npm - @hyper.authio/server - Versions diffs - 0.10.0 → 0.10.1 - Mend

@hyper.authio/server 0.10.0 → 0.10.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/index.d.ts CHANGED Viewed

@@ -349,7 +349,7 @@ declare function toProblemDetails(error: AuthioBearerError | AuthioForbiddenErro
  * - `activeCheck`: validated locally, then confirmed active by introspection (cached per `jti`). The caller is read
  *   from the token, and the introspection answer adds the claims the token does not carry: the answer has every claim
  *   of the complete token, so a lightweight access token's roles and permissions are read too. A claim the token
- *   carries keeps the token's value, which its signature vouches for (the answer names a single `aud`).
+ *   carries keeps the token's value, which its signature vouches for, whatever the answer says.
  * - `introspectionOnly`: introspection alone, for opaque (reference) tokens, or encrypted ones without the key. The
  *   caller is read from the answer.
  */

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/user.ts","../src/rules.ts","../src/errors.ts","../src/resource-metadata.ts","../src/verifier.ts","../src/webhooks.ts","../src/downstream.ts"],"names":["seconds","AuthioConfigurationError","systemClock","until","AuthioDefaults","AuthioError","token"],"mappings":";;;;AAiCA,IAAM,mCAAmB,IAAI,GAAA,CAAI,CAAC,QAAA,EAAU,SAAS,CAAC,CAAA;AAuB/C,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA;AAAA,EAEb,OAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA;AAAA;AAAA,EAEA,YAAA;AAAA;AAAA,EAEA,cAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,aAAA;AAAA;AAAA,EAEA,eAAA;AAAA;AAAA,EAEA,gBAAA;AAAA;AAAA,EAEA,YAAA;AAAA;AAAA,EAEA,YAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEA,UAAA;AAAA;AAAA,EAEA,QAAA;AAAA;AAAA,EAEA,QAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEA,OAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEA,MAAA;AAAA;AAAA,EAEA,cAAA;AAAA;AAAA,EAEA,KAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA,EAEA,MAAA;AAAA;AAAA,EAEA,cAAA;AAAA;AAAA,EAEA,iBAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEA,GAAA;AAAA;AAAA,EAEA,mBAAA;AAAA;AAAA,EAEA,qBAAA;AAAA;AAAA,EAEA,gBAAA;AAAA;AAAA,EAEA,eAAA;AAAA;AAAA,EAEA,KAAA;AAAA;AAAA,EAEA,YAAA;AAAA,EACA,KAAA;AAAA,EACA,aAAA;AAAA,EACA,IAAA;AAAA,EACA,iBAAA;AAAA;AAAA,EAEA,cAAA;AAAA;AAAA,EAEA,YAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAA;AAAA,EAIQ,SAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUjB,YACE,MAAA,EACA,QAAA,GAAoC,EAAC,EACrC,KAAA,EACA,SAAoC,OAAA,EACpC;AACA,IAAA,MAAM,IAAA,GAAO,CAAC,IAAA,KAAkB,OAAO,MAAA,CAAO,IAAI,CAAA,KAAM,QAAA,IAAY,MAAA,CAAO,IAAI,CAAA,GAAK,MAAA,CAAO,IAAI,CAAA,GAAe,MAAA;AAE9G,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,QAAQ,CAAA;AACzC,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,gBAAA,CAAiB,OAAO,CAAA,IAAK,EAAA;AACjD,IAAA,IAAA,CAAK,WAAW,IAAA,CAAK,gBAAA,CAAiB,QAAQ,CAAA,IAAK,IAAA,CAAK,iBAAiB,eAAe,CAAA;AACxF,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,gBAAA,CAAiB,SAAS,CAAA;AAChD,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,gBAAA,CAAiB,KAAK,CAAA;AAC1C,IAAA,IAAA,CAAK,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,OAAO,gBAAA,CAAiB,QAAQ,CAAC,CAAC,CAAC,CAAA;AACpF,IAAA,IAAA,CAAK,MAAA,GAAS,OAAO,MAAA,CAAO,QAAA,CAAS,SAAS,MAAA,CAAO,gBAAA,CAAiB,KAAK,CAAC,CAAA,CAAE,QAAQ,CAAC,KAAA,KAAU,MAAM,KAAA,CAAM,KAAK,CAAC,CAAA,CAAE,MAAA,CAAO,OAAO,CAAC,CAAC,CAAA;AACrI,IAAA,IAAA,CAAK,cAAA,GAAiB,oBAAoB,MAAM,CAAA;AAChD,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,MAAA,CAAA,CAAQ,QAAA,CAAS,UAAA,IAAc,CAAC,MAAM,CAAA,EAAG,OAAA,CAAQ,CAAC,SAAS,QAAA,CAAS,MAAA,CAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAC1G,IAAA,IAAA,CAAK,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,oBAAA,CAAqB,CAAC,GAAG,IAAA,CAAK,cAAA,CAAe,KAAA,EAAO,GAAG,IAAA,CAAK,SAAS,CAAC,CAAC,CAAA;AAClG,IAAA,IAAA,CAAK,WAAA,GAAc,KAAK,cAAA,CAAe,WAAA;AACvC,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA,CAAO,UAAU,QAAA,CAAS,WAAA,IAAe,CAAC,QAAQ,CAAA,EAAG,OAAA,CAAQ,CAAC,SAAS,QAAA,CAAS,MAAA,CAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AACpH,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,gBAAA,CAAiB,cAAc,CAAA;AAC1D,IAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA,CAAK,gBAAA,CAAiB,iBAAiB,CAAA;AAChE,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,gBAAA,CAAiB,SAAS,CAAA;AAChD,IAAA,IAAA,CAAK,MAAM,QAAA,CAAS,MAAA,CAAO,iBAAiB,0BAA0B,CAAC,EAAE,CAAC,CAAA;AAC1E,IAAA,IAAA,CAAK,mBAAA,GAAsB,IAAA,CAAK,GAAA,KAAQ,MAAA,IAAa,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AACjG,IAAA,IAAA,CAAK,qBAAA,GAAwB,MAAA,CAAO,MAAA,CAAO,oBAAA,CAAqB,QAAA,CAAS,OAAO,gBAAA,CAAiB,qBAAqB,CAAC,CAAC,CAAC,CAAA;AACzH,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,gBAAA,CAAiB,gBAAgB,CAAA;AAC9D,IAAA,IAAA,CAAK,eAAA,GAAkB,MAAA,CAAO,MAAA,CAAO,gBAAA,CAAiB,QAAQ,CAAC,CAAA;AAC/D,IAAA,IAAA,CAAK,KAAA,GAAQ,SAAA,CAAU,MAAA,CAAO,gBAAA,CAAiB,KAAK,CAAC,CAAA;AACrD,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA,CAAK,gBAAA,CAAiB,YAAY,CAAA;AACtD,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA,CAAK,gBAAA,CAAiB,KAAK,CAAA;AACxC,IAAA,IAAA,CAAK,aAAA,GAAgB,SAAA,CAAU,MAAA,CAAO,gBAAA,CAAiB,aAAa,CAAC,CAAA;AACrE,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,gBAAA,CAAiB,IAAI,CAAA;AACtC,IAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA,CAAK,gBAAA,CAAiB,iBAAiB,CAAA;AAChE,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,gBAAA,CAAiB,cAAc,CAAA;AAC1D,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA,CAAK,gBAAA,CAAiB,YAAY,CAAA;AACtD,IAAA,IAAA,CAAK,QAAA,GAAW,SAAA,CAAU,MAAA,CAAO,gBAAA,CAAiB,QAAQ,CAAC,CAAA;AAC3D,IAAA,IAAA,CAAK,IAAA,GACH,IAAA,CAAK,cAAA,KAAmB,iBAAA,GACpB,UAAA,GACA,IAAA,CAAK,cAAA,KAAmB,gBAAA,GACtB,oBAAA,GACA,IAAA,CAAK,QAAA,KAAa,MAAA,GAChB,MAAA,GACA,QAAA;AAEV,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,KAAS,UAAA,IAAc,KAAK,IAAA,KAAS,oBAAA;AAE1D,IAAA,MAAM,eAAA,GAAkB,WAAW,eAAA,IAAmB,IAAA,CAAK,SAAS,UAAA,IAAc,MAAA,CAAO,gBAAA,CAAiB,UAAU,CAAA,KAAM,MAAA;AAE1H,IAAA,IAAA,CAAK,cAAA,GAAiB,UAChB,IAAA,CAAK,gBAAA,CAAiB,SAAS,CAAA,KAA2C,eAAA,GAAkB,qBAAqB,eAAA,CAAA,GACnH,MAAA;AACJ,IAAA,IAAA,CAAK,eAAe,IAAA,CAAK,IAAA,KAAS,aAAa,IAAA,CAAK,gBAAA,CAAiB,YAAY,CAAA,GAAI,MAAA;AACrF,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,gBAAA,CAAiB,cAAc,CAAA;AAC1D,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,gBAAA,CAAiB,WAAW,CAAA;AACpD,IAAA,IAAA,CAAK,aAAA,GACH,IAAA,CAAK,gBAAA,CAAiB,aAAa,CAAA,KAAM,IAAA,CAAK,IAAA,KAAS,oBAAA,GAAuB,IAAA,CAAK,gBAAA,CAAiB,YAAY,CAAA,GAAI,MAAA,CAAA;AACtH,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA,CAAK,gBAAA,CAAiB,eAAe,CAAA;AAC5D,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,gBAAA,CAAiB,gBAAgB,CAAA;AAC9D,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,QAAA,KAAa,MAAA;AAC1C,IAAA,IAAA,CAAK,aAAa,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAC,CAAA;AACnD,IAAA,IAAA,CAAK,eAAe,CAAC,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,OAAO,OAAA,KAAY,MAAA;AAC/D,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA,CAAK,YAAA,GAAe,MAAA,CAAO,OAAO,EAAE,OAAA,EAAS,IAAA,CAAK,KAAA,CAAO,SAAU,IAAA,EAAM,IAAA,CAAK,KAAA,CAAO,IAAA,EAAM,CAAA,GAAI,MAAA;AAEnH,IAAA,MAAA,CAAO,cAAA,CAAe,MAAM,OAAA,EAAS,EAAE,OAAO,KAAA,EAAO,UAAA,EAAY,OAAO,CAAA;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,iBAAA,CAAkB,MAAA,EAAmC,QAAA,GAAoC,IAAI,KAAA,EAA4B;AAC9H,IAAA,OAAO,IAAI,WAAA,CAAW,qBAAA,CAAsB,MAAM,CAAA,EAAG,QAAA,EAAU,OAAO,eAAe,CAAA;AAAA,EACvF;AAAA;AAAA,EAGA,SAAS,KAAA,EAAwB;AAC/B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,CAAQ,IAAA,EAAc,OAAA,GAA+D,EAAC,EAAY;AAChG,IAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,IAAA,IAAI,OAAA,CAAQ,OAAA,IAAW,OAAA,CAAQ,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,OAAO,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,IAAA,EAAM,OAAA,CAAQ,OAAO,CAAA;AAE3G,IAAA,MAAM,MAAA,GAAS,KAAK,WAAA,EAAY;AAEhC,IAAA,OAAO,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,IAAI,CAAA,IAAK,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,CAAC,IAAA,KAAS,IAAA,CAAK,WAAA,OAAkB,MAAM,CAAA;AAAA,EACzG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,CAAc,QAAA,EAAkB,MAAA,EAAgB,OAAA,GAA+D,EAAC,EAAY;AAC1H,IAAA,OAAO,KAAK,cAAA,CAAe,MAAA,CAAO,QAAA,EAAU,MAAA,EAAQ,QAAQ,OAAO,CAAA;AAAA,EACrE;AAAA;AAAA,EAGA,SAAS,KAAA,EAAwB;AAC/B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAA,CAAS,SAAiB,MAAA,EAA2B;AACnD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,WAAA,CAAY,IAAI,CAAA;AAErC,IAAA,OAAO,MAAA,CAAO,MAAA,KAAW,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,KAAU,MAAA,CAAO,QAAA,CAAS,KAAK,CAAC,CAAA;AAAA,EAClG;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY,IAAA,EAAwB;AAClC,IAAA,OAAO,QAAA,CAAS,IAAA,CAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,EACnC;AAAA;AAAA,EAGA,MAAA,GAAkC;AAChC,IAAA,MAAM,EAAE,SAAA,EAAW,UAAA,EAAY,GAAG,SAAQ,GAAI,IAAA;AAE9C,IAAA,OAAO,EAAE,GAAG,OAAA,EAAS,cAAA,EAAgB,IAAA,CAAK,eAAe,OAAA,EAAQ;AAAA,EACnE;AACF;AAOO,SAAS,sBAAsB,MAAA,EAA4D;AAChG,EAAA,MAAM,EAAE,QAAQ,OAAA,EAAS,UAAA,EAAY,WAAW,QAAA,EAAU,GAAG,SAAQ,GAAI,MAAA;AACzE,EAAA,MAAM,MAAA,GAAkC,EAAE,GAAG,OAAA,EAAQ;AAErD,EAAA,IAAI,OAAO,SAAA,KAAc,QAAA,IAAY,MAAA,CAAO,GAAA,KAAQ,MAAA,IAAa,SAAA,CAAU,WAAA,EAAY,KAAM,SAAA,EAAW,MAAA,CAAO,GAAA,GAAM,SAAA;AACrH,EAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,OAAO,kBAAA,KAAuB,MAAA,SAAkB,kBAAA,GAAqB,QAAA;AACzG,EAAA,IAAI,OAAO,OAAO,SAAA,KAAc,QAAA,IAAY,OAAO,GAAA,KAAQ,MAAA,EAAW,MAAA,CAAO,GAAA,GAAM,MAAA,CAAO,SAAA;AAE1F,EAAA,OAAO,MAAA;AACT;AAOO,SAAS,kBAAkB,IAAA,EAAuB;AACvD,EAAA,OAAO,gBAAA,CAAiB,GAAA,CAAI,IAAA,CAAK,WAAA,EAAa,CAAA;AAChD;AAOO,SAAS,SAAS,KAAA,EAA0B;AACjD,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,SAAa,EAAC;AACnD,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,GAAG,OAAO,KAAA,CAAM,QAAQ,CAAC,IAAA,KAAU,SAAS,IAAA,IAAQ,IAAA,KAAS,SAAY,EAAC,GAAI,CAAC,MAAA,CAAO,IAAI,CAAC,CAAE,CAAA;AAEpH,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,EAAG;AACtD,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAE/B,MAAA,IAAI,MAAM,OAAA,CAAQ,MAAM,CAAA,EAAG,OAAO,SAAS,MAAM,CAAA;AAAA,IACnD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,CAAC,KAAK,CAAA;AAAA,IACf;AAAA,EACF;AAEA,EAAA,OAAO,CAAC,MAAA,CAAO,KAAK,CAAC,CAAA;AACvB;AAEA,SAAS,OAAO,KAAA,EAAwB;AACtC,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,OAAO,KAAA,KAAU,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA;AAC7G;AAEA,SAAS,SAAA,CAAU,KAAA,EAAgB,KAAA,GAAQ,CAAA,EAA4B;AACrE,EAAA,IAAI,KAAA,GAAQ,KAAA;AAEZ,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,KAAK,CAAA;AAAA,IAC1B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,GAAQ,EAAA,EAAI,OAAO,MAAA;AAEtF,EAAA,MAAM,MAAA,GAAS,KAAA;AAEf,EAAA,OAAO,OAAO,MAAA,CAAO;AAAA,IACnB,QAAA,EAAU,OAAO,MAAA,CAAO,SAAA,KAAc,YAAY,MAAA,CAAO,SAAA,GAAY,OAAO,SAAA,GAAY,MAAA;AAAA,IACxF,OAAA,EAAS,OAAO,MAAA,CAAO,GAAA,KAAQ,YAAY,MAAA,CAAO,GAAA,GAAM,OAAO,GAAA,GAAM,MAAA;AAAA,IACrE,IAAA,EAAM,OAAO,MAAA,CAAO,IAAA,KAAS,YAAY,MAAA,CAAO,IAAA,GAAO,OAAO,IAAA,GAAO,MAAA;AAAA,IACrE,KAAA,EAAO,SAAA,CAAU,MAAA,CAAO,GAAA,EAAK,QAAQ,CAAC;AAAA,GACvC,CAAA;AACH;AAEA,SAAS,QAAQ,KAAA,EAA0C;AACzD,EAAA,MAAM,QAAkB,EAAC;AAEzB,EAAA,KAAA,IAAS,OAAA,GAAU,KAAA,EAAO,OAAA,EAAS,OAAA,GAAU,OAAA,CAAQ,KAAA,EAAO,IAAI,OAAA,CAAQ,QAAA,EAAU,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AAE7G,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,UAAU,KAAA,EAAoC;AACrD,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,GAAI,KAAA,GAAQ,OAAO,KAAA,KAAU,YAAY,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA,GAAI,MAAA;AAC1I;AAEA,SAAS,OAAO,KAAA,EAAkC;AAChD,EAAA,MAAMA,QAAAA,GAAU,OAAO,KAAA,KAAU,QAAA,GAAW,QAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA,GAAI,MAAA;AAEvH,EAAA,OAAOA,aAAY,MAAA,GAAY,MAAA,GAAY,IAAI,IAAA,CAAKA,WAAU,GAAI,CAAA;AACpE;AAEA,SAAS,UAAU,KAAA,EAAqC;AACtD,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,KAAA;AACvC,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,IAAA;AAC7B,EAAA,IAAI,KAAA,KAAU,SAAS,OAAO,KAAA;AAE9B,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,SAAS,MAAA,EAAqC;AACrD,EAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,MAAM,CAAC,CAAA;AAC5B;AAEA,SAAS,qBAAqB,MAAA,EAAqC;AACjE,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAE7B,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,KAAA,KAAU;AAC9B,IAAA,MAAM,GAAA,GAAM,MAAM,WAAA,EAAY;AAE9B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,KAAA;AAE1B,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,OAAO,IAAA;AAAA,EACT,CAAC,CAAA;AACH;ACzWO,SAAS,SAAA,CAAU,SAAqB,KAAA,EAAoD;AACjG,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,OAAA,KAA0C,YAAY,MAAS,CAAA;AAE9H,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAElC,EAAA,MAAM,SAAS,QAAA,CAAS,MAAA,CAAO,CAAC,OAAA,KAAY,OAAA,CAAQ,UAAU,kCAAkC,CAAA;AAChG,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,MAAA,KAAW,CAAA,GAAI,WAAW,EAAC;AAClD,EAAA,MAAM,MAAA,GAAS,QAAQ,CAAC,CAAA,IAAK,OAAO,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,KAAK,CAAA;AACnE,EAAA,MAAM,SAAA,GAAY,aAAa,OAAA,CAAQ,GAAA,CAAI,CAAC,OAAA,KAAY,OAAA,CAAQ,SAAS,CAAC,CAAA;AAC1E,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,CAAC,OAAA,KAAY,OAAA,CAAQ,MAAM,CAAA,CAAE,MAAA,CAAO,CAAC,KAAA,KAA2B,KAAA,KAAU,MAAS,CAAA;AAE/G,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,SAAS,GAAA,CAAI,CAAC,YAAY,OAAA,CAAQ,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAAA,IAC5D,GAAI,QAAQ,KAAA,GAAQ,EAAE,OAAO,MAAA,CAAO,KAAA,KAAU,EAAC;AAAA,IAC/C,GAAI,QAAQ,KAAA,GAAQ,EAAE,OAAO,MAAA,CAAO,KAAA,KAAU,EAAC;AAAA,IAC/C,GAAI,SAAA,GAAY,EAAE,SAAA,KAAc,EAAC;AAAA,IACjC,GAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,EAAE,MAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,GAAG,OAAO,CAAA,EAAE,GAAI;AAAC,GAC/D;AACF;AAKO,SAAS,YAAA,CAAa,MAAA,EAAoC,KAAA,GAAqB,KAAA,EAAmB;AACvG,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,EAAQ,OAAO,CAAA;AAEvC,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,cAAA,EAAiB,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAAA,IAC3D,KAAA,EAAO,CAAC,IAAA,KACN,SAAA,CAAU,QAAA,EAAU,KAAA,EAAO,CAAC,KAAA,KAAU,IAAA,CAAK,QAAA,CAAS,KAAK,CAAC,IACtD,MAAA,GACA;AAAA,MACE,SAAS,CAAA,oCAAA,EAAuC,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,MAC7E,KAAA,EAAO,oBAAA;AAAA,MACP,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,GAAG;AAAA;AAC1B,GACR;AACF;AAKO,SAAS,WAAA,CACd,KAAA,EACA,OAAA,GAAoF,EAAC,EACzE;AACZ,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,KAAA,EAAO,MAAM,CAAA;AACrC,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,KAAA;AAC/B,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,OAAA,CAAQ,OAAO,CAAA;AAE5C,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,gBAAgB,KAAK,CAAA,GAAA,EAAM,SAAS,IAAA,CAAK,IAAI,CAAC,CAAA,EAAG,IAAI,CAAA,CAAA;AAAA,IAClE,KAAA,EAAO,CAAC,IAAA,KACN,SAAA,CAAU,QAAA,EAAU,KAAA,EAAO,CAAC,IAAA,KAAS,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,EAAE,SAAS,OAAA,CAAQ,OAAA,EAAS,CAAC,CAAA,GACjF,MAAA,GACA,EAAE,OAAA,EAAS,CAAA,oCAAA,EAAuC,KAAK,CAAA,GAAA,EAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,EAAG,IAAI,CAAA,CAAA,CAAA;AAAI,GACnG;AACF;AAKO,SAAS,iBAAA,CAAkB,QAAA,EAAkB,MAAA,EAAgB,OAAA,GAA+D,EAAC,EAAe;AACjJ,EAAA,IAAI,CAAC,QAAA,EAAU,IAAA,EAAK,IAAK,CAAC,MAAA,EAAQ,IAAA,EAAK,EAAG,MAAM,IAAI,SAAA,CAAU,6CAA6C,CAAA;AAE3G,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,OAAA,CAAQ,OAAO,CAAA;AAE5C,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAA,EAAI,MAAM,GAAG,IAAI,CAAA,CAAA;AAAA,IAC5D,KAAA,EAAO,CAAC,IAAA,KACN,IAAA,CAAK,cAAc,QAAA,EAAU,MAAA,EAAQ,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA,GAAI,MAAA,GAAY,EAAE,OAAA,EAAS,CAAA,gCAAA,EAAmC,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA,EAAG,IAAI,CAAA,CAAA,CAAA;AAAI,GAChK;AACF;AAKO,SAAS,YAAA,CAAa,MAAA,EAAoC,KAAA,GAAqB,KAAA,EAAmB;AACvG,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,EAAQ,OAAO,CAAA;AAEvC,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,cAAA,EAAiB,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAC5D,KAAA,EAAO,CAAC,IAAA,KACN,SAAA,CAAU,UAAU,KAAA,EAAO,CAAC,KAAA,KAAU,IAAA,CAAK,QAAA,CAAS,KAAK,CAAC,CAAA,GACtD,MAAA,GACA,EAAE,OAAA,EAAS,CAAA,yCAAA,EAA4C,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAI,GACjG;AACF;AAMO,SAAS,YAAA,CAAa,SAAiB,MAAA,EAA8B;AAC1E,EAAA,IAAI,CAAC,IAAA,EAAM,IAAA,IAAQ,MAAM,IAAI,UAAU,kCAAkC,CAAA;AAEzE,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,MAAA,CAAO,MAAA,KAAW,CAAA,GAAI,CAAA,cAAA,EAAiB,IAAI,CAAA,CAAA,GAAK,CAAA,cAAA,EAAiB,IAAI,CAAA,IAAA,EAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAC1G,KAAA,EAAO,CAAC,IAAA,KACN,IAAA,CAAK,QAAA,CAAS,MAAM,GAAG,MAAM,CAAA,GACzB,MAAA,GACA,EAAE,OAAA,EAAS,OAAO,MAAA,KAAW,CAAA,GAAI,CAAA,0BAAA,EAA6B,IAAI,CAAA,CAAA,CAAA,GAAM,CAAA,kBAAA,EAAqB,IAAI,CAAA,gBAAA,EAAmB,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAI,GACjJ;AACF;AAKO,SAAS,oBAAoB,YAAA,EAAmC;AACrE,EAAA,MAAM,MAAA,GAAS,YAAA,EAAc,IAAA,EAAK,IAAK,MAAA;AAEvC,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,CAAA,qBAAA,EAAwB,MAAA,IAAU,KAAK,CAAA,CAAA;AAAA,IACpD,KAAA,EAAO,CAAC,IAAA,KAAS;AACf,MAAA,MAAM,YACJ,CAAC,CAAC,KAAK,cAAA,KACN,CAAC,UACA,IAAA,CAAK,iBAAA,EAAmB,aAAY,KAAM,MAAA,CAAO,aAAY,IAC7D,IAAA,CAAK,eAAe,WAAA,EAAY,KAAM,OAAO,WAAA,EAAY,CAAA;AAE7D,MAAA,OAAO,SAAA,GACH,SACA,EAAE,OAAA,EAAS,SAAS,CAAA,qCAAA,EAAwC,MAAM,MAAM,wCAAA,EAAyC;AAAA,IACvH;AAAA,GACF;AACF;AAMO,SAAS,0BAAA,CAA2B,YAAA,EAAsB,OAAA,GAAoD,EAAC,EAAe;AACnI,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,YAAY,CAAA,IAAK,eAAe,CAAA,EAAG,MAAM,IAAI,UAAA,CAAW,mDAAmD,CAAA;AAEjI,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,KAAW,MAAA,GAAY,MAAA,GAAY,2BAAA,CAA4B,OAAA,CAAQ,MAAA,EAAQ,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAO,CAAA;AAE/H,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,kCAAkC,YAAY,CAAA,EAAG,UAAU,CAAA,EAAA,EAAK,OAAA,CAAQ,WAAW,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAAA,IACvG,KAAA,EAAO,CAAC,IAAA,KAAS;AACf,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,mBAAA,KAAwB,MAAA,IAAa,KAAK,mBAAA,IAAuB,YAAA;AACvF,MAAA,MAAM,MAAA,GAAS,OAAA,EAAS,KAAA,CAAM,IAAI,CAAA;AAElC,MAAA,IAAI,QAAA,IAAY,CAAC,MAAA,EAAQ,OAAO,MAAA;AAEhC,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,CAAC,QAAA,GAAW,MAAA,GAAY,6CAA6C,YAAY,CAAA,CAAA,CAAA,EAAK,MAAA,EAAQ,OAAO,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,KAAK,GAAG,CAAA;AAAA,QACxI,KAAA,EAAO,kCAAA;AAAA,QACP,SAAA,EAAW,OAAO,YAAY,CAAA;AAAA,QAC9B,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO,GAAI;AAAC,OACnE;AAAA,IACF;AAAA,GACF;AACF;AAKA,IAAM,YAAA,GAAiD,EAAE,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,KAAK,GAAA,EAAI;AAM7G,SAAS,4BACd,OAAA,EACA,KAAA,GAAqB,KAAA,EACrB,OAAA,GAAkC,EAAC,EACvB;AACZ,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,EAAS,uBAAuB,CAAA;AACxD,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,GAAA,CAAI,CAAC,WAAW,YAAA,CAAa,MAAA,CAAO,WAAA,EAAa,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,KAAA,KAA2B,UAAU,MAAS,CAAA;AAClI,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,KAAc,MAAA,CAAO,MAAA,KAAW,CAAA,GAAI,MAAA,GAAY,KAAA,KAAU,KAAA,GAAQ,YAAA,CAAa,MAAM,CAAA,GAAI,WAAW,MAAM,CAAA,CAAA;AAEpI,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,8BAAA,EAAiC,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAC5E,KAAA,EAAO,CAAC,IAAA,KAAS;AACf,MAAA,MAAM,IAAA,GAAO,KAAK,qBAAA,CAAsB,GAAA,CAAI,CAAC,MAAA,KAAW,MAAA,CAAO,aAAa,CAAA;AAE5E,MAAA,OAAO,SAAA,CAAU,QAAA,EAAU,KAAA,EAAO,CAAC,MAAA,KAAW,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,WAAA,EAAa,CAAC,CAAA,GAC7E,MAAA,GACA;AAAA,QACE,SAAS,CAAA,iCAAA,EAAoC,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAA,QAC3E,KAAA,EAAO,kCAAA;AAAA,QACP,GAAI,SAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OACnC;AAAA,IACN;AAAA,GACF;AACF;AAKO,SAAS,2BAAA,CAA4B,MAAA,EAAgB,OAAA,GAAmC,EAAC,EAAe;AAC7G,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA,IAAK,SAAS,CAAA,EAAG,MAAM,IAAI,UAAA,CAAW,wDAAwD,CAAA;AAE1H,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,WAAA;AAE/B,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,0BAA0B,MAAM,CAAA,MAAA,CAAA;AAAA,IAC7C,KAAA,EAAO,CAAC,IAAA,KACN,IAAA,CAAK,aAAa,MAAA,IAAa,KAAA,CAAM,GAAA,EAAI,GAAI,IAAA,CAAK,QAAA,GAAW,GAAA,IAAQ,MAAA,GAAS,MAC1E,MAAA,GACA;AAAA,MACE,OAAA,EACE,KAAK,QAAA,KAAa,MAAA,GACd,wDAAwD,MAAM,CAAA,yBAAA,CAAA,GAC9D,+BAA+B,MAAM,CAAA,aAAA,CAAA;AAAA,MAC3C,KAAA,EAAO,kCAAA;AAAA,MACP;AAAA;AACF,GACR;AACF;AAKO,SAAS,kBAAkB,KAAA,EAAmE;AACnG,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,KAAA,EAAO,aAAa,CAAA;AAE5C,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,CAAA,oBAAA,EAAuB,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IACvD,OAAO,CAAC,IAAA,KAAU,SAAS,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,GAAI,MAAA,GAAY,EAAE,OAAA,EAAS,CAAA,gBAAA,EAAmB,KAAK,IAAI,CAAA,cAAA,EAAiB,SAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAI,GAC9I;AACF;AAKO,SAAS,cAAc,SAAA,EAAmD;AAC/E,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,EAAW,WAAW,CAAA;AAE9C,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,CAAA,eAAA,EAAkB,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAClD,OAAO,CAAC,IAAA,KACN,KAAK,QAAA,KAAa,MAAA,IAAa,SAAS,QAAA,CAAS,IAAA,CAAK,QAAQ,CAAA,GAC1D,MAAA,GACA,EAAE,OAAA,EAAS,CAAA,gDAAA,EAAmD,SAAS,IAAA,CAAK,IAAI,CAAC,CAAA,EAAA,CAAA;AAAK,GAC9F;AACF;AAKO,SAAS,SAAS,KAAA,EAAiC;AACxD,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,MAAM,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,WAAW,CAAA,CAAE,IAAA,CAAK,OAAO,CAAA;AAAA,IAC/D,OAAO,CAAC,IAAA,KAAS,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK;AAAA,GAC3C;AACF;AAKO,SAAS,SAAS,KAAA,EAAiC;AACxD,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,gCAAgC,CAAA;AAE5E,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,MAAM,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,WAAW,CAAA,CAAE,IAAA,CAAK,MAAM,CAAA;AAAA,IAC9D,KAAA,EAAO,CAAC,IAAA,KAAS;AACf,MAAA,MAAM,QAAA,GAAW,MAAM,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA;AAErD,MAAA,OAAO,QAAA,CAAS,KAAK,CAAC,OAAA,KAAY,YAAY,MAAS,CAAA,GAAI,MAAA,GAAY,QAAA,CAAS,CAAC,CAAA;AAAA,IACnF;AAAA,GACF;AACF;AAEA,SAAS,MAAA,CAAO,QAAoC,IAAA,EAAwB;AAC1E,EAAA,MAAM,IAAA,GAAO,CAAC,GAAG,IAAI,KAAK,OAAO,MAAA,KAAW,QAAA,GAAW,CAAC,MAAM,CAAA,GAAI,CAAC,GAAG,MAAM,GAAG,MAAA,CAAO,CAAC,UAAU,KAAA,EAAO,IAAA,EAAM,CAAC,CAAC,CAAA;AAEhH,EAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG,MAAM,IAAI,SAAA,CAAU,CAAA,aAAA,EAAgB,IAAI,CAAA,aAAA,CAAe,CAAA;AAE9E,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,SAAA,CAAU,QAAA,EAA6B,KAAA,EAAoB,KAAA,EAA4C;AAC9G,EAAA,OAAO,KAAA,KAAU,QAAQ,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,QAAA,CAAS,KAAK,KAAK,CAAA;AACtE;AAEA,SAAS,aAAa,MAAA,EAA6D;AACjF,EAAA,OAAO,QAAQ,MAAA,EAAQ,CAAC,IAAA,EAAM,KAAA,KAAU,QAAQ,IAAI,CAAA;AACtD;AAEA,SAAS,WAAW,MAAA,EAA6D;AAC/E,EAAA,OAAO,QAAQ,MAAA,EAAQ,CAAC,IAAA,EAAM,KAAA,KAAU,OAAO,KAAK,CAAA;AACtD;AAEA,SAAS,OAAA,CAAQ,QAAyC,KAAA,EAAoE;AAC5H,EAAA,MAAM,QAAQ,MAAA,CAAO,MAAA,CAAO,CAAC,KAAA,KAA2B,CAAC,CAAC,KAAK,CAAA;AAC/D,EAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,CAAC,UAAU,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAC,CAAA,CAAE,KAAK,CAAC,IAAA,EAAM,UAAU,KAAA,CAAM,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAErH,EAAA,OAAO,OAAA,CAAQ,CAAC,CAAA,IAAK,KAAA,CAAM,CAAC,CAAA;AAC9B;AAEA,SAAS,gBAAgB,OAAA,EAAoE;AAC3F,EAAA,OAAO,OAAA,IAAW,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,SAAS,CAAC,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AACvF;AC5UO,IAAM,iBAAA,GAAN,MAAM,kBAAA,SAA0B,WAAA,CAAY;AAAA,EACxC,MAAA,GAAS,GAAA;AAAA;AAAA,EAET,KAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA,EAEA,MAAA;AAAA;AAAA,EAEA,gBAAA;AAAA,EAET,WAAA,CACE,WAAA,EACA,OAAA,GAKI,EAAC,EACL;AACA,IAAA,KAAA,CAAM,eAAe,0CAAA,EAA4C,EAAE,KAAA,EAAO,OAAA,CAAQ,OAAO,CAAA;AACzF,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,IAAW,OAAA,GAAU,OAAA,CAAQ,KAAA,GAAQ,eAAA;AAClD,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA,KAAgB,MAAA,GAAY,MAAA,GAAY,aAAa,WAAW,CAAA;AACnF,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,mBAAmB,OAAA,CAAQ,gBAAA;AAAA,EAClC;AAAA;AAAA,EAGA,qBAAqB,gBAAA,EAAyD;AAC5E,IAAA,IAAI,CAAC,gBAAA,IAAoB,gBAAA,KAAqB,IAAA,CAAK,kBAAkB,OAAO,IAAA;AAE5E,IAAA,OAAO,IAAI,kBAAA,CAAkB,IAAA,CAAK,WAAA,EAAa,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,KAAA,EAAO,KAAK,KAAA,EAAO,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,kBAAkB,CAAA;AAAA,EAChI;AAAA;AAAA,EAGA,IAAI,eAAA,GAA0B;AAC5B,IAAA,MAAM,aAAuB,EAAC;AAE9B,IAAA,IAAI,KAAK,KAAA,EAAO,UAAA,CAAW,KAAK,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA,CAAG,CAAA;AACvD,IAAA,IAAI,IAAA,CAAK,SAAS,IAAA,CAAK,WAAA,aAAwB,IAAA,CAAK,CAAA,mBAAA,EAAsB,IAAA,CAAK,WAAW,CAAA,CAAA,CAAG,CAAA;AAC7F,IAAA,IAAI,IAAA,CAAK,kBAAkB,UAAA,CAAW,IAAA,CAAK,sBAAsB,YAAA,CAAa,IAAA,CAAK,gBAAgB,CAAC,CAAA,CAAA,CAAG,CAAA;AAEvG,IAAA,OAAO,UAAA,CAAW,WAAW,CAAA,GAAI,QAAA,GAAW,UAAU,UAAA,CAAW,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,EAC7E;AACF;AAQO,IAAM,oBAAA,GAAN,MAAM,qBAAA,SAA6B,WAAA,CAAY;AAAA;AAAA,EAE3C,MAAA;AAAA,EACA,OAAA;AAAA;AAAA,EAEA,gBAAA;AAAA,EAET,WAAA,CAAY,OAAA,EAA4B,OAAA,GAAyC,EAAC,EAAG;AACnF,IAAA,KAAA,CAAM,QAAQ,OAAO,CAAA;AACrB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,MAAA,GAAS,OAAA,CAAQ,KAAA,KAAU,kCAAA,GAAqC,GAAA,GAAM,GAAA;AAC3E,IAAA,IAAA,CAAK,mBAAmB,OAAA,CAAQ,gBAAA;AAAA,EAClC;AAAA;AAAA,EAGA,qBAAqB,gBAAA,EAA4D;AAC/E,IAAA,IAAI,CAAC,gBAAA,IAAoB,gBAAA,KAAqB,IAAA,CAAK,kBAAkB,OAAO,IAAA;AAE5E,IAAA,OAAO,IAAI,qBAAA,CAAqB,IAAA,CAAK,OAAA,EAAS,EAAE,kBAAkB,CAAA;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,eAAA,GAAsC;AACxC,IAAA,MAAM,SAAA,GAAY,oBAAA,CAAqB,IAAA,CAAK,OAAO,CAAA;AAEnD,IAAA,OAAO,SAAA,IAAa,IAAA,CAAK,MAAA,KAAW,GAAA,IAAO,IAAA,CAAK,gBAAA,GAAmB,CAAA,EAAG,SAAS,CAAA,qBAAA,EAAwB,YAAA,CAAa,IAAA,CAAK,gBAAgB,CAAC,CAAA,CAAA,CAAA,GAAM,SAAA;AAAA,EAClJ;AACF;AAMO,SAAS,qBAAqB,OAAA,EAAgD;AACnF,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAA,EAAO,OAAO,MAAA;AAE3B,EAAA,MAAM,UAAA,GAAa,CAAC,CAAA,OAAA,EAAU,OAAA,CAAQ,KAAK,CAAA,CAAA,CAAA,EAAK,CAAA,mBAAA,EAAsB,YAAA,CAAa,YAAA,CAAa,OAAA,CAAQ,OAAO,CAAC,CAAC,CAAA,CAAA,CAAG,CAAA;AAEpH,EAAA,IAAI,OAAA,CAAQ,OAAO,UAAA,CAAW,IAAA,CAAK,UAAU,YAAA,CAAa,OAAA,CAAQ,KAAK,CAAC,CAAA,CAAA,CAAG,CAAA;AAC3E,EAAA,IAAI,OAAA,CAAQ,WAAW,UAAA,CAAW,IAAA,CAAK,eAAe,YAAA,CAAa,OAAA,CAAQ,SAAS,CAAC,CAAA,CAAA,CAAG,CAAA;AACxF,EAAA,IAAI,OAAA,CAAQ,WAAW,MAAA,EAAW,UAAA,CAAW,KAAK,CAAA,QAAA,EAAW,OAAA,CAAQ,MAAM,CAAA,CAAE,CAAA;AAE7E,EAAA,OAAO,CAAA,OAAA,EAAU,UAAA,CAAW,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AACxC;AAMO,SAAS,iBAAiB,KAAA,EAA0E;AACzG,EAAA,IAAI,KAAA,YAAiB,iBAAA;AACnB,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,gBAAA;AAAA,MACN,KAAA,EAAO,cAAA;AAAA,MACP,MAAA,EAAQ,GAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACV;AAEF,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAA,CAAM,MAAA,KAAW,GAAA,GAAM,gBAAA,GAAmB,oDAAA;AAAA,IAChD,KAAA,EAAO,KAAA,CAAM,MAAA,KAAW,GAAA,GAAM,cAAA,GAAiB,WAAA;AAAA,IAC/C,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,MAAA,EAAQ,KAAA,CAAM,OAAA,CAAQ,OAAA,IAAW,oDAAA;AAAA,IACjC,GAAI,KAAA,CAAM,OAAA,CAAQ,KAAA,GAAQ,EAAE,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAM,GAAI,EAAC;AAAA,IAC5D,GAAI,KAAA,CAAM,OAAA,CAAQ,KAAA,GAAQ,EAAE,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAM,GAAI,EAAC;AAAA,IAC5D,GAAI,KAAA,CAAM,OAAA,CAAQ,SAAA,GAAY,EAAE,YAAY,KAAA,CAAM,OAAA,CAAQ,SAAA,EAAU,GAAI,EAAC;AAAA,IACzE,GAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,KAAW,MAAA,GAAY,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAO,GAAI;AAAC,GAChF;AACF;AAEA,IAAM,gBAAA,GAAmB,oDAAA;AAOlB,SAAS,aAAa,IAAA,EAAsB;AACjD,EAAA,OAAO,CAAC,GAAG,IAAI,EAAE,GAAA,CAAI,CAAC,cAAe,SAAA,IAAa,GAAA,IAAO,aAAa,GAAA,IAAO,SAAA,KAAc,OAAO,SAAA,KAAc,IAAA,GAAO,YAAY,GAAI,CAAA,CAAE,KAAK,EAAE,CAAA;AAClJ;AAEA,SAAS,aAAa,KAAA,EAAuB;AAC3C,EAAA,OAAO,MAAM,OAAA,CAAQ,KAAA,EAAO,MAAM,CAAA,CAAE,OAAA,CAAQ,MAAM,KAAK,CAAA;AACzD;AC7GO,SAAS,6BAA6B,QAAA,EAA0B;AACrE,EAAA,MAAM,GAAA,GAAM,cAAc,QAAQ,CAAA;AAClC,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE5C,EAAA,OAAO,GAAG,GAAA,CAAI,MAAM,GAAG,cAAA,CAAe,6BAA6B,GAAG,IAAI,CAAA,CAAA;AAC5E;AAKO,SAAS,8BAA8B,QAAA,EAA0B;AACtE,EAAA,OAAO,IAAI,GAAA,CAAI,4BAAA,CAA6B,QAAQ,CAAC,CAAA,CAAE,QAAA;AACzD;AAMO,SAAS,gCAAgC,OAAA,EAAkF;AAChI,EAAA,aAAA,CAAc,QAAQ,QAAQ,CAAA;AAE9B,EAAA,MAAM,QAAA,GAA4C;AAAA,IAChD,GAAG,OAAA,CAAQ,KAAA;AAAA,IACX,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,qBAAA,EAAuB,CAAC,aAAA,CAAc,OAAO,CAAC,CAAA;AAAA,IAC9C,wBAAA,EAA0B,CAAC,QAAQ;AAAA,GACrC;AAEA,EAAA,IAAI,OAAA,CAAQ,eAAA,IAAmB,OAAA,CAAQ,eAAA,CAAgB,MAAA,GAAS,CAAA,EAAG,QAAA,CAAS,gBAAA,GAAmB,CAAC,GAAG,OAAA,CAAQ,eAAe,CAAA;AAC1H,EAAA,IAAI,OAAA,CAAQ,YAAA,EAAc,QAAA,CAAS,aAAA,GAAgB,OAAA,CAAQ,YAAA;AAC3D,EAAA,IAAI,OAAA,CAAQ,qBAAA,EAAuB,QAAA,CAAS,sBAAA,GAAyB,OAAA,CAAQ,qBAAA;AAE7E,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,cAAc,QAAA,EAAuB;AAC5C,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,QAAQ,CAAA;AAAA,EACxB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,yBAAyB,CAAA,cAAA,EAAiB,QAAQ,6BAA6B,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,EAC3G;AAEA,EAAA,IAAI,IAAI,IAAA,EAAM,MAAM,IAAI,wBAAA,CAAyB,CAAA,cAAA,EAAiB,QAAQ,CAAA,uCAAA,CAAyC,CAAA;AAEnH,EAAA,OAAO,GAAA;AACT;;;AC+DO,IAAM,6BAAA,GAAgC;AAAA,EAC3C,QAAA,EACE,gNAAA;AAAA,EACF,WAAA,EAAa,kEAAA;AAAA,EACb,KAAA,EAAO,qBAAA;AAAA,EACP,SAAA,EAAW,yHAAA;AAAA,EACX,sBAAA,EAAwB,uDAAA;AAAA,EACxB,SAAA,EACE;AACJ;AAEA,IAAM,gBAAA,GAAmB,GAAA;AAOlB,SAAS,qBAAqB,OAAA,EAAgD;AACnF,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,EAAU,IAAA,EAAK,IAAK,MAAA;AAC7C,EAAA,MAAM,KAAA,GAAQ,OAAO,OAAA,CAAQ,SAAA,KAAc,WAAW,CAAC,OAAA,CAAQ,SAAS,CAAA,GAAI,CAAC,GAAI,OAAA,CAAQ,SAAA,IAAa,EAAG,CAAA;AACzG,EAAA,MAAM,SAAA,GAAY,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAA,EAAO,GAAI,QAAA,GAAW,CAAC,QAAQ,CAAA,GAAI,EAAG,CAAA,CAAE,MAAA,CAAO,CAAC,UAAU,KAAA,EAAO,IAAA,EAAM,CAAC,CAAC,CAAA;AAE3G,EAAA,IAAI,UAAU,MAAA,KAAW,CAAA;AACvB,IAAA,MAAM,IAAIC,yBAAyB,8FAA8F,CAAA;AAEnI,EAAA,MAAM,UAAA,GAAa,kBAAkB,OAAO,CAAA;AAC5C,EAAA,MAAM,SAAA,GAAY,4BAA4B,UAAU,CAAA;AACxD,EAAA,MAAM,aAAA,GAAgB,QAAQ,aAAA,IAAiB,MAAA;AAC/C,EAAA,MAAM,MAAA,GAAS,cAAc,OAAO,CAAA;AAEpC,EAAA,IAAI,aAAA,KAAkB,UAAU,CAAC,MAAA;AAC/B,IAAA,MAAM,IAAIA,wBAAAA;AAAA,MACR,0BAA0B,aAAa,CAAA,8GAAA;AAAA,KACzC;AAEF,EAAA,MAAM,mBAAA,GAAsB,uBAAA,CAAwB,OAAA,CAAQ,gBAAA,EAAkB,QAAQ,CAAA;AACtF,EAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,OAAA,CAAQ,0BAAA,EAA4B,IAAI,4BAA4B,CAAA;AACpG,EAAA,MAAM,YAAY,OAAA,CAAQ,OAAA,CAAQ,SAAA,EAAW,EAAA,EAAI,WAAW,CAAA,GAAI,GAAA;AAChE,EAAA,MAAM,UAAA,GAAa,4BAAA,CAA6B,OAAA,CAAQ,4BAA4B,CAAA;AACpF,EAAA,MAAM,SAAA,GAAY,UAAA,EAAY,MAAA,CAAO,CAAC,SAAA,KAAe,qBAA2C,QAAA,CAAS,SAAS,CAAC,CAAA,IAAK,EAAC;AACzH,EAAA,MAAM,eAAe,SAAA,CAAU,MAAA,GAAS,IAAI,mBAAA,CAAoB,OAAA,EAAS,SAAS,CAAA,GAAI,MAAA;AACtF,EAAA,MAAM,qBAAA,GAAwB,QAAQ,qBAAA,IAAyB,IAAA;AAC/D,EAAA,MAAM,gBAAyC,EAAE,UAAA,EAAY,QAAQ,UAAA,EAAY,WAAA,EAAa,QAAQ,WAAA,EAAY;AAClH,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAkE;AACpF,EAAA,MAAM,WAAA,GAAc,uBAAA,CAAwB,UAAA,EAAY,SAAS,CAAA;AACjE,EAAA,MAAM,aAAA,GACJ,QAAQ,mBAAA,KAAwB,OAAA,CAAQ,0BAA0B,qBAAA,CAAsB,OAAA,CAAQ,uBAAuB,CAAA,GAAI,MAAA,CAAA;AAC7H,EAAA,MAAM,OAAA,GACJ,aAAA,KAAkB,MAAA,GACd,MAAA,GACA,2BAA2B,aAAA,EAAe;AAAA,IACxC,OAAA,EAAS,OAAA,CAAQ,mBAAA,KAAwB,MAAA,GAAY,yBAAA,GAA4B,qBAAA;AAAA,IACjF,iCAAiC,OAAA,CAAQ,+BAAA;AAAA,IACzC,sBAAsB,OAAA,CAAQ,oBAAA;AAAA,IAC9B,mBAAmB,OAAA,CAAQ;AAAA,GAC5B,CAAA;AACP,EAAA,MAAM,iBAAiB,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,IAAI,KAAK,OAAA,CAAQ,cAAA,IAAkB,EAAC,EAAG,MAAA,CAAO,CAAC,KAAA,KAAU,KAAA,EAAO,MAAM,CAAC,CAAC,CAAC,CAAA;AAElH,EAAA,MAAM,UAAA,GAAa,OAAO,KAAA,EAAe,GAAA,EAAa,MAAA,KAAyE;AAC7H,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,KAAA,CAAM,GAAA,EAAI;AACjC,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAE5B,IAAA,IAAI,MAAA,IAAU,MAAA,CAAO,KAAA,GAAQ,GAAA,SAAY,MAAA,CAAO,MAAA;AAEhD,IAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAEhB,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAQ,UAAA,CAAW,KAAA,EAAO,EAAE,aAAA,EAAe,gBAAA,CAAiB,WAAA,EAAa,MAAA,EAAQ,CAAA;AAEtG,IAAA,IAAI,CAAC,MAAA,CAAO,MAAA,EAAQ,OAAO,MAAA;AAE3B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,GAAA,GAAM,eAAA,EAAiB,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,GAAA,GAAM,GAAA,GAAO,OAAO,iBAAiB,CAAA;AAE3H,IAAA,IAAI,QAAQ,GAAA,EAAK;AACf,MAAA,IAAI,KAAA,CAAM,IAAA,IAAQ,gBAAA,EAAkB,KAAA,CAAM,MAAA,CAAO,MAAM,IAAA,EAAK,CAAE,IAAA,EAAK,CAAE,KAAM,CAAA;AAC3E,MAAA,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,EAAE,MAAA,EAAQ,OAAO,CAAA;AAAA,IAClC;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,SAAA,GAAY,OAAO,KAAA,EAAe,MAAA,KAA8C;AACpF,IAAA,IAAI,MAAA,GAAS,KAAA;AAEb,IAAA,IAAI,sBAAA,CAAuB,KAAK,CAAA,EAAG;AACjC,MAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,iBAAA,CAAkB,8BAA8B,SAAA,EAAW,EAAE,MAAA,EAAQ,mBAAA,EAAqB,CAAA;AAElH,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,QAAQ,KAAK,CAAA;AAAA,MAC9B,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,KAAA,YAAiB,0BAAA,EAA4B,MAAM,IAAI,iBAAA,CAAkB,KAAA,CAAM,OAAA,EAAS,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAA;AAClI,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF;AAEA,IAAA,IAAI,MAAA;AAEJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,gBAAA,CAAiB,MAAM,WAAA,CAAY,MAAM,GAAG,YAAY,CAAA;AAAA,IACnE,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,kBAAkB,6BAAA,CAA8B,sBAAA,EAAwB,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,0BAAA,EAA4B,CAAA;AAAA,IACxI;AAEA,IAAA,IAAI,OAAA;AAEJ,IAAA,IAAI;AACF,MAAA,IAAI,MAAA;AAEJ,MAAA,CAAC,EAAE,OAAA,EAAS,MAAA,KAAW,MAAM,eAAA,CAAgB,QAAQ,MAAA,EAAQ;AAAA,QAC3D,QAAQ,UAAA,CAAW,MAAA;AAAA,QACnB,SAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,GAAA,EAAK,UAAA,CAAW,KAAA,CAAM,GAAA;AAAI,OAC3B,CAAA;AAED,MAAA,sBAAA,CAAuB,MAAM,CAAA;AAAA,IAC/B,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,KAAA,YAAiB,8BAA8B,KAAA,CAAM,MAAA,KAAW,uBAAuB,SAAA,CAAU,MAAA,KAAW,CAAA,IAAK,gBAAA,CAAiB,MAAM,CAAA;AAC1I,QAAA,MAAM,IAAI,iBAAA,CAAkB,6BAAA,CAA8B,SAAA,EAAW,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAQ,CAAA;AAC7G,MAAA,IAAI,KAAA,YAAiB,0BAAA,EAA4B,MAAM,IAAI,iBAAA,CAAkB,KAAA,CAAM,OAAA,EAAS,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAA;AAClI,MAAA,MAAM,KAAA;AAAA,IACR;AAEA,IAAA,MAAM,OAAO,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,GAAW,QAAQ,GAAA,GAAM,MAAA;AAE7D,IAAA,IAAI,qBAAA,IAAyB,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,aAAY,KAAM,QAAA;AACxE,MAAA,MAAM,IAAI,kBAAkB,CAAA,sDAAA,EAAyD,IAAI,MAAM,EAAE,MAAA,EAAQ,oBAAoB,CAAA;AAE/H,IAAA,IAAI,kBAAkB,aAAA,EAAe,OAAO,IAAI,UAAA,CAAW,OAAA,EAAS,eAAe,KAAK,CAAA;AAExF,IAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,KAAA,EAAO,SAAS,MAAM,CAAA;AAEzD,IAAA,OAAO,IAAI,UAAA,CAAW,EAAE,GAAG,qBAAA,CAAsB,MAAM,CAAA,EAAG,GAAG,OAAA,EAAQ,EAAG,aAAA,EAAe,KAAK,CAAA;AAAA,EAC9F,CAAA;AAEA,EAAA,MAAM,aAAA,GAAgB,OAAO,KAAA,EAAe,OAAA,EAAqB,MAAA,KAA6D;AAC5H,IAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,GAAM,CAAA,IAAA,EAAO,QAAQ,GAAG,CAAA,CAAA,GAAK,MAAM,WAAA,CAAY,KAAK,CAAA;AACxE,IAAA,IAAI,MAAA;AAEJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAM,UAAA,CAAW,KAAA,EAAO,GAAA,EAAK,MAAM,CAAA;AAAA,IAC9C,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,MAAA,EAAQ,SAAS,MAAM,KAAA;AAC3B,MAAA,MAAM,IAAI,kBAAkB,6BAAA,CAA8B,WAAA,EAAa,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAe,CAAA;AAAA,IAChH;AAEA,IAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,iBAAA,CAAkB,8BAA8B,QAAA,EAAU,EAAE,MAAA,EAAQ,UAAA,EAAY,CAAA;AAEvG,IAAA,OAAO,MAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,qBAAA,GAAwB,OAAO,KAAA,EAAe,MAAA,KAA8C;AAChG,IAAA,IAAI,MAAA;AAEJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAM,UAAA,CAAW,KAAA,EAAO,MAAM,WAAA,CAAY,KAAK,GAAG,MAAM,CAAA;AAAA,IACnE,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,MAAA,EAAQ,SAAS,MAAM,KAAA;AAC3B,MAAA,MAAM,IAAI,kBAAkB,6BAAA,CAA8B,WAAA,EAAa,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAe,CAAA;AAAA,IAChH;AAEA,IAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,iBAAA,CAAkB,8BAA8B,QAAA,EAAU,EAAE,MAAA,EAAQ,UAAA,EAAY,CAAA;AAEvG,IAAA,IAAI,OAAO,GAAA,IAAO,MAAA,CAAO,GAAA,KAAQ,UAAA,CAAW,QAAQ,MAAM,IAAI,iBAAA,CAAkB,CAAA,YAAA,EAAe,OAAO,GAAG,CAAA,YAAA,CAAA,EAAgB,EAAE,MAAA,EAAQ,kBAAkB,CAAA;AAErJ,IAAA,MAAM,iBAAiB,CAAC,MAAA,CAAO,OAAO,EAAE,EAAE,IAAA,EAAK;AAE/C,IAAA,IAAI,CAAC,eAAe,IAAA,CAAK,CAAC,aAAa,SAAA,CAAU,QAAA,CAAS,QAAQ,CAAC,CAAA;AACjE,MAAA,MAAM,IAAI,kBAAkB,gBAAA,CAAiB,cAAA,EAAgB,SAAS,CAAA,EAAG,EAAE,MAAA,EAAQ,kBAAA,EAAoB,CAAA;AAEzG,IAAA,IAAI,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,IAAA,CAAa,MAAA,CAAO,MAAM,SAAA,IAAa,GAAA,IAAQ,UAAA,CAAW,KAAA,CAAM,GAAA,EAAI;AAC5F,MAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,sBAAA,EAAyB,IAAI,KAAK,MAAA,CAAO,GAAA,GAAM,GAAI,CAAA,CAAE,aAAa,CAAA,CAAA,CAAA,EAAK,EAAE,MAAA,EAAQ,WAAW,CAAA;AAE1H,IAAA,MAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA;AAC3C,IAAA,MAAM,OAAO,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,OAAO,GAAA,GAAM,MAAA;AAE3D,IAAA,IAAI,qBAAA,IAAyB,IAAA,KAAS,MAAA,IAAa,CAAC,kBAAkB,IAAI,CAAA;AACxE,MAAA,MAAM,IAAI,kBAAkB,CAAA,sDAAA,EAAyD,IAAI,MAAM,EAAE,MAAA,EAAQ,oBAAoB,CAAA;AAE/H,IAAA,OAAO,IAAI,UAAA,CAAW,MAAA,EAAQ,aAAA,EAAe,OAAO,eAAe,CAAA;AAAA,EACrE,CAAA;AAEA,EAAA,MAAM,MAAA,GAAS,OAAO,KAAA,EAAe,MAAA,KAA8C;AACjF,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,MAAM,IAAA,EAAK,EAAG,MAAM,IAAI,kBAAkB,6BAAA,CAA8B,KAAA,EAAO,EAAE,MAAA,EAAQ,aAAa,CAAA;AAExI,MAAA,OAAO,aAAA,KAAkB,mBAAA,GAAsB,MAAM,qBAAA,CAAsB,MAAM,IAAA,EAAK,EAAG,MAAM,CAAA,GAAI,MAAM,SAAA,CAAU,KAAA,CAAM,IAAA,IAAQ,MAAM,CAAA;AAAA,IACzI,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,KAAA,YAAiB,iBAAA,GAAoB,KAAA,CAAM,oBAAA,CAAqB,mBAAmB,CAAA,GAAI,KAAA;AAAA,IAC/F;AAAA,EACF,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,QAAA;AAAA,IACA,mBAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,MAAA;AAAA,IACA,MAAA;AAAA,IACA,MAAM,yBAAA,CAA0B,MAAA,EAAQ,MAAA,EAAQ;AAC9C,MAAA,MAAM,KAAA,GAAQ,gBAAgB,MAAM,CAAA;AAEpC,MAAA,IAAI,KAAA,KAAU,MAAA,EAAW,MAAM,IAAI,iBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,gBAAA,EAAkB,mBAAA,EAAqB,CAAA;AAE3H,MAAA,OAAO,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,IAC7B;AAAA,GACF;AACF;AAKO,SAAS,gBAAgB,MAAA,EAAuD;AACrF,EAAA,MAAM,KAAA,GAAQ,yBAAA,CAA0B,IAAA,CAAK,MAAA,IAAU,EAAE,CAAA;AAEzD,EAAA,OAAO,QAAQ,CAAC,CAAA;AAClB;AAOA,eAAsB,YAAY,KAAA,EAAgC;AAChE,EAAA,MAAM,MAAA,GAAS,IAAI,UAAA,CAAW,MAAM,OAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAEpG,EAAA,OAAO,SAAS,CAAC,GAAG,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,IAAA,CAAK,EAAE,CAAC,CAAA,CAAA;AACxF;AAEA,SAAS,uBAAA,CAAwB,SAAuC,QAAA,EAAkD;AACxH,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,EAAU,OAAO,OAAA;AACxC,EAAA,IAAI,CAAC,QAAA;AACH,IAAA,MAAM,IAAIA,yBAAyB,6GAA6G,CAAA;AAElJ,EAAA,OAAO,6BAA6B,QAAQ,CAAA;AAC9C;AAEA,SAAS,6BAA6B,OAAA,EAAuE;AAC3G,EAAA,MAAM,UAAA,GAAa,CAAC,GAAG,IAAI,GAAA,CAAA,CAAK,OAAO,OAAA,KAAY,QAAA,GAAW,CAAC,OAAO,CAAA,GAAI,CAAC,GAAI,OAAA,IAAW,EAAG,CAAA,EAAG,GAAA,CAAI,CAAC,SAAA,KAAc,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,OAAO,CAAC,CAAC,CAAA;AACrJ,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAG,0BAAA,EAA4B,GAAG,oBAAoB,CAAA;AAErE,EAAA,KAAA,MAAW,SAAA,IAAa,UAAA;AACtB,IAAA,IAAI,CAAC,KAAA,CAAM,QAAA,CAAS,SAAS,CAAA;AAC3B,MAAA,MAAM,IAAIA,yBAAyB,CAAA,yCAAA,EAA4C,SAAS,mBAAmB,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA;AAElI,EAAA,OAAO,UAAA,CAAW,MAAA,GAAS,CAAA,GAAI,UAAA,GAAa,MAAA;AAC9C;AAEA,SAAS,mBAAA,CAAoB,SAAgC,SAAA,EAAqD;AAChH,EAAA,MAAM,QAAQ,OAAA,CAAQ,MAAA;AACtB,EAAA,MAAM,SAAS,KAAA,IAAS,CAAC,SAAS,KAAK,CAAA,GAAI,MAAM,YAAA,GAAe,MAAA;AAEhE,EAAA,IAAI,CAAC,MAAA;AACH,IAAA,MAAM,IAAIA,wBAAAA;AAAA,MACR,CAAA,6BAAA,EAAgC,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,CAAA,oIAAA;AAAA,KACtD;AAEF,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,KAAA,MAAW,aAAa,SAAA,EAAW,uBAAA,CAAwB,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,EAAE,MAAM,CAAA;AAE7I,EAAA,OAAO,YAAY;AACjB,IAAA,MAAM,QAAQ,OAAO,MAAA,KAAW,UAAA,GAAa,MAAM,QAAO,GAAI,MAAA;AAE9D,IAAA,IAAI,OAAO,UAAU,QAAA,IAAY,CAAC,OAAO,MAAM,IAAIA,yBAAyB,sDAAsD,CAAA;AAElI,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AACF;AAEA,SAAS,iBAAiB,KAAA,EAAwB;AAChD,EAAA,IAAI;AACF,IAAA,OAAQ,qBAA2C,QAAA,CAAS,MAAA,CAAO,sBAAsB,KAAK,CAAA,CAAE,GAAG,CAAC,CAAA;AAAA,EACtG,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,cAAc,OAAA,EAA0D;AAC/E,EAAA,MAAM,QAAQ,OAAA,CAAQ,MAAA;AAEtB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,IAAI,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,KAAA;AAE5B,EAAA,OAAO,kBAAA,CAAmB;AAAA,IACxB,GAAG,KAAA;AAAA,IACH,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,cAAc,OAAA,CAAQ,YAAA;AAAA,IACtB,wBAAwB,OAAA,CAAQ,sBAAA;AAAA,IAChC,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,OAAO,OAAA,CAAQ;AAAA,GACO,CAAA;AAC1B;AAEA,SAAS,SAAS,KAAA,EAAuC;AACvD,EAAA,OAAO,OAAQ,KAAA,CAAuB,UAAA,KAAe,UAAA,IAAc,OAAQ,MAAuB,MAAA,KAAW,QAAA;AAC/G;AAEA,SAAS,gBAAA,CAAiB,gBAAmC,SAAA,EAAsC;AACjG,EAAA,MAAM,QAAQ,cAAA,CAAe,MAAA,KAAW,CAAA,GAAI,EAAA,GAAK,IAAI,cAAA,CAAe,GAAA,CAAI,CAAC,QAAA,KAAa,IAAI,QAAQ,CAAA,CAAA,CAAG,CAAA,CAAE,IAAA,CAAK,OAAO,CAAC,CAAA,CAAA;AACpH,EAAA,MAAM,QAAA,GAAW,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,KAAa,IAAI,QAAQ,CAAA,CAAA,CAAG,CAAA,CAAE,IAAA,CAAK,MAAM,CAAA;AAEzE,EAAA,OAAO,SAAA,CAAU,MAAA,KAAW,CAAA,GACxB,CAAA,oDAAA,EAAuD,KAAK,CAAA,QAAA,EAAW,QAAQ,CAAA,iDAAA,CAAA,GAC/E,CAAA,oDAAA,EAAuD,KAAK,CAAA,QAAA,EAAW,QAAQ,CAAA,0DAAA,CAAA;AACrF;ACvXO,SAAS,qBAAqB,OAAA,EAA+C;AAClF,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,IAAI,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,GAAI,OAAA,CAAQ,OAAA,IAAW,EAAG,CAAA,CAAE,MAAA,CAAO,CAAC,MAAA,KAA6B,CAAC,CAAC,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC,CAAA;AAEhI,EAAA,IAAI,QAAQ,MAAA,KAAW,CAAA,EAAG,MAAM,IAAIA,yBAAyB,4CAA4C,CAAA;AAEzG,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAASC,WAAAA;AAC/B,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,GAAA;AACvC,EAAA,MAAM,QAAA,GAAA,CAAY,OAAA,CAAQ,mBAAA,IAAuB,KAAA,IAAU,GAAA;AAC3D,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,WAAA,IAAe,IAAA,GAAO,IAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,OAAA,CAAQ,aAAA,IAAiB,UAAU,KAAK,CAAA;AACnE,EAAA,MAAM,WAA8D,EAAC;AAErE,EAAA,MAAM,QAAA,GAA2B;AAAA,IAC/B,WAAA;AAAA,IACA,EAAA,CAAG,MAAc,OAAA,EAA+B;AAC9C,MAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,UAAU,qCAAqC,CAAA;AAEpE,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AAC/B,MAAA,OAAO,QAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,OAAO,QAAA,EAAU;AACrB,MAAA,MAAM,IAAA,GAAO,OAAO,QAAA,CAAS,IAAA,KAAS,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,GAAI,QAAA,CAAS,IAAA;AAEpG,MAAA,IAAI,IAAA,CAAK,aAAa,WAAA,EAAa,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAQ,WAAA,EAAY;AAE7E,MAAA,MAAM,SAAA,GAAY,QAAA,CAAS,QAAA,CAAS,OAAA,EAAS,qBAAqB,SAAS,CAAA;AAC3E,MAAA,IAAI,OAAA,GAAU,2BAAA;AAEd,MAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,QAAA,MAAM,MAAA,GAAS,MAAM,sBAAA,CAAuB,SAAA,EAAW,IAAA,EAAM,MAAA,EAAQ,EAAE,SAAA,EAAW,GAAA,EAAK,KAAA,CAAM,GAAA,EAAI,EAAG,CAAA;AAEpG,QAAA,IAAI,OAAO,KAAA,EAAO;AAChB,UAAA,OAAA,GAAU,EAAA;AACV,UAAA;AAAA,QACF;AAEA,QAAA,OAAA,GAAU,MAAA,CAAO,MAAA;AAAA,MACnB;AAEA,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,OAAA,CAAQ,OAAA,GAAU,IAAI,KAAA,CAAM,OAAO,GAAG,EAAE,MAAA,EAAQ,YAAY,CAAA;AAC5D,QAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,UAAA,EAAW;AAAA,MAC3C;AAEA,MAAA,MAAM,KAAA,GAAQ,qBAAqB,IAAI,CAAA;AAEvC,MAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAQ,YAAA,EAAa;AAEvD,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,QAAA,CAAS,OAAA,EAAS,oBAAA,CAAqB,OAAO,CAAA,EAAG,IAAA,EAAK,IAAK,MAAA,CAAO,KAAA,CAAM,EAAA,IAAM,EAAE,CAAA;AAEzG,MAAA,IAAI,OAAA,IAAW,CAAE,MAAM,KAAA,CAAM,SAAS,OAAA,EAAS,QAAQ,CAAA,EAAI,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,aAAa,KAAA,EAAM;AAE5G,MAAA,IAAI;AACF,QAAA,KAAA,MAAW,EAAE,IAAA,EAAM,OAAA,EAAQ,IAAK,QAAA,EAAU,IAAI,IAAA,KAAS,GAAA,IAAO,IAAA,KAAS,KAAA,CAAM,IAAA,EAAM,MAAM,QAAQ,KAAK,CAAA;AAAA,MACxG,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA;AACxC,QAAA,OAAA,CAAQ,OAAA,GAAU,OAAO,EAAE,MAAA,EAAQ,kBAAkB,OAAA,EAAS,SAAA,EAAW,KAAA,CAAM,IAAA,EAAM,CAAA;AACrF,QAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,kBAAkB,KAAA,EAAM;AAAA,MACxD;AAEA,MAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,WAAW,KAAA,EAAM;AAAA,IACjD;AAAA,GACF;AAEA,EAAA,OAAO,QAAA;AACT;AAKO,SAAS,8BAAA,CAA+B,QAAqBA,WAAAA,EAA8C;AAChH,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAoB;AAErC,EAAA,OAAO;AAAA,IACL,QAAA,CAAS,SAAS,QAAA,EAAU;AAC1B,MAAA,MAAM,GAAA,GAAM,MAAM,GAAA,EAAI;AAEtB,MAAA,KAAA,MAAW,CAAC,EAAA,EAAIC,MAAK,CAAA,IAAK,IAAA,EAAM;AAC9B,QAAA,IAAIA,SAAQ,GAAA,EAAK;AACjB,QAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,MAChB;AAEA,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,OAAO,CAAA;AAE9B,MAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,GAAQ,GAAA,EAAK,OAAO,KAAA;AAE/C,MAAA,IAAA,CAAK,OAAO,OAAO,CAAA;AACnB,MAAA,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,GAAA,GAAM,QAAQ,CAAA;AAChC,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,QAAQ,OAAA,EAAS;AACf,MAAA,IAAA,CAAK,OAAO,OAAO,CAAA;AAAA,IACrB;AAAA,GACF;AACF;AAEA,SAAS,YAAA,CAAa,eAAmE,KAAA,EAAqD;AAC5I,EAAA,IAAI,aAAA,KAAkB,QAAQ,OAAO,EAAE,UAAU,MAAM,IAAA,EAAM,OAAA,EAAS,MAAM,MAAA,EAAU;AACtF,EAAA,IAAI,aAAA,KAAkB,QAAA,EAAU,OAAO,8BAAA,CAA+B,KAAK,CAAA;AAE3E,EAAA,OAAO,aAAA;AACT;AAEA,SAAS,QAAA,CAAS,SAAkE,IAAA,EAAkC;AACpH,EAAA,IAAI,OAAQ,QAAoB,GAAA,KAAQ,UAAA,SAAoB,OAAA,CAAoB,GAAA,CAAI,IAAI,CAAA,IAAK,MAAA;AAE7F,EAAA,MAAM,MAAA,GAAS,KAAK,WAAA,EAAY;AAEhC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAwD,CAAA,EAAG;AACnG,IAAA,IAAI,GAAA,CAAI,WAAA,EAAY,KAAM,MAAA,EAAQ,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA;AAAA,EAC7E;AAEA,EAAA,OAAO,MAAA;AACT;AC3KO,SAAS,qBAAA,CAAsB,OAAA,EAA8C,KAAA,GAAsB,UAAA,CAAW,KAAA,EAAqB;AACxI,EAAA,MAAM,KAAA,GAAQ,QAAQ,OAAO,CAAA;AAE7B,EAAA,OAAO,CAAC,OAAO,IAAA,KAAS;AACtB,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,KAAA,CAAM,OAAO,IAAI,CAAA;AAEpC,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,IAAA,EAAM,YAAY,KAAA,YAAiB,OAAA,GAAU,KAAA,CAAM,OAAA,GAAU,MAAA,CAAU,CAAA;AAEnG,IAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAE9C,IAAA,OAAO,MAAM,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAAA,EAC1C,CAAA;AACF;AAyBO,SAAS,iBAAiB,OAAA,EAAuI;AACtK,EAAA,MAAM,EAAE,QAAO,GAAI,OAAA;AACnB,EAAA,MAAM,KAAA,GAAQ,aAAA,CAAc,OAAA,CAAQ,MAAM,CAAA;AAC1C,EAAA,MAAM,WAAA,GAAA,CAAe,KAAA,IAAS,EAAA,EAAI,KAAA,CAAM,GAAG,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,EAAK,CAAE,IAAA,CAAK,GAAG,CAAA;AAC5E,EAAA,MAAM,SAASH,OAAAA,CAAQ,OAAA,CAAQ,gBAAA,EAAkBI,cAAAA,CAAe,kBAAkB,kBAAkB,CAAA;AACpG,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA0C;AAC9D,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAmD;AAEvE,EAAA,MAAM,KAAA,GAAQ,OAAO,OAAA,KAAqC;AACxD,IAAA,MAAM,KAAA,GAAQ,QAAQ,OAAO,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,OAAO,OAAA,KAAY,QAAA,GAAW,SAAY,OAAA,CAAQ,OAAA;AAE9D,IAAA,OAAO,CAAA,EAAG,GAAA,GAAM,CAAA,IAAA,EAAO,GAAG,KAAK,MAAM,WAAA,CAAY,KAAK,CAAC,CAAA,CAAA,EAAI,OAAA,CAAQ,QAAA,IAAY,EAAE,IAAI,WAAW,CAAA,CAAA;AAAA,EAClG,CAAA;AAEA,EAAA,MAAM,QAAA,GAAyC,OAAO,OAAA,EAAS,MAAA,KAAW;AACxE,IAAA,MAAM,QAAA,GAAW,QAAQ,OAAO,CAAA;AAEhC,IAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAIC,YAAY,yEAAyE,CAAA;AAE9G,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,OAAQ,CAAA;AAChC,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAE9B,IAAA,IAAI,MAAA,IAAU,OAAO,UAAA,CAAW,KAAA,CAAM,KAAI,GAAI,MAAA,CAAO,WAAW,OAAO,MAAA;AAEvE,IAAA,IAAI,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAE7B,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAA,GAAU,OAAO,MAAA,CACd,QAAA,CAAS,EAAE,YAAA,EAAc,UAAU,MAAA,EAAQ,KAAA,EAAO,QAAA,EAAU,OAAA,CAAQ,UAAU,MAAA,EAAQ,CAAA,CACtF,IAAA,CAAK,CAAC,QAAA,KAAa;AAClB,QAAA,MAAM,KAAA,GAAQ,yBAAyB,QAAA,EAAU,MAAA,CAAO,WAAW,KAAA,CAAM,GAAA,IAAO,MAAM,CAAA;AAEtF,QAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,KAAK,CAAA;AACtB,QAAA,OAAO,KAAA;AAAA,MACT,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAC,CAAA;AACpC,MAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,OAAO,CAAA;AAAA,IAC1B;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,UAAA,GAA6C,OAAO,OAAA,EAAS,WAAA,KAAgB;AACjF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,OAAO,CAAA;AAE/B,IAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,OAAA,CAAQ,GAAA,CAAI,GAAG,GAAG,WAAA,KAAgB,WAAA,EAAa,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAA;AAAA,EACpG,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,UAAA;AAAA,IACA,KAAA,CAAM,OAAA,EAAS,KAAA,GAAQ,MAAA,CAAO,WAAW,KAAA,EAAO;AAC9C,MAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAC5B,QAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA;AACvC,QAAA,MAAM,OAAO,OAAA,CAAQ,IAAA,GAAO,MAAM,OAAA,CAAQ,aAAY,GAAI,MAAA;AAC1D,QAAA,MAAM,OAAA,GAAU,CAACC,MAAAA,KAAwC;AACvD,UAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAE3C,UAAA,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA,EAAGA,MAAAA,CAAM,SAAS,CAAA,CAAA,EAAIA,MAAAA,CAAM,WAAW,CAAA,CAAE,CAAA;AAEtE,UAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,GAAA,EAAK,EAAE,QAAQ,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,QAAQ,OAAA,CAAQ,MAAA,EAAQ,QAAA,EAAU,OAAA,CAAQ,UAAU,CAAA;AAAA,QACzH,CAAA;AAEA,QAAA,MAAM,KAAA,GAAQ,MAAM,QAAA,CAAS,OAAA,EAAS,QAAQ,MAAM,CAAA;AACpD,QAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,KAAK,CAAA;AAEpC,QAAA,IAAI,SAAS,MAAA,KAAW,GAAA,IAAO,iBAAA,CAAkB,QAAQ,GAAG,OAAO,QAAA;AAEnE,QAAA,MAAM,UAAA,CAAW,OAAA,EAAU,KAAA,CAAM,WAAW,CAAA;AAE5C,QAAA,OAAO,QAAQ,MAAM,QAAA,CAAS,OAAA,EAAS,OAAA,CAAQ,MAAM,CAAC,CAAA;AAAA,MACxD,CAAA;AAAA,IACF;AAAA,GACF;AACF;AAKA,SAAS,kBAAkB,QAAA,EAA6B;AACtD,EAAA,OAAO,0BAAA,CAA2B,SAAS,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAC,CAAA,EAAG,UAAU,iBAAA,CAAkB,8BAAA;AAC3G;AAEA,SAAS,QAAQ,OAAA,EAAkE;AACjF,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AAErB,EAAA,OAAO,OAAO,OAAA,KAAY,QAAA,GAAW,OAAA,GAAU,OAAA,CAAQ,KAAA;AACzD","file":"index.js","sourcesContent":["import {\n AuthioClaimTypes,\n parseResourceAccess,\n type AuthioCallerKind,\n type AuthioCredentialForm,\n type AuthioIntrospectionResult,\n type AuthioResourceAccess,\n type AuthioResourceAccessSource,\n} from \"@hyper.authio/client\";\n\n/*\n The party acting for the subject, from the `act` claim (RFC 8693): who exchanged the token, nested when the chain\n * is longer.\n /\nexport interface AuthioActor {\n readonly clientId: string \| undefined;\n readonly subject: string \| undefined;\n /* `name`, on an impersonation: the administrator's display name. /\n readonly name: string \| undefined;\n readonly actor: AuthioActor \| undefined;\n}\n\n/\n The administrator who impersonates the subject (an `act` with `sub` and no `client_id`).\n /\nexport interface AuthioImpersonator {\n readonly subject: string;\n readonly name: string \| undefined;\n}\n\n/\n Introspection `token_type` values that stand for an access token: `Bearer`, and `api_key` for a consumer's API key.\n /\nconst accessTokenTypes = new Set([\"bearer\", \"api_key\"]);\n\n/\n Where the user reads flat (non-`_resource_access`) roles and groups from.\n /\nexport interface AuthioUserClaimSettings {\n /*\n Claims holding role names directly, such as one written by a claim mapper with the Role source. They count for\n * `hasRole` without a source filter. Defaults to `[\"role\"]`.\n /\n roleClaims?: readonly string[];\n /\n Claims holding group names, such as one written by a claim mapper with the Group source. Defaults to\n * `[\"groups\"]`.\n /\n groupClaims?: readonly string[];\n}\n\n/\n The caller of an API, read from a validated access token, an introspection answer, or both (the token's claims and\n * those of the answer the token does not carry, as `activeCheck` reads it): identity, every form of permission Authio\n * issues, and the raw claims for anything else.\n /\nexport class AuthioUser {\n /* `sub`: the person's id, or the credential's for a machine caller. /\n readonly subject: string;\n /\n Who called: `user` (a person signed in), `client` (a client as itself), `consumer` (a machine consumer of a\n * client) or `account_credential` (a credential of an Authio account).\n /\n readonly kind: AuthioCallerKind;\n /\n How a machine caller proved who it is (`client_secret`, `personal_access_token`, `api_key`,\n * `consumer_api_key`); `undefined` for a person or a client.\n /\n readonly credentialForm: AuthioCredentialForm \| undefined;\n /* `consumer_name`, for a consumer. /\n readonly consumerName: string \| undefined;\n /* `credential_name`, for an account credential. /\n readonly credentialName: string \| undefined;\n /* `owner_user_id`: the person who made the credential. /\n readonly ownerUserId: string \| undefined;\n /\n `owner_username`: the person who made the credential. On an account credential Authio wrote it to\n * `consumer_name` before, which is read when `owner_username` is absent.\n /\n readonly ownerUsername: string \| undefined;\n /* `credential_realm`: the one realm an account credential is limited to. /\n readonly credentialRealm: string \| undefined;\n /* `credential_client`: the one client an account credential is limited to. /\n readonly credentialClient: string \| undefined;\n /* Whether an administrator impersonates the subject. /\n readonly impersonated: boolean;\n /* The administrator impersonating the subject. /\n readonly impersonator: AuthioImpersonator \| undefined;\n /* Whether a client acts for the subject through a delegation (`act` with `client_id`). /\n readonly delegated: boolean;\n /* The clients acting for the subject, outermost first. /\n readonly actorChain: readonly string[];\n /* `auth_time`, in seconds since the epoch. /\n readonly authTime: number \| undefined;\n /* The client the token was issued to (`client_id`, RFC 9068 §2.2, else `azp`). /\n readonly clientId: string \| undefined;\n /* `sid`. /\n readonly sessionId: string \| undefined;\n /* `jti`. /\n readonly tokenId: string \| undefined;\n /* `aud`. /\n readonly audiences: readonly string[];\n /* The granted scopes. /\n readonly scopes: readonly string[];\n /* The roles of the seven `_resource_access` claims, with their source and permissions. /\n readonly resourceAccess: AuthioResourceAccess;\n /** Every role name: the `_resource_access` roles, then the flat role claims. /\n readonly roles: readonly string[];\n /** Resource → every method any role allows on it. /\n readonly permissions: Readonly<Record<string, readonly string[]>>;\n /* The group names of the group claims. /\n readonly groups: readonly string[];\n /* `org_id`. /\n readonly organizationId: string \| undefined;\n /* `org_alias`. /\n readonly organizationAlias: string \| undefined;\n /* `account_id`. /\n readonly accountId: string \| undefined;\n /* `acr`. /\n readonly acr: string \| undefined;\n /* `acr` as a number: 1 one factor, 2 several, 3 one of them phishing-resistant. /\n readonly authenticationLevel: number \| undefined;\n /* `amr`. /\n readonly authenticationMethods: readonly string[];\n /* `idp`. /\n readonly identityProvider: string \| undefined;\n /* `auth_time`. /\n readonly authenticatedAt: Date \| undefined;\n /* `act`. /\n readonly actor: AuthioActor \| undefined;\n /* `delegation_id`. /\n readonly delegationId: string \| undefined;\n readonly email: string \| undefined;\n readonly emailVerified: boolean \| undefined;\n readonly name: string \| undefined;\n readonly preferredUsername: string \| undefined;\n /* `credential_type`, on a token issued to an account credential or a consumer. /\n readonly credentialType: string \| undefined;\n /* `credential_id`. /\n readonly credentialId: string \| undefined;\n /\n Every claim, as the token or the introspection answer carried it (with `activeCheck`, the token's, plus the\n * answer's the token does not carry).\n /\n readonly claims: Readonly<Record<string, unknown>>;\n /* The access token the user was read from. Not enumerable, so it stays out of logs and JSON. /\n declare readonly token: string \| undefined;\n\n private readonly flatRoles: readonly string[];\n\n /\n @param claims The token's payload, or the introspection answer's members.\n * @param settings Where flat roles and groups are read from.\n * @param token The access token, kept for forwarding and on-behalf-of.\n * @param source Where the claims come from: a JWT (default) or an introspection answer. An introspection answer for\n * a consumer that reports no `exp` and no `actor_type` is the consumer's API key (Authio reports no lifetime for a\n * key), so its `credentialForm` is `consumer_api_key`.\n /\n constructor(\n claims: Readonly<Record<string, unknown>>,\n settings: AuthioUserClaimSettings = {},\n token?: string,\n source: \"token\" \| \"introspection\" = \"token\",\n ) {\n const text = (name: string) => (typeof claims[name] === \"string\" && claims[name] ? (claims[name] as string) : undefined);\n\n this.claims = Object.freeze({ ...claims });\n this.subject = text(AuthioClaimTypes.Subject) ?? \"\";\n this.clientId = text(AuthioClaimTypes.ClientId) ?? text(AuthioClaimTypes.AuthorizedParty);\n this.sessionId = text(AuthioClaimTypes.SessionId);\n this.tokenId = text(AuthioClaimTypes.JwtId);\n this.audiences = Object.freeze(distinct(valuesOf(claims[AuthioClaimTypes.Audience])));\n this.scopes = Object.freeze(distinct(valuesOf(claims[AuthioClaimTypes.Scope]).flatMap((scope) => scope.split(/\\s+/)).filter(Boolean)));\n this.resourceAccess = parseResourceAccess(claims);\n this.flatRoles = Object.freeze((settings.roleClaims ?? [\"role\"]).flatMap((name) => valuesOf(claims[name])));\n this.roles = Object.freeze(distinctIgnoringCase([...this.resourceAccess.roles, ...this.flatRoles]));\n this.permissions = this.resourceAccess.permissions;\n this.groups = Object.freeze(distinct((settings.groupClaims ?? [\"groups\"]).flatMap((name) => valuesOf(claims[name]))));\n this.organizationId = text(AuthioClaimTypes.OrganizationId);\n this.organizationAlias = text(AuthioClaimTypes.OrganizationAlias);\n this.accountId = text(AuthioClaimTypes.AccountId);\n this.acr = valuesOf(claims[AuthioClaimTypes.AuthenticationContextClass])[0];\n this.authenticationLevel = this.acr !== undefined && /^\\d+$/.test(this.acr) ? Number(this.acr) : undefined;\n this.authenticationMethods = Object.freeze(distinctIgnoringCase(valuesOf(claims[AuthioClaimTypes.AuthenticationMethods])));\n this.identityProvider = text(AuthioClaimTypes.IdentityProvider);\n this.authenticatedAt = toDate(claims[AuthioClaimTypes.AuthTime]);\n this.actor = readActor(claims[AuthioClaimTypes.Actor]);\n this.delegationId = text(AuthioClaimTypes.DelegationId);\n this.email = text(AuthioClaimTypes.Email);\n this.emailVerified = toBoolean(claims[AuthioClaimTypes.EmailVerified]);\n this.name = text(AuthioClaimTypes.Name);\n this.preferredUsername = text(AuthioClaimTypes.PreferredUsername);\n this.credentialType = text(AuthioClaimTypes.CredentialType);\n this.credentialId = text(AuthioClaimTypes.CredentialId);\n this.authTime = toSeconds(claims[AuthioClaimTypes.AuthTime]);\n this.kind =\n this.credentialType === \"client_consumer\"\n ? \"consumer\"\n : this.credentialType === \"account_secret\"\n ? \"account_credential\"\n : this.authTime !== undefined\n ? \"user\"\n : \"client\";\n\n const machine = this.kind === \"consumer\" \|\| this.kind === \"account_credential\";\n\n const keyIntrospected = source === \"introspection\" && this.kind === \"consumer\" && claims[AuthioClaimTypes.Expiration] === undefined;\n\n this.credentialForm = machine\n ? ((text(AuthioClaimTypes.ActorType) as AuthioCredentialForm \| undefined) ?? (keyIntrospected ? \"consumer_api_key\" : \"client_secret\"))\n : undefined;\n this.consumerName = this.kind === \"consumer\" ? text(AuthioClaimTypes.ConsumerName) : undefined;\n this.credentialName = text(AuthioClaimTypes.CredentialName);\n this.ownerUserId = text(AuthioClaimTypes.OwnerUserId);\n this.ownerUsername =\n text(AuthioClaimTypes.OwnerUsername) ?? (this.kind === \"account_credential\" ? text(AuthioClaimTypes.ConsumerName) : undefined);\n this.credentialRealm = text(AuthioClaimTypes.CredentialRealm);\n this.credentialClient = text(AuthioClaimTypes.CredentialClient);\n this.delegated = this.actor?.clientId !== undefined;\n this.actorChain = Object.freeze(chainOf(this.actor));\n this.impersonated = !this.delegated && this.actor?.subject !== undefined;\n this.impersonator = this.impersonated ? Object.freeze({ subject: this.actor!.subject!, name: this.actor!.name }) : undefined;\n\n Object.defineProperty(this, \"token\", { value: token, enumerable: false });\n }\n\n /\n Reads the caller from an introspection answer: `client_id` becomes `azp`, `username` becomes\n * `preferred_username`, and `token_type` becomes `typ` unless it is `api_key` (a consumer's API key).\n /\n static fromIntrospection(result: AuthioIntrospectionResult, settings: AuthioUserClaimSettings = {}, token?: string): AuthioUser {\n return new AuthioUser(claimsOfIntrospection(result), settings, token, \"introspection\");\n }\n\n /* Whether the scope was granted. /\n hasScope(scope: string): boolean {\n return this.scopes.includes(scope);\n }\n\n /\n Whether the user holds the role. Without sources, from any `_resource_access` claim or a flat role claim; with\n sources, only from those `_resource_access` claims.\n /\n hasRole(role: string, options: { sources?: readonly AuthioResourceAccessSource[] } = {}): boolean {\n if (!role) return false;\n if (options.sources && options.sources.length > 0) return this.resourceAccess.hasRole(role, options.sources);\n\n const wanted = role.toLowerCase();\n\n return this.resourceAccess.hasRole(role) \|\| this.flatRoles.some((name) => name.toLowerCase() === wanted);\n }\n\n /*\n Authio's grant rule: whether a role (from any source, or only from the given ones) allows `method` on\n * `resource`. Case-insensitive.