@inrupt/solid-client-authn-browser 5.0.1 → 5.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/solid-client-authn.bundle.js +1 -1
  2. package/dist/solid-client-authn.bundle.js.map +1 -1
  3. package/package.json +6 -6
package/dist/solid-client-authn.bundle.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"solid-client-authn.bundle.js","sources":["../../../node_modules/jose/dist/webapi/lib/buffer_utils.js","../../../node_modules/jose/dist/webapi/util/errors.js","../../../node_modules/jose/dist/webapi/util/base64url.js","../../../node_modules/jose/dist/webapi/lib/validate.js","../../../node_modules/jose/dist/webapi/lib/key.js","../../../node_modules/jose/dist/webapi/lib/key_descriptor.js","../../../node_modules/jose/dist/webapi/lib/jwe_algorithms.js","../../../node_modules/jose/dist/webapi/lib/jws_algorithms.js","../../../node_modules/jose/dist/webapi/lib/jws_verify.js","../../../node_modules/jose/dist/webapi/lib/jwt_claims_set.js","../../../node_modules/jose/dist/webapi/jwt/verify.js","../../../node_modules/jose/dist/webapi/lib/jws_sign.js","../../../node_modules/jose/dist/webapi/jwt/sign.js","../../../node_modules/jose/dist/webapi/lib/key_algorithm.js","../../../node_modules/jose/dist/webapi/key/export.js","../../../node_modules/jose/dist/webapi/jwks/local.js","../../../node_modules/jose/dist/webapi/jwks/remote.js","../../../node_modules/jose/dist/webapi/key/generate_key_pair.js","../../../node_modules/@inrupt/solid-client-authn-core/node_modules/uuid/dist/stringify.js","../../../node_modules/@inrupt/solid-client-authn-core/node_modules/uuid/dist/rng.js","../../../node_modules/@inrupt/solid-client-authn-core/node_modules/uuid/dist/v4.js","../../../node_modules/@inrupt/solid-client-authn-core/dist/index.mjs","../node_modules/uuid/dist/stringify.js","../node_modules/uuid/dist/rng.js","../node_modules/uuid/dist/v4.js","../../../node_modules/events/events.js","../src/storage/StorageUtility.ts","../../../node_modules/jwt-decode/build/esm/index.js","../../../node_modules/oidc-client-ts/dist/esm/oidc-client-ts.js","../../../node_modules/@inrupt/oidc-client-ext/dist/index.es.js","../src/ClientAuthentication.ts","../src/login/oidc/OidcLoginHandler.ts","../src/login/oidc/oidcHandlers/AuthorizationCodeWithPkceOidcHandler.ts","../src/login/oidc/IssuerConfigFetcher.ts","../src/sessionInfo/SessionInfoManager.ts","../src/login/oidc/incomingRedirectHandler/FallbackRedirectHandler.ts","../src/login/oidc/incomingRedirectHandler/AuthCodeRedirectHandler.ts","../src/login/oidc/AggregateRedirectHandler.ts","../src/storage/BrowserStorage.ts","../src/login/oidc/Redirector.ts","../src/login/oidc/ClientRegistrar.ts","../src/login/oidc/incomingRedirectHandler/ErrorOidcHandler.ts","../src/login/oidc/refresh/TokenRefresher.ts","../src/dependencies.ts","../src/constant.ts","../src/Session.ts","../src/defaultSession.ts"],"sourcesContent":["const encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder(\"utf-8\", { fatal: !0 }), MAX_INT32 = 2 ** 32;\nfunction concat(...buffers) {\n const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);\n let i = 0;\n for (const buffer of buffers)\n buf.set(buffer, i), i += buffer.length;\n return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n if (value < 0 || value >= MAX_INT32)\n throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);\n buf.set([value >>> 24, value >>> 16, value >>> 8, value & 255], offset);\n}\nfunction uint64be(value) {\n const high = Math.floor(value / MAX_INT32), low = value % MAX_INT32, buf = new Uint8Array(8);\n return writeUInt32BE(buf, high, 0), writeUInt32BE(buf, low, 4), buf;\n}\nfunction uint32be(value) {\n const buf = new Uint8Array(4);\n return writeUInt32BE(buf, value), buf;\n}\nconst NON_ASCII = /[^\\x00-\\x7f]/;\nfunction encode(string) {\n if (typeof string == \"string\" && string.length >= 128) {\n if (NON_ASCII.test(string))\n throw new TypeError(\"non-ASCII string encountered in encode()\");\n return encoder.encode(string);\n }\n const bytes = new Uint8Array(string.length);\n for (let i = 0; i < string.length; i++) {\n const code = string.charCodeAt(i);\n if (code > 127)\n throw new TypeError(\"non-ASCII string encountered in encode()\");\n bytes[i] = code;\n }\n return bytes;\n}\nfunction encodeBase64(input, url = !1) {\n if (Uint8Array.prototype.toBase64)\n return input.toBase64({ alphabet: url ? \"base64url\" : \"base64\", omitPadding: url });\n const CHUNK_SIZE = 32768, arr = [];\n for (let i = 0; i < input.length; i += CHUNK_SIZE)\n arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n const encoded = btoa(arr.join(\"\"));\n return url ? encoded.replace(/=/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\") : encoded;\n}\nfunction decodeBase64(encoded, url = !1) {\n if (Uint8Array.fromBase64)\n return Uint8Array.fromBase64(encoded, { alphabet: url ? \"base64url\" : \"base64\" });\n if (url) {\n if (encoded.includes(\"+\") || encoded.includes(\"/\"))\n throw new TypeError(\"Invalid base64url\");\n encoded = encoded.replace(/-/g, \"+\").replace(/_/g, \"/\");\n }\n const binary = atob(encoded), bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++)\n bytes[i] = binary.charCodeAt(i);\n return bytes;\n}\nasync function digest(algorithm, data) {\n const subtleDigest = `SHA-${algorithm.slice(-3)}`;\n return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));\n}\nexport {\n concat,\n decodeBase64,\n decoder,\n digest,\n encode,\n encodeBase64,\n encoder,\n strictDecoder,\n uint32be,\n uint64be\n};\n","class JOSEError extends Error {\n static code = \"ERR_JOSE_GENERIC\";\n code = \"ERR_JOSE_GENERIC\";\n constructor(message, options) {\n super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);\n }\n}\nclass JWTClaimValidationFailed extends JOSEError {\n static code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n claim;\n reason;\n payload;\n constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n }\n}\nclass JWTExpired extends JOSEError {\n static code = \"ERR_JWT_EXPIRED\";\n code = \"ERR_JWT_EXPIRED\";\n claim;\n reason;\n payload;\n constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n }\n}\nclass JOSEAlgNotAllowed extends JOSEError {\n static code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n}\nclass JOSENotSupported extends JOSEError {\n static code = \"ERR_JOSE_NOT_SUPPORTED\";\n code = \"ERR_JOSE_NOT_SUPPORTED\";\n}\nclass JWEDecryptionFailed extends JOSEError {\n static code = \"ERR_JWE_DECRYPTION_FAILED\";\n code = \"ERR_JWE_DECRYPTION_FAILED\";\n constructor(message = \"decryption operation failed\", options) {\n super(message, options);\n }\n}\nclass JWEInvalid extends JOSEError {\n static code = \"ERR_JWE_INVALID\";\n code = \"ERR_JWE_INVALID\";\n}\nclass JWSInvalid extends JOSEError {\n static code = \"ERR_JWS_INVALID\";\n code = \"ERR_JWS_INVALID\";\n}\nclass JWTInvalid extends JOSEError {\n static code = \"ERR_JWT_INVALID\";\n code = \"ERR_JWT_INVALID\";\n}\nclass JWKInvalid extends JOSEError {\n static code = \"ERR_JWK_INVALID\";\n code = \"ERR_JWK_INVALID\";\n}\nclass JWKSInvalid extends JOSEError {\n static code = \"ERR_JWKS_INVALID\";\n code = \"ERR_JWKS_INVALID\";\n}\nclass JWKSNoMatchingKey extends JOSEError {\n static code = \"ERR_JWKS_NO_MATCHING_KEY\";\n code = \"ERR_JWKS_NO_MATCHING_KEY\";\n constructor(message = \"no applicable key found in the JSON Web Key Set\", options) {\n super(message, options);\n }\n}\nclass JWKSMultipleMatchingKeys extends JOSEError {\n [Symbol.asyncIterator] = async function* () {\n };\n static code = \"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";\n code = \"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";\n constructor(message = \"multiple matching keys found in the JSON Web Key Set\", options) {\n super(message, options);\n }\n}\nclass JWKSTimeout extends JOSEError {\n static code = \"ERR_JWKS_TIMEOUT\";\n code = \"ERR_JWKS_TIMEOUT\";\n constructor(message = \"request timed out\", options) {\n super(message, options);\n }\n}\nclass JWSSignatureVerificationFailed extends JOSEError {\n static code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n constructor(message = \"signature verification failed\", options) {\n super(message, options);\n }\n}\nexport {\n JOSEAlgNotAllowed,\n JOSEError,\n JOSENotSupported,\n JWEDecryptionFailed,\n JWEInvalid,\n JWKInvalid,\n JWKSInvalid,\n JWKSMultipleMatchingKeys,\n JWKSNoMatchingKey,\n JWKSTimeout,\n JWSInvalid,\n JWSSignatureVerificationFailed,\n JWTClaimValidationFailed,\n JWTExpired,\n JWTInvalid\n};\n","import { encoder, decoder, encodeBase64, decodeBase64 } from \"../lib/buffer_utils.js\";\nconst invalid = \"The input to be decoded is not correctly encoded.\";\nfunction decode(input) {\n try {\n return decodeBase64(typeof input == \"string\" ? input : decoder.decode(input), !0);\n } catch (cause) {\n throw new TypeError(invalid, { cause });\n }\n}\nfunction encode(input) {\n return encodeBase64(typeof input == \"string\" ? encoder.encode(input) : input, !0);\n}\nexport {\n decode,\n encode\n};\n","import { JOSENotSupported, JWSInvalid } from \"../util/errors.js\";\nimport { decode } from \"../util/base64url.js\";\nimport { encode, strictDecoder } from \"./buffer_utils.js\";\nfunction assertUint8Array(input, label) {\n if (!(input instanceof Uint8Array))\n throw new TypeError(`${label} must be an instance of Uint8Array`);\n}\nfunction isObject(input) {\n if (typeof input != \"object\" || input === null || Object.prototype.toString.call(input) !== \"[object Object]\")\n return !1;\n const prototype = Object.getPrototypeOf(input);\n return prototype === null || Object.getPrototypeOf(prototype) === null;\n}\nfunction isJwkSet(input) {\n return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);\n}\nfunction isDisjoint(...headers) {\n const parameters = /* @__PURE__ */ new Set();\n for (const header of headers)\n if (header)\n for (const parameter of Object.keys(header)) {\n if (parameters.has(parameter))\n return !1;\n parameters.add(parameter);\n }\n return !0;\n}\nfunction assertNotSet(value, name) {\n if (value !== void 0)\n throw new TypeError(`${name} can only be called once`);\n}\nfunction decodeBase64url(value, label, ErrorClass) {\n try {\n return decode(value);\n } catch {\n throw new ErrorClass(`Failed to base64url decode the ${label}`);\n }\n}\nfunction encodeBase64url(value, label, ErrorClass) {\n try {\n return encode(value);\n } catch {\n throw new ErrorClass(`The ${label} is not a valid base64url string`);\n }\n}\nfunction parseJoseHeader(b64, ErrorClass, message) {\n let parsed;\n try {\n parsed = JSON.parse(strictDecoder.decode(decode(b64)));\n } catch {\n throw new ErrorClass(message);\n }\n if (!isObject(parsed))\n throw new ErrorClass(message);\n return parsed;\n}\nconst JWS_RECOGNIZED = { __proto__: null, b64: !0 }, JWE_RECOGNIZED = { __proto__: null };\nfunction validateAlgorithms(option, algorithms) {\n if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != \"string\")))\n throw new TypeError(`\"${option}\" option must be an array of strings`);\n return algorithms === void 0 ? void 0 : new Set(algorithms);\n}\nfunction validateCritDuplicates(Err, protectedHeader) {\n const { crit } = protectedHeader ?? {};\n if (Array.isArray(crit) && new Set(crit).size !== crit.length)\n throw new Err('\"crit\" (Critical) Header Parameter MUST NOT contain duplicate values');\n}\nfunction validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {\n if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)\n throw new Err('\"crit\" (Critical) Header Parameter MUST be integrity protected');\n if (!protectedHeader || protectedHeader.crit === void 0)\n return [];\n if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != \"string\" || input.length === 0))\n throw new Err('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');\n const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };\n for (const parameter of protectedHeader.crit) {\n if (!(parameter in recognized))\n throw new JOSENotSupported(`Extension Header Parameter \"${parameter}\" is not recognized`);\n if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)\n throw new Err(`Extension Header Parameter \"${parameter}\" is missing`);\n if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))\n throw new Err(`Extension Header Parameter \"${parameter}\" MUST be integrity protected`);\n }\n return protectedHeader.crit;\n}\nfunction validateB64(protectedHeader, extensions) {\n if (extensions.includes(\"b64\")) {\n const b64 = protectedHeader.b64;\n if (typeof b64 != \"boolean\")\n throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n return b64;\n }\n return !0;\n}\nfunction serializeJoseHeader(Err, header) {\n let serialized, parsed;\n try {\n serialized = JSON.stringify(header), parsed = JSON.parse(serialized);\n } catch (cause) {\n throw new Err(\"JOSE Header is not valid JSON\", { cause });\n }\n if (!isObject(parsed))\n throw new Err(\"JOSE Header is not a JSON object\");\n return [parsed, serialized];\n}\nexport {\n JWE_RECOGNIZED,\n JWS_RECOGNIZED,\n assertNotSet,\n assertUint8Array,\n decodeBase64url,\n encodeBase64url,\n isDisjoint,\n isJwkSet,\n isObject,\n parseJoseHeader,\n serializeJoseHeader,\n validateAlgorithms,\n validateB64,\n validateCrit,\n validateCritDuplicates\n};\n","import { isObject } from \"./validate.js\";\nimport { decode } from \"../util/base64url.js\";\nimport { JOSENotSupported } from \"../util/errors.js\";\nconst tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage) => {\n const { alg } = entry;\n if (key.use !== void 0) {\n const expected = usage === \"sign\" || usage === \"verify\" ? \"sig\" : \"enc\";\n if (key.use !== expected)\n throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${expected}\" when present`);\n }\n if (key.alg !== void 0 && key.alg !== alg)\n throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${alg}\" when present`);\n if (Array.isArray(key.key_ops)) {\n const expectedKeyOp = usage === \"encrypt\" || usage === \"decrypt\" ? entry.ops?.[usage === \"encrypt\" ? 0 : 1] : usage;\n if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))\n throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${expectedKeyOp}\" when present`);\n }\n};\nasync function prepareKey(entry, key, usage) {\n const { alg, secret } = entry, privateKey = usage === \"decrypt\" || usage === \"sign\";\n if (secret && key instanceof Uint8Array)\n return key;\n let normalized, keyObject;\n if (isObject(key)) {\n if (normalized = normalizeJwk(key), typeof normalized.kty != \"string\")\n throw invalidKeyType(alg, key, secret);\n if (!(secret ? normalized.kty === \"oct\" && typeof normalized.k == \"string\" : normalized.kty !== \"oct\" && (privateKey ? normalized.kty === \"AKP\" && typeof normalized.priv == \"string\" || typeof normalized.d == \"string\" : normalized.d === void 0 && normalized.priv === void 0)))\n throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present' : `JSON Web Key for this operation must be a ${privateKey ? \"private\" : \"public\"} JWK`);\n if (jwkMatchesOp(entry, normalized, usage), normalized.kty === \"oct\")\n return decode(normalized.k);\n if (!Object.isFrozen(key)) {\n const { key_ops } = key;\n Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);\n }\n } else {\n if (!isKeyLike(key))\n throw invalidKeyType(alg, key, secret);\n const expectedType = secret ? \"secret\" : privateKey ? \"private\" : \"public\";\n if (key.type !== expectedType && (secret || [\"secret\", \"public\", \"private\"].includes(key.type)))\n throw new TypeError(`${tag(key)} instances must be of type \"${expectedType}\" for the ${alg} algorithm`);\n if (isCryptoKey(key))\n return key;\n if (keyObject = key, keyObject.type === \"secret\")\n return keyObject.export();\n }\n cache ||= /* @__PURE__ */ new WeakMap();\n const cacheKey = key;\n let cached = cache.get(cacheKey);\n if (cached?.[alg])\n return cached[alg];\n if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == \"function\") {\n const isPublic = keyObject.type === \"public\", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;\n return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);\n }\n return normalized ??= keyObject.export({ format: \"jwk\" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);\n}\nlet cache;\nconst nist = {\n __proto__: null,\n prime256v1: \"P-256\",\n secp384r1: \"P-384\",\n secp521r1: \"P-521\"\n};\nfunction assertCryptoKey(key) {\n if (!isCryptoKey(key))\n throw new Error(\"CryptoKey instance expected\");\n}\nconst isCryptoKey = (key) => {\n if (key?.[Symbol.toStringTag] === \"CryptoKey\")\n return !0;\n try {\n return key instanceof CryptoKey;\n } catch {\n return !1;\n }\n}, isKeyObject = (key) => key?.[Symbol.toStringTag] === \"KeyObject\", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);\nfunction message(msg, actual, ...types) {\n if (types.length > 2) {\n const last = types.pop();\n msg += `one of type ${types.join(\", \")}, or ${last}.`;\n } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;\n return actual == null ? msg += ` Received ${actual}` : typeof actual == \"function\" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == \"object\" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;\n}\nconst invalidKeyInput = (actual, ...types) => message(\"Key must be \", actual, ...types);\nfunction invalidKeyType(alg, actual, secret) {\n const types = [\"CryptoKey\", \"KeyObject\", \"JSON Web Key\"];\n return secret && types.push(\"Uint8Array\"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));\n}\nconst unusable = (name, prop = \"algorithm.name\") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);\nfunction checkUsage(key, usage) {\n if (usage && !key.usages.includes(usage))\n throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);\n}\nfunction checkModulusLength(alg, key) {\n const { modulusLength } = key.algorithm;\n if (typeof modulusLength != \"number\" || modulusLength < 2048)\n throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);\n}\nfunction checkCryptoKey(key, expected, usage) {\n const algorithm = key.algorithm;\n if (algorithm.name !== expected.name)\n throw unusable(expected.name);\n if (expected.hash && algorithm.hash?.name !== expected.hash)\n throw unusable(expected.hash, \"algorithm.hash\");\n if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)\n throw unusable(expected.namedCurve, \"algorithm.namedCurve\");\n if (expected.length !== void 0 && algorithm.length !== expected.length)\n throw unusable(expected.length, \"algorithm.length\");\n checkUsage(key, usage);\n}\nfunction snapshotJwk(jwk) {\n return { __proto__: null, ...jwk };\n}\nfunction normalizeJwk(jwk) {\n const normalized = snapshotJwk(jwk);\n if (normalized.ext !== void 0 && typeof normalized.ext != \"boolean\")\n throw new TypeError('\"ext\" (Extractable) Parameter must be a boolean');\n if (normalized.key_ops !== void 0) {\n const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;\n if (!keyOps || keyOps.some((operation) => typeof operation != \"string\") || new Set(keyOps).size !== keyOps.length)\n throw new TypeError('\"key_ops\" (Key Operations) Parameter must be an array of unique strings');\n normalized.key_ops = keyOps;\n }\n return normalized;\n}\nfunction validateExtractableOption(extractable) {\n if (extractable !== void 0 && typeof extractable != \"boolean\")\n throw new TypeError('\"extractable\" option must be a boolean');\n return extractable;\n}\nasync function jwkToKey(entry, jwk, extractable) {\n if (!entry.kty.includes(jwk.kty))\n throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };\n return keyData.kty !== \"AKP\" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey(\"jwk\", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);\n}\nasync function rawKey(key, expected, usage, extractable = !1) {\n return key instanceof Uint8Array && (key = await crypto.subtle.importKey(\"raw\", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;\n}\nexport {\n assertCryptoKey,\n checkCryptoKey,\n checkModulusLength,\n checkUsage,\n invalidKeyInput,\n isCryptoKey,\n isKeyLike,\n isKeyObject,\n jwkToKey,\n normalizeJwk,\n prepareKey,\n rawKey,\n snapshotJwk,\n validateExtractableOption\n};\n","function table(entries) {\n const out = { __proto__: null };\n for (const alg in entries)\n out[alg] = { ...entries[alg], alg };\n return out;\n}\nexport {\n table\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { table } from \"./key_descriptor.js\";\nconst wrap = [\n [\"encrypt\", \"wrapKey\"],\n [\"decrypt\", \"unwrapKey\"]\n], derive = [[], [\"deriveBits\"]], none = [[], []];\nfunction rsaes(bits) {\n return {\n kty: [\"RSA\"],\n mode: \"key-encryption\",\n subtle: { name: \"RSA-OAEP\", hash: `SHA-${bits}` },\n usages: wrap,\n ops: [\"wrapKey\", \"unwrapKey\"]\n };\n}\nfunction ecdh(mode) {\n return {\n kty: [\"EC\", \"OKP\"],\n mode,\n subtle: { name: \"ECDH\" },\n resolve: ({ kty, crv, asymmetricKeyType }) => {\n if (crv === \"X25519\" || asymmetricKeyType === \"x25519\")\n return { name: \"X25519\" };\n if (kty === \"OKP\")\n throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n return { name: \"ECDH\", namedCurve: crv };\n },\n usages: derive,\n ops: [void 0, \"deriveBits\"]\n };\n}\nfunction aeskw(bits, gcm = !1) {\n return {\n kty: [\"oct\"],\n mode: \"key-wrapping\",\n secret: !0,\n subtle: { name: gcm ? \"AES-GCM\" : \"AES-KW\", length: bits },\n usages: none,\n ops: gcm ? [\"encrypt\", \"decrypt\"] : [\"wrapKey\", \"unwrapKey\"]\n };\n}\nfunction pbes2() {\n return {\n kty: [\"oct\"],\n mode: \"key-wrapping\",\n secret: !0,\n subtle: { name: \"PBKDF2\" },\n usages: none,\n ops: [\"deriveBits\", \"deriveBits\"]\n };\n}\nconst JWE = table({\n dir: {\n kty: [\"oct\"],\n mode: \"direct-encryption\",\n secret: !0,\n subtle: { name: \"AES-GCM\" },\n usages: none,\n ops: [\"encrypt\", \"decrypt\"]\n },\n \"RSA-OAEP\": rsaes(1),\n \"RSA-OAEP-256\": rsaes(256),\n \"RSA-OAEP-384\": rsaes(384),\n \"RSA-OAEP-512\": rsaes(512),\n \"ECDH-ES\": ecdh(\"direct-key-agreement\"),\n \"ECDH-ES+A128KW\": ecdh(\"key-agreement-with-key-wrapping\"),\n \"ECDH-ES+A192KW\": ecdh(\"key-agreement-with-key-wrapping\"),\n \"ECDH-ES+A256KW\": ecdh(\"key-agreement-with-key-wrapping\"),\n A128KW: aeskw(128),\n A192KW: aeskw(192),\n A256KW: aeskw(256),\n A128GCMKW: aeskw(128, !0),\n A192GCMKW: aeskw(192, !0),\n A256GCMKW: aeskw(256, !0),\n \"PBES2-HS256+A128KW\": pbes2(),\n \"PBES2-HS384+A192KW\": pbes2(),\n \"PBES2-HS512+A256KW\": pbes2()\n}), contentOps = [\"encrypt\", \"decrypt\"];\nfunction contentEncryption(bits, cbc = !1) {\n return {\n kty: [\"oct\"],\n secret: !0,\n subtle: { name: cbc ? \"AES-CBC\" : \"AES-GCM\", length: bits },\n usages: none,\n ops: contentOps,\n cekBits: bits,\n ivBits: cbc ? 128 : 96,\n cbc\n };\n}\nconst ENC = table({\n A128GCM: contentEncryption(128),\n A192GCM: contentEncryption(192),\n A256GCM: contentEncryption(256),\n \"A128CBC-HS256\": contentEncryption(256, !0),\n \"A192CBC-HS384\": contentEncryption(384, !0),\n \"A256CBC-HS512\": contentEncryption(512, !0)\n});\nfunction unsupported(parameter, name) {\n throw new JOSENotSupported(`Invalid or unsupported \"${parameter}\" (JWE ${name}) header value`);\n}\nfunction jweAlgorithm(alg) {\n return (typeof alg == \"string\" ? JWE[alg] : void 0) ?? unsupported(\"alg\", \"Algorithm\");\n}\nfunction isJWECEKTransport(algorithm) {\n return algorithm.mode === \"key-wrapping\" || algorithm.mode === \"key-encryption\" || algorithm.mode === \"key-agreement-with-key-wrapping\";\n}\nfunction jweEncryption(enc) {\n return (typeof enc == \"string\" ? ENC[enc] : void 0) ?? unsupported(\"enc\", \"Encryption Algorithm\");\n}\nexport {\n JWE,\n isJWECEKTransport,\n jweAlgorithm,\n jweEncryption\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { table } from \"./key_descriptor.js\";\nconst sig = [[\"verify\"], [\"sign\"]];\nfunction hmac(bits) {\n const subtle = { name: \"HMAC\", hash: `SHA-${bits}` };\n return { kty: [\"oct\"], secret: !0, subtle, signing: subtle, usages: sig };\n}\nfunction rsa(bits, saltLength) {\n const subtle = { name: saltLength ? \"RSA-PSS\" : \"RSASSA-PKCS1-v1_5\", hash: `SHA-${bits}` };\n return {\n kty: [\"RSA\"],\n subtle,\n signing: saltLength ? { ...subtle, saltLength } : subtle,\n usages: sig,\n minRsaBits: 2048\n };\n}\nfunction ecdsa(crv, bits) {\n return {\n kty: [\"EC\"],\n crv,\n subtle: { name: \"ECDSA\", namedCurve: crv },\n signing: { name: \"ECDSA\", hash: `SHA-${bits}` },\n usages: sig\n };\n}\nfunction eddsa() {\n const subtle = { name: \"Ed25519\" };\n return {\n kty: [\"OKP\"],\n crv: \"Ed25519\",\n subtle,\n signing: subtle,\n usages: sig\n };\n}\nfunction mldsa(bits) {\n const subtle = { name: `ML-DSA-${bits}` };\n return {\n kty: [\"AKP\"],\n subtle,\n signing: subtle,\n usages: sig\n };\n}\nconst JWS = table({\n HS256: hmac(256),\n HS384: hmac(384),\n HS512: hmac(512),\n RS256: rsa(256),\n RS384: rsa(384),\n RS512: rsa(512),\n PS256: rsa(256, 32),\n PS384: rsa(384, 48),\n PS512: rsa(512, 64),\n ES256: ecdsa(\"P-256\", 256),\n ES384: ecdsa(\"P-384\", 384),\n ES512: ecdsa(\"P-521\", 512),\n EdDSA: eddsa(),\n Ed25519: eddsa(),\n \"ML-DSA-44\": mldsa(44),\n \"ML-DSA-65\": mldsa(65),\n \"ML-DSA-87\": mldsa(87)\n});\nfunction jwsAlgorithm(alg) {\n const entry = typeof alg == \"string\" ? JWS[alg] : void 0;\n if (!entry)\n throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);\n return entry;\n}\nexport {\n JWS,\n jwsAlgorithm\n};\n","import { jwsAlgorithm } from \"./jws_algorithms.js\";\nimport { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from \"../util/errors.js\";\nimport { concat, decoder, encoder, encode } from \"./buffer_utils.js\";\nimport { decodeBase64url, encodeBase64url, parseJoseHeader, isDisjoint, isObject, validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from \"./validate.js\";\nimport { prepareKey, rawKey, checkModulusLength } from \"./key.js\";\nfunction snapshotJws(jws, sharedPayload) {\n const encodedProtected = jws.protected, inputHeader = jws.header, header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;\n let payload = sharedPayload ? sharedPayload[0] : jws.payload;\n !sharedPayload && payload instanceof Uint8Array && (payload = new Uint8Array(payload));\n const signature = jws.signature, snapshot = { payload, signature };\n if (encodedProtected !== void 0 && (snapshot.protected = encodedProtected), inputHeader !== void 0 && (snapshot.header = header), encodedProtected === void 0 && header === void 0)\n throw new JWSInvalid('Flattened JWS must have either of the \"protected\" or \"header\" members');\n if (encodedProtected !== void 0 && typeof encodedProtected != \"string\")\n throw new JWSInvalid(\"JWS Protected Header incorrect type\");\n if (payload === void 0)\n throw new JWSInvalid(\"JWS Payload missing\");\n if (typeof signature != \"string\")\n throw new JWSInvalid(\"JWS Signature missing or incorrect type\");\n if (header !== void 0 && !isObject(header))\n throw new JWSInvalid(\"JWS Unprotected Header incorrect type\");\n return snapshot;\n}\nfunction prepareVerify(options) {\n return [options && validateAlgorithms(\"algorithms\", options.algorithms), options?.crit];\n}\nfunction parseProtectedHeader(encodedProtected) {\n return encodedProtected === void 0 ? {} : parseJoseHeader(encodedProtected, JWSInvalid, \"JWS Protected Header is invalid\");\n}\nfunction encodeJsonUnencodedPayload(payload) {\n const invalid = /[\\p{Cs}\\p{Cn}]/u.exec(payload)?.[0];\n if (invalid !== void 0)\n throw new JWSInvalid(/\\p{Cs}/u.test(invalid) ? \"JWS Payload must be a well-formed Unicode string\" : \"JWS Payload must not contain unassigned Unicode code points\");\n return encoder.encode(payload);\n}\nfunction encodeCompactUnencodedPayload(payload) {\n try {\n return encode(payload);\n } catch {\n throw new JWSInvalid(\"JWS Compact Serialization payload must use only ASCII characters\");\n }\n}\nasync function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {\n const { protected: encodedProtected, header, payload: inputPayload } = jws, parsedProt = parsedProtected ?? parseProtectedHeader(encodedProtected);\n if (!isDisjoint(parsedProt, header))\n throw new JWSInvalid(\"JWS Protected and JWS Unprotected Header Parameter names must be disjoint\");\n const joseHeader = { ...parsedProt, ...header }, b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader)), { alg } = joseHeader;\n if (typeof alg != \"string\" || !alg)\n throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n if (shared[0] && !shared[0].has(alg))\n throw new JOSEAlgNotAllowed('\"alg\" (Algorithm) Header Parameter value not allowed');\n if (b64) {\n if (typeof inputPayload != \"string\")\n throw new JWSInvalid(\"JWS Payload must be a string\");\n } else if (typeof inputPayload != \"string\" && !(inputPayload instanceof Uint8Array))\n throw new JWSInvalid(\"JWS Payload must be a string or an Uint8Array instance\");\n const signingPayload = b64 || typeof inputPayload != \"string\" ? inputPayload : encodeUnencodedPayload(inputPayload);\n let resolvedKey = !1;\n typeof key == \"function\" && (key = await key(parsedProt, jws), resolvedKey = !0);\n const entry = jwsAlgorithm(alg), data = concat(encodedProtected !== void 0 ? encode(encodedProtected) : new Uint8Array(), encode(\".\"), typeof signingPayload == \"string\" ? shared[2] ??= encodeBase64url(signingPayload, \"payload\", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, \"signature\", JWSInvalid), k = await prepareKey(entry, key, \"verify\"), cryptoKey = await rawKey(k, entry.subtle, \"verify\");\n entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);\n let verified = !1;\n try {\n verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, data);\n } catch {\n }\n if (!verified)\n throw new JWSSignatureVerificationFailed();\n const result = { payload: typeof signingPayload == \"string\" ? decodeBase64url(signingPayload, \"payload\", JWSInvalid) : signingPayload };\n return encodedProtected !== void 0 && (result.protectedHeader = parsedProt), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: k }, b64] : [result, b64];\n}\nasync function verifyCompact(jws, shared, key) {\n if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != \"string\")\n throw new JWSInvalid(\"Compact JWS must be a string or Uint8Array\");\n const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(\".\");\n if (length !== 3)\n throw new JWSInvalid(\"Invalid Compact JWS\");\n return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);\n}\nexport {\n encodeJsonUnencodedPayload,\n parseProtectedHeader,\n prepareVerify,\n snapshotJws,\n verifyCompact,\n verifySignature\n};\n","import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from \"../util/errors.js\";\nimport { encoder, strictDecoder } from \"./buffer_utils.js\";\nimport { isObject } from \"./validate.js\";\nconst epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {\n s: 1,\n m: 60,\n h: 3600,\n d: 86400,\n w: 604800,\n y: 31557600\n}, REGEX = /^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, checkFailed = \"check_failed\";\nfunction invalidDuration() {\n throw new TypeError(\"Invalid time period format\");\n}\nfunction secs(str) {\n typeof str != \"string\" && invalidDuration();\n const matched = REGEX.exec(str);\n (!matched || matched[4] && matched[1]) && invalidDuration();\n const value = parseFloat(matched[2]), numericDate2 = Math.round(value * multipliers[matched[3][0].toLowerCase()]);\n return Number.isFinite(numericDate2) || invalidDuration(), matched[1] === \"-\" || matched[4] === \"ago\" ? -numericDate2 : numericDate2;\n}\nfunction validateInput(label, input) {\n if (!Number.isFinite(input))\n throw new TypeError(`Invalid ${label} input`);\n return input;\n}\nfunction validateStringClaim(claim, value) {\n if (typeof value != \"string\")\n throw new TypeError(`\"${claim}\" claim must be a string`);\n}\nfunction validateAudienceClaim(value) {\n if (typeof value != \"string\" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != \"string\")))\n throw new TypeError('\"aud\" claim must be a string or an array of strings');\n}\nfunction numericDate(value, label) {\n return typeof value == \"number\" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);\n}\nconst normalizeTyp = (value) => {\n const normalized = value.toLowerCase();\n return value.includes(\"/\") ? normalized : `application/${normalized}`;\n}, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == \"string\" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;\nfunction validateNumericDate(payload, claim, required = !1) {\n const value = payload[claim];\n if (!(value === void 0 && !required)) {\n if (typeof value != \"number\")\n throw new JWTClaimValidationFailed(`\"${claim}\" claim must be a number`, payload, claim, \"invalid\");\n return value;\n }\n}\nfunction unexpectedClaim(payload, claim) {\n throw new JWTClaimValidationFailed(`unexpected \"${claim}\" claim value`, payload, claim, checkFailed);\n}\nfunction validateClaimsSet(protectedHeader, encodedPayload, options = {}) {\n let payload;\n try {\n payload = JSON.parse(strictDecoder.decode(encodedPayload));\n } catch {\n }\n if (!isObject(payload))\n throw new JWTInvalid(\"JWT Claims Set must be a top-level JSON object\");\n const { typ } = options;\n if (typ !== void 0 && (typeof protectedHeader.typ != \"string\" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))\n throw new JWTClaimValidationFailed('unexpected \"typ\" JWT header value', payload, \"typ\", checkFailed);\n const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];\n maxTokenAge !== void 0 && presenceCheck.push(\"iat\"), audience !== void 0 && presenceCheck.push(\"aud\"), subject !== void 0 && presenceCheck.push(\"sub\"), issuer !== void 0 && presenceCheck.push(\"iss\");\n for (const claim of new Set(presenceCheck.reverse()))\n if (!Object.hasOwn(payload, claim))\n throw new JWTClaimValidationFailed(`missing required \"${claim}\" claim`, payload, claim, \"missing\");\n issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss) && unexpectedClaim(payload, \"iss\"), subject !== void 0 && payload.sub !== subject && unexpectedClaim(payload, \"sub\"), audience !== void 0 && !checkAudiencePresence(payload.aud, typeof audience == \"string\" ? [audience] : audience) && unexpectedClaim(payload, \"aud\");\n const { clockTolerance } = options;\n let tolerance = 0;\n if (typeof clockTolerance == \"string\")\n tolerance = secs(clockTolerance);\n else if (clockTolerance !== void 0) {\n if (typeof clockTolerance != \"number\")\n throw new TypeError(\"Invalid clockTolerance option type\");\n tolerance = clockTolerance;\n }\n validateInput(\"clockTolerance option\", tolerance);\n const { currentDate } = options, now = validateInput(\"currentDate option\", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(payload, \"iat\", maxTokenAge !== void 0), nbf = validateNumericDate(payload, \"nbf\");\n if (nbf !== void 0 && nbf > now + tolerance)\n throw new JWTClaimValidationFailed('\"nbf\" claim timestamp check failed', payload, \"nbf\", checkFailed);\n const exp = validateNumericDate(payload, \"exp\");\n if (exp !== void 0 && exp <= now - tolerance)\n throw new JWTExpired('\"exp\" claim timestamp check failed', payload, \"exp\", checkFailed);\n if (maxTokenAge !== void 0) {\n const age = now - iat, max = validateInput(\"maxTokenAge option\", typeof maxTokenAge == \"number\" ? maxTokenAge : secs(maxTokenAge));\n if (age - tolerance > max)\n throw new JWTExpired('\"iat\" claim timestamp check failed (too far in the past)', payload, \"iat\", checkFailed);\n if (age < -tolerance)\n throw new JWTClaimValidationFailed('\"iat\" claim timestamp check failed (it should be in the past)', payload, \"iat\", checkFailed);\n }\n return payload;\n}\nlet producerPayloads;\nfunction producerPayload(producer) {\n return producerPayloads.get(producer);\n}\nfunction jwtData(producer) {\n const payload = producerPayload(producer);\n for (const claim of [\"iat\", \"nbf\", \"exp\"]) {\n const value = payload[claim];\n if (typeof value == \"number\" && !Number.isFinite(value))\n throw new TypeError(`\"${claim}\" claim must be a finite number`);\n }\n return encoder.encode(JSON.stringify(payload));\n}\nfunction jwtClaim(producer, claim) {\n return producerPayload(producer)[claim];\n}\nclass JWTClaimsBuilder {\n constructor(payload = {}) {\n if (!isObject(payload))\n throw new TypeError(\"JWT Claims Set MUST be an object\");\n (producerPayloads ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(payload));\n }\n setIssuer(value) {\n return validateStringClaim(\"iss\", value), producerPayload(this).iss = value, this;\n }\n setSubject(value) {\n return validateStringClaim(\"sub\", value), producerPayload(this).sub = value, this;\n }\n setAudience(value) {\n return validateAudienceClaim(value), producerPayload(this).aud = value, this;\n }\n setJti(value) {\n return validateStringClaim(\"jti\", value), producerPayload(this).jti = value, this;\n }\n setNotBefore(value) {\n return producerPayload(this).nbf = numericDate(value, \"setNotBefore\"), this;\n }\n setExpirationTime(value) {\n return producerPayload(this).exp = numericDate(value, \"setExpirationTime\"), this;\n }\n setIssuedAt(value) {\n const payload = producerPayload(this);\n return value === void 0 ? payload.