '../known-errors';\nimport { inlineProductSchema } from '../schema-fields';\nimport { AccessToken, InternalSession, RefreshToken } from '../sessions';\nimport { generateSecureRandomString } from '../utils/crypto';\nimport { HexclaveAssertionError, throwErr } from '../utils/errors';\nimport { globalVar } from '../utils/globals';\nimport { HTTP_METHODS, HttpMethod } from '../utils/http';\nimport { ReadonlyJson } from '../utils/json';\nimport { publishableClientKeyNotNecessarySentinel } from '../utils/oauth';\nimport { filterUndefined, filterUndefinedOrNull } from '../utils/objects';\nimport { AuthenticationResponseJSON, PublicKeyCredentialCreationOptionsJSON, PublicKeyCredentialRequestOptionsJSON, RegistrationResponseJSON } from '../utils/passkey';\nimport { wait } from '../utils/promises';\nimport { Result } from \"../utils/results\";\nimport { deindent } from '../utils/strings';\nimport { urlString } from '../utils/urls';\nimport { ConnectedAccountAccessTokenCrud, ConnectedAccountCrud } from './crud/connected-accounts';\nimport { ContactChannelsCrud } from './crud/contact-channels';\nimport { CurrentUserCrud } from './crud/current-user';\nimport { CustomerInvoicesListResponse, ListCustomerInvoicesOptions } from './crud/invoices';\nimport { ItemCrud } from './crud/items';\nimport { NotificationPreferenceCrud } from './crud/notification-preferences';\nimport { OAuthProviderCrud } from './crud/oauth-providers';\nimport { CustomerProductsListResponse, ListCustomerProductsOptions } from './crud/products';\nimport { TeamApiKeysCrud, UserApiKeysCrud, teamApiKeysCreateInputSchema, teamApiKeysCreateOutputSchema, userApiKeysCreateInputSchema, userApiKeysCreateOutputSchema } from './crud/project-api-keys';\nimport { ProjectPermissionsCrud } from './crud/project-permissions';\nimport { AdminUserProjectsCrud, ClientProjectsCrud } from './crud/projects';\nimport { SessionsCrud } from './crud/sessions';\nimport { TeamInvitationCrud } from './crud/team-invitation';\nimport { TeamMemberProfilesCrud } from './crud/team-member-profiles';\nimport { TeamPermissionsCrud } from './crud/team-permissions';\nimport { TeamsCrud } from './crud/teams';\n\nexport type RequestLogEntry = {\n  path: string,\n  method: string,\n  status?: number,\n  duration: number,\n  error?: string,\n};\n\nexport type RequestListener = (entry: RequestLogEntry) => void;\n\nexport type ClientInterfaceOptions = {\n  clientVersion: string,\n  // This is a function instead of a string because it might be different based on the environment (for example client vs server)\n  getBaseUrl: () => string,\n  getAnalyticsBaseUrl?: () => string,\n  /**\n   * Ordered list of base URLs for request routing with fallback.\n   * Index 0 = primary, index 1..N = fallbacks in priority order.\n   * A single-element array means no fallback occurs.\n   */\n  getApiUrls: () => string[],\n  /**\n   * When a fallback succeeds and becomes the active server, this is the initial probability\n   * (0–1) that any given request will probe the primary to check if it's back.\n   * Halves on each failed probe, resets on success. Default: 0.3 (30%).\n   */\n  probeRate?: number,\n  extraRequestHeaders: Record<string, string>,\n  projectId: string,\n  prepareRequest?: () => Promise<void>,\n} & ({\n  publishableClientKey?: string,\n} | {\n  projectOwnerSession: InternalSession | (() => Promise<string | null>),\n});\n\ntype BotChallengeInput = {\n  token?: string,\n  phase?: \"invisible\" | \"visible\",\n  unavailable?: true,\n};\n\nconst botChallengeKnownErrors = [\n  KnownErrors.BotChallengeRequired,\n  KnownErrors.BotChallengeFailed,\n] as const;\n\nfunction isBotChallengeKnownError(error: unknown): error is KnownErrors[\"BotChallengeRequired\"] | KnownErrors[\"BotChallengeFailed\"] {\n  return KnownErrors.BotChallengeRequired.isInstance(error) || KnownErrors.BotChallengeFailed.isInstance(error);\n}\n\nfunction getBotChallengeRequestFields(botChallenge: BotChallengeInput | undefined, context: string) {\n  if (botChallenge?.unavailable) {\n    if (botChallenge.token != null || botChallenge.phase != null) {\n      throw new HexclaveAssertionError(`${context} bot challenge unavailability cannot be combined with a token or phase.`);\n    }\n\n    return {\n      bot_challenge_unavailable: \"true\" as const,\n    };\n  }\n\n  const challengeToken = botChallenge?.token?.trim() || undefined;\n  if (botChallenge?.phase === \"visible\") {\n    if (challengeToken == null) {\n      // Backward-compatible fallback for older callers; prefer `unavailable: true`.\n      return {\n        bot_challenge_unavailable: \"true\",\n      };\n    }\n\n    return {\n      bot_challenge_token: challengeToken,\n      bot_challenge_phase: \"visible\" as const,\n    };\n  }\n\n  if (challengeToken == null) {\n    if (botChallenge?.phase != null) {\n      throw new HexclaveAssertionError(`${context} bot challenge phase options require a token.`);\n    }\n\n    return {};\n  }\n\n  if (botChallenge?.phase == null) {\n    return {\n      bot_challenge_token: challengeToken,\n    };\n  }\n\n  return {\n    bot_challenge_token: challengeToken,\n    bot_challenge_phase: \"invisible\" as const,\n  };\n}\n\nasync function encodeGzipJsonBody(\n  jsonBody: string,\n  options: { keepalive: boolean },\n): Promise<{ body: BodyInit, contentType: string }> {\n  // Used by analytics-event and session-replay batch uploads; the server\n  // gunzips application/octet-stream bodies before schema validation.\n  // keepalive flushes must dispatch before page tear-down, so skip async gzip.\n  if (options.keepalive) {\n    return { body: jsonBody, contentType: \"application/json\" };\n  }\n  const CompressionStreamCtor: typeof CompressionStream | undefined =\n    (globalVar as { CompressionStream?: typeof CompressionStream }).CompressionStream;\n  if (typeof CompressionStreamCtor !== \"function\" || typeof Blob === \"undefined\" || typeof Response === \"undefined\") {\n    return { body: jsonBody, contentType: \"application/json\" };\n  }\n  try {\n    const stream = new Blob([jsonBody]).stream().pipeThrough(new CompressionStreamCtor(\"gzip\"));\n    const buffer = await new Response(stream).arrayBuffer();\n    return { body: new Uint8Array(buffer), contentType: \"application/octet-stream\" };\n  } catch {\n    // Broken CompressionStream (e.g. Safari < 16.4): fall back to plain JSON.\n    return { body: jsonBody, contentType: \"application/json\" };\n  }\n}\n\nexport class HexclaveClientInterface {\n  private pendingNetworkDiagnostics?: ReturnType<HexclaveClientInterface[\"_runNetworkDiagnosticsInner\"]>;\n  private _requestListeners = new Set<RequestListener>();\n\n  /**\n   * Fallback state. When null, we're in normal mode (primary first).\n   * When set, we skip straight to `stickyIndex` and only probe primary occasionally.\n   */\n  private _sticky: { index: number, probeRate: number } | null = null;\n  private readonly _initialProbeRate: number;\n\n  constructor(public readonly options: ClientInterfaceOptions) {\n    this._initialProbeRate = options.probeRate ?? 0.3;\n  }\n\n  addRequestListener(listener: RequestListener): () => void {\n    this._requestListeners.add(listener);\n    return () => {\n      this._requestListeners.delete(listener);\n    };\n  }\n\n  get projectId() {\n    return this.options.projectId;\n  }\n\n  getApiUrl() {\n    return this.options.getBaseUrl() + \"/api/v1\";\n  }\n\n  getApiUrls(): string[] {\n    return this.options.getApiUrls().map(u => u + \"/api/v1\");\n  }\n\n  /**\n   * Returns the best-known-good API URL: the sticky fallback if we're in\n   * fallback mode, otherwise the primary. Use for browser-navigated URLs\n   * (e.g. OAuth authorize) where _withFallback can't help.\n   */\n  getBestApiUrl(): string {\n    const apiUrls = this.getApiUrls();\n    if (this._sticky && apiUrls[this._sticky.index]) {\n      return apiUrls[this._sticky.index];\n    }\n    return apiUrls[0];\n  }\n\n  /**\n   * Routes a request through an ordered URL list with automatic failover.\n   *\n   * The URL list is [primary, ...fallbacks]. The logic has two modes:\n   *\n   * **Normal mode** (`_sticky` is null) — try each URL in order. If a\n   * non-primary URL succeeds, enter sticky mode on that index.\n   *\n   * **Sticky mode** — a previous request already failed over. We remember\n   * which URL worked and go there directly. Occasionally (controlled by a\n   * decaying probe rate) we probe the primary to see if it recovered:\n   *   - Probe succeeds → exit sticky mode, use result.\n   *   - Probe fails → halve probe rate, use sticky URL.\n   *   - Sticky URL fails → exit sticky mode, do a full iteration.\n   *\n   * In both modes, a full iteration tries every URL once per pass for 2\n   * passes before giving up. KnownErrors and 4xx API responses (except 429)\n   * are never retried (they're application-level, not network-level).\n   *\n   * Single-URL lists skip all of this and use 5-retry behavior directly.\n   */\n  protected async _withFallback<T>(cb: (apiUrl: string, retryOptions: { maxAttempts: number, skipDiagnostics: boolean }) => Promise<T>): Promise<T> {\n    const apiUrls = this.getApiUrls();\n\n    // Single URL — no fallback, just retry normally.\n    if (apiUrls.length <= 1) {\n      return await cb(apiUrls[0], { maxAttempts: 5, skipDiagnostics: false });\n    }\n\n    // If we're in sticky mode, try the remembered URL (with an optional primary probe first).\n    if (this._sticky) {\n      const result = await this._tryStickyUrl(apiUrls, cb);\n      if (result !== undefined) return result;\n      // Sticky URL failed — _sticky was cleared, fall through to full iteration.\n    }\n\n    // Full iteration: try every URL in order, 2 passes.\n    return await this._iterateUrls(apiUrls, cb);\n  }\n\n  private _shouldSkipFallback(error: unknown) {\n    return error instanceof KnownError || this._isNonRetryableApiResponseError(error);\n  }\n\n  private _isNonRetryableApiResponseError(error: unknown) {\n    const response = this._getApiResponseFromError(error);\n    return response != null && response.status >= 400 && response.status < 500;\n  }\n\n  private _getApiResponseFromError(error: unknown, seenErrors = new Set<Error>()): Response | null {\n    if (error instanceof Response) {\n      return error;\n    }\n    if (!(error instanceof Error) || seenErrors.has(error)) {\n      return null;\n    }\n\n    seenErrors.add(error);\n    return this._getApiResponseFromError(error.cause, seenErrors);\n  }\n\n  /**\n   * Attempts the sticky URL, optionally probing primary first.\n   * Returns the result on success, or `undefined` if we should fall through to full iteration.\n   */\n  private async _tryStickyUrl<T>(\n    apiUrls: string[],\n    cb: (apiUrl: string, retryOptions: { maxAttempts: number, skipDiagnostics: boolean }) => Promise<T>,\n  ): Promise<T | undefined> {\n    const sticky = this._sticky!;\n\n    // Probabilistically probe primary to check if it's back.\n    if (Math.random() < sticky.probeRate) {\n      try {\n        const result = await cb(apiUrls[0], { maxAttempts: 1, skipDiagnostics: true });\n        this._sticky = null;\n        return result;\n      } catch (e) {\n        if (this._shouldSkipFallback(e)) throw e;\n        sticky.probeRate = Math.max(sticky.probeRate * 0.5, 0.01);\n      }\n    }\n\n    // Try the sticky URL itself.\n    try {\n      return await cb(apiUrls[sticky.index], { maxAttempts: 1, skipDiagnostics: true });\n    } catch (e) {\n      if (this._shouldSkipFallback(e)) throw e;\n      this._sticky = null;\n      return undefined;\n    }\n  }\n\n  /**\n   * Tries every URL in order for up to 2 passes.\n   * If a non-primary URL (index > 0) succeeds, enters sticky mode on it.\n   */\n  private async _iterateUrls<T>(\n    apiUrls: string[],\n    cb: (apiUrl: string, retryOptions: { maxAttempts: number, skipDiagnostics: boolean }) => Promise<T>,\n  ): Promise<T> {\n    let lastError: Error | undefined;\n\n    for (let pass = 0; pass < 2; pass++) {\n      for (let i = 0; i < apiUrls.length; i++) {\n        try {\n          const result = await cb(apiUrls[i], { maxAttempts: 1, skipDiagnostics: true });\n          if (i > 0) {\n            this._sticky = { index: i, probeRate: this._initialProbeRate };\n          }\n          return result;\n        } catch (e) {\n          if (this._shouldSkipFallback(e)) throw e;\n          lastError = e instanceof Error ? e : new Error(String(e));\n        }\n      }\n    }\n\n    throw lastError!;\n  }\n\n  getAnalyticsApiUrl() {\n    return (this.options.getAnalyticsBaseUrl ?? this.options.getBaseUrl)() + \"/api/v1\";\n  }\n\n  public async runNetworkDiagnostics(session?: InternalSession | null, requestType?: \"client\" | \"server\" | \"admin\") {\n    if (this.pendingNetworkDiagnostics) {\n      return await this.pendingNetworkDiagnostics;\n    }\n\n    this.pendingNetworkDiagnostics = this._runNetworkDiagnosticsInner(session, requestType);\n    try {\n      return await this.pendingNetworkDiagnostics;\n    } finally {\n      this.pendingNetworkDiagnostics = undefined;\n    }\n  }\n\n  private async _runNetworkDiagnosticsInner(session?: InternalSession | null, requestType?: \"client\" | \"server\" | \"admin\") {\n    const tryRequest = async (cb: () => Promise<void>) => {\n      try {\n        await cb();\n        return \"OK\";\n      } catch (e) {\n        return `${e}`;\n      }\n    };\n    const cfTrace = await tryRequest(async () => {\n      const res = await fetch(\"https://1.1.1.1/cdn-cgi/trace\");\n      if (!res.ok) {\n        throw new Error(`${res.status} ${res.statusText}: ${await res.text()}`);\n      }\n    });\n    const baseUrlBackend = await tryRequest(async () => {\n      const res = await fetch(new URL(\"/health\", this.getApiUrl()));\n      if (!res.ok) {\n        throw new Error(`${res.status} ${res.statusText}: ${await res.text()}`);\n      }\n    });\n    const prodDashboard = await tryRequest(async () => {\n      const res = await fetch(\"https://app.hexclave.com/health\");\n      if (!res.ok) {\n        throw new Error(`${res.status} ${res.statusText}: ${await res.text()}`);\n      }\n    });\n    const prodBackend = await tryRequest(async () => {\n      const res = await fetch(\"https://api.hexclave.com/health\");\n      if (!res.ok) {\n        throw new Error(`${res.status} ${res.statusText}: ${await res.text()}`);\n      }\n    });\n    return {\n      \"navigator?.onLine\": globalVar.navigator?.onLine,\n      cfTrace,\n      baseUrlBackend,\n      prodDashboard,\n      prodBackend,\n    };\n  }\n\n  protected async _createNetworkError(cause: Error, session?: InternalSession | null, requestType?: \"client\" | \"server\" | \"admin\") {\n    return new Error(deindent`\n      Hexclave is unable to connect to the server. Please check your internet connection and try again.\n\n      If the problem persists, please contact support and provide a screenshot of your entire browser console.\n\n      ${cause}\n\n      ${JSON.stringify(await this.runNetworkDiagnostics(session, requestType), null, 2)}\n    `, { cause: cause });\n  }\n\n  protected async _networkRetry<T>(\n    cb: () => Promise<Result<T, any>>,\n    session?: InternalSession | null,\n    requestType?: \"client\" | \"server\" | \"admin\",\n    options?: { maxAttempts?: number, skipDiagnostics?: boolean },\n  ): Promise<T> {\n    const retriedResult = await Result.retry(\n      cb,\n      options?.maxAttempts ?? 5,\n      { exponentialDelayBase: 1000 },\n    );\n\n    // try to diagnose the error for the user\n    if (retriedResult.status === \"error\") {\n      if (globalVar.navigator && globalVar.navigator.onLine === false) {\n        throw new Error(\"You are offline. Please check your internet connection and try again. (window.navigator.onLine is false)\", { cause: retriedResult.error });\n      }\n      if (options?.skipDiagnostics) {\n        throw retriedResult.error;\n      }\n      throw await this._createNetworkError(retriedResult.error, session, requestType);\n    }\n    return retriedResult.data;\n  }\n\n  protected async _networkRetryException<T>(\n    cb: () => Promise<T>,\n    session?: InternalSession | null,\n    requestType?: \"client\" | \"server\" | \"admin\",\n    options?: { maxAttempts?: number, skipDiagnostics?: boolean },\n  ): Promise<T> {\n    return await this._networkRetry(async () => await Result.fromThrowingAsync(cb), session, requestType, options);\n  }\n\n  public async fetchNewAccessToken(refreshToken: RefreshToken) {\n    if (\"projectOwnerSession\" in this.options) {\n      // TODO support it\n      throw new Error(\"Admin session token is currently not supported for fetching new access token. Did you try to log in on a StackApp initiated with the admin session?