\n /\n hasPermission(resource: string, method: string, options: { sources?: readonly AuthioResourceAccessSource[] } = {}): boolean {\n return this.resourceAccess.grants(resource, method, options.sources);\n }\n\n /* Whether the user is in the group (exact match). /\n hasGroup(group: string): boolean {\n return this.groups.includes(group);\n }\n\n /\n Whether the claim is present (not `null`), and, given values, whether it holds one of them (exact match; an\n * array claim matches when any item does).\n /\n hasClaim(type: string, ...values: string[]): boolean {\n const present = this.claimValues(type);\n\n return values.length === 0 ? present.length > 0 : present.some((value) => values.includes(value));\n }\n\n /\n The claim's values as text: one for a scalar, one per item for an array, JSON text for an object.\n /\n claimValues(type: string): string[] {\n return valuesOf(this.claims[type]);\n }\n\n /* Every member but the raw token. /\n toJSON(): Record<string, unknown> {\n const { flatRoles: _flatRoles, ...members } = this as unknown as Record<string, unknown>;\n\n return { ...members, resourceAccess: this.resourceAccess.entries };\n }\n}\n\n/\n The claims an introspection answer stands for, named as in a JWT.\n \n @internal\n /\nexport function claimsOfIntrospection(result: AuthioIntrospectionResult): Record<string, unknown> {\n const { active: _active, token_type: tokenType, username, ...members } = result;\n const claims: Record<string, unknown> = { ...members };\n\n if (typeof tokenType === \"string\" && claims.typ === undefined && tokenType.toLowerCase() !== \"api_key\") claims.typ = tokenType;\n if (typeof username === \"string\" && claims.preferred_username === undefined) claims.preferred_username = username;\n if (typeof result.client_id === \"string\" && claims.azp === undefined) claims.azp = result.client_id;\n\n return claims;\n}\n\n/\n Whether an introspection `token_type` stands for an access token.\n \n @internal\n /\nexport function isAccessTokenType(type: string): boolean {\n return accessTokenTypes.has(type.toLowerCase());\n}\n\n/\n A claim's values as text.\n \n @internal\n /\nexport function valuesOf(value: unknown): string[] {\n if (value === undefined \|\| value === null) return [];\n if (Array.isArray(value)) return value.flatMap((item) => (item === null \|\| item === undefined ? [] : [toText(item)]));\n\n if (typeof value === \"string\" && value.startsWith(\"[\")) {\n try {\n const parsed = JSON.parse(value) as unknown;\n\n if (Array.isArray(parsed)) return valuesOf(parsed);\n } catch {\n return [value];\n }\n }\n\n return [toText(value)];\n}\n\nfunction toText(value: unknown): string {\n return typeof value === \"string\" ? value : typeof value === \"object\" ? JSON.stringify(value) : String(value);\n}\n\nfunction readActor(value: unknown, depth = 0): AuthioActor \| undefined {\n let actor = value;\n\n if (typeof actor === \"string\") {\n try {\n actor = JSON.parse(actor);\n } catch {\n return undefined;\n }\n }\n\n if (!actor \|\| typeof actor !== \"object\" \|\| Array.isArray(actor) \|\| depth > 16) return undefined;\n\n const record = actor as Record<string, unknown>;\n\n return Object.freeze({\n clientId: typeof record.client_id === \"string\" && record.client_id ? record.client_id : undefined,\n subject: typeof record.sub === \"string\" && record.sub ? record.sub : undefined,\n name: typeof record.name === \"string\" && record.name ? record.name : undefined,\n actor: readActor(record.act, depth + 1),\n });\n}\n\nfunction chainOf(actor: AuthioActor \| undefined): string[] {\n const chain: string[] = [];\n\n for (let current = actor; current; current = current.actor) if (current.clientId) chain.push(current.clientId);\n\n return chain;\n}\n\nfunction toSeconds(value: unknown): number \| undefined {\n return typeof value === \"number\" && Number.isFinite(value) ? value : typeof value === \"string\" && /^\\d+$/.test(value) ? Number(value) : undefined;\n}\n\nfunction toDate(value: unknown): Date \| undefined {\n const seconds = typeof value === \"number\" ? value : typeof value === \"string\" && /^\\d+$/.test(value) ? Number(value) : undefined;\n\n return seconds === undefined ? undefined : new Date(seconds 1000);\n}\n\nfunction toBoolean(value: unknown): boolean \| undefined {\n if (typeof value === \"boolean\") return value;\n if (value === \"true\") return true;\n if (value === \"false\") return false;\n\n return undefined;\n}\n\nfunction distinct(values: readonly string[]): string[] {\n return [...new Set(values)];\n}\n\nfunction distinctIgnoringCase(values: readonly string[]): string[] {\n const seen = new Set<string>();\n\n return values.filter((value) => {\n const key = value.toLowerCase();\n\n if (seen.has(key)) return false;\n\n seen.add(key);\n return true;\n });\n}\n","import { systemClock, type AuthioCallerKind, type AuthioClock, type AuthioResourceAccessSource } from \"@hyper.authio/client\";\nimport type { AuthioUser } from \"./user.js\";\n\n/*\n How several required values combine.\n /\nexport type AuthioMatch = \"any\" \| \"all\";\n\n/\n Why a rule refused the caller.\n /\nexport interface AuthioRuleFailure {\n /* What is missing, in words. /\n readonly message: string;\n /\n The RFC 6750 / RFC 9470 error to put in `WWW-Authenticate`: `insufficient_scope` for scopes,\n * `insufficient_user_authentication` for `acr`/`amr`, none otherwise.\n /\n readonly error?: \"insufficient_scope\" \| \"insufficient_user_authentication\";\n /* The required scopes, for `insufficient_scope`. /\n readonly scope?: string;\n /* The context classes to ask for again, for `insufficient_user_authentication` (RFC 9470 `acr_values`). /\n readonly acrValues?: string;\n /* How old the sign-in may be, in seconds, for `insufficient_user_authentication` (RFC 9470 `max_age`). /\n readonly maxAge?: number;\n}\n\n/\n A condition on the caller.\n /\nexport interface AuthioRule {\n /* What the rule requires, for logs. /\n readonly description: string;\n /* `undefined` when the caller satisfies the rule, else why not. /\n check(user: AuthioUser): AuthioRuleFailure \| undefined;\n}\n\n/\n Checks every rule. On refusal the message joins every rule's. When a rule other than a step-up fails (a scope, role,\n * permission, group, claim, organization, client or caller kind), no stronger sign-in can satisfy the request: the\n * refusal is a `403`, with the first such rule's error (`insufficient_scope`) or none, and never asks for a step-up.\n * Only when every failing rule asks for a stronger or more recent sign-in is the error `insufficient_user_authentication`,\n * with the strongest `acr_values` and the shortest `max_age` they ask for.\n /\nexport function authorize(user: AuthioUser, ...rules: AuthioRule[]): AuthioRuleFailure \| undefined {\n const failures = rules.map((rule) => rule.check(user)).filter((failure): failure is AuthioRuleFailure => failure !== undefined);\n\n if (failures.length === 0) return undefined;\n\n const others = failures.filter((failure) => failure.error !== \"insufficient_user_authentication\");\n const stepUps = others.length === 0 ? failures : [];\n const bearer = stepUps[0] ?? others.find((failure) => failure.error);\n const acrValues = strongestAcr(stepUps.map((failure) => failure.acrValues));\n const maxAges = stepUps.map((failure) => failure.maxAge).filter((value): value is number => value !== undefined);\n\n return {\n message: failures.map((failure) => failure.message).join(\" \"),\n ...(bearer?.error ? { error: bearer.error } : {}),\n ...(bearer?.scope ? { scope: bearer.scope } : {}),\n ...(acrValues ? { acrValues } : {}),\n ...(maxAges.length > 0 ? { maxAge: Math.min(...maxAges) } : {}),\n };\n}\n\n/\n Requires granted scopes.\n /\nexport function requireScope(scopes: string \| readonly string[], match: AuthioMatch = \"any\"): AuthioRule {\n const required = listOf(scopes, \"scope\");\n\n return {\n description: `Authio scope (${match}): ${required.join(\" \")}`,\n check: (user) =>\n satisfies(required, match, (scope) => user.hasScope(scope))\n ? undefined\n : {\n message: `The token lacks the required scope (${match}): ${required.join(\" \")}.`,\n error: \"insufficient_scope\",\n scope: required.join(\" \"),\n },\n };\n}\n\n/\n Requires roles, from any source or only from the given `_resource_access` claims.\n /\nexport function requireRole(\n roles: string \| readonly string[],\n options: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] } = {},\n): AuthioRule {\n const required = listOf(roles, \"role\");\n const match = options.match ?? \"any\";\n const from = describeSources(options.sources);\n\n return {\n description: `Authio role (${match}): ${required.join(\", \")}${from}`,\n check: (user) =>\n satisfies(required, match, (role) => user.hasRole(role, { sources: options.sources }))\n ? undefined\n : { message: `The caller lacks the required role (${match}): ${required.join(\", \")}${from}.` },\n };\n}\n\n/*\n Requires a permission (`method` on `resource`), granted by a role from any source or only from the given ones.\n /\nexport function requirePermission(resource: string, method: string, options: { sources?: readonly AuthioResourceAccessSource[] } = {}): AuthioRule {\n if (!resource?.trim() \|\| !method?.trim()) throw new TypeError(\"A permission needs a resource and a method.\");\n\n const from = describeSources(options.sources);\n\n return {\n description: `Authio permission: ${resource}:${method}${from}`,\n check: (user) =>\n user.hasPermission(resource, method, { sources: options.sources }) ? undefined : { message: `The caller lacks the permission ${resource}:${method}${from}.` },\n };\n}\n\n/\n Requires groups, read from the group claims (a claim mapper with the Group source).\n /\nexport function requireGroup(groups: string \| readonly string[], match: AuthioMatch = \"any\"): AuthioRule {\n const required = listOf(groups, \"group\");\n\n return {\n description: `Authio group (${match}): ${required.join(\", \")}`,\n check: (user) =>\n satisfies(required, match, (group) => user.hasGroup(group))\n ? undefined\n : { message: `The caller is not in the required group (${match}): ${required.join(\", \")}.` },\n };\n}\n\n/\n Requires a claim: present, or holding one of the given values. Fits claim-mapper claims, the user's own claims and\n * any other claim Authio issues.\n /\nexport function requireClaim(type: string, ...values: string[]): AuthioRule {\n if (!type?.trim()) throw new TypeError(\"A claim rule needs a claim type.\");\n\n return {\n description: values.length === 0 ? `Authio claim: ${type}` : `Authio claim: ${type} in ${values.join(\", \")}`,\n check: (user) =>\n user.hasClaim(type, ...values)\n ? undefined\n : { message: values.length === 0 ? `The token lacks the claim ${type}.` : `The token's claim ${type} is not one of: ${values.join(\", \")}.` },\n };\n}\n\n/\n Requires an organization context, or a given organization (alias or id, case-insensitive).\n /\nexport function requireOrganization(organization?: string): AuthioRule {\n const wanted = organization?.trim() \|\| undefined;\n\n return {\n description: `Authio organization: ${wanted ?? \"any\"}`,\n check: (user) => {\n const satisfied =\n !!user.organizationId &&\n (!wanted \|\|\n user.organizationAlias?.toLowerCase() === wanted.toLowerCase() \|\|\n user.organizationId.toLowerCase() === wanted.toLowerCase());\n\n return satisfied\n ? undefined\n : { message: wanted ? `The token is not in the organization ${wanted}.` : \"The token has no organization context.\" };\n },\n };\n}\n\n/\n Requires a minimum authentication level (`acr`): 1 one factor, 2 several, 3 one of them phishing-resistant. The\n * refusal asks for that level again (`acr_values`), and for a sign-in at most `maxAge` seconds old when given.\n /\nexport function requireAuthenticationLevel(minimumLevel: number, options: { maxAge?: number; clock?: AuthioClock } = {}): AuthioRule {\n if (!Number.isInteger(minimumLevel) \|\| minimumLevel < 0) throw new RangeError(\"The minimum level must be a non-negative integer.\");\n\n const recency = options.maxAge === undefined ? undefined : requireRecentAuthentication(options.maxAge, { clock: options.clock });\n\n return {\n description: `Authio authentication level >= ${minimumLevel}${recency ? `, ${recency.description}` : \"\"}`,\n check: (user) => {\n const levelMet = user.authenticationLevel !== undefined && user.authenticationLevel >= minimumLevel;\n const recent = recency?.check(user);\n\n if (levelMet && !recent) return undefined;\n\n return {\n message: [levelMet ? undefined : `The authentication level must be at least ${minimumLevel}.`, recent?.message].filter(Boolean).join(\" \"),\n error: \"insufficient_user_authentication\",\n acrValues: String(minimumLevel),\n ...(options.maxAge !== undefined ? { maxAge: options.maxAge } : {}),\n };\n },\n };\n}\n\n/\n The context class each authentication method implies when an API asks for it again (Authio's `acr` levels).\n /\nconst methodLevels: Readonly<Record<string, string>> = { mfa: \"2\", otp: \"2\", mca: \"2\", sms: \"2\", swk: \"3\", hwk: \"3\" };\n\n/\n Requires authentication methods (`amr`, case-insensitive), such as `otp`, `swk` or `fed`. The refusal asks for the\n * context class the methods imply (`2` for `mfa`/`otp`/`mca`, `3` for `swk`/`hwk`), or for `acrValues` when given.\n /\nexport function requireAuthenticationMethod(\n methods: string \| readonly string[],\n match: AuthioMatch = \"any\",\n options: { acrValues?: string } = {},\n): AuthioRule {\n const required = listOf(methods, \"authentication method\");\n const levels = required.map((method) => methodLevels[method.toLowerCase()]).filter((level): level is string => level !== undefined);\n const acrValues = options.acrValues ?? (levels.length === 0 ? undefined : match === \"all\" ? strongestAcr(levels) : weakestAcr(levels));\n\n return {\n description: `Authio authentication method (${match}): ${required.join(\", \")}`,\n check: (user) => {\n const used = user.authenticationMethods.map((method) => method.toLowerCase());\n\n return satisfies(required, match, (method) => used.includes(method.toLowerCase()))\n ? undefined\n : {\n message: `The user must authenticate with (${match}): ${required.join(\", \")}.`,\n error: \"insufficient_user_authentication\",\n ...(acrValues ? { acrValues } : {}),\n };\n },\n };\n}\n\n/\n Requires a sign-in at most `maxAge` seconds old (`auth_time`); the refusal asks for it with `max_age` (RFC 9470).\n /\nexport function requireRecentAuthentication(maxAge: number, options: { clock?: AuthioClock } = {}): AuthioRule {\n if (!Number.isInteger(maxAge) \|\| maxAge < 0) throw new RangeError(\"maxAge must be a non-negative whole number of seconds.\");\n\n const clock = options.clock ?? systemClock;\n\n return {\n description: `Authio sign-in at most ${maxAge} s old`,\n check: (user) =>\n user.authTime !== undefined && clock.now() - user.authTime 1000 <= maxAge * 1000\n ? undefined\n : {\n message:\n user.authTime === undefined\n ? `The token carries no sign-in time; a sign-in at most ${maxAge} seconds old is required.`\n : `The sign-in must be at most ${maxAge} seconds old.`,\n error: \"insufficient_user_authentication\",\n maxAge,\n },\n };\n}\n\n/*\n Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`.\n /\nexport function requireCallerKind(kinds: AuthioCallerKind \| readonly AuthioCallerKind[]): AuthioRule {\n const required = listOf(kinds, \"caller kind\") as AuthioCallerKind[];\n\n return {\n description: `Authio caller kind: ${required.join(\", \")}`,\n check: (user) => (required.includes(user.kind) ? undefined : { message: `The caller is a ${user.kind}, not one of: ${required.join(\", \")}.` }),\n };\n}\n\n/\n Requires the token to have been issued to one of the clients (`client_id`, else `azp`).\n /\nexport function requireClient(clientIds: string \| readonly string[]): AuthioRule {\n const required = listOf(clientIds, \"client id\");\n\n return {\n description: `Authio client: ${required.join(\", \")}`,\n check: (user) =>\n user.clientId !== undefined && required.includes(user.clientId)\n ? undefined\n : { message: `The token was not issued to an accepted client (${required.join(\", \")}).` },\n };\n}\n\n/\n Requires every rule.\n /\nexport function allOf(...rules: AuthioRule[]): AuthioRule {\n return {\n description: rules.map((rule) => rule.description).join(\" and \"),\n check: (user) => authorize(user, ...rules),\n };\n}\n\n/\n Requires at least one rule; the refusal is the first rule's.\n /\nexport function anyOf(...rules: AuthioRule[]): AuthioRule {\n if (rules.length === 0) throw new TypeError(\"anyOf needs at least one rule.\");\n\n return {\n description: rules.map((rule) => rule.description).join(\" or \"),\n check: (user) => {\n const failures = rules.map((rule) => rule.check(user));\n\n return failures.some((failure) => failure === undefined) ? undefined : failures[0];\n },\n };\n}\n\nfunction listOf(values: string \| readonly string[], name: string): string[] {\n const list = [...new Set((typeof values === \"string\" ? [values] : [...values]).filter((value) => value?.trim()))];\n\n if (list.length === 0) throw new TypeError(`At least one ${name} is required.`);\n\n return list;\n}\n\nfunction satisfies(required: readonly string[], match: AuthioMatch, holds: (value: string) => boolean): boolean {\n return match === \"all\" ? required.every(holds) : required.some(holds);\n}\n\nfunction strongestAcr(values: readonly (string \| undefined)[]): string \| undefined {\n return rankAcr(values, (left, right) => right - left);\n}\n\nfunction weakestAcr(values: readonly (string \| undefined)[]): string \| undefined {\n return rankAcr(values, (left, right) => left - right);\n}\n\nfunction rankAcr(values: readonly (string \| undefined)[], order: (left: number, right: number) => number): string \| undefined {\n const known = values.filter((value): value is string => !!value);\n const numeric = known.filter((value) => /^\\d+$/.test(value)).sort((left, right) => order(Number(left), Number(right)));\n\n return numeric[0] ?? known[0];\n}\n\nfunction describeSources(sources: readonly AuthioResourceAccessSource[] \| undefined): string {\n return sources && sources.length > 0 ? ` from ${[...new Set(sources)].join(\", \")}` : \"\";\n}\n","import { AuthioError, type AuthioTokenFailure } from \"@hyper.authio/client\";\nimport type { AuthioRuleFailure } from \"./rules.js\";\n\n/\n The request carries no valid access token: answer `401` with `wwwAuthenticate`.\n /\nexport class AuthioBearerError extends AuthioError {\n readonly status = 401;\n /* `invalid_token`, or `undefined` when the request had no token at all (RFC 6750 §3.1). /\n readonly error: \"invalid_token\" \| undefined;\n /* Why the token was refused, safe to send to the caller. /\n readonly description: string \| undefined;\n /* Why the token was refused, as a stable code; `undefined` when there was no token or Authio could not be asked. /\n readonly reason: AuthioTokenFailure \| \"inactive\" \| \"unconfirmed\" \| undefined;\n /* The API's protected resource metadata URL (RFC 9728), sent as `resource_metadata` when configured. /\n readonly resourceMetadata: string \| undefined;\n\n constructor(\n description: string \| undefined,\n options: {\n error?: \"invalid_token\" \| undefined;\n cause?: unknown;\n reason?: AuthioTokenFailure \| \"inactive\" \| \"unconfirmed\";\n resourceMetadata?: string;\n } = {},\n ) {\n super(description ?? \"A valid Authio access token is required.\", { cause: options.cause });\n this.error = \"error\" in options ? options.error : \"invalid_token\";\n this.description = description === undefined ? undefined : toHeaderText(description);\n this.reason = options.reason;\n this.resourceMetadata = options.resourceMetadata;\n }\n\n /* The same refusal, pointing at the API's protected resource metadata. /\n withResourceMetadata(resourceMetadata: string \| undefined): AuthioBearerError {\n if (!resourceMetadata \|\| resourceMetadata === this.resourceMetadata) return this;\n\n return new AuthioBearerError(this.description, { error: this.error, cause: this.cause, reason: this.reason, resourceMetadata });\n }\n\n /* The `WWW-Authenticate` value. /\n get wwwAuthenticate(): string {\n const parameters: string[] = [];\n\n if (this.error) parameters.push(`error=\"${this.error}\"`);\n if (this.error && this.description) parameters.push(`error_description=\"${this.description}\"`);\n if (this.resourceMetadata) parameters.push(`resource_metadata=\"${escapeQuoted(this.resourceMetadata)}\"`);\n\n return parameters.length === 0 ? \"Bearer\" : `Bearer ${parameters.join(\", \")}`;\n }\n}\n\n/\n A rule refused a caller whose token is valid. A refusal asking for a stronger or more recent sign-in\n * (`insufficient_user_authentication`) answers `401`, as RFC 9470 §3 has it, naming the protected resource metadata\n * (`resource_metadata`, RFC 9728 §5.1) when the API publishes it; every other refusal answers `403`, with\n * `wwwAuthenticate` when it is about scopes (`insufficient_scope`, RFC 6750 §3.1).\n /\nexport class AuthioForbiddenError extends AuthioError {\n /* `401` for a step-up (`insufficient_user_authentication`), `403` otherwise. /\n readonly status: 401 \| 403;\n readonly failure: AuthioRuleFailure;\n /* The API's protected resource metadata URL (RFC 9728), sent as `resource_metadata` with a step-up `401`. /\n readonly resourceMetadata: string \| undefined;\n\n constructor(failure: AuthioRuleFailure, options: { resourceMetadata?: string } = {}) {\n super(failure.message);\n this.failure = failure;\n this.status = failure.error === \"insufficient_user_authentication\" ? 401 : 403;\n this.resourceMetadata = options.resourceMetadata;\n }\n\n /* The same refusal, pointing at the API's protected resource metadata. /\n withResourceMetadata(resourceMetadata: string \| undefined): AuthioForbiddenError {\n if (!resourceMetadata \|\| resourceMetadata === this.resourceMetadata) return this;\n\n return new AuthioForbiddenError(this.failure, { resourceMetadata });\n }\n\n /\n The `WWW-Authenticate` value, or `undefined` when the refusal is not about scopes or the sign-in. A step-up `401`\n * carries `resource_metadata` when `resourceMetadata` is set.\n /\n get wwwAuthenticate(): string \| undefined {\n const challenge = toForbiddenChallenge(this.failure);\n\n return challenge && this.status === 401 && this.resourceMetadata ? `${challenge}, resource_metadata=\"${escapeQuoted(this.resourceMetadata)}\"` : challenge;\n }\n}\n\n/\n The `WWW-Authenticate` value of a refusal: `insufficient_scope` (with `scope`) or `insufficient_user_authentication`\n * (with `acr_values` and `max_age`, RFC 9470).\n /\nexport function toForbiddenChallenge(failure: AuthioRuleFailure): string \| undefined {\n if (!failure.error) return undefined;\n\n const parameters = [`error=\"${failure.error}\"`, `error_description=\"${escapeQuoted(toHeaderText(failure.message))}\"`];\n\n if (failure.scope) parameters.push(`scope=\"${escapeQuoted(failure.scope)}\"`);\n if (failure.acrValues) parameters.push(`acr_values=\"${escapeQuoted(failure.acrValues)}\"`);\n if (failure.maxAge !== undefined) parameters.push(`max_age=${failure.maxAge}`);\n\n return `Bearer ${parameters.join(\", \")}`;\n}\n\n/\n Problem details (RFC 9457) for a `401` or `403`, with the refusal's `status`: a step-up refusal is `401`\n * Unauthorized and carries `error`, `acr_values` and `max_age`.\n /\nexport function toProblemDetails(error: AuthioBearerError \| AuthioForbiddenError): Record<string, unknown> {\n if (error instanceof AuthioBearerError)\n return {\n type: unauthorizedType,\n title: \"Unauthorized\",\n status: 401,\n detail: \"A valid Authio access token is required.\",\n };\n\n return {\n type: error.status === 401 ? unauthorizedType : \"https://tools.ietf.org/html/rfc9110#section-15.5.4\",\n title: error.status === 401 ? \"Unauthorized\" : \"Forbidden\",\n status: error.status,\n detail: error.failure.message \|\| \"The caller is not allowed to access this resource.\",\n ...(error.failure.error ? { error: error.failure.error } : {}),\n ...(error.failure.scope ? { scope: error.failure.scope } : {}),\n ...(error.failure.acrValues ? { acr_values: error.failure.acrValues } : {}),\n ...(error.failure.maxAge !== undefined ? { max_age: error.failure.maxAge } : {}),\n };\n}\n\nconst unauthorizedType = \"https://tools.ietf.org/html/rfc9110#section-15.5.2\";\n\n/\n Keeps only the characters RFC 6750 §3 allows in an `error_description`.\n \n @internal\n /\nexport function toHeaderText(text: string): string {\n return [...text].map((character) => (character >= \" \" && character <= \"~\" && character !== '\"' && character !== \"\\\\\" ? character : \"?\")).join(\"\");\n}\n\nfunction escapeQuoted(value: string): string {\n return value.replace(/\\\\/g, \"\\\\\\\\\").replace(/\"/g, '\\\\\"');\n}\n","import { AuthioConfigurationError, AuthioDefaults, resolveIssuer, type AuthioConnectionOptions } from \"@hyper.authio/client\";\n\n/\n What an API publishes about itself as a protected resource (RFC 9728).\n /\nexport interface AuthioProtectedResourceMetadataOptions extends Pick<AuthioConnectionOptions, \"issuer\" \| \"authority\" \| \"realm\"> {\n /* The API's resource identifier (RFC 8707), such as `https://orders.example.com/api`. Required. /\n resource: string;\n /* Scopes a client can ask for to call the API. /\n scopesSupported?: readonly string[];\n /* A name to show to people. /\n resourceName?: string;\n /* A page documenting the API. /\n resourceDocumentation?: string;\n /* Further members, sent as given. /\n extra?: Record<string, unknown>;\n}\n\n/\n The protected resource metadata document (RFC 9728 §2).\n /\nexport interface AuthioProtectedResourceMetadata {\n resource: string;\n authorization_servers: string[];\n bearer_methods_supported: string[];\n scopes_supported?: string[];\n resource_name?: string;\n resource_documentation?: string;\n [member: string]: unknown;\n}\n\n/\n Where a resource's metadata is published: `{origin}/.well-known/oauth-protected-resource{path}` (RFC 9728 §3.1),\n * the path being the resource's own, without a trailing slash.\n /\nexport function protectedResourceMetadataUrl(resource: string): string {\n const url = parseResource(resource);\n const path = url.pathname.replace(/\\/+$/, \"\");\n\n return `${url.origin}${AuthioDefaults.ProtectedResourceMetadataPath}${path}`;\n}\n\n/\n The path a resource's metadata is served at on the API itself: `/.well-known/oauth-protected-resource{path}`.\n /\nexport function protectedResourceMetadataPath(resource: string): string {\n return new URL(protectedResourceMetadataUrl(resource)).pathname;\n}\n\n/\n Builds the API's protected resource metadata: the resource, the realm's issuer as its authorization server, bearer\n * tokens in the `Authorization` header, and the optional scopes, name and documentation.\n /\nexport function createProtectedResourceMetadata(options: AuthioProtectedResourceMetadataOptions): AuthioProtectedResourceMetadata {\n parseResource(options.resource);\n\n const document: AuthioProtectedResourceMetadata = {\n ...options.extra,\n resource: options.resource,\n authorization_servers: [resolveIssuer(options)],\n bearer_methods_supported: [\"header\"],\n };\n\n if (options.scopesSupported && options.scopesSupported.length > 0) document.scopes_supported = [...options.scopesSupported];\n if (options.resourceName) document.resource_name = options.resourceName;\n if (options.resourceDocumentation) document.resource_documentation = options.resourceDocumentation;\n\n return document;\n}\n\nfunction parseResource(resource: string): URL {\n let url: URL;\n\n try {\n url = new URL(resource);\n } catch (error) {\n throw new AuthioConfigurationError(`The resource '${resource}' is not an absolute URL.`, { cause: error });\n }\n\n if (url.hash) throw new AuthioConfigurationError(`The resource '${resource}' must not carry a fragment (RFC 8707).`);\n\n return url;\n}\n","import {\n AuthioAsymmetricAlgorithms,\n AuthioConfigurationError,\n AuthioHmacAlgorithms,\n AuthioTokenTypes,\n AuthioTokenValidationError,\n createAuthioClient,\n createAuthioDiscoveryClient,\n createAuthioSigningKeys,\n createAuthioTokenDecrypter,\n encryptionKeyFromFile,\n isAuthioTokenEncrypted,\n requireHmacSecretLength,\n resolveConnection,\n seconds,\n requireAccessTokenType,\n verifyAuthioJwt,\n withClientSecret,\n type AuthioClient,\n type AuthioClientOptions,\n type AuthioConnection,\n type AuthioConnectionOptions,\n type AuthioDiscoveryClient,\n type AuthioEncryptionKeySource,\n type AuthioIntrospectionResult,\n} from \"@hyper.authio/client\";\nimport { decodeProtectedHeader, type JWTPayload } from \"jose\";\nimport { AuthioBearerError } from \"./errors.js\";\nimport { protectedResourceMetadataUrl } from \"./resource-metadata.js\";\nimport { AuthioUser, claimsOfIntrospection, isAccessTokenType, type AuthioUserClaimSettings } from \"./user.js\";\n\n/\n Whether and how Authio's introspection endpoint takes part in validating a token.\n \n - `none`: the JWT is validated locally (signature, issuer, audience, lifetime) and the caller is read from it alone.\n * Fastest; a revoked token stays valid until it expires. A lightweight access token carries no roles, permissions,\n * plan, profile or email, so it needs one of the modes below.\n * - `activeCheck`: validated locally, then confirmed active by introspection (cached per `jti`). The caller is read\n * from the token, and the introspection answer adds the claims the token does not carry: the answer has every claim\n * of the complete token, so a lightweight access token's roles and permissions are read too. A claim the token\n * carries keeps the token's value, which its signature vouches for (the answer names a single `aud`).\n * - `introspectionOnly`: introspection alone, for opaque (reference) tokens, or encrypted ones without the key. The\n * caller is read from the answer.\n /\nexport type AuthioIntrospectionMode = \"none\" \| \"activeCheck\" \| \"introspectionOnly\";\n\n/\n How an API validates Authio access tokens.