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == \"string\" ? payload.iat = validateInput(\"setIssuedAt\", epoch(/* @__PURE__ */ new Date()) + secs(value)) : payload.iat = numericDate(value, \"setIssuedAt\"), this;\n }\n}\nexport {\n JWTClaimsBuilder,\n jwtClaim,\n jwtData,\n secs,\n validateClaimsSet\n};\n","import { prepareVerify, verifyCompact } from \"../lib/jws_verify.js\";\nimport { validateClaimsSet } from \"../lib/jwt_claims_set.js\";\nimport { JWTInvalid } from \"../util/errors.js\";\nasync function jwtVerify(jwt, key, options) {\n const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);\n if (!b64)\n throw new JWTInvalid(\"JWTs MUST NOT use unencoded payload\");\n const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);\n return { ...verified, payload };\n}\nexport {\n jwtVerify\n};\n","import { encode as b64u } from \"../util/base64url.js\";\nimport { jwsAlgorithm } from \"./jws_algorithms.js\";\nimport { isDisjoint, serializeJoseHeader, validateB64, validateCrit, validateCritDuplicates, JWS_RECOGNIZED } from \"./validate.js\";\nimport { JWSInvalid } from \"../util/errors.js\";\nimport { concat, encode, encoder } from \"./buffer_utils.js\";\nimport { prepareKey, rawKey, checkModulusLength } from \"./key.js\";\nasync function createSignature(input, key, rejectUnencoded) {\n let [payload, protectedHeader, unprotectedHeader, crit] = input, protectedHeaderString = \"\";\n if (protectedHeader !== void 0) {\n const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);\n protectedHeader = normalized[0], protectedHeaderString = b64u(normalized[1]);\n }\n if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader)\n throw new JWSInvalid(\"either setProtectedHeader or setUnprotectedHeader must be called before #sign()\");\n if (!isDisjoint(protectedHeader, unprotectedHeader))\n throw new JWSInvalid(\"JWS Protected and JWS Unprotected Header Parameter names must be disjoint\");\n const joseHeader = { ...protectedHeader, ...unprotectedHeader };\n validateCritDuplicates(JWSInvalid, protectedHeader);\n const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));\n b64 || rejectUnencoded?.();\n const { alg } = joseHeader;\n if (typeof alg != \"string\" || !alg)\n throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n const entry = jwsAlgorithm(alg);\n let payloadS = \"\", payloadB = payload, data;\n if (b64) {\n const encoded = input[4];\n encoded ? (payloadS = encoded[0] ??= b64u(payload), payloadB = encoded[1] ??= encode(payloadS)) : (payloadS = b64u(payload), data = encoder.encode(`${protectedHeaderString}.${payloadS}`));\n }\n data ??= concat(encode(protectedHeaderString), encode(\".\"), payloadB);\n const k = await rawKey(await prepareKey(entry, key, \"sign\"), entry.subtle, \"sign\");\n entry.minRsaBits && checkModulusLength(entry.alg, k);\n const jws = {\n signature: b64u(new Uint8Array(await crypto.subtle.sign(entry.signing, k, data))),\n payload: payloadS\n };\n return protectedHeader && (jws.protected = protectedHeaderString), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];\n}\nasync function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {\n const [jws] = await createSignature([payload, protectedHeader, void 0, crit], key, rejectUnencoded);\n return `${jws.protected}.${jws.payload}.${jws.signature}`;\n}\nexport {\n createCompactSignature,\n createSignature\n};\n","import { createCompactSignature } from \"../lib/jws_sign.js\";\nimport { JWTInvalid } from \"../util/errors.js\";\nimport { JWTClaimsBuilder, jwtData } from \"../lib/jwt_claims_set.js\";\nimport { assertNotSet } from \"../lib/validate.js\";\nconst SignJWT_base = JWTClaimsBuilder;\nclass SignJWT extends SignJWT_base {\n #protectedHeader;\n setProtectedHeader(protectedHeader) {\n return assertNotSet(this.#protectedHeader, \"setProtectedHeader\"), this.#protectedHeader = protectedHeader, this;\n }\n async sign(key, options) {\n return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {\n throw new JWTInvalid(\"JWTs MUST NOT use unencoded payload\");\n });\n }\n}\nexport {\n SignJWT\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { JWS } from \"./jws_algorithms.js\";\nimport { JWE } from \"./jwe_algorithms.js\";\nconst algArgument = '\"alg\" (Algorithm)';\nfunction unsupportedAlg(source = 'JWK \"alg\" (Algorithm) Parameter') {\n throw new JOSENotSupported(`Invalid or unsupported ${source} value`);\n}\nfunction keyAlgorithm(alg, source) {\n return (typeof alg == \"string\" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);\n}\nexport {\n algArgument,\n keyAlgorithm,\n unsupportedAlg\n};\n","import { toSPKI as exportPublic, toPKCS8 as exportPrivate } from \"../lib/asn1.js\";\nimport { invalidKeyInput, isCryptoKey, isKeyObject } from \"../lib/key.js\";\nimport { encode as b64u } from \"../util/base64url.js\";\nfunction exportSPKI(key) {\n return exportPublic(key);\n}\nfunction exportPKCS8(key) {\n return exportPrivate(key);\n}\nasync function exportJWK(key) {\n if (isKeyObject(key))\n if (key.type === \"secret\")\n key = key.export();\n else\n return key.export({ format: \"jwk\" });\n if (key instanceof Uint8Array)\n return {\n kty: \"oct\",\n k: b64u(key)\n };\n if (!isCryptoKey(key))\n throw new TypeError(invalidKeyInput(key, \"CryptoKey\", \"KeyObject\", \"Uint8Array\"));\n if (!key.extractable)\n throw new TypeError(\"non-extractable CryptoKey cannot be exported as a JWK\");\n const jwk = await crypto.subtle.exportKey(\"jwk\", key);\n delete jwk.ext, delete jwk.key_ops, delete jwk.use, jwk.kty !== \"AKP\" && delete jwk.alg;\n for (const parameter of Object.keys(jwk))\n jwk[parameter] === void 0 && delete jwk[parameter];\n return jwk;\n}\nexport {\n exportJWK,\n exportPKCS8,\n exportSPKI\n};\n","import { jwkToKey, snapshotJwk } from \"../lib/key.js\";\nimport { JWS } from \"../lib/jws_algorithms.js\";\nimport { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys } from \"../util/errors.js\";\nimport { isJwkSet } from \"../lib/validate.js\";\nfunction isUsableJWK(jwk, entry, alg, kid) {\n const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;\n return (ext === void 0 || typeof ext == \"boolean\") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == \"string\" && keyOps.indexOf(operation) === index) && keyOps.includes(\"verify\")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == \"string\" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== \"AKP\" : alg === jwkAlg) && (use === void 0 || use === \"sig\") && (!entry.crv || crv === entry.crv);\n}\nasync function importWithAlgCache(cache, jwk, entry) {\n const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;\n if (cached[alg] === void 0) {\n const pending = jwkToKey(entry, jwk, !0).then((key) => {\n if (key.type !== \"public\")\n throw new JWKSInvalid(\"JSON Web Key Set members must be public keys\");\n return cached[alg] = key, key;\n }).catch((error) => {\n throw cached[alg] === pending && delete cached[alg], error;\n });\n cached[alg] = pending;\n }\n return cached[alg];\n}\nfunction createLocalJWKSet(jwks) {\n let snapshot;\n try {\n snapshot = structuredClone(jwks);\n } catch {\n }\n if (!isJwkSet(snapshot))\n throw new JWKSInvalid(\"JSON Web Key Set malformed\");\n const metadata = snapshot.keys.map((jwk) => {\n const normalized = snapshotJwk(jwk);\n return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;\n }), cached = /* @__PURE__ */ new WeakMap();\n return Object.defineProperty(async (protectedHeader, token) => {\n const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == \"string\" ? JWS[alg] : void 0;\n if (!entry || entry.secret)\n throw new JOSENotSupported('Unsupported \"alg\" value for a JSON Web Key Set');\n const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;\n if (!length)\n throw new JWKSNoMatchingKey();\n if (length !== 1) {\n const error = new JWKSMultipleMatchingKeys();\n throw error[Symbol.asyncIterator] = async function* () {\n for (const jwk2 of candidates)\n try {\n yield await importWithAlgCache(cached, jwk2, entry);\n } catch {\n }\n }, error;\n }\n return importWithAlgCache(cached, jwk, entry);\n }, \"jwks\", {\n value: () => structuredClone(snapshot)\n });\n}\nexport {\n createLocalJWKSet\n};\n","import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from \"../util/errors.js\";\nimport { createLocalJWKSet } from \"./local.js\";\nimport { isJwkSet } from \"../lib/validate.js\";\nfunction isCloudflareWorkers() {\n return typeof WebSocketPair < \"u\" || typeof navigator < \"u\" && navigator.userAgent === \"Cloudflare-Workers\" || typeof EdgeRuntime < \"u\" && EdgeRuntime === \"vercel\";\n}\nlet USER_AGENT;\n(typeof navigator > \"u\" || !navigator.userAgent?.startsWith?.(\"Mozilla/5.0 \")) && (USER_AGENT = \"jose/v6.2.12\");\nconst customFetch = /* @__PURE__ */ Symbol();\nasync function fetchJwks(url, headers, signal, fetchImpl = fetch) {\n const response = await fetchImpl(url, {\n method: \"GET\",\n signal,\n redirect: \"manual\",\n headers\n }).catch((err) => {\n throw err.name === \"TimeoutError\" ? new JWKSTimeout() : err;\n });\n if (response.status !== 200)\n throw new JOSEError(\"Expected 200 OK from the JSON Web Key Set HTTP response\");\n try {\n return await response.json();\n } catch {\n throw new JOSEError(\"Failed to parse the JSON Web Key Set HTTP response as JSON\");\n }\n}\nconst jwksCache = /* @__PURE__ */ Symbol();\nfunction isFreshFor(timestamp, duration) {\n return Number.isFinite(timestamp) && Date.now() < timestamp + duration;\n}\nfunction validateDuration(value, fallback, option) {\n if (Number.isNaN(value))\n throw new TypeError(`\"${option}\" option must not be NaN`);\n return typeof value == \"number\" ? value : fallback;\n}\nfunction createRemoteJWKSet(url, options) {\n if (!(url instanceof URL))\n throw new TypeError(\"url must be an instance of URL\");\n const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;\n if (typeof timeoutOption == \"number\" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))\n throw new TypeError('\"timeoutDuration\" option must be a non-negative integer');\n const timeoutDuration = typeof timeoutOption == \"number\" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, \"cooldownDuration\"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, \"cacheMaxAge\"), headers = new Headers(opts.headers);\n USER_AGENT && !headers.has(\"User-Agent\") && headers.set(\"User-Agent\", USER_AGENT), headers.has(\"accept\") || headers.set(\"accept\", \"application/json, application/jwk-set+json\");\n const fetchImpl = opts[customFetch], cache = opts[jwksCache];\n let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;\n if (cache && typeof cache == \"object\") {\n const { uat, jwks } = cache;\n isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));\n }\n const reload = async () => {\n if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {\n const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {\n const next = createLocalJWKSet(json);\n if (sequence <= appliedSequence)\n return;\n local = next;\n const updatedAt = Date.now();\n cache && (cache.uat = updatedAt, cache.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;\n }).finally(() => {\n pendingFetch === current && (pendingFetch = void 0);\n });\n }\n await pendingFetch;\n };\n return Object.defineProperties(async (protectedHeader, token) => {\n (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();\n try {\n return await local(protectedHeader, token);\n } catch (err) {\n if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))\n return await reload(), local(protectedHeader, token);\n throw err;\n }\n }, {\n coolingDown: {\n get: () => isFreshFor(jwksTimestamp, cooldownDuration),\n enumerable: !0\n },\n fresh: {\n get: () => isFreshFor(jwksTimestamp, cacheMaxAge),\n enumerable: !0\n },\n reload: {\n value: reload,\n enumerable: !0\n },\n reloading: {\n get: () => !!pendingFetch,\n enumerable: !0\n },\n jwks: {\n value: () => local?.jwks(),\n enumerable: !0\n }\n });\n}\nexport {\n createRemoteJWKSet,\n customFetch,\n jwksCache\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { validateExtractableOption } from \"../lib/key.js\";\nimport { keyAlgorithm, unsupportedAlg, algArgument } from \"../lib/key_algorithm.js\";\nfunction getModulusLengthOption(options) {\n const modulusLength = options?.modulusLength ?? 2048;\n if (typeof modulusLength != \"number\" || !Number.isInteger(modulusLength) || modulusLength < 2048)\n throw new JOSENotSupported(\"Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used\");\n return modulusLength;\n}\nasync function generateKeyPair(alg, options) {\n const extractable = validateExtractableOption(options?.extractable), entry = keyAlgorithm(alg, algArgument);\n entry.secret && unsupportedAlg(algArgument);\n let algorithm;\n if (entry.resolve) {\n const crv = options?.crv ?? \"P-256\";\n if (![\"P-256\", \"P-384\", \"P-521\", \"X25519\"].includes(crv))\n throw new JOSENotSupported(\"Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519\");\n algorithm = entry.resolve({ crv });\n } else {\n if (entry.crv !== void 0 && options?.crv !== void 0 && options.crv !== entry.crv)\n throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);\n algorithm = entry.kty[0] === \"RSA\" ? {\n ...entry.subtle,\n publicExponent: Uint8Array.of(1, 0, 1),\n modulusLength: getModulusLengthOption(options)\n } : entry.subtle;\n }\n return crypto.subtle.generateKey(algorithm, extractable ?? !1, [\n ...entry.usages[1],\n ...entry.usages[0]\n ]);\n}\nexport {\n generateKeyPair\n};\n","import validate from './validate.js';\nconst byteToHex = [];\nfor (let i = 0; i < 256; ++i) {\n byteToHex.push((i + 0x100).toString(16).slice(1));\n}\nexport function unsafeStringify(arr, offset = 0) {\n return (byteToHex[arr[offset + 0]] +\n byteToHex[arr[offset + 1]] +\n byteToHex[arr[offset + 2]] +\n byteToHex[arr[offset + 3]] +\n '-' +\n byteToHex[arr[offset + 4]] +\n byteToHex[arr[offset + 5]] +\n '-' +\n byteToHex[arr[offset + 6]] +\n byteToHex[arr[offset + 7]] +\n '-' +\n byteToHex[arr[offset + 8]] +\n byteToHex[arr[offset + 9]] +\n '-' +\n byteToHex[arr[offset + 10]] +\n byteToHex[arr[offset + 11]] +\n byteToHex[arr[offset + 12]] +\n byteToHex[arr[offset + 13]] +\n byteToHex[arr[offset + 14]] +\n byteToHex[arr[offset + 15]]).toLowerCase();\n}\nfunction stringify(arr, offset = 0) {\n const uuid = unsafeStringify(arr, offset);\n if (!validate(uuid)) {\n throw TypeError('Stringified UUID is invalid');\n }\n return uuid;\n}\nexport default stringify;\n","const rnds8 = new Uint8Array(16);\nexport default function rng() {\n return crypto.getRandomValues(rnds8);\n}\n","import rng from './rng.js';\nimport { unsafeStringify } from './stringify.js';\nfunction v4(options, buf, offset) {\n if (!buf && !options && crypto.randomUUID) {\n return crypto.randomUUID();\n }\n return _v4(options, buf, offset);\n}\nfunction _v4(options, buf, offset) {\n options = options || {};\n const rnds = options.random ?? options.rng?.() ?? rng();\n if (rnds.length < 16) {\n throw new Error('Random bytes length must be >= 16');\n }\n rnds[6] = (rnds[6] & 0x0f) | 0x40;\n rnds[8] = (rnds[8] & 0x3f) | 0x80;\n if (buf) {\n offset = offset || 0;\n if (offset < 0 || offset + 16 > buf.length) {\n throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);\n }\n for (let i = 0; i < 16; ++i) {\n buf[offset + i] = rnds[i];\n }\n return buf;\n }\n return unsafeStringify(rnds);\n}\nexport default v4;\n","import { jwtVerify, createRemoteJWKSet, exportJWK, SignJWT, generateKeyPair } from 'jose';\nimport { v4 } from 'uuid';\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * Intended to be used by dependent packages as a common prefix for keys into\n * storage mechanisms (so as to group all keys related to Solid Client Authn\n * within those storage mechanisms, e.g., window.localStorage).\n */\nconst SOLID_CLIENT_AUTHN_KEY_PREFIX = \"solidClientAuthn:\";\n/**\n * Ordered list of signature algorithms, from most preferred to least preferred.\n */\nconst PREFERRED_SIGNING_ALG = [\"ES256\", \"RS256\"];\nconst EVENTS = {\n // Note that an `error` events MUST be listened to: https://nodejs.org/dist/latest-v16.x/docs/api/events.html#error-events.\n ERROR: \"error\",\n LOGIN: \"login\",\n LOGOUT: \"logout\",\n NEW_REFRESH_TOKEN: \"newRefreshToken\",\n NEW_TOKENS: \"newTokens\",\n AUTHORIZATION_REQUEST: \"authorizationRequest\",\n SESSION_EXPIRED: \"sessionExpired\",\n SESSION_EXTENDED: \"sessionExtended\",\n SESSION_RESTORED: \"sessionRestore\",\n TIMEOUT_SET: \"timeoutSet\",\n};\n/**\n * We want to refresh a token 5 seconds before it expires.\n */\nconst REFRESH_BEFORE_EXPIRATION_SECONDS = 5;\n// The openid scope requests an OIDC ID token token to be returned.\nconst SCOPE_OPENID = \"openid\";\n// The offline_access scope requests a refresh token to be returned.\nconst SCOPE_OFFLINE = \"offline_access\";\n// The webid scope is required as per https://solid.github.io/solid-oidc/#webid-scope\nconst SCOPE_WEBID = \"webid\";\nconst DEFAULT_SCOPES = [SCOPE_OPENID, SCOPE_OFFLINE, SCOPE_WEBID];\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n */\nclass AggregateHandler {\n handleables;\n constructor(handleables) {\n this.handleables = handleables;\n this.handleables = handleables;\n }\n /**\n * Helper function that will asynchronously determine the proper handler to use. If multiple\n * handlers can handle, it will choose the first one in the list\n * @param params Paramerters to feed to the handler\n */\n async getProperHandler(params) {\n // TODO : This function doesn't currently operate as described. Tests need to be written\n // return new Promise<IHandleable<P, R> | null>((resolve, reject) => {\n // const resolvedValues: Array<boolean | null> = Array(this.handleables.length).map(() => null)\n // let numberResolved = 0\n // this.handleables.forEach(async (handleable: IHandleable<P, R>, index: number) => {\n // resolvedValues[index] = await handleable.canHandle(...params)\n // numberResolved++\n // let curResolvedValueIndex = 0\n // while (\n // resolvedValues[curResolvedValueIndex] !== null ||\n // resolvedValues[curResolvedValueIndex] !== undefined\n // ) {\n // if (resolvedValues[curResolvedValueIndex]) {\n // resolve(this.handleables[curResolvedValueIndex])\n // }\n // curResolvedValueIndex++\n // }\n // })\n // })\n const canHandleList = await Promise.all(this.handleables.map((handleable) => handleable.canHandle(...params)));\n for (let i = 0; i < canHandleList.length; i += 1) {\n if (canHandleList[i]) {\n return this.handleables[i];\n }\n }\n return null;\n }\n async canHandle(...params) {\n return (await this.getProperHandler(params)) !== null;\n }\n async handle(...params) {\n const handler = await this.getProperHandler(params);\n if (handler) {\n return handler.handle(...params);\n }\n throw new Error(`[${this.constructor.name}] cannot find a suitable handler for: ${params\n .map((param) => {\n try {\n return JSON.stringify(param);\n }\n catch (_err) {\n /* eslint-disable @typescript-eslint/no-explicit-any */\n return param.toString();\n }\n })\n .join(\", \")}`);\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * Extract a WebID and the clientID from an ID token payload based on https://github.com/solid/webid-oidc-spec.\n * Note that this does not yet implement the user endpoint lookup, and only checks\n * for `webid`, `azp` or IRI-like `sub` claims.\n *\n * @param idToken the payload of the ID token from which the WebID can be extracted.\n * @returns an object with entries webId and clientId extracted from the ID token.\n * @internal\n */\nasync function getWebidFromTokenPayload(idToken, jwksIri, issuerIri, clientId) {\n let payload;\n let clientIdInPayload;\n try {\n const { payload: verifiedPayload } = await jwtVerify(idToken, createRemoteJWKSet(new URL(jwksIri)), {\n issuer: issuerIri,\n audience: clientId,\n });\n payload = verifiedPayload;\n }\n catch (e) {\n throw new Error(`Token verification failed: ${e.stack}`);\n }\n if (typeof payload.azp === \"string\") {\n clientIdInPayload = payload.azp;\n }\n if (typeof payload.webid === \"string\") {\n return {\n webId: payload.webid,\n clientId: clientIdInPayload,\n };\n }\n if (typeof payload.sub !== \"string\") {\n throw new Error(`The token ${JSON.stringify(payload)} is invalid: it has no 'webid' claim and no 'sub' claim.`);\n }\n try {\n // This parses the 'sub' claim to check if it is a well-formed IRI.\n // However, the normalized value isn't returned to make sure the WebID is returned\n // as specified by the Identity Provider.\n new URL(payload.sub);\n return {\n webId: payload.sub,\n clientId: clientIdInPayload,\n };\n }\n catch (e) {\n throw new Error(`The token has no 'webid' claim, and its 'sub' claim of [${payload.sub}] is invalid as a URL - error [${e}].`);\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nfunction normalizeScopes(scopes) {\n if (!Array.isArray(scopes)) {\n return DEFAULT_SCOPES;\n }\n return Array.from(\n // De-dupe potentia conflicts if any.\n new Set([\n ...DEFAULT_SCOPES,\n ...scopes.filter(\n // Remove user-provided scopes that are not strings or include spaces.\n (scope) => typeof scope === \"string\" && !scope.includes(\" \")),\n ]));\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nfunction isValidRedirectUrl(redirectUrl) {\n // If the redirect URL is not a valid URL, an error will be thrown.\n try {\n const urlObject = new URL(redirectUrl);\n const noReservedQuery = !urlObject.searchParams.has(\"code\") &&\n !urlObject.searchParams.has(\"state\");\n // As per https://tools.ietf.org/html/rfc6749#section-3.1.2, the redirect URL\n // must not include a hash fragment.\n const noHash = urlObject.hash === \"\";\n return noReservedQuery && noHash;\n }\n catch (_e) {\n return false;\n }\n}\nfunction removeOpenIdParams(redirectUrl) {\n const cleanedUpUrl = new URL(redirectUrl);\n // For auth code flow\n cleanedUpUrl.searchParams.delete(\"state\");\n cleanedUpUrl.searchParams.delete(\"code\");\n // For login error\n cleanedUpUrl.searchParams.delete(\"error\");\n cleanedUpUrl.searchParams.delete(\"error_description\");\n // For RFC9207\n cleanedUpUrl.searchParams.delete(\"iss\");\n return cleanedUpUrl;\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n * @packageDocumentation\n */\nfunction booleanWithFallback(value, fallback) {\n if (typeof value === \"boolean\") {\n return Boolean(value);\n }\n return Boolean(fallback);\n}\n/**\n * @hidden\n * Authorization code flow spec: https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth\n * PKCE: https://tools.ietf.org/html/rfc7636\n */\nclass AuthorizationCodeWithPkceOidcHandlerBase {\n storageUtility;\n redirector;\n constructor(storageUtility, redirector) {\n this.storageUtility = storageUtility;\n this.redirector = redirector;\n this.storageUtility = storageUtility;\n this.redirector = redirector;\n }\n parametersGuard = (oidcLoginOptions) => {\n return (oidcLoginOptions.issuerConfiguration.grantTypesSupported !== undefined &&\n oidcLoginOptions.issuerConfiguration.grantTypesSupported.indexOf(\"authorization_code\") > -1 &&\n oidcLoginOptions.redirectUrl !== undefined);\n };\n async canHandle(oidcLoginOptions) {\n return this.parametersGuard(oidcLoginOptions);\n }\n async setupRedirectHandler({ oidcLoginOptions, state, codeVerifier, targetUrl, }) {\n if (!this.parametersGuard(oidcLoginOptions)) {\n throw new Error(\"The authorization code grant requires a redirectUrl.\");\n }\n await Promise.all([\n // We use the OAuth 'state' value (which should be crypto-random) as\n // the key in our storage to store our actual SessionID. We do this\n // 'cos we'll need to lookup our session information again when the\n // browser is redirected back to us (i.e. the OAuth client\n // application) from the Authorization Server.\n // We don't want to use our session ID as the OAuth 'state' value, as\n // that session ID can be any developer-specified value, and therefore\n // may not be appropriate (since the OAuth 'state' value should really\n // be an unguessable crypto-random value).\n this.storageUtility.setForUser(state, {\n sessionId: oidcLoginOptions.sessionId,\n }),\n // Store our login-process state using the session ID as the key.\n // Strictly speaking, this indirection from our OAuth state value to\n // our session ID is unnecessary, but it provides a slightly cleaner\n // separation of concerns.\n this.storageUtility.setForUser(oidcLoginOptions.sessionId, {\n codeVerifier,\n issuer: oidcLoginOptions.issuer.toString(),\n // The redirect URL is read after redirect, so it must be stored now.\n redirectUrl: oidcLoginOptions.redirectUrl,\n dpop: Boolean(oidcLoginOptions.dpop).toString(),\n keepAlive: booleanWithFallback(oidcLoginOptions.keepAlive, true).toString(),\n }),\n ]);\n this.redirector.redirect(targetUrl, {\n handleRedirect: oidcLoginOptions.handleRedirect,\n });\n return undefined;\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n */\nclass GeneralLogoutHandler {\n sessionInfoManager;\n constructor(sessionInfoManager) {\n this.sessionInfoManager = sessionInfoManager;\n this.sessionInfoManager = sessionInfoManager;\n }\n async canHandle() {\n return true;\n }\n async handle(userId) {\n await this.sessionInfoManager.clear(userId);\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nclass IRpLogoutHandler {\n redirector;\n constructor(redirector) {\n this.redirector = redirector;\n this.redirector = redirector;\n }\n async canHandle(userId, options) {\n return options?.logoutType === \"idp\";\n }\n async handle(userId, options) {\n if (options?.logoutType !== \"idp\") {\n throw new Error(\"Attempting to call idp logout handler to perform app logout\");\n }\n if (options.toLogoutUrl === undefined) {\n throw new Error(\"Cannot perform IDP logout. Did you log in using the OIDC authentication flow?\");\n }\n this.redirector.redirect(options.toLogoutUrl(options), {\n handleRedirect: options.handleRedirect,\n });\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nclass IWaterfallLogoutHandler {\n handlers;\n constructor(sessionInfoManager, redirector) {\n this.handlers = [\n new GeneralLogoutHandler(sessionInfoManager),\n new IRpLogoutHandler(redirector),\n ];\n }\n async canHandle() {\n return true;\n }\n async handle(userId, options) {\n for (const handler of this.handlers) {\n if (await handler.canHandle(userId, options))\n await handler.handle(userId, options);\n }\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n * @packageDocumentation\n */\nfunction getUnauthenticatedSession() {\n return {\n isLoggedIn: false,\n sessionId: v4(),\n fetch: (...args) => fetch(...args),\n };\n}\n/**\n * @param sessionId\n * @param storage\n * @hidden\n */\nasync function clear(sessionId, storage) {\n await Promise.all([\n storage.deleteAllUserData(sessionId, { secure: false }),\n storage.deleteAllUserData(sessionId, { secure: true }),\n ]);\n}\n/**\n * @hidden\n */\nclass SessionInfoManagerBase {\n storageUtility;\n constructor(storageUtility) {\n this.storageUtility = storageUtility;\n this.storageUtility = storageUtility;\n }\n update(_sessionId, _options) {\n throw new Error(\"Not Implemented\");\n }\n set(_sessionId, _sessionInfo) {\n throw new Error(\"Not Implemented\");\n }\n get(_) {\n throw new Error(\"Not implemented\");\n }\n async getAll() {\n throw new Error(\"Not implemented\");\n }\n /**\n * This function removes all session-related information from storage.\n * @param sessionId the session identifier\n * @hidden\n */\n async clear(sessionId) {\n return clear(sessionId, this.storageUtility);\n }\n /**\n * Registers a new session, so that its ID can be retrieved.\n */\n async register(_sessionId) {\n throw new Error(\"Not implemented\");\n }\n /**\n * Returns all the registered session IDs. Differs from getAll, which also\n * returns additional session information.\n */\n async getRegisteredSessionIdAll() {\n throw new Error(\"Not implemented\");\n }\n /**\n * Deletes all information about all sessions, including their registrations.\n */\n async clearAll() {\n throw new Error(\"Not implemented\");\n }\n /**\n * Sets authorization request state in storage for a given session ID.\n */\n async setOidcContext(_sessionId, _authorizationRequestState) {\n throw new Error(\"Not implemented\");\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * This function is designed to isomorphically capture the behavior in oidc-client-js and node-oidc-provider\n * - https://github.com/IdentityModel/oidc-client-js/blob/edec8f59897bdeedcb0b4167586d49626203c2c1/src/OidcClient.js#L138\n * - https://github.com/panva/node-openid-client/blob/35758419489ff751a71f5b66f5020087a63e1e88/lib/client.js#L284\n *\n * @param options IEndSessionOptions\n * @returns The URL to redirect to in order to perform RP Initiated Logout\n * @hidden\n */\nfunction getEndSessionUrl({ endSessionEndpoint, idTokenHint, postLogoutRedirectUri, state, }) {\n const url = new URL(endSessionEndpoint);\n if (idTokenHint !== undefined)\n url.searchParams.append(\"id_token_hint\", idTokenHint);\n if (postLogoutRedirectUri !== undefined) {\n url.searchParams.append(\"post_logout_redirect_uri\", postLogoutRedirectUri);\n if (state !== undefined)\n url.searchParams.append(\"state\", state);\n }\n return url.toString();\n}\n/**\n * @param options.endSessionEndpoint The end_session_endpoint advertised by the server\n * @param options.idTokenHint The idToken supplied by the server after logging in\n * Redirects the window to the location required to perform RP initiated logout\n *\n * @hidden\n */\nfunction maybeBuildRpInitiatedLogout({ endSessionEndpoint, idTokenHint, }) {\n if (endSessionEndpoint === undefined)\n return undefined;\n return function logout({ state, postLogoutUrl }) {\n return getEndSessionUrl({\n endSessionEndpoint,\n idTokenHint,\n state,\n postLogoutRedirectUri: postLogoutUrl,\n });\n };\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nfunction isSupportedTokenType(token) {\n return typeof token === \"string\" && [\"DPoP\", \"Bearer\"].includes(token);\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nconst USER_SESSION_PREFIX = \"solidClientAuthenticationUser\";\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nfunction isValidUrl(url) {\n try {\n // Here, the URL constructor is just called to parse the given string and\n // verify if it is a well-formed IRI.\n new URL(url);\n return true;\n }\n catch {\n return false;\n }\n}\nfunction determineSigningAlg(supported, preferred) {\n return (preferred.find((signingAlg) => {\n return supported.includes(signingAlg);\n }) ?? null);\n}\nfunction isStaticClient(options) {\n return options.clientId !== undefined && !isValidUrl(options.clientId);\n}\nfunction isSolidOidcClient(options, issuerConfig) {\n return (issuerConfig.scopesSupported.includes(\"webid\") &&\n options.clientId !== undefined &&\n isValidUrl(options.clientId));\n}\nfunction isKnownClientType(clientType) {\n return (typeof clientType === \"string\" &&\n [\"dynamic\", \"static\", \"solid-oidc\"].includes(clientType));\n}\nasync function handleRegistration(options, issuerConfig, storageUtility, clientRegistrar) {\n let clientInfo;\n if (isSolidOidcClient(options, issuerConfig)) {\n clientInfo = {\n clientId: options.clientId,\n clientName: options.clientName,\n clientType: \"solid-oidc\",\n };\n }\n else if (isStaticClient(options)) {\n clientInfo = {\n clientId: options.clientId,\n clientSecret: options.clientSecret,\n clientName: options.clientName,\n clientType: \"static\",\n };\n }\n else {\n // Case of a dynamically registered client.\n return clientRegistrar.getClient({\n sessionId: options.sessionId,\n clientName: options.clientName,\n redirectUrl: options.redirectUrl,\n }, issuerConfig);\n }\n // If a client_id was provided, and the Identity Provider is Solid-OIDC compliant,\n // or it is not compliant but the client_id isn't an IRI (we assume it has already\n // been registered with the IdP), then the client registration information needs\n // to be stored so that it can be retrieved later after redirect.\n const infoToSave = {\n clientId: clientInfo.clientId,\n clientType: clientInfo.clientType,\n };\n if (clientInfo.clientType === \"static\") {\n infoToSave.clientSecret = clientInfo.clientSecret;\n }\n if (clientInfo.clientName) {\n infoToSave.clientName = clientInfo.clientName;\n }\n // Note that due to the underlying implementation, doing a `Promise.all`\n // on multiple `storageUtility.setForUser` results in the last one\n // overriding the previous calls.\n await storageUtility.setForUser(options.sessionId, infoToSave);\n return clientInfo;\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nconst boundFetch = (request, init) => fetch(request, init);\n/**\n * @hidden\n */\nclass ClientAuthentication {\n loginHandler;\n redirectHandler;\n logoutHandler;\n sessionInfoManager;\n issuerConfigFetcher;\n boundLogout;\n constructor(loginHandler, redirectHandler, logoutHandler, sessionInfoManager, issuerConfigFetcher) {\n this.loginHandler = loginHandler;\n this.redirectHandler = redirectHandler;\n this.logoutHandler = logoutHandler;\n this.sessionInfoManager = sessionInfoManager;\n this.issuerConfigFetcher = issuerConfigFetcher;\n this.loginHandler = loginHandler;\n this.redirectHandler = redirectHandler;\n this.logoutHandler = logoutHandler;\n this.sessionInfoManager = sessionInfoManager;\n this.issuerConfigFetcher = issuerConfigFetcher;\n }\n // By default, our fetch() resolves to the environment fetch() function.\n fetch = boundFetch;\n logout = async (sessionId, options) => {\n // When doing IDP logout this will redirect away from the current page, so we should not expect\n // code after this condition to be run if it is true.\n // We also need to make sure that any other cleanup that we want to do for\n // our session takes place before this condition is run\n await this.logoutHandler.handle(sessionId, options?.logoutType === \"idp\"\n ? {\n ...options,\n toLogoutUrl: this.boundLogout,\n }\n : options);\n // Restore our fetch() function back to the environment fetch(), effectively\n // leaving us with un-authenticated fetches from now on.\n this.fetch = boundFetch;\n // Delete the bound logout function, so that it can't be called after this.\n delete this.boundLogout;\n };\n getSessionInfo = async (sessionId) => {\n // TODO complete\n return this.sessionInfoManager.get(sessionId);\n };\n getAllSessionInfo = async () => {\n return this.sessionInfoManager.getAll();\n };\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n * @packageDocumentation\n */\n/**\n * A helper class that will validate items taken from local storage\n */\nasync function getSessionIdFromOauthState(storageUtility, oauthState) {\n return storageUtility.getForUser(oauthState, \"sessionId\");\n}\n/**\n * Based on the provided state, this looks up contextual information stored\n * before redirecting the user to the OIDC issuer.\n * @param sessionId The state (~ correlation ID) of the OIDC request\n * @param storageUtility\n * @param configFetcher\n * @returns Information stored about the client issuing the request\n */\nasync function loadOidcContextFromStorage(sessionId, storageUtility, configFetcher) {\n try {\n const [issuerIri, codeVerifier, storedRedirectIri, dpop, keepAlive] = await Promise.all([\n storageUtility.getForUser(sessionId, \"issuer\", {\n errorIfNull: true,\n }),\n storageUtility.getForUser(sessionId, \"codeVerifier\"),\n storageUtility.getForUser(sessionId, \"redirectUrl\"),\n storageUtility.getForUser(sessionId, \"dpop\", { errorIfNull: true }),\n storageUtility.getForUser(sessionId, \"keepAlive\"),\n ]);\n // Clear the code verifier, which is one-time use.\n await storageUtility.deleteForUser(sessionId, \"codeVerifier\");\n // Unlike openid-client, this looks up the configuration from storage\n const issuerConfig = await configFetcher.fetchConfig(issuerIri);\n return {\n codeVerifier,\n redirectUrl: storedRedirectIri,\n issuerConfig,\n dpop: dpop === \"true\",\n // Default keepAlive to true if not found in storage.\n keepAlive: typeof keepAlive === \"string\" ? keepAlive === \"true\" : true,\n };\n }\n catch (e) {\n throw new Error(`Failed to retrieve OIDC context from storage associated with session [${sessionId}]: ${e}`);\n }\n}\n/**\n * Stores information about the session in the provided storage. Note that not\n * all storage are equally secure, and it is strongly advised not to store either\n * the refresh token or the DPoP key in the browser's local storage.