\");\n    }\n\n    const clientSecret = this.options.publishableClientKey ?? publishableClientKeyNotNecessarySentinel;\n    return await this._withFallback(async (apiUrl, retryOptions) => {\n      return await this._fetchNewAccessTokenInner(refreshToken, clientSecret, apiUrl, retryOptions);\n    });\n  }\n\n  private async _fetchNewAccessTokenInner(refreshToken: RefreshToken, clientSecret: string, apiUrl: string, retryOptions?: { maxAttempts?: number, skipDiagnostics?: boolean }) {\n    const tokenEndpoint = apiUrl + '/auth/oauth/token';\n    const as = {\n      issuer: this.options.getBaseUrl(),\n      algorithm: 'oauth2',\n      token_endpoint: tokenEndpoint,\n    };\n    const client: oauth.Client = {\n      client_id: this.projectId,\n      client_secret: clientSecret,\n    };\n\n    const clientAuthentication = oauth.ClientSecretPost(clientSecret);\n    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition\n    const allowInsecure = tokenEndpoint.startsWith('http://');\n\n    const response = await this._networkRetryException(async () => {\n      const rawResponse = await oauth.refreshTokenGrantRequest(\n        as,\n        client,\n        clientAuthentication,\n        refreshToken.token,\n        allowInsecure ? { [oauth.allowInsecureRequests]: true } : undefined,\n      );\n\n      const response = await this._processResponse(rawResponse);\n\n      if (response.status === \"error\") {\n        const error = response.error;\n        if (KnownErrors.RefreshTokenError.isInstance(error)) {\n          return null;\n        }\n        throw error;\n      }\n\n      if (!response.data.ok) {\n        const body = await response.data.text();\n        throw new Error(`Failed to send refresh token request: ${response.status} ${body}`, { cause: response.data });\n      }\n\n      return response.data;\n    }, undefined, undefined, retryOptions);\n    if (!response) return null;\n\n    let result: oauth.TokenEndpointResponse;\n    try {\n      result = await oauth.processRefreshTokenResponse(as, client, response);\n    } catch (e){\n      if (e instanceof oauth.ResponseBodyError) {\n        throw new HexclaveAssertionError(\"ResponseBodyError when processing refresh token response\", {\n          cause: e.cause,\n          code: e.code,\n          error: e.error,\n        });\n      }\n      throw new HexclaveAssertionError(\"Unexpected error when processing refresh token response\", { cause: e });\n    }\n\n    if (!result.access_token) {\n      throw new HexclaveAssertionError(\"Access token not found in token endpoint response, this is weird!\");\n    }\n\n    return AccessToken.createIfValid(result.access_token) ?? throwErr(\"Access token in fetchNewAccessToken is invalid, looks like the backend is returning an invalid token!\", { result });\n  }\n\n  public async sendClientRequest(\n    path: string,\n    requestOptions: RequestInit,\n    session: InternalSession | null,\n    requestType: \"client\" | \"server\" | \"admin\" = \"client\",\n    apiUrlOverride?: string,\n    retryOptions?: { maxAttempts?: number, skipDiagnostics?: boolean },\n  ) {\n    session ??= this.createSession({\n      refreshToken: null,\n    });\n\n    if (apiUrlOverride) {\n      return await this._networkRetry(\n        () => this.sendClientRequestInner(path, requestOptions, session!, requestType, apiUrlOverride, retryOptions),\n        session,\n        requestType,\n        retryOptions,\n      );\n    }\n\n    return await this._withFallback(async (apiUrl, fallbackRetryOptions) => {\n      return await this._networkRetry(\n        () => this.sendClientRequestInner(path, requestOptions, session!, requestType, apiUrl, retryOptions),\n        session,\n        requestType,\n        { ...fallbackRetryOptions, ...retryOptions },\n      );\n    });\n  }\n\n  public createSession(options: Omit<ConstructorParameters<typeof InternalSession>[0], \"refreshAccessTokenCallback\">): InternalSession {\n    const session = new InternalSession({\n      refreshAccessTokenCallback: async (refreshToken) => await this.fetchNewAccessToken(refreshToken),\n      ...options,\n    });\n    return session;\n  }\n\n  async sendSessionReplayBatch(\n    body: string,\n    session: InternalSession | null,\n    options: { keepalive: boolean },\n  ): Promise<Result<Response, Error>> {\n    try {\n      const encoded = await encodeGzipJsonBody(body, { keepalive: options.keepalive });\n      const response = await this.sendClientRequest(\n        \"/session-replays/batch\",\n        {\n          method: \"POST\",\n          headers: { \"Content-Type\": encoded.contentType },\n          body: encoded.body,\n          keepalive: options.keepalive,\n        },\n        session,\n        \"client\",\n        this.getAnalyticsApiUrl(),\n        { maxAttempts: 1, skipDiagnostics: true },\n      );\n      return Result.ok(response);\n    } catch (e) {\n      return Result.error(e instanceof Error ? e : new Error(String(e)));\n    }\n  }\n\n  async sendAnalyticsEventBatch(\n    body: string,\n    session: InternalSession | null,\n    options: { keepalive: boolean },\n  ): Promise<Result<Response, Error>> {\n    try {\n      const encoded = await encodeGzipJsonBody(body, { keepalive: options.keepalive });\n      const response = await this.sendClientRequest(\n        \"/analytics/events/batch\",\n        {\n          method: \"POST\",\n          headers: { \"Content-Type\": encoded.contentType },\n          body: encoded.body,\n          keepalive: options.keepalive,\n        },\n        session,\n        \"client\",\n        this.getAnalyticsApiUrl(),\n        { maxAttempts: 1, skipDiagnostics: true },\n      );\n      return Result.ok(response);\n    } catch (e) {\n      return Result.error(e instanceof Error ? e : new Error(String(e)));\n    }\n  }\n\n  protected async sendClientRequestAndCatchKnownError<E extends typeof KnownErrors[keyof KnownErrors]>(\n    path: string,\n    requestOptions: RequestInit,\n    tokenStoreOrNull: InternalSession | null,\n    errorsToCatch: readonly E[],\n  ): Promise<Result<\n    Response & {\n      usedTokens: {\n        accessToken: AccessToken,\n        refreshToken: RefreshToken | null,\n      } | null,\n    },\n    InstanceType<E>\n  >> {\n    try {\n      return Result.ok(await this.sendClientRequest(path, requestOptions, tokenStoreOrNull));\n    } catch (e) {\n      for (const errorType of errorsToCatch) {\n        if (errorType.isInstance(e)) {\n          return Result.error(e as InstanceType<E>);\n        }\n      }\n      throw e;\n    }\n  }\n\n  private async sendClientRequestInner(\n    path: string,\n    options: RequestInit,\n    session: InternalSession,\n    requestType: \"client\" | \"server\" | \"admin\",\n    apiUrlOverride?: string,\n    innerOptions?: { skipDiagnostics?: boolean },\n  ): Promise<Result<Response & {\n    usedTokens: {\n      accessToken: AccessToken,\n      refreshToken: RefreshToken | null,\n    } | null,\n  }>> {\n    /**\n     * `tokenObj === null` means the session is invalid/not logged in\n     */\n    let tokenObj = await session.getOrFetchLikelyValidTokens(20_000, null);\n\n    let adminSession: InternalSession | null = null;\n    let adminTokenObj: { accessToken: AccessToken, refreshToken: RefreshToken | null } | null = null;\n\n    if (\"projectOwnerSession\" in this.options) {\n      const projectOwnerSession = this.options.projectOwnerSession;\n\n      if (typeof projectOwnerSession === 'function') {\n        const accessTokenString = await projectOwnerSession();\n        if (accessTokenString) {\n          const accessToken = AccessToken.createIfValid(accessTokenString);\n          if (accessToken) {\n            adminTokenObj = { accessToken, refreshToken: null };\n          }\n        }\n      } else {\n        adminSession = projectOwnerSession;\n        adminTokenObj = await projectOwnerSession.getOrFetchLikelyValidTokens(20_000, null);\n      }\n    }\n\n    // all requests should be dynamic to prevent Next.js caching\n    await this.options.prepareRequest?.();\n\n    let url = (apiUrlOverride ?? this.getApiUrl()) + path;\n    if (url.endsWith(\"/\")) {\n      url = url.slice(0, -1);\n    }\n    const params: RequestInit = {\n      /**\n       * This fetch may be cross-origin, in which case we don't want to send cookies of the\n       * original origin (this is the default behavior of `credentials`).\n       *\n       * To help debugging, also omit cookies on same-origin, so we don't accidentally\n       * implement reliance on cookies anywhere.\n       *\n       * However, Cloudflare Workers don't actually support `credentials`, so we only set it\n       * if Cloudflare-exclusive globals are not detected. https://github.com/cloudflare/workers-sdk/issues/2514\n       */\n      ...(\"WebSocketPair\" in globalVar ? {} : {\n        credentials: \"omit\",\n      }),\n      ...options,\n      headers: {\n        // Hexclave rebrand: emit x-hexclave-* request headers; the backend proxy dual-accepts both x-hexclave-* and x-stack-*.\n        \"X-Hexclave-Override-Error-Status\": \"true\",\n        \"X-Hexclave-Project-Id\": this.projectId,\n        \"X-Hexclave-Access-Type\": requestType,\n        \"X-Hexclave-Client-Version\": this.options.clientVersion,\n        ...(tokenObj ? {\n          \"X-Hexclave-Access-Token\": tokenObj.accessToken.token,\n        } : {}),\n        ...(tokenObj?.refreshToken ? {\n          \"X-Hexclave-Refresh-Token\": tokenObj.refreshToken.token,\n        } : {}),\n        \"X-Hexclave-Allow-Anonymous-User\": \"true\",\n        ...(\"publishableClientKey\" in this.options && this.options.publishableClientKey ? {\n          \"X-Hexclave-Publishable-Client-Key\": this.options.publishableClientKey,\n        } : {}),\n        ...(adminTokenObj ? {\n          \"X-Hexclave-Admin-Access-Token\": adminTokenObj.accessToken.token,\n        } : {}),\n        /**\n         * Next.js until v15 would cache fetch requests by default, and forcefully disabling it was nearly impossible.\n         *\n         * This header is used to change the cache key and hence always disable it, because we do our own caching.\n         *\n         * When we drop support for Next.js <15, we may be able to remove this header, but please make sure that this is\n         * the case (I haven't actually tested.)\n         */\n        \"X-Hexclave-Random-Nonce\": generateSecureRandomString(),\n        // don't show a warning when proxying the API through ngrok (only relevant if the API url is an ngrok site)\n        'ngrok-skip-browser-warning': 'true',\n        ...this.options.extraRequestHeaders,\n        ...options.headers,\n      },\n      /**\n       * Cloudflare Workers does not support cache, so don't pass it there\n       */\n      ...(\"WebSocketPair\" in globalVar ? {} : {\n        cache: \"no-store\",\n      }),\n    };\n\n    const startTime = performance.now();\n    let rawRes;\n    try {\n      rawRes = await fetch(url, params);\n    } catch (e) {\n      if (this._requestListeners.size > 0) {\n        const entry: RequestLogEntry = { path, method: (params.method ?? \"GET\").toUpperCase(), duration: Math.round(performance.now() - startTime), error: e instanceof Error ? e.message : \"Network error\" };\n        this._requestListeners.forEach((l) => l(entry));\n      }\n      if (e instanceof TypeError) {\n        // Likely to be a network error. Retry if the request is idempotent, throw network error otherwise.\n        if (HTTP_METHODS[(params.method ?? \"GET\") as HttpMethod].idempotent) {\n          return Result.error(e);\n        } else if (innerOptions?.skipDiagnostics) {\n          throw e;\n        } else {\n          throw await this._createNetworkError(e, session, requestType);\n        }\n      }\n      throw e;\n    }\n\n    const preprocessedRes = await this._preprocessResponse(rawRes);\n\n    if (this._requestListeners.size > 0) {\n      const entry: RequestLogEntry = { path, method: (params.method ?? \"GET\").toUpperCase(), status: preprocessedRes.status, duration: Math.round(performance.now() - startTime) };\n      this._requestListeners.forEach((l) => l(entry));\n    }\n\n    const processedRes = await this._processResponse(preprocessedRes);\n\n    if (processedRes.status === \"error\") {\n      // If the access token is invalid, reset it and retry\n      if (KnownErrors.InvalidAccessToken.isInstance(processedRes.error)) {\n        if (!tokenObj) {\n          throw new HexclaveAssertionError(\"Received invalid access token, but session is not logged in\", { tokenObj, processedRes });\n        }\n        session.markAccessTokenExpired(tokenObj.accessToken);\n        return Result.error(processedRes.error);\n      }\n\n      // Same for the admin access token\n      // TODO HACK: Some of the backend hasn't been ported to use the new error codes, so if we have project owner tokens we need to check for ApiKeyNotFound too. Once the migration to smartRouteHandlers is complete, we can check for InvalidAdminAccessToken only.\n      if (adminSession && (KnownErrors.InvalidAdminAccessToken.isInstance(processedRes.error) || KnownErrors.ApiKeyNotFound.isInstance(processedRes.error))) {\n        if (!adminTokenObj) {\n          throw new HexclaveAssertionError(\"Received invalid admin access token, but admin session is not logged in\", { adminTokenObj, processedRes });\n        }\n        adminSession.markAccessTokenExpired(adminTokenObj.accessToken);\n        return Result.error(processedRes.error);\n      }\n\n      // Known errors are client side errors, so except for the ones above they should not be retried\n      // Hence, throw instead of returning an error\n      throw processedRes.error;\n    }\n\n\n    const res = Object.assign(processedRes.data, {\n      usedTokens: tokenObj,\n    });\n    if (res.ok) {\n      return Result.ok(res);\n    } else if (res.status === 429) {\n      const retryAfter = res.headers.get(\"Retry-After\");\n      if (retryAfter !== null) {\n        console.log(`Rate limited while sending request to ${url}. Will retry after ${retryAfter} seconds...`);\n        await wait(Number(retryAfter) * 1000);\n        return Result.error(new Error(`Rate limited, retrying after ${retryAfter} seconds`));\n      }\n\n      console.log(`Rate limited while sending request to ${url}, no retry-after header received. Retrying with default backoff...`);\n      return Result.error(new Error(\"Rate limited, no retry-after header received\"));\n    } else {\n      const error = await res.text();\n\n      // Do not retry, throw error instead of returning one\n      if (res.status >= 400 && res.status < 500) {\n        throw new Error(`Failed to send request to ${url}: ${res.status} ${error}`, { cause: res });\n      }\n      const errorObj = new HexclaveAssertionError(`Failed to send request to ${url}: ${res.status} ${error}`, { request: params, res, path });\n\n      if (res.status === 508 && error.includes(\"INFINITE_LOOP_DETECTED\")) {\n        // Some Vercel deployments seem to have an odd infinite loop bug. In that case, retry.\n        // See: https://github.com/hexclave/hexclave/issues/319\n        return Result.error(errorObj);\n      }\n\n      // Do not retry, throw error instead of returning one\n      throw errorObj;\n    }\n  }\n\n  private async _preprocessResponse(rawRes: Response): Promise<Response> {\n    let res = rawRes;\n    // Hexclave rebrand: prefer the x-hexclave-* response header, fall back to the legacy x-stack-* name.\n    if (rawRes.headers.has(\"x-hexclave-actual-status\") || rawRes.headers.has(\"x-stack-actual-status\")) {\n      const actualStatus = Number(rawRes.headers.get(\"x-hexclave-actual-status\") ?? rawRes.headers.get(\"x-stack-actual-status\"));\n      res = new Response(rawRes.body, {\n        status: actualStatus,\n        statusText: rawRes.statusText,\n        headers: rawRes.headers,\n      });\n    }\n    return res;\n  }\n\n  private async _processResponse(res: Response): Promise<Result<Response, KnownError>> {\n    // Handle known errors\n    // Hexclave rebrand: prefer the x-hexclave-* response header, fall back to the legacy x-stack-* name.\n    if (res.headers.has(\"x-hexclave-known-error\") || res.headers.has(\"x-stack-known-error\")) {\n      const errorJson = await res.json();\n      const knownErrorHeader = res.headers.get(\"x-hexclave-known-error\") ?? res.headers.get(\"x-stack-known-error\");\n      if (knownErrorHeader !