\n /\nexport interface AuthioVerifierOptions extends AuthioConnectionOptions, AuthioUserClaimSettings {\n /* The audiences this API accepts: its resource identifier (RFC 8707) or client id. Required unless `resource` is set. /\n audiences?: string \| readonly string[];\n /\n The API's own resource identifier (RFC 8707), such as `https://orders.example.com`. Added to `audiences`, and\n * the `resource` of its protected resource metadata (RFC 9728).\n /\n resource?: string;\n /\n Points `401` challenges at the API's protected resource metadata (RFC 9728) with `resource_metadata`: `true`\n * for `{origin of resource}/.well-known/oauth-protected-resource{path of resource}`, or the URL itself. Off by default.\n /\n resourceMetadata?: boolean \| string;\n /* Scopes every request must carry (all of them); `authioBearer` answers `403 insufficient_scope` otherwise. /\n requiredScopes?: readonly string[];\n /* Defaults to `none`. /\n introspection?: AuthioIntrospectionMode;\n /\n The API's confidential client, for introspection: a client already created, or its options (issuer settings are\n * taken from these options when absent). It must be the client the resource server names as its introspection\n * client, since Authio answers introspection according to who asks.\n /\n client?: AuthioClient \| Omit<AuthioClientOptions, keyof AuthioConnectionOptions>;\n /* Seconds an active introspection answer is kept (never past the token's expiry). Defaults to 30. /\n introspectionCacheDuration?: number;\n /* Seconds of clock skew tolerated on `exp` and `nbf`. Defaults to 30. /\n clockSkew?: number;\n /\n The algorithm (or algorithms) access tokens are signed with, as the client registered in Authio signs them:\n * RS/PS/ES 256/384/512, or HS256/384/512 verified with the `clientSecret` of `client` (its UTF-8 octets, at least\n * 32, 48 or 64 bytes as RFC 7518 §3.2 asks). Only the client's own API holds that secret, so only it validates an HS\n token locally; any other API validates such tokens with introspection. Left out, the asymmetric algorithms of the\n * realm's keys are accepted, and never HS.\n /\n accessTokenSignedResponseAlg?: string \| readonly string[];\n /*\n Refuses a token whose `typ` claim is present and not `Bearer` (an ID token, for one). Defaults to `true`. A JWT\n * whose header `typ` is not `at+jwt` (RFC 9068 §4) is refused whatever this says.\n /\n rejectNonAccessTokens?: boolean;\n /\n The private half of the encryption key Authio encrypts this API's access tokens to (the resource server's or its\n * client's), so encrypted tokens are decrypted and validated locally (RSA-OAEP, RSA-OAEP-256).\n /\n clientEncryptionKey?: AuthioEncryptionKeySource;\n /* A PEM or JWK file holding `clientEncryptionKey` (Node only). /\n clientEncryptionKeyPath?: string;\n /\n The key management algorithms (`alg`) decrypted. Defaults to RSA-OAEP and RSA-OAEP-256; RSA1_5 cannot be listed,\n * because Node cannot decrypt it.\n /\n encryptionAlgorithms?: readonly string[];\n /* The content encryption algorithms (`enc`) decrypted. Defaults to A128CBC-HS256, A192CBC-HS384, A256CBC-HS512. /\n encryptionMethods?: readonly string[];\n /* Accepted for parity with the other Authio SDKs; RSA1_5 stays refused, because Node cannot decrypt it. /\n allowLegacyEncryptionAlgorithms?: boolean;\n}\n\n/\n Validates Authio access tokens and reads the caller.\n /\nexport interface AuthioVerifier {\n /* The connection settings. /\n readonly connection: AuthioConnection;\n /* The discovery document. /\n readonly discovery: AuthioDiscoveryClient;\n /* The accepted audiences. /\n readonly audiences: readonly string[];\n /* The API's resource identifier, when configured. /\n readonly resource: string \| undefined;\n /* The protected resource metadata URL sent in challenges, when turned on. /\n readonly resourceMetadataUrl: string \| undefined;\n /* Scopes every request must carry. /\n readonly requiredScopes: readonly string[];\n /* The introspection mode. /\n readonly introspection: AuthioIntrospectionMode;\n /* The client used for introspection, when there is one. /\n readonly client: AuthioClient \| undefined;\n /\n Validates a token and reads the caller.\n \n @throws AuthioBearerError when the token is not valid for this API.\n /\n verify(token: string, signal?: AbortSignal): Promise<AuthioUser>;\n /\n Validates the token of an `Authorization: Bearer` header.\n \n @throws AuthioBearerError without an error code when there is no bearer token, with `invalid_token` when it is\n * not valid.\n /\n verifyAuthorizationHeader(header: string \| null \| undefined, signal?: AbortSignal): Promise<AuthioUser>;\n}\n\n/\n Error descriptions of the refusals the SDK makes itself.\n /\nexport const AuthioBearerErrorDescriptions = {\n Inactive:\n \"Authio reports the token as not active to this API's client. It was revoked or has expired or its session ended; or this API's client is not the introspection client of the resource server the token is for.\",\n Unconfirmed: \"Authio could not be reached to confirm that the token is active.\",\n Empty: \"The token is empty.\",\n Encrypted: \"The token is encrypted; set clientEncryptionKey to decrypt it, or validate it with introspection ('introspectionOnly').\",\n SigningKeysUnavailable: \"Authio could not be reached to read its signing keys.\",\n Symmetric:\n \"The token is signed with the client's secret (HS): set accessTokenSignedResponseAlg and the client's clientSecret to validate it locally, or validate it with introspection ('introspectionOnly').\",\n} as const;\n\nconst maxCachedAnswers = 10_000;\n\n/*\n Creates a token verifier.\n \n @throws AuthioConfigurationError when no audience is given, or introspection is asked for without a client.\n /\nexport function createAuthioVerifier(options: AuthioVerifierOptions): AuthioVerifier {\n const resource = options.resource?.trim() \|\| undefined;\n const given = typeof options.audiences === \"string\" ? [options.audiences] : [...(options.audiences ?? [])];\n const audiences = [...new Set([...given, ...(resource ? [resource] : [])].filter((value) => value?.trim()))];\n\n if (audiences.length === 0)\n throw new AuthioConfigurationError(\"The Authio verifier needs at least one audience: the API's resource identifier or client id.\");\n\n const connection = resolveConnection(options);\n const discovery = createAuthioDiscoveryClient(connection);\n const introspection = options.introspection ?? \"none\";\n const client = resolveClient(options);\n\n if (introspection !== \"none\" && !client)\n throw new AuthioConfigurationError(\n `Authio introspection ('${introspection}') needs the API's confidential client: pass options.client with its clientId and clientSecret or private key.`,\n );\n\n const resourceMetadataUrl = resolveResourceMetadata(options.resourceMetadata, resource);\n const cacheDurationMs = seconds(options.introspectionCacheDuration, 30, \"introspectionCacheDuration\");\n const clockSkew = seconds(options.clockSkew, 30, \"clockSkew\") / 1000;\n const algorithms = resolveAccessTokenAlgorithms(options.accessTokenSignedResponseAlg);\n const symmetric = algorithms?.filter((algorithm) => (AuthioHmacAlgorithms as readonly string[]).includes(algorithm)) ?? [];\n const clientSecret = symmetric.length > 0 ? resolveClientSecret(options, symmetric) : undefined;\n const rejectNonAccessTokens = options.rejectNonAccessTokens ?? true;\n const claimSettings: AuthioUserClaimSettings = { roleClaims: options.roleClaims, groupClaims: options.groupClaims };\n const cache = new Map<string, { result: AuthioIntrospectionResult; until: number }>();\n const signingKeys = createAuthioSigningKeys(connection, discovery);\n const encryptionKey =\n options.clientEncryptionKey ?? (options.clientEncryptionKeyPath ? encryptionKeyFromFile(options.clientEncryptionKeyPath) : undefined);\n const decrypt =\n encryptionKey === undefined\n ? undefined\n : createAuthioTokenDecrypter(encryptionKey, {\n setting: options.clientEncryptionKey === undefined ? \"clientEncryptionKeyPath\" : \"clientEncryptionKey\",\n allowLegacyEncryptionAlgorithms: options.allowLegacyEncryptionAlgorithms,\n encryptionAlgorithms: options.encryptionAlgorithms,\n encryptionMethods: options.encryptionMethods,\n });\n const requiredScopes = Object.freeze([...new Set((options.requiredScopes ?? []).filter((scope) => scope?.trim()))]);\n\n const introspect = async (token: string, key: string, signal?: AbortSignal): Promise<AuthioIntrospectionResult \| undefined> => {\n const now = connection.clock.now();\n const cached = cache.get(key);\n\n if (cached && cached.until > now) return cached.result;\n\n cache.delete(key);\n\n const result = await client!.introspect(token, { tokenTypeHint: AuthioTokenTypes.AccessToken, signal });\n\n if (!result.active) return undefined;\n\n const until = Math.min(now + cacheDurationMs, typeof result.exp === \"number\" ? result.exp 1000 : Number.POSITIVE_INFINITY);\n\n if (until > now) {\n if (cache.size >= maxCachedAnswers) cache.delete(cache.keys().next().value!);\n cache.set(key, { result, until });\n }\n\n return result;\n };\n\n const verifyJwt = async (token: string, signal?: AbortSignal): Promise<AuthioUser> => {\n let signed = token;\n\n if (isAuthioTokenEncrypted(token)) {\n if (!decrypt) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Encrypted, { reason: \"decryption_failed\" });\n\n try {\n signed = await decrypt(token);\n } catch (error) {\n if (error instanceof AuthioTokenValidationError) throw new AuthioBearerError(error.message, { cause: error, reason: error.reason });\n throw error;\n }\n }\n\n let keySet: Awaited<ReturnType<typeof signingKeys>>;\n\n try {\n keySet = withClientSecret(await signingKeys(signal), clientSecret);\n } catch (error) {\n throw new AuthioBearerError(AuthioBearerErrorDescriptions.SigningKeysUnavailable, { cause: error, reason: \"signing_keys_unavailable\" });\n }\n\n let payload: JWTPayload;\n\n try {\n let header: Record<string, unknown>;\n\n ({ payload, header } = await verifyAuthioJwt(signed, keySet, {\n issuer: connection.issuer,\n audiences,\n algorithms,\n clockSkew,\n now: connection.clock.now(),\n }));\n\n requireAccessTokenType(header);\n } catch (error) {\n if (error instanceof AuthioTokenValidationError && error.reason === \"invalid_algorithm\" && symmetric.length === 0 && isSymmetricToken(signed))\n throw new AuthioBearerError(AuthioBearerErrorDescriptions.Symmetric, { cause: error, reason: error.reason });\n if (error instanceof AuthioTokenValidationError) throw new AuthioBearerError(error.message, { cause: error, reason: error.reason });\n throw error;\n }\n\n const type = typeof payload.typ === \"string\" ? payload.typ : undefined;\n\n if (rejectNonAccessTokens && type !== undefined && type.toLowerCase() !== \"bearer\")\n throw new AuthioBearerError(`Only access tokens are accepted; this token's typ is '${type}'.`, { reason: \"not_access_token\" });\n\n if (introspection !== \"activeCheck\") return new AuthioUser(payload, claimSettings, token);\n\n const answer = await confirmActive(token, payload, signal);\n\n return new AuthioUser({ ...claimsOfIntrospection(answer), ...payload }, claimSettings, token);\n };\n\n const confirmActive = async (token: string, payload: JWTPayload, signal?: AbortSignal): Promise<AuthioIntrospectionResult> => {\n const key = payload.jti ? `jti:${payload.jti}` : await keyForToken(token);\n let result: AuthioIntrospectionResult \| undefined;\n\n try {\n result = await introspect(token, key, signal);\n } catch (error) {\n if (signal?.aborted) throw error;\n throw new AuthioBearerError(AuthioBearerErrorDescriptions.Unconfirmed, { cause: error, reason: \"unconfirmed\" });\n }\n\n if (!result) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Inactive, { reason: \"inactive\" });\n\n return result;\n };\n\n const verifyByIntrospection = async (token: string, signal?: AbortSignal): Promise<AuthioUser> => {\n let result: AuthioIntrospectionResult \| undefined;\n\n try {\n result = await introspect(token, await keyForToken(token), signal);\n } catch (error) {\n if (signal?.aborted) throw error;\n throw new AuthioBearerError(AuthioBearerErrorDescriptions.Unconfirmed, { cause: error, reason: \"unconfirmed\" });\n }\n\n if (!result) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Inactive, { reason: \"inactive\" });\n\n if (result.iss && result.iss !== connection.issuer) throw new AuthioBearerError(`The issuer '${result.iss}' is invalid`, { reason: \"invalid_issuer\" });\n\n const tokenAudiences = [result.aud ?? []].flat();\n\n if (!tokenAudiences.some((audience) => audiences.includes(audience)))\n throw new AuthioBearerError(describeAudience(tokenAudiences, audiences), { reason: \"invalid_audience\" });\n\n if (typeof result.exp === \"number\" && (result.exp + clockSkew) * 1000 <= connection.clock.now())\n throw new AuthioBearerError(`The token expired at '${new Date(result.exp * 1000).toISOString()}'`, { reason: \"expired\" });\n\n const claims = claimsOfIntrospection(result);\n const type = typeof claims.typ === \"string\" ? claims.typ : undefined;\n\n if (rejectNonAccessTokens && type !== undefined && !isAccessTokenType(type))\n throw new AuthioBearerError(`Only access tokens are accepted; this token's typ is '${type}'.`, { reason: \"not_access_token\" });\n\n return new AuthioUser(claims, claimSettings, token, \"introspection\");\n };\n\n const verify = async (token: string, signal?: AbortSignal): Promise<AuthioUser> => {\n try {\n if (typeof token !== \"string\" \|\| !token.trim()) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Empty, { reason: \"malformed\" });\n\n return introspection === \"introspectionOnly\" ? await verifyByIntrospection(token.trim(), signal) : await verifyJwt(token.trim(), signal);\n } catch (error) {\n throw error instanceof AuthioBearerError ? error.withResourceMetadata(resourceMetadataUrl) : error;\n }\n };\n\n return {\n connection,\n discovery,\n audiences,\n resource,\n resourceMetadataUrl,\n requiredScopes,\n introspection,\n client,\n verify,\n async verifyAuthorizationHeader(header, signal) {\n const token = readBearerToken(header);\n\n if (token === undefined) throw new AuthioBearerError(undefined, { error: undefined, resourceMetadata: resourceMetadataUrl });\n\n return verify(token, signal);\n },\n };\n}\n\n/*\n The token of an `Authorization: Bearer` header, or `undefined` when the header is absent or of another scheme.\n /\nexport function readBearerToken(header: string \| null \| undefined): string \| undefined {\n const match = /^\\sBearer\\s+(\\S+)\\s$/i.exec(header ?? \"\");\n\n return match?.[1];\n}\n\n/\n The cache key of a token: `token:` and the hex SHA-256 of the token.\n \n @internal\n /\nexport async function keyForToken(token: string): Promise<string> {\n const digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(token)));\n\n return `token:${[...digest].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\")}`;\n}\n\nfunction resolveResourceMetadata(setting: boolean \| string \| undefined, resource: string \| undefined): string \| undefined {\n if (!setting) return undefined;\n if (typeof setting === \"string\") return setting;\n if (!resource)\n throw new AuthioConfigurationError(\"resourceMetadata: true needs the API's resource identifier: set options.resource, or pass the metadata URL.\");\n\n return protectedResourceMetadataUrl(resource);\n}\n\nfunction resolveAccessTokenAlgorithms(setting: string \| readonly string[] \| undefined): string[] \| undefined {\n const algorithms = [...new Set((typeof setting === \"string\" ? [setting] : [...(setting ?? [])]).map((algorithm) => algorithm.trim()).filter(Boolean))];\n const known = [...AuthioAsymmetricAlgorithms, ...AuthioHmacAlgorithms] as readonly string[];\n\n for (const algorithm of algorithms)\n if (!known.includes(algorithm))\n throw new AuthioConfigurationError(`The Authio accessTokenSignedResponseAlg '${algorithm}' is not one of ${known.join(\", \")}.`);\n\n return algorithms.length > 0 ? algorithms : undefined;\n}\n\nfunction resolveClientSecret(options: AuthioVerifierOptions, symmetric: readonly string[]): () => Promise<string> {\n const given = options.client;\n const source = given && !isClient(given) ? given.clientSecret : undefined;\n\n if (!source)\n throw new AuthioConfigurationError(\n `accessTokenSignedResponseAlg ${symmetric.join(\", \")} is verified with the client secret: pass options.client as { clientId, clientSecret } (an AuthioClient does not expose its secret).`,\n );\n\n if (typeof source === \"string\") for (const algorithm of symmetric) requireHmacSecretLength(algorithm, new TextEncoder().encode(source).length);\n\n return async () => {\n const value = typeof source === \"function\" ? await source() : source;\n\n if (typeof value !== \"string\" \|\| !value) throw new AuthioConfigurationError(\"The Authio clientSecret function returned no secret.\");\n\n return value;\n };\n}\n\nfunction isSymmetricToken(token: string): boolean {\n try {\n return (AuthioHmacAlgorithms as readonly string[]).includes(String(decodeProtectedHeader(token).alg));\n } catch {\n return false;\n }\n}\n\nfunction resolveClient(options: AuthioVerifierOptions): AuthioClient \| undefined {\n const given = options.client;\n\n if (!given) return undefined;\n if (isClient(given)) return given;\n\n return createAuthioClient({\n ...given,\n issuer: options.issuer,\n authority: options.authority,\n realm: options.realm,\n requireHttps: options.requireHttps,\n discoveryCacheDuration: options.discoveryCacheDuration,\n httpTimeout: options.httpTimeout,\n fetch: options.fetch,\n clock: options.clock,\n } as AuthioClientOptions);\n}\n\nfunction isClient(value: unknown): value is AuthioClient {\n return typeof (value as AuthioClient).introspect === \"function\" && typeof (value as AuthioClient).tokens === \"object\";\n}\n\nfunction describeAudience(tokenAudiences: readonly string[], audiences: readonly string[]): string {\n const known = tokenAudiences.length === 0 ? \"\" : ` ${tokenAudiences.map((audience) => `'${audience}'`).join(\" and \")}`;\n const accepted = audiences.map((audience) => `'${audience}'`).join(\" or \");\n\n return audiences.length === 1\n ? `The token is not addressed to this API: its audience${known} is not ${accepted}. Request the token for that resource (RFC 8707).`\n : `The token is not addressed to this API: its audience${known} is not ${accepted}. Request the token for one of those resources (RFC 8707).`;\n}\n","import {\n AuthioConfigurationError,\n AuthioWebhookHeaders,\n systemClock,\n tryParseWebhookEvent,\n verifyWebhookSignature,\n type AuthioClock,\n type AuthioTypedWebhookEvent,\n type AuthioWebhookDataByType,\n type AuthioWebhookEvent,\n} from \"@hyper.authio/client\";\n\n/\n Remembers delivered event ids, so a redelivery is acknowledged without running the handlers twice.\n /\nexport interface AuthioWebhookDeduplicationStore {\n /* Records the id; `false` when it was already recorded within the window. /\n tryBegin(eventId: string, windowMs: number): boolean \| Promise<boolean>;\n /* Forgets the id, after a handler failed, so the redelivery runs again. /\n release(eventId: string): void \| Promise<void>;\n}\n\n/\n How webhook deliveries are received.\n /\nexport interface AuthioWebhookOptions {\n /* The webhook's secret. /\n secret?: string;\n /* Several secrets, while one is being rotated; a delivery signed with any of them is accepted. /\n secrets?: readonly string[];\n /* Seconds a signature's timestamp may differ from now. Defaults to 300. /\n tolerance?: number;\n /* `memory` (default), `none`, or a store shared between instances. /\n deduplication?: \"memory\" \| \"none\" \| AuthioWebhookDeduplicationStore;\n /* Seconds a delivered id is remembered. Defaults to 86400. /\n deduplicationWindow?: number;\n /* The largest body accepted, in bytes. Defaults to 1 MiB. /\n maxBodySize?: number;\n /* The clock. /\n clock?: AuthioClock;\n /* Called when a delivery is refused or a handler fails. /\n onError?: (error: unknown, context: { reason: string; eventId?: string; eventType?: string }) => void;\n}\n\n/\n A handler of one event type, or of every type.\n /\nexport type AuthioWebhookHandler<E extends AuthioWebhookEvent = AuthioWebhookEvent> = (event: E) => void \| Promise<void>;\n\n/\n What to answer a delivery with.\n /\nexport interface AuthioWebhookOutcome {\n /* `200` handled, duplicate or ping; `400` unreadable; `401` bad or stale signature; `413` too large; `500` a handler failed. /\n readonly status: 200 \| 400 \| 401 \| 413 \| 500;\n /* Why, for logs. /\n readonly reason: \"handled\" \| \"duplicate\" \| \"unreadable\" \| \"unsigned\" \| \"too_large\" \| \"handler_failed\";\n readonly event?: AuthioWebhookEvent;\n}\n\n/\n Receives Authio webhook deliveries: verifies, deduplicates and dispatches them.\n /\nexport interface AuthioWebhooks {\n /* Handles one event type, typed. /\n on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhooks;\n /* Handles another event type, or `` for every type. /\n on(type: string, handler: AuthioWebhookHandler): AuthioWebhooks;\n /*\n Handles a delivery: the body exactly as received and the request headers.\n /\n handle(delivery: { body: string \| Uint8Array; headers: Headers \| Record<string, string \| string[] \| undefined> }): Promise<AuthioWebhookOutcome>;\n /* The largest body accepted, in bytes. /\n readonly maxBodySize: number;\n}\n\n/\n Creates a webhook receiver. Handlers run in registration order; a `` handler sees every event.\n \n * @throws AuthioConfigurationError when no secret is configured.\n /\nexport function createAuthioWebhooks(options: AuthioWebhookOptions): AuthioWebhooks {\n const secrets = [...new Set([options.secret, ...(options.secrets ?? [])].filter((secret): secret is string => !!secret?.trim()))];\n\n if (secrets.length === 0) throw new AuthioConfigurationError(\"Authio webhooks need the webhook's secret.\");\n\n const clock = options.clock ?? systemClock;\n const tolerance = options.tolerance ?? 300;\n const windowMs = (options.deduplicationWindow ?? 86_400) 1000;\n const maxBodySize = options.maxBodySize ?? 1024 * 1024;\n const store = resolveStore(options.deduplication ?? \"memory\", clock);\n const handlers: { type: string; handler: AuthioWebhookHandler }[] = [];\n\n const webhooks: AuthioWebhooks = {\n maxBodySize,\n on(type: string, handler: AuthioWebhookHandler) {\n if (!type) throw new TypeError(\"An event type (or '') is required.\");\n\n handlers.push({ type, handler });\n return webhooks;\n },\n async handle(delivery) {\n const body = typeof delivery.body === \"string\" ? new TextEncoder().encode(delivery.body) : delivery.body;\n\n if (body.byteLength > maxBodySize) return { status: 413, reason: \"too_large\" };\n\n const signature = headerOf(delivery.headers, AuthioWebhookHeaders.Signature);\n let refusal = \"no webhook secret matched\";\n\n for (const secret of secrets) {\n const result = await verifyWebhookSignature(signature, body, secret, { tolerance, now: clock.now() });\n\n if (result.valid) {\n refusal = \"\";\n break;\n }\n\n refusal = result.reason;\n }\n\n if (refusal) {\n options.onError?.(new Error(refusal), { reason: \"unsigned\" });\n return { status: 401, reason: \"unsigned\" };\n }\n\n const event = tryParseWebhookEvent(body);\n\n if (!event) return { status: 400, reason: \"unreadable\" };\n\n const eventId = headerOf(delivery.headers, AuthioWebhookHeaders.EventId)?.trim() \|\| String(event.id ?? \"\");\n\n if (eventId && !(await store.tryBegin(eventId, windowMs))) return { status: 200, reason: \"duplicate\", event };\n\n try {\n for (const { type, handler } of handlers) if (type === \"\" \|\| type === event.type) await handler(event);\n } catch (error) {\n if (eventId) await store.release(eventId);\n options.onError?.(error, { reason: \"handler_failed\", eventId, eventType: event.type });\n return { status: 500, reason: \"handler_failed\", event };\n }\n\n return { status: 200, reason: \"handled\", event };\n },\n };\n\n return webhooks;\n}\n\n/*\n A deduplication store kept in this process's memory.\n /\nexport function createMemoryDeduplicationStore(clock: AuthioClock = systemClock): AuthioWebhookDeduplicationStore {\n const seen = new Map<string, number>();\n\n return {\n tryBegin(eventId, windowMs) {\n const now = clock.now();\n\n for (const [id, until] of seen) {\n if (until > now) break;\n seen.delete(id);\n }\n\n const until = seen.get(eventId);\n\n if (until !== undefined && until > now) return false;\n\n seen.delete(eventId);\n seen.set(eventId, now + windowMs);\n return true;\n },\n release(eventId) {\n seen.delete(eventId);\n },\n };\n}\n\nfunction resolveStore(deduplication: NonNullable<AuthioWebhookOptions[\"deduplication\"]>, clock: AuthioClock): AuthioWebhookDeduplicationStore {\n if (deduplication === \"none\") return { tryBegin: () => true, release: () => undefined };\n if (deduplication === \"memory\") return createMemoryDeduplicationStore(clock);\n\n return deduplication;\n}\n\nfunction headerOf(headers: Headers \| Record<string, string \| string[] \| undefined>, name: string): string \| undefined {\n if (typeof (headers as Headers).get === \"function\") return (headers as Headers).get(name) ?? undefined;\n\n const wanted = name.toLowerCase();\n\n for (const [key, value] of Object.entries(headers as Record<string, string \| string[] \| undefined>)) {\n if (key.toLowerCase() === wanted) return Array.isArray(value) ? value[0] : value;\n }\n\n return undefined;\n}\n","import {\n AuthioDefaults,\n AuthioError,\n AuthioOAuthErrors,\n parseAuthioBearerChallenge,\n seconds,\n toClientCredentialsToken,\n toScopeString,\n type AuthioClient,\n type AuthioClientCredentialsToken,\n} from \"@hyper.authio/client\";\nimport type { AuthioUser } from \"./user.js\";\nimport { keyForToken } from \"./verifier.js\";\n\n/\n Who a downstream call is made for: a caller read by the verifier, or the incoming access token itself.\n /\nexport type AuthioDownstreamSubject = AuthioUser \| string;\n\n/\n A `fetch` that forwards the caller's own access token, unchanged, to a downstream API that accepts the same\n * audience. Sends no `Authorization` when there is no token.\n /\nexport function createForwardingFetch(subject: AuthioDownstreamSubject \| undefined, inner: typeof fetch = globalThis.fetch): typeof fetch {\n const token = tokenOf(subject);\n\n return (input, init) => {\n if (!token) return inner(input, init);\n\n const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));\n\n headers.set(\"authorization\", `Bearer ${token}`);\n\n return inner(input, { ...init, headers });\n };\n}\n\n/\n Exchanges the caller's token for one addressed to a downstream API (RFC 8693), and caches it.\n /\nexport interface AuthioOnBehalfOf {\n /\n A token for the downstream API on the caller's behalf: cached per incoming `jti` (else token hash), resource and\n * sorted scopes, renewed `tokenRefreshSkew` before expiry (at most half its lifetime); concurrent callers share\n * one exchange.\n \n @throws AuthioError when there is no incoming token.\n /\n getToken(subject: AuthioDownstreamSubject \| undefined, signal?: AbortSignal): Promise<AuthioClientCredentialsToken>;\n /* Drops a cached token; with `accessToken`, only when the cache still holds that token. /\n invalidate(subject: AuthioDownstreamSubject, accessToken?: string): Promise<void>;\n /* A `fetch` that sends the exchanged token, and on a `401` drops it and retries once. /\n fetch(subject: AuthioDownstreamSubject \| undefined, inner?: typeof fetch): typeof fetch;\n}\n\n/\n Creates an on-behalf-of exchanger.\n \n @param options `client` (the API's confidential client), the downstream `resource` and `scopes`.\n /\nexport function createOnBehalfOf(options: { client: AuthioClient; resource?: string; scopes?: Iterable<string> \| string; tokenRefreshSkew?: number }): AuthioOnBehalfOf {\n const { client } = options;\n const scope = toScopeString(options.scopes);\n const sortedScope = (scope ?? \"\").split(\" \").filter(Boolean).sort().join(\" \");\n const skewMs = seconds(options.tokenRefreshSkew, AuthioDefaults.TokenRefreshSkew, \"tokenRefreshSkew\");\n const entries = new Map<string, AuthioClientCredentialsToken>();\n const pending = new Map<string, Promise<AuthioClientCredentialsToken>>();\n\n const keyOf = async (subject: AuthioDownstreamSubject) => {\n const token = tokenOf(subject)!;\n const jti = typeof subject === \"string\" ? undefined : subject.tokenId;\n\n return `${jti ? `jti:${jti}` : await keyForToken(token)}\|${options.resource ?? \"\"}\|${sortedScope}`;\n };\n\n const getToken: AuthioOnBehalfOf[\"getToken\"] = async (subject, signal) => {\n const incoming = tokenOf(subject);\n\n if (!incoming) throw new AuthioError(\"On-behalf-of needs the caller's access token, and the request has none.\");\n\n const key = await keyOf(subject!);\n const cached = entries.get(key);\n\n if (cached && client.connection.clock.now() < cached.refreshAt) return cached;\n\n let request = pending.get(key);\n\n if (!request) {\n request = client.tokens\n .exchange({ subjectToken: incoming, scopes: scope, resource: options.resource, signal })\n .then((response) => {\n const token = toClientCredentialsToken(response, client.connection.clock.now(), skewMs);\n\n entries.set(key, token);\n return token;\n })\n .finally(() => pending.delete(key));\n pending.set(key, request);\n }\n\n return request;\n };\n\n const invalidate: AuthioOnBehalfOf[\"invalidate\"] = async (subject, accessToken) => {\n const key = await keyOf(subject);\n\n if (accessToken === undefined \|\| entries.get(key)?.accessToken === accessToken) entries.delete(key);\n };\n\n return {\n getToken,\n invalidate,\n fetch(subject, inner = client.connection.fetch) {\n return async (input, init) => {\n const request = new Request(input, init);\n const body = request.body ? await request.arrayBuffer() : undefined;\n const attempt = (token: AuthioClientCredentialsToken) => {\n const headers = new Headers(request.headers);\n\n headers.set(\"authorization\", `${token.tokenType} ${token.accessToken}`);\n\n return inner(request.url, { method: request.method, headers, body, signal: request.signal, redirect: request.redirect });\n };\n\n const token = await getToken(subject, request.signal);\n const response = await attempt(token);\n\n if (response.status !== 401 \|\| isStepUpChallenge(response)) return response;\n\n await invalidate(subject!, token.accessToken);\n\n return attempt(await getToken(subject, request.signal));\n };\n },\n };\n}\n\n/\n Whether a `401` asks for a stronger or more recent sign-in (RFC 9470 §3), which a new exchanged token cannot satisfy.\n */\nfunction isStepUpChallenge(response: Response): boolean {\n return parseAuthioBearerChallenge(response.headers.get(\"www-authenticate\"))?.error === AuthioOAuthErrors.InsufficientUserAuthentication;\n}\n\nfunction tokenOf(subject: AuthioDownstreamSubject \| undefined): string \| undefined {\n if (!subject) return undefined;\n\n return typeof subject === \"string\" ? subject : subject.token;\n}\n"]}