\n *\n * @param storageUtility\n * @param sessionId\n * @param webId\n * @param clientId\n * @param isLoggedIn\n * @param refreshToken\n * @param secure\n * @param dpopKey\n */\nasync function saveSessionInfoToStorage(storageUtility, sessionId, webId, clientId, isLoggedIn, refreshToken, secure, dpopKey) {\n // TODO: Investigate why this does not work with a Promise.all\n if (refreshToken !== undefined) {\n await storageUtility.setForUser(sessionId, { refreshToken }, { secure });\n }\n if (webId !== undefined) {\n await storageUtility.setForUser(sessionId, { webId }, { secure });\n }\n if (clientId !== undefined) {\n await storageUtility.setForUser(sessionId, { clientId }, { secure });\n }\n if (isLoggedIn !== undefined) {\n await storageUtility.setForUser(sessionId, { isLoggedIn }, { secure });\n }\n if (dpopKey !== undefined) {\n await storageUtility.setForUser(sessionId, {\n publicKey: JSON.stringify(dpopKey.publicKey),\n privateKey: JSON.stringify(await exportJWK(dpopKey.privateKey)),\n }, { secure });\n }\n}\n// TOTEST: this does not handle all possible bad inputs for example what if it's not proper JSON\n/**\n * @hidden\n */\nclass StorageUtility {\n secureStorage;\n insecureStorage;\n constructor(secureStorage, insecureStorage) {\n this.secureStorage = secureStorage;\n this.insecureStorage = insecureStorage;\n this.secureStorage = secureStorage;\n this.insecureStorage = insecureStorage;\n }\n getKey(userId) {\n return `solidClientAuthenticationUser:${userId}`;\n }\n async getUserData(userId, secure) {\n const stored = await (secure ? this.secureStorage : this.insecureStorage).get(this.getKey(userId));\n if (stored === undefined) {\n return {};\n }\n try {\n return JSON.parse(stored);\n }\n catch (_err) {\n throw new Error(`Data for user [${userId}] in [${secure ? \"secure\" : \"unsecure\"}] storage is corrupted - expected valid JSON, but got: ${stored}`);\n }\n }\n async setUserData(userId, data, secure) {\n await (secure ? this.secureStorage : this.insecureStorage).set(this.getKey(userId), JSON.stringify(data));\n }\n async get(key, options) {\n const value = await (options?.secure ? this.secureStorage : this.insecureStorage).get(key);\n if (value === undefined && options?.errorIfNull) {\n throw new Error(`[${key}] is not stored`);\n }\n return value;\n }\n async set(key, value, options) {\n return (options?.secure ? this.secureStorage : this.insecureStorage).set(key, value);\n }\n async delete(key, options) {\n return (options?.secure ? this.secureStorage : this.insecureStorage).delete(key);\n }\n async getForUser(userId, key, options) {\n const userData = await this.getUserData(userId, options?.secure);\n let value;\n if (!userData || !userData[key]) {\n value = undefined;\n }\n value = userData[key];\n if (value === undefined && options?.errorIfNull) {\n throw new Error(`Field [${key}] for user [${userId}] is not stored`);\n }\n return value || undefined;\n }\n async setForUser(userId, values, options) {\n let userData;\n try {\n userData = await this.getUserData(userId, options?.secure);\n }\n catch {\n // if reading the user data throws, the data is corrupted, and we want to write over it\n userData = {};\n }\n await this.setUserData(userId, { ...userData, ...values }, options?.secure);\n }\n async deleteForUser(userId, key, options) {\n const userData = await this.getUserData(userId, options?.secure);\n delete userData[key];\n await this.setUserData(userId, userData, options?.secure);\n }\n async deleteAllUserData(userId, options) {\n await (options?.secure ? this.secureStorage : this.insecureStorage).delete(this.getKey(userId));\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n */\nclass InMemoryStorage {\n map = {};\n async get(key) {\n return this.map[key] || undefined;\n }\n async set(key, value) {\n this.map[key] = value;\n }\n async delete(key) {\n delete this.map[key];\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n * @packageDocumentation\n */\n/**\n * Error to be triggered when a poor configuration is received\n */\n// NOTE: There's a bug with istanbul and typescript that prevents full branch coverages\n// https://github.com/gotwarlost/istanbul/issues/690\n// The workaround is to put istanbul ignore on the constructor\n/**\n * @hidden\n */\nclass ConfigurationError extends Error {\n /* istanbul ignore next */\n constructor(message) {\n super(message);\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n * @packageDocumentation\n */\n/**\n * Error to be triggered if a method is not implemented\n * @hidden\n */\nclass NotImplementedError extends Error {\n /* istanbul ignore next */\n constructor(methodName) {\n super(`[${methodName}] is not implemented`);\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n * @packageDocumentation\n */\n/**\n * Error to be triggered when receiving a response missing mandatory elements\n */\n// NOTE: There's a bug with istanbul and typescript that prevents full branch coverages\n// https://github.com/gotwarlost/istanbul/issues/690\n// The workaround is to put istanbul ignore on the constructor\n/**\n * @hidden\n */\nclass InvalidResponseError extends Error {\n missingFields;\n /* istanbul ignore next */\n constructor(missingFields) {\n super(`Invalid response from OIDC provider: missing fields ${missingFields}`);\n this.missingFields = missingFields;\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n * @packageDocumentation\n */\n/**\n * Error to be triggered when receiving a response missing mandatory elements\n */\n// NOTE: There's a bug with istanbul and typescript that prevents full branch coverages\n// https://github.com/gotwarlost/istanbul/issues/690\n// The workaround is to put istanbul ignore on the constructor\n/**\n * @hidden\n */\nclass OidcProviderError extends Error {\n error;\n errorDescription;\n /* istanbul ignore next */\n constructor(message, error, errorDescription) {\n super(message);\n this.error = error;\n this.errorDescription = errorDescription;\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * Normalizes a URL in order to generate the DPoP token based on a consistent scheme.\n *\n * @param audience The URL to normalize.\n * @returns The normalized URL as a string.\n * @hidden\n */\nfunction normalizeHTU(audience) {\n const audienceUrl = new URL(audience);\n return new URL(audienceUrl.pathname, audienceUrl.origin).toString();\n}\n/**\n * Creates a DPoP header according to https://tools.ietf.org/html/draft-fett-oauth-dpop-04,\n * based on the target URL and method, using the provided key.\n *\n * @param audience Target URL.\n * @param method HTTP method allowed.\n * @param dpopKey Key used to sign the token.\n * @returns A JWT that can be used as a DPoP Authorization header.\n */\nasync function createDpopHeader(audience, method, dpopKey) {\n return new SignJWT({\n htu: normalizeHTU(audience),\n htm: method.toUpperCase(),\n jti: v4(),\n })\n .setProtectedHeader({\n alg: PREFERRED_SIGNING_ALG[0],\n jwk: dpopKey.publicKey,\n typ: \"dpop+jwt\",\n })\n .setIssuedAt()\n .sign(dpopKey.privateKey, {});\n}\nasync function generateDpopKeyPair() {\n const { privateKey, publicKey } = await generateKeyPair(PREFERRED_SIGNING_ALG[0], { extractable: true });\n const dpopKeyPair = {\n privateKey,\n publicKey: await exportJWK(publicKey),\n };\n // The alg property isn't set by exportJWK, so set it manually.\n [dpopKeyPair.publicKey.alg] = PREFERRED_SIGNING_ALG;\n return dpopKeyPair;\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * If expires_in isn't specified for the access token, we assume its lifetime is\n * 10 minutes.\n */\nconst DEFAULT_EXPIRATION_TIME_SECONDS = 600;\nfunction isExpectedAuthError(statusCode) {\n // As per https://tools.ietf.org/html/rfc7235#section-3.1 and https://tools.ietf.org/html/rfc7235#section-3.1,\n // a response failing because the provided credentials aren't accepted by the\n // server can get a 401 or a 403 response.\n return [401, 403].includes(statusCode);\n}\nasync function buildDpopFetchOptions(targetUrl, authToken, dpopKey, defaultOptions) {\n const headers = new Headers(defaultOptions?.headers);\n // Any pre-existing Authorization header should be overriden.\n headers.set(\"Authorization\", `DPoP ${authToken}`);\n headers.set(\"DPoP\", await createDpopHeader(targetUrl, defaultOptions?.method ?? \"get\", dpopKey));\n return {\n ...defaultOptions,\n headers,\n };\n}\nasync function buildAuthenticatedHeaders(targetUrl, authToken, dpopKey, defaultOptions) {\n if (dpopKey !== undefined) {\n return buildDpopFetchOptions(targetUrl, authToken, dpopKey, defaultOptions);\n }\n const headers = new Headers(defaultOptions?.headers);\n // Any pre-existing Authorization header should be overriden.\n headers.set(\"Authorization\", `Bearer ${authToken}`);\n return {\n ...defaultOptions,\n headers,\n };\n}\nasync function makeAuthenticatedRequest(accessToken, url, defaultRequestInit, dpopKey, unauthFetch = fetch) {\n return unauthFetch(url, await buildAuthenticatedHeaders(url.toString(), accessToken, dpopKey, defaultRequestInit));\n}\nasync function refreshAccessToken(refreshOptions, dpopKey, eventEmitter) {\n const tokenSet = await refreshOptions.tokenRefresher.refresh(refreshOptions.sessionId, refreshOptions.refreshToken, dpopKey);\n eventEmitter?.emit(EVENTS.SESSION_EXTENDED, tokenSet.expiresIn ?? DEFAULT_EXPIRATION_TIME_SECONDS);\n return {\n accessToken: tokenSet.accessToken,\n refreshToken: tokenSet.refreshToken,\n expiresIn: tokenSet.expiresIn,\n };\n}\n/**\n *\n * @param expiresIn Delay until the access token expires.\n * @returns a delay until the access token should be refreshed.\n */\nconst computeRefreshDelay = (expiresIn) => {\n if (expiresIn !== undefined) {\n return expiresIn - REFRESH_BEFORE_EXPIRATION_SECONDS > 0\n ? // We want to refresh the token 5 seconds before they actually expire.\n expiresIn - REFRESH_BEFORE_EXPIRATION_SECONDS\n : expiresIn;\n }\n return DEFAULT_EXPIRATION_TIME_SECONDS;\n};\n/**\n * @param accessToken an access token, either a Bearer token or a DPoP one.\n * @param options The option object may contain two objects: the DPoP key token\n * is bound to if applicable, and options to customize token renewal behavior.\n * @param {typeof fetch} [options.fetch=fetch] A custom fetch function (defaults to the global fetch).\n *\n * @returns A fetch function that adds an appropriate Authorization header with\n * the provided token, and adds a DPoP header if applicable.\n */\nfunction buildAuthenticatedFetch(accessToken, options) {\n let currentAccessToken = accessToken;\n let latestTimeout;\n const currentRefreshOptions = options?.refreshOptions;\n const emitter = options?.eventEmitter;\n // Setup the refresh timeout outside of the authenticated fetch, so that\n // an idle app will not get logged out if it doesn't issue a fetch before\n // the first expiration date.\n if (options !== undefined && currentRefreshOptions !== undefined) {\n const proactivelyRefreshToken = async () => {\n try {\n const { accessToken: refreshedAccessToken, refreshToken, expiresIn, } = await refreshAccessToken(currentRefreshOptions, options.dpopKey, emitter);\n // Update the tokens in the closure if appropriate.\n currentAccessToken = refreshedAccessToken;\n if (refreshToken !== undefined) {\n currentRefreshOptions.refreshToken = refreshToken;\n }\n // Each time the access token is refreshed, we must plan for the next\n // refresh iteration.\n clearTimeout(latestTimeout);\n latestTimeout = setTimeout(proactivelyRefreshToken, computeRefreshDelay(expiresIn) * 1000);\n // If currentRefreshOptions is defined, options is necessarily defined too.\n options.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);\n }\n catch (e) {\n // It is possible that an underlying library throws an error on refresh flow failure.\n // If we used a log framework, the error could be logged at the `debug` level,\n // but otherwise the failure of the refresh flow should not blow up in the user's\n // face, so we just swallow the error.\n if (e instanceof OidcProviderError) {\n // The OIDC provider refused to refresh the access token and returned an error instead.\n /* istanbul ignore next 100% coverage would require testing that nothing\n happens here if the emitter is undefined, which is more cumbersome\n than what it's worth. */\n emitter?.emit(EVENTS.ERROR, e.error, e.errorDescription);\n /* istanbul ignore next 100% coverage would require testing that nothing\n happens here if the emitter is undefined, which is more cumbersome\n than what it's worth. */\n emitter?.emit(EVENTS.SESSION_EXPIRED);\n }\n if (e instanceof InvalidResponseError &&\n e.missingFields.includes(\"access_token\")) {\n // In this case, the OIDC provider returned a non-standard response, but\n // did not specify that it was an error. We cannot refresh nonetheless.\n /* istanbul ignore next 100% coverage would require testing that nothing\n happens here if the emitter is undefined, which is more cumbersome\n than what it's worth. */\n emitter?.emit(EVENTS.SESSION_EXPIRED);\n }\n }\n };\n latestTimeout = setTimeout(proactivelyRefreshToken, \n // If currentRefreshOptions is defined, options is necessarily defined too.\n computeRefreshDelay(options.expiresIn) * 1000);\n emitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);\n }\n else if (emitter !== undefined) {\n // If no refresh options are provided, the session expires when the access token does.\n const expirationTimeout = setTimeout(() => {\n emitter.emit(EVENTS.SESSION_EXPIRED);\n }, computeRefreshDelay(options?.expiresIn) * 1000);\n emitter.emit(EVENTS.TIMEOUT_SET, expirationTimeout);\n }\n return async (url, requestInit) => {\n let response = await makeAuthenticatedRequest(currentAccessToken, url, requestInit, options?.dpopKey, options?.fetch);\n const failedButNotExpectedAuthError = !response.ok && !isExpectedAuthError(response.status);\n if (response.ok || failedButNotExpectedAuthError) {\n // If there hasn't been a redirection, or if there has been a non-auth related\n // issue, it should be handled at the application level\n return response;\n }\n const hasBeenRedirected = response.url !== url;\n if (hasBeenRedirected && options?.dpopKey !== undefined) {\n // If the request failed for auth reasons, and has been redirected, we should\n // replay it generating a DPoP header for the rediration target IRI. This\n // doesn't apply to Bearer tokens, as the Bearer tokens aren't specific\n // to a given resource and method, while the DPoP header (associated to a\n // DPoP token) is.\n response = await makeAuthenticatedRequest(currentAccessToken, \n // Replace the original target IRI (`url`) by the redirection target\n response.url, requestInit, options.dpopKey, options.fetch);\n }\n return response;\n };\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nconst StorageUtilityGetResponse = \"getResponse\";\nconst StorageUtilityMock = {\n /* eslint-disable @typescript-eslint/no-unused-vars */\n get: async (key, options) => StorageUtilityGetResponse,\n set: async (key, value) => {\n /* do nothing */\n },\n delete: async (key) => {\n /* do nothing */\n },\n getForUser: async (userId, key, options) => StorageUtilityGetResponse,\n setForUser: async (userId, values, options) => {\n /* do nothing */\n },\n deleteForUser: async (userId, key, options) => {\n /* do nothing */\n },\n deleteAllUserData: async (userId, options) => {\n /* do nothing */\n },\n};\nconst mockStorage = (stored) => {\n const store = stored;\n return {\n get: async (key) => {\n if (store[key] === undefined) {\n return undefined;\n }\n if (typeof store[key] === \"string\") {\n return store[key];\n }\n return JSON.stringify(store[key]);\n },\n set: async (key, value) => {\n store[key] = value;\n },\n delete: async (key) => {\n delete store[key];\n },\n };\n};\nconst mockStorageUtility = (stored, isSecure = false) => {\n if (isSecure) {\n return new StorageUtility(mockStorage(stored), mockStorage({}));\n }\n return new StorageUtility(mockStorage({}), mockStorage(stored));\n};\n\nexport { AggregateHandler, AuthorizationCodeWithPkceOidcHandlerBase, ClientAuthentication, ConfigurationError, DEFAULT_SCOPES, EVENTS, GeneralLogoutHandler, IRpLogoutHandler, IWaterfallLogoutHandler, InMemoryStorage, InvalidResponseError, NotImplementedError, OidcProviderError, PREFERRED_SIGNING_ALG, REFRESH_BEFORE_EXPIRATION_SECONDS, SOLID_CLIENT_AUTHN_KEY_PREFIX, SessionInfoManagerBase, StorageUtility, StorageUtilityGetResponse, StorageUtilityMock, USER_SESSION_PREFIX, buildAuthenticatedFetch, clear, createDpopHeader, determineSigningAlg, generateDpopKeyPair, getEndSessionUrl, getSessionIdFromOauthState, getUnauthenticatedSession, getWebidFromTokenPayload, handleRegistration, isKnownClientType, isSupportedTokenType, isValidRedirectUrl, loadOidcContextFromStorage, maybeBuildRpInitiatedLogout, mockStorage, mockStorageUtility, normalizeScopes, removeOpenIdParams, saveSessionInfoToStorage };\n//# sourceMappingURL=index.mjs.map\n","import validate from './validate.js';\nconst byteToHex = [];\nfor (let i = 0; i < 256; ++i) {\n byteToHex.push((i + 0x100).toString(16).slice(1));\n}\nexport function unsafeStringify(arr, offset = 0) {\n return (byteToHex[arr[offset + 0]] +\n byteToHex[arr[offset + 1]] +\n byteToHex[arr[offset + 2]] +\n byteToHex[arr[offset + 3]] +\n '-' +\n byteToHex[arr[offset + 4]] +\n byteToHex[arr[offset + 5]] +\n '-' +\n byteToHex[arr[offset + 6]] +\n byteToHex[arr[offset + 7]] +\n '-' +\n byteToHex[arr[offset + 8]] +\n byteToHex[arr[offset + 9]] +\n '-' +\n byteToHex[arr[offset + 10]] +\n byteToHex[arr[offset + 11]] +\n byteToHex[arr[offset + 12]] +\n byteToHex[arr[offset + 13]] +\n byteToHex[arr[offset + 14]] +\n byteToHex[arr[offset + 15]]).toLowerCase();\n}\nfunction stringify(arr, offset = 0) {\n const uuid = unsafeStringify(arr, offset);\n if (!validate(uuid)) {\n throw TypeError('Stringified UUID is invalid');\n }\n return uuid;\n}\nexport default stringify;\n","const rnds8 = new Uint8Array(16);\nexport default function rng() {\n return crypto.getRandomValues(rnds8);\n}\n","import rng from './rng.js';\nimport { unsafeStringify } from './stringify.js';\nfunction v4(options, buf, offset) {\n if (!buf && !options && crypto.randomUUID) {\n return crypto.randomUUID();\n }\n return _v4(options, buf, offset);\n}\nfunction _v4(options, buf, offset) {\n options = options || {};\n const rnds = options.random ?? options.rng?.() ?? rng();\n if (rnds.length < 16) {\n throw new Error('Random bytes length must be >= 16');\n }\n rnds[6] = (rnds[6] & 0x0f) | 0x40;\n rnds[8] = (rnds[8] & 0x3f) | 0x80;\n if (buf) {\n offset = offset || 0;\n if (offset < 0 || offset + 16 > buf.length) {\n throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);\n }\n for (let i = 0; i < 16; ++i) {\n buf[offset + i] = rnds[i];\n }\n return buf;\n }\n return unsafeStringify(rnds);\n}\nexport default v4;\n","// Copyright Joyent, Inc. and other Node contributors.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a\n// copy of this software and associated documentation files (the\n// \"Software\"), to deal in the Software without restriction, including\n// without limitation the rights to use, copy, modify, merge, publish,\n// distribute, sublicense, and/or sell copies of the Software, and to permit\n// persons to whom the Software is furnished to do so, subject to the\n// following conditions:\n//\n// The above copyright notice and this permission notice shall be included\n// in all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS\n// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\n// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN\n// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,\n// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR\n// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE\n// USE OR OTHER DEALINGS IN THE SOFTWARE.\n\n'use strict';\n\nvar R = typeof Reflect === 'object' ? Reflect : null\nvar ReflectApply = R && typeof R.apply === 'function'\n ? R.apply\n : function ReflectApply(target, receiver, args) {\n return Function.prototype.apply.call(target, receiver, args);\n }\n\nvar ReflectOwnKeys\nif (R && typeof R.ownKeys === 'function') {\n ReflectOwnKeys = R.ownKeys\n} else if (Object.getOwnPropertySymbols) {\n ReflectOwnKeys = function ReflectOwnKeys(target) {\n return Object.getOwnPropertyNames(target)\n .concat(Object.getOwnPropertySymbols(target));\n };\n} else {\n ReflectOwnKeys = function ReflectOwnKeys(target) {\n return Object.getOwnPropertyNames(target);\n };\n}\n\nfunction ProcessEmitWarning(warning) {\n if (console && console.warn) console.warn(warning);\n}\n\nvar NumberIsNaN = Number.isNaN || function NumberIsNaN(value) {\n return value !== value;\n}\n\nfunction EventEmitter() {\n EventEmitter.init.call(this);\n}\nmodule.exports = EventEmitter;\nmodule.exports.once = once;\n\n// Backwards-compat with node 0.10.x\nEventEmitter.EventEmitter = EventEmitter;\n\nEventEmitter.prototype._events = undefined;\nEventEmitter.prototype._eventsCount = 0;\nEventEmitter.prototype._maxListeners = undefined;\n\n// By default EventEmitters will print a warning if more than 10 listeners are\n// added to it. This is a useful default which helps finding memory leaks.\nvar defaultMaxListeners = 10;\n\nfunction checkListener(listener) {\n if (typeof listener !== 'function') {\n throw new TypeError('The \"listener\" argument must be of type Function. Received type ' + typeof listener);\n }\n}\n\nObject.defineProperty(EventEmitter, 'defaultMaxListeners', {\n enumerable: true,\n get: function() {\n return defaultMaxListeners;\n },\n set: function(arg) {\n if (typeof arg !== 'number' || arg < 0 || NumberIsNaN(arg)) {\n throw new RangeError('The value of \"defaultMaxListeners\" is out of range. It must be a non-negative number. Received ' + arg + '.');\n }\n defaultMaxListeners = arg;\n }\n});\n\nEventEmitter.init = function() {\n\n if (this._events === undefined ||\n this._events === Object.getPrototypeOf(this)._events) {\n this._events = Object.create(null);\n this._eventsCount = 0;\n }\n\n this._maxListeners = this._maxListeners || undefined;\n};\n\n// Obviously not all Emitters should be limited to 10. This function allows\n// that to be increased. Set to zero for unlimited.\nEventEmitter.prototype.setMaxListeners = function setMaxListeners(n) {\n if (typeof n !== 'number' || n < 0 || NumberIsNaN(n)) {\n throw new RangeError('The value of \"n\" is out of range. It must be a non-negative number. Received ' + n + '.');\n }\n this._maxListeners = n;\n return this;\n};\n\nfunction _getMaxListeners(that) {\n if (that._maxListeners === undefined)\n return EventEmitter.defaultMaxListeners;\n return that._maxListeners;\n}\n\nEventEmitter.prototype.getMaxListeners = function getMaxListeners() {\n return _getMaxListeners(this);\n};\n\nEventEmitter.prototype.emit = function emit(type) {\n var args = [];\n for (var i = 1; i < arguments.length; i++) args.push(arguments[i]);\n var doError = (type === 'error');\n\n var events = this._events;\n if (events !== undefined)\n doError = (doError && events.error === undefined);\n else if (!doError)\n return false;\n\n // If there is no 'error' event listener then throw.\n if (doError) {\n var er;\n if (args.length > 0)\n er = args[0];\n if (er instanceof Error) {\n // Note: The comments on the `throw` lines are intentional, they show\n // up in Node's output if this results in an unhandled exception.\n throw er; // Unhandled 'error' event\n }\n // At least give some kind of context to the user\n var err = new Error('Unhandled error.' + (er ? ' (' + er.message + ')' : ''));\n err.context = er;\n throw err; // Unhandled 'error' event\n }\n\n var handler = events[type];\n\n if (handler === undefined)\n return false;\n\n if (typeof handler === 'function') {\n ReflectApply(handler, this, args);\n } else {\n var len = handler.length;\n var listeners = arrayClone(handler, len);\n for (var i = 0; i < len; ++i)\n ReflectApply(listeners[i], this, args);\n }\n\n return true;\n};\n\nfunction _addListener(target, type, listener, prepend) {\n var m;\n var events;\n var existing;\n\n checkListener(listener);\n\n events = target._events;\n if (events === undefined) {\n events = target._events = Object.create(null);\n target._eventsCount = 0;\n } else {\n // To avoid recursion in the case that type === \"newListener\"! Before\n // adding it to the listeners, first emit \"newListener\".\n if (events.newListener !== undefined) {\n target.emit('newListener', type,\n listener.listener ? listener.listener : listener);\n\n // Re-assign `events` because a newListener handler could have caused the\n // this._events to be assigned to a new object\n events = target._events;\n }\n existing = events[type];\n }\n\n if (existing === undefined) {\n // Optimize the case of one listener. Don't need the extra array object.\n existing = events[type] = listener;\n ++target._eventsCount;\n } else {\n if (typeof existing === 'function') {\n // Adding the second element, need to change to array.\n existing = events[type] =\n prepend ? [listener, existing] : [existing, listener];\n // If we've already got an array, just append.\n } else if (prepend) {\n existing.unshift(listener);\n } else {\n existing.push(listener);\n }\n\n // Check for listener leak\n m = _getMaxListeners(target);\n if (m > 0 && existing.length > m && !existing.warned) {\n existing.warned = true;\n // No error code for this since it is a Warning\n // eslint-disable-next-line no-restricted-syntax\n var w = new Error('Possible EventEmitter memory leak detected. ' +\n existing.length + ' ' + String(type) + ' listeners ' +\n 'added. Use emitter.setMaxListeners() to ' +\n 'increase limit');\n w.name = 'MaxListenersExceededWarning';\n w.emitter = target;\n w.type = type;\n w.count = existing.length;\n ProcessEmitWarning(w);\n }\n }\n\n return target;\n}\n\nEventEmitter.prototype.addListener = function addListener(type, listener) {\n return _addListener(this, type, listener, false);\n};\n\nEventEmitter.prototype.on = EventEmitter.prototype.addListener;\n\nEventEmitter.prototype.prependListener =\n function prependListener(type, listener) {\n return _addListener(this, type, listener, true);\n };\n\nfunction onceWrapper() {\n if (!this.fired) {\n this.target.removeListener(this.type, this.wrapFn);\n this.fired = true;\n if (arguments.length === 0)\n return this.listener.call(this.target);\n return this.listener.apply(this.target, arguments);\n }\n}\n\nfunction _onceWrap(target, type, listener) {\n var state = { fired: false, wrapFn: undefined, target: target, type: type, listener: listener };\n var wrapped = onceWrapper.bind(state);\n wrapped.listener = listener;\n state.wrapFn = wrapped;\n return wrapped;\n}\n\nEventEmitter.prototype.once = function once(type, listener) {\n checkListener(listener);\n this.on(type, _onceWrap(this, type, listener));\n return this;\n};\n\nEventEmitter.prototype.prependOnceListener =\n function prependOnceListener(type, listener) {\n checkListener(listener);\n this.prependListener(type, _onceWrap(this, type, listener));\n return this;\n };\n\n// Emits a 'removeListener' event if and only if the listener was removed.\nEventEmitter.prototype.removeListener =\n function removeListener(type, listener) {\n var list, events, position, i, originalListener;\n\n checkListener(listener);\n\n events = this._events;\n if (events === undefined)\n return this;\n\n list = events[type];\n if (list === undefined)\n return this;\n\n if (list === listener || list.listener === listener) {\n if (--this._eventsCount === 0)\n this._events = Object.create(null);\n else {\n delete events[type];\n if (events.removeListener)\n this.emit('removeListener', type, list.listener || listener);\n }\n } else if (typeof list !== 'function') {\n position = -1;\n\n for (i = list.length - 1; i >= 0; i--) {\n if (list[i] === listener || list[i].listener === listener) {\n originalListener = list[i].listener;\n position = i;\n break;\n }\n }\n\n if (position < 0)\n return this;\n\n if (position === 0)\n list.shift();\n else {\n spliceOne(list, position);\n }\n\n if (list.length === 1)\n events[type] = list[0];\n\n if (events.removeListener !== undefined)\n this.emit('removeListener', type, originalListener || listener);\n }\n\n return this;\n };\n\nEventEmitter.prototype.off = EventEmitter.prototype.removeListener;\n\nEventEmitter.prototype.removeAllListeners =\n function removeAllListeners(type) {\n var listeners, events, i;\n\n events = this._events;\n if (events === undefined)\n return this;\n\n // not listening for removeListener, no need to emit\n if (events.removeListener === undefined) {\n if (arguments.length === 0) {\n this._events = Object.create(null);\n this._eventsCount = 0;\n } else if (events[type] !== undefined) {\n if (--this._eventsCount === 0)\n this._events = Object.create(null);\n else\n delete events[type];\n }\n return this;\n }\n\n // emit removeListener for all listeners on all events\n if (arguments.length === 0) {\n var keys = Object.keys(events);\n var key;\n for (i = 0; i < keys.length; ++i) {\n key = keys[i];\n if (key === 'removeListener') continue;\n this.removeAllListeners(key);\n }\n this.removeAllListeners('removeListener');\n this._events = Object.create(null);\n this._eventsCount = 0;\n return this;\n }\n\n listeners = events[type];\n\n if (typeof listeners === 'function') {\n this.removeListener(type, listeners);\n } else if (listeners !== undefined) {\n // LIFO order\n for (i = listeners.length - 1; i >= 0; i--) {\n this.removeListener(type, listeners[i]);\n }\n }\n\n return this;\n };\n\nfunction _listeners(target, type, unwrap) {\n var events = target._events;\n\n if (events === undefined)\n return [];\n\n var evlistener = events[type];\n if (evlistener === undefined)\n return [];\n\n if (typeof evlistener === 'function')\n return unwrap ? [evlistener.listener || evlistener] : [evlistener];\n\n return unwrap ?\n unwrapListeners(evlistener) : arrayClone(evlistener, evlistener.length);\n}\n\nEventEmitter.prototype.listeners = function listeners(type) {\n return _listeners(this, type, true);\n};\n\nEventEmitter.prototype.rawListeners = function rawListeners(type) {\n return _listeners(this, type, false);\n};\n\nEventEmitter.listenerCount = function(emitter, type) {\n if (typeof emitter.listenerCount === 'function') {\n return emitter.listenerCount(type);\n } else {\n return listenerCount.call(emitter, type);\n }\n};\n\nEventEmitter.prototype.listenerCount = listenerCount;\nfunction listenerCount(type) {\n var events = this._events;\n\n if (events !== undefined) {\n var evlistener = events[type];\n\n if (typeof evlistener === 'function') {\n return 1;\n } else if (evlistener !== undefined) {\n return evlistener.length;\n }\n }\n\n return 0;\n}\n\nEventEmitter.prototype.eventNames = function eventNames() {\n return this._eventsCount > 0 ? ReflectOwnKeys(this._events) : [];\n};\n\nfunction arrayClone(arr, n) {\n var copy = new Array(n);\n for (var i = 0; i < n; ++i)\n copy[i] = arr[i];\n return copy;\n}\n\nfunction spliceOne(list, index) {\n for (; index + 1 < list.length; index++)\n list[index] = list[index + 1];\n list.pop();\n}\n\nfunction unwrapListeners(arr) {\n var ret = new Array(arr.length);\n for (var i = 0; i < ret.length; ++i) {\n ret[i] = arr[i].listener || arr[i];\n }\n return ret;\n}\n\nfunction once(emitter, name) {\n return new Promise(function (resolve, reject) {\n function errorListener(err) {\n emitter.removeListener(name, resolver);\n reject(err);\n }\n\n function resolver() {\n if (typeof emitter.removeListener === 'function') {\n emitter.removeListener('error', errorListener);\n }\n resolve([].slice.call(arguments));\n };\n\n eventTargetAgnosticAddListener(emitter, name, resolver, { once: true });\n if (name !== 'error') {\n addErrorHandlerIfEventEmitter(emitter, errorListener, { once: true });\n }\n });\n}\n\nfunction addErrorHandlerIfEventEmitter(emitter, handler, flags) {\n if (typeof emitter.on === 'function') {\n eventTargetAgnosticAddListener(emitter, 'error', handler, flags);\n }\n}\n\nfunction eventTargetAgnosticAddListener(emitter, name, listener, flags) {\n if (typeof emitter.on === 'function') {\n if (flags.once) {\n emitter.once(name, listener);\n } else {\n emitter.on(name, listener);\n }\n } else if (typeof emitter.addEventListener === 'function') {\n // EventTarget does not have `error` event semantics like Node\n // EventEmitters, we do not listen for `error` events here.\n emitter.addEventListener(name, function wrapListener(arg) {\n // IE does not have builtin `{ once: true }` support so we\n // have to do it manually.\n if (flags.once) {\n emitter.removeEventListener(name, wrapListener);\n }\n listener(arg);\n });\n } else {\n throw new TypeError('The \"emitter\" argument must be of type EventEmitter. Received type ' + typeof emitter);\n }\n}\n",null,"export class InvalidTokenError extends Error {\n}\nInvalidTokenError.prototype.name = \"InvalidTokenError\";\nfunction b64DecodeUnicode(str) {\n return decodeURIComponent(atob(str).replace(/(.)/g, (m, p) => {\n let code = p.charCodeAt(0).toString(16).toUpperCase();\n if (code.length < 2) {\n code = \"0\" + code;\n }\n return \"%\" + code;\n }));\n}\nfunction base64UrlDecode(str) {\n let output = str.replace(/-/g, \"+\").replace(/_/g, \"/\");\n switch (output.length % 4) {\n case 0:\n break;\n case 2:\n output += \"==\";\n break;\n case 3:\n output += \"=\";\n break;\n default:\n throw new Error(\"base64 string is not of the correct length\");\n }\n try {\n return b64DecodeUnicode(output);\n }\n catch (err) {\n return atob(output);\n }\n}\nexport function jwtDecode(token, options) {\n if (typeof token !== \"string\") {\n throw new InvalidTokenError(\"Invalid token specified: must be a string\");\n }\n options || (options = {});\n const pos = options.header === true ? 0 : 1;\n const part = token.split(\".\")[pos];\n if (typeof part !== \"string\") {\n throw new InvalidTokenError(`Invalid token specified: missing part #${pos + 1}`);\n }\n let decoded;\n try {\n decoded = base64UrlDecode(part);\n }\n catch (e) {\n throw new InvalidTokenError(`Invalid token specified: invalid base64 for part #${pos + 1} (${e.message})`);\n }\n try {\n return JSON.parse(decoded);\n }\n catch (e) {\n throw new InvalidTokenError(`Invalid token specified: invalid json for part #${pos + 1} (${e.message})`);\n }\n}\n","// src/utils/Logger.ts\nvar nopLogger = {\n debug: () => void 0,\n info: () => void 0,\n warn: () => void 0,\n error: () => void 0\n};\nvar level;\nvar logger;\nvar Log = /* @__PURE__ */ ((Log2) => {\n Log2[Log2[\"NONE\"] = 0] = \"NONE\";\n Log2[Log2[\"ERROR\"] = 1] = \"ERROR\";\n Log2[Log2[\"WARN\"] = 2] = \"WARN\";\n Log2[Log2[\"INFO\"] = 3] = \"INFO\";\n Log2[Log2[\"DEBUG\"] = 4] = \"DEBUG\";\n return Log2;\n})(Log || {});\n((Log2) => {\n function reset() {\n level = 3 /* INFO */;\n logger = nopLogger;\n }\n Log2.reset = reset;\n function setLevel(value) {\n if (!(0 /* NONE */ <= value && value <= 4 /* DEBUG */)) {\n throw new Error(\"Invalid log level\");\n }\n level = value;\n }\n Log2.setLevel = setLevel;\n function setLogger(value) {\n logger = value;\n }\n Log2.setLogger = setLogger;\n})(Log || (Log = {}));\nvar Logger = class _Logger {\n constructor(_name) {\n this._name = _name;\n }\n /* eslint-disable @typescript-eslint/no-unsafe-enum-comparison */\n debug(...args) {\n if (level >= 4 /* DEBUG */) {\n logger.debug(_Logger._format(this._name, this._method), ...args);\n }\n }\n info(...args) {\n if (level >= 3 /* INFO */) {\n logger.info(_Logger._format(this._name, this._method), ...args);\n }\n }\n warn(...args) {\n if (level >= 2 /* WARN */) {\n logger.warn(_Logger._format(this._name, this._method), ...args);\n }\n }\n error(...args) {\n if (level >= 1 /* ERROR */) {\n logger.error(_Logger._format(this._name, this._method), ...args);\n }\n }\n /* eslint-enable @typescript-eslint/no-unsafe-enum-comparison */\n throw(err) {\n this.error(err);\n throw err;\n }\n create(method) {\n const methodLogger = Object.create(this);\n methodLogger._method = method;\n methodLogger.debug(\"begin\");\n return methodLogger;\n }\n static createStatic(name, staticMethod) {\n const staticLogger = new _Logger(`${name}.