== errorJson.code) {\n        throw new HexclaveAssertionError(\"Mismatch between x-hexclave-known-error/x-stack-known-error header and error code in body; the server's response is invalid\");\n      }\n      const error = KnownError.fromJson(errorJson);\n      return Result.error(error);\n    }\n\n    return Result.ok(res);\n  }\n\n  public async checkFeatureSupport(options: { featureName?: string } & ReadonlyJson): Promise<never> {\n    const res = await this.sendClientRequest(\"/check-feature-support\", {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify(options),\n    }, null);\n\n    throw new HexclaveAssertionError(await res.text());\n  }\n\n  async sendForgotPasswordEmail(\n    email: string,\n    callbackUrl: string,\n  ): Promise<Result<undefined, KnownErrors[\"UserNotFound\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/password/send-reset-code\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          email,\n          callback_url: callbackUrl,\n        }),\n      },\n      null,\n      [KnownErrors.UserNotFound],\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    } else {\n      return Result.ok(undefined);\n    }\n  }\n\n  async sendVerificationEmail(\n    email: string,\n    callbackUrl: string,\n    session: InternalSession\n  ): Promise<KnownErrors[\"EmailAlreadyVerified\"] | undefined> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/contact-channels/send-verification-code\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          email,\n          callback_url: callbackUrl,\n        }),\n      },\n      session,\n      [KnownErrors.EmailAlreadyVerified]\n    );\n\n    if (res.status === \"error\") {\n      return res.error;\n    }\n  }\n\n  async sendMagicLinkEmail(\n    email: string,\n    callbackUrl: string,\n    botChallenge?: BotChallengeInput,\n  ): Promise<Result<{ nonce: string }, KnownErrors[\"RedirectUrlNotWhitelisted\"] | KnownErrors[\"BotChallengeRequired\"] | KnownErrors[\"BotChallengeFailed\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/otp/send-sign-in-code\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          email,\n          callback_url: callbackUrl,\n          ...getBotChallengeRequestFields(botChallenge, \"Magic link sign-in\"),\n        }),\n      },\n      null,\n      [KnownErrors.RedirectUrlNotWhitelisted, ...botChallengeKnownErrors]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    } else {\n      return Result.ok(await res.data.json());\n    }\n  }\n\n  async resetPassword(\n    options: { code: string } & ({ password: string } | { onlyVerifyCode: true })\n  ): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"onlyVerifyCode\" in options ? \"/auth/password/reset/check-code\" : \"/auth/password/reset\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          code: options.code,\n          ...(\"password\" in options ? { password: options.password } : {}),\n        }),\n      },\n      null,\n      [KnownErrors.VerificationCodeError]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    } else {\n      return Result.ok(undefined);\n    }\n  }\n\n  async updatePassword(\n    options: { oldPassword: string, newPassword: string },\n    session: InternalSession\n  ): Promise<KnownErrors[\"PasswordConfirmationMismatch\"] | KnownErrors[\"PasswordRequirementsNotMet\"] | undefined> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/password/update\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          old_password: options.oldPassword,\n          new_password: options.newPassword,\n        }),\n      },\n      session,\n      [KnownErrors.PasswordConfirmationMismatch, KnownErrors.PasswordRequirementsNotMet]\n    );\n\n    if (res.status === \"error\") {\n      return res.error;\n    }\n  }\n\n  async setPassword(\n    options: { password: string },\n    session: InternalSession\n  ): Promise<KnownErrors[\"PasswordRequirementsNotMet\"] | undefined> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/password/set\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify(options),\n      },\n      session,\n      [KnownErrors.PasswordRequirementsNotMet]\n    );\n\n    if (res.status === \"error\") {\n      return res.error;\n    }\n  }\n\n  async verifyPasswordResetCode(code: string): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"]>> {\n    const res = await this.resetPassword({ code, onlyVerifyCode: true });\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    } else {\n      return Result.ok(undefined);\n    }\n  }\n\n  async verifyEmail(code: string): Promise<Result<undefined, KnownErrors[\"VerificationCodeError\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/contact-channels/verify\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          code,\n        }),\n      },\n      null,\n      [KnownErrors.VerificationCodeError]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    } else {\n      return Result.ok(undefined);\n    }\n  }\n\n  async initiatePasskeyRegistration(\n    options: {},\n    session: InternalSession\n  ): Promise<Result<{ options_json: PublicKeyCredentialCreationOptionsJSON, code: string }, KnownErrors[]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/passkey/initiate-passkey-registration\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify(options),\n      },\n      session,\n      []\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    return Result.ok(await res.data.json());\n  }\n\n  async registerPasskey(\n    options: { credential: RegistrationResponseJSON, code: string },\n    session: InternalSession\n  ): Promise<Result<undefined, KnownErrors[\"PasskeyRegistrationFailed\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/passkey/register\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify(options),\n      },\n      session,\n      [KnownErrors.PasskeyRegistrationFailed]\n    );\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n    return Result.ok(undefined);\n  }\n\n  async initiatePasskeyAuthentication(\n    options: {\n    },\n    session: InternalSession\n  ): Promise<Result<{ options_json: PublicKeyCredentialRequestOptionsJSON, code: string }, KnownErrors[]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/passkey/initiate-passkey-authentication\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify(options),\n      },\n      session,\n      []\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    return Result.ok(await res.data.json());\n  }\n\n  async sendTeamInvitation(options: {\n    email: string,\n    teamId: string,\n    callbackUrl: string,\n    session: InternalSession,\n  }): Promise<void> {\n    await this.sendClientRequest(\n      \"/team-invitations/send-code\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          email: options.email,\n          team_id: options.teamId,\n          callback_url: options.callbackUrl,\n        }),\n      },\n      options.session,\n    );\n  }\n\n  async acceptTeamInvitation<T extends 'use' | 'details' | 'check'>(options: {\n    code: string,\n    session: InternalSession,\n    type: T,\n  }): Promise<Result<T extends 'details' ? { team_display_name: string } : undefined, KnownErrors[\"VerificationCodeError\"] | KnownErrors[\"TeamInvitationEmailMismatch\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      options.type === 'check' ?\n        \"/team-invitations/accept/check-code\" :\n        options.type === 'details' ?\n          \"/team-invitations/accept/details\" :\n          \"/team-invitations/accept\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          code: options.code,\n        }),\n      },\n      options.session,\n      [KnownErrors.VerificationCodeError, KnownErrors.TeamInvitationEmailMismatch]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    } else {\n      return Result.ok(await res.data.json());\n    }\n  }\n\n  async totpMfa(\n    attemptCode: string,\n    totp: string,\n    session: InternalSession\n  ) {\n    const res = await this.sendClientRequest(\"/auth/mfa/sign-in\", {\n      method: \"POST\",\n      headers: {\n        \"Content-Type\": \"application/json\"\n      },\n      body: JSON.stringify({\n        code: attemptCode,\n        type: \"totp\",\n        totp: totp,\n      }),\n    }, session);\n\n    const result = await res.json();\n    return {\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token,\n      newUser: result.is_new_user,\n    };\n  }\n\n  async signInWithCredential(\n    email: string,\n    password: string,\n    session: InternalSession\n  ): Promise<Result<{ accessToken: string, refreshToken: string }, KnownErrors[\"EmailPasswordMismatch\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/password/sign-in\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          email,\n          password,\n        }),\n      },\n      session,\n      [KnownErrors.EmailPasswordMismatch]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    const result = await res.data.json();\n    return Result.ok({\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token,\n    });\n  }\n\n  async signUpWithCredential(\n    email: string,\n    password: string,\n    emailVerificationRedirectUrl: string | undefined,\n    session: InternalSession,\n    botChallenge?: BotChallengeInput,\n  ): Promise<Result<{ accessToken: string, refreshToken: string }, KnownErrors[\"UserWithEmailAlreadyExists\"] | KnownErrors[\"PasswordRequirementsNotMet\"] | KnownErrors[\"BotChallengeRequired\"] | KnownErrors[\"BotChallengeFailed\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/password/sign-up\",\n      {\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        method: \"POST\",\n        body: JSON.stringify({\n          email,\n          password,\n          verification_callback_url: emailVerificationRedirectUrl,\n          ...getBotChallengeRequestFields(botChallenge, \"Credential sign-up\"),\n        }),\n      },\n      session,\n      [KnownErrors.UserWithEmailAlreadyExists, KnownErrors.PasswordRequirementsNotMet, ...botChallengeKnownErrors]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    const result = await res.data.json();\n    return Result.ok({\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token,\n    });\n  }\n\n  async signUpAnonymously(session: InternalSession): Promise<Result<{ accessToken: string, refreshToken: string }, never>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/anonymous/sign-up\",\n      {\n        method: \"POST\",\n      },\n      session,\n      [],\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    const result = await res.data.json();\n    return Result.ok({\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token,\n    });\n  }\n\n  async signInWithMagicLink(code: string, session: InternalSession): Promise<Result<{ newUser: boolean, accessToken: string, refreshToken: string }, KnownErrors[\"VerificationCodeError\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/otp/sign-in\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          code,\n        }),\n      },\n      session,\n      [KnownErrors.VerificationCodeError]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    const result = await res.data.json();\n    return Result.ok({\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token,\n      newUser: result.is_new_user,\n    });\n  }\n\n  async signInWithMfa(totp: string, code: string, session: InternalSession): Promise<Result<{ newUser: boolean, accessToken: string, refreshToken: string }, KnownErrors[\"VerificationCodeError\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/mfa/sign-in\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          type: \"totp\",\n          totp,\n          code,\n        }),\n      },\n      session,\n      [KnownErrors.VerificationCodeError]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    const result = await res.data.json();\n    return Result.ok({\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token,\n      newUser: result.is_new_user,\n    });\n  }\n\n  async signInWithPasskey(body: { authentication_response: AuthenticationResponseJSON, code: string }, session: InternalSession): Promise<Result<{accessToken: string, refreshToken: string }, KnownErrors[\"PasskeyAuthenticationFailed\"]>> {\n    const res = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/passkey/sign-in\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify(body),\n      },\n      session,\n      [KnownErrors.PasskeyAuthenticationFailed]\n    );\n\n    if (res.status === \"error\") {\n      return Result.error(res.error);\n    }\n\n    const result = await res.data.json();\n    return Result.ok({\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token,\n    });\n  }\n\n  async getOAuthUrl(\n    options: {\n      provider: string,\n      redirectUrl: string,\n      errorRedirectUrl: string,\n      afterCallbackRedirectUrl?: string,\n      codeChallenge: string,\n      state: string,\n      type: \"authenticate\" | \"link\",\n      providerScope?: string,\n      botChallenge?: BotChallengeInput,\n      session: InternalSession,\n    }\n  ): Promise<string> {\n    const updatedRedirectUrl = new URL(options.redirectUrl);\n    for (const key of [\"code\", \"state\"]) {\n      if (updatedRedirectUrl.searchParams.has(key)) {\n        console.warn(\"Redirect URL already contains \" + key + \" parameter, removing it as it will be overwritten by the OAuth callback\");\n      }\n      updatedRedirectUrl.searchParams.delete(key);\n    }\n\n    if (\"projectOwnerSession\" in this.options) {\n      // TODO fix\n      throw new Error(\"Admin session token is currently not supported for OAuth\");\n    }\n    const clientSecret = this.options.publishableClientKey ?? publishableClientKeyNotNecessarySentinel;\n    const url = new URL(this.getBestApiUrl() + \"/auth/oauth/authorize/\" + options.provider.toLowerCase());\n    url.searchParams.set(\"client_id\", this.projectId);\n    url.searchParams.set(\"client_secret\", clientSecret);\n    url.searchParams.set(\"redirect_uri\", updatedRedirectUrl.toString());\n    url.searchParams.set(\"scope\", \"legacy\");\n    url.searchParams.set(\"state\", options.state);\n    url.searchParams.set(\"grant_type\", \"authorization_code\");\n    url.searchParams.set(\"code_challenge\", options.codeChallenge);\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"type\", options.type);\n    url.searchParams.set(\"error_redirect_url\", options.errorRedirectUrl);\n\n    // TODO: This token will expire after 45s if the token lifetime is 60s, which may be shorter than the OAuth flow.\n    // We should probably find a way to request a longer-lived token here.\n    const tokens = await options.session.getOrFetchLikelyValidTokens(45_000, 60_000);\n    if (tokens) {\n      url.searchParams.set(\"token\", tokens.accessToken.token);\n    }\n\n    if (options.afterCallbackRedirectUrl) {\n      url.searchParams.set(\"after_callback_redirect_url\", options.afterCallbackRedirectUrl);\n    }\n    if (options.providerScope) {\n      url.searchParams.set(\"provider_scope\", options.providerScope);\n    }\n    for (const [key, value] of Object.entries(getBotChallengeRequestFields(options.botChallenge, `OAuth ${options.type}`))) {\n      url.searchParams.set(key, value);\n    }\n\n    return url.toString();\n  }\n\n  async authorizeOAuth(options: {\n    provider: string,\n    redirectUrl: string,\n    errorRedirectUrl: string,\n    afterCallbackRedirectUrl?: string,\n    codeChallenge: string,\n    state: string,\n    type: \"authenticate\" | \"link\",\n    providerScope?: string,\n    botChallenge?: BotChallengeInput,\n    session: InternalSession,\n  }): Promise<Result<string, KnownErrors[\"BotChallengeRequired\"] | KnownErrors[\"BotChallengeFailed\"]>> {\n    if (typeof window === \"undefined\") {\n      throw new HexclaveAssertionError(\"authorizeOAuth can currently only be called in a browser environment\");\n    }\n\n    await this.options.prepareRequest?.();\n\n    const url = new URL(await this.getOAuthUrl(options));\n    // Hexclave rebrand: dual-emit both query param names. The current backend accepts either, but\n    // a new SDK calling an OLDER backend (during deploy ordering, or a self-hoster on a stale\n    // image) only recognizes `stack_response_mode` — without it the route silently falls back to\n    // redirect mode and the SDK gets HTML where it expected JSON. Emit both to keep that working.\n    url.searchParams.set(\"hexclave_response_mode\", \"json\");\n    url.searchParams.set(\"stack_response_mode\", \"json\");\n\n    let rawRes;\n    try {\n      rawRes = await fetch(url, {\n        method: \"GET\",\n      });\n    } catch (error) {\n      if (error instanceof TypeError) {\n        throw await this._createNetworkError(error, options.session, \"client\");\n      }\n      throw error;\n    }\n\n    const processedResponse = await this._processResponse(rawRes);\n    if (processedResponse.status === \"error\") {\n      if (isBotChallengeKnownError(processedResponse.error)) {\n        return Result.error(processedResponse.error);\n      }\n      throw processedResponse.error;\n    }\n\n    if (processedResponse.data.status !== 200) {\n      throw new HexclaveAssertionError(`OAuth authorize returned an unexpected status: ${processedResponse.data.status}`);\n    }\n\n    const body = await processedResponse.data.json();\n    if (body == null || typeof body !== \"object\" || Array.isArray(body)) {\n      throw new HexclaveAssertionError(\"OAuth authorize response body must be an object\", { body });\n    }\n\n    const location = body.location;\n    if (typeof location !