1	+ {"version":3,"sources":["../src/user.ts","../src/rules.ts","../src/errors.ts","../src/resource-metadata.ts","../src/verifier.ts","../src/webhooks.ts","../src/downstream.ts"],"names":["seconds","AuthioConfigurationError","systemClock","until","AuthioDefaults","AuthioError","token"],"mappings":";;;;AAiCA,IAAM,mCAAmB,IAAI,GAAA,CAAI,CAAC,QAAA,EAAU,SAAS,CAAC,CAAA;AAuB/C,IAAM,UAAA,GAAN,MAAM,WAAA,CAAW;AAAA;AAAA,EAEb,OAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,cAAA;AAAA;AAAA,EAEA,YAAA;AAAA;AAAA,EAEA,cAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,aAAA;AAAA;AAAA,EAEA,eAAA;AAAA;AAAA,EAEA,gBAAA;AAAA;AAAA,EAEA,YAAA;AAAA;AAAA,EAEA,YAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEA,UAAA;AAAA;AAAA,EAEA,QAAA;AAAA;AAAA,EAEA,QAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEA,OAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEA,MAAA;AAAA;AAAA,EAEA,cAAA;AAAA;AAAA,EAEA,KAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA,EAEA,MAAA;AAAA;AAAA,EAEA,cAAA;AAAA;AAAA,EAEA,iBAAA;AAAA;AAAA,EAEA,SAAA;AAAA;AAAA,EAEA,GAAA;AAAA;AAAA,EAEA,mBAAA;AAAA;AAAA,EAEA,qBAAA;AAAA;AAAA,EAEA,gBAAA;AAAA;AAAA,EAEA,eAAA;AAAA;AAAA,EAEA,KAAA;AAAA;AAAA,EAEA,YAAA;AAAA,EACA,KAAA;AAAA,EACA,aAAA;AAAA,EACA,IAAA;AAAA,EACA,iBAAA;AAAA;AAAA,EAEA,cAAA;AAAA;AAAA,EAEA,YAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA,MAAA;AAAA,EAIQ,SAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUjB,YACE,MAAA,EACA,QAAA,GAAoC,EAAC,EACrC,KAAA,EACA,SAAoC,OAAA,EACpC;AACA,IAAA,MAAM,IAAA,GAAO,CAAC,IAAA,KAAkB,OAAO,MAAA,CAAO,IAAI,CAAA,KAAM,QAAA,IAAY,MAAA,CAAO,IAAI,CAAA,GAAK,MAAA,CAAO,IAAI,CAAA,GAAe,MAAA;AAE9G,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,QAAQ,CAAA;AACzC,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,gBAAA,CAAiB,OAAO,CAAA,IAAK,EAAA;AACjD,IAAA,IAAA,CAAK,WAAW,IAAA,CAAK,gBAAA,CAAiB,QAAQ,CAAA,IAAK,IAAA,CAAK,iBAAiB,eAAe,CAAA;AACxF,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,gBAAA,CAAiB,SAAS,CAAA;AAChD,IAAA,IAAA,CAAK,OAAA,GAAU,IAAA,CAAK,gBAAA,CAAiB,KAAK,CAAA;AAC1C,IAAA,IAAA,CAAK,SAAA,GAAY,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,OAAO,gBAAA,CAAiB,QAAQ,CAAC,CAAC,CAAC,CAAA;AACpF,IAAA,IAAA,CAAK,MAAA,GAAS,OAAO,MAAA,CAAO,QAAA,CAAS,SAAS,MAAA,CAAO,gBAAA,CAAiB,KAAK,CAAC,CAAA,CAAE,QAAQ,CAAC,KAAA,KAAU,MAAM,KAAA,CAAM,KAAK,CAAC,CAAA,CAAE,MAAA,CAAO,OAAO,CAAC,CAAC,CAAA;AACrI,IAAA,IAAA,CAAK,cAAA,GAAiB,oBAAoB,MAAM,CAAA;AAChD,IAAA,IAAA,CAAK,YAAY,MAAA,CAAO,MAAA,CAAA,CAAQ,QAAA,CAAS,UAAA,IAAc,CAAC,MAAM,CAAA,EAAG,OAAA,CAAQ,CAAC,SAAS,QAAA,CAAS,MAAA,CAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAC1G,IAAA,IAAA,CAAK,KAAA,GAAQ,MAAA,CAAO,MAAA,CAAO,oBAAA,CAAqB,CAAC,GAAG,IAAA,CAAK,cAAA,CAAe,KAAA,EAAO,GAAG,IAAA,CAAK,SAAS,CAAC,CAAC,CAAA;AAClG,IAAA,IAAA,CAAK,WAAA,GAAc,KAAK,cAAA,CAAe,WAAA;AACvC,IAAA,IAAA,CAAK,SAAS,MAAA,CAAO,MAAA,CAAO,UAAU,QAAA,CAAS,WAAA,IAAe,CAAC,QAAQ,CAAA,EAAG,OAAA,CAAQ,CAAC,SAAS,QAAA,CAAS,MAAA,CAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;AACpH,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,gBAAA,CAAiB,cAAc,CAAA;AAC1D,IAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA,CAAK,gBAAA,CAAiB,iBAAiB,CAAA;AAChE,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,gBAAA,CAAiB,SAAS,CAAA;AAChD,IAAA,IAAA,CAAK,MAAM,QAAA,CAAS,MAAA,CAAO,iBAAiB,0BAA0B,CAAC,EAAE,CAAC,CAAA;AAC1E,IAAA,IAAA,CAAK,mBAAA,GAAsB,IAAA,CAAK,GAAA,KAAQ,MAAA,IAAa,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,GAAI,MAAA;AACjG,IAAA,IAAA,CAAK,qBAAA,GAAwB,MAAA,CAAO,MAAA,CAAO,oBAAA,CAAqB,QAAA,CAAS,OAAO,gBAAA,CAAiB,qBAAqB,CAAC,CAAC,CAAC,CAAA;AACzH,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,gBAAA,CAAiB,gBAAgB,CAAA;AAC9D,IAAA,IAAA,CAAK,eAAA,GAAkB,MAAA,CAAO,MAAA,CAAO,gBAAA,CAAiB,QAAQ,CAAC,CAAA;AAC/D,IAAA,IAAA,CAAK,KAAA,GAAQ,SAAA,CAAU,MAAA,CAAO,gBAAA,CAAiB,KAAK,CAAC,CAAA;AACrD,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA,CAAK,gBAAA,CAAiB,YAAY,CAAA;AACtD,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA,CAAK,gBAAA,CAAiB,KAAK,CAAA;AACxC,IAAA,IAAA,CAAK,aAAA,GAAgB,SAAA,CAAU,MAAA,CAAO,gBAAA,CAAiB,aAAa,CAAC,CAAA;AACrE,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA,CAAK,gBAAA,CAAiB,IAAI,CAAA;AACtC,IAAA,IAAA,CAAK,iBAAA,GAAoB,IAAA,CAAK,gBAAA,CAAiB,iBAAiB,CAAA;AAChE,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,gBAAA,CAAiB,cAAc,CAAA;AAC1D,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA,CAAK,gBAAA,CAAiB,YAAY,CAAA;AACtD,IAAA,IAAA,CAAK,QAAA,GAAW,SAAA,CAAU,MAAA,CAAO,gBAAA,CAAiB,QAAQ,CAAC,CAAA;AAC3D,IAAA,IAAA,CAAK,IAAA,GACH,IAAA,CAAK,cAAA,KAAmB,iBAAA,GACpB,UAAA,GACA,IAAA,CAAK,cAAA,KAAmB,gBAAA,GACtB,oBAAA,GACA,IAAA,CAAK,QAAA,KAAa,MAAA,GAChB,MAAA,GACA,QAAA;AAEV,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,IAAA,KAAS,UAAA,IAAc,KAAK,IAAA,KAAS,oBAAA;AAE1D,IAAA,MAAM,eAAA,GAAkB,WAAW,eAAA,IAAmB,IAAA,CAAK,SAAS,UAAA,IAAc,MAAA,CAAO,gBAAA,CAAiB,UAAU,CAAA,KAAM,MAAA;AAE1H,IAAA,IAAA,CAAK,cAAA,GAAiB,UAChB,IAAA,CAAK,gBAAA,CAAiB,SAAS,CAAA,KAA2C,eAAA,GAAkB,qBAAqB,eAAA,CAAA,GACnH,MAAA;AACJ,IAAA,IAAA,CAAK,eAAe,IAAA,CAAK,IAAA,KAAS,aAAa,IAAA,CAAK,gBAAA,CAAiB,YAAY,CAAA,GAAI,MAAA;AACrF,IAAA,IAAA,CAAK,cAAA,GAAiB,IAAA,CAAK,gBAAA,CAAiB,cAAc,CAAA;AAC1D,IAAA,IAAA,CAAK,WAAA,GAAc,IAAA,CAAK,gBAAA,CAAiB,WAAW,CAAA;AACpD,IAAA,IAAA,CAAK,aAAA,GACH,IAAA,CAAK,gBAAA,CAAiB,aAAa,CAAA,KAAM,IAAA,CAAK,IAAA,KAAS,oBAAA,GAAuB,IAAA,CAAK,gBAAA,CAAiB,YAAY,CAAA,GAAI,MAAA,CAAA;AACtH,IAAA,IAAA,CAAK,eAAA,GAAkB,IAAA,CAAK,gBAAA,CAAiB,eAAe,CAAA;AAC5D,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA,CAAK,gBAAA,CAAiB,gBAAgB,CAAA;AAC9D,IAAA,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,KAAA,EAAO,QAAA,KAAa,MAAA;AAC1C,IAAA,IAAA,CAAK,aAAa,MAAA,CAAO,MAAA,CAAO,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAC,CAAA;AACnD,IAAA,IAAA,CAAK,eAAe,CAAC,IAAA,CAAK,SAAA,IAAa,IAAA,CAAK,OAAO,OAAA,KAAY,MAAA;AAC/D,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA,CAAK,YAAA,GAAe,MAAA,CAAO,OAAO,EAAE,OAAA,EAAS,IAAA,CAAK,KAAA,CAAO,SAAU,IAAA,EAAM,IAAA,CAAK,KAAA,CAAO,IAAA,EAAM,CAAA,GAAI,MAAA;AAEnH,IAAA,MAAA,CAAO,cAAA,CAAe,MAAM,OAAA,EAAS,EAAE,OAAO,KAAA,EAAO,UAAA,EAAY,OAAO,CAAA;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAO,iBAAA,CAAkB,MAAA,EAAmC,QAAA,GAAoC,IAAI,KAAA,EAA4B;AAC9H,IAAA,OAAO,IAAI,WAAA,CAAW,qBAAA,CAAsB,MAAM,CAAA,EAAG,QAAA,EAAU,OAAO,eAAe,CAAA;AAAA,EACvF;AAAA;AAAA,EAGA,SAAS,KAAA,EAAwB;AAC/B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAA,CAAQ,IAAA,EAAc,OAAA,GAA+D,EAAC,EAAY;AAChG,IAAA,IAAI,CAAC,MAAM,OAAO,KAAA;AAClB,IAAA,IAAI,OAAA,CAAQ,OAAA,IAAW,OAAA,CAAQ,OAAA,CAAQ,MAAA,GAAS,CAAA,EAAG,OAAO,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,IAAA,EAAM,OAAA,CAAQ,OAAO,CAAA;AAE3G,IAAA,MAAM,MAAA,GAAS,KAAK,WAAA,EAAY;AAEhC,IAAA,OAAO,IAAA,CAAK,cAAA,CAAe,OAAA,CAAQ,IAAI,CAAA,IAAK,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,CAAC,IAAA,KAAS,IAAA,CAAK,WAAA,OAAkB,MAAM,CAAA;AAAA,EACzG;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,aAAA,CAAc,QAAA,EAAkB,MAAA,EAAgB,OAAA,GAA+D,EAAC,EAAY;AAC1H,IAAA,OAAO,KAAK,cAAA,CAAe,MAAA,CAAO,QAAA,EAAU,MAAA,EAAQ,QAAQ,OAAO,CAAA;AAAA,EACrE;AAAA;AAAA,EAGA,SAAS,KAAA,EAAwB;AAC/B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,QAAA,CAAS,SAAiB,MAAA,EAA2B;AACnD,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,WAAA,CAAY,IAAI,CAAA;AAErC,IAAA,OAAO,MAAA,CAAO,MAAA,KAAW,CAAA,GAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,OAAA,CAAQ,IAAA,CAAK,CAAC,KAAA,KAAU,MAAA,CAAO,QAAA,CAAS,KAAK,CAAC,CAAA;AAAA,EAClG;AAAA;AAAA;AAAA;AAAA,EAKA,YAAY,IAAA,EAAwB;AAClC,IAAA,OAAO,QAAA,CAAS,IAAA,CAAK,MAAA,CAAO,IAAI,CAAC,CAAA;AAAA,EACnC;AAAA;AAAA,EAGA,MAAA,GAAkC;AAChC,IAAA,MAAM,EAAE,SAAA,EAAW,UAAA,EAAY,GAAG,SAAQ,GAAI,IAAA;AAE9C,IAAA,OAAO,EAAE,GAAG,OAAA,EAAS,cAAA,EAAgB,IAAA,CAAK,eAAe,OAAA,EAAQ;AAAA,EACnE;AACF;AAOO,SAAS,sBAAsB,MAAA,EAA4D;AAChG,EAAA,MAAM,EAAE,QAAQ,OAAA,EAAS,UAAA,EAAY,WAAW,QAAA,EAAU,GAAG,SAAQ,GAAI,MAAA;AACzE,EAAA,MAAM,MAAA,GAAkC,EAAE,GAAG,OAAA,EAAQ;AAErD,EAAA,IAAI,OAAO,SAAA,KAAc,QAAA,IAAY,MAAA,CAAO,GAAA,KAAQ,MAAA,IAAa,SAAA,CAAU,WAAA,EAAY,KAAM,SAAA,EAAW,MAAA,CAAO,GAAA,GAAM,SAAA;AACrH,EAAA,IAAI,OAAO,QAAA,KAAa,QAAA,IAAY,OAAO,kBAAA,KAAuB,MAAA,SAAkB,kBAAA,GAAqB,QAAA;AACzG,EAAA,IAAI,OAAO,OAAO,SAAA,KAAc,QAAA,IAAY,OAAO,GAAA,KAAQ,MAAA,EAAW,MAAA,CAAO,GAAA,GAAM,MAAA,CAAO,SAAA;AAE1F,EAAA,OAAO,MAAA;AACT;AAOO,SAAS,kBAAkB,IAAA,EAAuB;AACvD,EAAA,OAAO,gBAAA,CAAiB,GAAA,CAAI,IAAA,CAAK,WAAA,EAAa,CAAA;AAChD;AAOO,SAAS,SAAS,KAAA,EAA0B;AACjD,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,SAAa,EAAC;AACnD,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,GAAG,OAAO,KAAA,CAAM,QAAQ,CAAC,IAAA,KAAU,SAAS,IAAA,IAAQ,IAAA,KAAS,SAAY,EAAC,GAAI,CAAC,MAAA,CAAO,IAAI,CAAC,CAAE,CAAA;AAEpH,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,EAAG;AACtD,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,KAAK,CAAA;AAE/B,MAAA,IAAI,MAAM,OAAA,CAAQ,MAAM,CAAA,EAAG,OAAO,SAAS,MAAM,CAAA;AAAA,IACnD,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,CAAC,KAAK,CAAA;AAAA,IACf;AAAA,EACF;AAEA,EAAA,OAAO,CAAC,MAAA,CAAO,KAAK,CAAC,CAAA;AACvB;AAEA,SAAS,OAAO,KAAA,EAAwB;AACtC,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,OAAO,KAAA,KAAU,QAAA,GAAW,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA;AAC7G;AAEA,SAAS,SAAA,CAAU,KAAA,EAAgB,KAAA,GAAQ,CAAA,EAA4B;AACrE,EAAA,IAAI,KAAA,GAAQ,KAAA;AAEZ,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,IAAI;AACF,MAAA,KAAA,GAAQ,IAAA,CAAK,MAAM,KAAK,CAAA;AAAA,IAC1B,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,GAAQ,EAAA,EAAI,OAAO,MAAA;AAEtF,EAAA,MAAM,MAAA,GAAS,KAAA;AAEf,EAAA,OAAO,OAAO,MAAA,CAAO;AAAA,IACnB,QAAA,EAAU,OAAO,MAAA,CAAO,SAAA,KAAc,YAAY,MAAA,CAAO,SAAA,GAAY,OAAO,SAAA,GAAY,MAAA;AAAA,IACxF,OAAA,EAAS,OAAO,MAAA,CAAO,GAAA,KAAQ,YAAY,MAAA,CAAO,GAAA,GAAM,OAAO,GAAA,GAAM,MAAA;AAAA,IACrE,IAAA,EAAM,OAAO,MAAA,CAAO,IAAA,KAAS,YAAY,MAAA,CAAO,IAAA,GAAO,OAAO,IAAA,GAAO,MAAA;AAAA,IACrE,KAAA,EAAO,SAAA,CAAU,MAAA,CAAO,GAAA,EAAK,QAAQ,CAAC;AAAA,GACvC,CAAA;AACH;AAEA,SAAS,QAAQ,KAAA,EAA0C;AACzD,EAAA,MAAM,QAAkB,EAAC;AAEzB,EAAA,KAAA,IAAS,OAAA,GAAU,KAAA,EAAO,OAAA,EAAS,OAAA,GAAU,OAAA,CAAQ,KAAA,EAAO,IAAI,OAAA,CAAQ,QAAA,EAAU,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,QAAQ,CAAA;AAE7G,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,UAAU,KAAA,EAAoC;AACrD,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,GAAI,KAAA,GAAQ,OAAO,KAAA,KAAU,YAAY,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA,GAAI,MAAA;AAC1I;AAEA,SAAS,OAAO,KAAA,EAAkC;AAChD,EAAA,MAAMA,QAAAA,GAAU,OAAO,KAAA,KAAU,QAAA,GAAW,QAAQ,OAAO,KAAA,KAAU,QAAA,IAAY,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAA,GAAI,MAAA,CAAO,KAAK,CAAA,GAAI,MAAA;AAEvH,EAAA,OAAOA,aAAY,MAAA,GAAY,MAAA,GAAY,IAAI,IAAA,CAAKA,WAAU,GAAI,CAAA;AACpE;AAEA,SAAS,UAAU,KAAA,EAAqC;AACtD,EAAA,IAAI,OAAO,KAAA,KAAU,SAAA,EAAW,OAAO,KAAA;AACvC,EAAA,IAAI,KAAA,KAAU,QAAQ,OAAO,IAAA;AAC7B,EAAA,IAAI,KAAA,KAAU,SAAS,OAAO,KAAA;AAE9B,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,SAAS,MAAA,EAAqC;AACrD,EAAA,OAAO,CAAC,GAAG,IAAI,GAAA,CAAI,MAAM,CAAC,CAAA;AAC5B;AAEA,SAAS,qBAAqB,MAAA,EAAqC;AACjE,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAE7B,EAAA,OAAO,MAAA,CAAO,MAAA,CAAO,CAAC,KAAA,KAAU;AAC9B,IAAA,MAAM,GAAA,GAAM,MAAM,WAAA,EAAY;AAE9B,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG,OAAO,KAAA;AAE1B,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,OAAO,IAAA;AAAA,EACT,CAAC,CAAA;AACH;ACzWO,SAAS,SAAA,CAAU,SAAqB,KAAA,EAAoD;AACjG,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,OAAA,KAA0C,YAAY,MAAS,CAAA;AAE9H,EAAA,IAAI,QAAA,CAAS,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAElC,EAAA,MAAM,SAAS,QAAA,CAAS,MAAA,CAAO,CAAC,OAAA,KAAY,OAAA,CAAQ,UAAU,kCAAkC,CAAA;AAChG,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,MAAA,KAAW,CAAA,GAAI,WAAW,EAAC;AAClD,EAAA,MAAM,MAAA,GAAS,QAAQ,CAAC,CAAA,IAAK,OAAO,IAAA,CAAK,CAAC,OAAA,KAAY,OAAA,CAAQ,KAAK,CAAA;AACnE,EAAA,MAAM,SAAA,GAAY,aAAa,OAAA,CAAQ,GAAA,CAAI,CAAC,OAAA,KAAY,OAAA,CAAQ,SAAS,CAAC,CAAA;AAC1E,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,CAAC,OAAA,KAAY,OAAA,CAAQ,MAAM,CAAA,CAAE,MAAA,CAAO,CAAC,KAAA,KAA2B,KAAA,KAAU,MAAS,CAAA;AAE/G,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,SAAS,GAAA,CAAI,CAAC,YAAY,OAAA,CAAQ,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAAA,IAC5D,GAAI,QAAQ,KAAA,GAAQ,EAAE,OAAO,MAAA,CAAO,KAAA,KAAU,EAAC;AAAA,IAC/C,GAAI,QAAQ,KAAA,GAAQ,EAAE,OAAO,MAAA,CAAO,KAAA,KAAU,EAAC;AAAA,IAC/C,GAAI,SAAA,GAAY,EAAE,SAAA,KAAc,EAAC;AAAA,IACjC,GAAI,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,EAAE,MAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,GAAG,OAAO,CAAA,EAAE,GAAI;AAAC,GAC/D;AACF;AAKO,SAAS,YAAA,CAAa,MAAA,EAAoC,KAAA,GAAqB,KAAA,EAAmB;AACvG,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,EAAQ,OAAO,CAAA;AAEvC,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,cAAA,EAAiB,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA;AAAA,IAC3D,KAAA,EAAO,CAAC,IAAA,KACN,SAAA,CAAU,QAAA,EAAU,KAAA,EAAO,CAAC,KAAA,KAAU,IAAA,CAAK,QAAA,CAAS,KAAK,CAAC,IACtD,MAAA,GACA;AAAA,MACE,SAAS,CAAA,oCAAA,EAAuC,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,CAAA;AAAA,MAC7E,KAAA,EAAO,oBAAA;AAAA,MACP,KAAA,EAAO,QAAA,CAAS,IAAA,CAAK,GAAG;AAAA;AAC1B,GACR;AACF;AAKO,SAAS,WAAA,CACd,KAAA,EACA,OAAA,GAAoF,EAAC,EACzE;AACZ,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,KAAA,EAAO,MAAM,CAAA;AACrC,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,KAAA;AAC/B,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,OAAA,CAAQ,OAAO,CAAA;AAE5C,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,gBAAgB,KAAK,CAAA,GAAA,EAAM,SAAS,IAAA,CAAK,IAAI,CAAC,CAAA,EAAG,IAAI,CAAA,CAAA;AAAA,IAClE,KAAA,EAAO,CAAC,IAAA,KACN,SAAA,CAAU,QAAA,EAAU,KAAA,EAAO,CAAC,IAAA,KAAS,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,EAAE,SAAS,OAAA,CAAQ,OAAA,EAAS,CAAC,CAAA,GACjF,MAAA,GACA,EAAE,OAAA,EAAS,CAAA,oCAAA,EAAuC,KAAK,CAAA,GAAA,EAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,EAAG,IAAI,CAAA,CAAA,CAAA;AAAI,GACnG;AACF;AAKO,SAAS,iBAAA,CAAkB,QAAA,EAAkB,MAAA,EAAgB,OAAA,GAA+D,EAAC,EAAe;AACjJ,EAAA,IAAI,CAAC,QAAA,EAAU,IAAA,EAAK,IAAK,CAAC,MAAA,EAAQ,IAAA,EAAK,EAAG,MAAM,IAAI,SAAA,CAAU,6CAA6C,CAAA;AAE3G,EAAA,MAAM,IAAA,GAAO,eAAA,CAAgB,OAAA,CAAQ,OAAO,CAAA;AAE5C,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAA,EAAI,MAAM,GAAG,IAAI,CAAA,CAAA;AAAA,IAC5D,KAAA,EAAO,CAAC,IAAA,KACN,IAAA,CAAK,cAAc,QAAA,EAAU,MAAA,EAAQ,EAAE,OAAA,EAAS,OAAA,CAAQ,OAAA,EAAS,CAAA,GAAI,MAAA,GAAY,EAAE,OAAA,EAAS,CAAA,gCAAA,EAAmC,QAAQ,CAAA,CAAA,EAAI,MAAM,CAAA,EAAG,IAAI,CAAA,CAAA,CAAA;AAAI,GAChK;AACF;AAKO,SAAS,YAAA,CAAa,MAAA,EAAoC,KAAA,GAAqB,KAAA,EAAmB;AACvG,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAA,EAAQ,OAAO,CAAA;AAEvC,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,cAAA,EAAiB,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAC5D,KAAA,EAAO,CAAC,IAAA,KACN,SAAA,CAAU,UAAU,KAAA,EAAO,CAAC,KAAA,KAAU,IAAA,CAAK,QAAA,CAAS,KAAK,CAAC,CAAA,GACtD,MAAA,GACA,EAAE,OAAA,EAAS,CAAA,yCAAA,EAA4C,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAI,GACjG;AACF;AAMO,SAAS,YAAA,CAAa,SAAiB,MAAA,EAA8B;AAC1E,EAAA,IAAI,CAAC,IAAA,EAAM,IAAA,IAAQ,MAAM,IAAI,UAAU,kCAAkC,CAAA;AAEzE,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,MAAA,CAAO,MAAA,KAAW,CAAA,GAAI,CAAA,cAAA,EAAiB,IAAI,CAAA,CAAA,GAAK,CAAA,cAAA,EAAiB,IAAI,CAAA,IAAA,EAAO,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAC1G,KAAA,EAAO,CAAC,IAAA,KACN,IAAA,CAAK,QAAA,CAAS,MAAM,GAAG,MAAM,CAAA,GACzB,MAAA,GACA,EAAE,OAAA,EAAS,OAAO,MAAA,KAAW,CAAA,GAAI,CAAA,0BAAA,EAA6B,IAAI,CAAA,CAAA,CAAA,GAAM,CAAA,kBAAA,EAAqB,IAAI,CAAA,gBAAA,EAAmB,MAAA,CAAO,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAI,GACjJ;AACF;AAKO,SAAS,oBAAoB,YAAA,EAAmC;AACrE,EAAA,MAAM,MAAA,GAAS,YAAA,EAAc,IAAA,EAAK,IAAK,MAAA;AAEvC,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,CAAA,qBAAA,EAAwB,MAAA,IAAU,KAAK,CAAA,CAAA;AAAA,IACpD,KAAA,EAAO,CAAC,IAAA,KAAS;AACf,MAAA,MAAM,YACJ,CAAC,CAAC,KAAK,cAAA,KACN,CAAC,UACA,IAAA,CAAK,iBAAA,EAAmB,aAAY,KAAM,MAAA,CAAO,aAAY,IAC7D,IAAA,CAAK,eAAe,WAAA,EAAY,KAAM,OAAO,WAAA,EAAY,CAAA;AAE7D,MAAA,OAAO,SAAA,GACH,SACA,EAAE,OAAA,EAAS,SAAS,CAAA,qCAAA,EAAwC,MAAM,MAAM,wCAAA,EAAyC;AAAA,IACvH;AAAA,GACF;AACF;AAMO,SAAS,0BAAA,CAA2B,YAAA,EAAsB,OAAA,GAAoD,EAAC,EAAe;AACnI,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,YAAY,CAAA,IAAK,eAAe,CAAA,EAAG,MAAM,IAAI,UAAA,CAAW,mDAAmD,CAAA;AAEjI,EAAA,MAAM,OAAA,GAAU,OAAA,CAAQ,MAAA,KAAW,MAAA,GAAY,MAAA,GAAY,2BAAA,CAA4B,OAAA,CAAQ,MAAA,EAAQ,EAAE,KAAA,EAAO,OAAA,CAAQ,KAAA,EAAO,CAAA;AAE/H,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,kCAAkC,YAAY,CAAA,EAAG,UAAU,CAAA,EAAA,EAAK,OAAA,CAAQ,WAAW,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAAA,IACvG,KAAA,EAAO,CAAC,IAAA,KAAS;AACf,MAAA,MAAM,QAAA,GAAW,IAAA,CAAK,mBAAA,KAAwB,MAAA,IAAa,KAAK,mBAAA,IAAuB,YAAA;AACvF,MAAA,MAAM,MAAA,GAAS,OAAA,EAAS,KAAA,CAAM,IAAI,CAAA;AAElC,MAAA,IAAI,QAAA,IAAY,CAAC,MAAA,EAAQ,OAAO,MAAA;AAEhC,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,CAAC,QAAA,GAAW,MAAA,GAAY,6CAA6C,YAAY,CAAA,CAAA,CAAA,EAAK,MAAA,EAAQ,OAAO,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,KAAK,GAAG,CAAA;AAAA,QACxI,KAAA,EAAO,kCAAA;AAAA,QACP,SAAA,EAAW,OAAO,YAAY,CAAA;AAAA,QAC9B,GAAI,QAAQ,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,OAAA,CAAQ,MAAA,EAAO,GAAI;AAAC,OACnE;AAAA,IACF;AAAA,GACF;AACF;AAKA,IAAM,YAAA,GAAiD,EAAE,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,GAAA,EAAK,KAAK,GAAA,EAAI;AAM7G,SAAS,4BACd,OAAA,EACA,KAAA,GAAqB,KAAA,EACrB,OAAA,GAAkC,EAAC,EACvB;AACZ,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,OAAA,EAAS,uBAAuB,CAAA;AACxD,EAAA,MAAM,MAAA,GAAS,QAAA,CAAS,GAAA,CAAI,CAAC,WAAW,YAAA,CAAa,MAAA,CAAO,WAAA,EAAa,CAAC,CAAA,CAAE,MAAA,CAAO,CAAC,KAAA,KAA2B,UAAU,MAAS,CAAA;AAClI,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,KAAc,MAAA,CAAO,MAAA,KAAW,CAAA,GAAI,MAAA,GAAY,KAAA,KAAU,KAAA,GAAQ,YAAA,CAAa,MAAM,CAAA,GAAI,WAAW,MAAM,CAAA,CAAA;AAEpI,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,8BAAA,EAAiC,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAC5E,KAAA,EAAO,CAAC,IAAA,KAAS;AACf,MAAA,MAAM,IAAA,GAAO,KAAK,qBAAA,CAAsB,GAAA,CAAI,CAAC,MAAA,KAAW,MAAA,CAAO,aAAa,CAAA;AAE5E,MAAA,OAAO,SAAA,CAAU,QAAA,EAAU,KAAA,EAAO,CAAC,MAAA,KAAW,IAAA,CAAK,QAAA,CAAS,MAAA,CAAO,WAAA,EAAa,CAAC,CAAA,GAC7E,MAAA,GACA;AAAA,QACE,SAAS,CAAA,iCAAA,EAAoC,KAAK,MAAM,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAA,QAC3E,KAAA,EAAO,kCAAA;AAAA,QACP,GAAI,SAAA,GAAY,EAAE,SAAA,KAAc;AAAC,OACnC;AAAA,IACN;AAAA,GACF;AACF;AAKO,SAAS,2BAAA,CAA4B,MAAA,EAAgB,OAAA,GAAmC,EAAC,EAAe;AAC7G,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA,IAAK,SAAS,CAAA,EAAG,MAAM,IAAI,UAAA,CAAW,wDAAwD,CAAA;AAE1H,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAAS,WAAA;AAE/B,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,0BAA0B,MAAM,CAAA,MAAA,CAAA;AAAA,IAC7C,KAAA,EAAO,CAAC,IAAA,KACN,IAAA,CAAK,aAAa,MAAA,IAAa,KAAA,CAAM,GAAA,EAAI,GAAI,IAAA,CAAK,QAAA,GAAW,GAAA,IAAQ,MAAA,GAAS,MAC1E,MAAA,GACA;AAAA,MACE,OAAA,EACE,KAAK,QAAA,KAAa,MAAA,GACd,wDAAwD,MAAM,CAAA,yBAAA,CAAA,GAC9D,+BAA+B,MAAM,CAAA,aAAA,CAAA;AAAA,MAC3C,KAAA,EAAO,kCAAA;AAAA,MACP;AAAA;AACF,GACR;AACF;AAKO,SAAS,kBAAkB,KAAA,EAAmE;AACnG,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,KAAA,EAAO,aAAa,CAAA;AAE5C,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,CAAA,oBAAA,EAAuB,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IACvD,OAAO,CAAC,IAAA,KAAU,SAAS,QAAA,CAAS,IAAA,CAAK,IAAI,CAAA,GAAI,MAAA,GAAY,EAAE,OAAA,EAAS,CAAA,gBAAA,EAAmB,KAAK,IAAI,CAAA,cAAA,EAAiB,SAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA;AAAI,GAC9I;AACF;AAKO,SAAS,cAAc,SAAA,EAAmD;AAC/E,EAAA,MAAM,QAAA,GAAW,MAAA,CAAO,SAAA,EAAW,WAAW,CAAA;AAE9C,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,CAAA,eAAA,EAAkB,QAAA,CAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,IAClD,OAAO,CAAC,IAAA,KACN,KAAK,QAAA,KAAa,MAAA,IAAa,SAAS,QAAA,CAAS,IAAA,CAAK,QAAQ,CAAA,GAC1D,MAAA,GACA,EAAE,OAAA,EAAS,CAAA,gDAAA,EAAmD,SAAS,IAAA,CAAK,IAAI,CAAC,CAAA,EAAA,CAAA;AAAK,GAC9F;AACF;AAKO,SAAS,SAAS,KAAA,EAAiC;AACxD,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,MAAM,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,WAAW,CAAA,CAAE,IAAA,CAAK,OAAO,CAAA;AAAA,IAC/D,OAAO,CAAC,IAAA,KAAS,SAAA,CAAU,IAAA,EAAM,GAAG,KAAK;AAAA,GAC3C;AACF;AAKO,SAAS,SAAS,KAAA,EAAiC;AACxD,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,MAAM,IAAI,UAAU,gCAAgC,CAAA;AAE5E,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,MAAM,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,WAAW,CAAA,CAAE,IAAA,CAAK,MAAM,CAAA;AAAA,IAC9D,KAAA,EAAO,CAAC,IAAA,KAAS;AACf,MAAA,MAAM,QAAA,GAAW,MAAM,GAAA,CAAI,CAAC,SAAS,IAAA,CAAK,KAAA,CAAM,IAAI,CAAC,CAAA;AAErD,MAAA,OAAO,QAAA,CAAS,KAAK,CAAC,OAAA,KAAY,YAAY,MAAS,CAAA,GAAI,MAAA,GAAY,QAAA,CAAS,CAAC,CAAA;AAAA,IACnF;AAAA,GACF;AACF;AAEA,SAAS,MAAA,CAAO,QAAoC,IAAA,EAAwB;AAC1E,EAAA,MAAM,IAAA,GAAO,CAAC,GAAG,IAAI,KAAK,OAAO,MAAA,KAAW,QAAA,GAAW,CAAC,MAAM,CAAA,GAAI,CAAC,GAAG,MAAM,GAAG,MAAA,CAAO,CAAC,UAAU,KAAA,EAAO,IAAA,EAAM,CAAC,CAAC,CAAA;AAEhH,EAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG,MAAM,IAAI,SAAA,CAAU,CAAA,aAAA,EAAgB,IAAI,CAAA,aAAA,CAAe,CAAA;AAE9E,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,SAAA,CAAU,QAAA,EAA6B,KAAA,EAAoB,KAAA,EAA4C;AAC9G,EAAA,OAAO,KAAA,KAAU,QAAQ,QAAA,CAAS,KAAA,CAAM,KAAK,CAAA,GAAI,QAAA,CAAS,KAAK,KAAK,CAAA;AACtE;AAEA,SAAS,aAAa,MAAA,EAA6D;AACjF,EAAA,OAAO,QAAQ,MAAA,EAAQ,CAAC,IAAA,EAAM,KAAA,KAAU,QAAQ,IAAI,CAAA;AACtD;AAEA,SAAS,WAAW,MAAA,EAA6D;AAC/E,EAAA,OAAO,QAAQ,MAAA,EAAQ,CAAC,IAAA,EAAM,KAAA,KAAU,OAAO,KAAK,CAAA;AACtD;AAEA,SAAS,OAAA,CAAQ,QAAyC,KAAA,EAAoE;AAC5H,EAAA,MAAM,QAAQ,MAAA,CAAO,MAAA,CAAO,CAAC,KAAA,KAA2B,CAAC,CAAC,KAAK,CAAA;AAC/D,EAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO,CAAC,UAAU,OAAA,CAAQ,IAAA,CAAK,KAAK,CAAC,CAAA,CAAE,KAAK,CAAC,IAAA,EAAM,UAAU,KAAA,CAAM,MAAA,CAAO,IAAI,CAAA,EAAG,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAErH,EAAA,OAAO,OAAA,CAAQ,CAAC,CAAA,IAAK,KAAA,CAAM,CAAC,CAAA;AAC9B;AAEA,SAAS,gBAAgB,OAAA,EAAoE;AAC3F,EAAA,OAAO,OAAA,IAAW,OAAA,CAAQ,MAAA,GAAS,CAAA,GAAI,SAAS,CAAC,GAAG,IAAI,GAAA,CAAI,OAAO,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,GAAK,EAAA;AACvF;AC5UO,IAAM,iBAAA,GAAN,MAAM,kBAAA,SAA0B,WAAA,CAAY;AAAA,EACxC,MAAA,GAAS,GAAA;AAAA;AAAA,EAET,KAAA;AAAA;AAAA,EAEA,WAAA;AAAA;AAAA,EAEA,MAAA;AAAA;AAAA,EAEA,gBAAA;AAAA,EAET,WAAA,CACE,WAAA,EACA,OAAA,GAKI,EAAC,EACL;AACA,IAAA,KAAA,CAAM,eAAe,0CAAA,EAA4C,EAAE,KAAA,EAAO,OAAA,CAAQ,OAAO,CAAA;AACzF,IAAA,IAAA,CAAK,KAAA,GAAQ,OAAA,IAAW,OAAA,GAAU,OAAA,CAAQ,KAAA,GAAQ,eAAA;AAClD,IAAA,IAAA,CAAK,WAAA,GAAc,WAAA,KAAgB,MAAA,GAAY,MAAA,GAAY,aAAa,WAAW,CAAA;AACnF,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,mBAAmB,OAAA,CAAQ,gBAAA;AAAA,EAClC;AAAA;AAAA,EAGA,qBAAqB,gBAAA,EAAyD;AAC5E,IAAA,IAAI,CAAC,gBAAA,IAAoB,gBAAA,KAAqB,IAAA,CAAK,kBAAkB,OAAO,IAAA;AAE5E,IAAA,OAAO,IAAI,kBAAA,CAAkB,IAAA,CAAK,WAAA,EAAa,EAAE,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,KAAA,EAAO,KAAK,KAAA,EAAO,MAAA,EAAQ,IAAA,CAAK,MAAA,EAAQ,kBAAkB,CAAA;AAAA,EAChI;AAAA;AAAA,EAGA,IAAI,eAAA,GAA0B;AAC5B,IAAA,MAAM,aAAuB,EAAC;AAE9B,IAAA,IAAI,KAAK,KAAA,EAAO,UAAA,CAAW,KAAK,CAAA,OAAA,EAAU,IAAA,CAAK,KAAK,CAAA,CAAA,CAAG,CAAA;AACvD,IAAA,IAAI,IAAA,CAAK,SAAS,IAAA,CAAK,WAAA,aAAwB,IAAA,CAAK,CAAA,mBAAA,EAAsB,IAAA,CAAK,WAAW,CAAA,CAAA,CAAG,CAAA;AAC7F,IAAA,IAAI,IAAA,CAAK,kBAAkB,UAAA,CAAW,IAAA,CAAK,sBAAsB,YAAA,CAAa,IAAA,CAAK,gBAAgB,CAAC,CAAA,CAAA,CAAG,CAAA;AAEvG,IAAA,OAAO,UAAA,CAAW,WAAW,CAAA,GAAI,QAAA,GAAW,UAAU,UAAA,CAAW,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,EAC7E;AACF;AAQO,IAAM,oBAAA,GAAN,MAAM,qBAAA,SAA6B,WAAA,CAAY;AAAA;AAAA,EAE3C,MAAA;AAAA,EACA,OAAA;AAAA;AAAA,EAEA,gBAAA;AAAA,EAET,WAAA,CAAY,OAAA,EAA4B,OAAA,GAAyC,EAAC,EAAG;AACnF,IAAA,KAAA,CAAM,QAAQ,OAAO,CAAA;AACrB,IAAA,IAAA,CAAK,OAAA,GAAU,OAAA;AACf,IAAA,IAAA,CAAK,MAAA,GAAS,OAAA,CAAQ,KAAA,KAAU,kCAAA,GAAqC,GAAA,GAAM,GAAA;AAC3E,IAAA,IAAA,CAAK,mBAAmB,OAAA,CAAQ,gBAAA;AAAA,EAClC;AAAA;AAAA,EAGA,qBAAqB,gBAAA,EAA4D;AAC/E,IAAA,IAAI,CAAC,gBAAA,IAAoB,gBAAA,KAAqB,IAAA,CAAK,kBAAkB,OAAO,IAAA;AAE5E,IAAA,OAAO,IAAI,qBAAA,CAAqB,IAAA,CAAK,OAAA,EAAS,EAAE,kBAAkB,CAAA;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,IAAI,eAAA,GAAsC;AACxC,IAAA,MAAM,SAAA,GAAY,oBAAA,CAAqB,IAAA,CAAK,OAAO,CAAA;AAEnD,IAAA,OAAO,SAAA,IAAa,IAAA,CAAK,MAAA,KAAW,GAAA,IAAO,IAAA,CAAK,gBAAA,GAAmB,CAAA,EAAG,SAAS,CAAA,qBAAA,EAAwB,YAAA,CAAa,IAAA,CAAK,gBAAgB,CAAC,CAAA,CAAA,CAAA,GAAM,SAAA;AAAA,EAClJ;AACF;AAMO,SAAS,qBAAqB,OAAA,EAAgD;AACnF,EAAA,IAAI,CAAC,OAAA,CAAQ,KAAA,EAAO,OAAO,MAAA;AAE3B,EAAA,MAAM,UAAA,GAAa,CAAC,CAAA,OAAA,EAAU,OAAA,CAAQ,KAAK,CAAA,CAAA,CAAA,EAAK,CAAA,mBAAA,EAAsB,YAAA,CAAa,YAAA,CAAa,OAAA,CAAQ,OAAO,CAAC,CAAC,CAAA,CAAA,CAAG,CAAA;AAEpH,EAAA,IAAI,OAAA,CAAQ,OAAO,UAAA,CAAW,IAAA,CAAK,UAAU,YAAA,CAAa,OAAA,CAAQ,KAAK,CAAC,CAAA,CAAA,CAAG,CAAA;AAC3E,EAAA,IAAI,OAAA,CAAQ,WAAW,UAAA,CAAW,IAAA,CAAK,eAAe,YAAA,CAAa,OAAA,CAAQ,SAAS,CAAC,CAAA,CAAA,CAAG,CAAA;AACxF,EAAA,IAAI,OAAA,CAAQ,WAAW,MAAA,EAAW,UAAA,CAAW,KAAK,CAAA,QAAA,EAAW,OAAA,CAAQ,MAAM,CAAA,CAAE,CAAA;AAE7E,EAAA,OAAO,CAAA,OAAA,EAAU,UAAA,CAAW,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AACxC;AAMO,SAAS,iBAAiB,KAAA,EAA0E;AACzG,EAAA,IAAI,KAAA,YAAiB,iBAAA;AACnB,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,gBAAA;AAAA,MACN,KAAA,EAAO,cAAA;AAAA,MACP,MAAA,EAAQ,GAAA;AAAA,MACR,MAAA,EAAQ;AAAA,KACV;AAEF,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,KAAA,CAAM,MAAA,KAAW,GAAA,GAAM,gBAAA,GAAmB,oDAAA;AAAA,IAChD,KAAA,EAAO,KAAA,CAAM,MAAA,KAAW,GAAA,GAAM,cAAA,GAAiB,WAAA;AAAA,IAC/C,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,MAAA,EAAQ,KAAA,CAAM,OAAA,CAAQ,OAAA,IAAW,oDAAA;AAAA,IACjC,GAAI,KAAA,CAAM,OAAA,CAAQ,KAAA,GAAQ,EAAE,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAM,GAAI,EAAC;AAAA,IAC5D,GAAI,KAAA,CAAM,OAAA,CAAQ,KAAA,GAAQ,EAAE,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAA,EAAM,GAAI,EAAC;AAAA,IAC5D,GAAI,KAAA,CAAM,OAAA,CAAQ,SAAA,GAAY,EAAE,YAAY,KAAA,CAAM,OAAA,CAAQ,SAAA,EAAU,GAAI,EAAC;AAAA,IACzE,GAAI,KAAA,CAAM,OAAA,CAAQ,MAAA,KAAW,MAAA,GAAY,EAAE,OAAA,EAAS,KAAA,CAAM,OAAA,CAAQ,MAAA,EAAO,GAAI;AAAC,GAChF;AACF;AAEA,IAAM,gBAAA,GAAmB,oDAAA;AAOlB,SAAS,aAAa,IAAA,EAAsB;AACjD,EAAA,OAAO,CAAC,GAAG,IAAI,EAAE,GAAA,CAAI,CAAC,cAAe,SAAA,IAAa,GAAA,IAAO,aAAa,GAAA,IAAO,SAAA,KAAc,OAAO,SAAA,KAAc,IAAA,GAAO,YAAY,GAAI,CAAA,CAAE,KAAK,EAAE,CAAA;AAClJ;AAEA,SAAS,aAAa,KAAA,EAAuB;AAC3C,EAAA,OAAO,MAAM,OAAA,CAAQ,KAAA,EAAO,MAAM,CAAA,CAAE,OAAA,CAAQ,MAAM,KAAK,CAAA;AACzD;AC7GO,SAAS,6BAA6B,QAAA,EAA0B;AACrE,EAAA,MAAM,GAAA,GAAM,cAAc,QAAQ,CAAA;AAClC,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAE5C,EAAA,OAAO,GAAG,GAAA,CAAI,MAAM,GAAG,cAAA,CAAe,6BAA6B,GAAG,IAAI,CAAA,CAAA;AAC5E;AAKO,SAAS,8BAA8B,QAAA,EAA0B;AACtE,EAAA,OAAO,IAAI,GAAA,CAAI,4BAAA,CAA6B,QAAQ,CAAC,CAAA,CAAE,QAAA;AACzD;AAMO,SAAS,gCAAgC,OAAA,EAAkF;AAChI,EAAA,aAAA,CAAc,QAAQ,QAAQ,CAAA;AAE9B,EAAA,MAAM,QAAA,GAA4C;AAAA,IAChD,GAAG,OAAA,CAAQ,KAAA;AAAA,IACX,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,qBAAA,EAAuB,CAAC,aAAA,CAAc,OAAO,CAAC,CAAA;AAAA,IAC9C,wBAAA,EAA0B,CAAC,QAAQ;AAAA,GACrC;AAEA,EAAA,IAAI,OAAA,CAAQ,eAAA,IAAmB,OAAA,CAAQ,eAAA,CAAgB,MAAA,GAAS,CAAA,EAAG,QAAA,CAAS,gBAAA,GAAmB,CAAC,GAAG,OAAA,CAAQ,eAAe,CAAA;AAC1H,EAAA,IAAI,OAAA,CAAQ,YAAA,EAAc,QAAA,CAAS,aAAA,GAAgB,OAAA,CAAQ,YAAA;AAC3D,EAAA,IAAI,OAAA,CAAQ,qBAAA,EAAuB,QAAA,CAAS,sBAAA,GAAyB,OAAA,CAAQ,qBAAA;AAE7E,EAAA,OAAO,QAAA;AACT;AAEA,SAAS,cAAc,QAAA,EAAuB;AAC5C,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,QAAQ,CAAA;AAAA,EACxB,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,yBAAyB,CAAA,cAAA,EAAiB,QAAQ,6BAA6B,EAAE,KAAA,EAAO,OAAO,CAAA;AAAA,EAC3G;AAEA,EAAA,IAAI,IAAI,IAAA,EAAM,MAAM,IAAI,wBAAA,CAAyB,CAAA,cAAA,EAAiB,QAAQ,CAAA,uCAAA,CAAyC,CAAA;AAEnH,EAAA,OAAO,GAAA;AACT;;;AC+DO,IAAM,6BAAA,GAAgC;AAAA,EAC3C,QAAA,EACE,gNAAA;AAAA,EACF,WAAA,EAAa,kEAAA;AAAA,EACb,KAAA,EAAO,qBAAA;AAAA,EACP,SAAA,EAAW,yHAAA;AAAA,EACX,sBAAA,EAAwB,uDAAA;AAAA,EACxB,SAAA,EACE;AACJ;AAEA,IAAM,gBAAA,GAAmB,GAAA;AAOlB,SAAS,qBAAqB,OAAA,EAAgD;AACnF,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,EAAU,IAAA,EAAK,IAAK,MAAA;AAC7C,EAAA,MAAM,KAAA,GAAQ,OAAO,OAAA,CAAQ,SAAA,KAAc,WAAW,CAAC,OAAA,CAAQ,SAAS,CAAA,GAAI,CAAC,GAAI,OAAA,CAAQ,SAAA,IAAa,EAAG,CAAA;AACzG,EAAA,MAAM,SAAA,GAAY,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,KAAA,EAAO,GAAI,QAAA,GAAW,CAAC,QAAQ,CAAA,GAAI,EAAG,CAAA,CAAE,MAAA,CAAO,CAAC,UAAU,KAAA,EAAO,IAAA,EAAM,CAAC,CAAC,CAAA;AAE3G,EAAA,IAAI,UAAU,MAAA,KAAW,CAAA;AACvB,IAAA,MAAM,IAAIC,yBAAyB,8FAA8F,CAAA;AAEnI,EAAA,MAAM,UAAA,GAAa,kBAAkB,OAAO,CAAA;AAC5C,EAAA,MAAM,SAAA,GAAY,4BAA4B,UAAU,CAAA;AACxD,EAAA,MAAM,aAAA,GAAgB,QAAQ,aAAA,IAAiB,MAAA;AAC/C,EAAA,MAAM,MAAA,GAAS,cAAc,OAAO,CAAA;AAEpC,EAAA,IAAI,aAAA,KAAkB,UAAU,CAAC,MAAA;AAC/B,IAAA,MAAM,IAAIA,wBAAAA;AAAA,MACR,0BAA0B,aAAa,CAAA,8GAAA;AAAA,KACzC;AAEF,EAAA,MAAM,mBAAA,GAAsB,uBAAA,CAAwB,OAAA,CAAQ,gBAAA,EAAkB,QAAQ,CAAA;AACtF,EAAA,MAAM,eAAA,GAAkB,OAAA,CAAQ,OAAA,CAAQ,0BAAA,EAA4B,IAAI,4BAA4B,CAAA;AACpG,EAAA,MAAM,YAAY,OAAA,CAAQ,OAAA,CAAQ,SAAA,EAAW,EAAA,EAAI,WAAW,CAAA,GAAI,GAAA;AAChE,EAAA,MAAM,UAAA,GAAa,4BAAA,CAA6B,OAAA,CAAQ,4BAA4B,CAAA;AACpF,EAAA,MAAM,SAAA,GAAY,UAAA,EAAY,MAAA,CAAO,CAAC,SAAA,KAAe,qBAA2C,QAAA,CAAS,SAAS,CAAC,CAAA,IAAK,EAAC;AACzH,EAAA,MAAM,eAAe,SAAA,CAAU,MAAA,GAAS,IAAI,mBAAA,CAAoB,OAAA,EAAS,SAAS,CAAA,GAAI,MAAA;AACtF,EAAA,MAAM,qBAAA,GAAwB,QAAQ,qBAAA,IAAyB,IAAA;AAC/D,EAAA,MAAM,gBAAyC,EAAE,UAAA,EAAY,QAAQ,UAAA,EAAY,WAAA,EAAa,QAAQ,WAAA,EAAY;AAClH,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAkE;AACpF,EAAA,MAAM,WAAA,GAAc,uBAAA,CAAwB,UAAA,EAAY,SAAS,CAAA;AACjE,EAAA,MAAM,aAAA,GACJ,QAAQ,mBAAA,KAAwB,OAAA,CAAQ,0BAA0B,qBAAA,CAAsB,OAAA,CAAQ,uBAAuB,CAAA,GAAI,MAAA,CAAA;AAC7H,EAAA,MAAM,OAAA,GACJ,aAAA,KAAkB,MAAA,GACd,MAAA,GACA,2BAA2B,aAAA,EAAe;AAAA,IACxC,OAAA,EAAS,OAAA,CAAQ,mBAAA,KAAwB,MAAA,GAAY,yBAAA,GAA4B,qBAAA;AAAA,IACjF,iCAAiC,OAAA,CAAQ,+BAAA;AAAA,IACzC,sBAAsB,OAAA,CAAQ,oBAAA;AAAA,IAC9B,mBAAmB,OAAA,CAAQ;AAAA,GAC5B,CAAA;AACP,EAAA,MAAM,iBAAiB,MAAA,CAAO,MAAA,CAAO,CAAC,GAAG,IAAI,KAAK,OAAA,CAAQ,cAAA,IAAkB,EAAC,EAAG,MAAA,CAAO,CAAC,KAAA,KAAU,KAAA,EAAO,MAAM,CAAC,CAAC,CAAC,CAAA;AAElH,EAAA,MAAM,UAAA,GAAa,OAAO,KAAA,EAAe,GAAA,EAAa,MAAA,KAAyE;AAC7H,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,KAAA,CAAM,GAAA,EAAI;AACjC,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAE5B,IAAA,IAAI,MAAA,IAAU,MAAA,CAAO,KAAA,GAAQ,GAAA,SAAY,MAAA,CAAO,MAAA;AAEhD,IAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAEhB,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAQ,UAAA,CAAW,KAAA,EAAO,EAAE,aAAA,EAAe,gBAAA,CAAiB,WAAA,EAAa,MAAA,EAAQ,CAAA;AAEtG,IAAA,IAAI,CAAC,MAAA,CAAO,MAAA,EAAQ,OAAO,MAAA;AAE3B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,GAAA,GAAM,eAAA,EAAiB,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,MAAA,CAAO,GAAA,GAAM,GAAA,GAAO,OAAO,iBAAiB,CAAA;AAE3H,IAAA,IAAI,QAAQ,GAAA,EAAK;AACf,MAAA,IAAI,KAAA,CAAM,IAAA,IAAQ,gBAAA,EAAkB,KAAA,CAAM,MAAA,CAAO,MAAM,IAAA,EAAK,CAAE,IAAA,EAAK,CAAE,KAAM,CAAA;AAC3E,MAAA,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,EAAE,MAAA,EAAQ,OAAO,CAAA;AAAA,IAClC;AAEA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,SAAA,GAAY,OAAO,KAAA,EAAe,MAAA,KAA8C;AACpF,IAAA,IAAI,MAAA,GAAS,KAAA;AAEb,IAAA,IAAI,sBAAA,CAAuB,KAAK,CAAA,EAAG;AACjC,MAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,iBAAA,CAAkB,8BAA8B,SAAA,EAAW,EAAE,MAAA,EAAQ,mBAAA,EAAqB,CAAA;AAElH,MAAA,IAAI;AACF,QAAA,MAAA,GAAS,MAAM,QAAQ,KAAK,CAAA;AAAA,MAC9B,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,KAAA,YAAiB,0BAAA,EAA4B,MAAM,IAAI,iBAAA,CAAkB,KAAA,CAAM,OAAA,EAAS,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAA;AAClI,QAAA,MAAM,KAAA;AAAA,MACR;AAAA,IACF;AAEA,IAAA,IAAI,MAAA;AAEJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,gBAAA,CAAiB,MAAM,WAAA,CAAY,MAAM,GAAG,YAAY,CAAA;AAAA,IACnE,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,kBAAkB,6BAAA,CAA8B,sBAAA,EAAwB,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,0BAAA,EAA4B,CAAA;AAAA,IACxI;AAEA,IAAA,IAAI,OAAA;AAEJ,IAAA,IAAI;AACF,MAAA,IAAI,MAAA;AAEJ,MAAA,CAAC,EAAE,OAAA,EAAS,MAAA,KAAW,MAAM,eAAA,CAAgB,QAAQ,MAAA,EAAQ;AAAA,QAC3D,QAAQ,UAAA,CAAW,MAAA;AAAA,QACnB,SAAA;AAAA,QACA,UAAA;AAAA,QACA,SAAA;AAAA,QACA,GAAA,EAAK,UAAA,CAAW,KAAA,CAAM,GAAA;AAAI,OAC3B,CAAA;AAED,MAAA,sBAAA,CAAuB,MAAM,CAAA;AAAA,IAC/B,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,KAAA,YAAiB,8BAA8B,KAAA,CAAM,MAAA,KAAW,uBAAuB,SAAA,CAAU,MAAA,KAAW,CAAA,IAAK,gBAAA,CAAiB,MAAM,CAAA;AAC1I,QAAA,MAAM,IAAI,iBAAA,CAAkB,6BAAA,CAA8B,SAAA,EAAW,EAAE,OAAO,KAAA,EAAO,MAAA,EAAQ,KAAA,CAAM,MAAA,EAAQ,CAAA;AAC7G,MAAA,IAAI,KAAA,YAAiB,0BAAA,EAA4B,MAAM,IAAI,iBAAA,CAAkB,KAAA,CAAM,OAAA,EAAS,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,KAAA,CAAM,QAAQ,CAAA;AAClI,MAAA,MAAM,KAAA;AAAA,IACR;AAEA,IAAA,MAAM,OAAO,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,GAAW,QAAQ,GAAA,GAAM,MAAA;AAE7D,IAAA,IAAI,qBAAA,IAAyB,IAAA,KAAS,MAAA,IAAa,IAAA,CAAK,aAAY,KAAM,QAAA;AACxE,MAAA,MAAM,IAAI,kBAAkB,CAAA,sDAAA,EAAyD,IAAI,MAAM,EAAE,MAAA,EAAQ,oBAAoB,CAAA;AAE/H,IAAA,IAAI,kBAAkB,aAAA,EAAe,OAAO,IAAI,UAAA,CAAW,OAAA,EAAS,eAAe,KAAK,CAAA;AAExF,IAAA,MAAM,MAAA,GAAS,MAAM,aAAA,CAAc,KAAA,EAAO,SAAS,MAAM,CAAA;AAEzD,IAAA,OAAO,IAAI,UAAA,CAAW,EAAE,GAAG,qBAAA,CAAsB,MAAM,CAAA,EAAG,GAAG,OAAA,EAAQ,EAAG,aAAA,EAAe,KAAK,CAAA;AAAA,EAC9F,CAAA;AAEA,EAAA,MAAM,aAAA,GAAgB,OAAO,KAAA,EAAe,OAAA,EAAqB,MAAA,KAA6D;AAC5H,IAAA,MAAM,GAAA,GAAM,QAAQ,GAAA,GAAM,CAAA,IAAA,EAAO,QAAQ,GAAG,CAAA,CAAA,GAAK,MAAM,WAAA,CAAY,KAAK,CAAA;AACxE,IAAA,IAAI,MAAA;AAEJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAM,UAAA,CAAW,KAAA,EAAO,GAAA,EAAK,MAAM,CAAA;AAAA,IAC9C,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,MAAA,EAAQ,SAAS,MAAM,KAAA;AAC3B,MAAA,MAAM,IAAI,kBAAkB,6BAAA,CAA8B,WAAA,EAAa,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAe,CAAA;AAAA,IAChH;AAEA,IAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,iBAAA,CAAkB,8BAA8B,QAAA,EAAU,EAAE,MAAA,EAAQ,UAAA,EAAY,CAAA;AAEvG,IAAA,OAAO,MAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,qBAAA,GAAwB,OAAO,KAAA,EAAe,MAAA,KAA8C;AAChG,IAAA,IAAI,MAAA;AAEJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,MAAM,UAAA,CAAW,KAAA,EAAO,MAAM,WAAA,CAAY,KAAK,GAAG,MAAM,CAAA;AAAA,IACnE,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,MAAA,EAAQ,SAAS,MAAM,KAAA;AAC3B,MAAA,MAAM,IAAI,kBAAkB,6BAAA,CAA8B,WAAA,EAAa,EAAE,KAAA,EAAO,KAAA,EAAO,MAAA,EAAQ,aAAA,EAAe,CAAA;AAAA,IAChH;AAEA,IAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,iBAAA,CAAkB,8BAA8B,QAAA,EAAU,EAAE,MAAA,EAAQ,UAAA,EAAY,CAAA;AAEvG,IAAA,IAAI,OAAO,GAAA,IAAO,MAAA,CAAO,GAAA,KAAQ,UAAA,CAAW,QAAQ,MAAM,IAAI,iBAAA,CAAkB,CAAA,YAAA,EAAe,OAAO,GAAG,CAAA,YAAA,CAAA,EAAgB,EAAE,MAAA,EAAQ,kBAAkB,CAAA;AAErJ,IAAA,MAAM,iBAAiB,CAAC,MAAA,CAAO,OAAO,EAAE,EAAE,IAAA,EAAK;AAE/C,IAAA,IAAI,CAAC,eAAe,IAAA,CAAK,CAAC,aAAa,SAAA,CAAU,QAAA,CAAS,QAAQ,CAAC,CAAA;AACjE,MAAA,MAAM,IAAI,kBAAkB,gBAAA,CAAiB,cAAA,EAAgB,SAAS,CAAA,EAAG,EAAE,MAAA,EAAQ,kBAAA,EAAoB,CAAA;AAEzG,IAAA,IAAI,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,IAAA,CAAa,MAAA,CAAO,MAAM,SAAA,IAAa,GAAA,IAAQ,UAAA,CAAW,KAAA,CAAM,GAAA,EAAI;AAC5F,MAAA,MAAM,IAAI,iBAAA,CAAkB,CAAA,sBAAA,EAAyB,IAAI,KAAK,MAAA,CAAO,GAAA,GAAM,GAAI,CAAA,CAAE,aAAa,CAAA,CAAA,CAAA,EAAK,EAAE,MAAA,EAAQ,WAAW,CAAA;AAE1H,IAAA,MAAM,MAAA,GAAS,sBAAsB,MAAM,CAAA;AAC3C,IAAA,MAAM,OAAO,OAAO,MAAA,CAAO,GAAA,KAAQ,QAAA,GAAW,OAAO,GAAA,GAAM,MAAA;AAE3D,IAAA,IAAI,qBAAA,IAAyB,IAAA,KAAS,MAAA,IAAa,CAAC,kBAAkB,IAAI,CAAA;AACxE,MAAA,MAAM,IAAI,kBAAkB,CAAA,sDAAA,EAAyD,IAAI,MAAM,EAAE,MAAA,EAAQ,oBAAoB,CAAA;AAE/H,IAAA,OAAO,IAAI,UAAA,CAAW,MAAA,EAAQ,aAAA,EAAe,OAAO,eAAe,CAAA;AAAA,EACrE,CAAA;AAEA,EAAA,MAAM,MAAA,GAAS,OAAO,KAAA,EAAe,MAAA,KAA8C;AACjF,IAAA,IAAI;AACF,MAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,MAAM,IAAA,EAAK,EAAG,MAAM,IAAI,kBAAkB,6BAAA,CAA8B,KAAA,EAAO,EAAE,MAAA,EAAQ,aAAa,CAAA;AAExI,MAAA,OAAO,aAAA,KAAkB,mBAAA,GAAsB,MAAM,qBAAA,CAAsB,MAAM,IAAA,EAAK,EAAG,MAAM,CAAA,GAAI,MAAM,SAAA,CAAU,KAAA,CAAM,IAAA,IAAQ,MAAM,CAAA;AAAA,IACzI,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,KAAA,YAAiB,iBAAA,GAAoB,KAAA,CAAM,oBAAA,CAAqB,mBAAmB,CAAA,GAAI,KAAA;AAAA,IAC/F;AAAA,EACF,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,SAAA;AAAA,IACA,SAAA;AAAA,IACA,QAAA;AAAA,IACA,mBAAA;AAAA,IACA,cAAA;AAAA,IACA,aAAA;AAAA,IACA,MAAA;AAAA,IACA,MAAA;AAAA,IACA,MAAM,yBAAA,CAA0B,MAAA,EAAQ,MAAA,EAAQ;AAC9C,MAAA,MAAM,KAAA,GAAQ,gBAAgB,MAAM,CAAA;AAEpC,MAAA,IAAI,KAAA,KAAU,MAAA,EAAW,MAAM,IAAI,iBAAA,CAAkB,MAAA,EAAW,EAAE,KAAA,EAAO,MAAA,EAAW,gBAAA,EAAkB,mBAAA,EAAqB,CAAA;AAE3H,MAAA,OAAO,MAAA,CAAO,OAAO,MAAM,CAAA;AAAA,IAC7B;AAAA,GACF;AACF;AAKO,SAAS,gBAAgB,MAAA,EAAuD;AACrF,EAAA,MAAM,KAAA,GAAQ,yBAAA,CAA0B,IAAA,CAAK,MAAA,IAAU,EAAE,CAAA;AAEzD,EAAA,OAAO,QAAQ,CAAC,CAAA;AAClB;AAOA,eAAsB,YAAY,KAAA,EAAgC;AAChE,EAAA,MAAM,MAAA,GAAS,IAAI,UAAA,CAAW,MAAM,OAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AAEpG,EAAA,OAAO,SAAS,CAAC,GAAG,MAAM,CAAA,CAAE,GAAA,CAAI,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,EAAE,CAAA,CAAE,SAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,IAAA,CAAK,EAAE,CAAC,CAAA,CAAA;AACxF;AAEA,SAAS,uBAAA,CAAwB,SAAuC,QAAA,EAAkD;AACxH,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,EAAU,OAAO,OAAA;AACxC,EAAA,IAAI,CAAC,QAAA;AACH,IAAA,MAAM,IAAIA,yBAAyB,6GAA6G,CAAA;AAElJ,EAAA,OAAO,6BAA6B,QAAQ,CAAA;AAC9C;AAEA,SAAS,6BAA6B,OAAA,EAAuE;AAC3G,EAAA,MAAM,UAAA,GAAa,CAAC,GAAG,IAAI,GAAA,CAAA,CAAK,OAAO,OAAA,KAAY,QAAA,GAAW,CAAC,OAAO,CAAA,GAAI,CAAC,GAAI,OAAA,IAAW,EAAG,CAAA,EAAG,GAAA,CAAI,CAAC,SAAA,KAAc,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,MAAA,CAAO,OAAO,CAAC,CAAC,CAAA;AACrJ,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAG,0BAAA,EAA4B,GAAG,oBAAoB,CAAA;AAErE,EAAA,KAAA,MAAW,SAAA,IAAa,UAAA;AACtB,IAAA,IAAI,CAAC,KAAA,CAAM,QAAA,CAAS,SAAS,CAAA;AAC3B,MAAA,MAAM,IAAIA,yBAAyB,CAAA,yCAAA,EAA4C,SAAS,mBAAmB,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA;AAElI,EAAA,OAAO,UAAA,CAAW,MAAA,GAAS,CAAA,GAAI,UAAA,GAAa,MAAA;AAC9C;AAEA,SAAS,mBAAA,CAAoB,SAAgC,SAAA,EAAqD;AAChH,EAAA,MAAM,QAAQ,OAAA,CAAQ,MAAA;AACtB,EAAA,MAAM,SAAS,KAAA,IAAS,CAAC,SAAS,KAAK,CAAA,GAAI,MAAM,YAAA,GAAe,MAAA;AAEhE,EAAA,IAAI,CAAC,MAAA;AACH,IAAA,MAAM,IAAIA,wBAAAA;AAAA,MACR,CAAA,6BAAA,EAAgC,SAAA,CAAU,IAAA,CAAK,IAAI,CAAC,CAAA,oIAAA;AAAA,KACtD;AAEF,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,EAAU,KAAA,MAAW,aAAa,SAAA,EAAW,uBAAA,CAAwB,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,MAAM,EAAE,MAAM,CAAA;AAE7I,EAAA,OAAO,YAAY;AACjB,IAAA,MAAM,QAAQ,OAAO,MAAA,KAAW,UAAA,GAAa,MAAM,QAAO,GAAI,MAAA;AAE9D,IAAA,IAAI,OAAO,UAAU,QAAA,IAAY,CAAC,OAAO,MAAM,IAAIA,yBAAyB,sDAAsD,CAAA;AAElI,IAAA,OAAO,KAAA;AAAA,EACT,CAAA;AACF;AAEA,SAAS,iBAAiB,KAAA,EAAwB;AAChD,EAAA,IAAI;AACF,IAAA,OAAQ,qBAA2C,QAAA,CAAS,MAAA,CAAO,sBAAsB,KAAK,CAAA,CAAE,GAAG,CAAC,CAAA;AAAA,EACtG,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,cAAc,OAAA,EAA0D;AAC/E,EAAA,MAAM,QAAQ,OAAA,CAAQ,MAAA;AAEtB,EAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,EAAA,IAAI,QAAA,CAAS,KAAK,CAAA,EAAG,OAAO,KAAA;AAE5B,EAAA,OAAO,kBAAA,CAAmB;AAAA,IACxB,GAAG,KAAA;AAAA,IACH,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,WAAW,OAAA,CAAQ,SAAA;AAAA,IACnB,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,cAAc,OAAA,CAAQ,YAAA;AAAA,IACtB,wBAAwB,OAAA,CAAQ,sBAAA;AAAA,IAChC,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,OAAO,OAAA,CAAQ;AAAA,GACO,CAAA;AAC1B;AAEA,SAAS,SAAS,KAAA,EAAuC;AACvD,EAAA,OAAO,OAAQ,KAAA,CAAuB,UAAA,KAAe,UAAA,IAAc,OAAQ,MAAuB,MAAA,KAAW,QAAA;AAC/G;AAEA,SAAS,gBAAA,CAAiB,gBAAmC,SAAA,EAAsC;AACjG,EAAA,MAAM,QAAQ,cAAA,CAAe,MAAA,KAAW,CAAA,GAAI,EAAA,GAAK,IAAI,cAAA,CAAe,GAAA,CAAI,CAAC,QAAA,KAAa,IAAI,QAAQ,CAAA,CAAA,CAAG,CAAA,CAAE,IAAA,CAAK,OAAO,CAAC,CAAA,CAAA;AACpH,EAAA,MAAM,QAAA,GAAW,SAAA,CAAU,GAAA,CAAI,CAAC,QAAA,KAAa,IAAI,QAAQ,CAAA,CAAA,CAAG,CAAA,CAAE,IAAA,CAAK,MAAM,CAAA;AAEzE,EAAA,OAAO,SAAA,CAAU,MAAA,KAAW,CAAA,GACxB,CAAA,oDAAA,EAAuD,KAAK,CAAA,QAAA,EAAW,QAAQ,CAAA,iDAAA,CAAA,GAC/E,CAAA,oDAAA,EAAuD,KAAK,CAAA,QAAA,EAAW,QAAQ,CAAA,0DAAA,CAAA;AACrF;ACvXO,SAAS,qBAAqB,OAAA,EAA+C;AAClF,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,IAAI,IAAI,CAAC,OAAA,CAAQ,MAAA,EAAQ,GAAI,OAAA,CAAQ,OAAA,IAAW,EAAG,CAAA,CAAE,MAAA,CAAO,CAAC,MAAA,KAA6B,CAAC,CAAC,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC,CAAA;AAEhI,EAAA,IAAI,QAAQ,MAAA,KAAW,CAAA,EAAG,MAAM,IAAIA,yBAAyB,4CAA4C,CAAA;AAEzG,EAAA,MAAM,KAAA,GAAQ,QAAQ,KAAA,IAASC,WAAAA;AAC/B,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,IAAa,GAAA;AACvC,EAAA,MAAM,QAAA,GAAA,CAAY,OAAA,CAAQ,mBAAA,IAAuB,KAAA,IAAU,GAAA;AAC3D,EAAA,MAAM,WAAA,GAAc,OAAA,CAAQ,WAAA,IAAe,IAAA,GAAO,IAAA;AAClD,EAAA,MAAM,KAAA,GAAQ,YAAA,CAAa,OAAA,CAAQ,aAAA,IAAiB,UAAU,KAAK,CAAA;AACnE,EAAA,MAAM,WAA8D,EAAC;AAErE,EAAA,MAAM,QAAA,GAA2B;AAAA,IAC/B,WAAA;AAAA,IACA,EAAA,CAAG,MAAc,OAAA,EAA+B;AAC9C,MAAA,IAAI,CAAC,IAAA,EAAM,MAAM,IAAI,UAAU,qCAAqC,CAAA;AAEpE,MAAA,QAAA,CAAS,IAAA,CAAK,EAAE,IAAA,EAAM,OAAA,EAAS,CAAA;AAC/B,MAAA,OAAO,QAAA;AAAA,IACT,CAAA;AAAA,IACA,MAAM,OAAO,QAAA,EAAU;AACrB,MAAA,MAAM,IAAA,GAAO,OAAO,QAAA,CAAS,IAAA,KAAS,QAAA,GAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA,GAAI,QAAA,CAAS,IAAA;AAEpG,MAAA,IAAI,IAAA,CAAK,aAAa,WAAA,EAAa,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAQ,WAAA,EAAY;AAE7E,MAAA,MAAM,SAAA,GAAY,QAAA,CAAS,QAAA,CAAS,OAAA,EAAS,qBAAqB,SAAS,CAAA;AAC3E,MAAA,IAAI,OAAA,GAAU,2BAAA;AAEd,MAAA,KAAA,MAAW,UAAU,OAAA,EAAS;AAC5B,QAAA,MAAM,MAAA,GAAS,MAAM,sBAAA,CAAuB,SAAA,EAAW,IAAA,EAAM,MAAA,EAAQ,EAAE,SAAA,EAAW,GAAA,EAAK,KAAA,CAAM,GAAA,EAAI,EAAG,CAAA;AAEpG,QAAA,IAAI,OAAO,KAAA,EAAO;AAChB,UAAA,OAAA,GAAU,EAAA;AACV,UAAA;AAAA,QACF;AAEA,QAAA,OAAA,GAAU,MAAA,CAAO,MAAA;AAAA,MACnB;AAEA,MAAA,IAAI,OAAA,EAAS;AACX,QAAA,OAAA,CAAQ,OAAA,GAAU,IAAI,KAAA,CAAM,OAAO,GAAG,EAAE,MAAA,EAAQ,YAAY,CAAA;AAC5D,QAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,UAAA,EAAW;AAAA,MAC3C;AAEA,MAAA,MAAM,KAAA,GAAQ,qBAAqB,IAAI,CAAA;AAEvC,MAAA,IAAI,CAAC,KAAA,EAAO,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,QAAQ,YAAA,EAAa;AAEvD,MAAA,MAAM,OAAA,GAAU,QAAA,CAAS,QAAA,CAAS,OAAA,EAAS,oBAAA,CAAqB,OAAO,CAAA,EAAG,IAAA,EAAK,IAAK,MAAA,CAAO,KAAA,CAAM,EAAA,IAAM,EAAE,CAAA;AAEzG,MAAA,IAAI,OAAA,IAAW,CAAE,MAAM,KAAA,CAAM,SAAS,OAAA,EAAS,QAAQ,CAAA,EAAI,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,aAAa,KAAA,EAAM;AAE5G,MAAA,IAAI;AACF,QAAA,KAAA,MAAW,EAAE,IAAA,EAAM,OAAA,EAAQ,IAAK,QAAA,EAAU,IAAI,IAAA,KAAS,GAAA,IAAO,IAAA,KAAS,KAAA,CAAM,IAAA,EAAM,MAAM,QAAQ,KAAK,CAAA;AAAA,MACxG,SAAS,KAAA,EAAO;AACd,QAAA,IAAI,OAAA,EAAS,MAAM,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA;AACxC,QAAA,OAAA,CAAQ,OAAA,GAAU,OAAO,EAAE,MAAA,EAAQ,kBAAkB,OAAA,EAAS,SAAA,EAAW,KAAA,CAAM,IAAA,EAAM,CAAA;AACrF,QAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,kBAAkB,KAAA,EAAM;AAAA,MACxD;AAEA,MAAA,OAAO,EAAE,MAAA,EAAQ,GAAA,EAAK,MAAA,EAAQ,WAAW,KAAA,EAAM;AAAA,IACjD;AAAA,GACF;AAEA,EAAA,OAAO,QAAA;AACT;AAKO,SAAS,8BAAA,CAA+B,QAAqBA,WAAAA,EAA8C;AAChH,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAoB;AAErC,EAAA,OAAO;AAAA,IACL,QAAA,CAAS,SAAS,QAAA,EAAU;AAC1B,MAAA,MAAM,GAAA,GAAM,MAAM,GAAA,EAAI;AAEtB,MAAA,KAAA,MAAW,CAAC,EAAA,EAAIC,MAAK,CAAA,IAAK,IAAA,EAAM;AAC9B,QAAA,IAAIA,SAAQ,GAAA,EAAK;AACjB,QAAA,IAAA,CAAK,OAAO,EAAE,CAAA;AAAA,MAChB;AAEA,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,OAAO,CAAA;AAE9B,MAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,GAAQ,GAAA,EAAK,OAAO,KAAA;AAE/C,MAAA,IAAA,CAAK,OAAO,OAAO,CAAA;AACnB,MAAA,IAAA,CAAK,GAAA,CAAI,OAAA,EAAS,GAAA,GAAM,QAAQ,CAAA;AAChC,MAAA,OAAO,IAAA;AAAA,IACT,CAAA;AAAA,IACA,QAAQ,OAAA,EAAS;AACf,MAAA,IAAA,CAAK,OAAO,OAAO,CAAA;AAAA,IACrB;AAAA,GACF;AACF;AAEA,SAAS,YAAA,CAAa,eAAmE,KAAA,EAAqD;AAC5I,EAAA,IAAI,aAAA,KAAkB,QAAQ,OAAO,EAAE,UAAU,MAAM,IAAA,EAAM,OAAA,EAAS,MAAM,MAAA,EAAU;AACtF,EAAA,IAAI,aAAA,KAAkB,QAAA,EAAU,OAAO,8BAAA,CAA+B,KAAK,CAAA;AAE3E,EAAA,OAAO,aAAA;AACT;AAEA,SAAS,QAAA,CAAS,SAAkE,IAAA,EAAkC;AACpH,EAAA,IAAI,OAAQ,QAAoB,GAAA,KAAQ,UAAA,SAAoB,OAAA,CAAoB,GAAA,CAAI,IAAI,CAAA,IAAK,MAAA;AAE7F,EAAA,MAAM,MAAA,GAAS,KAAK,WAAA,EAAY;AAEhC,EAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,OAAwD,CAAA,EAAG;AACnG,IAAA,IAAI,GAAA,CAAI,WAAA,EAAY,KAAM,MAAA,EAAQ,OAAO,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA;AAAA,EAC7E;AAEA,EAAA,OAAO,MAAA;AACT;AC3KO,SAAS,qBAAA,CAAsB,OAAA,EAA8C,KAAA,GAAsB,UAAA,CAAW,KAAA,EAAqB;AACxI,EAAA,MAAM,KAAA,GAAQ,QAAQ,OAAO,CAAA;AAE7B,EAAA,OAAO,CAAC,OAAO,IAAA,KAAS;AACtB,IAAA,IAAI,CAAC,KAAA,EAAO,OAAO,KAAA,CAAM,OAAO,IAAI,CAAA;AAEpC,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,IAAA,EAAM,YAAY,KAAA,YAAiB,OAAA,GAAU,KAAA,CAAM,OAAA,GAAU,MAAA,CAAU,CAAA;AAEnG,IAAA,OAAA,CAAQ,GAAA,CAAI,eAAA,EAAiB,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE,CAAA;AAE9C,IAAA,OAAO,MAAM,KAAA,EAAO,EAAE,GAAG,IAAA,EAAM,SAAS,CAAA;AAAA,EAC1C,CAAA;AACF;AAyBO,SAAS,iBAAiB,OAAA,EAAuI;AACtK,EAAA,MAAM,EAAE,QAAO,GAAI,OAAA;AACnB,EAAA,MAAM,KAAA,GAAQ,aAAA,CAAc,OAAA,CAAQ,MAAM,CAAA;AAC1C,EAAA,MAAM,WAAA,GAAA,CAAe,KAAA,IAAS,EAAA,EAAI,KAAA,CAAM,GAAG,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,EAAK,CAAE,IAAA,CAAK,GAAG,CAAA;AAC5E,EAAA,MAAM,SAASH,OAAAA,CAAQ,OAAA,CAAQ,gBAAA,EAAkBI,cAAAA,CAAe,kBAAkB,kBAAkB,CAAA;AACpG,EAAA,MAAM,OAAA,uBAAc,GAAA,EAA0C;AAC9D,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAmD;AAEvE,EAAA,MAAM,KAAA,GAAQ,OAAO,OAAA,KAAqC;AACxD,IAAA,MAAM,KAAA,GAAQ,QAAQ,OAAO,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,OAAO,OAAA,KAAY,QAAA,GAAW,SAAY,OAAA,CAAQ,OAAA;AAE9D,IAAA,OAAO,CAAA,EAAG,GAAA,GAAM,CAAA,IAAA,EAAO,GAAG,KAAK,MAAM,WAAA,CAAY,KAAK,CAAC,CAAA,CAAA,EAAI,OAAA,CAAQ,QAAA,IAAY,EAAE,IAAI,WAAW,CAAA,CAAA;AAAA,EAClG,CAAA;AAEA,EAAA,MAAM,QAAA,GAAyC,OAAO,OAAA,EAAS,MAAA,KAAW;AACxE,IAAA,MAAM,QAAA,GAAW,QAAQ,OAAO,CAAA;AAEhC,IAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAIC,YAAY,yEAAyE,CAAA;AAE9G,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,OAAQ,CAAA;AAChC,IAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAE9B,IAAA,IAAI,MAAA,IAAU,OAAO,UAAA,CAAW,KAAA,CAAM,KAAI,GAAI,MAAA,CAAO,WAAW,OAAO,MAAA;AAEvE,IAAA,IAAI,OAAA,GAAU,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAE7B,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAA,GAAU,OAAO,MAAA,CACd,QAAA,CAAS,EAAE,YAAA,EAAc,UAAU,MAAA,EAAQ,KAAA,EAAO,QAAA,EAAU,OAAA,CAAQ,UAAU,MAAA,EAAQ,CAAA,CACtF,IAAA,CAAK,CAAC,QAAA,KAAa;AAClB,QAAA,MAAM,KAAA,GAAQ,yBAAyB,QAAA,EAAU,MAAA,CAAO,WAAW,KAAA,CAAM,GAAA,IAAO,MAAM,CAAA;AAEtF,QAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,KAAK,CAAA;AACtB,QAAA,OAAO,KAAA;AAAA,MACT,CAAC,CAAA,CACA,OAAA,CAAQ,MAAM,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAC,CAAA;AACpC,MAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,OAAO,CAAA;AAAA,IAC1B;AAEA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA;AAEA,EAAA,MAAM,UAAA,GAA6C,OAAO,OAAA,EAAS,WAAA,KAAgB;AACjF,IAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,OAAO,CAAA;AAE/B,IAAA,IAAI,WAAA,KAAgB,MAAA,IAAa,OAAA,CAAQ,GAAA,CAAI,GAAG,GAAG,WAAA,KAAgB,WAAA,EAAa,OAAA,CAAQ,MAAA,CAAO,GAAG,CAAA;AAAA,EACpG,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,QAAA;AAAA,IACA,UAAA;AAAA,IACA,KAAA,CAAM,OAAA,EAAS,KAAA,GAAQ,MAAA,CAAO,WAAW,KAAA,EAAO;AAC9C,MAAA,OAAO,OAAO,OAAO,IAAA,KAAS;AAC5B,QAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,KAAA,EAAO,IAAI,CAAA;AACvC,QAAA,MAAM,OAAO,OAAA,CAAQ,IAAA,GAAO,MAAM,OAAA,CAAQ,aAAY,GAAI,MAAA;AAC1D,QAAA,MAAM,OAAA,GAAU,CAACC,MAAAA,KAAwC;AACvD,UAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,OAAA,CAAQ,OAAO,CAAA;AAE3C,UAAA,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA,EAAGA,MAAAA,CAAM,SAAS,CAAA,CAAA,EAAIA,MAAAA,CAAM,WAAW,CAAA,CAAE,CAAA;AAEtE,UAAA,OAAO,KAAA,CAAM,OAAA,CAAQ,GAAA,EAAK,EAAE,QAAQ,OAAA,CAAQ,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,QAAQ,OAAA,CAAQ,MAAA,EAAQ,QAAA,EAAU,OAAA,CAAQ,UAAU,CAAA;AAAA,QACzH,CAAA;AAEA,QAAA,MAAM,KAAA,GAAQ,MAAM,QAAA,CAAS,OAAA,EAAS,QAAQ,MAAM,CAAA;AACpD,QAAA,MAAM,QAAA,GAAW,MAAM,OAAA,CAAQ,KAAK,CAAA;AAEpC,QAAA,IAAI,SAAS,MAAA,KAAW,GAAA,IAAO,iBAAA,CAAkB,QAAQ,GAAG,OAAO,QAAA;AAEnE,QAAA,MAAM,UAAA,CAAW,OAAA,EAAU,KAAA,CAAM,WAAW,CAAA;AAE5C,QAAA,OAAO,QAAQ,MAAM,QAAA,CAAS,OAAA,EAAS,OAAA,CAAQ,MAAM,CAAC,CAAA;AAAA,MACxD,CAAA;AAAA,IACF;AAAA,GACF;AACF;AAKA,SAAS,kBAAkB,QAAA,EAA6B;AACtD,EAAA,OAAO,0BAAA,CAA2B,SAAS,OAAA,CAAQ,GAAA,CAAI,kBAAkB,CAAC,CAAA,EAAG,UAAU,iBAAA,CAAkB,8BAAA;AAC3G;AAEA,SAAS,QAAQ,OAAA,EAAkE;AACjF,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AAErB,EAAA,OAAO,OAAO,OAAA,KAAY,QAAA,GAAW,OAAA,GAAU,OAAA,CAAQ,KAAA;AACzD","file":"index.js","sourcesContent":["import {\n AuthioClaimTypes,\n parseResourceAccess,\n type AuthioCallerKind,\n type AuthioCredentialForm,\n type AuthioIntrospectionResult,\n type AuthioResourceAccess,\n type AuthioResourceAccessSource,\n} from \"@hyper.authio/client\";\n\n/*\n The party acting for the subject, from the `act` claim (RFC 8693): who exchanged the token, nested when the chain\n * is longer.\n /\nexport interface AuthioActor {\n readonly clientId: string \| undefined;\n readonly subject: string \| undefined;\n /* `name`, on an impersonation: the administrator's display name. /\n readonly name: string \| undefined;\n readonly actor: AuthioActor \| undefined;\n}\n\n/\n The administrator who impersonates the subject (an `act` with `sub` and no `client_id`).\n /\nexport interface AuthioImpersonator {\n readonly subject: string;\n readonly name: string \| undefined;\n}\n\n/\n Introspection `token_type` values that stand for an access token: `Bearer`, and `api_key` for a consumer's API key.\n /\nconst accessTokenTypes = new Set([\"bearer\", \"api_key\"]);\n\n/\n Where the user reads flat (non-`_resource_access`) roles and groups from.\n /\nexport interface AuthioUserClaimSettings {\n /*\n Claims holding role names directly, such as one written by a claim mapper with the Role source. They count for\n * `hasRole` without a source filter. Defaults to `[\"role\"]`.\n /\n roleClaims?: readonly string[];\n /\n Claims holding group names, such as one written by a claim mapper with the Group source. Defaults to\n * `[\"groups\"]`.\n /\n groupClaims?: readonly string[];\n}\n\n/\n The caller of an API, read from a validated access token, an introspection answer, or both (the token's claims and\n * those of the answer the token does not carry, as `activeCheck` reads it): identity, every form of permission Authio\n * issues, and the raw claims for anything else.\n /\nexport class AuthioUser {\n /* `sub`: the person's id, or the credential's for a machine caller. /\n readonly subject: string;\n /\n Who called: `user` (a person signed in), `client` (a client as itself), `consumer` (a machine consumer of a\n * client) or `account_credential` (a credential of an Authio account).\n /\n readonly kind: AuthioCallerKind;\n /\n How a machine caller proved who it is (`client_secret`, `personal_access_token`, `api_key`,\n * `consumer_api_key`); `undefined` for a person or a client.\n /\n readonly credentialForm: AuthioCredentialForm \| undefined;\n /* `consumer_name`, for a consumer. /\n readonly consumerName: string \| undefined;\n /* `credential_name`, for an account credential. /\n readonly credentialName: string \| undefined;\n /* `owner_user_id`: the person who made the credential. /\n readonly ownerUserId: string \| undefined;\n /\n `owner_username`: the person who made the credential. On an account credential Authio wrote it to\n * `consumer_name` before, which is read when `owner_username` is absent.\n /\n readonly ownerUsername: string \| undefined;\n /* `credential_realm`: the one realm an account credential is limited to. /\n readonly credentialRealm: string \| undefined;\n /* `credential_client`: the one client an account credential is limited to. /\n readonly credentialClient: string \| undefined;\n /* Whether an administrator impersonates the subject. /\n readonly impersonated: boolean;\n /* The administrator impersonating the subject. /\n readonly impersonator: AuthioImpersonator \| undefined;\n /* Whether a client acts for the subject through a delegation (`act` with `client_id`). /\n readonly delegated: boolean;\n /* The clients acting for the subject, outermost first. /\n readonly actorChain: readonly string[];\n /* `auth_time`, in seconds since the epoch. /\n readonly authTime: number \| undefined;\n /* The client the token was issued to (`client_id`, RFC 9068 §2.2, else `azp`). /\n readonly clientId: string \| undefined;\n /* `sid`. /\n readonly sessionId: string \| undefined;\n /* `jti`. /\n readonly tokenId: string \| undefined;\n /* `aud`. /\n readonly audiences: readonly string[];\n /* The granted scopes. /\n readonly scopes: readonly string[];\n /* The roles of the seven `_resource_access` claims, with their source and permissions. /\n readonly resourceAccess: AuthioResourceAccess;\n /** Every role name: the `_resource_access` roles, then the flat role claims. /\n readonly roles: readonly string[];\n /** Resource → every method any role allows on it. /\n readonly permissions: Readonly<Record<string, readonly string[]>>;\n /* The group names of the group claims. /\n readonly groups: readonly string[];\n /* `org_id`. /\n readonly organizationId: string \| undefined;\n /* `org_alias`. /\n readonly organizationAlias: string \| undefined;\n /* `account_id`. /\n readonly accountId: string \| undefined;\n /* `acr`. /\n readonly acr: string \| undefined;\n /* `acr` as a number: 1 one factor, 2 several, 3 one of them phishing-resistant. /\n readonly authenticationLevel: number \| undefined;\n /* `amr`. /\n readonly authenticationMethods: readonly string[];\n /* `idp`. /\n readonly identityProvider: string \| undefined;\n /* `auth_time`. /\n readonly authenticatedAt: Date \| undefined;\n /* `act`. /\n readonly actor: AuthioActor \| undefined;\n /* `delegation_id`. /\n readonly delegationId: string \| undefined;\n readonly email: string \| undefined;\n readonly emailVerified: boolean \| undefined;\n readonly name: string \| undefined;\n readonly preferredUsername: string \| undefined;\n /* `credential_type`, on a token issued to an account credential or a consumer. /\n readonly credentialType: string \| undefined;\n /* `credential_id`. /\n readonly credentialId: string \| undefined;\n /\n Every claim, as the token or the introspection answer carried it (with `activeCheck`, the token's, plus the\n * answer's the token does not carry).\n /\n readonly claims: Readonly<Record<string, unknown>>;\n /* The access token the user was read from. Not enumerable, so it stays out of logs and JSON. /\n declare readonly token: string \| undefined;\n\n private readonly flatRoles: readonly string[];\n\n /\n @param claims The token's payload, or the introspection answer's members.\n * @param settings Where flat roles and groups are read from.\n * @param token The access token, kept for forwarding and on-behalf-of.\n * @param source Where the claims come from: a JWT (default) or an introspection answer. An introspection answer for\n * a consumer that reports no `exp` and no `actor_type` is the consumer's API key (Authio reports no lifetime for a\n * key), so its `credentialForm` is `consumer_api_key`.\n /\n constructor(\n claims: Readonly<Record<string, unknown>>,\n settings: AuthioUserClaimSettings = {},\n token?: string,\n source: \"token\" \| \"introspection\" = \"token\",\n ) {\n const text = (name: string) => (typeof claims[name] === \"string\" && claims[name] ? (claims[name] as string) : undefined);\n\n this.claims = Object.freeze({ ...claims });\n this.subject = text(AuthioClaimTypes.Subject) ?? \"\";\n this.clientId = text(AuthioClaimTypes.ClientId) ?? text(AuthioClaimTypes.AuthorizedParty);\n this.sessionId = text(AuthioClaimTypes.SessionId);\n this.tokenId = text(AuthioClaimTypes.JwtId);\n this.audiences = Object.freeze(distinct(valuesOf(claims[AuthioClaimTypes.Audience])));\n this.scopes = Object.freeze(distinct(valuesOf(claims[AuthioClaimTypes.Scope]).flatMap((scope) => scope.split(/\\s+/)).filter(Boolean)));\n this.resourceAccess = parseResourceAccess(claims);\n this.flatRoles = Object.freeze((settings.roleClaims ?? [\"role\"]).flatMap((name) => valuesOf(claims[name])));\n this.roles = Object.freeze(distinctIgnoringCase([...this.resourceAccess.roles, ...this.flatRoles]));\n this.permissions = this.resourceAccess.permissions;\n this.groups = Object.freeze(distinct((settings.groupClaims ?? [\"groups\"]).flatMap((name) => valuesOf(claims[name]))));\n this.organizationId = text(AuthioClaimTypes.OrganizationId);\n this.organizationAlias = text(AuthioClaimTypes.OrganizationAlias);\n this.accountId = text(AuthioClaimTypes.AccountId);\n this.acr = valuesOf(claims[AuthioClaimTypes.AuthenticationContextClass])[0];\n this.authenticationLevel = this.acr !== undefined && /^\\d+$/.test(this.acr) ? Number(this.acr) : undefined;\n this.authenticationMethods = Object.freeze(distinctIgnoringCase(valuesOf(claims[AuthioClaimTypes.AuthenticationMethods])));\n this.identityProvider = text(AuthioClaimTypes.IdentityProvider);\n this.authenticatedAt = toDate(claims[AuthioClaimTypes.AuthTime]);\n this.actor = readActor(claims[AuthioClaimTypes.Actor]);\n this.delegationId = text(AuthioClaimTypes.DelegationId);\n this.email = text(AuthioClaimTypes.Email);\n this.emailVerified = toBoolean(claims[AuthioClaimTypes.EmailVerified]);\n this.name = text(AuthioClaimTypes.Name);\n this.preferredUsername = text(AuthioClaimTypes.PreferredUsername);\n this.credentialType = text(AuthioClaimTypes.CredentialType);\n this.credentialId = text(AuthioClaimTypes.CredentialId);\n this.authTime = toSeconds(claims[AuthioClaimTypes.AuthTime]);\n this.kind =\n this.credentialType === \"client_consumer\"\n ? \"consumer\"\n : this.credentialType === \"account_secret\"\n ? \"account_credential\"\n : this.authTime !== undefined\n ? \"user\"\n : \"client\";\n\n const machine = this.kind === \"consumer\" \|\| this.kind === \"account_credential\";\n\n const keyIntrospected = source === \"introspection\" && this.kind === \"consumer\" && claims[AuthioClaimTypes.Expiration] === undefined;\n\n this.credentialForm = machine\n ? ((text(AuthioClaimTypes.ActorType) as AuthioCredentialForm \| undefined) ?? (keyIntrospected ? \"consumer_api_key\" : \"client_secret\"))\n : undefined;\n this.consumerName = this.kind === \"consumer\" ? text(AuthioClaimTypes.ConsumerName) : undefined;\n this.credentialName = text(AuthioClaimTypes.CredentialName);\n this.ownerUserId = text(AuthioClaimTypes.OwnerUserId);\n this.ownerUsername =\n text(AuthioClaimTypes.OwnerUsername) ?? (this.kind === \"account_credential\" ? text(AuthioClaimTypes.ConsumerName) : undefined);\n this.credentialRealm = text(AuthioClaimTypes.CredentialRealm);\n this.credentialClient = text(AuthioClaimTypes.CredentialClient);\n this.delegated = this.actor?.clientId !== undefined;\n this.actorChain = Object.freeze(chainOf(this.actor));\n this.impersonated = !this.delegated && this.actor?.subject !== undefined;\n this.impersonator = this.impersonated ? Object.freeze({ subject: this.actor!.subject!, name: this.actor!.name }) : undefined;\n\n Object.defineProperty(this, \"token\", { value: token, enumerable: false });\n }\n\n /\n Reads the caller from an introspection answer: `client_id` becomes `azp`, `username` becomes\n * `preferred_username`, and `token_type` becomes `typ` unless it is `api_key` (a consumer's API key).\n /\n static fromIntrospection(result: AuthioIntrospectionResult, settings: AuthioUserClaimSettings = {}, token?: string): AuthioUser {\n return new AuthioUser(claimsOfIntrospection(result), settings, token, \"introspection\");\n }\n\n /* Whether the scope was granted. /\n hasScope(scope: string): boolean {\n return this.scopes.includes(scope);\n }\n\n /\n Whether the user holds the role. Without sources, from any `_resource_access` claim or a flat role claim; with\n sources, only from those `_resource_access` claims.\n /\n hasRole(role: string, options: { sources?: readonly AuthioResourceAccessSource[] } = {}): boolean {\n if (!role) return false;\n if (options.sources && options.sources.length > 0) return this.resourceAccess.hasRole(role, options.sources);\n\n const wanted = role.toLowerCase();\n\n return this.resourceAccess.hasRole(role) \|\| this.flatRoles.some((name) => name.toLowerCase() === wanted);\n }\n\n /*\n Authio's grant rule: whether a role (from any source, or only from the given ones) allows `method` on\n * `resource`. Case-insensitive.\n /\n hasPermission(resource: string, method: string, options: { sources?: readonly AuthioResourceAccessSource[] } = {}): boolean {\n return this.resourceAccess.grants(resource, method, options.sources);\n }\n\n /* Whether the user is in the group (exact match). /\n hasGroup(group: string): boolean {\n return this.groups.includes(group);\n }\n\n /\n Whether the claim is present (not `null`), and, given values, whether it holds one of them (exact match; an\n * array claim matches when any item does).\n /\n hasClaim(type: string, ...values: string[]): boolean {\n const present = this.claimValues(type);\n\n return values.length === 0 ? present.length > 0 : present.some((value) => values.includes(value));\n }\n\n /\n The claim's values as text: one for a scalar, one per item for an array, JSON text for an object.