${staticMethod}`);\n staticLogger.debug(\"begin\");\n return staticLogger;\n }\n static _format(name, method) {\n const prefix = `[${name}]`;\n return method ? `${prefix} ${method}:` : prefix;\n }\n /* eslint-disable @typescript-eslint/no-unsafe-enum-comparison */\n // helpers for static class methods\n static debug(name, ...args) {\n if (level >= 4 /* DEBUG */) {\n logger.debug(_Logger._format(name), ...args);\n }\n }\n static info(name, ...args) {\n if (level >= 3 /* INFO */) {\n logger.info(_Logger._format(name), ...args);\n }\n }\n static warn(name, ...args) {\n if (level >= 2 /* WARN */) {\n logger.warn(_Logger._format(name), ...args);\n }\n }\n static error(name, ...args) {\n if (level >= 1 /* ERROR */) {\n logger.error(_Logger._format(name), ...args);\n }\n }\n /* eslint-enable @typescript-eslint/no-unsafe-enum-comparison */\n};\nLog.reset();\n\n// src/utils/JwtUtils.ts\nimport { jwtDecode } from \"jwt-decode\";\nvar JwtUtils = class {\n // IMPORTANT: doesn't validate the token\n static decode(token) {\n try {\n return jwtDecode(token);\n } catch (err) {\n Logger.error(\"JwtUtils.decode\", err);\n throw err;\n }\n }\n static async generateSignedJwt(header, payload, privateKey) {\n const encodedHeader = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(header)));\n const encodedPayload = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(payload)));\n const encodedToken = `${encodedHeader}.${encodedPayload}`;\n const signature = await window.crypto.subtle.sign(\n {\n name: \"ECDSA\",\n hash: { name: \"SHA-256\" }\n },\n privateKey,\n new TextEncoder().encode(encodedToken)\n );\n const encodedSignature = CryptoUtils.encodeBase64Url(new Uint8Array(signature));\n return `${encodedToken}.${encodedSignature}`;\n }\n static async generateSignedJwtWithHmac(header, payload, secretKey) {\n const encodedHeader = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(header)));\n const encodedPayload = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(payload)));\n const encodedToken = `${encodedHeader}.${encodedPayload}`;\n const signature = await window.crypto.subtle.sign(\n \"HMAC\",\n secretKey,\n new TextEncoder().encode(encodedToken)\n );\n const encodedSignature = CryptoUtils.encodeBase64Url(new Uint8Array(signature));\n return `${encodedToken}.${encodedSignature}`;\n }\n};\n\n// src/utils/CryptoUtils.ts\nvar UUID_V4_TEMPLATE = \"10000000-1000-4000-8000-100000000000\";\nvar toBase64 = (val) => btoa([...new Uint8Array(val)].map((chr) => String.fromCharCode(chr)).join(\"\"));\nvar _CryptoUtils = class _CryptoUtils {\n static _randomWord() {\n const arr = new Uint32Array(1);\n crypto.getRandomValues(arr);\n return arr[0];\n }\n /**\n * Generates RFC4122 version 4 guid\n */\n static generateUUIDv4() {\n const uuid = UUID_V4_TEMPLATE.replace(\n /[018]/g,\n (c) => (+c ^ _CryptoUtils._randomWord() & 15 >> +c / 4).toString(16)\n );\n return uuid.replace(/-/g, \"\");\n }\n /**\n * PKCE: Generate a code verifier\n */\n static generateCodeVerifier() {\n return _CryptoUtils.generateUUIDv4() + _CryptoUtils.generateUUIDv4() + _CryptoUtils.generateUUIDv4();\n }\n /**\n * PKCE: Generate a code challenge\n */\n static async generateCodeChallenge(code_verifier) {\n if (!crypto.subtle) {\n throw new Error(\"Crypto.subtle is available only in secure contexts (HTTPS).\");\n }\n try {\n const encoder = new TextEncoder();\n const data = encoder.encode(code_verifier);\n const hashed = await crypto.subtle.digest(\"SHA-256\", data);\n return toBase64(hashed).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n } catch (err) {\n Logger.error(\"CryptoUtils.generateCodeChallenge\", err);\n throw err;\n }\n }\n /**\n * Generates a base64-encoded string for a basic auth header\n */\n static generateBasicAuth(client_id, client_secret) {\n const encoder = new TextEncoder();\n const data = encoder.encode([client_id, client_secret].join(\":\"));\n return toBase64(data);\n }\n /**\n * Generates a hash of a string using a given algorithm\n * @param alg\n * @param message\n */\n static async hash(alg, message) {\n const msgUint8 = new TextEncoder().encode(message);\n const hashBuffer = await crypto.subtle.digest(alg, msgUint8);\n return new Uint8Array(hashBuffer);\n }\n /**\n * Generates a rfc7638 compliant jwk thumbprint\n * @param jwk\n */\n static async customCalculateJwkThumbprint(jwk) {\n let jsonObject;\n switch (jwk.kty) {\n case \"RSA\":\n jsonObject = {\n \"e\": jwk.e,\n \"kty\": jwk.kty,\n \"n\": jwk.n\n };\n break;\n case \"EC\":\n jsonObject = {\n \"crv\": jwk.crv,\n \"kty\": jwk.kty,\n \"x\": jwk.x,\n \"y\": jwk.y\n };\n break;\n case \"OKP\":\n jsonObject = {\n \"crv\": jwk.crv,\n \"kty\": jwk.kty,\n \"x\": jwk.x\n };\n break;\n case \"oct\":\n jsonObject = {\n \"crv\": jwk.k,\n \"kty\": jwk.kty\n };\n break;\n default:\n throw new Error(\"Unknown jwk type\");\n }\n const utf8encodedAndHashed = await _CryptoUtils.hash(\"SHA-256\", JSON.stringify(jsonObject));\n return _CryptoUtils.encodeBase64Url(utf8encodedAndHashed);\n }\n static async generateDPoPProof({\n url,\n accessToken,\n httpMethod,\n keyPair,\n nonce\n }) {\n let hashedToken;\n let encodedHash;\n const payload = {\n \"jti\": window.crypto.randomUUID(),\n \"htm\": httpMethod != null ? httpMethod : \"GET\",\n \"htu\": url,\n \"iat\": Math.floor(Date.now() / 1e3)\n };\n if (accessToken) {\n hashedToken = await _CryptoUtils.hash(\"SHA-256\", accessToken);\n encodedHash = _CryptoUtils.encodeBase64Url(hashedToken);\n payload.ath = encodedHash;\n }\n if (nonce) {\n payload.nonce = nonce;\n }\n try {\n const publicJwk = await crypto.subtle.exportKey(\"jwk\", keyPair.publicKey);\n const header = {\n \"alg\": \"ES256\",\n \"typ\": \"dpop+jwt\",\n \"jwk\": {\n \"crv\": publicJwk.crv,\n \"kty\": publicJwk.kty,\n \"x\": publicJwk.x,\n \"y\": publicJwk.y\n }\n };\n return await JwtUtils.generateSignedJwt(header, payload, keyPair.privateKey);\n } catch (err) {\n if (err instanceof TypeError) {\n throw new Error(`Error exporting dpop public key: ${err.message}`);\n } else {\n throw err;\n }\n }\n }\n static async generateDPoPJkt(keyPair) {\n try {\n const publicJwk = await crypto.subtle.exportKey(\"jwk\", keyPair.publicKey);\n return await _CryptoUtils.customCalculateJwkThumbprint(publicJwk);\n } catch (err) {\n if (err instanceof TypeError) {\n throw new Error(`Could not retrieve dpop keys from storage: ${err.message}`);\n } else {\n throw err;\n }\n }\n }\n static async generateDPoPKeys() {\n return await window.crypto.subtle.generateKey(\n {\n name: \"ECDSA\",\n namedCurve: \"P-256\"\n },\n false,\n [\"sign\", \"verify\"]\n );\n }\n /**\n * Generates a client assertion JWT for client_secret_jwt authentication\n * @param client_id The client identifier\n * @param client_secret The client secret\n * @param audience The token endpoint URL (audience)\n * @param algorithm The HMAC algorithm to use (HS256, HS384, HS512). Defaults to HS256\n */\n static async generateClientAssertionJwt(client_id, client_secret, audience, algorithm = \"HS256\") {\n const now = Math.floor(Date.now() / 1e3);\n const header = {\n \"alg\": algorithm,\n \"typ\": \"JWT\"\n };\n const payload = {\n \"iss\": client_id,\n \"sub\": client_id,\n \"aud\": audience,\n \"jti\": _CryptoUtils.generateUUIDv4(),\n \"exp\": now + 300,\n // 5 minutes\n \"iat\": now\n };\n const hashMap = {\n \"HS256\": \"SHA-256\",\n \"HS384\": \"SHA-384\",\n \"HS512\": \"SHA-512\"\n };\n const hashFunction = hashMap[algorithm];\n if (!hashFunction) {\n throw new Error(`Unsupported algorithm: ${algorithm}. Supported algorithms are: HS256, HS384, HS512`);\n }\n const encoder = new TextEncoder();\n const secretKey = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(client_secret),\n { name: \"HMAC\", hash: hashFunction },\n false,\n [\"sign\"]\n );\n return await JwtUtils.generateSignedJwtWithHmac(header, payload, secretKey);\n }\n};\n/**\n * Generates a base64url encoded string\n */\n_CryptoUtils.encodeBase64Url = (input) => {\n return toBase64(input).replace(/=/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\");\n};\nvar CryptoUtils = _CryptoUtils;\n\n// src/utils/Event.ts\nvar Event = class {\n constructor(_name) {\n this._name = _name;\n this._callbacks = [];\n this._logger = new Logger(`Event('${this._name}')`);\n }\n addHandler(cb) {\n this._callbacks.push(cb);\n return () => this.removeHandler(cb);\n }\n removeHandler(cb) {\n const idx = this._callbacks.lastIndexOf(cb);\n if (idx >= 0) {\n this._callbacks.splice(idx, 1);\n }\n }\n async raise(...ev) {\n this._logger.debug(\"raise:\", ...ev);\n for (const cb of this._callbacks) {\n await cb(...ev);\n }\n }\n};\n\n// src/utils/PopupUtils.ts\nvar PopupUtils = class {\n /**\n * Populates a map of window features with a placement centered in front of\n * the current window. If no explicit width is given, a default value is\n * binned into [800, 720, 600, 480, 360] based on the current window's width.\n */\n static center({ ...features }) {\n var _a, _b, _c;\n if (features.width == null)\n features.width = (_a = [800, 720, 600, 480].find((width) => width <= window.outerWidth / 1.618)) != null ? _a : 360;\n (_b = features.left) != null ? _b : features.left = Math.max(0, Math.round(window.screenX + (window.outerWidth - features.width) / 2));\n if (features.height != null)\n (_c = features.top) != null ? _c : features.top = Math.max(0, Math.round(window.screenY + (window.outerHeight - features.height) / 2));\n return features;\n }\n static serialize(features) {\n return Object.entries(features).filter(([, value]) => value != null).map(([key, value]) => `${key}=${typeof value !== \"boolean\" ? value : value ? \"yes\" : \"no\"}`).join(\",\");\n }\n};\n\n// src/utils/Timer.ts\nvar Timer = class _Timer extends Event {\n constructor() {\n super(...arguments);\n this._logger = new Logger(`Timer('${this._name}')`);\n this._timerHandle = null;\n this._expiration = 0;\n this._callback = () => {\n const diff = this._expiration - _Timer.getEpochTime();\n this._logger.debug(\"timer completes in\", diff);\n if (this._expiration <= _Timer.getEpochTime()) {\n this.cancel();\n void super.raise();\n }\n };\n }\n // get the time\n static getEpochTime() {\n return Math.floor(Date.now() / 1e3);\n }\n init(durationInSeconds) {\n const logger2 = this._logger.create(\"init\");\n durationInSeconds = Math.max(Math.floor(durationInSeconds), 1);\n const expiration = _Timer.getEpochTime() + durationInSeconds;\n if (this.expiration === expiration && this._timerHandle) {\n logger2.debug(\"skipping since already initialized for expiration at\", this.expiration);\n return;\n }\n this.cancel();\n logger2.debug(\"using duration\", durationInSeconds);\n this._expiration = expiration;\n const timerDurationInSeconds = Math.min(durationInSeconds, 5);\n this._timerHandle = setInterval(this._callback, timerDurationInSeconds * 1e3);\n }\n get expiration() {\n return this._expiration;\n }\n cancel() {\n this._logger.create(\"cancel\");\n if (this._timerHandle) {\n clearInterval(this._timerHandle);\n this._timerHandle = null;\n }\n }\n};\n\n// src/utils/UrlUtils.ts\nvar UrlUtils = class {\n static readParams(url, responseMode = \"query\") {\n if (!url) throw new TypeError(\"Invalid URL\");\n const parsedUrl = new URL(url, \"http://127.0.0.1\");\n const params = parsedUrl[responseMode === \"fragment\" ? \"hash\" : \"search\"];\n return new URLSearchParams(params.slice(1));\n }\n};\nvar URL_STATE_DELIMITER = \";\";\n\n// src/errors/ErrorResponse.ts\nvar ErrorResponse = class extends Error {\n constructor(args, form) {\n var _a, _b, _c;\n super(args.error_description || args.error || \"\");\n this.form = form;\n /** Marker to detect class: \"ErrorResponse\" */\n this.name = \"ErrorResponse\";\n if (!args.error) {\n Logger.error(\"ErrorResponse\", \"No error passed\");\n throw new Error(\"No error passed\");\n }\n this.error = args.error;\n this.error_description = (_a = args.error_description) != null ? _a : null;\n this.error_uri = (_b = args.error_uri) != null ? _b : null;\n this.state = args.userState;\n this.session_state = (_c = args.session_state) != null ? _c : null;\n this.url_state = args.url_state;\n }\n};\n\n// src/errors/ErrorTimeout.ts\nvar ErrorTimeout = class extends Error {\n constructor(message) {\n super(message);\n /** Marker to detect class: \"ErrorTimeout\" */\n this.name = \"ErrorTimeout\";\n }\n};\n\n// src/AccessTokenEvents.ts\nvar AccessTokenEvents = class {\n constructor(args) {\n this._logger = new Logger(\"AccessTokenEvents\");\n this._expiringTimer = new Timer(\"Access token expiring\");\n this._expiredTimer = new Timer(\"Access token expired\");\n this._expiringNotificationTimeInSeconds = args.expiringNotificationTimeInSeconds;\n }\n async load(container) {\n const logger2 = this._logger.create(\"load\");\n if (container.access_token && container.expires_in !== void 0) {\n const duration = container.expires_in;\n logger2.debug(\"access token present, remaining duration:\", duration);\n if (duration > 0) {\n let expiring = duration - this._expiringNotificationTimeInSeconds;\n if (expiring <= 0) {\n expiring = 1;\n }\n logger2.debug(\"registering expiring timer, raising in\", expiring, \"seconds\");\n this._expiringTimer.init(expiring);\n } else {\n logger2.debug(\"canceling existing expiring timer because we're past expiration.\");\n this._expiringTimer.cancel();\n }\n const expired = duration + 1;\n logger2.debug(\"registering expired timer, raising in\", expired, \"seconds\");\n this._expiredTimer.init(expired);\n } else {\n this._expiringTimer.cancel();\n this._expiredTimer.cancel();\n }\n }\n async unload() {\n this._logger.debug(\"unload: canceling existing access token timers\");\n this._expiringTimer.cancel();\n this._expiredTimer.cancel();\n }\n /**\n * Add callback: Raised prior to the access token expiring.\n */\n addAccessTokenExpiring(cb) {\n return this._expiringTimer.addHandler(cb);\n }\n /**\n * Remove callback: Raised prior to the access token expiring.\n */\n removeAccessTokenExpiring(cb) {\n this._expiringTimer.removeHandler(cb);\n }\n /**\n * Add callback: Raised after the access token has expired.\n */\n addAccessTokenExpired(cb) {\n return this._expiredTimer.addHandler(cb);\n }\n /**\n * Remove callback: Raised after the access token has expired.\n */\n removeAccessTokenExpired(cb) {\n this._expiredTimer.removeHandler(cb);\n }\n};\n\n// src/CheckSessionIFrame.ts\nvar CheckSessionIFrame = class {\n constructor(_callback, _client_id, url, _intervalInSeconds, _stopOnError) {\n this._callback = _callback;\n this._client_id = _client_id;\n this._intervalInSeconds = _intervalInSeconds;\n this._stopOnError = _stopOnError;\n this._logger = new Logger(\"CheckSessionIFrame\");\n this._timer = null;\n this._session_state = null;\n this._message = (e) => {\n if (e.origin === this._frame_origin && e.source === this._frame.contentWindow) {\n if (e.data === \"error\") {\n this._logger.error(\"error message from check session op iframe\");\n if (this._stopOnError) {\n this.stop();\n }\n } else if (e.data === \"changed\") {\n this._logger.debug(\"changed message from check session op iframe\");\n this.stop();\n void this._callback();\n } else {\n this._logger.debug(e.data + \" message from check session op iframe\");\n }\n }\n };\n const parsedUrl = new URL(url);\n this._frame_origin = parsedUrl.origin;\n this._frame = window.document.createElement(\"iframe\");\n this._frame.style.visibility = \"hidden\";\n this._frame.style.position = \"fixed\";\n this._frame.style.left = \"-1000px\";\n this._frame.style.top = \"0\";\n this._frame.width = \"0\";\n this._frame.height = \"0\";\n this._frame.src = parsedUrl.href;\n }\n load() {\n return new Promise((resolve) => {\n this._frame.onload = () => {\n resolve();\n };\n window.document.body.appendChild(this._frame);\n window.addEventListener(\"message\", this._message, false);\n });\n }\n start(session_state) {\n if (this._session_state === session_state) {\n return;\n }\n this._logger.create(\"start\");\n this.stop();\n this._session_state = session_state;\n const send = () => {\n if (!this._frame.contentWindow || !this._session_state) {\n return;\n }\n this._frame.contentWindow.postMessage(this._client_id + \" \" + this._session_state, this._frame_origin);\n };\n send();\n this._timer = setInterval(send, this._intervalInSeconds * 1e3);\n }\n stop() {\n this._logger.create(\"stop\");\n this._session_state = null;\n if (this._timer) {\n clearInterval(this._timer);\n this._timer = null;\n }\n }\n};\n\n// src/InMemoryWebStorage.ts\nvar InMemoryWebStorage = class {\n constructor() {\n this._logger = new Logger(\"InMemoryWebStorage\");\n this._data = {};\n }\n clear() {\n this._logger.create(\"clear\");\n this._data = {};\n }\n getItem(key) {\n this._logger.create(`getItem('${key}')`);\n return this._data[key];\n }\n setItem(key, value) {\n this._logger.create(`setItem('${key}')`);\n this._data[key] = value;\n }\n removeItem(key) {\n this._logger.create(`removeItem('${key}')`);\n delete this._data[key];\n }\n get length() {\n return Object.getOwnPropertyNames(this._data).length;\n }\n key(index) {\n return Object.getOwnPropertyNames(this._data)[index];\n }\n};\n\n// src/errors/ErrorDPoPNonce.ts\nvar ErrorDPoPNonce = class extends Error {\n constructor(nonce, message) {\n super(message);\n /** Marker to detect class: \"ErrorDPoPNonce\" */\n this.name = \"ErrorDPoPNonce\";\n this.nonce = nonce;\n }\n};\n\n// src/JsonService.ts\nvar JsonService = class {\n constructor(additionalContentTypes = [], _jwtHandler = null, _extraHeaders = {}) {\n this._jwtHandler = _jwtHandler;\n this._extraHeaders = _extraHeaders;\n this._logger = new Logger(\"JsonService\");\n this._contentTypes = [];\n this._contentTypes.push(...additionalContentTypes, \"application/json\");\n if (_jwtHandler) {\n this._contentTypes.push(\"application/jwt\");\n }\n }\n async fetchWithTimeout(input, init = {}) {\n const { timeoutInSeconds, ...initFetch } = init;\n if (!timeoutInSeconds) {\n return await fetch(input, initFetch);\n }\n const controller = new AbortController();\n const timeoutId = setTimeout(() => controller.abort(), timeoutInSeconds * 1e3);\n try {\n const response = await fetch(input, {\n ...init,\n signal: controller.signal\n });\n return response;\n } catch (err) {\n if (err instanceof DOMException && err.name === \"AbortError\") {\n throw new ErrorTimeout(\"Network timed out\");\n }\n throw err;\n } finally {\n clearTimeout(timeoutId);\n }\n }\n async getJson(url, {\n token,\n credentials,\n timeoutInSeconds\n } = {}) {\n const logger2 = this._logger.create(\"getJson\");\n const headers = {\n \"Accept\": this._contentTypes.join(\", \")\n };\n if (token) {\n logger2.debug(\"token passed, setting Authorization header\");\n headers[\"Authorization\"] = \"Bearer \" + token;\n }\n this._appendExtraHeaders(headers);\n let response;\n try {\n logger2.debug(\"url:\", url);\n response = await this.fetchWithTimeout(url, { method: \"GET\", headers, timeoutInSeconds, credentials });\n } catch (err) {\n logger2.error(\"Network Error\");\n throw err;\n }\n logger2.debug(\"HTTP response received, status\", response.status);\n const contentType = response.headers.get(\"Content-Type\");\n if (contentType && !this._contentTypes.find((item) => contentType.startsWith(item))) {\n logger2.throw(new Error(`Invalid response Content-Type: ${contentType != null ? contentType : \"undefined\"}, from URL: ${url}`));\n }\n if (response.ok && this._jwtHandler && (contentType == null ? void 0 : contentType.startsWith(\"application/jwt\"))) {\n return await this._jwtHandler(await response.text());\n }\n let json;\n try {\n json = await response.json();\n } catch (err) {\n logger2.error(\"Error parsing JSON response\", err);\n if (response.ok) throw err;\n throw new Error(`${response.statusText} (${response.status})`);\n }\n if (!response.ok) {\n logger2.error(\"Error from server:\", json);\n if (json.error) {\n throw new ErrorResponse(json);\n }\n throw new Error(`${response.statusText} (${response.status}): ${JSON.stringify(json)}`);\n }\n return json;\n }\n async postForm(url, {\n body,\n basicAuth,\n timeoutInSeconds,\n initCredentials,\n extraHeaders\n }) {\n const logger2 = this._logger.create(\"postForm\");\n const headers = {\n \"Accept\": this._contentTypes.join(\", \"),\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n ...extraHeaders\n };\n if (basicAuth !== void 0) {\n headers[\"Authorization\"] = \"Basic \" + basicAuth;\n }\n this._appendExtraHeaders(headers);\n let response;\n try {\n logger2.debug(\"url:\", url);\n response = await this.fetchWithTimeout(url, { method: \"POST\", headers, body, timeoutInSeconds, credentials: initCredentials });\n } catch (err) {\n logger2.error(\"Network error\");\n throw err;\n }\n logger2.debug(\"HTTP response received, status\", response.status);\n const contentType = response.headers.get(\"Content-Type\");\n if (contentType && !this._contentTypes.find((item) => contentType.startsWith(item))) {\n throw new Error(`Invalid response Content-Type: ${contentType != null ? contentType : \"undefined\"}, from URL: ${url}`);\n }\n const responseText = await response.text();\n let json = {};\n if (responseText) {\n try {\n json = JSON.parse(responseText);\n } catch (err) {\n logger2.error(\"Error parsing JSON response\", err);\n if (response.ok) throw err;\n throw new Error(`${response.statusText} (${response.status})`);\n }\n }\n if (!response.ok) {\n logger2.error(\"Error from server:\", json);\n if (response.headers.has(\"dpop-nonce\")) {\n const nonce = response.headers.get(\"dpop-nonce\");\n throw new ErrorDPoPNonce(nonce, `${JSON.stringify(json)}`);\n }\n if (json.error) {\n throw new ErrorResponse(json, body);\n }\n throw new Error(`${response.statusText} (${response.status}): ${JSON.stringify(json)}`);\n }\n return json;\n }\n _appendExtraHeaders(headers) {\n const logger2 = this._logger.create(\"appendExtraHeaders\");\n const customKeys = Object.keys(this._extraHeaders);\n const protectedHeaders = [\n \"accept\",\n \"content-type\"\n ];\n const preventOverride = [\n \"authorization\"\n ];\n if (customKeys.length === 0) {\n return;\n }\n customKeys.forEach((headerName) => {\n if (protectedHeaders.includes(headerName.toLocaleLowerCase())) {\n logger2.warn(\"Protected header could not be set\", headerName, protectedHeaders);\n return;\n }\n if (preventOverride.includes(headerName.toLocaleLowerCase()) && Object.keys(headers).includes(headerName)) {\n logger2.warn(\"Header could not be overridden\", headerName, preventOverride);\n return;\n }\n const content = typeof this._extraHeaders[headerName] === \"function\" ? this._extraHeaders[headerName]() : this._extraHeaders[headerName];\n if (content && content !== \"\") {\n headers[headerName] = content;\n }\n });\n }\n};\n\n// src/MetadataService.ts\nvar MetadataService = class {\n constructor(_settings) {\n this._settings = _settings;\n this._logger = new Logger(\"MetadataService\");\n this._signingKeys = null;\n this._metadata = null;\n this._metadataUrl = this._settings.metadataUrl;\n this._jsonService = new JsonService(\n [\"application/jwk-set+json\"],\n null,\n this._settings.extraHeaders\n );\n if (this._settings.signingKeys) {\n this._logger.debug(\"using signingKeys from settings\");\n this._signingKeys = this._settings.signingKeys;\n }\n if (this._settings.metadata) {\n this._logger.debug(\"using metadata from settings\");\n this._metadata = this._settings.metadata;\n }\n if (this._settings.fetchRequestCredentials) {\n this._logger.debug(\"using fetchRequestCredentials from settings\");\n this._fetchRequestCredentials = this._settings.fetchRequestCredentials;\n }\n }\n resetSigningKeys() {\n this._signingKeys = null;\n }\n async getMetadata() {\n const logger2 = this._logger.create(\"getMetadata\");\n if (this._metadata) {\n logger2.debug(\"using cached values\");\n return this._metadata;\n }\n if (!this._metadataUrl) {\n logger2.throw(new Error(\"No authority or metadataUrl configured on settings\"));\n throw null;\n }\n logger2.debug(\"getting metadata from\", this._metadataUrl);\n const metadata = await this._jsonService.getJson(this._metadataUrl, { credentials: this._fetchRequestCredentials, timeoutInSeconds: this._settings.requestTimeoutInSeconds });\n logger2.debug(\"merging remote JSON with seed metadata\");\n this._metadata = Object.assign({}, metadata, this._settings.metadataSeed);\n return this._metadata;\n }\n getIssuer() {\n return this._getMetadataProperty(\"issuer\");\n }\n getAuthorizationEndpoint() {\n return this._getMetadataProperty(\"authorization_endpoint\");\n }\n getUserInfoEndpoint() {\n return this._getMetadataProperty(\"userinfo_endpoint\");\n }\n getTokenEndpoint(optional = true) {\n return this._getMetadataProperty(\"token_endpoint\", optional);\n }\n getCheckSessionIframe() {\n return this._getMetadataProperty(\"check_session_iframe\", true);\n }\n getEndSessionEndpoint() {\n return this._getMetadataProperty(\"end_session_endpoint\", true);\n }\n getRevocationEndpoint(optional = true) {\n return this._getMetadataProperty(\"revocation_endpoint\", optional);\n }\n getKeysEndpoint(optional = true) {\n return this._getMetadataProperty(\"jwks_uri\", optional);\n }\n async _getMetadataProperty(name, optional = false) {\n const logger2 = this._logger.create(`_getMetadataProperty('${name}')`);\n const metadata = await this.getMetadata();\n logger2.debug(\"resolved\");\n if (metadata[name] === void 0) {\n if (optional === true) {\n logger2.warn(\"Metadata does not contain optional property\");\n return void 0;\n }\n logger2.throw(new Error(\"Metadata does not contain property \" + name));\n }\n return metadata[name];\n }\n async getSigningKeys() {\n const logger2 = this._logger.create(\"getSigningKeys\");\n if (this._signingKeys) {\n logger2.debug(\"returning signingKeys from cache\");\n return this._signingKeys;\n }\n const jwks_uri = await this.getKeysEndpoint(false);\n logger2.debug(\"got jwks_uri\", jwks_uri);\n const keySet = await this._jsonService.getJson(jwks_uri, { timeoutInSeconds: this._settings.requestTimeoutInSeconds });\n logger2.debug(\"got key set\", keySet);\n if (!Array.isArray(keySet.keys)) {\n logger2.throw(new Error(\"Missing keys on keyset\"));\n throw null;\n }\n this._signingKeys = keySet.keys;\n return this._signingKeys;\n }\n};\n\n// src/WebStorageStateStore.ts\nvar WebStorageStateStore = class {\n constructor({\n prefix = \"oidc.\",\n store = localStorage\n } = {}) {\n this._logger = new Logger(\"WebStorageStateStore\");\n this._store = store;\n this._prefix = prefix;\n }\n async set(key, value) {\n this._logger.create(`set('${key}')`);\n key = this._prefix + key;\n await this._store.setItem(key, value);\n }\n async get(key) {\n this._logger.create(`get('${key}')`);\n key = this._prefix + key;\n const item = await this._store.getItem(key);\n return item;\n }\n async remove(key) {\n this._logger.create(`remove('${key}')`);\n key = this._prefix + key;\n const item = await this._store.getItem(key);\n await this._store.removeItem(key);\n return item;\n }\n async getAllKeys() {\n this._logger.create(\"getAllKeys\");\n const len = await this._store.length;\n const keys = [];\n for (let index = 0; index < len; index++) {\n const key = await this._store.key(index);\n if (key && key.indexOf(this._prefix) === 0) {\n keys.push(key.substr(this._prefix.length));\n }\n }\n return keys;\n }\n};\n\n// src/OidcClientSettings.ts\nvar DefaultResponseType = \"code\";\nvar DefaultScope = \"openid\";\nvar DefaultClientAuthentication = \"client_secret_post\";\nvar DefaultStaleStateAgeInSeconds = 60 * 15;\nvar OidcClientSettingsStore = class {\n constructor({\n // metadata related\n authority,\n metadataUrl,\n metadata,\n signingKeys,\n metadataSeed,\n // client related\n client_id,\n client_secret,\n response_type = DefaultResponseType,\n scope = DefaultScope,\n redirect_uri,\n post_logout_redirect_uri,\n client_authentication = DefaultClientAuthentication,\n token_endpoint_auth_signing_alg = \"HS256\",\n // optional protocol\n prompt,\n display,\n max_age,\n ui_locales,\n acr_values,\n resource,\n response_mode,\n // behavior flags\n filterProtocolClaims = true,\n loadUserInfo = false,\n requestTimeoutInSeconds,\n staleStateAgeInSeconds = DefaultStaleStateAgeInSeconds,\n mergeClaimsStrategy = { array: \"replace\" },\n disablePKCE = false,\n // other behavior\n stateStore,\n revokeTokenAdditionalContentTypes,\n fetchRequestCredentials,\n refreshTokenAllowedScope,\n // extra\n extraQueryParams = {},\n extraTokenParams = {},\n extraHeaders = {},\n dpop,\n omitScopeWhenRequesting = false\n }) {\n var _a;\n this.authority = authority;\n if (metadataUrl) {\n this.metadataUrl = metadataUrl;\n } else {\n this.metadataUrl = authority;\n if (authority) {\n if (!this.metadataUrl.endsWith(\"/\")) {\n this.metadataUrl += \"/\";\n }\n this.metadataUrl += \".well-known/openid-configuration\";\n }\n }\n this.metadata = metadata;\n this.metadataSeed = metadataSeed;\n this.signingKeys = signingKeys;\n this.client_id = client_id;\n this.client_secret = client_secret;\n this.response_type = response_type;\n this.scope = scope;\n this.redirect_uri = redirect_uri;\n this.post_logout_redirect_uri = post_logout_redirect_uri;\n this.client_authentication = client_authentication;\n this.token_endpoint_auth_signing_alg = token_endpoint_auth_signing_alg;\n this.prompt = prompt;\n this.display = display;\n this.max_age = max_age;\n this.ui_locales = ui_locales;\n this.acr_values = acr_values;\n this.resource = resource;\n this.response_mode = response_mode;\n this.filterProtocolClaims = filterProtocolClaims != null ? filterProtocolClaims : true;\n this.loadUserInfo = !!loadUserInfo;\n this.staleStateAgeInSeconds = staleStateAgeInSeconds;\n this.mergeClaimsStrategy = mergeClaimsStrategy;\n this.omitScopeWhenRequesting = omitScopeWhenRequesting;\n this.disablePKCE = !!disablePKCE;\n this.revokeTokenAdditionalContentTypes = revokeTokenAdditionalContentTypes;\n this.fetchRequestCredentials = fetchRequestCredentials ? fetchRequestCredentials : \"same-origin\";\n this.requestTimeoutInSeconds = requestTimeoutInSeconds;\n if (stateStore) {\n this.stateStore = stateStore;\n } else {\n const store = typeof window !== \"undefined\" ? window.localStorage : new InMemoryWebStorage();\n this.stateStore = new WebStorageStateStore({ store });\n }\n this.refreshTokenAllowedScope = refreshTokenAllowedScope;\n this.extraQueryParams = extraQueryParams;\n this.extraTokenParams = extraTokenParams;\n this.extraHeaders = extraHeaders;\n this.dpop = dpop;\n if (this.dpop && !((_a = this.dpop) == null ? void 0 : _a.store)) {\n throw new Error(\"A DPoPStore is required when dpop is enabled\");\n }\n }\n};\n\n// src/UserInfoService.ts\nvar UserInfoService = class {\n constructor(_settings, _metadataService) {\n this._settings = _settings;\n this._metadataService = _metadataService;\n this._logger = new Logger(\"UserInfoService\");\n this._getClaimsFromJwt = async (responseText) => {\n const logger2 = this._logger.create(\"_getClaimsFromJwt\");\n try {\n const payload = JwtUtils.decode(responseText);\n logger2.debug(\"JWT decoding successful\");\n return payload;\n } catch (err) {\n logger2.error(\"Error parsing JWT response\");\n throw err;\n }\n };\n this._jsonService = new JsonService(\n void 0,\n this._getClaimsFromJwt,\n this._settings.extraHeaders\n );\n }\n async getClaims(token) {\n const logger2 = this._logger.create(\"getClaims\");\n if (!token) {\n this._logger.throw(new Error(\"No token passed\"));\n }\n const url = await this._metadataService.getUserInfoEndpoint();\n logger2.debug(\"got userinfo url\", url);\n const claims = await this._jsonService.getJson(url, {\n token,\n credentials: this._settings.fetchRequestCredentials,\n timeoutInSeconds: this._settings.requestTimeoutInSeconds\n });\n logger2.debug(\"got claims\", claims);\n return claims;\n }\n};\n\n// src/TokenClient.ts\nvar TokenClient = class {\n constructor(_settings, _metadataService) {\n this._settings = _settings;\n this._metadataService = _metadataService;\n this._logger = new Logger(\"TokenClient\");\n this._jsonService = new JsonService(\n this._settings.revokeTokenAdditionalContentTypes,\n null,\n this._settings.extraHeaders\n );\n }\n /**\n * Exchange code.\n *\n * @see https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3\n */\n async exchangeCode({\n grant_type = \"authorization_code\",\n redirect_uri = this._settings.redirect_uri,\n client_id = this._settings.client_id,\n client_secret = this._settings.client_secret,\n extraHeaders,\n ...args\n }) {\n const logger2 = this._logger.create(\"exchangeCode\");\n if (!client_id) {\n logger2.throw(new Error(\"A client_id is required\"));\n }\n if (!redirect_uri) {\n logger2.throw(new Error(\"A redirect_uri is required\"));\n }\n if (!args.code) {\n logger2.throw(new Error(\"A code is required\"));\n }\n const params = new URLSearchParams({ grant_type, redirect_uri });\n for (const [key, value] of Object.entries(args)) {\n if (value != null) {\n params.set(key, value);\n }\n }\n if ((this._settings.client_authentication === \"client_secret_basic\" || this._settings.client_authentication === \"client_secret_jwt\") && (client_secret === void 0 || client_secret === null)) {\n logger2.throw(new Error(\"A client_secret is required\"));\n throw null;\n }\n let basicAuth;\n const url = await this._metadataService.getTokenEndpoint(false);\n switch (this._settings.client_authentication) {\n case \"client_secret_basic\":\n basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret);\n break;\n case \"client_secret_post\":\n params.append(\"client_id\", client_id);\n if (client_secret) {\n params.append(\"client_secret\", client_secret);\n }\n break;\n case \"client_secret_jwt\": {\n const clientAssertion = await CryptoUtils.generateClientAssertionJwt(client_id, client_secret, url, this._settings.token_endpoint_auth_signing_alg);\n params.append(\"client_id\", client_id);\n params.append(\"client_assertion_type\", \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\");\n params.append(\"client_assertion\", clientAssertion);\n break;\n }\n }\n logger2.debug(\"got token endpoint\");\n const response = await this._jsonService.postForm(url, {\n body: params,\n basicAuth,\n timeoutInSeconds: this._settings.requestTimeoutInSeconds,\n initCredentials: this._settings.fetchRequestCredentials,\n extraHeaders\n });\n logger2.debug(\"got response\");\n return response;\n }\n /**\n * Exchange credentials.\n *\n * @see https://www.rfc-editor.org/rfc/rfc6749#section-4.3.2\n */\n async exchangeCredentials({\n grant_type = \"password\",\n client_id = this._settings.client_id,\n client_secret = this._settings.client_secret,\n scope = this._settings.scope,\n ...args\n }) {\n const logger2 = this._logger.create(\"exchangeCredentials\");\n if (!client_id) {\n logger2.throw(new Error(\"A client_id is required\"));\n }\n const params = new URLSearchParams({ grant_type });\n if (!this._settings.omitScopeWhenRequesting) {\n params.set(\"scope\", scope);\n }\n for (const [key, value] of Object.entries(args)) {\n if (value != null) {\n params.set(key, value);\n }\n }\n if ((this._settings.client_authentication === \"client_secret_basic\" || this._settings.client_authentication === \"client_secret_jwt\") && (client_secret === void 0 || client_secret === null)) {\n logger2.throw(new Error(\"A client_secret is required\"));\n throw null;\n }\n let basicAuth;\n const url = await this._metadataService.getTokenEndpoint(false);\n switch (this._settings.client_authentication) {\n case \"client_secret_basic\":\n basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret);\n break;\n case \"client_secret_post\":\n params.append(\"client_id\", client_id);\n if (client_secret) {\n params.append(\"client_secret\", client_secret);\n }\n break;\n case \"client_secret_jwt\": {\n const clientAssertion = await CryptoUtils.generateClientAssertionJwt(client_id, client_secret, url, this._settings.token_endpoint_auth_signing_alg);\n params.append(\"client_id\", client_id);\n params.append(\"client_assertion_type\", \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\");\n params.append(\"client_assertion\", clientAssertion);\n break;\n }\n }\n logger2.debug(\"got token endpoint\");\n const response = await this._jsonService.postForm(url, { body: params, basicAuth, timeoutInSeconds: this._settings.requestTimeoutInSeconds, initCredentials: this._settings.fetchRequestCredentials });\n logger2.debug(\"got response\");\n return response;\n }\n /**\n * Exchange a refresh token.