== \"string\") {\n      throw new HexclaveAssertionError(\"OAuth authorize response is missing a redirect location\", { body });\n    }\n\n    return Result.ok(location);\n  }\n\n  async callOAuthCallback(options: {\n    oauthParams: URLSearchParams,\n    redirectUri: string,\n    codeVerifier: string,\n    state: string,\n  }): Promise<{ newUser: boolean, afterCallbackRedirectUrl?: string, accessToken: string, refreshToken: string }> {\n    if (\"projectOwnerSession\" in this.options) {\n      // TODO fix\n      throw new Error(\"Admin session token is currently not supported for OAuth\");\n    }\n\n    const clientSecret = this.options.publishableClientKey ?? publishableClientKeyNotNecessarySentinel;\n    return await this._withFallback(async (apiUrl) => {\n      return await this._callOAuthCallbackInner(options, clientSecret, apiUrl);\n    });\n  }\n\n  private async _callOAuthCallbackInner(options: {\n    oauthParams: URLSearchParams,\n    redirectUri: string,\n    codeVerifier: string,\n    state: string,\n  }, clientSecret: string, apiUrl: string): Promise<{ newUser: boolean, afterCallbackRedirectUrl?: string, accessToken: string, refreshToken: string }> {\n    const tokenEndpoint = apiUrl + '/auth/oauth/token';\n    const as = {\n      issuer: this.options.getBaseUrl(),\n      algorithm: 'oauth2',\n      token_endpoint: tokenEndpoint,\n    };\n    const client: oauth.Client = {\n      client_id: this.projectId,\n      client_secret: clientSecret,\n    };\n    const clientAuthentication = oauth.ClientSecretPost(clientSecret);\n    // Allow insecure HTTP requests only in test environment (for localhost testing)\n    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition\n    const allowInsecure = tokenEndpoint.startsWith('http://');\n\n    let params: URLSearchParams;\n    try {\n      params = oauth.validateAuthResponse(as, client, options.oauthParams, options.state);\n    } catch (e) {\n      if (e instanceof oauth.AuthorizationResponseError) {\n        throw new HexclaveAssertionError(\"Authorization response error when validating outer OAuth response\", {\n          //cause is a URLSearchParams object for this error, so we need to serialize it better\n          cause: Object.fromEntries(e.cause),\n          code: e.code,\n          error: e.error,\n        });\n      }\n      throw new HexclaveAssertionError(\"Unexpected error when validating outer OAuth response\", { cause: e });\n    }\n    const response = await oauth.authorizationCodeGrantRequest(\n      as,\n      client,\n      clientAuthentication,\n      params,\n      options.redirectUri,\n      options.codeVerifier,\n      allowInsecure ? { [oauth.allowInsecureRequests]: true } : undefined,\n    );\n\n    let result;\n    try {\n      result = await oauth.processAuthorizationCodeResponse(as, client, response);\n    } catch (e) {\n      if (e instanceof oauth.ResponseBodyError) {\n        if ((e.cause as any).code === \"MULTI_FACTOR_AUTHENTICATION_REQUIRED\") {\n          throw new KnownErrors.MultiFactorAuthenticationRequired((e.cause as any).details.attempt_code);\n        }\n        // TODO Handle OAuth 2.0 response body error\n        throw new HexclaveAssertionError(\"Outer OAuth error during authorization code response\", {\n          cause: e.cause,\n          code: e.code,\n          error: e.error,\n        });\n      }\n      throw new HexclaveAssertionError(\"Unexpected error when processing authorization code response\", { cause: e });\n    }\n    return {\n      newUser: result.is_new_user as boolean,\n      afterCallbackRedirectUrl: result.after_callback_redirect_url as string | undefined,\n      accessToken: result.access_token,\n      refreshToken: result.refresh_token ?? throwErr(\"Refresh token not found in outer OAuth response\"),\n    };\n  }\n\n  async signOut(session: InternalSession): Promise<void> {\n    const tokenObj = await session.getOrFetchLikelyValidTokens(20_000, null);\n    if (tokenObj) {\n      const resOrError = await this.sendClientRequestAndCatchKnownError(\n        \"/auth/sessions/current\",\n        {\n          method: \"DELETE\",\n          headers: {\n            \"Content-Type\": \"application/json\"\n          },\n          body: JSON.stringify({}),\n        },\n        session,\n        [KnownErrors.RefreshTokenError]\n      );\n      if (resOrError.status === \"error\") {\n        if (KnownErrors.RefreshTokenError.isInstance(resOrError.error)) {\n          // refresh token was already invalid, just continue like nothing happened\n        } else {\n          // this should never happen\n          throw new HexclaveAssertionError(\"Unexpected error\", { cause: resOrError.error });\n        }\n      } else {\n        // user was signed out successfully, all good\n      }\n    }\n    session.markInvalid();\n  }\n\n  async getClientUserByToken(session: InternalSession): Promise<CurrentUserCrud[\"Client\"][\"Read\"] | null> {\n    const responseOrError = await this.sendClientRequestAndCatchKnownError(\n      \"/users/me\",\n      {},\n      session,\n      [KnownErrors.CannotGetOwnUserWithoutUser],\n    );\n    if (responseOrError.status === \"error\") {\n      if (KnownErrors.CannotGetOwnUserWithoutUser.isInstance(responseOrError.error)) {\n        return null;\n      } else {\n        throw new HexclaveAssertionError(\"Unexpected uncaught error\", { cause: responseOrError.error });\n      }\n    }\n    const response = responseOrError.data;\n    const user: CurrentUserCrud[\"Client\"][\"Read\"] = await response.json();\n    if (!(user as any)) throw new HexclaveAssertionError(\"User endpoint returned null; this should never happen\");\n    return user;\n  }\n\n  async listTeamInvitations(\n    options: {\n      teamId: string,\n    },\n    session: InternalSession,\n  ): Promise<TeamInvitationCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\n      \"/team-invitations?\" + new URLSearchParams({ team_id: options.teamId }),\n      {},\n      session,\n    );\n    const result = await response.json() as TeamInvitationCrud['Client']['List'];\n    return result.items;\n  }\n\n  async listCurrentUserTeamInvitations(\n    session: InternalSession,\n  ): Promise<TeamInvitationCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\n      \"/team-invitations?\" + new URLSearchParams({ user_id: 'me' }),\n      {},\n      session,\n    );\n    const result = await response.json() as TeamInvitationCrud['Client']['List'];\n    return result.items;\n  }\n\n  async acceptTeamInvitationById(\n    invitationId: string,\n    session: InternalSession,\n  ) {\n    await this.sendClientRequest(\n      urlString`/team-invitations/${invitationId}/accept` + \"?\" + new URLSearchParams({ user_id: 'me' }),\n      { method: \"POST\" },\n      session,\n    );\n  }\n\n  async revokeTeamInvitation(\n    invitationId: string,\n    teamId: string,\n    session: InternalSession,\n  ) {\n    await this.sendClientRequest(\n      `/team-invitations/${invitationId}?team_id=${teamId}`,\n      { method: \"DELETE\" },\n      session,\n    );\n  }\n\n  async listTeamMemberProfiles(\n    options: {\n      teamId?: string,\n      userId?: string,\n    },\n    session: InternalSession,\n  ): Promise<TeamMemberProfilesCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\n      \"/team-member-profiles?\" + new URLSearchParams(filterUndefined({\n        team_id: options.teamId,\n        user_id: options.userId,\n      })),\n      {},\n      session,\n    );\n    const result = await response.json() as TeamMemberProfilesCrud['Client']['List'];\n    return result.items;\n  }\n\n  async getTeamMemberProfile(\n    options: {\n      teamId: string,\n      userId: string,\n    },\n    session: InternalSession,\n  ): Promise<TeamMemberProfilesCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      `/team-member-profiles/${options.teamId}/${options.userId}`,\n      {},\n      session,\n    );\n    return await response.json();\n  }\n\n  async leaveTeam(\n    teamId: string,\n    session: InternalSession,\n  ) {\n    await this.sendClientRequest(\n      `/team-memberships/${teamId}/me`,\n      {\n        method: \"DELETE\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({}),\n      },\n      session,\n    );\n  }\n\n  async updateTeamMemberProfile(\n    options: {\n      teamId: string,\n      userId: string,\n      profile: TeamMemberProfilesCrud['Client']['Update'],\n    },\n    session: InternalSession,\n  ) {\n    await this.sendClientRequest(\n      `/team-member-profiles/${options.teamId}/${options.userId}`,\n      {\n        method: \"PATCH\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(options.profile),\n      },\n      session,\n    );\n  }\n\n  async updateTeam(\n    options: {\n      teamId: string,\n      data: TeamsCrud['Client']['Update'],\n    },\n    session: InternalSession,\n  ) {\n    await this.sendClientRequest(\n      `/teams/${options.teamId}`,\n      {\n        method: \"PATCH\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(options.data),\n      },\n      session,\n    );\n  }\n\n  async listCurrentUserTeamPermissions(\n    options: {\n      teamId: string,\n      recursive: boolean,\n    },\n    session: InternalSession\n  ): Promise<TeamPermissionsCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\n      `/team-permissions?team_id=${options.teamId}&user_id=me&recursive=${options.recursive}`,\n      {},\n      session,\n    );\n    const result = await response.json() as TeamPermissionsCrud['Client']['List'];\n    return result.items;\n  }\n\n  async listCurrentUserProjectPermissions(\n    options: {\n      recursive: boolean,\n    },\n    session: InternalSession\n  ): Promise<ProjectPermissionsCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\n      `/project-permissions?user_id=me&recursive=${options.recursive}`,\n      {},\n      session,\n    );\n    const result = await response.json() as ProjectPermissionsCrud['Client']['List'];\n    return result.items;\n  }\n\n  async listCurrentUserTeams(session: InternalSession): Promise<TeamsCrud[\"Client\"][\"Read\"][]> {\n    const response = await this.sendClientRequest(\n      \"/teams?user_id=me\",\n      {},\n      session,\n    );\n    const result = await response.json() as TeamsCrud[\"Client\"][\"List\"];\n    return result.items;\n  }\n\n  async getClientProject(): Promise<Result<ClientProjectsCrud['Client']['Read'], KnownErrors[\"ProjectNotFound\"]>> {\n    const responseOrError = await this.sendClientRequestAndCatchKnownError(\"/projects/current\", {}, null, [KnownErrors.ProjectNotFound]);\n    if (responseOrError.status === \"error\") {\n      return Result.error(responseOrError.error);\n    }\n    const response = responseOrError.data;\n    const project: ClientProjectsCrud['Client']['Read'] = await response.json();\n    return Result.ok(project);\n  }\n\n  async updateClientUser(update: CurrentUserCrud[\"Client\"][\"Update\"], session: InternalSession) {\n    await this.sendClientRequest(\n      \"/users/me\",\n      {\n        method: \"PATCH\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(update),\n      },\n      session,\n    );\n  }\n\n  async listProjects(session: InternalSession): Promise<AdminUserProjectsCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\"/internal/projects\", {}, session);\n    if (!response.ok) {\n      throw new Error(\"Failed to list projects: \" + response.status + \" \" + (await response.text()));\n    }\n\n    const json = await response.json() as AdminUserProjectsCrud['Client']['List'];\n    return json.items;\n  }\n\n  async createProject(\n    project: AdminUserProjectsCrud['Client']['Create'],\n    session: InternalSession,\n  ): Promise<AdminUserProjectsCrud['Client']['Read']> {\n    const fetchResponse = await this.sendClientRequest(\n      \"/internal/projects\",\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(project),\n      },\n      session,\n    );\n    if (!fetchResponse.ok) {\n      throw new Error(\"Failed to create project: \" + fetchResponse.status + \" \" + (await fetchResponse.text()));\n    }\n\n    const json = await fetchResponse.json();\n    return json;\n  }\n\n  async createProviderAccessToken(\n    provider: string,\n    scope: string,\n    session: InternalSession,\n  ): Promise<ConnectedAccountAccessTokenCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      `/connected-accounts/me/${provider}/access-token`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({ scope }),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  /**\n   * Get access token for a specific connected account by provider ID and provider account ID.\n   * This is the preferred method when dealing with multiple accounts of the same provider.\n   */\n  async createProviderAccessTokenByAccount(\n    providerId: string,\n    providerAccountId: string,\n    scope: string,\n    session: InternalSession,\n  ): Promise<ConnectedAccountAccessTokenCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      `/connected-accounts/me/${encodeURIComponent(providerId)}/${encodeURIComponent(providerAccountId)}/access-token`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({ scope }),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  /**\n   * List all connected accounts for the current user.\n   */\n  async listConnectedAccounts(\n    session: InternalSession,\n  ): Promise<ConnectedAccountCrud['Client']['List']> {\n    const response = await this.sendClientRequest(\n      `/connected-accounts/me`,\n      { method: \"GET\" },\n      session,\n    );\n    return await response.json();\n  }\n\n  async createClientTeam(\n    data: TeamsCrud['Client']['Create'],\n    session: InternalSession,\n  ): Promise<TeamsCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      \"/teams\",\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(data),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async deleteTeam(\n    teamId: string,\n    session: InternalSession,\n  ) {\n    await this.sendClientRequest(\n      `/teams/${teamId}`,\n      {\n        method: \"DELETE\",\n      },\n      session,\n    );\n  }\n\n  async deleteCurrentUser(session: InternalSession) {\n    await this.sendClientRequest(\n      \"/users/me\",\n      {\n        method: \"DELETE\",\n      },\n      session,\n    );\n  }\n\n  async createClientContactChannel(\n    data: ContactChannelsCrud['Client']['Create'],\n    session: InternalSession,\n  ): Promise<ContactChannelsCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      \"/contact-channels\",\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(data),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async updateClientContactChannel(\n    id: string,\n    data: ContactChannelsCrud['Client']['Update'],\n    session: InternalSession,\n  ): Promise<ContactChannelsCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      `/contact-channels/me/${id}`,\n      {\n        method: \"PATCH\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(data),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async deleteClientContactChannel(\n    id: string,\n    session: InternalSession,\n  ): Promise<void> {\n    await this.sendClientRequest(\n      `/contact-channels/me/${id}`,\n      {\n        method: \"DELETE\",\n      },\n      session,\n    );\n  }\n\n  async deleteSession(\n    sessionId: string,\n    session: InternalSession,\n  ): Promise<void> {\n    await this.sendClientRequest(\n      `/auth/sessions/${sessionId}?user_id=me`,\n      {\n        method: \"DELETE\",\n      },\n      session,\n    );\n  }\n\n  async listSessions(\n    session: InternalSession,\n  ): Promise<SessionsCrud['Client']['List']> {\n    const response = await this.sendClientRequest(\n      \"/auth/sessions?user_id=me\",\n      {\n        method: \"GET\",\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n\n  async listClientContactChannels(\n    session: InternalSession,\n  ): Promise<ContactChannelsCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\n      \"/contact-channels?user_id=me\",\n      {\n        method: \"GET\",\n      },\n      session,\n    );\n    const json = await response.json() as ContactChannelsCrud['Client']['List'];\n    return json.items;\n  }\n\n  async sendCurrentUserContactChannelVerificationEmail(\n    contactChannelId: string,\n    callbackUrl: string,\n    session: InternalSession,\n  ): Promise<Result<undefined, KnownErrors[\"EmailAlreadyVerified\"]>> {\n    const responseOrError = await this.sendClientRequestAndCatchKnownError(\n      `/contact-channels/me/${contactChannelId}/send-verification-code`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({ callback_url: callbackUrl }),\n      },\n      session,\n      [KnownErrors.EmailAlreadyVerified]\n    );\n\n    if (responseOrError.status === \"error\") {\n      return Result.error(responseOrError.error);\n    }\n    return Result.ok(undefined);\n  }\n\n  async cliLogin(\n    loginCode: string,\n    refreshToken: string,\n    session: InternalSession\n  ): Promise<Result<undefined, KnownErrors[\"SchemaError\"]>> {\n    const responseOrError = await this.sendClientRequestAndCatchKnownError(\n      \"/auth/cli/complete\",\n      {\n        method: \"POST\",\n        headers: {\n          \"Content-Type\": \"application/json\"\n        },\n        body: JSON.stringify({\n          login_code: loginCode,\n          refresh_token: refreshToken,\n        }),\n      },\n      session,\n      [KnownErrors.SchemaError]\n    );\n\n    if (responseOrError.status === \"error\") {\n      return Result.error(responseOrError.error);\n    }\n    return Result.ok(undefined);\n  }\n\n  private async _getApiKeyRequestInfo(options: { user_id: string | null } | { team_id: string }) {\n    if (\"user_id\" in options && \"team_id\" in options) {\n      throw new HexclaveAssertionError(\"Cannot specify both user_id and team_id in _getApiKeyRequestInfo\");\n    }\n\n    return {\n      endpoint: \"team_id\" in options ? \"/team-api-keys\" : \"/user-api-keys\",\n      queryParams: new URLSearchParams(filterUndefinedOrNull(options)),\n    };\n  }\n\n  // API Keys CRUD operations\n  listProjectApiKeys(options: { user_id: string }, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read'][]>;\n  listProjectApiKeys(options: { team_id: string }, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<TeamApiKeysCrud['Client']['Read'][]>;\n  listProjectApiKeys(options: { user_id: string } | { team_id: string }, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<(UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read'])[]>;\n  async listProjectApiKeys(\n    options: { user_id: string } | { team_id: string },\n    session: InternalSession | null,\n    requestType: \"client\" | \"server\" | \"admin\",\n  ): Promise<(UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read'])[]> {\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequest : (this as any).sendServerRequest as never).bind(this);\n    const { endpoint, queryParams } = await this._getApiKeyRequestInfo(options);\n\n    const response = await sendRequest(\n      `${endpoint}?