\n /\n claimValues(type: string): string[] {\n return valuesOf(this.claims[type]);\n }\n\n /* Every member but the raw token. /\n toJSON(): Record<string, unknown> {\n const { flatRoles: _flatRoles, ...members } = this as unknown as Record<string, unknown>;\n\n return { ...members, resourceAccess: this.resourceAccess.entries };\n }\n}\n\n/\n The claims an introspection answer stands for, named as in a JWT.\n \n @internal\n /\nexport function claimsOfIntrospection(result: AuthioIntrospectionResult): Record<string, unknown> {\n const { active: _active, token_type: tokenType, username, ...members } = result;\n const claims: Record<string, unknown> = { ...members };\n\n if (typeof tokenType === \"string\" && claims.typ === undefined && tokenType.toLowerCase() !== \"api_key\") claims.typ = tokenType;\n if (typeof username === \"string\" && claims.preferred_username === undefined) claims.preferred_username = username;\n if (typeof result.client_id === \"string\" && claims.azp === undefined) claims.azp = result.client_id;\n\n return claims;\n}\n\n/\n Whether an introspection `token_type` stands for an access token.\n \n @internal\n /\nexport function isAccessTokenType(type: string): boolean {\n return accessTokenTypes.has(type.toLowerCase());\n}\n\n/\n A claim's values as text.\n \n @internal\n /\nexport function valuesOf(value: unknown): string[] {\n if (value === undefined \|\| value === null) return [];\n if (Array.isArray(value)) return value.flatMap((item) => (item === null \|\| item === undefined ? [] : [toText(item)]));\n\n if (typeof value === \"string\" && value.startsWith(\"[\")) {\n try {\n const parsed = JSON.parse(value) as unknown;\n\n if (Array.isArray(parsed)) return valuesOf(parsed);\n } catch {\n return [value];\n }\n }\n\n return [toText(value)];\n}\n\nfunction toText(value: unknown): string {\n return typeof value === \"string\" ? value : typeof value === \"object\" ? JSON.stringify(value) : String(value);\n}\n\nfunction readActor(value: unknown, depth = 0): AuthioActor \| undefined {\n let actor = value;\n\n if (typeof actor === \"string\") {\n try {\n actor = JSON.parse(actor);\n } catch {\n return undefined;\n }\n }\n\n if (!actor \|\| typeof actor !== \"object\" \|\| Array.isArray(actor) \|\| depth > 16) return undefined;\n\n const record = actor as Record<string, unknown>;\n\n return Object.freeze({\n clientId: typeof record.client_id === \"string\" && record.client_id ? record.client_id : undefined,\n subject: typeof record.sub === \"string\" && record.sub ? record.sub : undefined,\n name: typeof record.name === \"string\" && record.name ? record.name : undefined,\n actor: readActor(record.act, depth + 1),\n });\n}\n\nfunction chainOf(actor: AuthioActor \| undefined): string[] {\n const chain: string[] = [];\n\n for (let current = actor; current; current = current.actor) if (current.clientId) chain.push(current.clientId);\n\n return chain;\n}\n\nfunction toSeconds(value: unknown): number \| undefined {\n return typeof value === \"number\" && Number.isFinite(value) ? value : typeof value === \"string\" && /^\\d+$/.test(value) ? Number(value) : undefined;\n}\n\nfunction toDate(value: unknown): Date \| undefined {\n const seconds = typeof value === \"number\" ? value : typeof value === \"string\" && /^\\d+$/.test(value) ? Number(value) : undefined;\n\n return seconds === undefined ? undefined : new Date(seconds 1000);\n}\n\nfunction toBoolean(value: unknown): boolean \| undefined {\n if (typeof value === \"boolean\") return value;\n if (value === \"true\") return true;\n if (value === \"false\") return false;\n\n return undefined;\n}\n\nfunction distinct(values: readonly string[]): string[] {\n return [...new Set(values)];\n}\n\nfunction distinctIgnoringCase(values: readonly string[]): string[] {\n const seen = new Set<string>();\n\n return values.filter((value) => {\n const key = value.toLowerCase();\n\n if (seen.has(key)) return false;\n\n seen.add(key);\n return true;\n });\n}\n","import { systemClock, type AuthioCallerKind, type AuthioClock, type AuthioResourceAccessSource } from \"@hyper.authio/client\";\nimport type { AuthioUser } from \"./user.js\";\n\n/*\n How several required values combine.\n /\nexport type AuthioMatch = \"any\" \| \"all\";\n\n/\n Why a rule refused the caller.\n /\nexport interface AuthioRuleFailure {\n /* What is missing, in words. /\n readonly message: string;\n /\n The RFC 6750 / RFC 9470 error to put in `WWW-Authenticate`: `insufficient_scope` for scopes,\n * `insufficient_user_authentication` for `acr`/`amr`, none otherwise.\n /\n readonly error?: \"insufficient_scope\" \| \"insufficient_user_authentication\";\n /* The required scopes, for `insufficient_scope`. /\n readonly scope?: string;\n /* The context classes to ask for again, for `insufficient_user_authentication` (RFC 9470 `acr_values`). /\n readonly acrValues?: string;\n /* How old the sign-in may be, in seconds, for `insufficient_user_authentication` (RFC 9470 `max_age`). /\n readonly maxAge?: number;\n}\n\n/\n A condition on the caller.\n /\nexport interface AuthioRule {\n /* What the rule requires, for logs. /\n readonly description: string;\n /* `undefined` when the caller satisfies the rule, else why not. /\n check(user: AuthioUser): AuthioRuleFailure \| undefined;\n}\n\n/\n Checks every rule. On refusal the message joins every rule's. When a rule other than a step-up fails (a scope, role,\n * permission, group, claim, organization, client or caller kind), no stronger sign-in can satisfy the request: the\n * refusal is a `403`, with the first such rule's error (`insufficient_scope`) or none, and never asks for a step-up.\n * Only when every failing rule asks for a stronger or more recent sign-in is the error `insufficient_user_authentication`,\n * with the strongest `acr_values` and the shortest `max_age` they ask for.\n /\nexport function authorize(user: AuthioUser, ...rules: AuthioRule[]): AuthioRuleFailure \| undefined {\n const failures = rules.map((rule) => rule.check(user)).filter((failure): failure is AuthioRuleFailure => failure !== undefined);\n\n if (failures.length === 0) return undefined;\n\n const others = failures.filter((failure) => failure.error !== \"insufficient_user_authentication\");\n const stepUps = others.length === 0 ? failures : [];\n const bearer = stepUps[0] ?? others.find((failure) => failure.error);\n const acrValues = strongestAcr(stepUps.map((failure) => failure.acrValues));\n const maxAges = stepUps.map((failure) => failure.maxAge).filter((value): value is number => value !== undefined);\n\n return {\n message: failures.map((failure) => failure.message).join(\" \"),\n ...(bearer?.error ? { error: bearer.error } : {}),\n ...(bearer?.scope ? { scope: bearer.scope } : {}),\n ...(acrValues ? { acrValues } : {}),\n ...(maxAges.length > 0 ? { maxAge: Math.min(...maxAges) } : {}),\n };\n}\n\n/\n Requires granted scopes.\n /\nexport function requireScope(scopes: string \| readonly string[], match: AuthioMatch = \"any\"): AuthioRule {\n const required = listOf(scopes, \"scope\");\n\n return {\n description: `Authio scope (${match}): ${required.join(\" \")}`,\n check: (user) =>\n satisfies(required, match, (scope) => user.hasScope(scope))\n ? undefined\n : {\n message: `The token lacks the required scope (${match}): ${required.join(\" \")}.`,\n error: \"insufficient_scope\",\n scope: required.join(\" \"),\n },\n };\n}\n\n/\n Requires roles, from any source or only from the given `_resource_access` claims.\n /\nexport function requireRole(\n roles: string \| readonly string[],\n options: { match?: AuthioMatch; sources?: readonly AuthioResourceAccessSource[] } = {},\n): AuthioRule {\n const required = listOf(roles, \"role\");\n const match = options.match ?? \"any\";\n const from = describeSources(options.sources);\n\n return {\n description: `Authio role (${match}): ${required.join(\", \")}${from}`,\n check: (user) =>\n satisfies(required, match, (role) => user.hasRole(role, { sources: options.sources }))\n ? undefined\n : { message: `The caller lacks the required role (${match}): ${required.join(\", \")}${from}.` },\n };\n}\n\n/*\n Requires a permission (`method` on `resource`), granted by a role from any source or only from the given ones.\n /\nexport function requirePermission(resource: string, method: string, options: { sources?: readonly AuthioResourceAccessSource[] } = {}): AuthioRule {\n if (!resource?.trim() \|\| !method?.trim()) throw new TypeError(\"A permission needs a resource and a method.\");\n\n const from = describeSources(options.sources);\n\n return {\n description: `Authio permission: ${resource}:${method}${from}`,\n check: (user) =>\n user.hasPermission(resource, method, { sources: options.sources }) ? undefined : { message: `The caller lacks the permission ${resource}:${method}${from}.` },\n };\n}\n\n/\n Requires groups, read from the group claims (a claim mapper with the Group source).\n /\nexport function requireGroup(groups: string \| readonly string[], match: AuthioMatch = \"any\"): AuthioRule {\n const required = listOf(groups, \"group\");\n\n return {\n description: `Authio group (${match}): ${required.join(\", \")}`,\n check: (user) =>\n satisfies(required, match, (group) => user.hasGroup(group))\n ? undefined\n : { message: `The caller is not in the required group (${match}): ${required.join(\", \")}.` },\n };\n}\n\n/\n Requires a claim: present, or holding one of the given values. Fits claim-mapper claims, the user's own claims and\n * any other claim Authio issues.\n /\nexport function requireClaim(type: string, ...values: string[]): AuthioRule {\n if (!type?.trim()) throw new TypeError(\"A claim rule needs a claim type.\");\n\n return {\n description: values.length === 0 ? `Authio claim: ${type}` : `Authio claim: ${type} in ${values.join(\", \")}`,\n check: (user) =>\n user.hasClaim(type, ...values)\n ? undefined\n : { message: values.length === 0 ? `The token lacks the claim ${type}.` : `The token's claim ${type} is not one of: ${values.join(\", \")}.` },\n };\n}\n\n/\n Requires an organization context, or a given organization (alias or id, case-insensitive).\n /\nexport function requireOrganization(organization?: string): AuthioRule {\n const wanted = organization?.trim() \|\| undefined;\n\n return {\n description: `Authio organization: ${wanted ?? \"any\"}`,\n check: (user) => {\n const satisfied =\n !!user.organizationId &&\n (!wanted \|\|\n user.organizationAlias?.toLowerCase() === wanted.toLowerCase() \|\|\n user.organizationId.toLowerCase() === wanted.toLowerCase());\n\n return satisfied\n ? undefined\n : { message: wanted ? `The token is not in the organization ${wanted}.` : \"The token has no organization context.\" };\n },\n };\n}\n\n/\n Requires a minimum authentication level (`acr`): 1 one factor, 2 several, 3 one of them phishing-resistant. The\n * refusal asks for that level again (`acr_values`), and for a sign-in at most `maxAge` seconds old when given.\n /\nexport function requireAuthenticationLevel(minimumLevel: number, options: { maxAge?: number; clock?: AuthioClock } = {}): AuthioRule {\n if (!Number.isInteger(minimumLevel) \|\| minimumLevel < 0) throw new RangeError(\"The minimum level must be a non-negative integer.\");\n\n const recency = options.maxAge === undefined ? undefined : requireRecentAuthentication(options.maxAge, { clock: options.clock });\n\n return {\n description: `Authio authentication level >= ${minimumLevel}${recency ? `, ${recency.description}` : \"\"}`,\n check: (user) => {\n const levelMet = user.authenticationLevel !== undefined && user.authenticationLevel >= minimumLevel;\n const recent = recency?.check(user);\n\n if (levelMet && !recent) return undefined;\n\n return {\n message: [levelMet ? undefined : `The authentication level must be at least ${minimumLevel}.`, recent?.message].filter(Boolean).join(\" \"),\n error: \"insufficient_user_authentication\",\n acrValues: String(minimumLevel),\n ...(options.maxAge !== undefined ? { maxAge: options.maxAge } : {}),\n };\n },\n };\n}\n\n/\n The context class each authentication method implies when an API asks for it again (Authio's `acr` levels).\n /\nconst methodLevels: Readonly<Record<string, string>> = { mfa: \"2\", otp: \"2\", mca: \"2\", sms: \"2\", swk: \"3\", hwk: \"3\" };\n\n/\n Requires authentication methods (`amr`, case-insensitive), such as `otp`, `swk` or `fed`. The refusal asks for the\n * context class the methods imply (`2` for `mfa`/`otp`/`mca`, `3` for `swk`/`hwk`), or for `acrValues` when given.\n /\nexport function requireAuthenticationMethod(\n methods: string \| readonly string[],\n match: AuthioMatch = \"any\",\n options: { acrValues?: string } = {},\n): AuthioRule {\n const required = listOf(methods, \"authentication method\");\n const levels = required.map((method) => methodLevels[method.toLowerCase()]).filter((level): level is string => level !== undefined);\n const acrValues = options.acrValues ?? (levels.length === 0 ? undefined : match === \"all\" ? strongestAcr(levels) : weakestAcr(levels));\n\n return {\n description: `Authio authentication method (${match}): ${required.join(\", \")}`,\n check: (user) => {\n const used = user.authenticationMethods.map((method) => method.toLowerCase());\n\n return satisfies(required, match, (method) => used.includes(method.toLowerCase()))\n ? undefined\n : {\n message: `The user must authenticate with (${match}): ${required.join(\", \")}.`,\n error: \"insufficient_user_authentication\",\n ...(acrValues ? { acrValues } : {}),\n };\n },\n };\n}\n\n/\n Requires a sign-in at most `maxAge` seconds old (`auth_time`); the refusal asks for it with `max_age` (RFC 9470).\n /\nexport function requireRecentAuthentication(maxAge: number, options: { clock?: AuthioClock } = {}): AuthioRule {\n if (!Number.isInteger(maxAge) \|\| maxAge < 0) throw new RangeError(\"maxAge must be a non-negative whole number of seconds.\");\n\n const clock = options.clock ?? systemClock;\n\n return {\n description: `Authio sign-in at most ${maxAge} s old`,\n check: (user) =>\n user.authTime !== undefined && clock.now() - user.authTime 1000 <= maxAge * 1000\n ? undefined\n : {\n message:\n user.authTime === undefined\n ? `The token carries no sign-in time; a sign-in at most ${maxAge} seconds old is required.`\n : `The sign-in must be at most ${maxAge} seconds old.`,\n error: \"insufficient_user_authentication\",\n maxAge,\n },\n };\n}\n\n/*\n Requires the caller to be of one of the kinds: `user`, `client`, `consumer`, `account_credential`.\n /\nexport function requireCallerKind(kinds: AuthioCallerKind \| readonly AuthioCallerKind[]): AuthioRule {\n const required = listOf(kinds, \"caller kind\") as AuthioCallerKind[];\n\n return {\n description: `Authio caller kind: ${required.join(\", \")}`,\n check: (user) => (required.includes(user.kind) ? undefined : { message: `The caller is a ${user.kind}, not one of: ${required.join(\", \")}.` }),\n };\n}\n\n/\n Requires the token to have been issued to one of the clients (`client_id`, else `azp`).\n /\nexport function requireClient(clientIds: string \| readonly string[]): AuthioRule {\n const required = listOf(clientIds, \"client id\");\n\n return {\n description: `Authio client: ${required.join(\", \")}`,\n check: (user) =>\n user.clientId !== undefined && required.includes(user.clientId)\n ? undefined\n : { message: `The token was not issued to an accepted client (${required.join(\", \")}).` },\n };\n}\n\n/\n Requires every rule.\n /\nexport function allOf(...rules: AuthioRule[]): AuthioRule {\n return {\n description: rules.map((rule) => rule.description).join(\" and \"),\n check: (user) => authorize(user, ...rules),\n };\n}\n\n/\n Requires at least one rule; the refusal is the first rule's.\n /\nexport function anyOf(...rules: AuthioRule[]): AuthioRule {\n if (rules.length === 0) throw new TypeError(\"anyOf needs at least one rule.\");\n\n return {\n description: rules.map((rule) => rule.description).join(\" or \"),\n check: (user) => {\n const failures = rules.map((rule) => rule.check(user));\n\n return failures.some((failure) => failure === undefined) ? undefined : failures[0];\n },\n };\n}\n\nfunction listOf(values: string \| readonly string[], name: string): string[] {\n const list = [...new Set((typeof values === \"string\" ? [values] : [...values]).filter((value) => value?.trim()))];\n\n if (list.length === 0) throw new TypeError(`At least one ${name} is required.`);\n\n return list;\n}\n\nfunction satisfies(required: readonly string[], match: AuthioMatch, holds: (value: string) => boolean): boolean {\n return match === \"all\" ? required.every(holds) : required.some(holds);\n}\n\nfunction strongestAcr(values: readonly (string \| undefined)[]): string \| undefined {\n return rankAcr(values, (left, right) => right - left);\n}\n\nfunction weakestAcr(values: readonly (string \| undefined)[]): string \| undefined {\n return rankAcr(values, (left, right) => left - right);\n}\n\nfunction rankAcr(values: readonly (string \| undefined)[], order: (left: number, right: number) => number): string \| undefined {\n const known = values.filter((value): value is string => !!value);\n const numeric = known.filter((value) => /^\\d+$/.test(value)).sort((left, right) => order(Number(left), Number(right)));\n\n return numeric[0] ?? known[0];\n}\n\nfunction describeSources(sources: readonly AuthioResourceAccessSource[] \| undefined): string {\n return sources && sources.length > 0 ? ` from ${[...new Set(sources)].join(\", \")}` : \"\";\n}\n","import { AuthioError, type AuthioTokenFailure } from \"@hyper.authio/client\";\nimport type { AuthioRuleFailure } from \"./rules.js\";\n\n/\n The request carries no valid access token: answer `401` with `wwwAuthenticate`.\n /\nexport class AuthioBearerError extends AuthioError {\n readonly status = 401;\n /* `invalid_token`, or `undefined` when the request had no token at all (RFC 6750 §3.1). /\n readonly error: \"invalid_token\" \| undefined;\n /* Why the token was refused, safe to send to the caller. /\n readonly description: string \| undefined;\n /* Why the token was refused, as a stable code; `undefined` when there was no token or Authio could not be asked. /\n readonly reason: AuthioTokenFailure \| \"inactive\" \| \"unconfirmed\" \| undefined;\n /* The API's protected resource metadata URL (RFC 9728), sent as `resource_metadata` when configured. /\n readonly resourceMetadata: string \| undefined;\n\n constructor(\n description: string \| undefined,\n options: {\n error?: \"invalid_token\" \| undefined;\n cause?: unknown;\n reason?: AuthioTokenFailure \| \"inactive\" \| \"unconfirmed\";\n resourceMetadata?: string;\n } = {},\n ) {\n super(description ?? \"A valid Authio access token is required.\", { cause: options.cause });\n this.error = \"error\" in options ? options.error : \"invalid_token\";\n this.description = description === undefined ? undefined : toHeaderText(description);\n this.reason = options.reason;\n this.resourceMetadata = options.resourceMetadata;\n }\n\n /* The same refusal, pointing at the API's protected resource metadata. /\n withResourceMetadata(resourceMetadata: string \| undefined): AuthioBearerError {\n if (!resourceMetadata \|\| resourceMetadata === this.resourceMetadata) return this;\n\n return new AuthioBearerError(this.description, { error: this.error, cause: this.cause, reason: this.reason, resourceMetadata });\n }\n\n /* The `WWW-Authenticate` value. /\n get wwwAuthenticate(): string {\n const parameters: string[] = [];\n\n if (this.error) parameters.push(`error=\"${this.error}\"`);\n if (this.error && this.description) parameters.push(`error_description=\"${this.description}\"`);\n if (this.resourceMetadata) parameters.push(`resource_metadata=\"${escapeQuoted(this.resourceMetadata)}\"`);\n\n return parameters.length === 0 ? \"Bearer\" : `Bearer ${parameters.join(\", \")}`;\n }\n}\n\n/\n A rule refused a caller whose token is valid. A refusal asking for a stronger or more recent sign-in\n * (`insufficient_user_authentication`) answers `401`, as RFC 9470 §3 has it, naming the protected resource metadata\n * (`resource_metadata`, RFC 9728 §5.1) when the API publishes it; every other refusal answers `403`, with\n * `wwwAuthenticate` when it is about scopes (`insufficient_scope`, RFC 6750 §3.1).\n /\nexport class AuthioForbiddenError extends AuthioError {\n /* `401` for a step-up (`insufficient_user_authentication`), `403` otherwise. /\n readonly status: 401 \| 403;\n readonly failure: AuthioRuleFailure;\n /* The API's protected resource metadata URL (RFC 9728), sent as `resource_metadata` with a step-up `401`. /\n readonly resourceMetadata: string \| undefined;\n\n constructor(failure: AuthioRuleFailure, options: { resourceMetadata?: string } = {}) {\n super(failure.message);\n this.failure = failure;\n this.status = failure.error === \"insufficient_user_authentication\" ? 401 : 403;\n this.resourceMetadata = options.resourceMetadata;\n }\n\n /* The same refusal, pointing at the API's protected resource metadata. /\n withResourceMetadata(resourceMetadata: string \| undefined): AuthioForbiddenError {\n if (!resourceMetadata \|\| resourceMetadata === this.resourceMetadata) return this;\n\n return new AuthioForbiddenError(this.failure, { resourceMetadata });\n }\n\n /\n The `WWW-Authenticate` value, or `undefined` when the refusal is not about scopes or the sign-in. A step-up `401`\n * carries `resource_metadata` when `resourceMetadata` is set.\n /\n get wwwAuthenticate(): string \| undefined {\n const challenge = toForbiddenChallenge(this.failure);\n\n return challenge && this.status === 401 && this.resourceMetadata ? `${challenge}, resource_metadata=\"${escapeQuoted(this.resourceMetadata)}\"` : challenge;\n }\n}\n\n/\n The `WWW-Authenticate` value of a refusal: `insufficient_scope` (with `scope`) or `insufficient_user_authentication`\n * (with `acr_values` and `max_age`, RFC 9470).\n /\nexport function toForbiddenChallenge(failure: AuthioRuleFailure): string \| undefined {\n if (!failure.error) return undefined;\n\n const parameters = [`error=\"${failure.error}\"`, `error_description=\"${escapeQuoted(toHeaderText(failure.message))}\"`];\n\n if (failure.scope) parameters.push(`scope=\"${escapeQuoted(failure.scope)}\"`);\n if (failure.acrValues) parameters.push(`acr_values=\"${escapeQuoted(failure.acrValues)}\"`);\n if (failure.maxAge !== undefined) parameters.push(`max_age=${failure.maxAge}`);\n\n return `Bearer ${parameters.join(\", \")}`;\n}\n\n/\n Problem details (RFC 9457) for a `401` or `403`, with the refusal's `status`: a step-up refusal is `401`\n * Unauthorized and carries `error`, `acr_values` and `max_age`.\n /\nexport function toProblemDetails(error: AuthioBearerError \| AuthioForbiddenError): Record<string, unknown> {\n if (error instanceof AuthioBearerError)\n return {\n type: unauthorizedType,\n title: \"Unauthorized\",\n status: 401,\n detail: \"A valid Authio access token is required.\",\n };\n\n return {\n type: error.status === 401 ? unauthorizedType : \"https://tools.ietf.org/html/rfc9110#section-15.5.4\",\n title: error.status === 401 ? \"Unauthorized\" : \"Forbidden\",\n status: error.status,\n detail: error.failure.message \|\| \"The caller is not allowed to access this resource.\",\n ...(error.failure.error ? { error: error.failure.error } : {}),\n ...(error.failure.scope ? { scope: error.failure.scope } : {}),\n ...(error.failure.acrValues ? { acr_values: error.failure.acrValues } : {}),\n ...(error.failure.maxAge !== undefined ? { max_age: error.failure.maxAge } : {}),\n };\n}\n\nconst unauthorizedType = \"https://tools.ietf.org/html/rfc9110#section-15.5.2\";\n\n/\n Keeps only the characters RFC 6750 §3 allows in an `error_description`.\n \n @internal\n /\nexport function toHeaderText(text: string): string {\n return [...text].map((character) => (character >= \" \" && character <= \"~\" && character !== '\"' && character !== \"\\\\\" ? character : \"?\")).join(\"\");\n}\n\nfunction escapeQuoted(value: string): string {\n return value.replace(/\\\\/g, \"\\\\\\\\\").replace(/\"/g, '\\\\\"');\n}\n","import { AuthioConfigurationError, AuthioDefaults, resolveIssuer, type AuthioConnectionOptions } from \"@hyper.authio/client\";\n\n/\n What an API publishes about itself as a protected resource (RFC 9728).\n /\nexport interface AuthioProtectedResourceMetadataOptions extends Pick<AuthioConnectionOptions, \"issuer\" \| \"authority\" \| \"realm\"> {\n /* The API's resource identifier (RFC 8707), such as `https://orders.example.com/api`. Required. /\n resource: string;\n /* Scopes a client can ask for to call the API. /\n scopesSupported?: readonly string[];\n /* A name to show to people. /\n resourceName?: string;\n /* A page documenting the API. /\n resourceDocumentation?: string;\n /* Further members, sent as given. /\n extra?: Record<string, unknown>;\n}\n\n/\n The protected resource metadata document (RFC 9728 §2).\n /\nexport interface AuthioProtectedResourceMetadata {\n resource: string;\n authorization_servers: string[];\n bearer_methods_supported: string[];\n scopes_supported?: string[];\n resource_name?: string;\n resource_documentation?: string;\n [member: string]: unknown;\n}\n\n/\n Where a resource's metadata is published: `{origin}/.well-known/oauth-protected-resource{path}` (RFC 9728 §3.1),\n * the path being the resource's own, without a trailing slash.\n /\nexport function protectedResourceMetadataUrl(resource: string): string {\n const url = parseResource(resource);\n const path = url.pathname.replace(/\\/+$/, \"\");\n\n return `${url.origin}${AuthioDefaults.ProtectedResourceMetadataPath}${path}`;\n}\n\n/\n The path a resource's metadata is served at on the API itself: `/.well-known/oauth-protected-resource{path}`.\n /\nexport function protectedResourceMetadataPath(resource: string): string {\n return new URL(protectedResourceMetadataUrl(resource)).pathname;\n}\n\n/\n Builds the API's protected resource metadata: the resource, the realm's issuer as its authorization server, bearer\n * tokens in the `Authorization` header, and the optional scopes, name and documentation.\n /\nexport function createProtectedResourceMetadata(options: AuthioProtectedResourceMetadataOptions): AuthioProtectedResourceMetadata {\n parseResource(options.resource);\n\n const document: AuthioProtectedResourceMetadata = {\n ...options.extra,\n resource: options.resource,\n authorization_servers: [resolveIssuer(options)],\n bearer_methods_supported: [\"header\"],\n };\n\n if (options.scopesSupported && options.scopesSupported.length > 0) document.scopes_supported = [...options.scopesSupported];\n if (options.resourceName) document.resource_name = options.resourceName;\n if (options.resourceDocumentation) document.resource_documentation = options.resourceDocumentation;\n\n return document;\n}\n\nfunction parseResource(resource: string): URL {\n let url: URL;\n\n try {\n url = new URL(resource);\n } catch (error) {\n throw new AuthioConfigurationError(`The resource '${resource}' is not an absolute URL.`, { cause: error });\n }\n\n if (url.hash) throw new AuthioConfigurationError(`The resource '${resource}' must not carry a fragment (RFC 8707).`);\n\n return url;\n}\n","import {\n AuthioAsymmetricAlgorithms,\n AuthioConfigurationError,\n AuthioHmacAlgorithms,\n AuthioTokenTypes,\n AuthioTokenValidationError,\n createAuthioClient,\n createAuthioDiscoveryClient,\n createAuthioSigningKeys,\n createAuthioTokenDecrypter,\n encryptionKeyFromFile,\n isAuthioTokenEncrypted,\n requireHmacSecretLength,\n resolveConnection,\n seconds,\n requireAccessTokenType,\n verifyAuthioJwt,\n withClientSecret,\n type AuthioClient,\n type AuthioClientOptions,\n type AuthioConnection,\n type AuthioConnectionOptions,\n type AuthioDiscoveryClient,\n type AuthioEncryptionKeySource,\n type AuthioIntrospectionResult,\n} from \"@hyper.authio/client\";\nimport { decodeProtectedHeader, type JWTPayload } from \"jose\";\nimport { AuthioBearerError } from \"./errors.js\";\nimport { protectedResourceMetadataUrl } from \"./resource-metadata.js\";\nimport { AuthioUser, claimsOfIntrospection, isAccessTokenType, type AuthioUserClaimSettings } from \"./user.js\";\n\n/\n Whether and how Authio's introspection endpoint takes part in validating a token.\n \n - `none`: the JWT is validated locally (signature, issuer, audience, lifetime) and the caller is read from it alone.\n * Fastest; a revoked token stays valid until it expires. A lightweight access token carries no roles, permissions,\n * plan, profile or email, so it needs one of the modes below.\n * - `activeCheck`: validated locally, then confirmed active by introspection (cached per `jti`). The caller is read\n * from the token, and the introspection answer adds the claims the token does not carry: the answer has every claim\n * of the complete token, so a lightweight access token's roles and permissions are read too. A claim the token\n * carries keeps the token's value, which its signature vouches for, whatever the answer says.\n * - `introspectionOnly`: introspection alone, for opaque (reference) tokens, or encrypted ones without the key. The\n * caller is read from the answer.\n /\nexport type AuthioIntrospectionMode = \"none\" \| \"activeCheck\" \| \"introspectionOnly\";\n\n/\n How an API validates Authio access tokens.\n /\nexport interface AuthioVerifierOptions extends AuthioConnectionOptions, AuthioUserClaimSettings {\n /* The audiences this API accepts: its resource identifier (RFC 8707) or client id. Required unless `resource` is set. /\n audiences?: string \| readonly string[];\n /\n The API's own resource identifier (RFC 8707), such as `https://orders.example.com`. Added to `audiences`, and\n * the `resource` of its protected resource metadata (RFC 9728).\n /\n resource?: string;\n /\n Points `401` challenges at the API's protected resource metadata (RFC 9728) with `resource_metadata`: `true`\n * for `{origin of resource}/.well-known/oauth-protected-resource{path of resource}`, or the URL itself. Off by default.