\n *\n * @see https://www.rfc-editor.org/rfc/rfc6749#section-6\n */\n async exchangeRefreshToken({\n grant_type = \"refresh_token\",\n client_id = this._settings.client_id,\n client_secret = this._settings.client_secret,\n timeoutInSeconds,\n extraHeaders,\n ...args\n }) {\n const logger2 = this._logger.create(\"exchangeRefreshToken\");\n if (!client_id) {\n logger2.throw(new Error(\"A client_id is required\"));\n }\n if (!args.refresh_token) {\n logger2.throw(new Error(\"A refresh_token is required\"));\n }\n const params = new URLSearchParams({ grant_type });\n for (const [key, value] of Object.entries(args)) {\n if (Array.isArray(value)) {\n value.forEach((param) => params.append(key, param));\n } else if (value != null) {\n params.set(key, value);\n }\n }\n if ((this._settings.client_authentication === \"client_secret_basic\" || this._settings.client_authentication === \"client_secret_jwt\") && (client_secret === void 0 || client_secret === null)) {\n logger2.throw(new Error(\"A client_secret is required\"));\n throw null;\n }\n let basicAuth;\n const url = await this._metadataService.getTokenEndpoint(false);\n switch (this._settings.client_authentication) {\n case \"client_secret_basic\":\n basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret);\n break;\n case \"client_secret_post\":\n params.append(\"client_id\", client_id);\n if (client_secret) {\n params.append(\"client_secret\", client_secret);\n }\n break;\n case \"client_secret_jwt\": {\n const clientAssertion = await CryptoUtils.generateClientAssertionJwt(client_id, client_secret, url, this._settings.token_endpoint_auth_signing_alg);\n params.append(\"client_id\", client_id);\n params.append(\"client_assertion_type\", \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\");\n params.append(\"client_assertion\", clientAssertion);\n break;\n }\n }\n logger2.debug(\"got token endpoint\");\n const response = await this._jsonService.postForm(url, { body: params, basicAuth, timeoutInSeconds, initCredentials: this._settings.fetchRequestCredentials, extraHeaders });\n logger2.debug(\"got response\");\n return response;\n }\n /**\n * Revoke an access or refresh token.\n *\n * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1\n */\n async revoke(args) {\n var _a;\n const logger2 = this._logger.create(\"revoke\");\n if (!args.token) {\n logger2.throw(new Error(\"A token is required\"));\n }\n const url = await this._metadataService.getRevocationEndpoint(false);\n logger2.debug(`got revocation endpoint, revoking ${(_a = args.token_type_hint) != null ? _a : \"default token type\"}`);\n const params = new URLSearchParams();\n for (const [key, value] of Object.entries(args)) {\n if (value != null) {\n params.set(key, value);\n }\n }\n params.set(\"client_id\", this._settings.client_id);\n if (this._settings.client_secret) {\n params.set(\"client_secret\", this._settings.client_secret);\n }\n await this._jsonService.postForm(url, { body: params, timeoutInSeconds: this._settings.requestTimeoutInSeconds });\n logger2.debug(\"got response\");\n }\n};\n\n// src/ResponseValidator.ts\nvar ResponseValidator = class {\n constructor(_settings, _metadataService, _claimsService) {\n this._settings = _settings;\n this._metadataService = _metadataService;\n this._claimsService = _claimsService;\n this._logger = new Logger(\"ResponseValidator\");\n this._userInfoService = new UserInfoService(this._settings, this._metadataService);\n this._tokenClient = new TokenClient(this._settings, this._metadataService);\n }\n async validateSigninResponse(response, state, extraHeaders) {\n const logger2 = this._logger.create(\"validateSigninResponse\");\n this._processSigninState(response, state);\n logger2.debug(\"state processed\");\n await this._processCode(response, state, extraHeaders);\n logger2.debug(\"code processed\");\n if (response.isOpenId) {\n this._validateIdTokenAttributes(response, \"\", state.nonce);\n }\n logger2.debug(\"tokens validated\");\n await this._processClaims(response, state == null ? void 0 : state.skipUserInfo, response.isOpenId);\n logger2.debug(\"claims processed\");\n }\n async validateCredentialsResponse(response, skipUserInfo) {\n const logger2 = this._logger.create(\"validateCredentialsResponse\");\n const shouldValidateSubClaim = response.isOpenId && !!response.id_token;\n if (shouldValidateSubClaim) {\n this._validateIdTokenAttributes(response);\n }\n logger2.debug(\"tokens validated\");\n await this._processClaims(response, skipUserInfo, shouldValidateSubClaim);\n logger2.debug(\"claims processed\");\n }\n async validateRefreshResponse(response, state) {\n var _a, _b;\n const logger2 = this._logger.create(\"validateRefreshResponse\");\n response.userState = state.data;\n (_a = response.session_state) != null ? _a : response.session_state = state.session_state;\n (_b = response.scope) != null ? _b : response.scope = state.scope;\n if (response.isOpenId && !!response.id_token) {\n this._validateIdTokenAttributes(response, state.id_token);\n logger2.debug(\"ID Token validated\");\n }\n if (!response.id_token) {\n response.id_token = state.id_token;\n response.profile = state.profile;\n }\n const hasIdToken = response.isOpenId && !!response.id_token;\n await this._processClaims(response, false, hasIdToken);\n logger2.debug(\"claims processed\");\n }\n validateSignoutResponse(response, state) {\n const logger2 = this._logger.create(\"validateSignoutResponse\");\n if (state.id !== response.state) {\n logger2.throw(new Error(\"State does not match\"));\n }\n logger2.debug(\"state validated\");\n response.userState = state.data;\n if (response.error) {\n logger2.warn(\"Response was error\", response.error);\n throw new ErrorResponse(response);\n }\n }\n _processSigninState(response, state) {\n var _a;\n const logger2 = this._logger.create(\"_processSigninState\");\n if (state.id !== response.state) {\n logger2.throw(new Error(\"State does not match\"));\n }\n if (!state.client_id) {\n logger2.throw(new Error(\"No client_id on state\"));\n }\n if (!state.authority) {\n logger2.throw(new Error(\"No authority on state\"));\n }\n if (this._settings.authority !== state.authority) {\n logger2.throw(new Error(\"authority mismatch on settings vs. signin state\"));\n }\n if (this._settings.client_id && this._settings.client_id !== state.client_id) {\n logger2.throw(new Error(\"client_id mismatch on settings vs. signin state\"));\n }\n logger2.debug(\"state validated\");\n response.userState = state.data;\n response.url_state = state.url_state;\n (_a = response.scope) != null ? _a : response.scope = state.scope;\n if (response.error) {\n logger2.warn(\"Response was error\", response.error);\n throw new ErrorResponse(response);\n }\n if (state.code_verifier && !response.code) {\n logger2.throw(new Error(\"Expected code in response\"));\n }\n }\n async _processClaims(response, skipUserInfo = false, validateSub = true) {\n const logger2 = this._logger.create(\"_processClaims\");\n response.profile = this._claimsService.filterProtocolClaims(response.profile);\n if (skipUserInfo || !this._settings.loadUserInfo || !response.access_token) {\n logger2.debug(\"not loading user info\");\n return;\n }\n logger2.debug(\"loading user info\");\n const claims = await this._userInfoService.getClaims(response.access_token);\n logger2.debug(\"user info claims received from user info endpoint\");\n if (validateSub && claims.sub !== response.profile.sub) {\n logger2.throw(new Error(\"subject from UserInfo response does not match subject in ID Token\"));\n }\n response.profile = this._claimsService.mergeClaims(response.profile, this._claimsService.filterProtocolClaims(claims));\n logger2.debug(\"user info claims received, updated profile:\", response.profile);\n }\n async _processCode(response, state, extraHeaders) {\n const logger2 = this._logger.create(\"_processCode\");\n if (response.code) {\n logger2.debug(\"Validating code\");\n const tokenResponse = await this._tokenClient.exchangeCode({\n client_id: state.client_id,\n client_secret: state.client_secret,\n code: response.code,\n redirect_uri: state.redirect_uri,\n code_verifier: state.code_verifier,\n extraHeaders,\n ...state.extraTokenParams\n });\n Object.assign(response, tokenResponse);\n } else {\n logger2.debug(\"No code to process\");\n }\n }\n _validateIdTokenAttributes(response, existingToken, nonce) {\n var _a;\n const logger2 = this._logger.create(\"_validateIdTokenAttributes\");\n logger2.debug(\"decoding ID Token JWT\");\n const incoming = JwtUtils.decode((_a = response.id_token) != null ? _a : \"\");\n if (!incoming.sub) {\n logger2.throw(new Error(\"ID Token is missing a subject claim\"));\n }\n if (nonce && incoming.nonce !== nonce) {\n logger2.throw(new Error(\"nonce in id_token does not match nonce in client storage\"));\n }\n if (existingToken) {\n const existing = JwtUtils.decode(existingToken);\n if (incoming.sub !== existing.sub) {\n logger2.throw(new Error(\"sub in id_token does not match current sub\"));\n }\n if (incoming.auth_time && incoming.auth_time !== existing.auth_time) {\n logger2.throw(new Error(\"auth_time in id_token does not match original auth_time\"));\n }\n if (incoming.azp && incoming.azp !== existing.azp) {\n logger2.throw(new Error(\"azp in id_token does not match original azp\"));\n }\n if (!incoming.azp && existing.azp) {\n logger2.throw(new Error(\"azp not in id_token, but present in original id_token\"));\n }\n }\n response.profile = incoming;\n }\n};\n\n// src/State.ts\nvar State = class _State {\n constructor(args) {\n this.id = args.id || CryptoUtils.generateUUIDv4();\n this.data = args.data;\n if (args.created && args.created > 0) {\n this.created = args.created;\n } else {\n this.created = Timer.getEpochTime();\n }\n this.request_type = args.request_type;\n this.url_state = args.url_state;\n }\n toStorageString() {\n new Logger(\"State\").create(\"toStorageString\");\n return JSON.stringify({\n id: this.id,\n data: this.data,\n created: this.created,\n request_type: this.request_type,\n url_state: this.url_state\n });\n }\n static fromStorageString(storageString) {\n Logger.createStatic(\"State\", \"fromStorageString\");\n return Promise.resolve(new _State(JSON.parse(storageString)));\n }\n static async clearStaleState(storage, age) {\n const logger2 = Logger.createStatic(\"State\", \"clearStaleState\");\n const cutoff = Timer.getEpochTime() - age;\n const keys = await storage.getAllKeys();\n logger2.debug(\"got keys\", keys);\n for (let i = 0; i < keys.length; i++) {\n const key = keys[i];\n const item = await storage.get(key);\n let remove = false;\n if (item) {\n try {\n const state = await _State.fromStorageString(item);\n logger2.debug(\"got item from key:\", key, state.created);\n if (state.created <= cutoff) {\n remove = true;\n }\n } catch (err) {\n logger2.error(\"Error parsing state for key:\", key, err);\n remove = true;\n }\n } else {\n logger2.debug(\"no item in storage for key:\", key);\n remove = true;\n }\n if (remove) {\n logger2.debug(\"removed item for key:\", key);\n void storage.remove(key);\n }\n }\n }\n};\n\n// src/SigninState.ts\nvar SigninState = class _SigninState extends State {\n constructor(args) {\n super(args);\n this.code_verifier = args.code_verifier;\n this.code_challenge = args.code_challenge;\n this.authority = args.authority;\n this.client_id = args.client_id;\n this.redirect_uri = args.redirect_uri;\n this.scope = args.scope;\n this.client_secret = args.client_secret;\n this.extraTokenParams = args.extraTokenParams;\n this.response_mode = args.response_mode;\n this.skipUserInfo = args.skipUserInfo;\n this.nonce = args.nonce;\n }\n static async create(args) {\n const code_verifier = args.code_verifier === true ? CryptoUtils.generateCodeVerifier() : args.code_verifier || void 0;\n const code_challenge = code_verifier ? await CryptoUtils.generateCodeChallenge(code_verifier) : void 0;\n return new _SigninState({\n ...args,\n code_verifier,\n code_challenge\n });\n }\n toStorageString() {\n new Logger(\"SigninState\").create(\"toStorageString\");\n return JSON.stringify({\n id: this.id,\n data: this.data,\n created: this.created,\n request_type: this.request_type,\n url_state: this.url_state,\n code_verifier: this.code_verifier,\n authority: this.authority,\n client_id: this.client_id,\n redirect_uri: this.redirect_uri,\n scope: this.scope,\n client_secret: this.client_secret,\n extraTokenParams: this.extraTokenParams,\n response_mode: this.response_mode,\n skipUserInfo: this.skipUserInfo,\n nonce: this.nonce\n });\n }\n static fromStorageString(storageString) {\n Logger.createStatic(\"SigninState\", \"fromStorageString\");\n const data = JSON.parse(storageString);\n return _SigninState.create(data);\n }\n};\n\n// src/SigninRequest.ts\nvar _SigninRequest = class _SigninRequest {\n constructor(args) {\n this.url = args.url;\n this.state = args.state;\n }\n static async create({\n // mandatory\n url,\n authority,\n client_id,\n redirect_uri,\n response_type,\n scope,\n // optional\n state_data,\n response_mode,\n request_type,\n client_secret,\n nonce,\n url_state,\n resource,\n skipUserInfo,\n extraQueryParams,\n extraTokenParams,\n disablePKCE,\n dpopJkt,\n omitScopeWhenRequesting,\n ...optionalParams\n }) {\n if (!url) {\n this._logger.error(\"create: No url passed\");\n throw new Error(\"url\");\n }\n if (!client_id) {\n this._logger.error(\"create: No client_id passed\");\n throw new Error(\"client_id\");\n }\n if (!redirect_uri) {\n this._logger.error(\"create: No redirect_uri passed\");\n throw new Error(\"redirect_uri\");\n }\n if (!response_type) {\n this._logger.error(\"create: No response_type passed\");\n throw new Error(\"response_type\");\n }\n if (!scope) {\n this._logger.error(\"create: No scope passed\");\n throw new Error(\"scope\");\n }\n if (!authority) {\n this._logger.error(\"create: No authority passed\");\n throw new Error(\"authority\");\n }\n const state = await SigninState.create({\n data: state_data,\n request_type,\n url_state,\n code_verifier: !disablePKCE,\n client_id,\n authority,\n redirect_uri,\n response_mode,\n client_secret,\n scope,\n extraTokenParams,\n skipUserInfo,\n nonce\n });\n const parsedUrl = new URL(url);\n parsedUrl.searchParams.append(\"client_id\", client_id);\n parsedUrl.searchParams.append(\"redirect_uri\", redirect_uri);\n parsedUrl.searchParams.append(\"response_type\", response_type);\n if (!omitScopeWhenRequesting) {\n parsedUrl.searchParams.append(\"scope\", scope);\n }\n if (nonce) {\n parsedUrl.searchParams.append(\"nonce\", nonce);\n }\n if (dpopJkt) {\n parsedUrl.searchParams.append(\"dpop_jkt\", dpopJkt);\n }\n let stateParam = state.id;\n if (url_state) {\n stateParam = `${stateParam}${URL_STATE_DELIMITER}${url_state}`;\n }\n parsedUrl.searchParams.append(\"state\", stateParam);\n if (state.code_challenge) {\n parsedUrl.searchParams.append(\"code_challenge\", state.code_challenge);\n parsedUrl.searchParams.append(\"code_challenge_method\", \"S256\");\n }\n if (resource) {\n const resources = Array.isArray(resource) ? resource : [resource];\n resources.forEach((r) => parsedUrl.searchParams.append(\"resource\", r));\n }\n for (const [key, value] of Object.entries({ response_mode, ...optionalParams, ...extraQueryParams })) {\n if (value != null) {\n parsedUrl.searchParams.append(key, value.toString());\n }\n }\n return new _SigninRequest({\n url: parsedUrl.href,\n state\n });\n }\n};\n_SigninRequest._logger = new Logger(\"SigninRequest\");\nvar SigninRequest = _SigninRequest;\n\n// src/SigninResponse.ts\nvar OidcScope = \"openid\";\nvar SigninResponse = class {\n constructor(params) {\n /** @see {@link User.access_token} */\n this.access_token = \"\";\n /** @see {@link User.token_type} */\n this.token_type = \"\";\n /** @see {@link User.profile} */\n this.profile = {};\n this.state = params.get(\"state\");\n this.session_state = params.get(\"session_state\");\n if (this.state) {\n const splitState = decodeURIComponent(this.state).split(URL_STATE_DELIMITER);\n this.state = splitState[0];\n if (splitState.length > 1) {\n this.url_state = splitState.slice(1).join(URL_STATE_DELIMITER);\n }\n }\n this.error = params.get(\"error\");\n this.error_description = params.get(\"error_description\");\n this.error_uri = params.get(\"error_uri\");\n this.code = params.get(\"code\");\n }\n get expires_in() {\n if (this.expires_at === void 0) {\n return void 0;\n }\n return this.expires_at - Timer.getEpochTime();\n }\n set expires_in(value) {\n if (typeof value === \"string\") value = Number(value);\n if (value !== void 0 && value >= 0) {\n this.expires_at = Math.floor(value) + Timer.getEpochTime();\n }\n }\n get isOpenId() {\n var _a;\n return ((_a = this.scope) == null ? void 0 : _a.split(\" \").includes(OidcScope)) || !!this.id_token;\n }\n};\n\n// src/SignoutRequest.ts\nvar SignoutRequest = class {\n constructor({\n url,\n state_data,\n id_token_hint,\n post_logout_redirect_uri,\n extraQueryParams,\n request_type,\n client_id,\n url_state\n }) {\n this._logger = new Logger(\"SignoutRequest\");\n if (!url) {\n this._logger.error(\"ctor: No url passed\");\n throw new Error(\"url\");\n }\n const parsedUrl = new URL(url);\n if (id_token_hint) {\n parsedUrl.searchParams.append(\"id_token_hint\", id_token_hint);\n }\n if (client_id) {\n parsedUrl.searchParams.append(\"client_id\", client_id);\n }\n if (post_logout_redirect_uri) {\n parsedUrl.searchParams.append(\"post_logout_redirect_uri\", post_logout_redirect_uri);\n if (state_data || url_state) {\n this.state = new State({ data: state_data, request_type, url_state });\n let stateParam = this.state.id;\n if (url_state) {\n stateParam = `${stateParam}${URL_STATE_DELIMITER}${url_state}`;\n }\n parsedUrl.searchParams.append(\"state\", stateParam);\n }\n }\n for (const [key, value] of Object.entries({ ...extraQueryParams })) {\n if (value != null) {\n parsedUrl.searchParams.append(key, value.toString());\n }\n }\n this.url = parsedUrl.href;\n }\n};\n\n// src/SignoutResponse.ts\nvar SignoutResponse = class {\n constructor(params) {\n this.state = params.get(\"state\");\n if (this.state) {\n const splitState = decodeURIComponent(this.state).split(URL_STATE_DELIMITER);\n this.state = splitState[0];\n if (splitState.length > 1) {\n this.url_state = splitState.slice(1).join(URL_STATE_DELIMITER);\n }\n }\n this.error = params.get(\"error\");\n this.error_description = params.get(\"error_description\");\n this.error_uri = params.get(\"error_uri\");\n }\n};\n\n// src/ClaimsService.ts\nvar DefaultProtocolClaims = [\n \"nbf\",\n \"jti\",\n \"auth_time\",\n \"nonce\",\n \"acr\",\n \"amr\",\n \"azp\",\n \"at_hash\"\n // https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken\n];\nvar InternalRequiredProtocolClaims = [\"sub\", \"iss\", \"aud\", \"exp\", \"iat\"];\nvar ClaimsService = class {\n constructor(_settings) {\n this._settings = _settings;\n this._logger = new Logger(\"ClaimsService\");\n }\n filterProtocolClaims(claims) {\n const result = { ...claims };\n if (this._settings.filterProtocolClaims) {\n let protocolClaims;\n if (Array.isArray(this._settings.filterProtocolClaims)) {\n protocolClaims = this._settings.filterProtocolClaims;\n } else {\n protocolClaims = DefaultProtocolClaims;\n }\n for (const claim of protocolClaims) {\n if (!InternalRequiredProtocolClaims.includes(claim)) {\n delete result[claim];\n }\n }\n }\n return result;\n }\n mergeClaims(claims1, claims2) {\n const result = { ...claims1 };\n for (const [claim, values] of Object.entries(claims2)) {\n if (result[claim] !== values) {\n if (Array.isArray(result[claim]) || Array.isArray(values)) {\n if (this._settings.mergeClaimsStrategy.array == \"replace\") {\n result[claim] = values;\n } else {\n const mergedValues = Array.isArray(result[claim]) ? result[claim] : [result[claim]];\n for (const value of Array.isArray(values) ? values : [values]) {\n if (!mergedValues.includes(value)) {\n mergedValues.push(value);\n }\n }\n result[claim] = mergedValues;\n }\n } else if (typeof result[claim] === \"object\" && typeof values === \"object\") {\n result[claim] = this.mergeClaims(result[claim], values);\n } else {\n result[claim] = values;\n }\n }\n }\n return result;\n }\n};\n\n// src/DPoPStore.ts\nvar DPoPState = class {\n constructor(keys, nonce) {\n this.keys = keys;\n this.nonce = nonce;\n }\n};\n\n// src/OidcClient.ts\nvar OidcClient = class {\n constructor(settings, metadataService) {\n this._logger = new Logger(\"OidcClient\");\n this.settings = settings instanceof OidcClientSettingsStore ? settings : new OidcClientSettingsStore(settings);\n this.metadataService = metadataService != null ? metadataService : new MetadataService(this.settings);\n this._claimsService = new ClaimsService(this.settings);\n this._validator = new ResponseValidator(this.settings, this.metadataService, this._claimsService);\n this._tokenClient = new TokenClient(this.settings, this.metadataService);\n }\n async createSigninRequest({\n state,\n request,\n request_uri,\n request_type,\n id_token_hint,\n login_hint,\n skipUserInfo,\n nonce,\n url_state,\n response_type = this.settings.response_type,\n scope = this.settings.scope,\n redirect_uri = this.settings.redirect_uri,\n prompt = this.settings.prompt,\n display = this.settings.display,\n max_age = this.settings.max_age,\n ui_locales = this.settings.ui_locales,\n acr_values = this.settings.acr_values,\n resource = this.settings.resource,\n response_mode = this.settings.response_mode,\n extraQueryParams = this.settings.extraQueryParams,\n extraTokenParams = this.settings.extraTokenParams,\n dpopJkt,\n omitScopeWhenRequesting = this.settings.omitScopeWhenRequesting\n }) {\n const logger2 = this._logger.create(\"createSigninRequest\");\n if (response_type !== \"code\") {\n throw new Error(\"Only the Authorization Code flow (with PKCE) is supported\");\n }\n const url = await this.metadataService.getAuthorizationEndpoint();\n logger2.debug(\"Received authorization endpoint\", url);\n const signinRequest = await SigninRequest.create({\n url,\n authority: this.settings.authority,\n client_id: this.settings.client_id,\n redirect_uri,\n response_type,\n scope,\n state_data: state,\n url_state,\n prompt,\n display,\n max_age,\n ui_locales,\n id_token_hint,\n login_hint,\n acr_values,\n dpopJkt,\n resource,\n request,\n request_uri,\n extraQueryParams,\n extraTokenParams,\n request_type,\n response_mode,\n client_secret: this.settings.client_secret,\n skipUserInfo,\n nonce,\n disablePKCE: this.settings.disablePKCE,\n omitScopeWhenRequesting\n });\n await this.clearStaleState();\n const signinState = signinRequest.state;\n await this.settings.stateStore.set(signinState.id, signinState.toStorageString());\n return signinRequest;\n }\n async readSigninResponseState(url, removeState = false) {\n const logger2 = this._logger.create(\"readSigninResponseState\");\n const response = new SigninResponse(UrlUtils.readParams(url, this.settings.response_mode));\n if (!response.state) {\n logger2.throw(new Error(\"No state in response\"));\n throw null;\n }\n const storedStateString = await this.settings.stateStore[removeState ? \"remove\" : \"get\"](response.state);\n if (!storedStateString) {\n logger2.throw(new Error(\"No matching state found in storage\"));\n throw null;\n }\n const state = await SigninState.fromStorageString(storedStateString);\n return { state, response };\n }\n async processSigninResponse(url, extraHeaders, removeState = true) {\n const logger2 = this._logger.create(\"processSigninResponse\");\n const { state, response } = await this.readSigninResponseState(url, removeState);\n logger2.debug(\"received state from storage; validating response\");\n if (this.settings.dpop && this.settings.dpop.store) {\n const dpopProof = await this.getDpopProof(this.settings.dpop.store);\n extraHeaders = { ...extraHeaders, \"DPoP\": dpopProof };\n }\n try {\n await this._validator.validateSigninResponse(response, state, extraHeaders);\n } catch (err) {\n if (err instanceof ErrorDPoPNonce && this.settings.dpop) {\n const dpopProof = await this.getDpopProof(this.settings.dpop.store, err.nonce);\n extraHeaders[\"DPoP\"] = dpopProof;\n await this._validator.validateSigninResponse(response, state, extraHeaders);\n } else {\n throw err;\n }\n }\n return response;\n }\n async getDpopProof(dpopStore, nonce) {\n let keyPair;\n let dpopState;\n if (!(await dpopStore.getAllKeys()).includes(this.settings.client_id)) {\n keyPair = await CryptoUtils.generateDPoPKeys();\n dpopState = new DPoPState(keyPair, nonce);\n await dpopStore.set(this.settings.client_id, dpopState);\n } else {\n dpopState = await dpopStore.get(this.settings.client_id);\n if (dpopState.nonce !== nonce && nonce) {\n dpopState.nonce = nonce;\n await dpopStore.set(this.settings.client_id, dpopState);\n }\n }\n return await CryptoUtils.generateDPoPProof({\n url: await this.metadataService.getTokenEndpoint(false),\n httpMethod: \"POST\",\n keyPair: dpopState.keys,\n nonce: dpopState.nonce\n });\n }\n async processResourceOwnerPasswordCredentials({\n username,\n password,\n skipUserInfo = false,\n extraTokenParams = {}\n }) {\n const tokenResponse = await this._tokenClient.exchangeCredentials({ username, password, ...extraTokenParams });\n const signinResponse = new SigninResponse(new URLSearchParams());\n Object.assign(signinResponse, tokenResponse);\n await this._validator.validateCredentialsResponse(signinResponse, skipUserInfo);\n return signinResponse;\n }\n async useRefreshToken({\n state,\n redirect_uri,\n resource,\n timeoutInSeconds,\n extraHeaders,\n extraTokenParams\n }) {\n var _a;\n const logger2 = this._logger.create(\"useRefreshToken\");\n let scope;\n if (this.settings.refreshTokenAllowedScope === void 0) {\n scope = state.scope;\n } else {\n const allowableScopes = this.settings.refreshTokenAllowedScope.split(\" \");\n const providedScopes = ((_a = state.scope) == null ? void 0 : _a.split(\" \")) || [];\n scope = providedScopes.filter((s) => allowableScopes.includes(s)).join(\" \");\n }\n if (this.settings.dpop && this.settings.dpop.store) {\n const dpopProof = await this.getDpopProof(this.settings.dpop.store);\n extraHeaders = { ...extraHeaders, \"DPoP\": dpopProof };\n }\n let result;\n try {\n result = await this._tokenClient.exchangeRefreshToken({\n refresh_token: state.refresh_token,\n // provide the (possible filtered) scope list\n scope,\n redirect_uri,\n resource,\n timeoutInSeconds,\n extraHeaders,\n ...extraTokenParams\n });\n } catch (err) {\n if (err instanceof ErrorDPoPNonce && this.settings.dpop) {\n extraHeaders[\"DPoP\"] = await this.getDpopProof(this.settings.dpop.store, err.nonce);\n result = await this._tokenClient.exchangeRefreshToken({\n refresh_token: state.refresh_token,\n // provide the (possible filtered) scope list\n scope,\n redirect_uri,\n resource,\n timeoutInSeconds,\n extraHeaders,\n ...extraTokenParams\n });\n } else {\n throw err;\n }\n }\n const response = new SigninResponse(new URLSearchParams());\n Object.assign(response, result);\n logger2.debug(\"validating response\", response);\n await this._validator.validateRefreshResponse(response, {\n ...state,\n // override the scope in the state handed over to the validator\n // so it can set the granted scope to the requested scope in case none is included in the response\n scope\n });\n return response;\n }\n async createSignoutRequest({\n state,\n id_token_hint,\n client_id,\n request_type,\n url_state,\n post_logout_redirect_uri = this.settings.post_logout_redirect_uri,\n extraQueryParams = this.settings.extraQueryParams\n } = {}) {\n const logger2 = this._logger.create(\"createSignoutRequest\");\n const url = await this.metadataService.getEndSessionEndpoint();\n if (!url) {\n logger2.throw(new Error(\"No end session endpoint\"));\n throw null;\n }\n logger2.debug(\"Received end session endpoint\", url);\n if (!client_id && post_logout_redirect_uri && !id_token_hint) {\n client_id = this.settings.client_id;\n }\n const request = new SignoutRequest({\n url,\n id_token_hint,\n client_id,\n post_logout_redirect_uri,\n state_data: state,\n extraQueryParams,\n request_type,\n url_state\n });\n await this.clearStaleState();\n const signoutState = request.state;\n if (signoutState) {\n logger2.debug(\"Signout request has state to persist\");\n await this.settings.stateStore.set(signoutState.id, signoutState.toStorageString());\n }\n return request;\n }\n async readSignoutResponseState(url, removeState = false) {\n const logger2 = this._logger.create(\"readSignoutResponseState\");\n const response = new SignoutResponse(UrlUtils.readParams(url, this.settings.response_mode));\n if (!response.state) {\n logger2.debug(\"No state in response\");\n if (response.error) {\n logger2.warn(\"Response was error:\", response.error);\n throw new ErrorResponse(response);\n }\n return { state: void 0, response };\n }\n const storedStateString = await this.settings.stateStore[removeState ? \"remove\" : \"get\"](response.state);\n if (!storedStateString) {\n logger2.throw(new Error(\"No matching state found in storage\"));\n throw null;\n }\n const state = await State.fromStorageString(storedStateString);\n return { state, response };\n }\n async processSignoutResponse(url) {\n const logger2 = this._logger.create(\"processSignoutResponse\");\n const { state, response } = await this.readSignoutResponseState(url, true);\n if (state) {\n logger2.debug(\"Received state from storage; validating response\");\n this._validator.validateSignoutResponse(response, state);\n } else {\n logger2.debug(\"No state from storage; skipping response validation\");\n }\n return response;\n }\n clearStaleState() {\n this._logger.create(\"clearStaleState\");\n return State.clearStaleState(this.settings.stateStore, this.settings.staleStateAgeInSeconds);\n }\n async revokeToken(token, type) {\n this._logger.create(\"revokeToken\");\n return await this._tokenClient.revoke({\n token,\n token_type_hint: type\n });\n }\n};\n\n// src/SessionMonitor.ts\nvar SessionMonitor = class {\n constructor(_userManager) {\n this._userManager = _userManager;\n this._logger = new Logger(\"SessionMonitor\");\n this._start = async (user) => {\n const session_state = user.session_state;\n if (!session_state) {\n return;\n }\n const logger2 = this._logger.create(\"_start\");\n if (user.profile) {\n this._sub = user.profile.sub;\n logger2.debug(\"session_state\", session_state, \", sub\", this._sub);\n } else {\n this._sub = void 0;\n logger2.debug(\"session_state\", session_state, \", anonymous user\");\n }\n if (this._checkSessionIFrame) {\n this._checkSessionIFrame.start(session_state);\n return;\n }\n try {\n const url = await this._userManager.metadataService.getCheckSessionIframe();\n if (url) {\n logger2.debug(\"initializing check session iframe\");\n const client_id = this._userManager.settings.client_id;\n const intervalInSeconds = this._userManager.settings.checkSessionIntervalInSeconds;\n const stopOnError = this._userManager.settings.stopCheckSessionOnError;\n const checkSessionIFrame = new CheckSessionIFrame(this._callback, client_id, url, intervalInSeconds, stopOnError);\n await checkSessionIFrame.load();\n this._checkSessionIFrame = checkSessionIFrame;\n checkSessionIFrame.start(session_state);\n } else {\n logger2.warn(\"no check session iframe found in the metadata\");\n }\n } catch (err) {\n logger2.error(\"Error from getCheckSessionIframe:\", err instanceof Error ? err.message : err);\n }\n };\n this._stop = () => {\n const logger2 = this._logger.create(\"_stop\");\n this._sub = void 0;\n if (this._checkSessionIFrame) {\n this._checkSessionIFrame.stop();\n }\n if (this._userManager.settings.monitorAnonymousSession) {\n const timerHandle = setInterval(async () => {\n clearInterval(timerHandle);\n try {\n const session = await this._userManager.querySessionStatus();\n if (session) {\n const tmpUser = {\n session_state: session.session_state,\n profile: session.sub ? {\n sub: session.sub\n } : null\n };\n void this._start(tmpUser);\n }\n } catch (err) {\n logger2.error(\"error from querySessionStatus\", err instanceof Error ? err.message : err);\n }\n }, 1e3);\n }\n };\n this._callback = async () => {\n const logger2 = this._logger.create(\"_callback\");\n try {\n const session = await this._userManager.querySessionStatus();\n let raiseEvent = true;\n if (session && this._checkSessionIFrame) {\n if (session.sub === this._sub) {\n raiseEvent = false;\n this._checkSessionIFrame.start(session.session_state);\n logger2.debug(\"same sub still logged in at OP, session state has changed, restarting check session iframe; session_state\", session.session_state);\n await this._userManager.events._raiseUserSessionChanged();\n } else {\n logger2.debug(\"different subject signed into OP\", session.sub);\n }\n } else {\n logger2.debug(\"subject no longer signed into OP\");\n }\n if (raiseEvent) {\n if (this._sub) {\n await this._userManager.events._raiseUserSignedOut();\n } else {\n await this._userManager.events._raiseUserSignedIn();\n }\n } else {\n logger2.debug(\"no change in session detected, no event to raise\");\n }\n } catch (err) {\n if (this._sub) {\n logger2.debug(\"Error calling queryCurrentSigninSession; raising signed out event\", err);\n await this._userManager.events._raiseUserSignedOut();\n }\n }\n };\n if (!_userManager) {\n this._logger.throw(new Error(\"No user manager passed\"));\n }\n this._userManager.events.addUserLoaded(this._start);\n this._userManager.events.addUserUnloaded(this._stop);\n this._init().catch((err) => {\n this._logger.error(err);\n });\n }\n async _init() {\n this._logger.create(\"_init\");\n const user = await this._userManager.getUser();\n if (user) {\n void this._start(user);\n } else if (this._userManager.settings.monitorAnonymousSession) {\n const session = await this._userManager.querySessionStatus();\n if (session) {\n const tmpUser = {\n session_state: session.session_state,\n profile: session.sub ? {\n sub: session.sub\n } : null\n };\n void this._start(tmpUser);\n }\n }\n }\n};\n\n// src/User.ts\nvar User = class _User {\n constructor(args) {\n var _a;\n this.id_token = args.id_token;\n this.session_state = (_a = args.session_state) != null ? _a : null;\n this.access_token = args.access_token;\n this.refresh_token = args.refresh_token;\n this.token_type = args.token_type;\n this.scope = args.scope;\n this.profile = args.profile;\n this.expires_at = args.expires_at;\n this.state = args.userState;\n this.url_state = args.url_state;\n }\n /** Computed number of seconds the access token has remaining. */\n get expires_in() {\n if (this.expires_at === void 0) {\n return void 0;\n }\n return this.expires_at - Timer.getEpochTime();\n }\n set expires_in(value) {\n if (value !== void 0) {\n this.expires_at = Math.floor(value) + Timer.getEpochTime();\n }\n }\n /** Computed value indicating if the access token is expired. */\n get expired() {\n const expires_in = this.expires_in;\n if (expires_in === void 0) {\n return void 0;\n }\n return expires_in <= 0;\n }\n /** Array representing the parsed values from the `scope`. */\n get scopes() {\n var _a, _b;\n return (_b = (_a = this.scope) == null ? void 0 : _a.split(\" \")) != null ? _b : [];\n }\n toStorageString() {\n new Logger(\"User\").create(\"toStorageString\");\n return JSON.stringify({\n id_token: this.id_token,\n session_state: this.session_state,\n access_token: this.access_token,\n refresh_token: this.refresh_token,\n token_type: this.token_type,\n scope: this.scope,\n profile: this.profile,\n expires_at: this.expires_at\n });\n }\n static fromStorageString(storageString) {\n Logger.createStatic(\"User\", \"fromStorageString\");\n return new _User(JSON.parse(storageString));\n }\n};\n\n// src/navigators/AbstractChildWindow.ts\nvar messageSource = \"oidc-client\";\nvar AbstractChildWindow = class {\n constructor() {\n this._abort = new Event(\"Window navigation aborted\");\n this._disposeHandlers = /* @__PURE__ */ new Set();\n this._window = null;\n }\n async navigate(params) {\n const logger2 = this._logger.create(\"navigate\");\n if (!this._window) {\n throw new Error(\"Attempted to navigate on a disposed window\");\n }\n logger2.debug(\"setting URL in window\");\n this._window.location.replace(params.url);\n const { url, keepOpen } = await new Promise((resolve, reject) => {\n const listener = (e) => {\n var _a;\n const data = e.data;\n const origin = (_a = params.scriptOrigin) != null ? _a : window.location.origin;\n if (e.origin !== origin || (data == null ? void 0 : data.source) !== messageSource) {\n return;\n }\n try {\n const state = UrlUtils.readParams(data.url, params.response_mode).get(\"state\");\n if (!state) {\n logger2.warn(\"no state found in response url\");\n }\n if (e.source !== this._window && state !== params.state) {\n return;\n }\n } catch {\n this._dispose();\n reject(new Error(\"Invalid response from window\"));\n }\n resolve(data);\n };\n window.addEventListener(\"message\", listener, false);\n this._disposeHandlers.add(() => window.removeEventListener(\"message\", listener, false));\n const channel = new BroadcastChannel(`oidc-client-popup-${params.state}`);\n channel.addEventListener(\"message\", listener, false);\n this._disposeHandlers.add(() => channel.close());\n this._disposeHandlers.add(this._abort.addHandler((reason) => {\n this._dispose();\n reject(reason);\n }));\n });\n logger2.debug(\"got response from window\");\n this._dispose();\n if (!keepOpen) {\n this.close();\n }\n return { url };\n }\n _dispose() {\n this._logger.create(\"_dispose\");\n for (const dispose of this._disposeHandlers) {\n dispose();\n }\n this._disposeHandlers.clear();\n }\n static _notifyParent(parent, url, keepOpen = false, targetOrigin = window.location.origin) {\n const msgData = {\n source: messageSource,\n url,\n keepOpen\n };\n const logger2 = new Logger(\"_notifyParent\");\n if (parent) {\n logger2.debug(\"With parent. Using parent.postMessage.