${queryParams.toString()}`,\n      {\n        method: \"GET\",\n      },\n      session,\n      requestType,\n    );\n    const json = await response.json();\n    return json.items;\n  }\n\n  createProjectApiKey(data: yup.InferType<typeof userApiKeysCreateInputSchema>, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<yup.InferType<typeof userApiKeysCreateOutputSchema>>;\n  createProjectApiKey(data: yup.InferType<typeof teamApiKeysCreateInputSchema>, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<yup.InferType<typeof teamApiKeysCreateOutputSchema>>;\n  createProjectApiKey(data: yup.InferType<typeof userApiKeysCreateInputSchema> | yup.InferType<typeof teamApiKeysCreateInputSchema>, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<yup.InferType<typeof userApiKeysCreateOutputSchema> | yup.InferType<typeof teamApiKeysCreateOutputSchema>>;\n  async createProjectApiKey(\n    data: yup.InferType<typeof userApiKeysCreateInputSchema> | yup.InferType<typeof teamApiKeysCreateInputSchema>,\n    session: InternalSession | null,\n    requestType: \"client\" | \"server\" | \"admin\",\n  ): Promise<yup.InferType<typeof userApiKeysCreateOutputSchema> | yup.InferType<typeof teamApiKeysCreateOutputSchema>> {\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequest : (this as any).sendServerRequest as never).bind(this);\n    const { endpoint } = await this._getApiKeyRequestInfo(data);\n\n    const response = await sendRequest(\n      `${endpoint}`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(data),\n      },\n      session,\n      requestType,\n    );\n    return await response.json();\n  }\n\n  getProjectApiKey(options: { user_id: string | null }, keyId: string, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read']>;\n  getProjectApiKey(options: { team_id: string }, keyId: string, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<TeamApiKeysCrud['Client']['Read']>;\n  getProjectApiKey(options: { user_id: string | null } | { team_id: string }, keyId: string, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read']>;\n  async getProjectApiKey(\n    options: { user_id: string | null } | { team_id: string },\n    keyId: string,\n    session: InternalSession | null,\n    requestType: \"client\" | \"server\" | \"admin\",\n  ): Promise<UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read']> {\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequest : (this as any).sendServerRequest as never).bind(this);\n    const { endpoint, queryParams } = await this._getApiKeyRequestInfo(options);\n\n    const response = await sendRequest(\n      `${endpoint}/${keyId}?${queryParams.toString()}`,\n      {\n        method: \"GET\",\n      },\n      session,\n      requestType,\n    );\n    return await response.json();\n  }\n\n  updateProjectApiKey(options: { user_id: string }, keyId: string, data: UserApiKeysCrud['Client']['Update'], session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read']>;\n  updateProjectApiKey(options: { team_id: string }, keyId: string, data: TeamApiKeysCrud['Client']['Update'], session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<TeamApiKeysCrud['Client']['Read']>;\n  updateProjectApiKey(options: { user_id: string } | { team_id: string }, keyId: string, data: UserApiKeysCrud['Client']['Update'] | TeamApiKeysCrud['Client']['Update'], session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read']>;\n  async updateProjectApiKey(\n    options: { user_id: string } | { team_id: string },\n    keyId: string,\n    data: UserApiKeysCrud['Client']['Update'] | TeamApiKeysCrud['Client']['Update'],\n    session: InternalSession | null,\n    requestType: \"client\" | \"server\" | \"admin\",\n  ): Promise<UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read']> {\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequest : (this as any).sendServerRequest as never).bind(this);\n    const { endpoint, queryParams } = await this._getApiKeyRequestInfo(options);\n\n    const response = await sendRequest(\n      `${endpoint}/${keyId}?${queryParams.toString()}`,\n      {\n        method: \"PATCH\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(data),\n      },\n      session,\n      requestType,\n    );\n    return await response.json();\n  }\n\n  checkProjectApiKey(type: \"user\", apiKey: string, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read'] | null>;\n  checkProjectApiKey(type: \"team\", apiKey: string, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<TeamApiKeysCrud['Client']['Read'] | null>;\n  checkProjectApiKey(type: \"user\" | \"team\", apiKey: string, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read'] | null>;\n  async checkProjectApiKey(type: \"user\" | \"team\", apiKey: string, session: InternalSession | null, requestType: \"client\" | \"server\" | \"admin\"): Promise<UserApiKeysCrud['Client']['Read'] | TeamApiKeysCrud['Client']['Read'] | null> {\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequestAndCatchKnownError : (this as any).sendServerRequestAndCatchKnownError as never).bind(this);\n    const result = await sendRequest(\n      `/${type}-api-keys/check`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({ api_key: apiKey }),\n      },\n      session,\n      [KnownErrors.ApiKeyNotValid]\n    );\n    if (result.status === \"error\") {\n      return null;\n    }\n    return await result.data.json();\n  }\n\n  async listNotificationCategories(\n    session: InternalSession,\n  ): Promise<NotificationPreferenceCrud['Client']['Read'][]> {\n    const response = await this.sendClientRequest(\n      `/emails/notification-preference/me`,\n      {},\n      session,\n    );\n    const result = await response.json() as NotificationPreferenceCrud['Client']['List'];\n    return result.items;\n  }\n\n  async setNotificationsEnabled(\n    notificationCategoryId: string,\n    enabled: boolean,\n    session: InternalSession,\n  ): Promise<void> {\n    await this.sendClientRequest(\n      `/emails/notification-preference/me/${notificationCategoryId}`,\n      {\n        method: \"PATCH\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({\n          enabled,\n        }),\n      },\n      session,\n    );\n  }\n\n  async getOAuthProvider(\n    userId: string,\n    providerId: string,\n    session: InternalSession,\n  ): Promise<OAuthProviderCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      `/oauth-providers/${userId}/${providerId}`,\n      {\n        method: \"GET\",\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async updateOAuthProvider(\n    userId: string,\n    providerId: string,\n    data: OAuthProviderCrud['Client']['Update'],\n    session: InternalSession,\n  ): Promise<OAuthProviderCrud['Client']['Read']> {\n    const response = await this.sendClientRequest(\n      `/oauth-providers/${userId}/${providerId}`,\n      {\n        method: \"PATCH\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify(data),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async listOAuthProviders(\n    options: {\n      user_id?: string,\n    } = {},\n    session: InternalSession,\n  ): Promise<OAuthProviderCrud['Client']['Read'][]> {\n    const queryParams = new URLSearchParams(filterUndefined(options));\n    const response = await this.sendClientRequest(\n      `/oauth-providers${queryParams.toString() ? `?${queryParams.toString()}` : ''}`,\n      {\n        method: \"GET\",\n      },\n      session,\n    );\n    const result = await response.json();\n    return result.items;\n  }\n\n  async deleteOAuthProvider(\n    userId: string,\n    providerId: string,\n    session: InternalSession,\n  ): Promise<void> {\n    const response = await this.sendClientRequest(\n      `/oauth-providers/${userId}/${providerId}`,\n      {\n        method: \"DELETE\",\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async getItem(\n    options: (\n      { itemId: string, userId: string } |\n      { itemId: string, teamId: string } |\n      { itemId: string, customCustomerId: string }\n    ),\n    session: InternalSession | null,\n    requestType: \"client\" | \"server\" | \"admin\" = \"client\",\n  ): Promise<ItemCrud['Client']['Read']> {\n    let customerType: \"user\" | \"team\" | \"custom\";\n    let customerId: string;\n    if (\"userId\" in options) {\n      customerType = \"user\";\n      customerId = options.userId;\n    } else if (\"teamId\" in options) {\n      customerType = \"team\";\n      customerId = options.teamId;\n    } else if (\"customCustomerId\" in options) {\n      customerType = \"custom\";\n      customerId = options.customCustomerId;\n    } else {\n      throw new HexclaveAssertionError(\"getItem requires one of userId, teamId, or customCustomerId\");\n    }\n\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequest : (this as any).sendServerRequest as never).bind(this);\n    const response = await sendRequest(\n      urlString`/payments/items/${customerType}/${customerId}/${options.itemId}`,\n      {},\n      session,\n      requestType,\n    );\n    return await response.json();\n  }\n\n  async listProducts(\n    options: ListCustomerProductsOptions,\n    session: InternalSession | null,\n    requestType: \"client\" | \"server\" | \"admin\" = \"client\",\n  ): Promise<CustomerProductsListResponse> {\n    const queryParams = new URLSearchParams(filterUndefined({\n      cursor: options.cursor,\n      limit: options.limit !== undefined ? options.limit.toString() : undefined,\n    }));\n    const path = urlString`/payments/products/${options.customer_type}/${options.customer_id}`;\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequest : (this as any).sendServerRequest as never).bind(this);\n    const response = await sendRequest(\n      `${path}${queryParams.toString() ? `?${queryParams.toString()}` : ''}`,\n      {},\n      session,\n      requestType,\n    );\n    return await response.json();\n  }\n\n  async listInvoices(\n    options: ListCustomerInvoicesOptions,\n    session: InternalSession | null,\n  ): Promise<CustomerInvoicesListResponse> {\n    const queryParams = new URLSearchParams(filterUndefined({\n      cursor: options.cursor,\n      limit: options.limit !== undefined ? options.limit.toString() : undefined,\n    }));\n    const path = urlString`/payments/invoices/${options.customer_type}/${options.customer_id}`;\n    const response = await this.sendClientRequest(\n      `${path}${queryParams.toString() ? `?${queryParams.toString()}` : ''}`,\n      {},\n      session,\n    );\n    return await response.json();\n  }\n\n  async cancelSubscription(\n    options: {\n      customer_type: \"user\" | \"team\" | \"custom\",\n      customer_id: string,\n      product_id: string,\n      subscription_id?: string,\n    },\n    session: InternalSession | null,\n  ): Promise<void> {\n    const queryParams = new URLSearchParams(filterUndefined({\n      subscription_id: options.subscription_id,\n    }));\n    const path = urlString`/payments/products/${options.customer_type}/${options.customer_id}/${options.product_id}`;\n    await this.sendClientRequest(\n      `${path}${queryParams.toString() ? `?${queryParams.toString()}` : ''}`,\n      {\n        method: \"DELETE\",\n      },\n      session,\n    );\n  }\n\n  async switchSubscription(\n    options: {\n      customer_type: \"user\" | \"team\",\n      customer_id: string,\n      from_product_id: string,\n      to_product_id: string,\n      price_id?: string,\n      quantity?: number,\n    },\n    session: InternalSession | null,\n  ): Promise<void> {\n    await this.sendClientRequest(\n      urlString`/payments/products/${options.customer_type}/${options.customer_id}/switch`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({\n          from_product_id: options.from_product_id,\n          to_product_id: options.to_product_id,\n          price_id: options.price_id,\n          quantity: options.quantity,\n        }),\n      },\n      session,\n    );\n  }\n\n  async createCheckoutUrl(\n    customer_type: \"user\" | \"team\" | \"custom\",\n    customer_id: string,\n    productIdOrInline: string | yup.InferType<typeof inlineProductSchema>,\n    session: InternalSession | null,\n    returnUrl?: string,\n    requestType: \"client\" | \"server\" | \"admin\" = \"client\",\n  ): Promise<string> {\n    const productBody = typeof productIdOrInline === \"string\" ?\n      { product_id: productIdOrInline } :\n      { product_inline: productIdOrInline };\n    const sendRequest = (requestType === \"client\" ? this.sendClientRequest : (this as any).sendServerRequest as never).bind(this);\n    const response = await sendRequest(\n      \"/payments/purchases/create-purchase-url\",\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({ customer_type, customer_id, ...productBody, return_url: returnUrl }),\n      },\n      session,\n      requestType,\n    );\n    const { url } = await response.json() as { url: string };\n    return url;\n  }\n\n  async getCustomerBilling(\n    customerType: \"user\" | \"team\",\n    customerId: string,\n    session: InternalSession | null,\n  ): Promise<{\n    has_customer: boolean,\n    default_payment_method: {\n      id: string,\n      brand: string | null,\n      last4: string | null,\n      exp_month: number | null,\n      exp_year: number | null,\n    } | null,\n  }> {\n    const response = await this.sendClientRequest(\n      urlString`/payments/billing/${customerType}/${customerId}`,\n      {},\n      session,\n    );\n    return await response.json();\n  }\n\n  async createCustomerPaymentMethodSetupIntent(\n    customerType: \"user\" | \"team\",\n    customerId: string,\n    session: InternalSession | null,\n  ): Promise<{\n    client_secret: string,\n    stripe_account_id: string,\n  }> {\n    const response = await this.sendClientRequest(\n      urlString`/payments/payment-method/${customerType}/${customerId}/setup-intent`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({}),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async setDefaultCustomerPaymentMethodFromSetupIntent(\n    customerType: \"user\" | \"team\",\n    customerId: string,\n    setupIntentId: string,\n    session: InternalSession | null,\n  ): Promise<{\n    default_payment_method: {\n      id: string,\n      brand: string | null,\n      last4: string | null,\n      exp_month: number | null,\n      exp_year: number | null,\n    },\n  }> {\n    const response = await this.sendClientRequest(\n      urlString`/payments/payment-method/${customerType}/${customerId}/set-default`,\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({\n          setup_intent_id: setupIntentId,\n        }),\n      },\n      session,\n    );\n    return await response.json();\n  }\n\n  async transferProject(internalProjectSession: InternalSession, projectIdToTransfer: string, newTeamId: string): Promise<void> {\n    if (this.options.projectId !