\n /\n resourceMetadata?: boolean \| string;\n /* Scopes every request must carry (all of them); `authioBearer` answers `403 insufficient_scope` otherwise. /\n requiredScopes?: readonly string[];\n /* Defaults to `none`. /\n introspection?: AuthioIntrospectionMode;\n /\n The API's confidential client, for introspection: a client already created, or its options (issuer settings are\n * taken from these options when absent). It must be the client the resource server names as its introspection\n * client, since Authio answers introspection according to who asks.\n /\n client?: AuthioClient \| Omit<AuthioClientOptions, keyof AuthioConnectionOptions>;\n /* Seconds an active introspection answer is kept (never past the token's expiry). Defaults to 30. /\n introspectionCacheDuration?: number;\n /* Seconds of clock skew tolerated on `exp` and `nbf`. Defaults to 30. /\n clockSkew?: number;\n /\n The algorithm (or algorithms) access tokens are signed with, as the client registered in Authio signs them:\n * RS/PS/ES 256/384/512, or HS256/384/512 verified with the `clientSecret` of `client` (its UTF-8 octets, at least\n * 32, 48 or 64 bytes as RFC 7518 §3.2 asks). Only the client's own API holds that secret, so only it validates an HS\n token locally; any other API validates such tokens with introspection. Left out, the asymmetric algorithms of the\n * realm's keys are accepted, and never HS.\n /\n accessTokenSignedResponseAlg?: string \| readonly string[];\n /*\n Refuses a token whose `typ` claim is present and not `Bearer` (an ID token, for one). Defaults to `true`. A JWT\n * whose header `typ` is not `at+jwt` (RFC 9068 §4) is refused whatever this says.\n /\n rejectNonAccessTokens?: boolean;\n /\n The private half of the encryption key Authio encrypts this API's access tokens to (the resource server's or its\n * client's), so encrypted tokens are decrypted and validated locally (RSA-OAEP, RSA-OAEP-256).\n /\n clientEncryptionKey?: AuthioEncryptionKeySource;\n /* A PEM or JWK file holding `clientEncryptionKey` (Node only). /\n clientEncryptionKeyPath?: string;\n /\n The key management algorithms (`alg`) decrypted. Defaults to RSA-OAEP and RSA-OAEP-256; RSA1_5 cannot be listed,\n * because Node cannot decrypt it.\n /\n encryptionAlgorithms?: readonly string[];\n /* The content encryption algorithms (`enc`) decrypted. Defaults to A128CBC-HS256, A192CBC-HS384, A256CBC-HS512. /\n encryptionMethods?: readonly string[];\n /* Accepted for parity with the other Authio SDKs; RSA1_5 stays refused, because Node cannot decrypt it. /\n allowLegacyEncryptionAlgorithms?: boolean;\n}\n\n/\n Validates Authio access tokens and reads the caller.\n /\nexport interface AuthioVerifier {\n /* The connection settings. /\n readonly connection: AuthioConnection;\n /* The discovery document. /\n readonly discovery: AuthioDiscoveryClient;\n /* The accepted audiences. /\n readonly audiences: readonly string[];\n /* The API's resource identifier, when configured. /\n readonly resource: string \| undefined;\n /* The protected resource metadata URL sent in challenges, when turned on. /\n readonly resourceMetadataUrl: string \| undefined;\n /* Scopes every request must carry. /\n readonly requiredScopes: readonly string[];\n /* The introspection mode. /\n readonly introspection: AuthioIntrospectionMode;\n /* The client used for introspection, when there is one. /\n readonly client: AuthioClient \| undefined;\n /\n Validates a token and reads the caller.\n \n @throws AuthioBearerError when the token is not valid for this API.\n /\n verify(token: string, signal?: AbortSignal): Promise<AuthioUser>;\n /\n Validates the token of an `Authorization: Bearer` header.\n \n @throws AuthioBearerError without an error code when there is no bearer token, with `invalid_token` when it is\n * not valid.\n /\n verifyAuthorizationHeader(header: string \| null \| undefined, signal?: AbortSignal): Promise<AuthioUser>;\n}\n\n/\n Error descriptions of the refusals the SDK makes itself.\n /\nexport const AuthioBearerErrorDescriptions = {\n Inactive:\n \"Authio reports the token as not active to this API's client. It was revoked or has expired or its session ended; or this API's client is not the introspection client of the resource server the token is for.\",\n Unconfirmed: \"Authio could not be reached to confirm that the token is active.\",\n Empty: \"The token is empty.\",\n Encrypted: \"The token is encrypted; set clientEncryptionKey to decrypt it, or validate it with introspection ('introspectionOnly').\",\n SigningKeysUnavailable: \"Authio could not be reached to read its signing keys.\",\n Symmetric:\n \"The token is signed with the client's secret (HS): set accessTokenSignedResponseAlg and the client's clientSecret to validate it locally, or validate it with introspection ('introspectionOnly').\",\n} as const;\n\nconst maxCachedAnswers = 10_000;\n\n/*\n Creates a token verifier.\n \n @throws AuthioConfigurationError when no audience is given, or introspection is asked for without a client.\n /\nexport function createAuthioVerifier(options: AuthioVerifierOptions): AuthioVerifier {\n const resource = options.resource?.trim() \|\| undefined;\n const given = typeof options.audiences === \"string\" ? [options.audiences] : [...(options.audiences ?? [])];\n const audiences = [...new Set([...given, ...(resource ? [resource] : [])].filter((value) => value?.trim()))];\n\n if (audiences.length === 0)\n throw new AuthioConfigurationError(\"The Authio verifier needs at least one audience: the API's resource identifier or client id.\");\n\n const connection = resolveConnection(options);\n const discovery = createAuthioDiscoveryClient(connection);\n const introspection = options.introspection ?? \"none\";\n const client = resolveClient(options);\n\n if (introspection !== \"none\" && !client)\n throw new AuthioConfigurationError(\n `Authio introspection ('${introspection}') needs the API's confidential client: pass options.client with its clientId and clientSecret or private key.`,\n );\n\n const resourceMetadataUrl = resolveResourceMetadata(options.resourceMetadata, resource);\n const cacheDurationMs = seconds(options.introspectionCacheDuration, 30, \"introspectionCacheDuration\");\n const clockSkew = seconds(options.clockSkew, 30, \"clockSkew\") / 1000;\n const algorithms = resolveAccessTokenAlgorithms(options.accessTokenSignedResponseAlg);\n const symmetric = algorithms?.filter((algorithm) => (AuthioHmacAlgorithms as readonly string[]).includes(algorithm)) ?? [];\n const clientSecret = symmetric.length > 0 ? resolveClientSecret(options, symmetric) : undefined;\n const rejectNonAccessTokens = options.rejectNonAccessTokens ?? true;\n const claimSettings: AuthioUserClaimSettings = { roleClaims: options.roleClaims, groupClaims: options.groupClaims };\n const cache = new Map<string, { result: AuthioIntrospectionResult; until: number }>();\n const signingKeys = createAuthioSigningKeys(connection, discovery);\n const encryptionKey =\n options.clientEncryptionKey ?? (options.clientEncryptionKeyPath ? encryptionKeyFromFile(options.clientEncryptionKeyPath) : undefined);\n const decrypt =\n encryptionKey === undefined\n ? undefined\n : createAuthioTokenDecrypter(encryptionKey, {\n setting: options.clientEncryptionKey === undefined ? \"clientEncryptionKeyPath\" : \"clientEncryptionKey\",\n allowLegacyEncryptionAlgorithms: options.allowLegacyEncryptionAlgorithms,\n encryptionAlgorithms: options.encryptionAlgorithms,\n encryptionMethods: options.encryptionMethods,\n });\n const requiredScopes = Object.freeze([...new Set((options.requiredScopes ?? []).filter((scope) => scope?.trim()))]);\n\n const introspect = async (token: string, key: string, signal?: AbortSignal): Promise<AuthioIntrospectionResult \| undefined> => {\n const now = connection.clock.now();\n const cached = cache.get(key);\n\n if (cached && cached.until > now) return cached.result;\n\n cache.delete(key);\n\n const result = await client!.introspect(token, { tokenTypeHint: AuthioTokenTypes.AccessToken, signal });\n\n if (!result.active) return undefined;\n\n const until = Math.min(now + cacheDurationMs, typeof result.exp === \"number\" ? result.exp 1000 : Number.POSITIVE_INFINITY);\n\n if (until > now) {\n if (cache.size >= maxCachedAnswers) cache.delete(cache.keys().next().value!);\n cache.set(key, { result, until });\n }\n\n return result;\n };\n\n const verifyJwt = async (token: string, signal?: AbortSignal): Promise<AuthioUser> => {\n let signed = token;\n\n if (isAuthioTokenEncrypted(token)) {\n if (!decrypt) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Encrypted, { reason: \"decryption_failed\" });\n\n try {\n signed = await decrypt(token);\n } catch (error) {\n if (error instanceof AuthioTokenValidationError) throw new AuthioBearerError(error.message, { cause: error, reason: error.reason });\n throw error;\n }\n }\n\n let keySet: Awaited<ReturnType<typeof signingKeys>>;\n\n try {\n keySet = withClientSecret(await signingKeys(signal), clientSecret);\n } catch (error) {\n throw new AuthioBearerError(AuthioBearerErrorDescriptions.SigningKeysUnavailable, { cause: error, reason: \"signing_keys_unavailable\" });\n }\n\n let payload: JWTPayload;\n\n try {\n let header: Record<string, unknown>;\n\n ({ payload, header } = await verifyAuthioJwt(signed, keySet, {\n issuer: connection.issuer,\n audiences,\n algorithms,\n clockSkew,\n now: connection.clock.now(),\n }));\n\n requireAccessTokenType(header);\n } catch (error) {\n if (error instanceof AuthioTokenValidationError && error.reason === \"invalid_algorithm\" && symmetric.length === 0 && isSymmetricToken(signed))\n throw new AuthioBearerError(AuthioBearerErrorDescriptions.Symmetric, { cause: error, reason: error.reason });\n if (error instanceof AuthioTokenValidationError) throw new AuthioBearerError(error.message, { cause: error, reason: error.reason });\n throw error;\n }\n\n const type = typeof payload.typ === \"string\" ? payload.typ : undefined;\n\n if (rejectNonAccessTokens && type !== undefined && type.toLowerCase() !== \"bearer\")\n throw new AuthioBearerError(`Only access tokens are accepted; this token's typ is '${type}'.`, { reason: \"not_access_token\" });\n\n if (introspection !== \"activeCheck\") return new AuthioUser(payload, claimSettings, token);\n\n const answer = await confirmActive(token, payload, signal);\n\n return new AuthioUser({ ...claimsOfIntrospection(answer), ...payload }, claimSettings, token);\n };\n\n const confirmActive = async (token: string, payload: JWTPayload, signal?: AbortSignal): Promise<AuthioIntrospectionResult> => {\n const key = payload.jti ? `jti:${payload.jti}` : await keyForToken(token);\n let result: AuthioIntrospectionResult \| undefined;\n\n try {\n result = await introspect(token, key, signal);\n } catch (error) {\n if (signal?.aborted) throw error;\n throw new AuthioBearerError(AuthioBearerErrorDescriptions.Unconfirmed, { cause: error, reason: \"unconfirmed\" });\n }\n\n if (!result) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Inactive, { reason: \"inactive\" });\n\n return result;\n };\n\n const verifyByIntrospection = async (token: string, signal?: AbortSignal): Promise<AuthioUser> => {\n let result: AuthioIntrospectionResult \| undefined;\n\n try {\n result = await introspect(token, await keyForToken(token), signal);\n } catch (error) {\n if (signal?.aborted) throw error;\n throw new AuthioBearerError(AuthioBearerErrorDescriptions.Unconfirmed, { cause: error, reason: \"unconfirmed\" });\n }\n\n if (!result) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Inactive, { reason: \"inactive\" });\n\n if (result.iss && result.iss !== connection.issuer) throw new AuthioBearerError(`The issuer '${result.iss}' is invalid`, { reason: \"invalid_issuer\" });\n\n const tokenAudiences = [result.aud ?? []].flat();\n\n if (!tokenAudiences.some((audience) => audiences.includes(audience)))\n throw new AuthioBearerError(describeAudience(tokenAudiences, audiences), { reason: \"invalid_audience\" });\n\n if (typeof result.exp === \"number\" && (result.exp + clockSkew) * 1000 <= connection.clock.now())\n throw new AuthioBearerError(`The token expired at '${new Date(result.exp * 1000).toISOString()}'`, { reason: \"expired\" });\n\n const claims = claimsOfIntrospection(result);\n const type = typeof claims.typ === \"string\" ? claims.typ : undefined;\n\n if (rejectNonAccessTokens && type !== undefined && !isAccessTokenType(type))\n throw new AuthioBearerError(`Only access tokens are accepted; this token's typ is '${type}'.`, { reason: \"not_access_token\" });\n\n return new AuthioUser(claims, claimSettings, token, \"introspection\");\n };\n\n const verify = async (token: string, signal?: AbortSignal): Promise<AuthioUser> => {\n try {\n if (typeof token !== \"string\" \|\| !token.trim()) throw new AuthioBearerError(AuthioBearerErrorDescriptions.Empty, { reason: \"malformed\" });\n\n return introspection === \"introspectionOnly\" ? await verifyByIntrospection(token.trim(), signal) : await verifyJwt(token.trim(), signal);\n } catch (error) {\n throw error instanceof AuthioBearerError ? error.withResourceMetadata(resourceMetadataUrl) : error;\n }\n };\n\n return {\n connection,\n discovery,\n audiences,\n resource,\n resourceMetadataUrl,\n requiredScopes,\n introspection,\n client,\n verify,\n async verifyAuthorizationHeader(header, signal) {\n const token = readBearerToken(header);\n\n if (token === undefined) throw new AuthioBearerError(undefined, { error: undefined, resourceMetadata: resourceMetadataUrl });\n\n return verify(token, signal);\n },\n };\n}\n\n/*\n The token of an `Authorization: Bearer` header, or `undefined` when the header is absent or of another scheme.\n /\nexport function readBearerToken(header: string \| null \| undefined): string \| undefined {\n const match = /^\\sBearer\\s+(\\S+)\\s$/i.exec(header ?? \"\");\n\n return match?.[1];\n}\n\n/\n The cache key of a token: `token:` and the hex SHA-256 of the token.\n \n @internal\n /\nexport async function keyForToken(token: string): Promise<string> {\n const digest = new Uint8Array(await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(token)));\n\n return `token:${[...digest].map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\")}`;\n}\n\nfunction resolveResourceMetadata(setting: boolean \| string \| undefined, resource: string \| undefined): string \| undefined {\n if (!setting) return undefined;\n if (typeof setting === \"string\") return setting;\n if (!resource)\n throw new AuthioConfigurationError(\"resourceMetadata: true needs the API's resource identifier: set options.resource, or pass the metadata URL.\");\n\n return protectedResourceMetadataUrl(resource);\n}\n\nfunction resolveAccessTokenAlgorithms(setting: string \| readonly string[] \| undefined): string[] \| undefined {\n const algorithms = [...new Set((typeof setting === \"string\" ? [setting] : [...(setting ?? [])]).map((algorithm) => algorithm.trim()).filter(Boolean))];\n const known = [...AuthioAsymmetricAlgorithms, ...AuthioHmacAlgorithms] as readonly string[];\n\n for (const algorithm of algorithms)\n if (!known.includes(algorithm))\n throw new AuthioConfigurationError(`The Authio accessTokenSignedResponseAlg '${algorithm}' is not one of ${known.join(\", \")}.`);\n\n return algorithms.length > 0 ? algorithms : undefined;\n}\n\nfunction resolveClientSecret(options: AuthioVerifierOptions, symmetric: readonly string[]): () => Promise<string> {\n const given = options.client;\n const source = given && !isClient(given) ? given.clientSecret : undefined;\n\n if (!source)\n throw new AuthioConfigurationError(\n `accessTokenSignedResponseAlg ${symmetric.join(\", \")} is verified with the client secret: pass options.client as { clientId, clientSecret } (an AuthioClient does not expose its secret).`,\n );\n\n if (typeof source === \"string\") for (const algorithm of symmetric) requireHmacSecretLength(algorithm, new TextEncoder().encode(source).length);\n\n return async () => {\n const value = typeof source === \"function\" ? await source() : source;\n\n if (typeof value !== \"string\" \|\| !value) throw new AuthioConfigurationError(\"The Authio clientSecret function returned no secret.\");\n\n return value;\n };\n}\n\nfunction isSymmetricToken(token: string): boolean {\n try {\n return (AuthioHmacAlgorithms as readonly string[]).includes(String(decodeProtectedHeader(token).alg));\n } catch {\n return false;\n }\n}\n\nfunction resolveClient(options: AuthioVerifierOptions): AuthioClient \| undefined {\n const given = options.client;\n\n if (!given) return undefined;\n if (isClient(given)) return given;\n\n return createAuthioClient({\n ...given,\n issuer: options.issuer,\n authority: options.authority,\n realm: options.realm,\n requireHttps: options.requireHttps,\n discoveryCacheDuration: options.discoveryCacheDuration,\n httpTimeout: options.httpTimeout,\n fetch: options.fetch,\n clock: options.clock,\n } as AuthioClientOptions);\n}\n\nfunction isClient(value: unknown): value is AuthioClient {\n return typeof (value as AuthioClient).introspect === \"function\" && typeof (value as AuthioClient).tokens === \"object\";\n}\n\nfunction describeAudience(tokenAudiences: readonly string[], audiences: readonly string[]): string {\n const known = tokenAudiences.length === 0 ? \"\" : ` ${tokenAudiences.map((audience) => `'${audience}'`).join(\" and \")}`;\n const accepted = audiences.map((audience) => `'${audience}'`).join(\" or \");\n\n return audiences.length === 1\n ? `The token is not addressed to this API: its audience${known} is not ${accepted}. Request the token for that resource (RFC 8707).`\n : `The token is not addressed to this API: its audience${known} is not ${accepted}. Request the token for one of those resources (RFC 8707).`;\n}\n","import {\n AuthioConfigurationError,\n AuthioWebhookHeaders,\n systemClock,\n tryParseWebhookEvent,\n verifyWebhookSignature,\n type AuthioClock,\n type AuthioTypedWebhookEvent,\n type AuthioWebhookDataByType,\n type AuthioWebhookEvent,\n} from \"@hyper.authio/client\";\n\n/\n Remembers delivered event ids, so a redelivery is acknowledged without running the handlers twice.\n /\nexport interface AuthioWebhookDeduplicationStore {\n /* Records the id; `false` when it was already recorded within the window. /\n tryBegin(eventId: string, windowMs: number): boolean \| Promise<boolean>;\n /* Forgets the id, after a handler failed, so the redelivery runs again. /\n release(eventId: string): void \| Promise<void>;\n}\n\n/\n How webhook deliveries are received.\n /\nexport interface AuthioWebhookOptions {\n /* The webhook's secret. /\n secret?: string;\n /* Several secrets, while one is being rotated; a delivery signed with any of them is accepted. /\n secrets?: readonly string[];\n /* Seconds a signature's timestamp may differ from now. Defaults to 300. /\n tolerance?: number;\n /* `memory` (default), `none`, or a store shared between instances. /\n deduplication?: \"memory\" \| \"none\" \| AuthioWebhookDeduplicationStore;\n /* Seconds a delivered id is remembered. Defaults to 86400. /\n deduplicationWindow?: number;\n /* The largest body accepted, in bytes. Defaults to 1 MiB. /\n maxBodySize?: number;\n /* The clock. /\n clock?: AuthioClock;\n /* Called when a delivery is refused or a handler fails. /\n onError?: (error: unknown, context: { reason: string; eventId?: string; eventType?: string }) => void;\n}\n\n/\n A handler of one event type, or of every type.\n /\nexport type AuthioWebhookHandler<E extends AuthioWebhookEvent = AuthioWebhookEvent> = (event: E) => void \| Promise<void>;\n\n/\n What to answer a delivery with.\n /\nexport interface AuthioWebhookOutcome {\n /* `200` handled, duplicate or ping; `400` unreadable; `401` bad or stale signature; `413` too large; `500` a handler failed. /\n readonly status: 200 \| 400 \| 401 \| 413 \| 500;\n /* Why, for logs. /\n readonly reason: \"handled\" \| \"duplicate\" \| \"unreadable\" \| \"unsigned\" \| \"too_large\" \| \"handler_failed\";\n readonly event?: AuthioWebhookEvent;\n}\n\n/\n Receives Authio webhook deliveries: verifies, deduplicates and dispatches them.\n /\nexport interface AuthioWebhooks {\n /* Handles one event type, typed. /\n on<T extends keyof AuthioWebhookDataByType>(type: T, handler: AuthioWebhookHandler<AuthioTypedWebhookEvent<T>>): AuthioWebhooks;\n /* Handles another event type, or `` for every type. /\n on(type: string, handler: AuthioWebhookHandler): AuthioWebhooks;\n /*\n Handles a delivery: the body exactly as received and the request headers.\n /\n handle(delivery: { body: string \| Uint8Array; headers: Headers \| Record<string, string \| string[] \| undefined> }): Promise<AuthioWebhookOutcome>;\n /* The largest body accepted, in bytes. /\n readonly maxBodySize: number;\n}\n\n/\n Creates a webhook receiver. Handlers run in registration order; a `` handler sees every event.\n \n * @throws AuthioConfigurationError when no secret is configured.\n /\nexport function createAuthioWebhooks(options: AuthioWebhookOptions): AuthioWebhooks {\n const secrets = [...new Set([options.secret, ...(options.secrets ?? [])].filter((secret): secret is string => !!secret?.trim()))];\n\n if (secrets.length === 0) throw new AuthioConfigurationError(\"Authio webhooks need the webhook's secret.\");\n\n const clock = options.clock ?? systemClock;\n const tolerance = options.tolerance ?? 300;\n const windowMs = (options.deduplicationWindow ?? 86_400) 1000;\n const maxBodySize = options.maxBodySize ?? 1024 * 1024;\n const store = resolveStore(options.deduplication ?? \"memory\", clock);\n const handlers: { type: string; handler: AuthioWebhookHandler }[] = [];\n\n const webhooks: AuthioWebhooks = {\n maxBodySize,\n on(type: string, handler: AuthioWebhookHandler) {\n if (!type) throw new TypeError(\"An event type (or '') is required.\");\n\n handlers.push({ type, handler });\n return webhooks;\n },\n async handle(delivery) {\n const body = typeof delivery.body === \"string\" ? new TextEncoder().encode(delivery.body) : delivery.body;\n\n if (body.byteLength > maxBodySize) return { status: 413, reason: \"too_large\" };\n\n const signature = headerOf(delivery.headers, AuthioWebhookHeaders.Signature);\n let refusal = \"no webhook secret matched\";\n\n for (const secret of secrets) {\n const result = await verifyWebhookSignature(signature, body, secret, { tolerance, now: clock.now() });\n\n if (result.valid) {\n refusal = \"\";\n break;\n }\n\n refusal = result.reason;\n }\n\n if (refusal) {\n options.onError?.(new Error(refusal), { reason: \"unsigned\" });\n return { status: 401, reason: \"unsigned\" };\n }\n\n const event = tryParseWebhookEvent(body);\n\n if (!event) return { status: 400, reason: \"unreadable\" };\n\n const eventId = headerOf(delivery.headers, AuthioWebhookHeaders.EventId)?.trim() \|\| String(event.id ?? \"\");\n\n if (eventId && !(await store.tryBegin(eventId, windowMs))) return { status: 200, reason: \"duplicate\", event };\n\n try {\n for (const { type, handler } of handlers) if (type === \"\" \|\| type === event.type) await handler(event);\n } catch (error) {\n if (eventId) await store.release(eventId);\n options.onError?.(error, { reason: \"handler_failed\", eventId, eventType: event.type });\n return { status: 500, reason: \"handler_failed\", event };\n }\n\n return { status: 200, reason: \"handled\", event };\n },\n };\n\n return webhooks;\n}\n\n/*\n A deduplication store kept in this process's memory.\n /\nexport function createMemoryDeduplicationStore(clock: AuthioClock = systemClock): AuthioWebhookDeduplicationStore {\n const seen = new Map<string, number>();\n\n return {\n tryBegin(eventId, windowMs) {\n const now = clock.now();\n\n for (const [id, until] of seen) {\n if (until > now) break;\n seen.delete(id);\n }\n\n const until = seen.get(eventId);\n\n if (until !== undefined && until > now) return false;\n\n seen.delete(eventId);\n seen.set(eventId, now + windowMs);\n return true;\n },\n release(eventId) {\n seen.delete(eventId);\n },\n };\n}\n\nfunction resolveStore(deduplication: NonNullable<AuthioWebhookOptions[\"deduplication\"]>, clock: AuthioClock): AuthioWebhookDeduplicationStore {\n if (deduplication === \"none\") return { tryBegin: () => true, release: () => undefined };\n if (deduplication === \"memory\") return createMemoryDeduplicationStore(clock);\n\n return deduplication;\n}\n\nfunction headerOf(headers: Headers \| Record<string, string \| string[] \| undefined>, name: string): string \| undefined {\n if (typeof (headers as Headers).get === \"function\") return (headers as Headers).get(name) ?? undefined;\n\n const wanted = name.toLowerCase();\n\n for (const [key, value] of Object.entries(headers as Record<string, string \| string[] \| undefined>)) {\n if (key.toLowerCase() === wanted) return Array.isArray(value) ? value[0] : value;\n }\n\n return undefined;\n}\n","import {\n AuthioDefaults,\n AuthioError,\n AuthioOAuthErrors,\n parseAuthioBearerChallenge,\n seconds,\n toClientCredentialsToken,\n toScopeString,\n type AuthioClient,\n type AuthioClientCredentialsToken,\n} from \"@hyper.authio/client\";\nimport type { AuthioUser } from \"./user.js\";\nimport { keyForToken } from \"./verifier.js\";\n\n/\n Who a downstream call is made for: a caller read by the verifier, or the incoming access token itself.\n /\nexport type AuthioDownstreamSubject = AuthioUser \| string;\n\n/\n A `fetch` that forwards the caller's own access token, unchanged, to a downstream API that accepts the same\n * audience. Sends no `Authorization` when there is no token.\n /\nexport function createForwardingFetch(subject: AuthioDownstreamSubject \| undefined, inner: typeof fetch = globalThis.fetch): typeof fetch {\n const token = tokenOf(subject);\n\n return (input, init) => {\n if (!token) return inner(input, init);\n\n const headers = new Headers(init?.headers ?? (input instanceof Request ? input.headers : undefined));\n\n headers.set(\"authorization\", `Bearer ${token}`);\n\n return inner(input, { ...init, headers });\n };\n}\n\n/\n Exchanges the caller's token for one addressed to a downstream API (RFC 8693), and caches it.\n /\nexport interface AuthioOnBehalfOf {\n /\n A token for the downstream API on the caller's behalf: cached per incoming `jti` (else token hash), resource and\n * sorted scopes, renewed `tokenRefreshSkew` before expiry (at most half its lifetime); concurrent callers share\n * one exchange.\n \n @throws AuthioError when there is no incoming token.\n /\n getToken(subject: AuthioDownstreamSubject \| undefined, signal?: AbortSignal): Promise<AuthioClientCredentialsToken>;\n /* Drops a cached token; with `accessToken`, only when the cache still holds that token. /\n invalidate(subject: AuthioDownstreamSubject, accessToken?: string): Promise<void>;\n /* A `fetch` that sends the exchanged token, and on a `401` drops it and retries once. /\n fetch(subject: AuthioDownstreamSubject \| undefined, inner?: typeof fetch): typeof fetch;\n}\n\n/\n Creates an on-behalf-of exchanger.\n \n @param options `client` (the API's confidential client), the downstream `resource` and `scopes`.\n /\nexport function createOnBehalfOf(options: { client: AuthioClient; resource?: string; scopes?: Iterable<string> \| string; tokenRefreshSkew?: number }): AuthioOnBehalfOf {\n const { client } = options;\n const scope = toScopeString(options.scopes);\n const sortedScope = (scope ?? \"\").split(\" \").filter(Boolean).sort().join(\" \");\n const skewMs = seconds(options.tokenRefreshSkew, AuthioDefaults.TokenRefreshSkew, \"tokenRefreshSkew\");\n const entries = new Map<string, AuthioClientCredentialsToken>();\n const pending = new Map<string, Promise<AuthioClientCredentialsToken>>();\n\n const keyOf = async (subject: AuthioDownstreamSubject) => {\n const token = tokenOf(subject)!;\n const jti = typeof subject === \"string\" ? undefined : subject.tokenId;\n\n return `${jti ? `jti:${jti}` : await keyForToken(token)}\|${options.resource ?? \"\"}\|${sortedScope}`;\n };\n\n const getToken: AuthioOnBehalfOf[\"getToken\"] = async (subject, signal) => {\n const incoming = tokenOf(subject);\n\n if (!incoming) throw new AuthioError(\"On-behalf-of needs the caller's access token, and the request has none.\");\n\n const key = await keyOf(subject!);\n const cached = entries.get(key);\n\n if (cached && client.connection.clock.now() < cached.refreshAt) return cached;\n\n let request = pending.get(key);\n\n if (!request) {\n request = client.tokens\n .exchange({ subjectToken: incoming, scopes: scope, resource: options.resource, signal })\n .then((response) => {\n const token = toClientCredentialsToken(response, client.connection.clock.now(), skewMs);\n\n entries.set(key, token);\n return token;\n })\n .finally(() => pending.delete(key));\n pending.set(key, request);\n }\n\n return request;\n };\n\n const invalidate: AuthioOnBehalfOf[\"invalidate\"] = async (subject, accessToken) => {\n const key = await keyOf(subject);\n\n if (accessToken === undefined \|\| entries.get(key)?.accessToken === accessToken) entries.delete(key);\n };\n\n return {\n getToken,\n invalidate,\n fetch(subject, inner = client.connection.fetch) {\n return async (input, init) => {\n const request = new Request(input, init);\n const body = request.body ? await request.arrayBuffer() : undefined;\n const attempt = (token: AuthioClientCredentialsToken) => {\n const headers = new Headers(request.headers);\n\n headers.set(\"authorization\", `${token.tokenType} ${token.accessToken}`);\n\n return inner(request.url, { method: request.method, headers, body, signal: request.signal, redirect: request.redirect });\n };\n\n const token = await getToken(subject, request.signal);\n const response = await attempt(token);\n\n if (response.status !== 401 \|\| isStepUpChallenge(response)) return response;\n\n await invalidate(subject!, token.accessToken);\n\n return attempt(await getToken(subject, request.signal));\n };\n },\n };\n}\n\n/\n Whether a `401` asks for a stronger or more recent sign-in (RFC 9470 §3), which a new exchanged token cannot satisfy.\n */\nfunction isStepUpChallenge(response: Response): boolean {\n return parseAuthioBearerChallenge(response.headers.get(\"www-authenticate\"))?.error === AuthioOAuthErrors.InsufficientUserAuthentication;\n}\n\nfunction tokenOf(subject: AuthioDownstreamSubject \| undefined): string \| undefined {\n if (!subject) return undefined;\n\n return typeof subject === \"string\" ? subject : subject.token;\n}\n"]}