\");\n parent.postMessage(msgData, targetOrigin);\n } else {\n logger2.debug(\"No parent. Using BroadcastChannel.\");\n const state = new URL(url).searchParams.get(\"state\");\n if (!state) {\n throw new Error(\"No parent and no state in URL. Can't complete notification.\");\n }\n const channel = new BroadcastChannel(`oidc-client-popup-${state}`);\n channel.postMessage(msgData);\n channel.close();\n }\n }\n};\n\n// src/UserManagerSettings.ts\nvar DefaultPopupWindowFeatures = {\n location: false,\n toolbar: false,\n height: 640,\n closePopupWindowAfterInSeconds: -1\n};\nvar DefaultPopupTarget = \"_blank\";\nvar DefaultAccessTokenExpiringNotificationTimeInSeconds = 60;\nvar DefaultCheckSessionIntervalInSeconds = 2;\nvar DefaultSilentRequestTimeoutInSeconds = 10;\nvar UserManagerSettingsStore = class extends OidcClientSettingsStore {\n constructor(args) {\n const {\n popup_redirect_uri = args.redirect_uri,\n popup_post_logout_redirect_uri = args.post_logout_redirect_uri,\n popupWindowFeatures = DefaultPopupWindowFeatures,\n popupWindowTarget = DefaultPopupTarget,\n redirectMethod = \"assign\",\n redirectTarget = \"self\",\n iframeNotifyParentOrigin = args.iframeNotifyParentOrigin,\n iframeScriptOrigin = args.iframeScriptOrigin,\n requestTimeoutInSeconds,\n silent_redirect_uri = args.redirect_uri,\n silentRequestTimeoutInSeconds,\n automaticSilentRenew = true,\n validateSubOnSilentRenew = true,\n includeIdTokenInSilentRenew = false,\n monitorSession = false,\n monitorAnonymousSession = false,\n checkSessionIntervalInSeconds = DefaultCheckSessionIntervalInSeconds,\n query_status_response_type = \"code\",\n stopCheckSessionOnError = true,\n revokeTokenTypes = [\"access_token\", \"refresh_token\"],\n revokeTokensOnSignout = false,\n includeIdTokenInSilentSignout = false,\n accessTokenExpiringNotificationTimeInSeconds = DefaultAccessTokenExpiringNotificationTimeInSeconds,\n maxSilentRenewTimeoutRetries,\n userStore\n } = args;\n super(args);\n this.popup_redirect_uri = popup_redirect_uri;\n this.popup_post_logout_redirect_uri = popup_post_logout_redirect_uri;\n this.popupWindowFeatures = popupWindowFeatures;\n this.popupWindowTarget = popupWindowTarget;\n this.redirectMethod = redirectMethod;\n this.redirectTarget = redirectTarget;\n this.iframeNotifyParentOrigin = iframeNotifyParentOrigin;\n this.iframeScriptOrigin = iframeScriptOrigin;\n this.silent_redirect_uri = silent_redirect_uri;\n this.silentRequestTimeoutInSeconds = silentRequestTimeoutInSeconds || requestTimeoutInSeconds || DefaultSilentRequestTimeoutInSeconds;\n this.automaticSilentRenew = automaticSilentRenew;\n this.validateSubOnSilentRenew = validateSubOnSilentRenew;\n this.includeIdTokenInSilentRenew = includeIdTokenInSilentRenew;\n this.monitorSession = monitorSession;\n this.monitorAnonymousSession = monitorAnonymousSession;\n this.checkSessionIntervalInSeconds = checkSessionIntervalInSeconds;\n this.stopCheckSessionOnError = stopCheckSessionOnError;\n this.query_status_response_type = query_status_response_type;\n this.revokeTokenTypes = revokeTokenTypes;\n this.revokeTokensOnSignout = revokeTokensOnSignout;\n this.includeIdTokenInSilentSignout = includeIdTokenInSilentSignout;\n this.accessTokenExpiringNotificationTimeInSeconds = accessTokenExpiringNotificationTimeInSeconds;\n this.maxSilentRenewTimeoutRetries = maxSilentRenewTimeoutRetries;\n if (userStore) {\n this.userStore = userStore;\n } else {\n const store = typeof window !== \"undefined\" ? window.sessionStorage : new InMemoryWebStorage();\n this.userStore = new WebStorageStateStore({ store });\n }\n }\n};\n\n// src/navigators/IFrameWindow.ts\nvar IFrameWindow = class _IFrameWindow extends AbstractChildWindow {\n constructor({\n silentRequestTimeoutInSeconds = DefaultSilentRequestTimeoutInSeconds\n }) {\n super();\n this._logger = new Logger(\"IFrameWindow\");\n this._timeoutInSeconds = silentRequestTimeoutInSeconds;\n this._frame = _IFrameWindow.createHiddenIframe();\n this._window = this._frame.contentWindow;\n }\n static createHiddenIframe() {\n const iframe = window.document.createElement(\"iframe\");\n iframe.style.visibility = \"hidden\";\n iframe.style.position = \"fixed\";\n iframe.style.left = \"-1000px\";\n iframe.style.top = \"0\";\n iframe.width = \"0\";\n iframe.height = \"0\";\n window.document.body.appendChild(iframe);\n return iframe;\n }\n async navigate(params) {\n this._logger.debug(\"navigate: Using timeout of:\", this._timeoutInSeconds);\n const timer = setTimeout(() => void this._abort.raise(new ErrorTimeout(\"IFrame timed out without a response\")), this._timeoutInSeconds * 1e3);\n this._disposeHandlers.add(() => clearTimeout(timer));\n return await super.navigate(params);\n }\n close() {\n var _a;\n if (this._frame) {\n if (this._frame.parentNode) {\n this._frame.addEventListener(\"load\", (ev) => {\n var _a2;\n const frame = ev.target;\n (_a2 = frame.parentNode) == null ? void 0 : _a2.removeChild(frame);\n void this._abort.raise(new Error(\"IFrame removed from DOM\"));\n }, true);\n (_a = this._frame.contentWindow) == null ? void 0 : _a.location.replace(\"about:blank\");\n }\n this._frame = null;\n }\n this._window = null;\n }\n static notifyParent(url, targetOrigin) {\n return super._notifyParent(window.parent, url, false, targetOrigin);\n }\n};\n\n// src/navigators/IFrameNavigator.ts\nvar IFrameNavigator = class {\n constructor(_settings) {\n this._settings = _settings;\n this._logger = new Logger(\"IFrameNavigator\");\n }\n async prepare({\n silentRequestTimeoutInSeconds = this._settings.silentRequestTimeoutInSeconds\n }) {\n return new IFrameWindow({ silentRequestTimeoutInSeconds });\n }\n async callback(url) {\n this._logger.create(\"callback\");\n IFrameWindow.notifyParent(url, this._settings.iframeNotifyParentOrigin);\n }\n};\n\n// src/navigators/PopupWindow.ts\nvar checkForPopupClosedInterval = 500;\nvar second = 1e3;\nvar PopupWindow = class extends AbstractChildWindow {\n constructor({\n popupWindowTarget = DefaultPopupTarget,\n popupWindowFeatures = {},\n popupSignal,\n popupAbortOnClose\n }) {\n super();\n this._logger = new Logger(\"PopupWindow\");\n const centeredPopup = PopupUtils.center({ ...DefaultPopupWindowFeatures, ...popupWindowFeatures });\n this._window = window.open(void 0, popupWindowTarget, PopupUtils.serialize(centeredPopup));\n this.abortOnClose = Boolean(popupAbortOnClose);\n if (popupSignal) {\n popupSignal.addEventListener(\"abort\", () => {\n var _a;\n void this._abort.raise(new Error((_a = popupSignal.reason) != null ? _a : \"Popup aborted\"));\n });\n }\n if (popupWindowFeatures.closePopupWindowAfterInSeconds && popupWindowFeatures.closePopupWindowAfterInSeconds > 0) {\n setTimeout(() => {\n if (!this._window || typeof this._window.closed !== \"boolean\" || this._window.closed) {\n void this._abort.raise(new Error(\"Popup blocked by user\"));\n return;\n }\n this.close();\n }, popupWindowFeatures.closePopupWindowAfterInSeconds * second);\n }\n }\n async navigate(params) {\n var _a;\n (_a = this._window) == null ? void 0 : _a.focus();\n const popupClosedInterval = setInterval(() => {\n if (!this._window || this._window.closed) {\n this._logger.debug(\"Popup closed by user or isolated by redirect\");\n clearPopupClosedInterval();\n this._disposeHandlers.delete(clearPopupClosedInterval);\n if (this.abortOnClose) {\n void this._abort.raise(new Error(\"Popup closed by user\"));\n }\n }\n }, checkForPopupClosedInterval);\n const clearPopupClosedInterval = () => clearInterval(popupClosedInterval);\n this._disposeHandlers.add(clearPopupClosedInterval);\n return await super.navigate(params);\n }\n close() {\n if (this._window) {\n if (!this._window.closed) {\n this._window.close();\n void this._abort.raise(new Error(\"Popup closed\"));\n }\n }\n this._window = null;\n }\n static notifyOpener(url, keepOpen) {\n super._notifyParent(window.opener, url, keepOpen);\n if (!keepOpen && !window.opener) {\n window.close();\n }\n }\n};\n\n// src/navigators/PopupNavigator.ts\nvar PopupNavigator = class {\n constructor(_settings) {\n this._settings = _settings;\n this._logger = new Logger(\"PopupNavigator\");\n }\n async prepare({\n popupWindowFeatures = this._settings.popupWindowFeatures,\n popupWindowTarget = this._settings.popupWindowTarget,\n popupSignal,\n popupAbortOnClose\n }) {\n return new PopupWindow({\n popupWindowFeatures,\n popupWindowTarget,\n popupSignal,\n popupAbortOnClose\n });\n }\n async callback(url, { keepOpen = false }) {\n this._logger.create(\"callback\");\n PopupWindow.notifyOpener(url, keepOpen);\n }\n};\n\n// src/navigators/RedirectNavigator.ts\nvar RedirectNavigator = class {\n constructor(_settings) {\n this._settings = _settings;\n this._logger = new Logger(\"RedirectNavigator\");\n }\n async prepare({\n redirectMethod = this._settings.redirectMethod,\n redirectTarget = this._settings.redirectTarget\n }) {\n var _a;\n this._logger.create(\"prepare\");\n let targetWindow = window.self;\n if (redirectTarget === \"top\") {\n targetWindow = (_a = window.top) != null ? _a : window.self;\n }\n const redirect = targetWindow.location[redirectMethod].bind(targetWindow.location);\n let abort;\n return {\n navigate: async (params) => {\n this._logger.create(\"navigate\");\n const promise = new Promise((resolve, reject) => {\n abort = reject;\n window.addEventListener(\"pageshow\", () => resolve(window.location.href));\n redirect(params.url);\n });\n return await promise;\n },\n close: () => {\n this._logger.create(\"close\");\n abort == null ? void 0 : abort(new Error(\"Redirect aborted\"));\n targetWindow.stop();\n }\n };\n }\n async callback() {\n return;\n }\n};\n\n// src/UserManagerEvents.ts\nvar UserManagerEvents = class extends AccessTokenEvents {\n constructor(settings) {\n super({ expiringNotificationTimeInSeconds: settings.accessTokenExpiringNotificationTimeInSeconds });\n this._logger = new Logger(\"UserManagerEvents\");\n this._userLoaded = new Event(\"User loaded\");\n this._userUnloaded = new Event(\"User unloaded\");\n this._silentRenewError = new Event(\"Silent renew error\");\n this._userSignedIn = new Event(\"User signed in\");\n this._userSignedOut = new Event(\"User signed out\");\n this._userSessionChanged = new Event(\"User session changed\");\n }\n async load(user, raiseEvent = true) {\n await super.load(user);\n if (raiseEvent) {\n await this._userLoaded.raise(user);\n }\n }\n async unload() {\n await super.unload();\n await this._userUnloaded.raise();\n }\n /**\n * Add callback: Raised when a user session has been established (or re-established).\n */\n addUserLoaded(cb) {\n return this._userLoaded.addHandler(cb);\n }\n /**\n * Remove callback: Raised when a user session has been established (or re-established).\n */\n removeUserLoaded(cb) {\n return this._userLoaded.removeHandler(cb);\n }\n /**\n * Add callback: Raised when a user session has been terminated.\n */\n addUserUnloaded(cb) {\n return this._userUnloaded.addHandler(cb);\n }\n /**\n * Remove callback: Raised when a user session has been terminated.\n */\n removeUserUnloaded(cb) {\n return this._userUnloaded.removeHandler(cb);\n }\n /**\n * Add callback: Raised when the automatic silent renew has failed.\n */\n addSilentRenewError(cb) {\n return this._silentRenewError.addHandler(cb);\n }\n /**\n * Remove callback: Raised when the automatic silent renew has failed.\n */\n removeSilentRenewError(cb) {\n return this._silentRenewError.removeHandler(cb);\n }\n /**\n * @internal\n */\n async _raiseSilentRenewError(e) {\n await this._silentRenewError.raise(e);\n }\n /**\n * Add callback: Raised when the user is signed in (when `monitorSession` is set).\n * @see {@link UserManagerSettings.monitorSession}\n */\n addUserSignedIn(cb) {\n return this._userSignedIn.addHandler(cb);\n }\n /**\n * Remove callback: Raised when the user is signed in (when `monitorSession` is set).\n */\n removeUserSignedIn(cb) {\n this._userSignedIn.removeHandler(cb);\n }\n /**\n * @internal\n */\n async _raiseUserSignedIn() {\n await this._userSignedIn.raise();\n }\n /**\n * Add callback: Raised when the user's sign-in status at the OP has changed (when `monitorSession` is set).\n * @see {@link UserManagerSettings.monitorSession}\n */\n addUserSignedOut(cb) {\n return this._userSignedOut.addHandler(cb);\n }\n /**\n * Remove callback: Raised when the user's sign-in status at the OP has changed (when `monitorSession` is set).\n */\n removeUserSignedOut(cb) {\n this._userSignedOut.removeHandler(cb);\n }\n /**\n * @internal\n */\n async _raiseUserSignedOut() {\n await this._userSignedOut.raise();\n }\n /**\n * Add callback: Raised when the user session changed (when `monitorSession` is set).\n * @see {@link UserManagerSettings.monitorSession}\n */\n addUserSessionChanged(cb) {\n return this._userSessionChanged.addHandler(cb);\n }\n /**\n * Remove callback: Raised when the user session changed (when `monitorSession` is set).\n */\n removeUserSessionChanged(cb) {\n this._userSessionChanged.removeHandler(cb);\n }\n /**\n * @internal\n */\n async _raiseUserSessionChanged() {\n await this._userSessionChanged.raise();\n }\n};\n\n// src/SilentRenewService.ts\nvar SilentRenewService = class {\n constructor(_userManager) {\n this._userManager = _userManager;\n this._logger = new Logger(\"SilentRenewService\");\n this._isStarted = false;\n this._retryTimer = new Timer(\"Retry Silent Renew\");\n this._timeoutRetryCount = 0;\n this._tokenExpiring = async () => {\n const logger2 = this._logger.create(\"_tokenExpiring\");\n try {\n await this._userManager.signinSilent();\n this._timeoutRetryCount = 0;\n logger2.debug(\"silent token renewal successful\");\n } catch (err) {\n if (err instanceof ErrorTimeout) {\n this._timeoutRetryCount++;\n const maxRetries = this._userManager.settings.maxSilentRenewTimeoutRetries;\n const hasReachedLimit = maxRetries !== void 0 && this._timeoutRetryCount > maxRetries;\n if (hasReachedLimit) {\n logger2.error(\n `Timeout retry limit reached (${this._timeoutRetryCount} > ${maxRetries}), raising silentRenewError:`,\n err\n );\n this._timeoutRetryCount = 0;\n await this._userManager.events._raiseSilentRenewError(err);\n return;\n }\n logger2.warn(\n `ErrorTimeout from signinSilent (attempt ${this._timeoutRetryCount}), retry in 5s:`,\n err\n );\n this._retryTimer.init(5);\n return;\n }\n logger2.error(\"Error from signinSilent:\", err);\n this._timeoutRetryCount = 0;\n await this._userManager.events._raiseSilentRenewError(err);\n }\n };\n }\n async start() {\n const logger2 = this._logger.create(\"start\");\n if (!this._isStarted) {\n this._isStarted = true;\n this._userManager.events.addAccessTokenExpiring(this._tokenExpiring);\n this._retryTimer.addHandler(this._tokenExpiring);\n try {\n await this._userManager.getUser();\n } catch (err) {\n logger2.error(\"getUser error\", err);\n }\n }\n }\n stop() {\n if (this._isStarted) {\n this._retryTimer.cancel();\n this._retryTimer.removeHandler(this._tokenExpiring);\n this._userManager.events.removeAccessTokenExpiring(this._tokenExpiring);\n this._isStarted = false;\n }\n }\n};\n\n// src/RefreshState.ts\nvar RefreshState = class {\n constructor(args) {\n this.refresh_token = args.refresh_token;\n this.id_token = args.id_token;\n this.session_state = args.session_state;\n this.scope = args.scope;\n this.profile = args.profile;\n this.data = args.state;\n }\n};\n\n// src/UserManager.ts\nvar UserManager = class {\n constructor(settings, redirectNavigator, popupNavigator, iframeNavigator) {\n this._logger = new Logger(\"UserManager\");\n this.settings = new UserManagerSettingsStore(settings);\n this._client = new OidcClient(settings);\n this._redirectNavigator = redirectNavigator != null ? redirectNavigator : new RedirectNavigator(this.settings);\n this._popupNavigator = popupNavigator != null ? popupNavigator : new PopupNavigator(this.settings);\n this._iframeNavigator = iframeNavigator != null ? iframeNavigator : new IFrameNavigator(this.settings);\n this._events = new UserManagerEvents(this.settings);\n this._silentRenewService = new SilentRenewService(this);\n if (this.settings.automaticSilentRenew) {\n this.startSilentRenew();\n }\n this._sessionMonitor = null;\n if (this.settings.monitorSession) {\n this._sessionMonitor = new SessionMonitor(this);\n }\n }\n /**\n * Get object used to register for events raised by the `UserManager`.\n */\n get events() {\n return this._events;\n }\n /**\n * Get object used to access the metadata configuration of the identity provider.\n */\n get metadataService() {\n return this._client.metadataService;\n }\n /**\n * Load the `User` object for the currently authenticated user.\n *\n * @param raiseEvent - If `true`, the `UserLoaded` event will be raised. Defaults to false.\n * @returns A promise\n */\n async getUser(raiseEvent = false) {\n const logger2 = this._logger.create(\"getUser\");\n const user = await this._loadUser();\n if (user) {\n logger2.info(\"user loaded\");\n await this._events.load(user, raiseEvent);\n return user;\n }\n logger2.info(\"user not found in storage\");\n return null;\n }\n /**\n * Remove from any storage the currently authenticated user.\n *\n * @returns A promise\n */\n async removeUser() {\n const logger2 = this._logger.create(\"removeUser\");\n await this.storeUser(null);\n logger2.info(\"user removed from storage\");\n await this._events.unload();\n }\n /**\n * Trigger a redirect of the current window to the authorization endpoint.\n *\n * @returns A promise\n *\n * @throws `Error` In cases of wrong authentication.\n */\n async signinRedirect(args = {}) {\n var _a;\n this._logger.create(\"signinRedirect\");\n const {\n redirectMethod,\n ...requestArgs\n } = args;\n let dpopJkt;\n if ((_a = this.settings.dpop) == null ? void 0 : _a.bind_authorization_code) {\n dpopJkt = await this.generateDPoPJkt(this.settings.dpop);\n }\n const handle = await this._redirectNavigator.prepare({ redirectMethod });\n await this._signinStart({\n request_type: \"si:r\",\n dpopJkt,\n ...requestArgs\n }, handle);\n }\n /**\n * Process the response (callback) from the authorization endpoint.\n * It is recommended to use {@link UserManager.signinCallback} instead.\n *\n * @returns A promise containing the authenticated `User`.\n *\n * @see {@link UserManager.signinCallback}\n */\n async signinRedirectCallback(url = window.location.href) {\n const logger2 = this._logger.create(\"signinRedirectCallback\");\n const user = await this._signinEnd(url);\n if (user.profile && user.profile.sub) {\n logger2.info(\"success, signed in subject\", user.profile.sub);\n } else {\n logger2.info(\"no subject\");\n }\n return user;\n }\n /**\n * Trigger the signin with user/password.\n *\n * @returns A promise containing the authenticated `User`.\n * @throws {@link ErrorResponse} In cases of wrong authentication.\n */\n async signinResourceOwnerCredentials({\n username,\n password,\n skipUserInfo = false\n }) {\n const logger2 = this._logger.create(\"signinResourceOwnerCredential\");\n const signinResponse = await this._client.processResourceOwnerPasswordCredentials({\n username,\n password,\n skipUserInfo,\n extraTokenParams: this.settings.extraTokenParams\n });\n logger2.debug(\"got signin response\");\n const user = await this._buildUser(signinResponse);\n if (user.profile && user.profile.sub) {\n logger2.info(\"success, signed in subject\", user.profile.sub);\n } else {\n logger2.info(\"no subject\");\n }\n return user;\n }\n /**\n * Trigger a request (via a popup window) to the authorization endpoint.\n *\n * @returns A promise containing the authenticated `User`.\n * @throws `Error` In cases of wrong authentication.\n */\n async signinPopup(args = {}) {\n var _a;\n const logger2 = this._logger.create(\"signinPopup\");\n let dpopJkt;\n if ((_a = this.settings.dpop) == null ? void 0 : _a.bind_authorization_code) {\n dpopJkt = await this.generateDPoPJkt(this.settings.dpop);\n }\n const {\n popupWindowFeatures,\n popupWindowTarget,\n popupSignal,\n popupAbortOnClose,\n ...requestArgs\n } = args;\n const url = this.settings.popup_redirect_uri;\n if (!url) {\n logger2.throw(new Error(\"No popup_redirect_uri configured\"));\n }\n const handle = await this._popupNavigator.prepare({ popupWindowFeatures, popupWindowTarget, popupSignal, popupAbortOnClose });\n const user = await this._signin({\n request_type: \"si:p\",\n redirect_uri: url,\n display: \"popup\",\n dpopJkt,\n ...requestArgs\n }, handle);\n if (user) {\n if (user.profile && user.profile.sub) {\n logger2.info(\"success, signed in subject\", user.profile.sub);\n } else {\n logger2.info(\"no subject\");\n }\n }\n return user;\n }\n /**\n * Notify the opening window of response (callback) from the authorization endpoint.\n * It is recommended to use {@link UserManager.signinCallback} instead.\n *\n * @returns A promise\n *\n * @see {@link UserManager.signinCallback}\n */\n async signinPopupCallback(url = window.location.href, keepOpen = false) {\n const logger2 = this._logger.create(\"signinPopupCallback\");\n await this._popupNavigator.callback(url, { keepOpen });\n logger2.info(\"success\");\n }\n /**\n * Trigger a silent request (via refresh token or an iframe) to the authorization endpoint.\n *\n * @returns A promise that contains the authenticated `User`.\n */\n async signinSilent(args = {}) {\n var _a, _b;\n const logger2 = this._logger.create(\"signinSilent\");\n const {\n silentRequestTimeoutInSeconds,\n ...requestArgs\n } = args;\n let user = await this._loadUser();\n if (!args.forceIframeAuth && (user == null ? void 0 : user.refresh_token)) {\n logger2.debug(\"using refresh token\");\n const state = new RefreshState(user);\n return await this._useRefreshToken({\n state,\n redirect_uri: requestArgs.redirect_uri,\n resource: requestArgs.resource,\n extraTokenParams: requestArgs.extraTokenParams,\n timeoutInSeconds: silentRequestTimeoutInSeconds\n });\n }\n let dpopJkt;\n if ((_a = this.settings.dpop) == null ? void 0 : _a.bind_authorization_code) {\n dpopJkt = await this.generateDPoPJkt(this.settings.dpop);\n }\n const url = this.settings.silent_redirect_uri;\n if (!url) {\n logger2.throw(new Error(\"No silent_redirect_uri configured\"));\n }\n let verifySub;\n if (user && this.settings.validateSubOnSilentRenew) {\n logger2.debug(\"subject prior to silent renew:\", user.profile.sub);\n verifySub = user.profile.sub;\n }\n const handle = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds });\n user = await this._signin({\n request_type: \"si:s\",\n redirect_uri: url,\n prompt: \"none\",\n id_token_hint: this.settings.includeIdTokenInSilentRenew ? user == null ? void 0 : user.id_token : void 0,\n dpopJkt,\n ...requestArgs\n }, handle, verifySub);\n if (user) {\n if ((_b = user.profile) == null ? void 0 : _b.sub) {\n logger2.info(\"success, signed in subject\", user.profile.sub);\n } else {\n logger2.info(\"no subject\");\n }\n }\n return user;\n }\n async _useRefreshToken(args) {\n const response = await this._client.useRefreshToken({\n timeoutInSeconds: this.settings.silentRequestTimeoutInSeconds,\n ...args\n });\n const user = new User({ ...args.state, ...response });\n await this.storeUser(user);\n await this._events.load(user);\n return user;\n }\n /**\n *\n * Notify the parent window of response (callback) from the authorization endpoint.\n * It is recommended to use {@link UserManager.signinCallback} instead.\n *\n * @returns A promise\n *\n * @see {@link UserManager.signinCallback}\n */\n async signinSilentCallback(url = window.location.href) {\n const logger2 = this._logger.create(\"signinSilentCallback\");\n await this._iframeNavigator.callback(url);\n logger2.info(\"success\");\n }\n /**\n * Process any response (callback) from the authorization endpoint, by dispatching the request_type\n * and executing one of the following functions:\n * - {@link UserManager.signinRedirectCallback}\n * - {@link UserManager.signinPopupCallback}\n * - {@link UserManager.signinSilentCallback}\n *\n * @throws `Error` If request_type is unknown or signin cannot be processed.\n */\n async signinCallback(url = window.location.href) {\n const { state } = await this._client.readSigninResponseState(url);\n switch (state.request_type) {\n case \"si:r\":\n return await this.signinRedirectCallback(url);\n case \"si:p\":\n await this.signinPopupCallback(url);\n break;\n case \"si:s\":\n await this.signinSilentCallback(url);\n break;\n default:\n throw new Error(\"invalid request_type in state\");\n }\n return void 0;\n }\n /**\n * Process any response (callback) from the end session endpoint, by dispatching the request_type\n * and executing one of the following functions:\n * - {@link UserManager.signoutRedirectCallback}\n * - {@link UserManager.signoutPopupCallback}\n * - {@link UserManager.signoutSilentCallback}\n *\n * @throws `Error` If request_type is unknown or signout cannot be processed.\n */\n async signoutCallback(url = window.location.href, keepOpen = false) {\n const { state } = await this._client.readSignoutResponseState(url);\n if (!state) {\n return void 0;\n }\n switch (state.request_type) {\n case \"so:r\":\n return await this.signoutRedirectCallback(url);\n case \"so:p\":\n await this.signoutPopupCallback(url, keepOpen);\n break;\n case \"so:s\":\n await this.signoutSilentCallback(url);\n break;\n default:\n throw new Error(\"invalid request_type in state\");\n }\n return void 0;\n }\n /**\n * Query OP for user's current signin status.\n *\n * @returns A promise object with session_state and subject identifier.\n */\n async querySessionStatus(args = {}) {\n const logger2 = this._logger.create(\"querySessionStatus\");\n const {\n silentRequestTimeoutInSeconds,\n ...requestArgs\n } = args;\n const url = this.settings.silent_redirect_uri;\n if (!url) {\n logger2.throw(new Error(\"No silent_redirect_uri configured\"));\n }\n const user = await this._loadUser();\n const handle = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds });\n const navResponse = await this._signinStart({\n request_type: \"si:s\",\n // this acts like a signin silent\n redirect_uri: url,\n prompt: \"none\",\n id_token_hint: this.settings.includeIdTokenInSilentRenew ? user == null ? void 0 : user.id_token : void 0,\n response_type: this.settings.query_status_response_type,\n scope: \"openid\",\n skipUserInfo: true,\n ...requestArgs\n }, handle);\n try {\n const extraHeaders = {};\n const signinResponse = await this._client.processSigninResponse(navResponse.url, extraHeaders);\n logger2.debug(\"got signin response\");\n if (signinResponse.session_state && signinResponse.profile.sub) {\n logger2.info(\"success for subject\", signinResponse.profile.sub);\n return {\n session_state: signinResponse.session_state,\n sub: signinResponse.profile.sub\n };\n }\n logger2.info(\"success, user not authenticated\");\n return null;\n } catch (err) {\n if (this.settings.monitorAnonymousSession && err instanceof ErrorResponse) {\n switch (err.error) {\n case \"login_required\":\n case \"consent_required\":\n case \"interaction_required\":\n case \"account_selection_required\":\n logger2.info(\"success for anonymous user\");\n return {\n session_state: err.session_state\n };\n }\n }\n throw err;\n }\n }\n async _signin(args, handle, verifySub) {\n const navResponse = await this._signinStart(args, handle);\n return await this._signinEnd(navResponse.url, verifySub);\n }\n async _signinStart(args, handle) {\n const logger2 = this._logger.create(\"_signinStart\");\n try {\n const signinRequest = await this._client.createSigninRequest(args);\n logger2.debug(\"got signin request\");\n return await handle.navigate({\n url: signinRequest.url,\n state: signinRequest.state.id,\n response_mode: signinRequest.state.response_mode,\n scriptOrigin: this.settings.iframeScriptOrigin\n });\n } catch (err) {\n logger2.debug(\"error after preparing navigator, closing navigator window\");\n handle.close();\n throw err;\n }\n }\n async _signinEnd(url, verifySub) {\n const logger2 = this._logger.create(\"_signinEnd\");\n const extraHeaders = {};\n const signinResponse = await this._client.processSigninResponse(url, extraHeaders);\n logger2.debug(\"got signin response\");\n const user = await this._buildUser(signinResponse, verifySub);\n return user;\n }\n async _buildUser(signinResponse, verifySub) {\n const logger2 = this._logger.create(\"_buildUser\");\n const user = new User(signinResponse);\n if (verifySub) {\n if (verifySub !== user.profile.sub) {\n logger2.debug(\"current user does not match user returned from signin. sub from signin:\", user.profile.sub);\n throw new ErrorResponse({ ...signinResponse, error: \"login_required\" });\n }\n logger2.debug(\"current user matches user returned from signin\");\n }\n await this.storeUser(user);\n logger2.debug(\"user stored\");\n await this._events.load(user);\n return user;\n }\n /**\n * Trigger a redirect of the current window to the end session endpoint.\n *\n * @returns A promise\n */\n async signoutRedirect(args = {}) {\n const logger2 = this._logger.create(\"signoutRedirect\");\n const {\n redirectMethod,\n ...requestArgs\n } = args;\n const handle = await this._redirectNavigator.prepare({ redirectMethod });\n await this._signoutStart({\n request_type: \"so:r\",\n post_logout_redirect_uri: this.settings.post_logout_redirect_uri,\n ...requestArgs\n }, handle);\n logger2.info(\"success\");\n }\n /**\n * Process response (callback) from the end session endpoint.\n * It is recommended to use {@link UserManager.signoutCallback} instead.\n *\n * @returns A promise containing signout response\n *\n * @see {@link UserManager.signoutCallback}\n */\n async signoutRedirectCallback(url = window.location.href) {\n const logger2 = this._logger.create(\"signoutRedirectCallback\");\n const response = await this._signoutEnd(url);\n logger2.info(\"success\");\n return response;\n }\n /**\n * Trigger a redirect of a popup window to the end session endpoint.\n *\n * @returns A promise\n */\n async signoutPopup(args = {}) {\n const logger2 = this._logger.create(\"signoutPopup\");\n const {\n popupWindowFeatures,\n popupWindowTarget,\n popupSignal,\n ...requestArgs\n } = args;\n const url = this.settings.popup_post_logout_redirect_uri;\n const handle = await this._popupNavigator.prepare({ popupWindowFeatures, popupWindowTarget, popupSignal });\n await this._signout({\n request_type: \"so:p\",\n post_logout_redirect_uri: url,\n // we're putting a dummy entry in here because we\n // need a unique id from the state for notification\n // to the parent window, which is necessary if we\n // plan to return back to the client after signout\n // and so we can close the popup after signout\n state: url == null ? void 0 : {},\n ...requestArgs\n }, handle);\n logger2.info(\"success\");\n }\n /**\n * Process response (callback) from the end session endpoint from a popup window.\n * It is recommended to use {@link UserManager.signoutCallback} instead.\n *\n * @returns A promise\n *\n * @see {@link UserManager.signoutCallback}\n */\n async signoutPopupCallback(url = window.location.href, keepOpen = false) {\n const logger2 = this._logger.create(\"signoutPopupCallback\");\n await this._popupNavigator.callback(url, { keepOpen });\n logger2.info(\"success\");\n }\n async _signout(args, handle) {\n const navResponse = await this._signoutStart(args, handle);\n return await this._signoutEnd(navResponse.url);\n }\n async _signoutStart(args = {}, handle) {\n var _a;\n const logger2 = this._logger.create(\"_signoutStart\");\n try {\n const user = await this._loadUser();\n logger2.debug(\"loaded current user from storage\");\n if (this.settings.revokeTokensOnSignout) {\n await this._revokeInternal(user);\n }\n const id_token = args.id_token_hint || user && user.id_token;\n if (id_token) {\n logger2.debug(\"setting id_token_hint in signout request\");\n args.id_token_hint = id_token;\n }\n await this.removeUser();\n logger2.debug(\"user removed, creating signout request\");\n const signoutRequest = await this._client.createSignoutRequest(args);\n logger2.debug(\"got signout request\");\n return await handle.navigate({\n url: signoutRequest.url,\n state: (_a = signoutRequest.state) == null ? void 0 : _a.id,\n scriptOrigin: this.settings.iframeScriptOrigin\n });\n } catch (err) {\n logger2.debug(\"error after preparing navigator, closing navigator window\");\n handle.close();\n throw err;\n }\n }\n async _signoutEnd(url) {\n const logger2 = this._logger.create(\"_signoutEnd\");\n const signoutResponse = await this._client.processSignoutResponse(url);\n logger2.debug(\"got signout response\");\n return signoutResponse;\n }\n /**\n * Trigger a silent request (via an iframe) to the end session endpoint.\n *\n * @returns A promise\n */\n async signoutSilent(args = {}) {\n var _a;\n const logger2 = this._logger.create(\"signoutSilent\");\n const {\n silentRequestTimeoutInSeconds,\n ...requestArgs\n } = args;\n const id_token_hint = this.settings.includeIdTokenInSilentSignout ? (_a = await this._loadUser()) == null ? void 0 : _a.id_token : void 0;\n const url = this.settings.popup_post_logout_redirect_uri;\n const handle = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds });\n await this._signout({\n request_type: \"so:s\",\n post_logout_redirect_uri: url,\n id_token_hint,\n ...requestArgs\n }, handle);\n logger2.info(\"success\");\n }\n /**\n * Notify the parent window of response (callback) from the end session endpoint.\n * It is recommended to use {@link UserManager.signoutCallback} instead.\n *\n * @returns A promise\n *\n * @see {@link UserManager.signoutCallback}\n */\n async signoutSilentCallback(url = window.location.href) {\n const logger2 = this._logger.create(\"signoutSilentCallback\");\n await this._iframeNavigator.callback(url);\n logger2.info(\"success\");\n }\n async revokeTokens(types) {\n const user = await this._loadUser();\n await this._revokeInternal(user, types);\n }\n async _revokeInternal(user, types = this.settings.revokeTokenTypes) {\n const logger2 = this._logger.create(\"_revokeInternal\");\n if (!user) return;\n const typesPresent = types.filter((type) => typeof user[type] === \"string\");\n if (!typesPresent.length) {\n logger2.debug(\"no need to revoke due to no token(s)\");\n return;\n }\n for (const type of typesPresent) {\n await this._client.revokeToken(\n user[type],\n type\n );\n logger2.info(`${type} revoked successfully`);\n if (type !== \"access_token\") {\n user[type] = null;\n }\n }\n await this.storeUser(user);\n logger2.debug(\"user stored\");\n await this._events.load(user);\n }\n /**\n * Enables silent renew for the `UserManager`.\n */\n startSilentRenew() {\n this._logger.create(\"startSilentRenew\");\n void this._silentRenewService.start();\n }\n /**\n * Disables silent renew for the `UserManager`.\n */\n stopSilentRenew() {\n this._silentRenewService.stop();\n }\n get _userStoreKey() {\n return `user:${this.settings.authority}:${this.settings.client_id}`;\n }\n async _loadUser() {\n const logger2 = this._logger.create(\"_loadUser\");\n const storageString = await this.settings.userStore.get(this._userStoreKey);\n if (storageString) {\n logger2.debug(\"user storageString loaded\");\n return User.fromStorageString(storageString);\n }\n logger2.debug(\"no user storageString\");\n return null;\n }\n async storeUser(user) {\n const logger2 = this._logger.create(\"storeUser\");\n if (user) {\n logger2.debug(\"storing user\");\n const storageString = user.toStorageString();\n await this.settings.userStore.set(this._userStoreKey, storageString);\n } else {\n this._logger.debug(\"removing user\");\n await this.settings.userStore.remove(this._userStoreKey);\n if (this.settings.dpop) {\n await this.settings.dpop.store.remove(this.settings.client_id);\n }\n }\n }\n /**\n * Removes stale state entries in storage for incomplete authorize requests.\n */\n async clearStaleState() {\n await this._client.clearStaleState();\n }\n /**\n * Dynamically generates a DPoP proof for a given user, URL and optional Http method.\n * This method is useful when you need to make a request to a resource server\n * with fetch or similar, and you need to include a DPoP proof in a DPoP header.\n * @param url - The URL to generate the DPoP proof for\n * @param user - The user to generate the DPoP proof for\n * @param httpMethod - Optional, defaults to \"GET\"\n * @param nonce - Optional nonce provided by the resource server\n *\n * @returns A promise containing the DPoP proof or undefined if DPoP is not enabled/no user is found.