== \"internal\") {\n      throw new HexclaveAssertionError(\"HexclaveClientInterface.transferProject() is only available for internal projects (please specify the project ID in the constructor)\");\n    }\n    await this.sendClientRequest(\n      \"/internal/projects/transfer\",\n      {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/json\",\n        },\n        body: JSON.stringify({\n          project_id: projectIdToTransfer,\n          new_team_id: newTeamId,\n        }),\n      },\n      internalProjectSession,\n    );\n  }\n}\n"],"x_google_ignoreList":[0],"mappings":";;;;;;;;;;;;;;AAAA,IAAI;AACJ,IAAI,OAAO,cAAc,eAAe,CAAC,UAAU,WAAW,aAAa,cAAc,GAGrF,aAAa;AAEjB,SAAS,gBAAgB,OAAO,UAAU;CACtC,IAAI,SAAS,MACT,OAAO;CAEX,IAAI;EACA,OAAQ,iBAAiB,YACrB,OAAO,eAAe,KAAK,CAAC,CAAC,OAAO,iBAAiB,SAAS,UAAU,OAAO;CACvF,QACM;EACF,OAAO;CACX;AACJ;AACA,MAAM,wBAAwB;AAC9B,MAAM,uBAAuB;AAC7B,SAAS,eAAe,SAAS,MAAM,OAAO;CAC1C,MAAM,MAAM,IAAI,UAAU,SAAS,EAAE,MAAM,CAAC;CAC5C,OAAO,OAAO,KAAK,EAAE,KAAK,CAAC;CAC3B,OAAO;AACX;AACA,MAAa,wBAAwB,OAAO;AAC5C,MAAa,YAAY,OAAO;AAChC,MAAa,iBAAiB,OAAO;AACrC,MAAa,cAAc,OAAO;AAElC,MAAa,aAAa,OAAO;AAEjC,MAAM,UAAU,IAAI,YAAY;AAChC,MAAM,UAAU,IAAI,YAAY;AAChC,SAAS,IAAI,OAAO;CAChB,IAAI,OAAO,UAAU,UACjB,OAAO,QAAQ,OAAO,KAAK;CAE/B,OAAO,QAAQ,OAAO,KAAK;AAC/B;AACA,IAAI;AACJ,IAAI,WAAW,UAAU,UACrB,mBAAmB,UAAU;CACzB,IAAI,iBAAiB,aACjB,QAAQ,IAAI,WAAW,KAAK;CAEhC,OAAO,MAAM,SAAS;EAAE,UAAU;EAAa,aAAa;CAAK,CAAC;AACtE;KAEC;CACD,MAAM,aAAa;CACnB,mBAAmB,UAAU;EACzB,IAAI,iBAAiB,aACjB,QAAQ,IAAI,WAAW,KAAK;EAEhC,MAAM,MAAM,CAAC;EACb,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,YAAY,KAAK,YACvC,IAAI,KAAK,OAAO,aAAa,MAAM,MAAM,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,CAAC;EAE/E,OAAO,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG;CACtF;AACJ;AACA,IAAI;AACJ,IAAI,WAAW,YACX,mBAAmB,UAAU;CACzB,IAAI;EACA,OAAO,WAAW,WAAW,OAAO,EAAE,UAAU,YAAY,CAAC;CACjE,SACO,OAAO;EACV,MAAM,eAAe,qDAAqD,uBAAuB,KAAK;CAC1G;AACJ;KAGA,mBAAmB,UAAU;CACzB,IAAI;EACA,MAAM,SAAS,KAAK,MAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC;EAClF,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;EAC1C,KAAK,IAAI,IAAI,GAAG,IAAI,OAAO,QAAQ,KAC/B,MAAM,KAAK,OAAO,WAAW,CAAC;EAElC,OAAO;CACX,SACO,OAAO;EACV,MAAM,eAAe,qDAAqD,uBAAuB,KAAK;CAC1G;AACJ;AAEJ,SAAS,KAAK,OAAO;CACjB,IAAI,OAAO,UAAU,UACjB,OAAO,gBAAgB,KAAK;CAEhC,OAAO,gBAAgB,KAAK;AAChC;AACA,IAAa,4BAAb,cAA+C,MAAM;CACjD;CACA,YAAY,SAAS,SAAS;EAC1B,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO,KAAK,YAAY;EAC7B,KAAK,OAAO;EACZ,MAAM,oBAAoB,MAAM,KAAK,WAAW;CACpD;AACJ;AACA,IAAa,2BAAb,cAA8C,MAAM;CAChD;CACA,YAAY,SAAS,SAAS;EAC1B,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO,KAAK,YAAY;EAC7B,IAAI,SAAS,MACT,KAAK,OAAO,SAAS;EAEzB,MAAM,oBAAoB,MAAM,KAAK,WAAW;CACpD;AACJ;AACA,SAAS,IAAI,SAAS,MAAM,OAAO;CAC/B,OAAO,IAAI,yBAAyB,SAAS;EAAE;EAAM;CAAM,CAAC;AAChE;AA0DA,SAAS,aAAa,OAAO;CACzB,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAClE,OAAO;CAEX,OAAO;AACX;AACA,SAAS,eAAe,OAAO;CAC3B,IAAI,gBAAgB,OAAO,OAAO,GAC9B,QAAQ,OAAO,YAAY,MAAM,QAAQ,CAAC;CAE9C,MAAM,UAAU,IAAI,QAAQ,SAAS,CAAC,CAAC;CACvC,IAAI,cAAc,CAAC,QAAQ,IAAI,YAAY,GACvC,QAAQ,IAAI,cAAc,UAAU;CAExC,IAAI,QAAQ,IAAI,eAAe,GAC3B,MAAM,eAAe,0EAAsE,qBAAqB;CAEpH,OAAO;AACX;AACA,SAAS,OAAO,KAAK,OAAO;CACxB,IAAI,UAAU,KAAA,GAAW;EACrB,IAAI,OAAO,UAAU,YACjB,QAAQ,MAAM,IAAI,IAAI;EAE1B,IAAI,EAAE,iBAAiB,cACnB,MAAM,eAAe,mEAAiE,oBAAoB;EAE9G,OAAO;CACX;AAEJ;AAoDA,SAAS,aAAa,OAAO,QAAQ,IAAI,MAAM,OAAO;CAClD,IAAI;EACA,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,GACnD,MAAM,eAAe,GAAG,GAAG,oBAAoB,sBAAsB,KAAK;EAE9E,IAAI,QAAQ,GACR;EACJ,IAAI,QAAQ;GACR,IAAI,UAAU,GACV,MAAM,eAAe,GAAG,GAAG,iCAAiC,uBAAuB,KAAK;GAE5F;EACJ;EACA,MAAM,eAAe,GAAG,GAAG,6BAA6B,uBAAuB,KAAK;CACxF,SACO,KAAK;EACR,IAAI,MACA,MAAM,IAAI,IAAI,SAAS,MAAM,KAAK;EAEtC,MAAM;CACV;AACJ;AACA,SAAS,aAAa,OAAO,IAAI,MAAM,OAAO;CAC1C,IAAI;EACA,IAAI,OAAO,UAAU,UACjB,MAAM,eAAe,GAAG,GAAG,oBAAoB,sBAAsB,KAAK;EAE9E,IAAI,MAAM,WAAW,GACjB,MAAM,eAAe,GAAG,GAAG,qBAAqB,uBAAuB,KAAK;CAEpF,SACO,KAAK;EACR,IAAI,MACA,MAAM,IAAI,IAAI,SAAS,MAAM,KAAK;EAEtC,MAAM;CACV;AACJ;AAoBA,SAAS,sBAAsB,UAAU;CACrC,kBAAkB,UAAU,kBAAkB;AAClD;AACA,SAAS,QAAQ,UAAU,GAAG,OAAO;CACjC,IAAI,MAAM;CACV,IAAI,MAAM,SAAS,GAAG;EAClB,MAAM,OAAO,MAAM,IAAI;EACvB,OAAO,GAAG,MAAM,KAAK,IAAI,EAAE,OAAO;CACtC,OACK,IAAI,MAAM,WAAW,GACtB,OAAO,GAAG,MAAM,GAAG,MAAM,MAAM;MAG/B,OAAO,MAAM;CAEjB,OAAO,IAAI,KAAK,sBAAsB,QAAQ;AAClD;AAMA,SAAS,kBAAkB,UAAU,aAAa;CAC9C,IAAI,eAAe,QAAQ,MAAM,aAC7B,MAAM,QAAQ,UAAU,WAAW;AAE3C;AA2FA,SAAS,aAAa,QAAQ;CAC1B,MAAM,OAAO,SAAS;CACtB,OAAO,OAAO,SAAS,YAAY,OAAO,SAAS,IAAI,IAAI,OAAO;AACtE;AACA,SAAS,kBAAkB,QAAQ;CAC/B,MAAM,YAAY,SAAS;CAC3B,OAAO,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,KAAK,KAAK,KAAK,SAAS,MAAM,KACzF,YACA;AACV;AACA,SAAS,YAAY;CACjB,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACvC;AACA,SAAS,SAAS,IAAI;CAClB,IAAI,OAAO,OAAO,YAAY,OAAO,MACjC,MAAM,eAAe,4BAA0B,oBAAoB;CAEvE,aAAa,GAAG,QAAQ,eAAa;AACzC;AACA,SAAS,aAAa,QAAQ;CAC1B,IAAI,OAAO,WAAW,YAAY,WAAW,MACzC,MAAM,eAAe,gCAA8B,oBAAoB;CAE3E,aAAa,OAAO,WAAW,sBAAoB;AACvD;AAqBA,SAAgB,iBAAiB,cAAc;CAC3C,aAAa,cAAc,kBAAgB;CAC3C,QAAQ,KAAK,QAAQ,MAAM,aAAa;EACpC,KAAK,IAAI,aAAa,OAAO,SAAS;EACtC,KAAK,IAAI,iBAAiB,YAAY;CAC1C;AACJ;AAiJA,MAAM,WAAW,IAAI,SAEZ,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,KACnC,KAAK,SAAS;CACb,IAAI;EACA,OAAO,IAAI,IAAI,KAAK,IAAI;CAC5B,QACM;EACF,OAAO;CACX;AACJ;AACJ,SAAgB,cAAc,KAAK,cAAc;CAC7C,IAAI,gBAAgB,IAAI,aAAa,UACjC,MAAM,IAAI,sCAAsC,wBAAwB,GAAG;CAE/E,IAAI,IAAI,aAAa,YAAY,IAAI,aAAa,SAC9C,MAAM,IAAI,4CAA4C,4BAA4B,GAAG;AAE7F;AACA,SAAS,iBAAiB,OAAO,UAAU,cAAc,cAAc;CACnE,IAAI;CACJ,IAAI,OAAO,UAAU,YAAY,EAAE,MAAM,SAAS,KAAK,IACnD,MAAM,IAAI,0DAA0D,eAAe,6BAA6B,SAAS,KAAK,OAAO,SAAS,MAAM,UAAU,KAAA,IAAY,0BAA0B,yBAAyB,EAAE,WAAW,eAAe,yBAAyB,aAAa,SAAS,CAAC;CAE7S,cAAc,KAAK,YAAY;CAC/B,OAAO;AACX;AACA,SAAgB,gBAAgB,IAAI,UAAU,cAAc,cAAc;CACtE,IAAI,gBAAgB,GAAG,yBAAyB,YAAY,GAAG,uBAC3D,OAAO,iBAAiB,GAAG,sBAAsB,WAAW,UAAU,cAAc,YAAY;CAEpG,OAAO,iBAAiB,GAAG,WAAW,UAAU,cAAc,YAAY;AAC9E;AA0GA,IAAa,oBAAb,cAAuC,MAAM;CACzC;CACA;CACA;CACA;CACA;CACA;CACA,YAAY,SAAS,SAAS;EAC1B,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO,KAAK,YAAY;EAC7B,KAAK,OAAO;EACZ,KAAK,QAAQ,QAAQ;EACrB,KAAK,QAAQ,QAAQ,MAAM;EAC3B,KAAK,SAAS,QAAQ,SAAS;EAC/B,KAAK,oBAAoB,QAAQ,MAAM;EACvC,OAAO,eAAe,MAAM,YAAY;GAAE,YAAY;GAAO,OAAO,QAAQ;EAAS,CAAC;EACtF,MAAM,oBAAoB,MAAM,KAAK,WAAW;CACpD;AACJ;AACA,IAAa,6BAAb,cAAgD,MAAM;CAClD;CACA;CACA;CACA;CACA,YAAY,SAAS,SAAS;EAC1B,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO,KAAK,YAAY;EAC7B,KAAK,OAAO;EACZ,KAAK,QAAQ,QAAQ;EACrB,KAAK,QAAQ,QAAQ,MAAM,IAAI,OAAO;EACtC,KAAK,oBAAoB,QAAQ,MAAM,IAAI,mBAAmB,KAAK,KAAA;EACnE,MAAM,oBAAoB,MAAM,KAAK,WAAW;CACpD;AACJ;AACA,IAAa,gCAAb,cAAmD,MAAM;CACrD;CACA;CACA;CACA;CACA,YAAY,SAAS,SAAS;EAC1B,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO,KAAK,YAAY;EAC7B,KAAK,OAAO;EACZ,KAAK,QAAQ,QAAQ;EACrB,KAAK,SAAS,QAAQ,SAAS;EAC/B,KAAK,WAAW,QAAQ;EACxB,OAAO,eAAe,MAAM,YAAY,EAAE,YAAY,MAAM,CAAC;EAC7D,MAAM,oBAAoB,MAAM,KAAK,WAAW;CACpD;AACJ;AAMA,MAAM,2BAAW,IAAI,OAAO,qDAA8B;AAC1D,MAAM,gCAAgB,IAAI,OAAO,0GAA+C;AAChF,MAAM,kCAAkB,IAAI,OAAO,oHAAyC;AAC5E,MAAM,iCAAiB,IAAI,OAAO,uDAAyC;AAC3E,SAAS,+BAA+B,UAAU;CAC9C,IAAI,CAAC,gBAAgB,UAAU,QAAQ,GACnC,MAAM,eAAe,gDAA8C,oBAAoB;CAE3F,MAAM,SAAS,SAAS,QAAQ,IAAI,kBAAkB;CACtD,IAAI,WAAW,MACX;CAEJ,MAAM,aAAa,CAAC;CACpB,IAAI,OAAO;CACX,OAAO,MAAM;EACT,IAAI,QAAQ,KAAK,MAAM,QAAQ;EAC/B,MAAM,SAAS,QAAQ,IAAI,CAAC,YAAY;EACxC,IAAI,CAAC,QACD;EAEJ,MAAM,cAAc,KAAK,UAAU,MAAM,EAAE,CAAC,MAAM;EAClD,IAAI,eAAe,CAAC,YAAY,MAAM,QAAQ,GAC1C;EAEJ,MAAM,aAAa,YAAY,MAAM,WAAW;EAChD,MAAM,gBAAgB,CAAC,CAAC;EACxB,OAAO,aAAa,WAAW,KAAK,KAAA;EACpC,MAAM,aAAa,CAAC;EACpB,IAAI;EACJ,IAAI,eACA,OAAO,MAAM;GACT,IAAI;GACJ,IAAI;GACJ,IAAK,QAAQ,KAAK,MAAM,aAAa,GAAI;IAErC,GAAG,KAAK,OAAO,QAAQ;IACvB,IAAI,MAAM,SAAS,IAAI,GACnB,IAAI;KACA,QAAQ,KAAK,MAAM,IAAI,MAAM,EAAE;IACnC,QACM,CAAE;IAEZ,WAAW,IAAI,YAAY,KAAK;IAChC;GACJ;GACA,IAAK,QAAQ,KAAK,MAAM,eAAe,GAAI;IAEvC,GAAG,KAAK,OAAO,QAAQ;IACvB,WAAW,IAAI,YAAY,KAAK;IAChC;GACJ;GACA,IAAK,QAAQ,KAAK,MAAM,cAAc,GAAI;IACtC,IAAI,OAAO,KAAK,UAAU,CAAC,CAAC,QACxB;IAGJ,GAAG,SAAS,QAAQ;IACpB;GACJ;GACA;EACJ;OAGA,OAAO,eAAe,KAAA;EAE1B,MAAM,YAAY;GAAE;GAAQ;EAAW;EACvC,IAAI,SACA,UAAU,UAAU;EAExB,WAAW,KAAK,SAAS;CAC7B;CACA,IAAI,CAAC,WAAW,QACZ;CAEJ,OAAO;AACX;AAoBA,eAAe,4BAA4B,UAAU;CACjD,IAAI,SAAS,SAAS,OAAO,SAAS,SAAS,KAAK;EAChD,uBAAuB,QAAQ;EAC/B,sBAAsB,QAAQ;EAC9B,IAAI;GACA,MAAM,OAAO,MAAM,SAAS,MAAM,CAAC,CAAC,KAAK;GACzC,IAAI,aAAa,IAAI,KAAK,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,QACnE,OAAO;EAEf,QACM,CAAE;CACZ;AAEJ;AACA,eAAe,oBAAoB,UAAU,UAAU,OAAO;CAC1D,IAAI,SAAS,WAAW,UAAU;EAC9B,8BAA8B,QAAQ;EACtC,IAAI;EACJ,IAAK,MAAM,MAAM,4BAA4B,QAAQ,GAAI;GACrD,MAAM,SAAS,MAAM,OAAO;GAC5B,MAAM,IAAI,kBAAkB,uDAAuD;IAC/E,OAAO;IACP;GACJ,CAAC;EACL;EACA,MAAM,IAAI,+BAA+B,MAAM,0CAA0C,yBAAyB,QAAQ;CAC9H;AACJ;AACA,SAAS,WAAW,QAAQ;CACxB,IAAI,CAAC,QAAQ,IAAI,MAAM,GACnB,MAAM,eAAe,8CAA4C,qBAAqB;AAE9F;AA+JA,SAAgB,eAAe,OAAO;CAClC,OAAO,MAAM,QAAQ,IAAI,cAAc,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC;AACzD;AA0CA,eAAe,qBAAqB,IAAI,QAAQ,sBAAsB,KAAK,MAAM,SAAS,SAAS;CAC/F,MAAM,qBAAqB,IAAI,QAAQ,MAAM,OAAO;CACpD,QAAQ,IAAI,gBAAgB,iDAAiD;CAC7E,QAAQ,UAAU,gBAAgB,MAAA,CAAO,IAAI,MAAM;EAC/C;EACA,SAAS,OAAO,YAAY,QAAQ,QAAQ,CAAC;EAC7C,QAAQ;EACR,UAAU;EACV,QAAQ,OAAO,KAAK,SAAS,MAAM;CACvC,CAAC;AACL;AACA,eAAe,qBAAqB,IAAI,QAAQ,sBAAsB,WAAW,YAAY,SAAS;CAClG,MAAM,MAAM,gBAAgB,IAAI,kBAAkB,OAAO,2BAA2B,UAAU,2BAA2B,IAAI;CAC7H,WAAW,IAAI,cAAc,SAAS;CACtC,MAAM,UAAU,eAAe,SAAS,OAAO;CAC/C,QAAQ,IAAI,UAAU,kBAAkB;CACxC,IAAI,SAAS,SAAS,KAAA,GAAW;EAC7B,WAAW,QAAQ,IAAI;EACvB,MAAM,QAAQ,KAAK,SAAS,KAAK,SAAS,MAAM;CACpD;CACA,MAAM,WAAW,MAAM,qBAAqB,IAAI,QAAQ,sBAAsB,KAAK,YAAY,SAAS,OAAO;CAC/G,SAAS,MAAM,WAAW,UAAU,GAAG;CACvC,OAAO;AACX;AACA,eAAsB,yBAAyB,IAAI,QAAQ,sBAAsB,cAAc,SAAS;CACpG,SAAS,EAAE;CACX,aAAa,MAAM;CACnB,aAAa,cAAc,kBAAgB;CAC3C,MAAM,aAAa,IAAI,gBAAgB,SAAS,oBAAoB;CACpE,WAAW,IAAI,iBAAiB,YAAY;CAC5C,OAAO,qBAAqB,IAAI,QAAQ,sBAAsB,iBAAiB,YAAY,OAAO;AACtG;AACA,MAAM,gCAAgB,IAAI,QAAQ;AAClC,MAAM,0BAAU,IAAI,QAAQ;AAC5B,SAAgB,0BAA0B,KAAK;CAC3C,IAAI,CAAC,IAAI,UACL;CAEJ,MAAM,SAAS,cAAc,IAAI,GAAG;CACpC,IAAI,CAAC,QACD,MAAM,eAAe,oFAAkF,qBAAqB;CAEhI,OAAO;AACX;AAeA,eAAe,kCAAkC,IAAI,QAAQ,UAAU,iCAAiC,WAAW,sBAAsB;CACrI,SAAS,EAAE;CACX,aAAa,MAAM;CACnB,IAAI,CAAC,gBAAgB,UAAU,QAAQ,GACnC,MAAM,eAAe,gDAA8C,oBAAoB;CAE3F,MAAM,oBAAoB,UAAU,KAAK,gBAAgB;CACzD,uBAAuB,QAAQ;CAC/B,MAAM,OAAO,MAAM,oBAAoB,QAAQ;CAC/C,aAAa,KAAK,cAAc,+CAA2C,kBAAkB,EACzF,MAAM,KACV,CAAC;CACD,aAAa,KAAK,YAAY,6CAAyC,kBAAkB,EACrF,MAAM,KACV,CAAC;CACD,KAAK,aAAa,KAAK,WAAW,YAAY;CAC9C,IAAI,KAAK,eAAe,KAAA,GAAW;EAC/B,IAAI,YAAY,OAAO,KAAK,eAAe,WAAW,WAAW,KAAK,UAAU,IAAI,KAAK;EACzF,aAAa,WAAW,MAAM,6CAAyC,kBAAkB,EACrF,MAAM,KACV,CAAC;EACD,KAAK,aAAa;CACtB;CACA,IAAI,KAAK,kBAAkB,KAAA,GACvB,aAAa,KAAK,eAAe,gDAA4C,kBAAkB,EAC3F,MAAM,KACV,CAAC;CAEL,IAAI,KAAK,UAAU,KAAA,KAAa,OAAO,KAAK,UAAU,UAClD,MAAM,IAAI,yDAAqD,kBAAkB,EAAE,MAAM,KAAK,CAAC;CAEnG,IAAI,KAAK,aAAa,KAAA,GAAW;EAC7B,aAAa,KAAK,UAAU,2CAAuC,kBAAkB,EACjF,MAAM,KACV,CAAC;EACD,MAAM,iBAAiB;GAAC;GAAO;GAAO;GAAO;GAAO;EAAK;EACzD,IAAI,OAAO,sBAAsB,MAC7B,eAAe,KAAK,WAAW;EAEnC,IAAI,OAAO,oBAAoB,KAAA,GAAW;GACtC,aAAa,OAAO,iBAAiB,MAAM,4BAA0B;GACrE,eAAe,KAAK,WAAW;EACnC;EACA,IAAI,iCAAiC,QACjC,eAAe,KAAK,GAAG,+BAA+B;EAE1D,MAAM,EAAE,QAAQ,QAAQ,MAAM,YAAY,KAAK,UAAU,sBAAsB,KAAK,KAAA,GAAW,OAAO,8BAA8B,GAAG,uCAAuC,OAAO,GAAG,aAAa,MAAM,GAAG,kBAAkB,MAAM,GAAG,SAAS,CAAC,CAC9O,KAAK,iBAAiB,KAAK,KAAA,GAAW,cAAc,CAAC,CAAC,CACtD,KAAK,eAAe,KAAK,KAAA,GAAW,EAAE,CAAC,CAAC,CACxC,KAAK,iBAAiB,KAAK,KAAA,GAAW,OAAO,SAAS,CAAC;EAC5D,IAAI,MAAM,QAAQ,OAAO,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG;GACtD,IAAI,OAAO,QAAQ,KAAA,GACf,MAAM,IAAI,6EAA2E,sBAAsB;IAAE;IAAQ,OAAO;GAAM,CAAC;GAEvI,IAAI,OAAO,QAAQ,OAAO,WACtB,MAAM,IAAI,8DAA4D,sBAAsB;IAAE,UAAU,OAAO;IAAW;IAAQ,OAAO;GAAM,CAAC;EAExJ;EACA,IAAI,OAAO,cAAc,KAAA,GACrB,aAAa,OAAO,WAAW,MAAM,gDAA8C,kBAAkB,EAAE,OAAO,CAAC;EAEnH,QAAQ,IAAI,UAAU,GAAG;EACzB,cAAc,IAAI,MAAM,MAAM;CAClC;CACA,IAAI,uBAAuB,KAAK,gBAAgB,KAAA,GAC5C,qBAAqB,KAAK,WAAW,CAAC,UAAU,IAAI;MAEnD,IAAI,KAAK,eAAe,UAAU,KAAK,eAAe,UACvD,MAAM,IAAI,0BAA0B,kCAAkC,EAAE,OAAO,EAAE,MAAM,KAAK,EAAE,CAAC;CAEnG,OAAO;AACX;AACA,SAAS,8BAA8B,UAAU;CAC7C,IAAI;CACJ,IAAK,aAAa,+BAA+B,QAAQ,GACrD,MAAM,IAAI,8BAA8B,yEAAyE;EAAE,OAAO;EAAY;CAAS,CAAC;AAExJ;AACA,eAAsB,4BAA4B,IAAI,QAAQ,UAAU,SAAS;CAC7E,OAAO,kCAAkC,IAAI,QAAQ,UAAU,KAAA,GAAW,UAAU,aAAa,SAAS,oBAAoB;AAClI;AAOA,SAAS,iBAAiB,UAAU,QAAQ;CACxC,IAAI,MAAM,QAAQ,OAAO,OAAO,GAAG;MAC3B,CAAC,OAAO,OAAO,IAAI,SAAS,QAAQ,GACpC,MAAM,IAAI,iDAA+C,sBAAsB;GAC3E;GACA,QAAQ,OAAO;GACf,OAAO;EACX,CAAC;CAAA,OAGJ,IAAI,OAAO,OAAO,QAAQ,UAC3B,MAAM,IAAI,iDAA+C,sBAAsB;EAC3E;EACA,QAAQ,OAAO;EACf,OAAO;CACX,CAAC;CAEL,OAAO;AACX;AAOA,SAAS,eAAe,IAAI,QAAQ;CAChC,MAAM,WAAW,GAAG,gBAAgB,GAAG,MAAM,KAAK,GAAG;CACrD,IAAI,OAAO,OAAO,QAAQ,UACtB,MAAM,IAAI,+CAA6C,sBAAsB;EACzE;EACA,QAAQ,OAAO;EACf,OAAO;CACX,CAAC;CAEL,OAAO;AACX;AACA,MAAM,0BAAU,IAAI,QAAQ;AAC5B,SAAS,MAAM,cAAc;CACzB,QAAQ,IAAI,YAAY;CACxB,OAAO;AACX;AACA,MAAa,SAAS,OAAO;AAC7B,eAAsB,8BAA8B,IAAI,QAAQ,sBAAsB,oBAAoB,aAAa,cAAc,SAAS;CAC1I,SAAS,EAAE;CACX,aAAa,MAAM;CACnB,IAAI,CAAC,QAAQ,IAAI,kBAAkB,GAC/B,MAAM,eAAe,0IAAqI,qBAAqB;CAEnL,aAAa,aAAa,iBAAe;CACzC,MAAM,OAAO,sBAAsB,oBAAoB,MAAM;CAC7D,IAAI,CAAC,MACD,MAAM,IAAI,mDAAiD,gBAAgB;CAE/E,MAAM,aAAa,IAAI,gBAAgB,SAAS,oBAAoB;CACpE,WAAW,IAAI,gBAAgB,WAAW;CAC1C,WAAW,IAAI,QAAQ,IAAI;CAC3B,IAAI,iBAAiB,QAAQ;EACzB,aAAa,cAAc,kBAAgB;EAC3C,WAAW,IAAI,iBAAiB,YAAY;CAChD;CACA,OAAO,qBAAqB,IAAI,QAAQ,sBAAsB,sBAAsB,YAAY,OAAO;AAC3G;AACA,MAAM,gBAAgB;CAClB,KAAK;CACL,QAAQ;CACR,WAAW;CACX,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,OAAO;CACP,QAAQ;CACR,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,KAAK;CACL,WAAW;AACf;AACA,SAAS,iBAAiB,UAAU,QAAQ;CACxC,KAAK,MAAM,SAAS,UAChB,IAAI,OAAO,OAAO,WAAW,KAAA,GACzB,MAAM,IAAI,QAAQ,MAAM,KAAK,cAAc,OAAO,kBAAkB,kBAAkB,EAClF,QAAQ,OAAO,OACnB,CAAC;CAGT,OAAO;AACX;AACA,MAAa,gBAAgB,OAAO;AACpC,MAAa,oBAAoB,OAAO;AACxC,eAAsB,iCAAiC,IAAI,QAAQ,UAAU,SAAS;CAClF,IAAI,OAAO,SAAS,kBAAkB,YAClC,OAAO,SAAS,WAAW,YAC3B,SAAS,gBACT,OAAO,uCAAuC,IAAI,QAAQ,UAAU,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,aAAa,QAAQ,oBAAoB;CAEhK,OAAO,uCAAuC,IAAI,QAAQ,UAAU,UAAU,aAAa,SAAS,oBAAoB;AAC5H;AACA,eAAe,uCAAuC,IAAI,QAAQ,UAAU,eAAe,QAAQ,WAAW,sBAAsB;CAChI,MAAM,2BAA2B,CAAC;CAClC,QAAQ,eAAR;EACI,KAAK,KAAA;GACD,gBAAgB;GAChB;EACJ,KAAK,eACD;EACJ;GACI,aAAa,eAAe,4BAA0B;GACtD,yBAAyB,KAAK,OAAO;CAC7C;CACA,WAAW,OAAO;CAClB,QAAQ,QAAR;EACI,KAAK,KAAA;GACD,SAAS;GACT;EACJ,KAAK,mBACD;EACJ;GACI,aAAa,QAAQ,MAAM,qBAAmB;GAC9C,yBAAyB,KAAK,WAAW;CACjD;CACA,MAAM,SAAS,MAAM,kCAAkC,IAAI,QAAQ,UAAU,0BAA0B,WAAW,oBAAoB;CACtI,aAAa,OAAO,UAAU,2CAAuC,kBAAkB,EACnF,MAAM,OACV,CAAC;CACD,MAAM,SAAS,0BAA0B,MAAM;CAC/C,IAAI,WAAW,mBAAmB;EAC9B,MAAM,MAAM,UAAU,IAAI,aAAa,MAAM;EAC7C,MAAM,YAAY,kBAAkB,MAAM;EAC1C,IAAI,OAAO,YAAY,SAAS,MAAM,WAClC,MAAM,IAAI,oEAAoE,qBAAqB;GAAE;GAAQ;GAAK;GAAW,OAAO;EAAY,CAAC;CAEzJ;CACA,IAAI,kBAAkB;MACd,OAAO,UAAU,KAAA,GACjB,MAAM,IAAI,6CAA2C,sBAAsB;GACvE,UAAU,KAAA;GACV;GACA,OAAO;EACX,CAAC;CAAA,OAGJ,IAAI,OAAO,UAAU,eACtB,MAAM,IAAI,6CAA2C,sBAAsB;EACvE,UAAU;EACV;EACA,OAAO;CACX,CAAC;CAEL,OAAO;AACX;AACA,eAAe,uCAAuC,IAAI,QAAQ,UAAU,WAAW,sBAAsB;CACzG,MAAM,SAAS,MAAM,kCAAkC,IAAI,QAAQ,UAAU,KAAA,GAAW,WAAW,oBAAoB;CACvH,MAAM,SAAS,0BAA0B,MAAM;CAC/C,IAAI,QAAQ;EACR,IAAI,OAAO,oBAAoB,KAAA,GAAW;GACtC,aAAa,OAAO,iBAAiB,MAAM,4BAA0B;GACrE,MAAM,MAAM,UAAU,IAAI,aAAa,MAAM;GAC7C,MAAM,YAAY,kBAAkB,MAAM;GAC1C,IAAI,OAAO,YAAY,OAAO,kBAAkB,MAAM,WAClD,MAAM,IAAI,oEAAoE,qBAAqB;IAAE;IAAQ;IAAK;IAAW,OAAO;GAAY,CAAC;EAEzJ;EACA,IAAI,OAAO,UAAU,KAAA,GACjB,MAAM,IAAI,6CAA2C,sBAAsB;GACvE,UAAU,KAAA;GACV;GACA,OAAO;EACX,CAAC;CAET;CACA,OAAO;AACX;AACA,MAAa,6BAA6B;AAC1C,MAAa,sBAAsB;AACnC,MAAa,wBAAwB;AACrC,MAAa,+BAA+B;AAE5C,MAAa,cAAc;AAC3B,MAAa,mBAAmB;AAEhC,MAAa,uBAAuB;AACpC,MAAa,0BAA0B;AACvC,MAAa,yBAAyB;AACtC,MAAa,6BAA6B;AAC1C,MAAa,sBAAsB;AACnC,MAAa,uBAAuB;AAGpC,MAAa,0BAA0B;AACvC,MAAa,0BAA0B;AA4CvC,SAAS,uBAAuB,UAAU;CACtC,IAAI,SAAS,UACT,MAAM,eAAe,2CAAyC,qBAAqB;AAE3F;AAgLA,eAAe,YAAY,KAAK,UAAU,WAAW,gBAAgB,YAAY;CAC7E,IAAI,EAAE,GAAG,iBAAiB,GAAG,SAAS,WAAW,IAAI,MAAM,GAAG;CAC9D,IAAI,WAAW,GACX,IAAI,eAAe,KAAA,GAAW;EAC1B,MAAM,MAAM,WAAW,GAAG;EAC1B,CAAC,CAAE,GAAG,iBAAiB,GAAG,SAAS,UAAW,IAAI,MAAM,GAAG;CAC/D,OAEI,MAAM,IAAI,0BAA0B,oCAAoC,EAAE,OAAO,IAAI,CAAC;CAG9F,IAAI,WAAW,GACX,MAAM,IAAI,eAAe,kBAAkB,GAAG;CAElD,IAAI;CACJ,IAAI;EACA,SAAS,KAAK,MAAM,IAAI,KAAK,eAAe,CAAC,CAAC;CAClD,SACO,OAAO;EACV,MAAM,IAAI,6DAA6D,aAAa,KAAK;CAC7F;CACA,IAAI,CAAC,aAAa,MAAM,GACpB,MAAM,IAAI,yCAAyC,kBAAkB,GAAG;CAE5E,SAAS,MAAM;CACf,IAAI,OAAO,SAAS,KAAA,GAChB,MAAM,IAAI,0BAA0B,6DAA2D,EAC3F,OAAO,EAAE,OAAO,EACpB,CAAC;CAEL,IAAI;CACJ,IAAI;EACA,SAAS,KAAK,MAAM,IAAI,KAAK,OAAO,CAAC,CAAC;CAC1C,SACO,OAAO;EACV,MAAM,IAAI,8DAA8D,aAAa,KAAK;CAC9F;CACA,IAAI,CAAC,aAAa,MAAM,GACpB,MAAM,IAAI,0CAA0C,kBAAkB,GAAG;CAE7E,MAAM,MAAM,UAAU,IAAI;CAC1B,IAAI,OAAO,QAAQ,KAAA,GAAW;EAC1B,IAAI,OAAO,OAAO,QAAQ,UACtB,MAAM,IAAI,uDAAqD,kBAAkB,EAAE,OAAO,CAAC;EAE/F,IAAI,OAAO,OAAO,MAAM,gBACpB,MAAM,IAAI,8FAA4F,qBAAqB;GAAE;GAAQ;GAAK,WAAW;GAAgB,OAAO;EAAM,CAAC;CAE3L;CACA,IAAI,OAAO,QAAQ,KAAA;MACX,OAAO,OAAO,QAAQ,UACtB,MAAM,IAAI,iDAA+C,kBAAkB,EAAE,OAAO,CAAC;CAAA;CAG7F,IAAI,OAAO,QAAQ,KAAA;MACX,OAAO,OAAO,QAAQ,UACtB,MAAM,IAAI,8CAA4C,kBAAkB,EAAE,OAAO,CAAC;CAAA;CAG1F,IAAI,OAAO,QAAQ,KAAA,GAAW;EAC1B,IAAI,OAAO,OAAO,QAAQ,UACtB,MAAM,IAAI,kDAAgD,kBAAkB,EAAE,OAAO,CAAC;EAE1F,IAAI,OAAO,MAAM,MAAM,gBACnB,MAAM,IAAI,mDAAiD,qBAAqB;GAC5E;GACA;GACA,WAAW;GACX,OAAO;EACX,CAAC;CAET;CACA,IAAI,OAAO,QAAQ,KAAA;MACX,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,OAAO,GAAG,GAC3D,MAAM,IAAI,gDAA8C,kBAAkB,EAAE,OAAO,CAAC;CAAA;CAG5F,OAAO;EAAE;EAAQ;EAAQ,KAAK;CAAI;AACtC;AAyNA,SAAS,sBAAsB,QAAQ,QAAQ,UAAU,QAAQ;CAC7D,IAAI,WAAW,KAAA,GAAW;EACtB,IAAI,OAAO,WAAW,WAAW,OAAO,QAAQ,SAAS,CAAC,OAAO,SAAS,OAAO,GAAG,GAChF,MAAM,IAAI,2CAAyC,kBAAkB;GACjE;GACA,UAAU;GACV,QAAQ;EACZ,CAAC;EAEL;CACJ;CACA,IAAI,MAAM,QAAQ,MAAM,GAAG;EACvB,IAAI,CAAC,OAAO,SAAS,OAAO,GAAG,GAC3B,MAAM,IAAI,2CAAyC,kBAAkB;GACjE;GACA,UAAU;GACV,QAAQ;EACZ,CAAC;EAEL;CACJ;CACA,IAAI,aAAa,KAAA,GAAW;EACxB,IAAI,OAAO,aAAa,WAClB,OAAO,QAAQ,WACf,OAAO,aAAa,aAChB,CAAC,SAAS,OAAO,GAAG,IACpB,CAAC,SAAS,SAAS,OAAO,GAAG,GACnC,MAAM,IAAI,2CAAyC,kBAAkB;GACjE;GACA,UAAU;GACV,QAAQ;EACZ,CAAC;EAEL;CACJ;CACA,MAAM,IAAI,sFAAoF,KAAA,GAAW;EAAE;EAAQ;EAAQ;CAAS,CAAC;AACzI;AACA,SAAS,sBAAsB,YAAY,MAAM;CAC7C,MAAM,EAAE,GAAG,OAAO,WAAW,WAAW,OAAO,IAAI;CACnD,IAAI,SAAS,GACT,MAAM,IAAI,IAAI,KAAK,yCAAyC,gBAAgB;CAEhF,OAAO;AACX;AACA,MAAa,iBAAiB,OAAO;AACrC,MAAa,gBAAgB,OAAO;AACpC,SAAgB,qBAAqB,IAAI,QAAQ,YAAY,eAAe;CACxE,SAAS,EAAE;CACX,aAAa,MAAM;CACnB,IAAI,sBAAsB,KACtB,aAAa,WAAW;CAE5B,IAAI,EAAE,sBAAsB,kBACxB,MAAM,eAAe,iEAA+D,oBAAoB;CAE5G,IAAI,sBAAsB,YAAY,UAAU,GAC5C,MAAM,IAAI,4GAA0G,kBAAkB,EAAE,WAAW,CAAC;CAExJ,MAAM,MAAM,sBAAsB,YAAY,KAAK;CACnD,MAAM,QAAQ,sBAAsB,YAAY,OAAO;CACvD,IAAI,CAAC,OAAO,GAAG,gDACX,MAAM,IAAI,+CAA6C,kBAAkB,EAAE,WAAW,CAAC;CAE3F,IAAI,OAAO,QAAQ,GAAG,QAClB,MAAM,IAAI,wDAAsD,kBAAkB;EAC9E,UAAU,GAAG;EACb;CACJ,CAAC;CAEL,QAAQ,eAAR;EACI,KAAK,KAAA;EACL,KAAK;GACD,IAAI,UAAU,KAAA,GACV,MAAM,IAAI,uDAAqD,kBAAkB;IAC7E,UAAU,KAAA;IACV;GACJ,CAAC;GAEL;EACJ,KAAK,gBACD;EACJ;GACI,aAAa,eAAe,4BAA0B;GACtD,IAAI,UAAU,eACV,MAAM,IAAI,UAAU,KAAA,IACd,yCACA,iDAA+C,kBAAkB;IAAE,UAAU;IAAe;GAAW,CAAC;CAE1H;CAEA,IADc,sBAAsB,YAAY,OACxC,GACJ,MAAM,IAAI,2BAA2B,sDAAsD,EACvF,OAAO,WACX,CAAC;CAEL,MAAM,WAAW,sBAAsB,YAAY,UAAU;CAC7D,MAAM,QAAQ,sBAAsB,YAAY,OAAO;CACvD,IAAI,aAAa,KAAA,KAAa,UAAU,KAAA,GACpC,MAAM,IAAI,0BAA0B,6CAA6C;CAErF,OAAO,MAAM,IAAI,gBAAgB,UAAU,CAAC;AAChD;AA+XA,eAAe,oBAAoB,UAAU,QAAQ,uBAAuB;CACxE,IAAI;CACJ,IAAI;EACA,OAAO,MAAM,SAAS,KAAK;CAC/B,SACO,OAAO;EACV,MAAM,QAAQ;EACd,MAAM,IAAI,6CAA2C,aAAa,KAAK;CAC3E;CACA,IAAI,CAAC,aAAa,IAAI,GAClB,MAAM,IAAI,gDAA8C,kBAAkB,EAAE,MAAM,KAAK,CAAC;CAE5F,OAAO;AACX;AAGA,MAAa,kBAAkB,OAAO;;;AC33EtC,MAAM,0BAA0B,CAC9BA,mBAAAA,YAAY,sBACZA,mBAAAA,YAAY,kBACd;AAEA,SAAS,yBAAyB,OAAkG;CAClI,OAAOA,mBAAAA,YAAY,qBAAqB,WAAW,KAAK,KAAKA,mBAAAA,YAAY,mBAAmB,WAAW,KAAK;AAC9G;AAEA,SAAS,6BAA6B,cAA6C,SAAiB;CAClG,IAAI,cAAc,aAAa;EAC7B,IAAI,aAAa,SAAS,QAAQ,aAAa,SAAS,MACtD,MAAM,IAAIC,mBAAAA,uBAAuB,GAAG,QAAQ,wEAAwE;EAGtH,OAAO,EACL,2BAA2B,OAC7B;CACF;CAEA,MAAM,iBAAiB,cAAc,OAAO,KAAK,KAAK,KAAA;CACtD,IAAI,cAAc,UAAU,WAAW;EACrC,IAAI,kBAAkB,MAEpB,OAAO,EACL,2BAA2B,OAC7B;EAGF,OAAO;GACL,qBAAqB;GACrB,qBAAqB;EACvB;CACF;CAEA,IAAI,kBAAkB,MAAM;EAC1B,IAAI,cAAc,SAAS,MACzB,MAAM,IAAIA,mBAAAA,uBAAuB,GAAG,QAAQ,8CAA8C;EAG5F,OAAO,CAAC;CACV;CAEA,IAAI,cAAc,SAAS,MACzB,OAAO,EACL,qBAAqB,eACvB;CAGF,OAAO;EACL,qBAAqB;EACrB,qBAAqB;CACvB;AACF;AAEA,eAAe,mBACb,UACA,SACkD;CAIlD,IAAI,QAAQ,WACV,OAAO;EAAE,MAAM;EAAU,aAAa;CAAmB;CAE3D,MAAM,wBACHC,oBAAAA,UAA+D;CAClE,IAAI,OAAO,0BAA0B,cAAc,OAAO,SAAS,eAAe,OAAO,aAAa,aACpG,OAAO;EAAE,MAAM;EAAU,aAAa;CAAmB;CAE3D,IAAI;EACF,MAAM,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,IAAI,sBAAsB,MAAM,CAAC;EAC1F,MAAM,SAAS,MAAM,IAAI,SAAS,MAAM,CAAC,CAAC,YAAY;EACtD,OAAO;GAAE,MAAM,IAAI,WAAW,MAAM;GAAG,aAAa;EAA2B;CACjF,QAAQ;EAEN,OAAO;GAAE,MAAM;GAAU,aAAa;EAAmB;CAC3D;AACF;AAEA,IAAa,0BAAb,MAAqC;CAWnC,YAAY,SAAiD;EAAjC,KAAA,UAAA;2CATA,IAAI,IAAqB;iBAMU;EAI7D,KAAK,oBAAoB,QAAQ,aAAa;CAChD;CAEA,mBAAmB,UAAuC;EACxD,KAAK,kBAAkB,IAAI,QAAQ;EACnC,aAAa;GACX,KAAK,kBAAkB,OAAO,QAAQ;EACxC;CACF;CAEA,IAAI,YAAY;EACd,OAAO,KAAK,QAAQ;CACtB;CAEA,YAAY;EACV,OAAO,KAAK,QAAQ,WAAW,IAAI;CACrC;CAEA,aAAuB;EACrB,OAAO,KAAK,QAAQ,WAAW,CAAC,CAAC,KAAI,MAAK,IAAI,SAAS;CACzD;;;;;;CAOA,gBAAwB;EACtB,MAAM,UAAU,KAAK,WAAW;EAChC,IAAI,KAAK,WAAW,QAAQ,KAAK,QAAQ,QACvC,OAAO,QAAQ,KAAK,QAAQ;EAE9B,OAAO,QAAQ;CACjB;;;;;;;;;;;;;;;;;;;;;;CAuBA,MAAgB,cAAiB,IAAiH;EAChJ,MAAM,UAAU,KAAK,WAAW;EAGhC,IAAI,QAAQ,UAAU,GACpB,OAAO,MAAM,GAAG,QAAQ,IAAI;GAAE,aAAa;GAAG,iBAAiB;EAAM,CAAC;EAIxE,IAAI,KAAK,SAAS;GAChB,MAAM,SAAS,MAAM,KAAK,cAAc,SAAS,EAAE;GACnD,IAAI,WAAW,KAAA,GAAW,OAAO;EAEnC;EAGA,OAAO,MAAM,KAAK,aAAa,SAAS,EAAE;CAC5C;CAEA,oBAA4B,OAAgB;EAC1C,OAAO,iBAAiBC,mBAAAA,cAAc,KAAK,gCAAgC,KAAK;CAClF;CAEA,gCAAwC,OAAgB;EACtD,MAAM,WAAW,KAAK,yBAAyB,KAAK;EACpD,OAAO,YAAY,QAAQ,SAAS,UAAU,OAAO,SAAS,SAAS;CACzE;CAEA,yBAAiC,OAAgB,6BAAa,IAAI,IAAW,GAAoB;EAC/F,IAAI,iBAAiB,UACnB,OAAO;EAET,IAAI,EAAE,iBAAiB,UAAU,WAAW,IAAI,KAAK,GACnD,OAAO;EAGT,WAAW,IAAI,KAAK;EACpB,OAAO,KAAK,yBAAyB,MAAM,OAAO,UAAU;CAC9D;;;;;CAMA,MAAc,cACZ,SACA,IACwB;EACxB,MAAM,SAAS,KAAK;EAGpB,IAAI,KAAK,OAAO,IAAI,OAAO,WACzB,IAAI;GACF,MAAM,SAAS,MAAM,GAAG,QAAQ,IAAI;IAAE,aAAa;IAAG,iBAAiB;GAAK,CAAC;GAC7E,KAAK,UAAU;GACf,OAAO;EACT,SAAS,GAAG;GACV,IAAI,KAAK,oBAAoB,CAAC,GAAG,MAAM;GACvC,OAAO,YAAY,KAAK,IAAI,OAAO,YAAY,IAAK,GAAI;EAC1D;EAIF,IAAI;GACF,OAAO,MAAM,GAAG,QAAQ,OAAO,QAAQ;IAAE,aAAa;IAAG,iBAAiB;GAAK,CAAC;EAClF,SAAS,GAAG;GACV,IAAI,KAAK,oBAAoB,CAAC,GAAG,MAAM;GACvC,KAAK,UAAU;GACf;EACF;CACF;;;;;CAMA,MAAc,aACZ,SACA,IACY;EACZ,IAAI;EAEJ,KAAK,IAAI,OAAO,GAAG,OAAO,GAAG,QAC3B,KAAK,IAAI,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAClC,IAAI;GACF,MAAM,SAAS,MAAM,GAAG,QAAQ,IAAI;IAAE,aAAa;IAAG,iBAAiB;GAAK,CAAC;GAC7E,IAAI,IAAI,GACN,KAAK,UAAU;IAAE,OAAO;IAAG,WAAW,KAAK;GAAkB;GAE/D,OAAO;EACT,SAAS,GAAG;GACV,IAAI,KAAK,oBAAoB,CAAC,GAAG,MAAM;GACvC,YAAY,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,CAAC,CAAC;EAC1D;EAIJ,MAAM;CACR;CAEA,qBAAqB;EACnB,QAAQ,KAAK,QAAQ,uBAAuB,KAAK,QAAQ,WAAA,CAAY,IAAI;CAC3E;CAEA,MAAa,sBAAsB,SAAkC,aAA6C;EAChH,IAAI,KAAK,2BACP,OAAO,MAAM,KAAK;EAGpB,KAAK,4BAA4B,KAAK,4BAA4B,SAAS,WAAW;EACtF,IAAI;GACF,OAAO,MAAM,KAAK;EACpB,UAAU;GACR,KAAK,4BAA4B,KAAA;EACnC;CACF;CAEA,MAAc,4BAA4B,SAAkC,aAA6C;EACvH,MAAM,aAAa,OAAO,OAA4B;GACpD,IAAI;IACF,MAAM,GAAG;IACT,OAAO;GACT,SAAS,GAAG;IACV,OAAO,GAAG;GACZ;EACF;EACA,MAAM,UAAU,MAAM,WAAW,YAAY;GAC3C,MAAM,MAAM,MAAM,MAAM,+BAA+B;GACvD,IAAI,CAAC,IAAI,IACP,MAAM,IAAI,MAAM,GAAG,IAAI,OAAO,GAAG,IAAI,WAAW,IAAI,MAAM,IAAI,KAAK,GAAG;EAE1E,CAAC;EACD,MAAM,iBAAiB,MAAM,WAAW,YAAY;GAClD,MAAM,MAAM,MAAM,MAAM,IAAI,IAAI,WAAW,KAAK,UAAU,CAAC,CAAC;GAC5D,IAAI,CAAC,IAAI,IACP,MAAM,IAAI,MAAM,GAAG,IAAI,OAAO,GAAG,IAAI,WAAW,IAAI,MAAM,IAAI,KAAK,GAAG;EAE1E,CAAC;EACD,MAAM,gBAAgB,MAAM,WAAW,YAAY;GACjD,MAAM,MAAM,MAAM,MAAM,iCAAiC;GACzD,IAAI,CAAC,IAAI,IACP,MAAM,IAAI,MAAM,GAAG,IAAI,OAAO,GAAG,IAAI,WAAW,IAAI,MAAM,IAAI,KAAK,GAAG;EAE1E,CAAC;EACD,MAAM,cAAc,MAAM,WAAW,YAAY;GAC/C,MAAM,MAAM,MAAM,MAAM,iCAAiC;GACzD,IAAI,CAAC,IAAI,IACP,MAAM,IAAI,MAAM,GAAG,IAAI,OAAO,GAAG,IAAI,WAAW,IAAI,MAAM,IAAI,KAAK,GAAG;EAE1E,CAAC;EACD,OAAO;GACL,qBAAqBD,oBAAAA,UAAU,WAAW;GAC1C;GACA;GACA;GACA;EACF;CACF;CAEA,MAAgB,oBAAoB,OAAc,SAAkC,aAA6C;EAC/H,OAAO,IAAI,MAAM,oBAAA,QAAQ;;;;;QAKrB,MAAM;;QAEN,KAAK,UAAU,MAAM,KAAK,sBAAsB,SAAS,WAAW,GAAG,MAAM,CAAC,EAAE;OACjF,EAAS,MAAM,CAAC;CACrB;CAEA,MAAgB,cACd,IACA,SACA,aACA,SACY;EACZ,MAAM,gBAAgB,MAAME,oBAAAA,OAAO,MACjC,IACA,SAAS,eAAe,GACxB,EAAE,sBAAsB,IAAK,CAC/B;EAGA,IAAI,cAAc,WAAW,SAAS;GACpC,IAAIF,oBAAAA,UAAU,aAAaA,oBAAAA,UAAU,UAAU,WAAW,OACxD,MAAM,IAAI,MAAM,4GAA4G,EAAE,OAAO,cAAc,MAAM,CAAC;GAE5J,IAAI,SAAS,iBACX,MAAM,cAAc;GAEtB,MAAM,MAAM,KAAK,oBAAoB,cAAc,OAAO,SAAS,WAAW;EAChF;EACA,OAAO,cAAc;CACvB;CAEA,MAAgB,uBACd,IACA,SACA,aACA,SACY;EACZ,OAAO,MAAM,KAAK,cAAc,YAAY,MAAME,oBAAAA,OAAO,kBAAkB,EAAE,GAAG,SAAS,aAAa,OAAO;CAC/G;CAEA,MAAa,oBAAoB,cAA4B;EAC3D,IAAI,yBAAyB,KAAK,SAEhC,MAAM,IAAI,MAAM,qJAAqJ;EAGvK,MAAM,eAAe,KAAK,QAAQ,wBAAwBC,kBAAAA;EAC1D,OAAO,MAAM,KAAK,cAAc,OAAO,QAAQ,iBAAiB;GAC9D,OAAO,MAAM,KAAK,0BAA0B,cAAc,cAAc,QAAQ,YAAY;EAC9F,CAAC;CACH;CAEA,MAAc,0BAA0B,cAA4B,cAAsB,QAAgB,cAAoE;EAC5K,MAAM,gBAAgB,SAAS;EAC/B,MAAM,KAAK;GACT,QAAQ,KAAK,QAAQ,WAAW;GAChC,WAAW;GACX,gBAAgB;EAClB;EACA,MAAM,SAAuB;GAC3B,WAAW,KAAK;GAChB,eAAe;EACjB;EAEA,MAAM,uBAAuBC,iBAAuB,YAAY;EAEhE,MAAM,gBAAgB,cAAc,WAAW,SAAS;EAExD,MAAM,WAAW,MAAM,KAAK,uBAAuB,YAAY;GAC7D,MAAM,cAAc,MAAMC,yBACxB,IACA,QACA,sBACA,aAAa,OACb,gBAAgB,GAAGC,wBAA8B,KAAK,IAAI,KAAA,CAC5D;GAEA,MAAM,WAAW,MAAM,KAAK,iBAAiB,WAAW;GAExD,IAAI,SAAS,WAAW,SAAS;IAC/B,MAAM,QAAQ,SAAS;IACvB,IAAIR,mBAAAA,YAAY,kBAAkB,WAAW,KAAK,GAChD,OAAO;IAET,MAAM;GACR;GAEA,IAAI,CAAC,SAAS,KAAK,IAAI;IACrB,MAAM,OAAO,MAAM,SAAS,KAAK,KAAK;IACtC,MAAM,IAAI,MAAM,yCAAyC,SAAS,OAAO,GAAG,QAAQ,EAAE,OAAO,SAAS,KAAK,CAAC;GAC9G;GAEA,OAAO,SAAS;EAClB,GAAG,KAAA,GAAW,KAAA,GAAW,YAAY;EACrC,IAAI,CAAC,UAAU,OAAO;EAEtB,IAAI;EACJ,IAAI;GACF,SAAS,MAAMS,4BAAkC,IAAI,QAAQ,QAAQ;EACvE,SAAS,GAAE;GACT,IAAI,aAAaC,mBACf,MAAM,IAAIT,mBAAAA,uBAAuB,4DAA4D;IAC3F,OAAO,EAAE;IACT,MAAM,EAAE;IACR,OAAO,EAAE;GACX,CAAC;GAEH,MAAM,IAAIA,mBAAAA,uBAAuB,2DAA2D,EAAE,OAAO,EAAE,CAAC;EAC1G;EAEA,IAAI,CAAC,OAAO,cACV,MAAM,IAAIA,mBAAAA,uBAAuB,mEAAmE;EAGtG,OAAOU,eAAAA,YAAY,cAAc,OAAO,YAAY,MAAA,GAAA,mBAAA,SAAA,CAAc,yGAAyG,EAAE,OAAO,CAAC;CACvL;CAEA,MAAa,kBACX,MACA,gBACA,SACA,cAA6C,UAC7C,gBACA,cACA;EACA,YAAY,KAAK,cAAc,EAC7B,cAAc,KAChB,CAAC;EAED,IAAI,gBACF,OAAO,MAAM,KAAK,oBACV,KAAK,uBAAuB,MAAM,gBAAgB,SAAU,aAAa,gBAAgB,YAAY,GAC3G,SACA,aACA,YACF;EAGF,OAAO,MAAM,KAAK,cAAc,OAAO,QAAQ,yBAAyB;GACtE,OAAO,MAAM,KAAK,oBACV,KAAK,uBAAuB,MAAM,gBAAgB,SAAU,aAAa,QAAQ,YAAY,GACnG,SACA,aACA;IAAE,GAAG;IAAsB,GAAG;GAAa,CAC7C;EACF,CAAC;CACH;CAEA,cAAqB,SAAgH;EAKnI,OAAO,IAJaC,eAAAA,gBAAgB;GAClC,4BAA4B,OAAO,iBAAiB,MAAM,KAAK,oBAAoB,YAAY;GAC/F,GAAG;EACL,CACa;CACf;CAEA,MAAM,uBACJ,MACA,SACA,SACkC;EAClC,IAAI;GACF,MAAM,UAAU,MAAM,mBAAmB,MAAM,EAAE,WAAW,QAAQ,UAAU,CAAC;GAC/E,MAAM,WAAW,MAAM,KAAK,kBAC1B,0BACA;IACE,QAAQ;IACR,SAAS,EAAE,gBAAgB,QAAQ,YAAY;IAC/C,MAAM,QAAQ;IACd,WAAW,QAAQ;GACrB,GACA,SACA,UACA,KAAK,mBAAmB,GACxB;IAAE,aAAa;IAAG,iBAAiB;GAAK,CAC1C;GACA,OAAOR,oBAAAA,OAAO,GAAG,QAAQ;EAC3B,SAAS,GAAG;GACV,OAAOA,oBAAAA,OAAO,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,CAAC,CAAC,CAAC;EACnE;CACF;CAEA,MAAM,wBACJ,MACA,SACA,SACkC;EAClC,IAAI;GACF,MAAM,UAAU,MAAM,mBAAmB,MAAM,EAAE,WAAW,QAAQ,UAAU,CAAC;GAC/E,MAAM,WAAW,MAAM,KAAK,kBAC1B,2BACA;IACE,QAAQ;IACR,SAAS,EAAE,gBAAgB,QAAQ,YAAY;IAC/C,MAAM,QAAQ;IACd,WAAW,QAAQ;GACrB,GACA,SACA,UACA,KAAK,mBAAmB,GACxB;IAAE,aAAa;IAAG,iBAAiB;GAAK,CAC1C;GACA,OAAOA,oBAAAA,OAAO,GAAG,QAAQ;EAC3B,SAAS,GAAG;GACV,OAAOA,oBAAAA,OAAO,MAAM,aAAa,QAAQ,IAAI,IAAI,MAAM,OAAO,CAAC,CAAC,CAAC;EACnE;CACF;CAEA,MAAgB,oCACd,MACA,gBACA,kBACA,eASC;EACD,IAAI;GACF,OAAOA,oBAAAA,OAAO,GAAG,MAAM,KAAK,kBAAkB,MAAM,gBAAgB,gBAAgB,CAAC;EACvF,SAAS,GAAG;GACV,KAAK,MAAM,aAAa,eACtB,IAAI,UAAU,WAAW,CAAC,GACxB,OAAOA,oBAAAA,OAAO,MAAM,CAAoB;GAG5C,MAAM;EACR;CACF;CAEA,MAAc,uBACZ,MACA,SACA,SACA,aACA,gBACA,cAME;;;;EAIF,IAAI,WAAW,MAAM,QAAQ,4BAA4B,KAAQ,IAAI;EAErE,IAAI,eAAuC;EAC3C,IAAI,gBAAwF;EAE5F,IAAI,yBAAyB,KAAK,SAAS;GACzC,MAAM,sBAAsB,KAAK,QAAQ;GAEzC,IAAI,OAAO,wBAAwB,YAAY;IAC7C,MAAM,oBAAoB,MAAM,oBAAoB;IACpD,IAAI,mBAAmB;KACrB,MAAM,cAAcO,eAAAA,YAAY,cAAc,iBAAiB;KAC/D,IAAI,aACF,gBAAgB;MAAE;MAAa,cAAc;KAAK;IAEtD;GACF,OAAO;IACL,eAAe;IACf,gBAAgB,MAAM,oBAAoB,4BAA4B,KAAQ,IAAI;GACpF;EACF;EAGA,MAAM,KAAK,QAAQ,iBAAiB;EAEpC,IAAI,OAAO,kBAAkB,KAAK,UAAU,KAAK;EACjD,IAAI,IAAI,SAAS,GAAG,GAClB,MAAM,IAAI,MAAM,GAAG,EAAE;EAEvB,MAAM,SAAsB;;;;;;;;;;;GAW1B,GAAI,mBAAmBT,oBAAAA,YAAY,CAAC,IAAI,EACtC,aAAa,OACf;GACA,GAAG;GACH,SAAS;IAEP,oCAAoC;IACpC,yBAAyB,KAAK;IAC9B,0BAA0B;IAC1B,6BAA6B,KAAK,QAAQ;IAC1C,GAAI,WAAW,EACb,2BAA2B,SAAS,YAAY,MAClD,IAAI,CAAC;IACL,GAAI,UAAU,eAAe,EAC3B,4BAA4B,SAAS,aAAa,MACpD,IAAI,CAAC;IACL,mCAAmC;IACnC,GAAI,0BAA0B,KAAK,WAAW,KAAK,QAAQ,uBAAuB,EAChF,qCAAqC,KAAK,QAAQ,qBACpD,IAAI,CAAC;IACL,GAAI,gBAAgB,EAClB,iCAAiC,cAAc,YAAY,MAC7D,IAAI,CAAC;;;;;;;;;IASL,4BAAA,GAAA,mBAAA,2BAAA,CAAsD;IAEtD,8BAA8B;IAC9B,GAAG,KAAK,QAAQ;IAChB,GAAG,QAAQ;GACb;;;;GAIA,GAAI,mBAAmBA,oBAAAA,YAAY,CAAC,IAAI,EACtC,OAAO,WACT;EACF;EAEA,MAAM,YAAY,YAAY,IAAI;EAClC,IAAI;EACJ,IAAI;GACF,SAAS,MAAM,MAAM,KAAK,MAAM;EAClC,SAAS,GAAG;GACV,IAAI,KAAK,kBAAkB,OAAO,GAAG;IACnC,MAAM,QAAyB;KAAE;KAAM,SAAS,OAAO,UAAU,MAAA,CAAO,YAAY;KAAG,UAAU,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS;KAAG,OAAO,aAAa,QAAQ,EAAE,UAAU;IAAgB;IACpM,KAAK,kBAAkB,SAAS,MAAM,EAAE,KAAK,CAAC;GAChD;GACA,IAAI,aAAa,WAEf,IAAIW,iBAAAA,aAAc,OAAO,UAAU,MAAqB,CAAC,YACvD,OAAOT,oBAAAA,OAAO,MAAM,CAAC;QAChB,IAAI,cAAc,iBACvB,MAAM;QAEN,MAAM,MAAM,KAAK,oBAAoB,GAAG,SAAS,WAAW;GAGhE,MAAM;EACR;EAEA,MAAM,kBAAkB,MAAM,KAAK,oBAAoB,MAAM;EAE7D,IAAI,KAAK,kBAAkB,OAAO,GAAG;GACnC,MAAM,QAAyB;IAAE;IAAM,SAAS,OAAO,UAAU,MAAA,CAAO,YAAY;IAAG,QAAQ,gBAAgB;IAAQ,UAAU,KAAK,MAAM,YAAY,IAAI,IAAI,SAAS;GAAE;GAC3K,KAAK,kBAAkB,SAAS,MAAM,EAAE,KAAK,CAAC;EAChD;EAEA,MAAM,eAAe,MAAM,KAAK,iBAAiB,eAAe;EAEhE,IAAI,aAAa,WAAW,SAAS;GAEnC,IAAIJ,mBAAAA,YAAY,mBAAmB,WAAW,aAAa,KAAK,GAAG;IACjE,IAAI,CAAC,UACH,MAAM,IAAIC,mBAAAA,uBAAuB,+DAA+D;KAAE;KAAU;IAAa,CAAC;IAE5H,QAAQ,uBAAuB,SAAS,WAAW;IACnD,OAAOG,oBAAAA,OAAO,MAAM,aAAa,KAAK;GACxC;GAIA,IAAI,iBAAiBJ,mBAAAA,YAAY,wBAAwB,WAAW,aAAa,KAAK,KAAKA,mBAAAA,YAAY,eAAe,WAAW,aAAa,KAAK,IAAI;IACrJ,IAAI,CAAC,eACH,MAAM,IAAIC,mBAAAA,uBAAuB,2EAA2E;KAAE;KAAe;IAAa,CAAC;IAE7I,aAAa,uBAAuB,cAAc,WAAW;IAC7D,OAAOG,oBAAAA,OAAO,MAAM,aAAa,KAAK;GACxC;GAIA,MAAM,aAAa;EACrB;EAGA,MAAM,MAAM,OAAO,OAAO,aAAa,MAAM,EAC3C,YAAY,SACd,CAAC;EACD,IAAI,IAAI,IACN,OAAOA,oBAAAA,OAAO,GAAG,GAAG;OACf,IAAI,IAAI,WAAW,KAAK;GAC7B,MAAM,aAAa,IAAI,QAAQ,IAAI,aAAa;GAChD,IAAI,eAAe,MAAM;IACvB,QAAQ,IAAI,yCAAyC,IAAI,qBAAqB,WAAW,YAAY;IACrG,OAAA,GAAA,qBAAA,KAAA,CAAW,OAAO,UAAU,IAAI,GAAI;IACpC,OAAOA,oBAAAA,OAAO,sBAAM,IAAI,MAAM,gCAAgC,WAAW,SAAS,CAAC;GACrF;GAEA,QAAQ,IAAI,yCAAyC,IAAI,mEAAmE;GAC5H,OAAOA,oBAAAA,OAAO,sBAAM,IAAI,MAAM,8CAA8C,CAAC;EAC/E,OAAO;GACL,MAAM,QAAQ,MAAM,IAAI,KAAK;GAG7B,IAAI,IAAI,UAAU,OAAO,IAAI,SAAS,KACpC,MAAM,IAAI,MAAM,6BAA6B,IAAI,IAAI,IAAI,OAAO,GAAG,SAAS,EAAE,OAAO,IAAI,CAAC;GAE5F,MAAM,WAAW,IAAIH,mBAAAA,uBAAuB,6BAA6B,IAAI,IAAI,IAAI,OAAO,GAAG,SAAS;IAAE,SAAS;IAAQ;IAAK;GAAK,CAAC;GAEtI,IAAI,IAAI,WAAW,OAAO,MAAM,SAAS,wBAAwB,GAG/D,OAAOG,oBAAAA,OAAO,MAAM,QAAQ;GAI9B,MAAM;EACR;CACF;CAEA,MAAc,oBAAoB,QAAqC;EACrE,IAAI,MAAM;EAEV,IAAI,OAAO,QAAQ,IAAI,0BAA0B,KAAK,OAAO,QAAQ,IAAI,uBAAuB,GAAG;GACjG,MAAM,eAAe,OAAO,OAAO,QAAQ,IAAI,0BAA0B,KAAK,OAAO,QAAQ,IAAI,uBAAuB,CAAC;GACzH,MAAM,IAAI,SAAS,OAAO,MAAM;IAC9B,QAAQ;IACR,YAAY,OAAO;IACnB,SAAS,OAAO;GAClB,CAAC;EACH;EACA,OAAO;CACT;CAEA,MAAc,iBAAiB,KAAsD;EAGnF,IAAI,IAAI,QAAQ,IAAI,wBAAwB,KAAK,IAAI,QAAQ,IAAI,qBAAqB,GAAG;GACvF,MAAM,YAAY,MAAM,IAAI,KAAK;GAEjC,KADyB,IAAI,QAAQ,IAAI,wBAAwB,KAAK,IAAI,QAAQ,IAAI,qBAAqB,OAClF,UAAU,MACjC,MAAM,IAAIH,mBAAAA,uBAAuB,6HAA6H;GAEhK,MAAM,QAAQE,mBAAAA,WAAW,SAAS,SAAS;GAC3C,OAAOC,oBAAAA,OAAO,MAAM,KAAK;EAC3B;EAEA,OAAOA,oBAAAA,OAAO,GAAG,GAAG;CACtB;CAEA,MAAa,oBAAoB,SAAkE;EASjG,MAAM,IAAIH,mBAAAA,uBAAuB,OAAM,MARrB,KAAK,kBAAkB,0BAA0B;GACjE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,OAAO;EAC9B,GAAG,IAAI,EAAA,CAEoC,KAAK,CAAC;CACnD;CAEA,MAAM,wBACJ,OACA,aACyD;EACzD,MAAM,MAAM,MAAM,KAAK,oCACrB,kCACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU;IACnB;IACA,cAAc;GAChB,CAAC;EACH,GACA,MACA,CAACD,mBAAAA,YAAY,YAAY,CAC3B;EAEA,IAAI,IAAI,WAAW,SACjB,OAAOI,oBAAAA,OAAO,MAAM,IAAI,KAAK;OAE7B,OAAOA,oBAAAA,OAAO,GAAG,KAAA,CAAS;CAE9B;CAEA,MAAM,sBACJ,OACA,aACA,SAC0D;EAC1D,MAAM,MAAM,MAAM,KAAK,oCACrB,4CACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU;IACnB;IACA,cAAc;GAChB,CAAC;EACH,GACA,SACA,CAACJ,mBAAAA,YAAY,oBAAoB,CACnC;EAEA,IAAI,IAAI,WAAW,SACjB,OAAO,IAAI;CAEf;CAEA,MAAM,mBACJ,OACA,aACA,cACwJ;EACxJ,MAAM,MAAM,MAAM,KAAK,oCACrB,+BACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU;IACnB;IACA,cAAc;IACd,GAAG,6BAA6B,cAAc,oBAAoB;GACpE,CAAC;EACH,GACA,MACA,CAACA,mBAAAA,YAAY,2BAA2B,GAAG,uBAAuB,CACpE;EAEA,IAAI,IAAI,WAAW,SACjB,OAAOI,oBAAAA,OAAO,MAAM,IAAI,KAAK;OAE7B,OAAOA,oBAAAA,OAAO,GAAG,MAAM,IAAI,KAAK,KAAK,CAAC;CAE1C;CAEA,MAAM,cACJ,SACkE;EAClE,MAAM,MAAM,MAAM,KAAK,oCACrB,oBAAoB,UAAU,oCAAoC,wBAClE;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU;IACnB,MAAM,QAAQ;IACd,GAAI,cAAc,UAAU,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;GAChE,CAAC;EACH,GACA,MACA,CAACJ,mBAAAA,YAAY,qBAAqB,CACpC;EAEA,IAAI,IAAI,WAAW,SACjB,OAAOI,oBAAAA,OAAO,MAAM,IAAI,KAAK;OAE7B,OAAOA,oBAAAA,OAAO,GAAG,KAAA,CAAS;CAE9B;CAEA,MAAM,eACJ,SACA,SAC8G;EAC9G,MAAM,MAAM,MAAM,KAAK,oCACrB,yBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU;IACnB,cAAc,QAAQ;IACtB,cAAc,QAAQ;GACxB,CAAC;EACH,GACA,SACA,CAACJ,mBAAAA,YAAY,8BAA8BA,mBAAAA,YAAY,0BAA0B,CACnF;EAEA,IAAI,IAAI,WAAW,SACjB,OAAO,IAAI;CAEf;CAEA,MAAM,YACJ,SACA,SACgE;EAChE,MAAM,MAAM,MAAM,KAAK,oCACrB,sBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,OAAO;EAC9B,GACA,SACA,CAACA,mBAAAA,YAAY,0BAA0B,CACzC;EAEA,IAAI,IAAI,WAAW,SACjB,OAAO,IAAI;CAEf;CAEA,MAAM,wBAAwB,MAAgF;EAC5G,MAAM,MAAM,MAAM,KAAK,cAAc;GAAE;GAAM,gBAAgB;EAAK,CAAC;EACnE,IAAI,IAAI,WAAW,SACjB,OAAOI,oBAAAA,OAAO,MAAM,IAAI,KAAK;OAE7B,OAAOA,oBAAAA,OAAO,GAAG,KAAA,CAAS;CAE9B;CAEA,MAAM,YAAY,MAAgF;EAChG,MAAM,MAAM,MAAM,KAAK,oCACrB,4BACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,EACnB,KACF,CAAC;EACH,GACA,MACA,CAACJ,mBAAAA,YAAY,qBAAqB,CACpC;EAEA,IAAI,IAAI,WAAW,SACjB,OAAOI,oBAAAA,OAAO,MAAM,IAAI,KAAK;OAE7B,OAAOA,oBAAAA,OAAO,GAAG,KAAA,CAAS;CAE9B;CAEA,MAAM,4BACJ,SACA,SACwG;EACxG,MAAM,MAAM,MAAM,KAAK,oCACrB,+CACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,OAAO;EAC9B,GACA,SACA,CAAC,CACH;EAEA,IAAI,IAAI,WAAW,SACjB,OAAOA,oBAAAA,OAAO,MAAM,IAAI,KAAK;EAG/B,OAAOA,oBAAAA,OAAO,GAAG,MAAM,IAAI,KAAK,KAAK,CAAC;CACxC;CAEA,MAAM,gBACJ,SACA,SACsE;EACtE,MAAM,MAAM,MAAM,KAAK,oCACrB,0BACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,OAAO;EAC9B,GACA,SACA,CAACJ,mBAAAA,YAAY,yBAAyB,CACxC;EACA,IAAI,IAAI,WAAW,SACjB,OAAOI,oBAAAA,OAAO,MAAM,IAAI,KAAK;EAE/B,OAAOA,oBAAAA,OAAO,GAAG,KAAA,CAAS;CAC5B;CAEA,MAAM,8BACJ,SAEA,SACuG;EACvG,MAAM,MAAM,MAAM,KAAK,oCACrB,iDACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,OAAO;EAC9B,GACA,SACA,CAAC,CACH;EAEA,IAAI,IAAI,WAAW,SACjB,OAAOA,oBAAAA,OAAO,MAAM,IAAI,KAAK;EAG/B,OAAOA,oBAAAA,OAAO,GAAG,MAAM,IAAI,KAAK,KAAK,CAAC;CACxC;CAEA,MAAM,mBAAmB,SAKP;EAChB,MAAM,KAAK,kBACT,+BACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU;IACnB,OAAO,QAAQ;IACf,SAAS,QAAQ;IACjB,cAAc,QAAQ;GACxB,CAAC;EACH,GACA,QAAQ,OACV;CACF;CAEA,MAAM,qBAA4D,SAIsG;EACtK,MAAM,MAAM,MAAM,KAAK,oCACrB,QAAQ,SAAS,UACf,wCACA,QAAQ,SAAS,YACf,qCACA,4BACJ;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,EACnB,MAAM,QAAQ,KAChB,CAAC;EACH,GACA,QAAQ,SACR,CAACJ,mBAAAA,YAAY,uBAAuBA,mBAAAA,YAAY,2BAA2B,CAC7E;EAEA,IAAI,IAAI,WAAW,SACjB,OAAOI,oBAAAA,OAAO,MAAM,IAAI,KAAK;OAE7B,OAAOA,oBAAAA,OAAO,GAAG,MAAM,IAAI,KAAK,KAAK,CAAC;CAE1C;CAEA,MAAM,QACJ,aACA,MACA,SACA;EAaA,MAAM,SAAS,OAAM,MAZH,KAAK,kBAAkB,qBAAqB;GAC5D,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU;IACnB,MAAM;IACN,MAAM;IACA;GACR,CAAC;EACH,GAAG,OAAO,EAAA,CAEe,KAAK;EAC9B,OAAO;GACL,aAAa,OAAO;GACpB,cAAc,OAAO;GACrB,SAAS,OAAO;EAClB;CACF;CAEA,MAAM,qBACJ,OACA,UACA,SACsG;EACtG,MAAM,MAAM,MAAM,KAAK,oCACrB,0BACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU;IACnB;IACA;GACF,CAAC;EACH,GACA,SACA,CAACJ,mBAAAA,YAAY,qBAAqB,CACpC;EAEA,IAAI,IAAI,WAAW,SACjB,OAAOI,oBAAAA,OAAO,MAAM,IAAI,KAAK;EAG/B,MAAM,SAAS,MAAM,IAAI,KAAK,KAAK;EACnC,OAAOA,oBAAAA,OAAO,GAAG;GACf,aAAa,OAAO;GACpB,cAAc,OAAO;EACvB,CAAC;CACH;CAEA,MAAM,qBACJ,OACA,UACA,8BACA,SACA,cACiO;EACjO,MAAM,MAAM,MAAM,KAAK,oCACrB,0BACA;GACE,SAAS,EACP,gBAAgB,mBAClB;GACA,QAAQ;GACR,MAAM,KAAK,UAAU;IACnB;IACA;IACA,2BAA2B;IAC3B,GAAG,6BAA6B,cAAc,oBAAoB;GACpE,CAAC;EACH,GACA,SACA;GAACJ,mBAAAA,YAAY;GAA4BA,mBAAAA,YAAY;GAA4B,GAAG;EAAuB,CAC7G;EAEA,IAAI,IAAI,WAAW,SACjB,OAAOI,oBAAAA,OAAO,MAAM,IAAI,KAAK;EAG/B,MAAM,SAAS,MAAM,IAAI,KAAK,KAAK;EACnC,OAAOA,oBAAAA,OAAO,GAAG;GACf,aAAa,OAAO;GACpB,cAAc,OAAO;EACvB,CAAC;CACH;CAEA,MAAM,kBAAkB,SAAiG;EACvH,MAAM,MAAM,MAAM,KAAK,oCACrB,2BACA,EACE,QAAQ,OACV,GACA,SACA,CAAC,CACH;EAEA,IAAI,IAAI,WAAW,SACjB,OAAOA,oBAAAA,OAAO,MAAM,IAAI,KAAK;EAG/B,MAAM,SAAS,MAAM,IAAI,KAAK,KAAK;EACnC,OAAOA,oBAAAA,OAAO,GAAG;GACf,aAAa,OAAO;GACpB,cAAc,OAAO;EACvB,CAAC;CACH;CAEA,MAAM,oBAAoB,MAAc,SAAkJ;EACxL,MAAM,MAAM,MAAM,KAAK,oCACrB,qBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,EACnB,KACF,CAAC;EACH,GACA,SACA,CAACJ,mBAAAA,YAAY,qBAAqB,CACpC;EAEA,IAAI,IAAI,WAAW,SACjB,OAAOI,oBAAAA,OAAO,MAAM,IAAI,KAAK;EAG/B,MAAM,SAAS,MAAM,IAAI,KAAK,KAAK;EACnC,OAAOA,oBAAAA,OAAO,GAAG;GACf,aAAa,OAAO;GACpB,cAAc,OAAO;GACrB,SAAS,OAAO;EAClB,CAAC;CACH;CAEA,MAAM,cAAc,MAAc,MAAc,SAAkJ;EAChM,MAAM,MAAM,MAAM,KAAK,oCACrB,qBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU;IACnB,MAAM;IACN;IACA;GACF,CAAC;EACH,GACA,SACA,CAACJ,mBAAAA,YAAY,qBAAqB,CACpC;EAEA,IAAI,IAAI,WAAW,SACjB,OAAOI,oBAAAA,OAAO,MAAM,IAAI,KAAK;EAG/B,MAAM,SAAS,MAAM,IAAI,KAAK,KAAK;EACnC,OAAOA,oBAAAA,OAAO,GAAG;GACf,aAAa,OAAO;GACpB,cAAc,OAAO;GACrB,SAAS,OAAO;EAClB,CAAC;CACH;CAEA,MAAM,kBAAkB,MAA6E,SAAqI;EACxO,MAAM,MAAM,MAAM,KAAK,oCACrB,yBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,IAAI;EAC3B,GACA,SACA,CAACJ,mBAAAA,YAAY,2BAA2B,CAC1C;EAEA,IAAI,IAAI,WAAW,SACjB,OAAOI,oBAAAA,OAAO,MAAM,IAAI,KAAK;EAG/B,MAAM,SAAS,MAAM,IAAI,KAAK,KAAK;EACnC,OAAOA,oBAAAA,OAAO,GAAG;GACf,aAAa,OAAO;GACpB,cAAc,OAAO;EACvB,CAAC;CACH;CAEA,MAAM,YACJ,SAYiB;EACjB,MAAM,qBAAqB,IAAI,IAAI,QAAQ,WAAW;EACtD,KAAK,MAAM,OAAO,CAAC,QAAQ,OAAO,GAAG;GACnC,IAAI,mBAAmB,aAAa,IAAI,GAAG,GACzC,QAAQ,KAAK,mCAAmC,MAAM,yEAAyE;GAEjI,mBAAmB,aAAa,OAAO,GAAG;EAC5C;EAEA,IAAI,yBAAyB,KAAK,SAEhC,MAAM,IAAI,MAAM,0DAA0D;EAE5E,MAAM,eAAe,KAAK,QAAQ,wBAAwBC,kBAAAA;EAC1D,MAAM,MAAM,IAAI,IAAI,KAAK,cAAc,IAAI,2BAA2B,QAAQ,SAAS,YAAY,CAAC;EACpG,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS;EAChD,IAAI,aAAa,IAAI,iBAAiB,YAAY;EAClD,IAAI,aAAa,IAAI,gBAAgB,mBAAmB,SAAS,CAAC;EAClE,IAAI,aAAa,IAAI,SAAS,QAAQ;EACtC,IAAI,aAAa,IAAI,SAAS,QAAQ,KAAK;EAC3C,IAAI,aAAa,IAAI,cAAc,oBAAoB;EACvD,IAAI,aAAa,IAAI,kBAAkB,QAAQ,aAAa;EAC5D,IAAI,aAAa,IAAI,yBAAyB,MAAM;EACpD,IAAI,aAAa,IAAI,iBAAiB,MAAM;EAC5C,IAAI,aAAa,IAAI,QAAQ,QAAQ,IAAI;EACzC,IAAI,aAAa,IAAI,sBAAsB,QAAQ,gBAAgB;EAInE,MAAM,SAAS,MAAM,QAAQ,QAAQ,4BAA4B,MAAQ,GAAM;EAC/E,IAAI,QACF,IAAI,aAAa,IAAI,SAAS,OAAO,YAAY,KAAK;EAGxD,IAAI,QAAQ,0BACV,IAAI,aAAa,IAAI,+BAA+B,QAAQ,wBAAwB;EAEtF,IAAI,QAAQ,eACV,IAAI,aAAa,IAAI,kBAAkB,QAAQ,aAAa;EAE9D,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,6BAA6B,QAAQ,cAAc,SAAS,QAAQ,MAAM,CAAC,GACnH,IAAI,aAAa,IAAI,KAAK,KAAK;EAGjC,OAAO,IAAI,SAAS;CACtB;CAEA,MAAM,eAAe,SAWgF;EACnG,IAAI,OAAO,WAAW,aACpB,MAAM,IAAIJ,mBAAAA,uBAAuB,sEAAsE;EAGzG,MAAM,KAAK,QAAQ,iBAAiB;EAEpC,MAAM,MAAM,IAAI,IAAI,MAAM,KAAK,YAAY,OAAO,CAAC;EAKnD,IAAI,aAAa,IAAI,0BAA0B,MAAM;EACrD,IAAI,aAAa,IAAI,uBAAuB,MAAM;EAElD,IAAI;EACJ,IAAI;GACF,SAAS,MAAM,MAAM,KAAK,EACxB,QAAQ,MACV,CAAC;EACH,SAAS,OAAO;GACd,IAAI,iBAAiB,WACnB,MAAM,MAAM,KAAK,oBAAoB,OAAO,QAAQ,SAAS,QAAQ;GAEvE,MAAM;EACR;EAEA,MAAM,oBAAoB,MAAM,KAAK,iBAAiB,MAAM;EAC5D,IAAI,kBAAkB,WAAW,SAAS;GACxC,IAAI,yBAAyB,kBAAkB,KAAK,GAClD,OAAOG,oBAAAA,OAAO,MAAM,kBAAkB,KAAK;GAE7C,MAAM,kBAAkB;EAC1B;EAEA,IAAI,kBAAkB,KAAK,WAAW,KACpC,MAAM,IAAIH,mBAAAA,uBAAuB,kDAAkD,kBAAkB,KAAK,QAAQ;EAGpH,MAAM,OAAO,MAAM,kBAAkB,KAAK,KAAK;EAC/C,IAAI,QAAQ,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,GAChE,MAAM,IAAIA,mBAAAA,uBAAuB,mDAAmD,EAAE,KAAK,CAAC;EAG9F,MAAM,WAAW,KAAK;EACtB,IAAI,OAAO,aAAa,UACtB,MAAM,IAAIA,mBAAAA,uBAAuB,2DAA2D,EAAE,KAAK,CAAC;EAGtG,OAAOG,oBAAAA,OAAO,GAAG,QAAQ;CAC3B;CAEA,MAAM,kBAAkB,SAKwF;EAC9G,IAAI,yBAAyB,KAAK,SAEhC,MAAM,IAAI,MAAM,0DAA0D;EAG5E,MAAM,eAAe,KAAK,QAAQ,wBAAwBC,kBAAAA;EAC1D,OAAO,MAAM,KAAK,cAAc,OAAO,WAAW;GAChD,OAAO,MAAM,KAAK,wBAAwB,SAAS,cAAc,MAAM;EACzE,CAAC;CACH;CAEA,MAAc,wBAAwB,SAKnC,cAAsB,QAA6H;EACpJ,MAAM,gBAAgB,SAAS;EAC/B,MAAM,KAAK;GACT,QAAQ,KAAK,QAAQ,WAAW;GAChC,WAAW;GACX,gBAAgB;EAClB;EACA,MAAM,SAAuB;GAC3B,WAAW,KAAK;GAChB,eAAe;EACjB;EACA,MAAM,uBAAuBC,iBAAuB,YAAY;EAGhE,MAAM,gBAAgB,cAAc,WAAW,SAAS;EAExD,IAAI;EACJ,IAAI;GACF,SAASQ,qBAA2B,IAAI,QAAQ,QAAQ,aAAa,QAAQ,KAAK;EACpF,SAAS,GAAG;GACV,IAAI,aAAaC,4BACf,MAAM,IAAId,mBAAAA,uBAAuB,qEAAqE;IAEpG,OAAO,OAAO,YAAY,EAAE,KAAK;IACjC,MAAM,EAAE;IACR,OAAO,EAAE;GACX,CAAC;GAEH,MAAM,IAAIA,mBAAAA,uBAAuB,yDAAyD,EAAE,OAAO,EAAE,CAAC;EACxG;EACA,MAAM,WAAW,MAAMe,8BACrB,IACA,QACA,sBACA,QACA,QAAQ,aACR,QAAQ,cACR,gBAAgB,GAAGR,wBAA8B,KAAK,IAAI,KAAA,CAC5D;EAEA,IAAI;EACJ,IAAI;GACF,SAAS,MAAMS,iCAAuC,IAAI,QAAQ,QAAQ;EAC5E,SAAS,GAAG;GACV,IAAI,aAAaP,mBAAyB;IACxC,IAAK,EAAE,MAAc,SAAS,wCAC5B,MAAM,IAAIV,mBAAAA,YAAY,kCAAmC,EAAE,MAAc,QAAQ,YAAY;IAG/F,MAAM,IAAIC,mBAAAA,uBAAuB,wDAAwD;KACvF,OAAO,EAAE;KACT,MAAM,EAAE;KACR,OAAO,EAAE;IACX,CAAC;GACH;GACA,MAAM,IAAIA,mBAAAA,uBAAuB,gEAAgE,EAAE,OAAO,EAAE,CAAC;EAC/G;EACA,OAAO;GACL,SAAS,OAAO;GAChB,0BAA0B,OAAO;GACjC,aAAa,OAAO;GACpB,cAAc,OAAO,kBAAA,GAAA,mBAAA,SAAA,CAA0B,iDAAiD;EAClG;CACF;CAEA,MAAM,QAAQ,SAAyC;EAErD,IAAI,MADmB,QAAQ,4BAA4B,KAAQ,IAAI,GACzD;GACZ,MAAM,aAAa,MAAM,KAAK,oCAC5B,0BACA;IACE,QAAQ;IACR,SAAS,EACP,gBAAgB,mBAClB;IACA,MAAM,KAAK,UAAU,CAAC,CAAC;GACzB,GACA,SACA,CAACD,mBAAAA,YAAY,iBAAiB,CAChC;GACA,IAAI,WAAW,WAAW,SACxB,IAAIA,mBAAAA,YAAY,kBAAkB,WAAW,WAAW,KAAK,GAAG,CAEhE,OAEE,MAAM,IAAIC,mBAAAA,uBAAuB,oBAAoB,EAAE,OAAO,WAAW,MAAM,CAAC;EAKtF;EACA,QAAQ,YAAY;CACtB;CAEA,MAAM,qBAAqB,SAA6E;EACtG,MAAM,kBAAkB,MAAM,KAAK,oCACjC,aACA,CAAC,GACD,SACA,CAACD,mBAAAA,YAAY,2BAA2B,CAC1C;EACA,IAAI,gBAAgB,WAAW,SAC7B,IAAIA,mBAAAA,YAAY,4BAA4B,WAAW,gBAAgB,KAAK,GAC1E,OAAO;OAEP,MAAM,IAAIC,mBAAAA,uBAAuB,6BAA6B,EAAE,OAAO,gBAAgB,MAAM,CAAC;EAIlG,MAAM,OAA0C,MAD/B,gBAAgB,KAC8B,KAAK;EACpE,IAAI,CAAE,MAAc,MAAM,IAAIA,mBAAAA,uBAAuB,uDAAuD;EAC5G,OAAO;CACT;CAEA,MAAM,oBACJ,SAGA,SACiD;EAOjD,QAAO,OADc,MALE,KAAK,kBAC1B,uBAAuB,IAAI,gBAAgB,EAAE,SAAS,QAAQ,OAAO,CAAC,GACtE,CAAC,GACD,OACF,EAAA,CAC8B,KAAK,EAAA,CACrB;CAChB;CAEA,MAAM,+BACJ,SACiD;EAOjD,QAAO,OADc,MALE,KAAK,kBAC1B,uBAAuB,IAAI,gBAAgB,EAAE,SAAS,KAAK,CAAC,GAC5D,CAAC,GACD,OACF,EAAA,CAC8B,KAAK,EAAA,CACrB;CAChB;CAEA,MAAM,yBACJ,cACA,SACA;EACA,MAAM,KAAK,kBACT,iBAAA,SAAS,qBAAqB,aAAa,WAAW,MAAM,IAAI,gBAAgB,EAAE,SAAS,KAAK,CAAC,GACjG,EAAE,QAAQ,OAAO,GACjB,OACF;CACF;CAEA,MAAM,qBACJ,cACA,QACA,SACA;EACA,MAAM,KAAK,kBACT,qBAAqB,aAAa,WAAW,UAC7C,EAAE,QAAQ,SAAS,GACnB,OACF;CACF;CAEA,MAAM,uBACJ,SAIA,SACqD;EAUrD,QAAO,OADc,MARE,KAAK,kBAC1B,2BAA2B,IAAI,iBAAA,GAAA,oBAAA,gBAAA,CAAgC;GAC7D,SAAS,QAAQ;GACjB,SAAS,QAAQ;EACnB,CAAC,CAAC,GACF,CAAC,GACD,OACF,EAAA,CAC8B,KAAK,EAAA,CACrB;CAChB;CAEA,MAAM,qBACJ,SAIA,SACmD;EAMnD,OAAO,OAAM,MALU,KAAK,kBAC1B,yBAAyB,QAAQ,OAAO,GAAG,QAAQ,UACnD,CAAC,GACD,OACF,EAAA,CACsB,KAAK;CAC7B;CAEA,MAAM,UACJ,QACA,SACA;EACA,MAAM,KAAK,kBACT,qBAAqB,OAAO,MAC5B;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,CAAC,CAAC;EACzB,GACA,OACF;CACF;CAEA,MAAM,wBACJ,SAKA,SACA;EACA,MAAM,KAAK,kBACT,yBAAyB,QAAQ,OAAO,GAAG,QAAQ,UACnD;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,QAAQ,OAAO;EACtC,GACA,OACF;CACF;CAEA,MAAM,WACJ,SAIA,SACA;EACA,MAAM,KAAK,kBACT,UAAU,QAAQ,UAClB;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,QAAQ,IAAI;EACnC,GACA,OACF;CACF;CAEA,MAAM,+BACJ,SAIA,SACkD;EAOlD,QAAO,OADc,MALE,KAAK,kBAC1B,6BAA6B,QAAQ,OAAO,wBAAwB,QAAQ,aAC5E,CAAC,GACD,OACF,EAAA,CAC8B,KAAK,EAAA,CACrB;CAChB;CAEA,MAAM,kCACJ,SAGA,SACqD;EAOrD,QAAO,OADc,MALE,KAAK,kBAC1B,6CAA6C,QAAQ,aACrD,CAAC,GACD,OACF,EAAA,CAC8B,KAAK,EAAA,CACrB;CAChB;CAEA,MAAM,qBAAqB,SAAkE;EAO3F,QAAO,OADc,MALE,KAAK,kBAC1B,qBACA,CAAC,GACD,OACF,EAAA,CAC8B,KAAK,EAAA,CACrB;CAChB;CAEA,MAAM,mBAA0G;EAC9G,MAAM,kBAAkB,MAAM,KAAK,oCAAoC,qBAAqB,CAAC,GAAG,MAAM,CAACD,mBAAAA,YAAY,eAAe,CAAC;EACnI,IAAI,gBAAgB,WAAW,SAC7B,OAAOI,oBAAAA,OAAO,MAAM,gBAAgB,KAAK;EAG3C,MAAM,UAAgD,MADrC,gBAAgB,KACoC,KAAK;EAC1E,OAAOA,oBAAAA,OAAO,GAAG,OAAO;CAC1B;CAEA,MAAM,iBAAiB,QAA6C,SAA0B;EAC5F,MAAM,KAAK,kBACT,aACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,MAAM;EAC7B,GACA,OACF;CACF;CAEA,MAAM,aAAa,SAA8E;EAC/F,MAAM,WAAW,MAAM,KAAK,kBAAkB,sBAAsB,CAAC,GAAG,OAAO;EAC/E,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,8BAA8B,SAAS,SAAS,MAAO,MAAM,SAAS,KAAK,CAAE;EAI/F,QAAO,MADY,SAAS,KAAK,EAAA,CACrB;CACd;CAEA,MAAM,cACJ,SACA,SACkD;EAClD,MAAM,gBAAgB,MAAM,KAAK,kBAC/B,sBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,OAAO;EAC9B,GACA,OACF;EACA,IAAI,CAAC,cAAc,IACjB,MAAM,IAAI,MAAM,+BAA+B,cAAc,SAAS,MAAO,MAAM,cAAc,KAAK,CAAE;EAI1G,OAAO,MADY,cAAc,KAAK;CAExC;CAEA,MAAM,0BACJ,UACA,OACA,SAC4D;EAY5D,OAAO,OAAM,MAXU,KAAK,kBAC1B,0BAA0B,SAAS,gBACnC;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;EAChC,GACA,OACF,EAAA,CACsB,KAAK;CAC7B;;;;;CAMA,MAAM,mCACJ,YACA,mBACA,OACA,SAC4D;EAY5D,OAAO,OAAM,MAXU,KAAK,kBAC1B,0BAA0B,mBAAmB,UAAU,EAAE,GAAG,mBAAmB,iBAAiB,EAAE,gBAClG;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;EAChC,GACA,OACF,EAAA,CACsB,KAAK;CAC7B;;;;CAKA,MAAM,sBACJ,SACiD;EAMjD,OAAO,OAAM,MALU,KAAK,kBAC1B,0BACA,EAAE,QAAQ,MAAM,GAChB,OACF,EAAA,CACsB,KAAK;CAC7B;CAEA,MAAM,iBACJ,MACA,SACsC;EAYtC,OAAO,OAAM,MAXU,KAAK,kBAC1B,UACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,IAAI;EAC3B,GACA,OACF,EAAA,CACsB,KAAK;CAC7B;CAEA,MAAM,WACJ,QACA,SACA;EACA,MAAM,KAAK,kBACT,UAAU,UACV,EACE,QAAQ,SACV,GACA,OACF;CACF;CAEA,MAAM,kBAAkB,SAA0B;EAChD,MAAM,KAAK,kBACT,aACA,EACE,QAAQ,SACV,GACA,OACF;CACF;CAEA,MAAM,2BACJ,MACA,SACgD;EAYhD,OAAO,OAAM,MAXU,KAAK,kBAC1B,qBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,IAAI;EAC3B,GACA,OACF,EAAA,CACsB,KAAK;CAC7B;CAEA,MAAM,2BACJ,IACA,MACA,SACgD;EAYhD,OAAO,OAAM,MAXU,KAAK,kBAC1B,wBAAwB,MACxB;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,IAAI;EAC3B,GACA,OACF,EAAA,CACsB,KAAK;CAC7B;CAEA,MAAM,2BACJ,IACA,SACe;EACf,MAAM,KAAK,kBACT,wBAAwB,MACxB,EACE,QAAQ,SACV,GACA,OACF;CACF;CAEA,MAAM,cACJ,WACA,SACe;EACf,MAAM,KAAK,kBACT,kBAAkB,UAAU,cAC5B,EACE,QAAQ,SACV,GACA,OACF;CACF;CAEA,MAAM,aACJ,SACyC;EAQzC,OAAO,OAAM,MAPU,KAAK,kBAC1B,6BACA,EACE,QAAQ,MACV,GACA,OACF,EAAA,CACsB,KAAK;CAC7B;CAGA,MAAM,0BACJ,SACkD;EASlD,QAAO,OADY,MAPI,KAAK,kBAC1B,gCACA,EACE,QAAQ,MACV,GACA,OACF,EAAA,CAC4B,KAAK,EAAA,CACrB;CACd;CAEA,MAAM,+CACJ,kBACA,aACA,SACiE;EACjE,MAAM,kBAAkB,MAAM,KAAK,oCACjC,wBAAwB,iBAAiB,0BACzC;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,EAAE,cAAc,YAAY,CAAC;EACpD,GACA,SACA,CAACJ,mBAAAA,YAAY,oBAAoB,CACnC;EAEA,IAAI,gBAAgB,WAAW,SAC7B,OAAOI,oBAAAA,OAAO,MAAM,gBAAgB,KAAK;EAE3C,OAAOA,oBAAAA,OAAO,GAAG,KAAA,CAAS;CAC5B;CAEA,MAAM,SACJ,WACA,cACA,SACwD;EACxD,MAAM,kBAAkB,MAAM,KAAK,oCACjC,sBACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU;IACnB,YAAY;IACZ,eAAe;GACjB,CAAC;EACH,GACA,SACA,CAACJ,mBAAAA,YAAY,WAAW,CAC1B;EAEA,IAAI,gBAAgB,WAAW,SAC7B,OAAOI,oBAAAA,OAAO,MAAM,gBAAgB,KAAK;EAE3C,OAAOA,oBAAAA,OAAO,GAAG,KAAA,CAAS;CAC5B;CAEA,MAAc,sBAAsB,SAA2D;EAC7F,IAAI,aAAa,WAAW,aAAa,SACvC,MAAM,IAAIH,mBAAAA,uBAAuB,kEAAkE;EAGrG,OAAO;GACL,UAAU,aAAa,UAAU,mBAAmB;GACpD,aAAa,IAAI,iBAAA,GAAA,oBAAA,sBAAA,CAAsC,OAAO,CAAC;EACjE;CACF;CAMA,MAAM,mBACJ,SACA,SACA,aACoF;EACpF,MAAM,eAAe,gBAAgB,WAAW,KAAK,oBAAqB,KAAa,kBAAA,CAA4B,KAAK,IAAI;EAC5H,MAAM,EAAE,UAAU,gBAAgB,MAAM,KAAK,sBAAsB,OAAO;EAW1E,QAAO,OADY,MARI,YACrB,GAAG,SAAS,GAAG,YAAY,SAAS,KACpC,EACE,QAAQ,MACV,GACA,SACA,WACF,EAAA,CAC4B,KAAK,EAAA,CACrB;CACd;CAKA,MAAM,oBACJ,MACA,SACA,aACoH;EACpH,MAAM,eAAe,gBAAgB,WAAW,KAAK,oBAAqB,KAAa,kBAAA,CAA4B,KAAK,IAAI;EAC5H,MAAM,EAAE,aAAa,MAAM,KAAK,sBAAsB,IAAI;EAc1D,OAAO,OAAM,MAZU,YACrB,GAAG,YACH;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,IAAI;EAC3B,GACA,SACA,WACF,EAAA,CACsB,KAAK;CAC7B;CAKA,MAAM,iBACJ,SACA,OACA,SACA,aACgF;EAChF,MAAM,eAAe,gBAAgB,WAAW,KAAK,oBAAqB,KAAa,kBAAA,CAA4B,KAAK,IAAI;EAC5H,MAAM,EAAE,UAAU,gBAAgB,MAAM,KAAK,sBAAsB,OAAO;EAU1E,OAAO,OAAM,MARU,YACrB,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,SAAS,KAC7C,EACE,QAAQ,MACV,GACA,SACA,WACF,EAAA,CACsB,KAAK;CAC7B;CAKA,MAAM,oBACJ,SACA,OACA,MACA,SACA,aACgF;EAChF,MAAM,eAAe,gBAAgB,WAAW,KAAK,oBAAqB,KAAa,kBAAA,CAA4B,KAAK,IAAI;EAC5H,MAAM,EAAE,UAAU,gBAAgB,MAAM,KAAK,sBAAsB,OAAO;EAc1E,OAAO,OAAM,MAZU,YACrB,GAAG,SAAS,GAAG,MAAM,GAAG,YAAY,SAAS,KAC7C;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,IAAI;EAC3B,GACA,SACA,WACF,EAAA,CACsB,KAAK;CAC7B;CAKA,MAAM,mBAAmB,MAAuB,QAAgB,SAAiC,aAAmI;EAElO,MAAM,SAAS,OADM,gBAAgB,WAAW,KAAK,sCAAuC,KAAa,oCAAA,CAA8C,KAAK,IAC7H,CAAC,CAC9B,IAAI,KAAK,kBACT;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,EAAE,SAAS,OAAO,CAAC;EAC1C,GACA,SACA,CAACD,mBAAAA,YAAY,cAAc,CAC7B;EACA,IAAI,OAAO,WAAW,SACpB,OAAO;EAET,OAAO,MAAM,OAAO,KAAK,KAAK;CAChC;CAEA,MAAM,2BACJ,SACyD;EAOzD,QAAO,OADc,MALE,KAAK,kBAC1B,sCACA,CAAC,GACD,OACF,EAAA,CAC8B,KAAK,EAAA,CACrB;CAChB;CAEA,MAAM,wBACJ,wBACA,SACA,SACe;EACf,MAAM,KAAK,kBACT,sCAAsC,0BACtC;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,EACnB,QACF,CAAC;EACH,GACA,OACF;CACF;CAEA,MAAM,iBACJ,QACA,YACA,SAC8C;EAQ9C,OAAO,OAAM,MAPU,KAAK,kBAC1B,oBAAoB,OAAO,GAAG,cAC9B,EACE,QAAQ,MACV,GACA,OACF,EAAA,CACsB,KAAK;CAC7B;CAEA,MAAM,oBACJ,QACA,YACA,MACA,SAC8C;EAY9C,OAAO,OAAM,MAXU,KAAK,kBAC1B,oBAAoB,OAAO,GAAG,cAC9B;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,IAAI;EAC3B,GACA,OACF,EAAA,CACsB,KAAK;CAC7B;CAEA,MAAM,mBACJ,UAEI,CAAC,GACL,SACgD;EAChD,MAAM,cAAc,IAAI,iBAAA,GAAA,oBAAA,gBAAA,CAAgC,OAAO,CAAC;EAShE,QAAO,OADc,MAPE,KAAK,kBAC1B,mBAAmB,YAAY,SAAS,IAAI,IAAI,YAAY,SAAS,MAAM,MAC3E,EACE,QAAQ,MACV,GACA,OACF,EAAA,CAC8B,KAAK,EAAA,CACrB;CAChB;CAEA,MAAM,oBACJ,QACA,YACA,SACe;EAQf,OAAO,OAAM,MAPU,KAAK,kBAC1B,oBAAoB,OAAO,GAAG,cAC9B,EACE,QAAQ,SACV,GACA,OACF,EAAA,CACsB,KAAK;CAC7B;CAEA,MAAM,QACJ,SAKA,SACA,cAA6C,UACR;EACrC,IAAI;EACJ,IAAI;EACJ,IAAI,YAAY,SAAS;GACvB,eAAe;GACf,aAAa,QAAQ;EACvB,OAAO,IAAI,YAAY,SAAS;GAC9B,eAAe;GACf,aAAa,QAAQ;EACvB,OAAO,IAAI,sBAAsB,SAAS;GACxC,eAAe;GACf,aAAa,QAAQ;EACvB,OACE,MAAM,IAAIC,mBAAAA,uBAAuB,6DAA6D;EAUhG,OAAO,OAAM,OAPQ,gBAAgB,WAAW,KAAK,oBAAqB,KAAa,kBAAA,CAA4B,KAAK,IACvF,CAAC,CAChC,iBAAA,SAAS,mBAAmB,aAAa,GAAG,WAAW,GAAG,QAAQ,UAClE,CAAC,GACD,SACA,WACF,EAAA,CACsB,KAAK;CAC7B;CAEA,MAAM,aACJ,SACA,SACA,cAA6C,UACN;EACvC,MAAM,cAAc,IAAI,iBAAA,GAAA,oBAAA,gBAAA,CAAgC;GACtD,QAAQ,QAAQ;GAChB,OAAO,QAAQ,UAAU,KAAA,IAAY,QAAQ,MAAM,SAAS,IAAI,KAAA;EAClE,CAAC,CAAC;EACF,MAAM,OAAO,iBAAA,SAAS,sBAAsB,QAAQ,cAAc,GAAG,QAAQ;EAQ7E,OAAO,OAAM,OAPQ,gBAAgB,WAAW,KAAK,oBAAqB,KAAa,kBAAA,CAA4B,KAAK,IACvF,CAAC,CAChC,GAAG,OAAO,YAAY,SAAS,IAAI,IAAI,YAAY,SAAS,MAAM,MAClE,CAAC,GACD,SACA,WACF,EAAA,CACsB,KAAK;CAC7B;CAEA,MAAM,aACJ,SACA,SACuC;EACvC,MAAM,cAAc,IAAI,iBAAA,GAAA,oBAAA,gBAAA,CAAgC;GACtD,QAAQ,QAAQ;GAChB,OAAO,QAAQ,UAAU,KAAA,IAAY,QAAQ,MAAM,SAAS,IAAI,KAAA;EAClE,CAAC,CAAC;EACF,MAAM,OAAO,iBAAA,SAAS,sBAAsB,QAAQ,cAAc,GAAG,QAAQ;EAM7E,OAAO,OAAM,MALU,KAAK,kBAC1B,GAAG,OAAO,YAAY,SAAS,IAAI,IAAI,YAAY,SAAS,MAAM,MAClE,CAAC,GACD,OACF,EAAA,CACsB,KAAK;CAC7B;CAEA,MAAM,mBACJ,SAMA,SACe;EACf,MAAM,cAAc,IAAI,iBAAA,GAAA,oBAAA,gBAAA,CAAgC,EACtD,iBAAiB,QAAQ,gBAC3B,CAAC,CAAC;EACF,MAAM,OAAO,iBAAA,SAAS,sBAAsB,QAAQ,cAAc,GAAG,QAAQ,YAAY,GAAG,QAAQ;EACpG,MAAM,KAAK,kBACT,GAAG,OAAO,YAAY,SAAS,IAAI,IAAI,YAAY,SAAS,MAAM,MAClE,EACE,QAAQ,SACV,GACA,OACF;CACF;CAEA,MAAM,mBACJ,SAQA,SACe;EACf,MAAM,KAAK,kBACT,iBAAA,SAAS,sBAAsB,QAAQ,cAAc,GAAG,QAAQ,YAAY,UAC5E;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU;IACnB,iBAAiB,QAAQ;IACzB,eAAe,QAAQ;IACvB,UAAU,QAAQ;IAClB,UAAU,QAAQ;GACpB,CAAC;EACH,GACA,OACF;CACF;CAEA,MAAM,kBACJ,eACA,aACA,mBACA,SACA,WACA,cAA6C,UAC5B;EACjB,MAAM,cAAc,OAAO,sBAAsB,WAC/C,EAAE,YAAY,kBAAkB,IAChC,EAAE,gBAAgB,kBAAkB;EActC,MAAM,EAAE,QAAQ,OAAM,OAbD,gBAAgB,WAAW,KAAK,oBAAqB,KAAa,kBAAA,CAA4B,KAAK,IACvF,CAAC,CAChC,2CACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU;IAAE;IAAe;IAAa,GAAG;IAAa,YAAY;GAAU,CAAC;EAC5F,GACA,SACA,WACF,EAAA,CAC+B,KAAK;EACpC,OAAO;CACT;CAEA,MAAM,mBACJ,cACA,YACA,SAUC;EAMD,OAAO,OAAM,MALU,KAAK,kBAC1B,iBAAA,SAAS,qBAAqB,aAAa,GAAG,cAC9C,CAAC,GACD,OACF,EAAA,CACsB,KAAK;CAC7B;CAEA,MAAM,uCACJ,cACA,YACA,SAIC;EAYD,OAAO,OAAM,MAXU,KAAK,kBAC1B,iBAAA,SAAS,4BAA4B,aAAa,GAAG,WAAW,gBAChE;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,CAAC,CAAC;EACzB,GACA,OACF,EAAA,CACsB,KAAK;CAC7B;CAEA,MAAM,+CACJ,cACA,YACA,eACA,SASC;EAcD,OAAO,OAAM,MAbU,KAAK,kBAC1B,iBAAA,SAAS,4BAA4B,aAAa,GAAG,WAAW,eAChE;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU,EACnB,iBAAiB,cACnB,CAAC;EACH,GACA,OACF,EAAA,CACsB,KAAK;CAC7B;CAEA,MAAM,gBAAgB,wBAAyC,qBAA6B,WAAkC;EAC5H,IAAI,KAAK,QAAQ,cAAc,YAC7B,MAAM,IAAIA,mBAAAA,uBAAuB,sIAAsI;EAEzK,MAAM,KAAK,kBACT,+BACA;GACE,QAAQ;GACR,SAAS,EACP,gBAAgB,mBAClB;GACA,MAAM,KAAK,UAAU;IACnB,YAAY;IACZ,aAAa;GACf,CAAC;EACH,GACA,sBACF;CACF;AACF"}