\n */\n async dpopProof(url, user, httpMethod, nonce) {\n var _a, _b;\n const dpopState = await ((_b = (_a = this.settings.dpop) == null ? void 0 : _a.store) == null ? void 0 : _b.get(this.settings.client_id));\n if (dpopState) {\n return await CryptoUtils.generateDPoPProof({\n url,\n accessToken: user == null ? void 0 : user.access_token,\n httpMethod,\n keyPair: dpopState.keys,\n nonce\n });\n }\n return void 0;\n }\n async generateDPoPJkt(dpopSettings) {\n let dpopState = await dpopSettings.store.get(this.settings.client_id);\n if (!dpopState) {\n const dpopKeys = await CryptoUtils.generateDPoPKeys();\n dpopState = new DPoPState(dpopKeys);\n await dpopSettings.store.set(this.settings.client_id, dpopState);\n }\n return await CryptoUtils.generateDPoPJkt(dpopState.keys);\n }\n};\n\n// package.json\nvar version = \"3.5.0\";\n\n// src/Version.ts\nvar Version = version;\n\n// src/IndexedDbDPoPStore.ts\nvar IndexedDbDPoPStore = class {\n constructor() {\n this._dbName = \"oidc\";\n this._storeName = \"dpop\";\n }\n async set(key, value) {\n const store = await this.createStore(this._dbName, this._storeName);\n await store(\"readwrite\", (str) => {\n str.put(value, key);\n return this.promisifyRequest(str.transaction);\n });\n }\n async get(key) {\n const store = await this.createStore(this._dbName, this._storeName);\n return await store(\"readonly\", (str) => {\n return this.promisifyRequest(str.get(key));\n });\n }\n async remove(key) {\n const item = await this.get(key);\n const store = await this.createStore(this._dbName, this._storeName);\n await store(\"readwrite\", (str) => {\n return this.promisifyRequest(str.delete(key));\n });\n return item;\n }\n async getAllKeys() {\n const store = await this.createStore(this._dbName, this._storeName);\n return await store(\"readonly\", (str) => {\n return this.promisifyRequest(str.getAllKeys());\n });\n }\n promisifyRequest(request) {\n return new Promise((resolve, reject) => {\n request.oncomplete = request.onsuccess = () => resolve(request.result);\n request.onabort = request.onerror = () => reject(request.error);\n });\n }\n async createStore(dbName, storeName) {\n const request = indexedDB.open(dbName);\n request.onupgradeneeded = () => request.result.createObjectStore(storeName);\n const db = await this.promisifyRequest(request);\n return async (txMode, callback) => {\n const tx = db.transaction(storeName, txMode);\n const store = tx.objectStore(storeName);\n return await callback(store);\n };\n }\n};\nexport {\n AccessTokenEvents,\n CheckSessionIFrame,\n DPoPState,\n ErrorResponse,\n ErrorTimeout,\n InMemoryWebStorage,\n IndexedDbDPoPStore,\n Log,\n Logger,\n MetadataService,\n OidcClient,\n OidcClientSettingsStore,\n SessionMonitor,\n SigninResponse,\n SigninState,\n SignoutResponse,\n State,\n User,\n UserManager,\n UserManagerSettingsStore,\n Version,\n WebStorageStateStore\n};\n//# sourceMappingURL=oidc-client-ts.js.map\n","import { WebStorageStateStore, State } from 'oidc-client-ts';\nexport { AccessTokenEvents, CheckSessionIFrame, InMemoryWebStorage, Log, MetadataService, OidcClient, SessionMonitor, SigninResponse, User, UserManager, WebStorageStateStore } from 'oidc-client-ts';\nimport { determineSigningAlg, PREFERRED_SIGNING_ALG, generateDpopKeyPair, createDpopHeader, getWebidFromTokenPayload, OidcProviderError, InvalidResponseError, removeOpenIdParams } from '@inrupt/solid-client-authn-core';\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n// Camelcase identifiers are required in the OIDC specification.\n/* eslint-disable camelcase*/\nfunction processErrorResponse(\n// The type is any here because the object is parsed from a JSON response\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nresponseBody, options) {\n // The following errors are defined by the spec, and allow providing some context.\n // See https://tools.ietf.org/html/rfc7591#section-3.2.2 for more information\n if (responseBody.error === \"invalid_redirect_uri\") {\n throw new Error(`Dynamic client registration failed: the provided redirect uri [${options.redirectUrl?.toString()}] is invalid - ${responseBody.error_description ?? \"\"}`);\n }\n if (responseBody.error === \"invalid_client_metadata\") {\n throw new Error(`Dynamic client registration failed: the provided client metadata ${JSON.stringify(options)} is invalid - ${responseBody.error_description ?? \"\"}`);\n }\n // We currently don't support software statements, so no related error should happen.\n // If an error outside of the spec happens, no additional context can be provided\n throw new Error(`Dynamic client registration failed: ${responseBody.error} - ${responseBody.error_description ?? \"\"}`);\n}\nfunction hasClientId(body) {\n return typeof body.client_id === \"string\";\n}\nfunction hasRedirectUri(body) {\n return (Array.isArray(body.redirect_uris) &&\n body.redirect_uris.every((uri) => typeof uri === \"string\"));\n}\nfunction validateRegistrationResponse(responseBody, options) {\n if (!hasClientId(responseBody)) {\n throw new Error(`Dynamic client registration failed: no client_id has been found on ${JSON.stringify(responseBody)}`);\n }\n if (options.redirectUrl &&\n hasRedirectUri(responseBody) &&\n responseBody.redirect_uris[0] !== options.redirectUrl.toString()) {\n throw new Error(`Dynamic client registration failed: the returned redirect URIs ${JSON.stringify(responseBody.redirect_uris)} don't match the provided ${JSON.stringify([\n options.redirectUrl.toString(),\n ])}`);\n }\n return true;\n}\nasync function registerClient(options, issuerConfig) {\n if (!issuerConfig.registrationEndpoint) {\n throw new Error(\"Dynamic Registration could not be completed because the issuer has no registration endpoint.\");\n }\n if (!Array.isArray(issuerConfig.idTokenSigningAlgValuesSupported)) {\n throw new Error(\"The OIDC issuer discovery profile is missing the 'id_token_signing_alg_values_supported' value, which is mandatory.\");\n }\n const signingAlg = determineSigningAlg(issuerConfig.idTokenSigningAlgValuesSupported, PREFERRED_SIGNING_ALG);\n const config = {\n client_name: options.clientName,\n application_type: \"web\",\n redirect_uris: [options.redirectUrl?.toString()],\n subject_type: \"public\",\n token_endpoint_auth_method: \"client_secret_basic\",\n id_token_signed_response_alg: signingAlg,\n grant_types: [\"authorization_code\", \"refresh_token\"],\n };\n const headers = {\n \"Content-Type\": \"application/json\",\n };\n const registerResponse = await fetch(issuerConfig.registrationEndpoint.toString(), {\n method: \"POST\",\n headers,\n body: JSON.stringify(config),\n });\n if (registerResponse.ok) {\n const responseBody = await registerResponse.json();\n validateRegistrationResponse(responseBody, options);\n return {\n clientId: responseBody.client_id,\n clientSecret: responseBody.client_secret,\n expiresAt: responseBody.client_secret_expires_at,\n idTokenSignedResponseAlg: responseBody.id_token_signed_response_alg,\n clientType: \"dynamic\",\n };\n }\n if (registerResponse.status === 400) {\n processErrorResponse(await registerResponse.json(), options);\n }\n throw new Error(`Dynamic client registration failed: the server returned ${registerResponse.status} ${registerResponse.statusText} - ${await registerResponse.text()}`);\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n// Camelcase identifiers are required in the OAuth specification.\n/* eslint-disable camelcase*/\nfunction hasError(value) {\n return value.error !== undefined && typeof value.error === \"string\";\n}\nfunction hasErrorDescription(value) {\n return (value.error_description !== undefined &&\n typeof value.error_description === \"string\");\n}\nfunction hasErrorUri(value) {\n return value.error_uri !== undefined && typeof value.error_uri === \"string\";\n}\nfunction hasAccessToken(value) {\n return (value.access_token !== undefined && typeof value.access_token === \"string\");\n}\nfunction hasIdToken(value) {\n return value.id_token !== undefined && typeof value.id_token === \"string\";\n}\nfunction hasRefreshToken(value) {\n return (value.refresh_token !== undefined && typeof value.refresh_token === \"string\");\n}\nfunction hasTokenType(value) {\n return value.token_type !== undefined && typeof value.token_type === \"string\";\n}\nfunction hasExpiresIn(value) {\n return value.expires_in === undefined || typeof value.expires_in === \"number\";\n}\nfunction validatePreconditions(issuer, data) {\n if (data.grantType &&\n (!issuer.grantTypesSupported ||\n !issuer.grantTypesSupported.includes(data.grantType))) {\n throw new Error(`The issuer [${issuer.issuer}] does not support the [${data.grantType}] grant`);\n }\n if (!issuer.tokenEndpoint) {\n throw new Error(`This issuer [${issuer.issuer}] does not have a token endpoint`);\n }\n}\nfunction validateTokenEndpointResponse(tokenResponse, dpop) {\n if (hasError(tokenResponse)) {\n throw new OidcProviderError(`Token endpoint returned error [${tokenResponse.error}]${hasErrorDescription(tokenResponse)\n ? `: ${tokenResponse.error_description}`\n : \"\"}${hasErrorUri(tokenResponse) ? ` (see ${tokenResponse.error_uri})` : \"\"}`, tokenResponse.error, hasErrorDescription(tokenResponse)\n ? tokenResponse.error_description\n : undefined);\n }\n if (!hasAccessToken(tokenResponse)) {\n throw new InvalidResponseError([\"access_token\"]);\n }\n if (!hasIdToken(tokenResponse)) {\n throw new InvalidResponseError([\"id_token\"]);\n }\n if (!hasTokenType(tokenResponse)) {\n throw new InvalidResponseError([\"token_type\"]);\n }\n if (!hasExpiresIn(tokenResponse)) {\n throw new InvalidResponseError([\"expires_in\"]);\n }\n // TODO: Due to a bug in both the ESS ID broker AND NSS (what were the odds), a DPoP token is returned\n // with a token_type 'Bearer'. To work around this, this test is currently disabled.\n // https://github.com/solid/oidc-op/issues/26\n // Fixed, but unreleased for the ESS (current version: inrupt-oidc-server-0.5.2)\n // if (dpop && tokenResponse.token_type.toLowerCase() !== \"dpop\") {\n // throw new Error(\n // `Invalid token endpoint response: requested a [DPoP] token, but got a 'token_type' value of [${tokenResponse.token_type}].`\n // );\n // }\n if (!dpop && tokenResponse.token_type.toLowerCase() !== \"bearer\") {\n throw new Error(`Invalid token endpoint response: requested a [Bearer] token, but got a 'token_type' value of [${tokenResponse.token_type}].`);\n }\n return tokenResponse;\n}\nasync function getTokens(issuer, client, data, dpop) {\n validatePreconditions(issuer, data);\n const headers = {\n \"content-type\": \"application/x-www-form-urlencoded\",\n };\n let dpopKey;\n if (dpop) {\n dpopKey = await generateDpopKeyPair();\n headers.DPoP = await createDpopHeader(issuer.tokenEndpoint, \"POST\", dpopKey);\n }\n // Note: this defaults to client_secret_basic. client_secret_post\n // is currently not supported. See https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication\n // for details.\n if (client.clientSecret) {\n headers.Authorization = `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`;\n }\n const requestBody = {\n grant_type: data.grantType,\n redirect_uri: data.redirectUrl,\n code: data.code,\n code_verifier: data.codeVerifier,\n client_id: client.clientId,\n };\n const tokenRequestInit = {\n method: \"POST\",\n headers,\n body: new URLSearchParams(requestBody).toString(),\n };\n const rawTokenResponse = await fetch(issuer.tokenEndpoint, tokenRequestInit);\n const jsonTokenResponse = (await rawTokenResponse.json());\n const tokenResponse = validateTokenEndpointResponse(jsonTokenResponse, dpop);\n const { webId, clientId } = await getWebidFromTokenPayload(tokenResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);\n return {\n accessToken: tokenResponse.access_token,\n idToken: tokenResponse.id_token,\n refreshToken: hasRefreshToken(tokenResponse)\n ? tokenResponse.refresh_token\n : undefined,\n webId,\n clientId,\n dpopKey,\n expiresIn: tokenResponse.expires_in,\n };\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nconst isValidUrl = (url) => {\n try {\n // Here, the URL constructor is just called to parse the given string and\n // verify if it is a well-formed IRI.\n new URL(url);\n return true;\n }\n catch {\n return false;\n }\n};\n// Identifiers in snake_case are mandated by the OAuth spec.\nasync function refresh(refreshToken, issuer, client, dpopKey) {\n if (client.clientId === undefined) {\n throw new Error(\"No client ID available when trying to refresh the access token.\");\n }\n const requestBody = {\n grant_type: \"refresh_token\",\n refresh_token: refreshToken,\n };\n let dpopHeader = {};\n if (dpopKey !== undefined) {\n dpopHeader = {\n DPoP: await createDpopHeader(issuer.tokenEndpoint, \"POST\", dpopKey),\n };\n }\n let authHeader = {};\n if (client.clientSecret !== undefined) {\n authHeader = {\n // We assume that client_secret_basic is the client authentication method.\n // TODO: Get the authentication method from the IClient configuration object.\n Authorization: `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`,\n };\n }\n else if (isValidUrl(client.clientId)) {\n // If the client ID is an URL, and there is no client secret, the client\n // has a Solid-OIDC Client Identifier, and it should be present in the\n // request body.\n requestBody.client_id = client.clientId;\n }\n const rawResponse = await fetch(issuer.tokenEndpoint, {\n method: \"POST\",\n body: new URLSearchParams(requestBody).toString(),\n headers: {\n ...dpopHeader,\n ...authHeader,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n });\n let response;\n try {\n response = await rawResponse.json();\n }\n catch (_e) {\n // The response is left out of the error on purpose not to leak any sensitive information.\n throw new Error(`The token endpoint of issuer ${issuer.issuer} returned a malformed response.`);\n }\n const validatedResponse = validateTokenEndpointResponse(response, dpopKey !== undefined);\n const { webId } = await getWebidFromTokenPayload(validatedResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);\n return {\n accessToken: validatedResponse.access_token,\n idToken: validatedResponse.id_token,\n refreshToken: typeof validatedResponse.refresh_token === \"string\"\n ? validatedResponse.refresh_token\n : undefined,\n webId,\n dpopKey,\n expiresIn: validatedResponse.expires_in,\n };\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * Removes OIDC-specific query parameters from a given URL (state, code...), and\n * sanitizes the URL (e.g. removes the hash fragment).\n * @param redirectUrl The URL to clean up.\n * @returns A copy of the URL, without OIDC-specific query params.\n */\nfunction normalizeCallbackUrl(redirectUrl) {\n const cleanedUrl = removeOpenIdParams(redirectUrl);\n // As per https://tools.ietf.org/html/rfc6749#section-3.1.2, the redirect URL\n // must not include a hash fragment.\n cleanedUrl.hash = \"\";\n // Do not normalize the trailing slash, and respect the original redirect URL.\n if (\n // The trailing slash is present in the original redirect URL\n redirectUrl.includes(`${cleanedUrl.origin}/`)) {\n return cleanedUrl.href;\n }\n // Calling cleanedUrl.href appends a trailing slash to the origin, which may\n // create a redirect URL mismatch if it wasn't originally present.\n return `${cleanedUrl.origin}${cleanedUrl.href.substring(\n // Adds 1 to the origin length to remove the trailing slash\n cleanedUrl.origin.length + 1)}`;\n}\n/**\n * Clears any OIDC-related data lingering in the local storage.\n */\nasync function clearOidcPersistentStorage() {\n const store = new WebStorageStateStore({});\n await State.clearStaleState(store, 60 * 15);\n const myStorage = window.localStorage;\n const itemsToRemove = [];\n for (let i = 0; i <= myStorage.length; i += 1) {\n const key = myStorage.key(i);\n if (key &&\n (key.match(/^oidc\\..+$/) ||\n key.match(/^solidClientAuthenticationUser:.+$/))) {\n itemsToRemove.push(key);\n }\n }\n itemsToRemove.forEach((key) => myStorage.removeItem(key));\n}\n\nexport { clearOidcPersistentStorage, getTokens, normalizeCallbackUrl, refresh, registerClient };\n",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null],"names":["encoder","TextEncoder","decoder","TextDecoder","strictDecoder","fatal","concat","buffers","size","reduce","acc","length","buf","Uint8Array","i","buffer","set","NON_ASCII","encode","string","test","TypeError","bytes","code","charCodeAt","JOSEError","Error","static","constructor","message","options","super","this","name","captureStackTrace","JWTClaimValidationFailed","claim","reason","payload","cause","JWTExpired","JOSEAlgNotAllowed","JOSENotSupported","JWSInvalid","JWTInvalid","JWKSInvalid","JWKSNoMatchingKey","JWKSMultipleMatchingKeys","Symbol","asyncIterator","async","JWKSTimeout","JWSSignatureVerificationFailed","decode","input","encoded","url","fromBase64","alphabet","includes","replace","binary","atob","decodeBase64","prototype","toBase64","omitPadding","arr","push","String","fromCharCode","apply","subarray","btoa","join","encodeBase64","isObject","Object","toString","call","getPrototypeOf","isJwkSet","Array","isArray","keys","from","every","isDisjoint","headers","parameters","Set","header","parameter","has","add","decodeBase64url","value","label","ErrorClass","JWS_RECOGNIZED","__proto__","b64","validateAlgorithms","option","algorithms","some","s","validateCrit","Err","recognizedDefault","recognizedOption","protectedHeader","joseHeader","crit","recognized","hasOwn","validateB64","extensions","serializeJoseHeader","serialized","parsed","JSON","stringify","parse","prepareKey","entry","key","usage","alg","secret","privateKey","normalized","keyObject","jwk","snapshotJwk","ext","key_ops","keyOps","operation","normalizeJwk","kty","invalidKeyType","k","priv","d","use","expected","expectedKeyOp","ops","jwkMatchesOp","isFrozen","freeze","isKeyLike","expectedType","type","toStringTag","tag","isCryptoKey","export","cache","WeakMap","cacheKey","cached","get","toCryptoKey","isPublic","crv","nist","asymmetricKeyDetails","namedCurve","params","resolve","asymmetricKeyType","subtle","usages","format","jwkToKey","prime256v1","secp384r1","secp521r1","CryptoKey","isKeyObject","msg","actual","types","last","pop","unusable","prop","checkModulusLength","modulusLength","algorithm","checkCryptoKey","hash","checkUsage","extractable","isPrivate","keyData","crypto","importKey","rawKey","table","entries","out","wrap","derive","none","rsaes","bits","mode","ecdh","aeskw","gcm","pbes2","JWE","dir","A128KW","A192KW","A256KW","A128GCMKW","A192GCMKW","A256GCMKW","contentOps","contentEncryption","cbc","cekBits","ivBits","A128GCM","A192GCM","A256GCM","sig","hmac","signing","rsa","saltLength","minRsaBits","ecdsa","eddsa","mldsa","JWS","HS256","HS384","HS512","RS256","RS384","RS512","PS256","PS384","PS512","ES256","ES384","ES512","EdDSA","Ed25519","jwsAlgorithm","parseProtectedHeader","encodedProtected","parseJoseHeader","encodeCompactUnencodedPayload","verifySignature","jws","shared","encodeUnencodedPayload","parsedProtected","protected","inputPayload","parsedProt","signingPayload","resolvedKey","data","encodeBase64url","signature","cryptoKey","verified","verify","result","unprotectedHeader","epoch","date","Math","floor","getTime","multipliers","m","h","w","y","REGEX","checkFailed","invalidDuration","secs","str","matched","exec","parseFloat","numericDate2","round","toLowerCase","Number","isFinite","validateInput","validateStringClaim","numericDate","Date","normalizeTyp","validateNumericDate","required","unexpectedClaim","validateClaimsSet","encodedPayload","typ","requiredClaims","issuer","subject","audience","maxTokenAge","presenceCheck","reverse","audPayload","audOption","iss","sub","aud","clockTolerance","tolerance","currentDate","now","iat","nbf","exp","age","producerPayloads","producerPayload","producer","jwtVerify","jwt","split","verifyCompact","prepareVerify","createSignature","rejectUnencoded","protectedHeaderString","b64u","validateCritDuplicates","payloadS","payloadB","sign","SignJWT_base","structuredClone","setIssuer","setSubject","setAudience","member","validateAudienceClaim","setJti","jti","setNotBefore","setExpirationTime","setIssuedAt","SignJWT","setProtectedHeader","assertNotSet","createCompactSignature","jwtData","algArgument","unsupportedAlg","source","exportJWK","invalidKeyInput","exportKey","importWithAlgCache","pending","then","catch","error","createLocalJWKSet","jwks","snapshot","metadata","map","defineProperty","token","kid","candidates","filter","_","index","jwkKid","jwkAlg","indexOf","isUsableJWK","jwk2","USER_AGENT","navigator","userAgent","startsWith","customFetch","jwksCache","isFreshFor","timestamp","duration","validateDuration","fallback","isNaN","createRemoteJWKSet","URL","href","opts","timeoutOption","timeoutDuration","isInteger","cooldownDuration","cacheMaxAge","Headers","fetchImpl","jwksTimestamp","pendingFetch","local","reloadSequence","appliedSequence","uat","reload","WebSocketPair","EdgeRuntime","sequence","current","signal","fetch","response","method","redirect","err","status","json","fetchJwks","AbortSignal","timeout","next","updatedAt","finally","defineProperties","coolingDown","enumerable","fresh","reloading","getModulusLengthOption","generateKeyPair","keyAlgorithm","publicExponent","of","generateKey","byteToHex","slice","rnds8","v4","offset","randomUUID","rnds","random","rng","getRandomValues","unsafeStringify","_v4","SOLID_CLIENT_AUTHN_KEY_PREFIX","PREFERRED_SIGNING_ALG","EVENTS","ERROR","LOGIN","LOGOUT","NEW_REFRESH_TOKEN","NEW_TOKENS","AUTHORIZATION_REQUEST","SESSION_EXPIRED","SESSION_EXTENDED","SESSION_RESTORED","TIMEOUT_SET","DEFAULT_SCOPES","AggregateHandler","handleables","getProperHandler","canHandleList","Promise","all","handleable","canHandle","handle","handler","param","_err","getWebidFromTokenPayload","idToken","jwksIri","issuerIri","clientId","clientIdInPayload","verifiedPayload","e","stack","azp","webid","webId","isValidRedirectUrl","redirectUrl","urlObject","noReservedQuery","searchParams","noHash","_e","removeOpenIdParams","cleanedUpUrl","delete","AuthorizationCodeWithPkceOidcHandlerBase","storageUtility","redirector","parametersGuard","oidcLoginOptions","undefined","issuerConfiguration","grantTypesSupported","setupRedirectHandler","state","codeVerifier","targetUrl","setForUser","sessionId","dpop","Boolean","keepAlive","handleRedirect","GeneralLogoutHandler","sessionInfoManager","userId","clear","IRpLogoutHandler","logoutType","toLogoutUrl","IWaterfallLogoutHandler","handlers","getUnauthenticatedSession","isLoggedIn","args","storage","deleteAllUserData","secure","SessionInfoManagerBase","update","_sessionId","_options","_sessionInfo","getAll","register","getRegisteredSessionIdAll","clearAll","setOidcContext","_authorizationRequestState","maybeBuildRpInitiatedLogout","endSessionEndpoint","idTokenHint","postLogoutUrl","postLogoutRedirectUri","append","getEndSessionUrl","isValidUrl","handleRegistration","issuerConfig","clientRegistrar","clientInfo","scopesSupported","isSolidOidcClient","clientName","clientType","isStaticClient","getClient","clientSecret","infoToSave","boundFetch","request","init","ClientAuthentication$1","loginHandler","redirectHandler","logoutHandler","issuerConfigFetcher","boundLogout","logout","getSessionInfo","getAllSessionInfo","loadOidcContextFromStorage","configFetcher","storedRedirectIri","getForUser","errorIfNull","deleteForUser","fetchConfig","StorageUtility","secureStorage","insecureStorage","getKey","getUserData","stored","setUserData","userData","values","InMemoryStorage","ConfigurationError","NotImplementedError","methodName","InvalidResponseError","missingFields","OidcProviderError","errorDescription","normalizeHTU","audienceUrl","pathname","origin","createDpopHeader","dpopKey","htu","htm","toUpperCase","publicKey","buildAuthenticatedHeaders","authToken","defaultOptions","buildDpopFetchOptions","makeAuthenticatedRequest","accessToken","defaultRequestInit","unauthFetch","computeRefreshDelay","expiresIn","buildAuthenticatedFetch","latestTimeout","currentAccessToken","currentRefreshOptions","refreshOptions","emitter","eventEmitter","proactivelyRefreshToken","refreshedAccessToken","refreshToken","tokenSet","tokenRefresher","refresh","emit","refreshAccessToken","clearTimeout","setTimeout","expirationTimeout","requestInit","failedButNotExpectedAuthError","ok","statusCode","ReflectOwnKeys","R","Reflect","ReflectApply","target","receiver","Function","ownKeys","getOwnPropertySymbols","getOwnPropertyNames","NumberIsNaN","EventEmitter","eventsModule","exports","once","reject","errorListener","removeListener","resolver","arguments","eventTargetAgnosticAddListener","flags","on","addErrorHandlerIfEventEmitter","_events","_eventsCount","_maxListeners","defaultMaxListeners","checkListener","listener","_getMaxListeners","that","_addListener","prepend","events","existing","warning","create","newListener","unshift","warned","count","console","warn","onceWrapper","fired","wrapFn","_onceWrap","wrapped","bind","_listeners","unwrap","evlistener","ret","unwrapListeners","arrayClone","listenerCount","n","copy","addEventListener","wrapListener","arg","removeEventListener","RangeError","setMaxListeners","getMaxListeners","doError","er","context","len","listeners","addListener","prependListener","prependOnceListener","list","position","originalListener","shift","spliceOne","off","removeAllListeners","rawListeners","eventNames","StorageUtilityBrowser","InvalidTokenError","base64UrlDecode","output","decodeURIComponent","p","b64DecodeUnicode","level","logger","Log2","nopLogger","debug","info","Log","reset","setLevel","setLogger","Logger","_Logger","_name","_format","_method","methodLogger","createStatic","staticMethod","staticLogger","prefix","JwtUtils","pos","part","decoded","jwtDecode","generateSignedJwt","encodedToken","CryptoUtils","encodeBase64Url","window","generateSignedJwtWithHmac","secretKey","val","chr","_CryptoUtils","_randomWord","Uint32Array","generateUUIDv4","c","generateCodeVerifier","generateCodeChallenge","code_verifier","hashed","digest","generateBasicAuth","client_id","client_secret","msgUint8","hashBuffer","customCalculateJwkThumbprint","jsonObject","x","utf8encodedAndHashed","generateDPoPProof","httpMethod","keyPair","nonce","hashedToken","encodedHash","ath","publicJwk","generateDPoPJkt","generateDPoPKeys","generateClientAssertionJwt","hashFunction","Event","_callbacks","_logger","addHandler","cb","removeHandler","idx","lastIndexOf","splice","raise","ev","Timer","_Timer","_timerHandle","_expiration","_callback","diff","getEpochTime","cancel","durationInSeconds","logger2","max","expiration","timerDurationInSeconds","min","setInterval","clearInterval","UrlUtils","readParams","responseMode","URLSearchParams","URL_STATE_DELIMITER","ErrorResponse","form","_a","_b","_c","error_description","error_uri","userState","session_state","url_state","ErrorTimeout","InMemoryWebStorage","_data","getItem","setItem","removeItem","ErrorDPoPNonce","JsonService","additionalContentTypes","_jwtHandler","_extraHeaders","_contentTypes","fetchWithTimeout","timeoutInSeconds","initFetch","controller","AbortController","timeoutId","abort","DOMException","getJson","credentials","Accept","_appendExtraHeaders","contentType","find","item","throw","text","statusText","postForm","body","basicAuth","initCredentials","extraHeaders","responseText","customKeys","protectedHeaders","preventOverride","forEach","headerName","toLocaleLowerCase","content","MetadataService","_settings","_signingKeys","_metadata","_metadataUrl","metadataUrl","_jsonService","signingKeys","fetchRequestCredentials","_fetchRequestCredentials","resetSigningKeys","getMetadata","requestTimeoutInSeconds","assign","metadataSeed","getIssuer","_getMetadataProperty","getAuthorizationEndpoint","getUserInfoEndpoint","getTokenEndpoint","optional","getCheckSessionIframe","getEndSessionEndpoint","getRevocationEndpoint","getKeysEndpoint","getSigningKeys","jwks_uri","keySet","WebStorageStateStore","store","localStorage","_store","_prefix","remove","getAllKeys","substr","OidcClientSettingsStore","authority","response_type","scope","redirect_uri","post_logout_redirect_uri","client_authentication","token_endpoint_auth_signing_alg","prompt","display","max_age","ui_locales","acr_values","resource","response_mode","filterProtocolClaims","loadUserInfo","staleStateAgeInSeconds","mergeClaimsStrategy","array","disablePKCE","stateStore","revokeTokenAdditionalContentTypes","refreshTokenAllowedScope","extraQueryParams","extraTokenParams","omitScopeWhenRequesting","endsWith","UserInfoService","_metadataService","_getClaimsFromJwt","getClaims","claims","TokenClient","exchangeCode","grant_type","clientAssertion","exchangeCredentials","exchangeRefreshToken","refresh_token","revoke","token_type_hint","ResponseValidator","_claimsService","_userInfoService","_tokenClient","validateSigninResponse","_processSigninState","_processCode","isOpenId","_validateIdTokenAttributes","_processClaims","skipUserInfo","validateCredentialsResponse","shouldValidateSubClaim","id_token","validateRefreshResponse","profile","hasIdToken","validateSignoutResponse","id","validateSub","access_token","mergeClaims","tokenResponse","existingToken","incoming","auth_time","State","_State","created","request_type","toStorageString","fromStorageString","storageString","clearStaleState","cutoff","SigninState","_SigninState","code_challenge","_SigninRequest","state_data","dpopJkt","optionalParams","parsedUrl","stateParam","r","SigninRequest","SigninResponse","token_type","splitState","expires_in","expires_at","SignoutRequest","id_token_hint","SignoutResponse","DefaultProtocolClaims","InternalRequiredProtocolClaims","ClaimsService","protocolClaims","claims1","claims2","mergedValues","DPoPState","OidcClient","settings","metadataService","_validator","createSigninRequest","request_uri","login_hint","signinRequest","signinState","readSigninResponseState","removeState","storedStateString","processSigninResponse","dpopProof","getDpopProof","DPoP","dpopStore","dpopState","processResourceOwnerPasswordCredentials","username","password","signinResponse","useRefreshToken","allowableScopes","createSignoutRequest","signoutState","readSignoutResponseState","processSignoutResponse","revokeToken","validateRegistrationResponse","responseBody","redirect_uris","uri","hasRedirectUri","registerClient","registrationEndpoint","idTokenSigningAlgValuesSupported","signingAlg","supported","config","client_name","application_type","subject_type","token_endpoint_auth_method","id_token_signed_response_alg","grant_types","registerResponse","expiresAt","client_secret_expires_at","idTokenSignedResponseAlg","processErrorResponse","hasErrorDescription","validateTokenEndpointResponse","hasErrorUri","hasAccessToken","hasTokenType","hasExpiresIn","getTokens","client","grantType","tokenEndpoint","validatePreconditions","dpopKeyPair","generateDpopKeyPair","Authorization","requestBody","tokenRequestInit","rawTokenResponse","jwksUri","dpopHeader","authHeader","rawResponse","validatedResponse","ClientAuthentication","ClientAuthenticationBase","login","cleanedUrl","substring","normalizeCallbackUrl","location","validateCurrentSession","currentSessionId","sessionInfo","clientAppId","clientExpiresAt","isClientExpired","handleIncomingRedirect","redirectInfo","getLogoutUrl","cleanUrlAfterRedirect","expirationDate","history","replaceState","hasIssuer","oidcIssuer","hasRedirectUrl","OidcLoginHandler","oidcHandler","clientRegistration","OidcOptions","tokenType","scopes","customScopes","AuthorizationCodeWithPkceOidcHandler","redirectUri","oidcOptions","oidcClientLibrary","signingRequest","issuerConfigKeyMap","toKey","convertToUrl","authorization_endpoint","token_endpoint","userinfo_endpoint","registration_endpoint","end_session_endpoint","scopes_supported","response_types_supported","response_modes_supported","grant_types_supported","acr_values_supported","subject_types_supported","id_token_signing_alg_values_supported","id_token_encryption_alg_values_supported","id_token_encryption_enc_values_supported","userinfo_signing_alg_values_supported","userinfo_encryption_alg_values_supported","userinfo_encryption_enc_values_supported","request_object_signing_alg_values_supported","request_object_encryption_alg_values_supported","request_object_encryption_enc_values_supported","token_endpoint_auth_methods_supported","token_endpoint_auth_signing_alg_values_supported","display_values_supported","claim_types_supported","claims_supported","service_documentation","claims_locales_supported","ui_locales_supported","claims_parameter_supported","request_parameter_supported","request_uri_parameter_supported","require_request_uri_registration","op_policy_uri","op_tos_uri","IssuerConfigFetcher","getLocalStorageKey","openIdConfigUrl","issuerConfigRequestBody","parsedConfig","processConfig","clearBase","myStorage","itemsToRemove","match","clearOidcPersistentStorage","SessionInfoManager","clientAppSecret","parseInt","FallbackRedirectHandler","_redirectUrl","AuthCodeRedirectHandler","tokerRefresher","myUrl","oauthState","storedSessionId","isDpop","tokenCreatedAt","tokens","authFetch","saveSessionInfoToStorage","AggregateRedirectHandler","redirectHandlers","BrowserStorage","Redirector","redirectByReplacingState","ClientRegistrar","storedClientId","storedClientSecret","storedClientName","storedClientType","expired","registeredClient","ErrorOidcHandler","errorUrl","errorDescriptionUrl","TokenRefresher","oidcContext","getClientAuthenticationWithDependencies","dependencies","inMemoryStorage","KEY_CURRENT_SESSION","KEY_CURRENT_URL","Session","clientAuthentication","tokenRequestInProgress","sessionOptions","internalLogout","emitSignal","inputOptions","setSessionInfo","currentUrl","restorePreviousSession","clientAuthn","session","storedSessionInfo","silentlyAuthenticate","defaultSession","getDefaultSession"],"mappings":"uDAAK,MAACA,EAAU,IAAIC,YAAeC,EAAU,IAAIC,YAAeC,EAAgB,IAAID,YAAY,QAAS,CAAEE,OAAO,IAClH,SAASC,KAAUC,GACjB,MAAMC,EAAOD,EAAQE,OAAO,CAACC,GAAOC,YAAaD,EAAMC,EAAQ,GAAIC,EAAM,IAAIC,WAAWL,GACxF,IAAIM,EAAI,EACR,IAAK,MAAMC,KAAUR,EACnBK,EAAII,IAAID,EAAQD,GAAIA,GAAKC,EAAOJ,OAClC,OAAOC,CACT,CAcA,MAAMK,EAAY,eAClB,SAASC,EAAOC,GACd,GAAqB,iBAAVA,GAAsBA,EAAOR,QAAU,IAAK,CACrD,GAAIM,EAAUG,KAAKD,GACjB,MAAM,IAAIE,UAAU,4CACtB,OAAOrB,EAAQkB,OAAOC,EACvB,CACD,MAAMG,EAAQ,IAAIT,WAAWM,EAAOR,QACpC,IAAK,IAAIG,EAAI,EAAGA,EAAIK,EAAOR,OAAQG,IAAK,CACtC,MAAMS,EAAOJ,EAAOK,WAAWV,GAC/B,GAAIS,EAAO,IACT,MAAM,IAAIF,UAAU,4CACtBC,EAAMR,GAAKS,CACZ,CACD,OAAOD,CACT,CCpCA,MAAMG,UAAkBC,MACtBC,YAAc,mBACdJ,KAAO,mBACP,WAAAK,CAAYC,EAASC,GACnBC,MAAMF,EAASC,GAAUE,KAAKC,KAAOD,KAAKJ,YAAYK,KAAMP,MAAMQ,oBAAoBF,KAAMA,KAAKJ,YAClG,EAEH,MAAMO,UAAiCV,EACrCE,YAAc,kCACdJ,KAAO,kCACPa,MACAC,OACAC,QACA,WAAAV,CAAYC,EAASS,EAASF,EAAQ,cAAeC,EAAS,eAC5DN,MAAMF,EAAS,CAAEU,MAAO,CAAEH,QAAOC,SAAQC,aAAcN,KAAKI,MAAQA,EAAOJ,KAAKK,OAASA,EAAQL,KAAKM,QAAUA,CACjH,EAEH,MAAME,UAAmBf,EACvBE,YAAc,kBACdJ,KAAO,kBACPa,MACAC,OACAC,QACA,WAAAV,CAAYC,EAASS,EAASF,EAAQ,cAAeC,EAAS,eAC5DN,MAAMF,EAAS,CAAEU,MAAO,CAAEH,QAAOC,SAAQC,aAAcN,KAAKI,MAAQA,EAAOJ,KAAKK,OAASA,EAAQL,KAAKM,QAAUA,CACjH,EAEH,MAAMG,UAA0BhB,EAC9BE,YAAc,2BACdJ,KAAO,2BAET,MAAMmB,UAAyBjB,EAC7BE,YAAc,yBACdJ,KAAO,yBAaT,MAAMoB,UAAmBlB,EACvBE,YAAc,kBACdJ,KAAO,kBAET,MAAMqB,UAAmBnB,EACvBE,YAAc,kBACdJ,KAAO,kBAMT,MAAMsB,UAAoBpB,EACxBE,YAAc,mBACdJ,KAAO,mBAET,MAAMuB,UAA0BrB,EAC9BE,YAAc,2BACdJ,KAAO,2BACP,WAAAK,CAAYC,EAAU,kDAAmDC,GACvEC,MAAMF,EAASC,EAChB,EAEH,MAAMiB,UAAiCtB,EACrC,CAACuB,OAAOC,eAAiBC,kBAC3B,EACEvB,YAAc,kCACdJ,KAAO,kCACP,WAAAK,CAAYC,EAAU,uDAAwDC,GAC5EC,MAAMF,EAASC,EAChB,EAEH,MAAMqB,UAAoB1B,EACxBE,YAAc,mBACdJ,KAAO,mBACP,WAAAK,CAAYC,EAAU,oBAAqBC,GACzCC,MAAMF,EAASC,EAChB,EAEH,MAAMsB,UAAuC3B,EAC3CE,YAAc,wCACdJ,KAAO,wCACP,WAAAK,CAAYC,EAAU,gCAAiCC,GACrDC,MAAMF,EAASC,EAChB,ECxFH,SAASuB,EAAOC,GACd,IACE,OF0CJ,SAAsBC,EAASC,GAAM,GACnC,GAAI3C,WAAW4C,WACb,OAAO5C,WAAW4C,WAAWF,EAAS,CAAEG,SAAUF,EAAM,YAAc,WACxE,GAAIA,EAAK,CACP,GAAID,EAAQI,SAAS,MAAQJ,EAAQI,SAAS,KAC5C,MAAM,IAAItC,UAAU,qBACtBkC,EAAUA,EAAQK,QAAQ,KAAM,KAAKA,QAAQ,KAAM,IACpD,CACD,MAAMC,EAASC,KAAKP,GAAUjC,EAAQ,IAAIT,WAAWgD,EAAOlD,QAC5D,IAAK,IAAIG,EAAI,EAAGA,EAAI+C,EAAOlD,OAAQG,IACjCQ,EAAMR,GAAK+C,EAAOrC,WAAWV,GAC/B,OAAOQ,CACT,CEtDWyC,CAA6B,iBAATT,EAAoBA,EAAQpD,EAAQmD,OAAOC,IAAQ,EAC/E,CAAC,MAAOf,GACP,MAAM,IAAIlB,UALE,oDAKiB,CAAEkB,SAChC,CACH,CACA,SAASrB,EAAOoC,GACd,OF2BF,SAAsBA,EAAOE,GAAM,GACjC,GAAI3C,WAAWmD,UAAUC,SACvB,OAAOX,EAAMW,SAAS,CAAEP,SAAUF,EAAM,YAAc,SAAUU,YAAaV,IAC/E,MAA0BW,EAAM,GAChC,IAAK,IAAIrD,EAAI,EAAGA,EAAIwC,EAAM3C,OAAQG,GADf,MAEjBqD,EAAIC,KAAKC,OAAOC,aAAaC,MAAM,KAAMjB,EAAMkB,SAAS1D,EAAGA,EAF1C,SAGnB,MAAMyC,EAAUkB,KAAKN,EAAIO,KAAK,KAC9B,OAAOlB,EAAMD,EAAQK,QAAQ,KAAM,IAAIA,QAAQ,MAAO,KAAKA,QAAQ,MAAO,KAAOL,CACnF,CEnCSoB,CAA6B,iBAATrB,EAAoBtD,EAAQkB,OAAOoC,GAASA,GAAO,EAChF,CCJA,SAASsB,EAAStB,GAChB,GAAoB,iBAATA,GAA+B,OAAVA,GAA4D,oBAA1CuB,OAAOb,UAAUc,SAASC,KAAKzB,GAC/E,OAAO,EACT,MAAMU,EAAYa,OAAOG,eAAe1B,GACxC,OAAqB,OAAdU,GAA2D,OAArCa,OAAOG,eAAehB,EACrD,CACA,SAASiB,EAAS3B,GAChB,OAAOsB,EAAStB,IAAU4B,MAAMC,QAAQ7B,EAAM8B,OAASF,MAAMG,KAAK/B,EAAM8B,MAAME,MAAMV,EACtF,CACA,SAASW,KAAcC,GACrB,MAAMC,EAA6B,IAAIC,IACvC,IAAK,MAAMC,KAAUH,EACnB,GAAIG,EACF,IAAK,MAAMC,KAAaf,OAAOO,KAAKO,GAAS,CAC3C,GAAIF,EAAWI,IAAID,GACjB,OAAO,EACTH,EAAWK,IAAIF,EAChB,CACL,OAAO,CACT,CAKA,SAASG,EAAgBC,EAAOC,EAAOC,GACrC,IACE,OAAO7C,EAAO2C,EAClB,CAAI,MACA,MAAM,IAAIE,EAAW,kCAAkCD,IACxD,CACH,CAmBK,MAACE,EAAiB,CAAEC,UAAW,KAAMC,KAAK,GAC/C,SAASC,EAAmBC,EAAQC,GAClC,QAAwB,IAApBA,KAA2BtB,MAAMC,QAAQqB,IAAeA,EAAWC,KAAMC,GAAkB,iBAALA,IACxF,MAAM,IAAIrF,UAAU,IAAIkF,yCAC1B,YAA2B,IAApBC,OAA6B,EAAI,IAAId,IAAIc,EAClD,CAMA,SAASG,EAAaC,EAAKC,EAAmBC,EAAkBC,EAAiBC,GAC/E,QAA6B,IAAzBA,EAAWC,WAAkD,IAA/BF,GAAiBE,KACjD,MAAM,IAAIL,EAAI,kEAChB,IAAKG,QAAiD,IAA9BA,EAAgBE,KACtC,MAAO,GACT,IAAK/B,MAAMC,QAAQ4B,EAAgBE,OAAyC,IAAhCF,EAAgBE,KAAKtG,QAAgBoG,EAAgBE,KAAKR,KAAMnD,GAA0B,iBAATA,GAAsC,IAAjBA,EAAM3C,QACtJ,MAAM,IAAIiG,EAAI,yFAChB,MAAMM,OAAuC,IAA1BJ,EAA8BD,EAAoB,CAAET,UAAW,QAASU,KAAqBD,GAChH,IAAK,MAAMjB,KAAamB,EAAgBE,KAAM,CAC5C,KAAMrB,KAAasB,GACjB,MAAM,IAAIxE,EAAiB,+BAA+BkD,wBAC5D,IAAKf,OAAOsC,OAAOH,EAAYpB,SAA6C,IAA/BoB,EAAWpB,GACtD,MAAM,IAAIgB,EAAI,+BAA+BhB,iBAC/C,GAAIsB,EAAWtB,MAAgBf,OAAOsC,OAAOJ,EAAiBnB,SAAkD,IAApCmB,EAAgBnB,IAC1F,MAAM,IAAIgB,EAAI,+BAA+BhB,iCAChD,CACD,OAAOmB,EAAgBE,IACzB,CACA,SAASG,EAAYL,EAAiBM,GACpC,GAAIA,EAAW1D,SAAS,OAAQ,CAC9B,MAAM0C,EAAMU,EAAgBV,IAC5B,GAAkB,kBAAPA,EACT,MAAM,IAAI1D,EAAW,2EACvB,OAAO0D,CACR,CACD,OAAO,CACT,CACA,SAASiB,EAAoBV,EAAKjB,GAChC,IAAI4B,EAAYC,EAChB,IACED,EAAaE,KAAKC,UAAU/B,GAAS6B,EAASC,KAAKE,MAAMJ,EAC1D,CAAC,MAAOhF,GACP,MAAM,IAAIqE,EAAI,gCAAiC,CAAErE,SAClD,CACD,IAAKqC,EAAS4C,GACZ,MAAM,IAAIZ,EAAI,oCAChB,MAAO,CAACY,EAAQD,EAClB,CCtFArE,eAAe0E,EAAWC,EAAOC,EAAKC,GACpC,MAAMC,IAAEA,EAAGC,OAAEA,GAAWJ,EAAOK,EAAuB,YAAVH,GAAiC,SAAVA,EACnE,GAAIE,GAAUH,aAAejH,WAC3B,OAAOiH,EACT,IAAIK,EAAYC,EAChB,GAAIxD,EAASkD,GAAM,CACjB,GAAIK,EAyFR,SAAsBE,GACpB,MAAMF,EAAaG,EAAYD,GAC/B,QAA4B,IAAxBF,EAAWI,KAA2C,kBAAlBJ,EAAWI,IACjD,MAAM,IAAIlH,UAAU,mDACtB,QAAgC,IAA5B8G,EAAWK,QAAoB,CACjC,MAAMxC,EAAQmC,EAAWK,QAASC,EAASvD,MAAMC,QAAQa,GAAS,IAAIA,QAAc,EACpF,IAAKyC,GAAUA,EAAOhC,KAAMiC,GAAkC,iBAAbA,IAA0B,IAAIhD,IAAI+C,GAAQjI,OAASiI,EAAO9H,OACzG,MAAM,IAAIU,UAAU,2EACtB8G,EAAWK,QAAUC,CACtB,CACD,OAAON,CACT,CApGqBQ,CAAab,GAA+B,iBAAlBK,EAAWS,IACpD,MAAMC,EAAeb,EAAKF,EAAKG,GACjC,KAAMA,EAA4B,QAAnBE,EAAWS,KAAwC,iBAAhBT,EAAWW,EAAmC,QAAnBX,EAAWS,MAAkBV,EAAgC,QAAnBC,EAAWS,KAA2C,iBAAnBT,EAAWY,MAA2C,iBAAhBZ,EAAWa,OAAsC,IAAtBb,EAAWa,QAAyC,IAAzBb,EAAWY,OAC/P,MAAM,IAAI1H,UAAU4G,EAAS,0HAA4H,6CAA6CC,EAAa,UAAY,gBACjO,GAzByD,EAACL,EAAOC,EAAKC,KACxE,MAAMC,IAAEA,GAAQH,EAChB,QAAqB,IAAjBC,EAAImB,IAAgB,CACtB,MAAMC,EAAqB,SAAVnB,GAA8B,WAAVA,EAAqB,MAAQ,MAClE,GAAID,EAAImB,MAAQC,EACd,MAAM,IAAI7H,UAAU,sDAAsD6H,kBAC7E,CACD,QAAqB,IAAjBpB,EAAIE,KAAkBF,EAAIE,MAAQA,EACpC,MAAM,IAAI3G,UAAU,sDAAsD2G,mBAC5E,GAAI9C,MAAMC,QAAQ2C,EAAIU,SAAU,CAC9B,MAAMW,EAA0B,YAAVpB,GAAiC,YAAVA,EAAsBF,EAAMuB,MAAgB,YAAVrB,EAAsB,EAAI,GAAKA,EAC9G,GAAIoB,IAAkBrB,EAAIU,QAAQ7E,SAASwF,GACzC,MAAM,IAAI9H,UAAU,+DAA+D8H,kBACtF,GAYKE,CAAaxB,EAAOM,EAAYJ,GAA2B,QAAnBI,EAAWS,IACrD,OAAOvF,EAAO8E,EAAWW,GAC3B,IAAKjE,OAAOyE,SAASxB,GAAM,CACzB,MAAMU,QAAEA,GAAYV,EACpB5C,MAAMC,QAAQqD,IAAY3D,OAAO0E,OAAOf,GAAU3D,OAAO0E,OAAOzB,EACjE,CACL,KAAS,CACL,IAAK0B,EAAU1B,GACb,MAAMe,EAAeb,EAAKF,EAAKG,GACjC,MAAMwB,EAAexB,EAAS,SAAWC,EAAa,UAAY,SAClE,GAAIJ,EAAI4B,OAASD,IAAiBxB,GAAU,CAAC,SAAU,SAAU,WAAWtE,SAASmE,EAAI4B,OACvF,MAAM,IAAIrI,UAAU,GApCd,CAACyG,GAAQA,EAAI9E,OAAO2G,aAoCHC,CAAI9B,iCAAmC2B,cAAyBzB,eACzF,GAAI6B,EAAY/B,GACd,OAAOA,EACT,GAAIM,EAAYN,EAAwB,WAAnBM,EAAUsB,KAC7B,OAAOtB,EAAU0B,QACpB,CACDC,IAA0B,IAAIC,QAC9B,MAAMC,EAAWnC,EACjB,IAAIoC,EAASH,EAAMI,IAAIF,GACvB,GAAIC,IAASlC,GACX,OAAOkC,EAAOlC,GAChB,GAAIkC,GAAUH,EAAM/I,IAAIiJ,EAAUC,EAAS,IAAK9B,GAA6C,mBAAzBA,EAAUgC,YAA2B,CACvG,MAAMC,EAA8B,WAAnBjC,EAAUsB,KAAmBY,EAAMC,EAAKnC,EAAUoC,sBAAsBC,YAAaC,EAAS7C,EAAM8C,UAAU,CAAEL,MAAKM,kBAAmBxC,EAAUwC,qBAAwB/C,EAAMgD,OACjM,OAAOX,EAAOlC,GAAOI,EAAUgC,YAAYM,EAAQL,EAAUxC,EAAMiD,OAAOT,EAAW,EAAI,GAC1F,CACD,OAAOlC,IAAeC,EAAU0B,OAAO,CAAEiB,OAAQ,QAAU5C,EAAWH,IAAMA,EAAKkC,EAAOlC,SAAagD,EAASnD,EAAOM,EACvH,CACA,IAAI4B,EACJ,MAAMQ,EAAO,CACXnE,UAAW,KACX6E,WAAY,QACZC,UAAW,QACXC,UAAW,SAMPtB,EAAe/B,IACnB,GAAkC,cAA9BA,IAAM9E,OAAO2G,aACf,OAAO,EACT,IACE,OAAO7B,aAAesD,SAC1B,CAAI,MACA,OAAO,CACR,GACAC,EAAevD,GAAsC,cAA9BA,IAAM9E,OAAO2G,aAA8BH,EAAa1B,GAAQ+B,EAAY/B,IAAQuD,EAAYvD,GAC1H,SAASjG,EAAQyJ,EAAKC,KAAWC,GAC/B,GAAIA,EAAM7K,OAAS,EAAG,CACpB,MAAM8K,EAAOD,EAAME,MACnBJ,GAAO,eAAeE,EAAM9G,KAAK,aAAa+G,IAClD,MAA0B,IAAjBD,EAAM7K,OAAe2K,GAAO,eAAeE,EAAM,SAASA,EAAM,MAAQF,GAAO,WAAWE,EAAM,MACvG,OAAiB,MAAVD,EAAiBD,GAAO,aAAaC,IAA4B,mBAAVA,GAAwBA,EAAOtJ,KAAOqJ,GAAO,sBAAsBC,EAAOtJ,OAA0B,iBAAVsJ,GAAgC,MAAVA,GAAkBA,EAAO3J,aAAaK,OAASqJ,GAAO,4BAA4BC,EAAO3J,YAAYK,QAASqJ,CAC9R,CAEA,SAASzC,EAAeb,EAAKuD,EAAQtD,GACnC,MAAMuD,EAAQ,CAAC,YAAa,YAAa,gBACzC,OAAOvD,GAAUuD,EAAMpH,KAAK,cAAe,IAAI/C,UAAUQ,EAAQ,eAAemG,uBAA0BuD,KAAWC,GACvH,CACA,MAAMG,EAAW,CAAC1J,EAAM2J,EAAO,mBAAqB,IAAIvK,UAAU,kDAAkDuK,aAAgB3J,KAKpI,SAAS4J,EAAmB7D,EAAKF,GAC/B,MAAMgE,cAAEA,GAAkBhE,EAAIiE,UAC9B,GAA4B,iBAAjBD,GAA6BA,EAAgB,KACtD,MAAM,IAAIzK,UAAU,GAAG2G,yDAC3B,CACA,SAASgE,EAAelE,EAAKoB,EAAUnB,GACrC,MAAMgE,EAAYjE,EAAIiE,UACtB,GAAIA,EAAU9J,OAASiH,EAASjH,KAC9B,MAAM0J,EAASzC,EAASjH,MAC1B,GAAIiH,EAAS+C,MAAQF,EAAUE,MAAMhK,OAASiH,EAAS+C,KACrD,MAAMN,EAASzC,EAAS+C,KAAM,kBAChC,GAAI/C,EAASuB,YAAcsB,EAAUtB,aAAevB,EAASuB,WAC3D,MAAMkB,EAASzC,EAASuB,WAAY,wBACtC,QAA6B,IAAzBvB,EAASvI,QAAqBoL,EAAUpL,SAAWuI,EAASvI,OAC9D,MAAMgL,EAASzC,EAASvI,OAAQ,qBAlBpC,SAAoBmH,EAAKC,GACvB,GAAIA,IAAUD,EAAIgD,OAAOnH,SAASoE,GAChC,MAAM,IAAI1G,UAAU,sEAAsE0G,KAC9F,CAgBEmE,CAAWpE,EAAKC,EAClB,CACA,SAASO,EAAYD,GACnB,MAAO,CAAEjC,UAAW,QAASiC,EAC/B,CAkBAnF,eAAe8H,EAASnD,EAAOQ,EAAK8D,GAClC,IAAKtE,EAAMe,IAAIjF,SAAS0E,EAAIO,KAC1B,MAAM,IAAIlG,EAAiB,gEAC7B,MAAMqJ,EAAYlE,EAAM8C,UAAU,CAAE/B,IAAKP,EAAIO,IAAK0B,IAAKjC,EAAIiC,OAAUzC,EAAMgD,OAAQuB,KAAe/D,EAAIW,IAAKX,EAAIU,MAAOsD,EAAU,IAAKhE,EAAKE,IAAK4D,GAAe9D,EAAIE,KAClK,MAAuB,QAAhB8D,EAAQzD,YAAwByD,EAAQrE,WAAYqE,EAAQpD,IAAKqD,OAAOzB,OAAO0B,UAAU,MAAOF,EAASN,EAAWM,EAAQ9D,MAAQ6D,EAAW/D,EAAIG,SAAWX,EAAMiD,OAAOsB,EAAY,EAAI,GACpM,CACAlJ,eAAesJ,EAAO1E,EAAKoB,EAAUnB,EAAOoE,GAAc,GACxD,OAAOrE,aAAejH,aAAeiH,QAAYwE,OAAOzB,OAAO0B,UAAU,MAAOzE,EAAKoB,EAAUiD,EAAa,CAACpE,KAAUiE,EAAelE,EAAKoB,EAAUnB,GAAQD,CAC/J,CC1IA,SAAS2E,EAAMC,GACb,MAAMC,EAAM,CAAEvG,UAAW,MACzB,IAAK,MAAM4B,KAAO0E,EAChBC,EAAI3E,GAAO,IAAK0E,EAAQ1E,GAAMA,OAChC,OAAO2E,CACT,CCHA,MAAMC,EAAO,CACX,CAAC,UAAW,WACZ,CAAC,UAAW,cACXC,EAAS,CAAC,GAAI,CAAC,eAAgBC,EAAO,CAAC,GAAI,IAC9C,SAASC,EAAMC,GACb,MAAO,CACLpE,IAAK,CAAC,OACNqE,KAAM,iBACNpC,OAAQ,CAAE5I,KAAM,WAAYgK,KAAM,OAAOe,KACzClC,OAAQ8B,EACRxD,IAAK,CAAC,UAAW,aAErB,CACA,SAAS8D,EAAKD,GACZ,MAAO,CACLrE,IAAK,CAAC,KAAM,OACZqE,OACApC,OAAQ,CAAE5I,KAAM,QAChB0I,QAAS,EAAG/B,MAAK0B,MAAKM,wBACpB,GAAY,WAARN,GAA0C,WAAtBM,EACtB,MAAO,CAAE3I,KAAM,UACjB,GAAY,QAAR2G,EACF,MAAM,IAAIlG,EAAiB,gEAC7B,MAAO,CAAET,KAAM,OAAQwI,WAAYH,IAErCQ,OAAQ+B,EACRzD,IAAK,MAAM,EAAG,cAElB,CACA,SAAS+D,EAAMH,EAAMI,GAAM,GACzB,MAAO,CACLxE,IAAK,CAAC,OACNqE,KAAM,eACNhF,QAAQ,EACR4C,OAAQ,CAAE5I,KAAMmL,EAAM,UAAY,SAAUzM,OAAQqM,GACpDlC,OAAQgC,EACR1D,IAAKgE,EAAM,CAAC,UAAW,WAAa,CAAC,UAAW,aAEpD,CACA,SAASC,IACP,MAAO,CACLzE,IAAK,CAAC,OACNqE,KAAM,eACNhF,QAAQ,EACR4C,OAAQ,CAAE5I,KAAM,UAChB6I,OAAQgC,EACR1D,IAAK,CAAC,aAAc,cAExB,CACA,MAAMkE,EAAMb,EAAM,CAChBc,IAAK,CACH3E,IAAK,CAAC,OACNqE,KAAM,oBACNhF,QAAQ,EACR4C,OAAQ,CAAE5I,KAAM,WAChB6I,OAAQgC,EACR1D,IAAK,CAAC,UAAW,YAEnB,WAAY2D,EAAM,GAClB,eAAgBA,EAAM,KACtB,eAAgBA,EAAM,KACtB,eAAgBA,EAAM,KACtB,UAAWG,EAAK,wBAChB,iBAAkBA,EAAK,mCACvB,iBAAkBA,EAAK,mCACvB,iBAAkBA,EAAK,mCACvBM,OAAQL,EAAM,KACdM,OAAQN,EAAM,KACdO,OAAQP,EAAM,KACdQ,UAAWR,EAAM,KAAK,GACtBS,UAAWT,EAAM,KAAK,GACtBU,UAAWV,EAAM,KAAK,GACtB,qBAAsBE,IACtB,qBAAsBA,IACtB,qBAAsBA,MACpBS,EAAa,CAAC,UAAW,WAC7B,SAASC,GAAkBf,EAAMgB,GAAM,GACrC,MAAO,CACLpF,IAAK,CAAC,OACNX,QAAQ,EACR4C,OAAQ,CAAE5I,KAAM+L,EAAM,UAAY,UAAWrN,OAAQqM,GACrDlC,OAAQgC,EACR1D,IAAK0E,EACLG,QAASjB,EACTkB,OAAQF,EAAM,IAAM,GACpBA,MAEJ,CACYvB,EAAM,CAChB0B,QAASJ,GAAkB,KAC3BK,QAASL,GAAkB,KAC3BM,QAASN,GAAkB,KAC3B,gBAAiBA,GAAkB,KAAK,GACxC,gBAAiBA,GAAkB,KAAK,GACxC,gBAAiBA,GAAkB,KAAK,KC9F1C,MAAMO,GAAM,CAAC,CAAC,UAAW,CAAC,SAC1B,SAASC,GAAKvB,GACZ,MAAMnC,EAAS,CAAE5I,KAAM,OAAQgK,KAAM,OAAOe,KAC5C,MAAO,CAAEpE,IAAK,CAAC,OAAQX,QAAQ,EAAI4C,SAAQ2D,QAAS3D,EAAQC,OAAQwD,GACtE,CACA,SAASG,GAAIzB,EAAM0B,GACjB,MAAM7D,EAAS,CAAE5I,KAAMyM,EAAa,UAAY,oBAAqBzC,KAAM,OAAOe,KAClF,MAAO,CACLpE,IAAK,CAAC,OACNiC,SACA2D,QAASE,EAAa,IAAK7D,EAAQ6D,cAAe7D,EAClDC,OAAQwD,GACRK,WAAY,KAEhB,CACA,SAASC,GAAMtE,EAAK0C,GAClB,MAAO,CACLpE,IAAK,CAAC,MACN0B,MACAO,OAAQ,CAAE5I,KAAM,QAASwI,WAAYH,GACrCkE,QAAS,CAAEvM,KAAM,QAASgK,KAAM,OAAOe,KACvClC,OAAQwD,GAEZ,CACA,SAASO,KACP,MAAMhE,EAAS,CAAE5I,KAAM,WACvB,MAAO,CACL2G,IAAK,CAAC,OACN0B,IAAK,UACLO,SACA2D,QAAS3D,EACTC,OAAQwD,GAEZ,CACA,SAASQ,GAAM9B,GACb,MAAMnC,EAAS,CAAE5I,KAAM,UAAU+K,KACjC,MAAO,CACLpE,IAAK,CAAC,OACNiC,SACA2D,QAAS3D,EACTC,OAAQwD,GAEZ,CACA,MAAMS,GAAMtC,EAAM,CAChBuC,MAAOT,GAAK,KACZU,MAAOV,GAAK,KACZW,MAAOX,GAAK,KACZY,MAAOV,GAAI,KACXW,MAAOX,GAAI,KACXY,MAAOZ,GAAI,KACXa,MAAOb,GAAI,IAAK,IAChBc,MAAOd,GAAI,IAAK,IAChBe,MAAOf,GAAI,IAAK,IAChBgB,MAAOb,GAAM,QAAS,KACtBc,MAAOd,GAAM,QAAS,KACtBe,MAAOf,GAAM,QAAS,KACtBgB,MAAOf,KACPgB,QAAShB,KACT,YAAaC,GAAM,IACnB,YAAaA,GAAM,IACnB,YAAaA,GAAM,MAErB,SAASgB,GAAa9H,GACpB,MAAMH,EAAsB,iBAAPG,EAAkB+G,GAAI/G,QAAY,EACvD,IAAKH,EACH,MAAM,IAAInF,EAAiB,OAAOsF,gEACpC,OAAOH,CACT,CC5CA,SAASkI,GAAqBC,GAC5B,YAAiC,IAA1BA,EAA8B,CAAE,ELmBzC,SAAyB3J,EAAKH,EAAYrE,GACxC,IAAI2F,EACJ,IACEA,EAASC,KAAKE,MAAMvH,EAAciD,OAAOA,EAAOgD,IACpD,CAAI,MACA,MAAM,IAAIH,EAAWrE,EACtB,CACD,IAAK+C,EAAS4C,GACZ,MAAM,IAAItB,EAAWrE,GACvB,OAAO2F,CACT,CK7B4CyI,CAAgBD,EAAkBrN,EAAY,kCAC1F,CAOA,SAASuN,GAA8B5N,GACrC,IACE,OAAOpB,EAAOoB,EAClB,CAAI,MACA,MAAM,IAAIK,EAAW,mEACtB,CACH,CACAO,eAAeiN,GAAgBC,EAAKC,EAAQvI,EAAKwI,EAAwBC,GACvE,MAAQC,UAAWR,EAAgBrK,OAAEA,EAAQrD,QAASmO,GAAiBL,EAAKM,EAAgCX,GAAqBC,GACjI,IAAKzK,EAAWmL,EAAY/K,GAC1B,MAAM,IAAIhD,EAAW,6EACvB,MAAMqE,EAAa,IAAK0J,KAAe/K,GAAUU,EAAMe,EAAYsJ,EAAY/J,EAAahE,EAAYwD,EAAgBkK,EAAO,GAAIK,EAAY1J,KAAcgB,IAAEA,GAAQhB,EACvK,GAAkB,iBAAPgB,IAAoBA,EAC7B,MAAM,IAAIrF,EAAW,6DACvB,GAAI0N,EAAO,KAAOA,EAAO,GAAGxK,IAAImC,GAC9B,MAAM,IAAIvF,EAAkB,wDAC9B,GAAI4D,GACF,GAA2B,iBAAhBoK,EACT,MAAM,IAAI9N,EAAW,qCAClB,GAA2B,iBAAhB8N,KAA8BA,aAAwB5P,YACtE,MAAM,IAAI8B,EAAW,0DACvB,MAAMgO,EAAiBtK,GAA8B,iBAAhBoK,EAA2BA,EAAeH,EAAuBG,GACtG,IAAIG,GAAc,EACJ,mBAAP9I,IAAsBA,QAAYA,EAAI4I,EAAYN,GAAMQ,GAAc,GAC7E,MAAM/I,EAAQiI,GAAa9H,GAAM6I,EAAOvQ,OAAiC,IAA1B0P,EAA8B9O,EAAO8O,GAAoB,IAAInP,WAAcK,EAAO,KAA+B,iBAAlByP,EAA6BN,EAAO,KLpBpL,SAAyBrK,EAAOC,EAAOC,GACrC,IACE,OAAOhF,EAAO8E,EAClB,CAAI,MACA,MAAM,IAAIE,EAAW,OAAOD,oCAC7B,CACH,CKc2L6K,CAAgBH,EAAgB,UAAWhO,GAAcgO,GAAiBI,EAAYhL,EAAgBqK,EAAIW,UAAW,YAAapO,GAAamG,QAAUlB,EAAWC,EAAOC,EAAK,UAAWkJ,QAAkBxE,EAAO1D,EAAGjB,EAAMgD,OAAQ,UAC9ZhD,EAAM8G,YAAc9C,EAAmBhE,EAAMG,IAAKgJ,GAClD,IAAIC,GAAW,EACf,IACEA,QAAiB3E,OAAOzB,OAAOqG,OAAOrJ,EAAM2G,QAASwC,EAAWD,EAAWF,EAC/E,CAAI,MACD,CACD,IAAKI,EACH,MAAM,IAAI7N,EACZ,MAAM+N,EAAS,CAAE7O,QAAkC,iBAAlBqO,EAA6B5K,EAAgB4K,EAAgB,UAAWhO,GAAcgO,GACvH,YAAiC,IAA1BX,IAAgCmB,EAAOpK,gBAAkB2J,QAA6B,IAAhB/K,IAAsBwL,EAAOC,kBAAoBzL,GAASiL,EAAc,CAAC,IAAKO,EAAQrJ,IAAKgB,GAAKzC,GAAO,CAAC8K,EAAQ9K,EAC/L,CClEA,MAAMgL,GAASC,GAASC,KAAKC,MAAMF,EAAKG,UAAY,KAAMC,GAAc,CACtEhL,EAAG,EACHiL,EAAG,GACHC,EAAG,KACH5I,EAAG,MACH6I,EAAG,OACHC,EAAG,UACFC,GAAQ,oIAAqIC,GAAc,eAC9J,SAASC,KACP,MAAM,IAAI5Q,UAAU,6BACtB,CACA,SAAS6Q,GAAKC,GACE,iBAAPA,GAAmBF,KAC1B,MAAMG,EAAUL,GAAMM,KAAKF,KACzBC,GAAWA,EAAQ,IAAMA,EAAQ,KAAOH,KAC1C,MAAMjM,EAAQsM,WAAWF,EAAQ,IAAKG,EAAehB,KAAKiB,MAAMxM,EAAQ0L,GAAYU,EAAQ,GAAG,GAAGK,gBAClG,OAAOC,OAAOC,SAASJ,IAAiBN,KAAkC,MAAfG,EAAQ,IAA6B,QAAfA,EAAQ,IAAgBG,EAAeA,CAC1H,CACA,SAASK,GAAc3M,EAAO3C,GAC5B,IAAKoP,OAAOC,SAASrP,GACnB,MAAM,IAAIjC,UAAU,WAAW4E,WACjC,OAAO3C,CACT,CACA,SAASuP,GAAoBzQ,EAAO4D,GAClC,GAAoB,iBAATA,EACT,MAAM,IAAI3E,UAAU,IAAIe,4BAC5B,CAKA,SAAS0Q,GAAY9M,EAAOC,GAC1B,MAAuB,iBAATD,EAAoB4M,GAAc3M,EAAOD,GAASA,aAAiB+M,KAAOH,GAAc3M,EAAOoL,GAAMrL,IAAUqL,GAAsB,IAAI0B,MAAUb,GAAKlM,EACxK,CACA,MAAMgN,GAAgBhN,IACpB,MAAMmC,EAAanC,EAAMyM,cACzB,OAAOzM,EAAMrC,SAAS,KAAOwE,EAAa,eAAeA,KAE3D,SAAS8K,GAAoB3Q,EAASF,EAAO8Q,GAAW,GACtD,MAAMlN,EAAQ1D,EAAQF,GACtB,QAAqB,IAAf4D,GAAqBkN,EAAW,CACpC,GAAoB,iBAATlN,EACT,MAAM,IAAI7D,EAAyB,IAAIC,4BAAiCE,EAASF,EAAO,WAC1F,OAAO4D,CACR,CACH,CACA,SAASmN,GAAgB7Q,EAASF,GAChC,MAAM,IAAID,EAAyB,eAAeC,iBAAsBE,EAASF,EAAO4P,GAC1F,CACA,SAASoB,GAAkBrM,EAAiBsM,EAAgBvR,EAAU,CAAA,GACpE,IAAIQ,EACJ,IACEA,EAAUmF,KAAKE,MAAMvH,EAAciD,OAAOgQ,GAC9C,CAAI,MACD,CACD,IAAKzO,EAAStC,GACZ,MAAM,IAAIM,EAAW,kDACvB,MAAM0Q,IAAEA,GAAQxR,EAChB,QAAiB,IAAbwR,IAAiD,iBAAvBvM,EAAgBuM,KAAmBN,GAAajM,EAAgBuM,OAASN,GAAaM,IAClH,MAAM,IAAInR,EAAyB,oCAAqCG,EAAS,MAAO0P,IAC1F,MAAMuB,eAAEA,EAAiB,GAAEC,OAAEA,EAAMC,QAAEA,EAAOC,SAAEA,EAAQC,YAAEA,GAAgB7R,EAAS8R,EAAgB,IAAIL,QAChF,IAArBI,GAA0BC,EAAcxP,KAAK,YAA0B,IAAlBsP,GAAuBE,EAAcxP,KAAK,YAAyB,IAAjBqP,GAAsBG,EAAcxP,KAAK,YAAwB,IAAhBoP,GAAqBI,EAAcxP,KAAK,OAChM,IAAK,MAAMhC,KAAS,IAAIsD,IAAIkO,EAAcC,WACxC,IAAKhP,OAAOsC,OAAO7E,EAASF,GAC1B,MAAM,IAAID,EAAyB,qBAAqBC,WAAgBE,EAASF,EAAO,WA3BnE,IAAC0R,EAAYC,OA4BtB,IAAhBP,KAAuBtO,MAAMC,QAAQqO,GAAUA,EAAS,CAACA,IAAS7P,SAASrB,EAAQ0R,MAAQb,GAAgB7Q,EAAS,YAAyB,IAAjBmR,GAAsBnR,EAAQ2R,MAAQR,GAAWN,GAAgB7Q,EAAS,YAA0B,IAAlBoR,IA5BpLI,EA4BkOxR,EAAQ4R,IA5B9NH,EA4BsP,iBAAZL,EAAuB,CAACA,GAAYA,IA5B3O,iBAAdI,EAAyBC,EAAUpQ,SAASmQ,GAAc5O,MAAMC,QAAQ2O,IAAcC,EAAUtN,KAAMyN,GAAQJ,EAAWnQ,SAASuQ,OA4BoIf,GAAgB7Q,EAAS,OAC1V,MAAM6R,eAAEA,GAAmBrS,EAC3B,IAAIsS,EAAY,EAChB,GAA6B,iBAAlBD,EACTC,EAAYlC,GAAKiC,QACd,QAA4B,IAAxBA,EAA2B,CAClC,GAA6B,iBAAlBA,EACT,MAAM,IAAI9S,UAAU,sCACtB+S,EAAYD,CACb,CACDvB,GAAc,wBAAyBwB,GACvC,MAAMC,YAAEA,GAAgBvS,EAASwS,EAAM1B,GAAc,qBAAsBvB,QAA2B,IAArBgD,EAAyC,IAAItB,KAASsB,IAAeE,EAAMtB,GAAoB3Q,EAAS,WAA4B,IAArBqR,GAAyBa,EAAMvB,GAAoB3Q,EAAS,OAC5P,QAAiB,IAAbkS,GAAkBA,EAAMF,EAAMF,EAChC,MAAM,IAAIjS,EAAyB,qCAAsCG,EAAS,MAAO0P,IAC3F,MAAMyC,EAAMxB,GAAoB3Q,EAAS,OACzC,QAAiB,IAAbmS,GAAkBA,GAAOH,EAAMF,EACjC,MAAM,IAAI5R,EAAW,qCAAsCF,EAAS,MAAO0P,IAC7E,QAAyB,IAArB2B,EAAwB,CAC1B,MAAMe,EAAMJ,EAAMC,EAClB,GAAIG,EAAMN,EADmBxB,GAAc,qBAA4C,iBAAfe,EAA0BA,EAAczB,GAAKyB,IAEnH,MAAM,IAAInR,EAAW,2DAA4DF,EAAS,MAAO0P,IACnG,GAAI0C,GAAON,EACT,MAAM,IAAIjS,EAAyB,gEAAiEG,EAAS,MAAO0P,GACvH,CACD,OAAO1P,CACT,CACA,IAAIqS,GACJ,SAASC,GAAgBC,GACvB,OAAOF,GAAiBxK,IAAI0K,EAC9B,CC9FA3R,eAAe4R,GAAUC,EAAKjN,EAAKhG,GACjC,MAAOmP,EAAU5K,SFkEnBnD,eAA6BkN,EAAKC,EAAQvI,GACxC,GAAIsI,aAAevP,aAAeuP,EAAMlQ,EAAQmD,OAAO+M,IAAqB,iBAAPA,EACnE,MAAM,IAAIzN,EAAW,8CACvB,MAAQ,EAAGoE,EAAiB,EAAGzE,EAAS,EAAGyO,EAASpQ,OAAEA,GAAWyP,EAAI4E,MAAM,KAC3E,GAAe,IAAXrU,EACF,MAAM,IAAIgC,EAAW,uBACvB,OAAOwN,GAAgB,CAAE7N,UAASkO,UAAWzJ,EAAiBgK,aAAaV,EAAQvI,EAAKoI,GAC1F,CEzEgC+E,CAAcF,EFkB9C,SAAuBjT,GACrB,MAAO,CAACA,GAAWwE,EAAmB,aAAcxE,EAAQ0E,YAAa1E,GAASmF,KACpF,CEpBmDiO,CAAcpT,GAAUgG,GACzE,IAAKzB,EACH,MAAM,IAAIzD,EAAW,uCACvB,MAAMN,EAAU8Q,GAAkBnC,EAASlK,gBAAiBkK,EAAS3O,QAASR,GAC9E,MAAO,IAAKmP,EAAU3O,UACxB,CCHAY,eAAeiS,GAAgB7R,EAAOwE,EAAKsN,GACzC,IAAK9S,EAASyE,EAAiBqK,EAAmBnK,GAAQ3D,EAAO+R,EAAwB,GACzF,QAA6B,IAAzBtO,EAA4B,CAC9B,MAAMoB,EAAab,EAAoB3E,EAAYoE,GACnDA,EAAkBoB,EAAW,GAAIkN,EAAwBC,EAAKnN,EAAW,GAC1E,CACD,QAA+B,IAA3BiJ,IAAiCA,EAAoB9J,EAAoB3E,EAAYyO,GAAmB,KAAMrK,IAAoBqK,EACpI,MAAM,IAAIzO,EAAW,mFACvB,IAAK4C,EAAWwB,EAAiBqK,GAC/B,MAAM,IAAIzO,EAAW,6EACvB,MAAMqE,EAAa,IAAKD,KAAoBqK,IR8C9C,SAAgCxK,EAAKG,GACnC,MAAME,KAAEA,GAASF,GAAmB,GACpC,GAAI7B,MAAMC,QAAQ8B,IAAS,IAAIvB,IAAIuB,GAAMzG,OAASyG,EAAKtG,OACrD,MAAM,IAAIiG,EAAI,uEAClB,CQjDE2O,CAAuB5S,EAAYoE,GACnC,MAAMV,EAAMe,EAAYL,EAAiBJ,EAAahE,EAAYwD,EAAgBc,EAAMF,EAAiBC,IACzGX,GAAO+O,MACP,MAAMpN,IAAEA,GAAQhB,EAChB,GAAkB,iBAAPgB,IAAoBA,EAC7B,MAAM,IAAIrF,EAAW,6DACvB,MAAMkF,EAAQiI,GAAa9H,GAC3B,IAAuC6I,EAAnC2E,EAAW,GAAIC,EAAWnT,EAC1B+D,IAEiGmP,EAAWF,EAAKhT,GAAUuO,EAAO7Q,EAAQkB,OAAO,GAAGmU,KAAyBG,MAEjL3E,IAASvQ,EAAOY,EAAOmU,GAAwBnU,EAAO,KAAMuU,GAC5D,MAAM3M,QAAU0D,QAAa5E,EAAWC,EAAOC,EAAK,QAASD,EAAMgD,OAAQ,QAC3EhD,EAAM8G,YAAc9C,EAAmBhE,EAAMG,IAAKc,GAClD,MAAMsH,EAAM,CACVW,UAAWuE,EAAK,IAAIzU,iBAAiByL,OAAOzB,OAAO6K,KAAK7N,EAAM2G,QAAS1F,EAAG+H,KAC1EvO,QAASkT,GAEX,OAAOzO,IAAoBqJ,EAAII,UAAY6E,GAAwBjE,IAAsBhB,EAAIzK,OAASyL,GAAoB,CAAChB,EAAK/J,EAClI,CCjCA,MAAMsP,GH0GN,MACE,WAAA/T,CAAYU,EAAU,IACpB,IAAKsC,EAAStC,GACZ,MAAM,IAAIjB,UAAU,qCACrBsT,KAAqC,IAAI3K,SAAWhJ,IAAIgB,KAAM4T,gBAAgBtT,GAChF,CACD,SAAAuT,CAAU7P,GACR,OAAO6M,GAAoB,MAAO7M,GAAQ4O,GAAgB5S,MAAMgS,IAAMhO,EAAOhE,IAC9E,CACD,UAAA8T,CAAW9P,GACT,OAAO6M,GAAoB,MAAO7M,GAAQ4O,GAAgB5S,MAAMiS,IAAMjO,EAAOhE,IAC9E,CACD,WAAA+T,CAAY/P,GACV,OA7FJ,SAA+BA,GAC7B,GAAoB,iBAATA,KAAuBd,MAAMC,QAAQa,IAAUd,MAAMG,KAAKW,GAAOS,KAAMuP,GAA4B,iBAAVA,IAClG,MAAM,IAAI3U,UAAU,sDACxB,CA0FW4U,CAAsBjQ,GAAQ4O,GAAgB5S,MAAMkS,IAAMlO,EAAOhE,IACzE,CACD,MAAAkU,CAAOlQ,GACL,OAAO6M,GAAoB,MAAO7M,GAAQ4O,GAAgB5S,MAAMmU,IAAMnQ,EAAOhE,IAC9E,CACD,YAAAoU,CAAapQ,GACX,OAAO4O,GAAgB5S,MAAMwS,IAAM1B,GAAY9M,EAAO,gBAAiBhE,IACxE,CACD,iBAAAqU,CAAkBrQ,GAChB,OAAO4O,GAAgB5S,MAAMyS,IAAM3B,GAAY9M,EAAO,qBAAsBhE,IAC7E,CACD,WAAAsU,CAAYtQ,GACV,MAAM1D,EAAUsS,GAAgB5S,MAChC,OAA0BM,EAAQiS,SAAZ,IAAfvO,EAAiCqL,GAAsB,IAAI0B,MAA0B,iBAAT/M,EAAkC4M,GAAc,cAAevB,GAAsB,IAAI0B,MAAUb,GAAKlM,IAAwB8M,GAAY9M,EAAO,eAAgBhE,IACvP,GGpIH,MAAMuU,WAAgBZ,GACpB5O,GACA,kBAAAyP,CAAmBzP,GACjB,OTmBJ,SAAsBf,EAAO/D,GAC3B,QAAmB,IAAf+D,EACF,MAAM,IAAI3E,UAAU,GAAGY,4BAC3B,CStBWwU,CAAazU,MAAK+E,EAAkB,sBAAuB/E,MAAK+E,EAAmBA,EAAiB/E,IAC5G,CACD,UAAM0T,CAAK5N,EAAKhG,GACd,OD2BJoB,eAAsCZ,EAASyE,EAAiBE,EAAMa,EAAKsN,GACzE,MAAOhF,SAAa+E,GAAgB,CAAC7S,EAASyE,OAAsB,EAAGE,GAAOa,EAAKsN,GACnF,MAAO,GAAGhF,EAAII,aAAaJ,EAAI9N,WAAW8N,EAAIW,WAChD,CC9BW2F,CHuFX,SAAiB7B,GACf,MAAMvS,EAAUsS,GAAgBC,GAChC,IAAK,MAAMzS,IAAS,CAAC,MAAO,MAAO,OAAQ,CACzC,MAAM4D,EAAQ1D,EAAQF,GACtB,GAAoB,iBAAT4D,IAAsB0M,OAAOC,SAAS3M,GAC/C,MAAM,IAAI3E,UAAU,IAAIe,mCAC3B,CACD,OAAOpC,EAAQkB,OAAOuG,KAAKC,UAAUpF,GACvC,CG/FkCqU,CAAQ3U,MAAOA,MAAK+E,EAAkBjF,GAASmF,KAAMa,EAAK,KACtF,MAAM,IAAIlF,EAAW,wCAExB,ECXH,MAAMgU,GAAc,oBACpB,SAASC,GAAeC,EAAS,mCAC/B,MAAM,IAAIpU,EAAiB,0BAA0BoU,UACvD,CCGA5T,eAAe6T,GAAUjP,GACvB,GAAIuD,EAAYvD,GACd,IAAiB,WAAbA,EAAI4B,KAGN,OAAO5B,EAAIgC,OAAO,CAAEiB,OAAQ,QAF5BjD,EAAMA,EAAIgC,QAE0B,CACxC,GAAIhC,aAAejH,WACjB,MAAO,CACL+H,IAAK,MACLE,EAAGwM,EAAKxN,IAEZ,IAAK+B,EAAY/B,GACf,MAAM,IAAIzG,UV8DU,EAACkK,KAAWC,IAAU3J,EAAQ,eAAgB0J,KAAWC,GU9DzDwL,CAAgBlP,EAAK,YAAa,YAAa,eACrE,IAAKA,EAAIqE,YACP,MAAM,IAAI9K,UAAU,yDACtB,MAAMgH,QAAYiE,OAAOzB,OAAOoM,UAAU,MAAOnP,UAC1CO,EAAIE,WAAYF,EAAIG,eAAgBH,EAAIY,IAAiB,QAAZZ,EAAIO,YAAwBP,EAAIL,IACpF,IAAK,MAAMpC,KAAaf,OAAOO,KAAKiD,QACV,IAAxBA,EAAIzC,WAAgCyC,EAAIzC,GAC1C,OAAOyC,CACT,CCrBAnF,eAAegU,GAAmBnN,EAAO1B,EAAKR,GAC5C,MAAMqC,EAASH,EAAMI,IAAI9B,IAAQ0B,EAAM/I,IAAIqH,EAAK,CAAE,GAAE8B,IAAI9B,IAAML,IAAEA,GAAQH,EACxE,QAAyB,IAArBqC,EAAOlC,GAAiB,CAC1B,MAAMmP,EAAUnM,EAASnD,EAAOQ,GAAK,GAAI+O,KAAMtP,IAC7C,GAAiB,WAAbA,EAAI4B,KACN,MAAM,IAAI7G,EAAY,gDACxB,OAAOqH,EAAOlC,GAAOF,EAAKA,IACzBuP,MAAOC,IACR,MAAMpN,EAAOlC,KAASmP,UAAkBjN,EAAOlC,GAAMsP,IAEvDpN,EAAOlC,GAAOmP,CACf,CACD,OAAOjN,EAAOlC,EAChB,CACA,SAASuP,GAAkBC,GACzB,IAAIC,EACJ,IACEA,EAAW7B,gBAAgB4B,EAC/B,CAAI,MACD,CACD,IAAKvS,EAASwS,GACZ,MAAM,IAAI5U,EAAY,8BACxB,MAAM6U,EAAWD,EAASrS,KAAKuS,IAAKtP,IAClC,MAAMF,EAAaG,EAAYD,GAC/B,OAAOnD,MAAMC,QAAQgD,EAAWK,WAAaL,EAAWK,QAAU,IAAIL,EAAWK,UAAWL,IAC1F+B,EAAyB,IAAIF,QACjC,OAAOnF,OAAO+S,eAAe1U,MAAO6D,EAAiB8Q,KACnD,MAAM7P,IAAEA,EAAG8P,IAAEA,GAAQ,IAAK/Q,KAAoB8Q,GAAOlS,QAAUkC,EAAsB,iBAAPG,EAAkB+G,GAAI/G,QAAY,EAChH,IAAKH,GAASA,EAAMI,OAClB,MAAM,IAAIvF,EAAiB,kDAC7B,MAAMqV,EAAaN,EAASrS,KAAK4S,OAAO,CAACC,EAAGC,IAlChD,SAAqB7P,EAAKR,EAAOG,EAAK8P,GACpC,MAAMlP,IAAEA,EAAKJ,QAASC,EAAMF,IAAEA,EAAKuP,IAAKK,EAAQnQ,IAAKoQ,EAAMnP,IAAEA,EAAGqB,IAAEA,GAAQjC,EAC1E,YAAqB,IAAbE,GAAgC,kBAAPA,UAAsC,IAAhBE,GAAqBvD,MAAMC,QAAQsD,IAAWA,EAAOnD,MAAM,CAACoD,EAAWwP,IAA8B,iBAAbxP,GAAyBD,EAAO4P,QAAQ3P,KAAewP,IAAUzP,EAAO9E,SAAS,YAAckE,EAAMe,IAAIjF,SAASiF,UAAsB,IAAbkP,GAAgC,iBAAPA,GAAmBA,IAAQK,UAA4B,IAAhBC,EAA4B,QAARxP,EAAgBZ,IAAQoQ,UAAyB,IAAbnP,GAA0B,QAARA,MAAoBpB,EAAMyC,KAAOA,IAAQzC,EAAMyC,IACrc,CA+B0DgO,CAAYZ,EAASQ,GAAQrQ,EAAOG,EAAK8P,KAAS,EAAGzP,EAAG1H,OAAEA,GAAWoX,EAC3H,IAAKpX,EACH,MAAM,IAAImC,EACZ,GAAe,IAAXnC,EAAc,CAChB,MAAM2W,EAAQ,IAAIvU,EAClB,MAAMuU,EAAMtU,OAAOC,eAAiBC,kBAClC,IAAK,MAAMqV,KAAQR,EACjB,gBACcb,GAAmBhN,EAAQqO,EAAM1Q,EACzD,CAAY,MACD,CACJ,EAAEyP,CACJ,CACD,OAAOJ,GAAmBhN,EAAQ7B,EAAKR,IACtC,OAAQ,CACT7B,MAAO,IAAM4P,gBAAgB6B,IAEjC,CCjDA,IAAIe,WACIC,UAAY,MAAQA,UAAUC,WAAWC,aAAa,mBAAqBH,GAAa,gBAChG,MAAMI,GAA8B5V,SAkBpC,MAAM6V,GAA4B7V,SAClC,SAAS8V,GAAWC,EAAWC,GAC7B,OAAOtG,OAAOC,SAASoG,IAAchG,KAAKuB,MAAQyE,EAAYC,CAChE,CACA,SAASC,GAAiBjT,EAAOkT,EAAU3S,GACzC,GAAImM,OAAOyG,MAAMnT,GACf,MAAM,IAAI3E,UAAU,IAAIkF,6BAC1B,MAAuB,iBAATP,EAAoBA,EAAQkT,CAC5C,CACA,SAASE,GAAmB5V,EAAK1B,GAC/B,KAAM0B,aAAe6V,KACnB,MAAM,IAAIhY,UAAU,kCACtB,MAAMiY,EAAO,IAAID,IAAI7V,EAAI8V,MAAMA,KAAMC,EAAkB,CAAE,EAAEC,EAAgBD,EAAKE,gBAChF,GAA4B,iBAAjBD,KAA+B9G,OAAOgH,UAAUF,IAAkBA,EAAgB,GAC3F,MAAM,IAAInY,UAAU,2DACtB,MAAMoY,EAA0C,iBAAjBD,EAA4BA,EAAgB,IAAKG,EAAmBV,GAAiBM,EAAKI,iBAAkB,IAAK,oBAAqBC,EAAcX,GAAiBM,EAAKK,YAAa,IAAK,eAAgBpU,EAAU,IAAIqU,QAAQN,EAAK/T,SACtQgT,KAAehT,EAAQK,IAAI,eAAiBL,EAAQxE,IAAI,aAAcwX,IAAahT,EAAQK,IAAI,WAAaL,EAAQxE,IAAI,SAAU,8CAClI,MAAM8Y,EAAYP,EAAKX,IAAc7O,EAAQwP,EAAKV,IAClD,IAAIkB,EAAeC,EAAuDC,EAAzCC,EAAiB,EAAGC,EAAkB,EACvE,GAAIpQ,GAAyB,iBAATA,EAAmB,CACrC,MAAMqQ,IAAEA,EAAG5C,KAAEA,GAASzN,EACtB+O,GAAWsB,EAAKR,IAAgB3U,EAASuS,KAAUuC,EAAgBK,EAAKH,EAAQ1C,GAAkBC,GACnG,CACD,MAAM6C,EAASnX,UACb,GAAI8W,WA9CQM,cAAgB,YAAc7B,UAAY,KAA+B,uBAAxBA,UAAUC,kBAA6C6B,YAAc,KAAuB,WAAhBA,eA8C3FP,OAAoB,IAAKA,EAAc,CACnF,MAAMQ,IAAaN,EAAgBO,EAAUT,EA1CnD9W,eAAyBM,EAAKgC,EAASkV,EAAQZ,EAAYa,OACzD,MAAMC,QAAiBd,EAAUtW,EAAK,CACpCqX,OAAQ,MACRH,SACAI,SAAU,SACVtV,YACC6R,MAAO0D,IACR,KAAmB,iBAAbA,EAAI9Y,KAA0B,IAAIkB,EAAgB4X,IAE1D,GAAwB,MAApBH,EAASI,OACX,MAAM,IAAIvZ,EAAU,2DACtB,IACE,aAAamZ,EAASK,MAC1B,CAAI,MACA,MAAM,IAAIxZ,EAAU,6DACrB,CACH,CA0BkEyZ,CAAU5B,EAAM9T,EAAS2V,YAAYC,QAAQ3B,GAAkBK,GAAW1C,KAAM6D,IAC1I,MAAMI,EAAO9D,GAAkB0D,GAC/B,GAAIT,GAAYL,EACd,OACFF,EAAQoB,EACR,MAAMC,EAAYvI,KAAKuB,MACvBvK,IAAUA,EAAMqQ,IAAMkB,EAAWvR,EAAMyN,KAAOyD,GAAOlB,EAAgBuB,EAAWnB,EAAkBK,IACjGe,QAAQ,KACTvB,IAAiBS,IAAYT,OAAoB,IAEpD,OACKA,GAER,OAAOnV,OAAO2W,iBAAiBtY,MAAO6D,EAAiB8Q,OACnDoC,IAAUnB,GAAWiB,EAAeH,WAAuBS,IAC7D,IACE,aAAaJ,EAAMlT,EAAiB8Q,EACrC,CAAC,MAAOkD,GACP,GAAIA,aAAejY,IAAsBgW,GAAWiB,EAAeJ,GACjE,aAAaU,IAAUJ,EAAMlT,EAAiB8Q,GAChD,MAAMkD,CACP,GACA,CACDU,YAAa,CACXtR,IAAK,IAAM2O,GAAWiB,EAAeJ,GACrC+B,YAAY,GAEdC,MAAO,CACLxR,IAAK,IAAM2O,GAAWiB,EAAeH,GACrC8B,YAAY,GAEdrB,OAAQ,CACNrU,MAAOqU,EACPqB,YAAY,GAEdE,UAAW,CACTzR,IAAK,MAAQ6P,EACb0B,YAAY,GAEdlE,KAAM,CACJxR,MAAO,IAAMiU,GAAOzC,OACpBkE,YAAY,IAGlB,CC5FA,SAASG,GAAuB/Z,GAC9B,MAAMgK,EAAgBhK,GAASgK,eAAiB,KAChD,GAA4B,iBAAjBA,IAA8B4G,OAAOgH,UAAU5N,IAAkBA,EAAgB,KAC1F,MAAM,IAAIpJ,EAAiB,+FAC7B,OAAOoJ,CACT,CACA5I,eAAe4Y,GAAgB9T,EAAKlG,GAClC,MAAMqK,EAAwCrK,GAASqK,YAActE,EJHvE,SAAsBG,EAAK8O,GACzB,OAAsB,iBAAP9O,EAAkB+G,GAAI/G,IAAQsF,EAAItF,QAAY,IAAM6O,GAAeC,EACpF,CIC+EiF,CAAa/T,EAAK4O,IAE/F,IAAI7K,EACJ,GAFAlE,EAAMI,QAAU4O,GAAeD,IAE3B/O,EAAM8C,QAAS,CACjB,MAAML,EAAMxI,GAASwI,KAAO,QAC5B,IAAK,CAAC,QAAS,QAAS,QAAS,UAAU3G,SAAS2G,GAClD,MAAM,IAAI5H,EAAiB,oGAC7BqJ,EAAYlE,EAAM8C,QAAQ,CAAEL,OAChC,KAAS,CACL,QAAuB,IAAnBzC,EAAMyC,UAAwC,IAAtBxI,GAASwI,KAAkBxI,EAAQwI,MAAQzC,EAAMyC,IAC3E,MAAM,IAAI5H,EAAiB,4EAA4EsF,QAAUH,EAAMyC,OACzHyB,EAA6B,QAAjBlE,EAAMe,IAAI,GAAe,IAChCf,EAAMgD,OACTmR,eAAgBnb,WAAWob,GAAG,EAAG,EAAG,GACpCnQ,cAAe+P,GAAuB/Z,IACpC+F,EAAMgD,MACX,CACD,OAAOyB,OAAOzB,OAAOqR,YAAYnQ,EAAWI,EAAmB,IAC1DtE,EAAMiD,OAAO,MACbjD,EAAMiD,OAAO,IAEpB,CC9BA,MAAMqR,GAAY,GAClB,IAAK,IAAIrb,EAAI,EAAGA,EAAI,MAAOA,EACvBqb,GAAU/X,MAAMtD,EAAI,KAAOgE,SAAS,IAAIsX,MAAM,ICHlD,MAAMC,GAAQ,IAAIxb,WAAW,ICE7B,SAASyb,GAAGxa,EAASlB,EAAK2b,GACtB,OAAwBjQ,OAAOkQ,WACpBlQ,OAAOkQ,aAItB,SAAa1a,GACTA,EAAUA,GAAW,GACrB,MAAM2a,EAAO3a,EAAQ4a,QAAU5a,EAAQ6a,SDRhCrQ,OAAOsQ,gBAAgBP,ICS9B,GAAII,EAAK9b,OAAS,GACd,MAAM,IAAIe,MAAM,qCAcpB,OAZA+a,EAAK,GAAgB,GAAVA,EAAK,GAAa,GAC7BA,EAAK,GAAgB,GAAVA,EAAK,GAAa,IFV1B,SAAyBtY,EAAKoY,EAAS,GAC1C,OAAQJ,GAAUhY,EAAIoY,EAAS,IAC3BJ,GAAUhY,EAAIoY,EAAS,IACvBJ,GAAUhY,EAAIoY,EAAS,IACvBJ,GAAUhY,EAAIoY,EAAS,IACvB,IACAJ,GAAUhY,EAAIoY,EAAS,IACvBJ,GAAUhY,EAAIoY,EAAS,IACvB,IACAJ,GAAUhY,EAAIoY,EAAS,IACvBJ,GAAUhY,EAAIoY,EAAS,IACvB,IACAJ,GAAUhY,EAAIoY,EAAS,IACvBJ,GAAUhY,EAAIoY,EAAS,IACvB,IACAJ,GAAUhY,EAAIoY,EAAS,KACvBJ,GAAUhY,EAAIoY,EAAS,KACvBJ,GAAUhY,EAAIoY,EAAS,KACvBJ,GAAUhY,EAAIoY,EAAS,KACvBJ,GAAUhY,EAAIoY,EAAS,KACvBJ,GAAUhY,EAAIoY,EAAS,MAAM9J,aACrC,CEAWoK,CAAgBJ,EAC3B,CArBWK,CAAIhb,EACf,CCoBA,MAAMib,GAAgC,oBAIhCC,GAAwB,CAAC,QAAS,SAClCC,GAAS,CAEXC,MAAO,QACPC,MAAO,QACPC,OAAQ,SACRC,kBAAmB,kBACnBC,WAAY,YACZC,sBAAuB,uBACvBC,gBAAiB,iBACjBC,iBAAkB,kBAClBC,iBAAkB,iBAClBC,YAAa,cAYXC,GAAiB,CALF,SAEC,iBAEF,SAyBpB,MAAMC,GACFC,YACA,WAAAlc,CAAYkc,GACR9b,KAAK8b,YAAcA,EACnB9b,KAAK8b,YAAcA,CACtB,CAMD,sBAAMC,CAAiBrT,GAoBnB,MAAMsT,QAAsBC,QAAQC,IAAIlc,KAAK8b,YAAYnG,IAAKwG,GAAeA,EAAWC,aAAa1T,KACrG,IAAK,IAAI5J,EAAI,EAAGA,EAAIkd,EAAcrd,OAAQG,GAAK,EAC3C,GAAIkd,EAAcld,GACd,OAAOkB,KAAK8b,YAAYhd,GAGhC,OAAO,IACV,CACD,eAAMsd,IAAa1T,GACf,OAAiD,aAAnC1I,KAAK+b,iBAAiBrT,EACvC,CACD,YAAM2T,IAAU3T,GACZ,MAAM4T,QAAgBtc,KAAK+b,iBAAiBrT,GAC5C,GAAI4T,EACA,OAAOA,EAAQD,UAAU3T,GAE7B,MAAM,IAAIhJ,MAAM,IAAIM,KAAKJ,YAAYK,6CAA6CyI,EAC7EiN,IAAK4G,IACN,IACI,OAAO9W,KAAKC,UAAU6W,EACzB,CACD,MAAOC,GAEH,OAAOD,EAAMzZ,UAChB,IAEAJ,KAAK,QACb,EA+BLxB,eAAeub,GAAyBC,EAASC,EAASC,EAAWC,GACjE,IAAIvc,EACAwc,EACJ,IACI,MAAQxc,QAASyc,SAA0BjK,GAAU4J,EAAStF,GAAmB,IAAIC,IAAIsF,IAAW,CAChGnL,OAAQoL,EACRlL,SAAUmL,IAEdvc,EAAUyc,CACb,CACD,MAAOC,GACH,MAAM,IAAItd,MAAM,8BAA8Bsd,EAAEC,QACnD,CAID,GAH2B,iBAAhB3c,EAAQ4c,MACfJ,EAAoBxc,EAAQ4c,KAEH,iBAAlB5c,EAAQ6c,MACf,MAAO,CACHC,MAAO9c,EAAQ6c,MACfN,SAAUC,GAGlB,GAA2B,iBAAhBxc,EAAQ2R,IACf,MAAM,IAAIvS,MAAM,aAAa+F,KAAKC,UAAUpF,8DAEhD,IAKI,OADA,IAAI+W,IAAI/W,EAAQ2R,KACT,CACHmL,MAAO9c,EAAQ2R,IACf4K,SAAUC,EAEjB,CACD,MAAOE,GACH,MAAM,IAAItd,MAAM,2DAA2DY,EAAQ2R,qCAAqC+K,MAC3H,CACL,CAsDA,SAASK,GAAmBC,GAExB,IACI,MAAMC,EAAY,IAAIlG,IAAIiG,GACpBE,GAAmBD,EAAUE,aAAa5Z,IAAI,UAC/C0Z,EAAUE,aAAa5Z,IAAI,SAG1B6Z,EAA4B,KAAnBH,EAAUtT,KACzB,OAAOuT,GAAmBE,CAC7B,CACD,MAAOC,GACH,OAAO,CACV,CACL,CACA,SAASC,GAAmBN,GACxB,MAAMO,EAAe,IAAIxG,IAAIiG,GAS7B,OAPAO,EAAaJ,aAAaK,OAAO,SACjCD,EAAaJ,aAAaK,OAAO,QAEjCD,EAAaJ,aAAaK,OAAO,SACjCD,EAAaJ,aAAaK,OAAO,qBAEjCD,EAAaJ,aAAaK,OAAO,OAC1BD,CACX,CAoCA,MAAME,GACFC,eACAC,WACA,WAAAre,CAAYoe,EAAgBC,GACxBje,KAAKge,eAAiBA,EACtBhe,KAAKie,WAAaA,EAClBje,KAAKge,eAAiBA,EACtBhe,KAAKie,WAAaA,CACrB,CACDC,gBAAmBC,QACsDC,IAA7DD,EAAiBE,oBAAoBC,qBACzCH,EAAiBE,oBAAoBC,oBAAoBjI,QAAQ,uBAAyB,QACzD+H,IAAjCD,EAAiBb,YAEzB,eAAMlB,CAAU+B,GACZ,OAAOne,KAAKke,gBAAgBC,EAC/B,CACD,0BAAMI,EAAqBJ,iBAAEA,EAAgBK,MAAEA,EAAKC,aAAEA,EAAYC,UAAEA,IAChE,IAAK1e,KAAKke,gBAAgBC,GACtB,MAAM,IAAIze,MAAM,wDA9B5B,IAA6BsE,EAAOkT,QAgCtB+E,QAAQC,IAAI,CAUdlc,KAAKge,eAAeW,WAAWH,EAAO,CAClCI,UAAWT,EAAiBS,YAMhC5e,KAAKge,eAAeW,WAAWR,EAAiBS,UAAW,CACvDH,eACAjN,OAAQ2M,EAAiB3M,OAAO1O,WAEhCwa,YAAaa,EAAiBb,YAC9BuB,KAAMC,QAAQX,EAAiBU,MAAM/b,WACrCic,WAvDa/a,EAuDkBma,EAAiBY,UAvD5B7H,GAuDuC,EAtDlD,kBAAVlT,EACA8a,QAAQ9a,GAEZ8a,QAAQ5H,IAmD8DpU,eAGzE9C,KAAKie,WAAWnF,SAAS4F,EAAW,CAChCM,eAAgBb,EAAiBa,gBAGxC,EAyBL,MAAMC,GACFC,mBACA,WAAAtf,CAAYsf,GACRlf,KAAKkf,mBAAqBA,EAC1Blf,KAAKkf,mBAAqBA,CAC7B,CACD,eAAM9C,GACF,OAAO,CACV,CACD,YAAMC,CAAO8C,SACHnf,KAAKkf,mBAAmBE,MAAMD,EACvC,EAsBL,MAAME,GACFpB,WACA,WAAAre,CAAYqe,GACRje,KAAKie,WAAaA,EAClBje,KAAKie,WAAaA,CACrB,CACD,eAAM7B,CAAU+C,EAAQrf,GACpB,MAA+B,QAAxBA,GAASwf,UACnB,CACD,YAAMjD,CAAO8C,EAAQrf,GACjB,GAA4B,QAAxBA,GAASwf,WACT,MAAM,IAAI5f,MAAM,+DAEpB,QAA4B0e,IAAxBte,EAAQyf,YACR,MAAM,IAAI7f,MAAM,iFAEpBM,KAAKie,WAAWnF,SAAShZ,EAAQyf,YAAYzf,GAAU,CACnDkf,eAAgBlf,EAAQkf,gBAE/B,EAsBL,MAAMQ,GACFC,SACA,WAAA7f,CAAYsf,EAAoBjB,GAC5Bje,KAAKyf,SAAW,CACZ,IAAIR,GAAqBC,GACzB,IAAIG,GAAiBpB,GAE5B,CACD,eAAM7B,GACF,OAAO,CACV,CACD,YAAMC,CAAO8C,EAAQrf,GACjB,IAAK,MAAMwc,KAAWtc,KAAKyf,eACbnD,EAAQF,UAAU+C,EAAQrf,UAC1Bwc,EAAQD,OAAO8C,EAAQrf,EAExC,EA0BL,SAAS4f,KACL,MAAO,CACHC,YAAY,EACZf,UAAWtE,KACX3B,MAAO,IAAIiH,IAASjH,SAASiH,GAErC,CAMA1e,eAAeke,GAAMR,EAAWiB,SACtB5D,QAAQC,IAAI,CACd2D,EAAQC,kBAAkBlB,EAAW,CAAEmB,QAAQ,IAC/CF,EAAQC,kBAAkBlB,EAAW,CAAEmB,QAAQ,KAEvD,CAIA,MAAMC,GACFhC,eACA,WAAApe,CAAYoe,GACRhe,KAAKge,eAAiBA,EACtBhe,KAAKge,eAAiBA,CACzB,CACD,MAAAiC,CAAOC,EAAYC,GACf,MAAM,IAAIzgB,MAAM,kBACnB,CACD,GAAAV,CAAIkhB,EAAYE,GACZ,MAAM,IAAI1gB,MAAM,kBACnB,CACD,GAAAyI,CAAI8N,GACA,MAAM,IAAIvW,MAAM,kBACnB,CACD,YAAM2gB,GACF,MAAM,IAAI3gB,MAAM,kBACnB,CAMD,WAAM0f,CAAMR,GACR,OAAOQ,GAAMR,EAAW5e,KAAKge,eAChC,CAID,cAAMsC,CAASJ,GACX,MAAM,IAAIxgB,MAAM,kBACnB,CAKD,+BAAM6gB,GACF,MAAM,IAAI7gB,MAAM,kBACnB,CAID,cAAM8gB,GACF,MAAM,IAAI9gB,MAAM,kBACnB,CAID,oBAAM+gB,CAAeP,EAAYQ,GAC7B,MAAM,IAAIhhB,MAAM,kBACnB,EAiDL,SAASihB,IAA4BC,mBAAEA,EAAkBC,YAAEA,IACvD,QAA2BzC,IAAvBwC,EAEJ,OAAO,UAAgBpC,MAAEA,EAAKsC,cAAEA,IAC5B,OAtBR,UAA0BF,mBAAEA,EAAkBC,YAAEA,EAAWE,sBAAEA,EAAqBvC,MAAEA,IAChF,MAAMhd,EAAM,IAAI6V,IAAIuJ,GAQpB,YAPoBxC,IAAhByC,GACArf,EAAIic,aAAauD,OAAO,gBAAiBH,QACfzC,IAA1B2C,IACAvf,EAAIic,aAAauD,OAAO,2BAA4BD,QACtC3C,IAAVI,GACAhd,EAAIic,aAAauD,OAAO,QAASxC,IAElChd,EAAIsB,UACf,CAYeme,CAAiB,CACpBL,qBACAC,cACArC,QACAuC,sBAAuBD,GAEnC,CACA,CAiEA,SAASI,GAAW1f,GAChB,IAII,OADA,IAAI6V,IAAI7V,IACD,CACV,CACD,MACI,OAAO,CACV,CACL,CAkBAN,eAAeigB,GAAmBrhB,EAASshB,EAAcpD,EAAgBqD,GACrE,IAAIC,EACJ,GAXJ,SAA2BxhB,EAASshB,GAChC,OAAQA,EAAaG,gBAAgB5f,SAAS,eACrByc,IAArBte,EAAQ+c,UACRqE,GAAWphB,EAAQ+c,SAC3B,CAOQ2E,CAAkB1hB,EAASshB,GAC3BE,EAAa,CACTzE,SAAU/c,EAAQ+c,SAClB4E,WAAY3hB,EAAQ2hB,WACpBC,WAAY,kBAGf,KArBT,SAAwB5hB,GACpB,YAA4Bse,IAArBte,EAAQ+c,WAA2BqE,GAAWphB,EAAQ+c,SACjE,CAmBa8E,CAAe7hB,GAUpB,OAAOuhB,EAAgBO,UAAU,CAC7BhD,UAAW9e,EAAQ8e,UACnB6C,WAAY3hB,EAAQ2hB,WACpBnE,YAAaxd,EAAQwd,aACtB8D,GAbHE,EAAa,CACTzE,SAAU/c,EAAQ+c,SAClBgF,aAAc/hB,EAAQ+hB,aACtBJ,WAAY3hB,EAAQ2hB,WACpBC,WAAY,SAUnB,CAKD,MAAMI,EAAa,CACfjF,SAAUyE,EAAWzE,SACrB6E,WAAYJ,EAAWI,YAY3B,MAV8B,WAA1BJ,EAAWI,aACXI,EAAWD,aAAeP,EAAWO,cAErCP,EAAWG,aACXK,EAAWL,WAAaH,EAAWG,kBAKjCzD,EAAeW,WAAW7e,EAAQ8e,UAAWkD,GAC5CR,CACX,CAqBA,MAAMS,GAAa,CAACC,EAASC,IAAStJ,MAAMqJ,EAASC,GAIrD,IAAAC,GAAA,MACIC,aACAC,gBACAC,cACAnD,mBACAoD,oBACAC,YACA,WAAA3iB,CAAYuiB,EAAcC,EAAiBC,EAAenD,EAAoBoD,GAC1EtiB,KAAKmiB,aAAeA,EACpBniB,KAAKoiB,gBAAkBA,EACvBpiB,KAAKqiB,cAAgBA,EACrBriB,KAAKkf,mBAAqBA,EAC1Blf,KAAKsiB,oBAAsBA,EAC3BtiB,KAAKmiB,aAAeA,EACpBniB,KAAKoiB,gBAAkBA,EACvBpiB,KAAKqiB,cAAgBA,EACrBriB,KAAKkf,mBAAqBA,EAC1Blf,KAAKsiB,oBAAsBA,CAC9B,CAED3J,MAAQoJ,GACRS,OAASthB,MAAO0d,EAAW9e,WAKjBE,KAAKqiB,cAAchG,OAAOuC,EAAmC,QAAxB9e,GAASwf,WAC9C,IACKxf,EACHyf,YAAavf,KAAKuiB,aAEpBziB,GAGNE,KAAK2Y,MAAQoJ,UAEN/hB,KAAKuiB,aAEhBE,eAAiBvhB,MAAO0d,GAEb5e,KAAKkf,mBAAmB/W,IAAIyW,GAEvC8D,kBAAoBxhB,SACTlB,KAAKkf,mBAAmBmB,UAyCvCnf,eAAeyhB,GAA2B/D,EAAWZ,EAAgB4E,GACjE,IACI,MAAOhG,EAAW6B,EAAcoE,EAAmBhE,EAAME,SAAmB9C,QAAQC,IAAI,CACpF8B,EAAe8E,WAAWlE,EAAW,SAAU,CAC3CmE,aAAa,IAEjB/E,EAAe8E,WAAWlE,EAAW,gBACrCZ,EAAe8E,WAAWlE,EAAW,eACrCZ,EAAe8E,WAAWlE,EAAW,OAAQ,CAAEmE,aAAa,IAC5D/E,EAAe8E,WAAWlE,EAAW,qBAGnCZ,EAAegF,cAAcpE,EAAW,gBAG9C,MAAO,CACHH,eACAnB,YAAauF,EACbzB,mBAJuBwB,EAAcK,YAAYrG,GAKjDiC,KAAe,SAATA,EAENE,UAAgC,iBAAdA,GAAuC,SAAdA,EAElD,CACD,MAAO/B,GACH,MAAM,IAAItd,MAAM,yEAAyEkf,OAAe5B,IAC3G,CACL,CAwCA,MAAMkG,GACFC,cACAC,gBACA,WAAAxjB,CAAYujB,EAAeC,GACvBpjB,KAAKmjB,cAAgBA,EACrBnjB,KAAKojB,gBAAkBA,EACvBpjB,KAAKmjB,cAAgBA,EACrBnjB,KAAKojB,gBAAkBA,CAC1B,CACD,MAAAC,CAAOlE,GACH,MAAO,iCAAiCA,GAC3C,CACD,iBAAMmE,CAAYnE,EAAQY,GACtB,MAAMwD,QAAgBxD,EAAS/f,KAAKmjB,cAAgBnjB,KAAKojB,iBAAiBjb,IAAInI,KAAKqjB,OAAOlE,IAC1F,QAAef,IAAXmF,EACA,MAAO,GAEX,IACI,OAAO9d,KAAKE,MAAM4d,EACrB,CACD,MAAO/G,GACH,MAAM,IAAI9c,MAAM,kBAAkByf,UAAeY,EAAS,SAAW,oEAAoEwD,IAC5I,CACJ,CACD,iBAAMC,CAAYrE,EAAQtQ,EAAMkR,SACrBA,EAAS/f,KAAKmjB,cAAgBnjB,KAAKojB,iBAAiBpkB,IAAIgB,KAAKqjB,OAAOlE,GAAS1Z,KAAKC,UAAUmJ,GACtG,CACD,SAAM1G,CAAIrC,EAAKhG,GACX,MAAMkE,QAAelE,GAASigB,OAAS/f,KAAKmjB,cAAgBnjB,KAAKojB,iBAAiBjb,IAAIrC,GACtF,QAAcsY,IAAVpa,GAAuBlE,GAASijB,YAChC,MAAM,IAAIrjB,MAAM,IAAIoG,oBAExB,OAAO9B,CACV,CACD,SAAMhF,CAAI8G,EAAK9B,EAAOlE,GAClB,OAAQA,GAASigB,OAAS/f,KAAKmjB,cAAgBnjB,KAAKojB,iBAAiBpkB,IAAI8G,EAAK9B,EACjF,CACD,YAAM,CAAO8B,EAAKhG,GACd,OAAQA,GAASigB,OAAS/f,KAAKmjB,cAAgBnjB,KAAKojB,iBAAiBtF,OAAOhY,EAC/E,CACD,gBAAMgd,CAAW3D,EAAQrZ,EAAKhG,GAC1B,MAAM2jB,QAAiBzjB,KAAKsjB,YAAYnE,EAAQrf,GAASigB,QACzD,IAAI/b,EAKJ,GAJKyf,GAAaA,EAAS3d,KACvB9B,OAAQoa,GAEZpa,EAAQyf,EAAS3d,QACHsY,IAAVpa,GAAuBlE,GAASijB,YAChC,MAAM,IAAIrjB,MAAM,UAAUoG,gBAAkBqZ,oBAEhD,OAAOnb,QAASoa,CACnB,CACD,gBAAMO,CAAWQ,EAAQuE,EAAQ5jB,GAC7B,IAAI2jB,EACJ,IACIA,QAAiBzjB,KAAKsjB,YAAYnE,EAAQrf,GAASigB,OACtD,CACD,MAEI0D,EAAW,CAAA,CACd,OACKzjB,KAAKwjB,YAAYrE,EAAQ,IAAKsE,KAAaC,GAAU5jB,GAASigB,OACvE,CACD,mBAAMiD,CAAc7D,EAAQrZ,EAAKhG,GAC7B,MAAM2jB,QAAiBzjB,KAAKsjB,YAAYnE,EAAQrf,GAASigB,eAClD0D,EAAS3d,SACV9F,KAAKwjB,YAAYrE,EAAQsE,EAAU3jB,GAASigB,OACrD,CACD,uBAAMD,CAAkBX,EAAQrf,SACrBA,GAASigB,OAAS/f,KAAKmjB,cAAgBnjB,KAAKojB,iBAAiBtF,OAAO9d,KAAKqjB,OAAOlE,GAC1F,EAyBL,MAAMwE,GACFhO,IAAM,CAAA,EACN,SAAMxN,CAAIrC,GACN,OAAO9F,KAAK2V,IAAI7P,SAAQsY,CAC3B,CACD,SAAMpf,CAAI8G,EAAK9B,GACXhE,KAAK2V,IAAI7P,GAAO9B,CACnB,CACD,YAAM,CAAO8B,UACF9F,KAAK2V,IAAI7P,EACnB,EAmCL,MAAM8d,WAA2BlkB,MAE7B,WAAAE,CAAYC,GACRE,MAAMF,EACT,EA8BL,MAAMgkB,WAA4BnkB,MAE9B,WAAAE,CAAYkkB,GACR/jB,MAAM,IAAI+jB,wBACb,EAmCL,MAAMC,WAA6BrkB,MAC/BskB,cAEA,WAAApkB,CAAYokB,GACRjkB,MAAM,uDAAuDikB,KAC7DhkB,KAAKgkB,cAAgBA,CACxB,EAmCL,MAAMC,WAA0BvkB,MAC5B4V,MACA4O,iBAEA,WAAAtkB,CAAYC,EAASyV,EAAO4O,GACxBnkB,MAAMF,GACNG,KAAKsV,MAAQA,EACbtV,KAAKkkB,iBAAmBA,CAC3B,EA6BL,SAASC,GAAazS,GAClB,MAAM0S,EAAc,IAAI/M,IAAI3F,GAC5B,OAAO,IAAI2F,IAAI+M,EAAYC,SAAUD,EAAYE,QAAQxhB,UAC7D,CAUA5B,eAAeqjB,GAAiB7S,EAAUmH,EAAQ2L,GAC9C,OAAO,IAAIjQ,GAAQ,CACfkQ,IAAKN,GAAazS,GAClBgT,IAAK7L,EAAO8L,cACZxQ,IAAKmG,OAEJ9F,mBAAmB,CACpBxO,IAAKgV,GAAsB,GAC3B3U,IAAKme,EAAQI,UACbtT,IAAK,aAEJgD,cACAZ,KAAK8Q,EAAQte,WAAY,CAAA,EAClC,CAoDAhF,eAAe2jB,GAA0BnG,EAAWoG,EAAWN,EAASO,GACpE,QAAgB3G,IAAZoG,EACA,OAZRtjB,eAAqCwd,EAAWoG,EAAWN,EAASO,GAChE,MAAMvhB,EAAU,IAAIqU,QAAQkN,GAAgBvhB,SAI5C,OAFAA,EAAQxE,IAAI,gBAAiB,QAAQ8lB,KACrCthB,EAAQxE,IAAI,aAAculB,GAAiB7F,EAAWqG,GAAgBlM,QAAU,MAAO2L,IAChF,IACAO,EACHvhB,UAER,CAGewhB,CAAsBtG,EAAWoG,EAAWN,EAASO,GAEhE,MAAMvhB,EAAU,IAAIqU,QAAQkN,GAAgBvhB,SAG5C,OADAA,EAAQxE,IAAI,gBAAiB,UAAU8lB,KAChC,IACAC,EACHvhB,UAER,CACAtC,eAAe+jB,GAAyBC,EAAa1jB,EAAK2jB,EAAoBX,EAASY,EAAczM,OACjG,OAAOyM,EAAY5jB,QAAWqjB,GAA0BrjB,EAAIsB,WAAYoiB,EAAaV,EAASW,GAClG,CAeA,MAAME,GAAuBC,QACPlH,IAAdkH,EACOA,EA9xC2B,EA8xCqB,EAE/CA,EAhyC0B,EAiyC5BA,EAnD0B,IAgExC,SAASC,GAAwBL,EAAaplB,GAC1C,IACI0lB,EADAC,EAAqBP,EAEzB,MAAMQ,EAAwB5lB,GAAS6lB,eACjCC,EAAU9lB,GAAS+lB,aAIzB,QAAgBzH,IAAZte,QAAmDse,IAA1BsH,EAAqC,CAC9D,MAAMI,EAA0B5kB,UAC5B,IACI,MAAQgkB,YAAaa,EAAoBC,aAAEA,EAAYV,UAAEA,SA3CzEpkB,eAAkCykB,EAAgBnB,EAASqB,GACvD,MAAMI,QAAiBN,EAAeO,eAAeC,QAAQR,EAAe/G,UAAW+G,EAAeK,aAAcxB,GAEpH,OADAqB,GAAcO,KAAKnL,GAAOQ,iBAAkBwK,EAASX,WAlCjB,KAmC7B,CACHJ,YAAae,EAASf,YACtBc,aAAcC,EAASD,aACvBV,UAAWW,EAASX,UAE5B,CAmC8Fe,CAAmBX,EAAuB5lB,EAAQ0kB,QAASoB,GAEzIH,EAAqBM,OACA3H,IAAjB4H,IACAN,EAAsBM,aAAeA,GAIzCM,aAAad,GACbA,EAAgBe,WAAWT,EAA0D,IAAjCT,GAAoBC,IAExExlB,EAAQ+lB,cAAcO,KAAKnL,GAAOU,YAAa6J,EAClD,CACD,MAAOxI,GAKCA,aAAaiH,KAKb2B,GAASQ,KAAKnL,GAAOC,MAAO8B,EAAE1H,MAAO0H,EAAEkH,kBAIvC0B,GAASQ,KAAKnL,GAAOO,kBAErBwB,aAAa+G,IACb/G,EAAEgH,cAAcriB,SAAS,iBAMzBikB,GAASQ,KAAKnL,GAAOO,gBAE5B,GAELgK,EAAgBe,WAAWT,EAEc,IAAzCT,GAAoBvlB,EAAQwlB,YAC5BM,GAASQ,KAAKnL,GAAOU,YAAa6J,EACrC,MACI,QAAgBpH,IAAZwH,EAAuB,CAE5B,MAAMY,EAAoBD,WAAW,KACjCX,EAAQQ,KAAKnL,GAAOO,kBACqB,IAA1C6J,GAAoBvlB,GAASwlB,YAChCM,EAAQQ,KAAKnL,GAAOU,YAAa6K,EACpC,CACD,OAAOtlB,MAAOM,EAAKilB,KACf,IAAI7N,QAAiBqM,GAAyBQ,EAAoBjkB,EAAKilB,EAAa3mB,GAAS0kB,QAAS1kB,GAAS6Y,OAC/G,MAAM+N,GAAiC9N,EAAS+N,KAhI3BC,EAgIsDhO,EAASI,QA5HjF,CAAC,IAAK,KAAKrX,SAASilB,IAJ/B,IAA6BA,EAiIrB,GAAIhO,EAAS+N,IAAMD,EAGf,OAAO9N,EAaX,OAX0BA,EAASpX,MAAQA,QACG4c,IAArBte,GAAS0kB,UAM9B5L,QAAiBqM,GAAyBQ,EAE1C7M,EAASpX,IAAKilB,EAAa3mB,EAAQ0kB,QAAS1kB,EAAQ6Y,QAEjDC,EAEf,CCj7CA,MAAMuB,GAAY,GAClB,IAAK,IAAIrb,EAAI,EAAGA,EAAI,MAAOA,EACvBqb,GAAU/X,MAAMtD,EAAI,KAAOgE,SAAS,IAAIsX,MAAM,ICHlD,MAAMC,GAAQ,IAAIxb,WAAW,ICE7B,SAASyb,GAAGxa,EAASlB,EAAK2b,GACtB,OAAwBjQ,OAAOkQ,WACpBlQ,OAAOkQ,aAItB,SAAa1a,GACTA,EAAUA,GAAW,GACrB,MAAM2a,EAAO3a,EAAQ4a,QAAU5a,EAAQ6a,SDRhCrQ,OAAOsQ,gBAAgBP,ICS9B,GAAII,EAAK9b,OAAS,GACd,MAAM,IAAIe,MAAM,qCAcpB,OAZA+a,EAAK,GAAgB,GAAVA,EAAK,GAAa,GAC7BA,EAAK,GAAgB,GAAVA,EAAK,GAAa,IFV1B,SAAyBtY,EAAKoY,EAAS,GAC1C,OAAQJ,GAAUhY,EAAIoY,EAAS,IAC3BJ,GAAUhY,EAAIoY,EAAS,IACvBJ,GAAUhY,EAAIoY,EAAS,IACvBJ,GAAUhY,EAAIoY,EAAS,IACvB,IACAJ,GAAUhY,EAAIoY,EAAS,IACvBJ,GAAUhY,EAAIoY,EAAS,IACvB,IACAJ,GAAUhY,EAAIoY,EAAS,IACvBJ,GAAUhY,EAAIoY,EAAS,IACvB,IACAJ,GAAUhY,EAAIoY,EAAS,IACvBJ,GAAUhY,EAAIoY,EAAS,IACvB,IACAJ,GAAUhY,EAAIoY,EAAS,KACvBJ,GAAUhY,EAAIoY,EAAS,KACvBJ,GAAUhY,EAAIoY,EAAS,KACvBJ,GAAUhY,EAAIoY,EAAS,KACvBJ,GAAUhY,EAAIoY,EAAS,KACvBJ,GAAUhY,EAAIoY,EAAS,MAAM9J,aACrC,CEAWoK,CAAgBJ,EAC3B,CArBWK,CAAIhb,EACf,4KCgBA,IAOI+mB,EAPAC,EAAuB,iBAAZC,QAAuBA,QAAU,KAC5CC,EAAeF,GAAwB,mBAAZA,EAAEvkB,MAC7BukB,EAAEvkB,MACF,SAAsB0kB,EAAQC,EAAUtH,GACxC,OAAOuH,SAASnlB,UAAUO,MAAMQ,KAAKkkB,EAAQC,EAAUtH,EACxD,EAIDiH,EADEC,GAA0B,mBAAdA,EAAEM,QACCN,EAAEM,QACVvkB,OAAOwkB,sBACC,SAAwBJ,GACvC,OAAOpkB,OAAOykB,oBAAoBL,GAC/B3oB,OAAOuE,OAAOwkB,sBAAsBJ,GAC3C,EAEmB,SAAwBA,GACvC,OAAOpkB,OAAOykB,oBAAoBL,EACtC,EAOA,IAAIM,EAAc7W,OAAOyG,OAAS,SAAqBnT,GACrD,OAAOA,GAAUA,CAClB,EAED,SAASwjB,IACPA,EAAavF,KAAKlf,KAAK/C,KACxB,CACaynB,GAAAC,QAAGF,EACEC,GAAAC,QAAAC,KAwYnB,SAAc/B,EAAS3lB,GACrB,OAAO,IAAIgc,QAAQ,SAAUtT,EAASif,GACpC,SAASC,EAAc9O,GACrB6M,EAAQkC,eAAe7nB,EAAM8nB,GAC7BH,EAAO7O,EACR,CAED,SAASgP,IAC+B,mBAA3BnC,EAAQkC,gBACjBlC,EAAQkC,eAAe,QAASD,GAElClf,EAAQ,GAAGyR,MAAMrX,KAAKilB,WAE5B,CACIC,EAA+BrC,EAAS3lB,EAAM8nB,EAAU,CAAEJ,MAAM,IACnD,UAAT1nB,GAMR,SAAuC2lB,EAAStJ,EAAS4L,GAC7B,mBAAftC,EAAQuC,IACjBF,EAA+BrC,EAAS,QAAStJ,EAAS4L,EAE7D,CATKE,CAA8BxC,EAASiC,EAAe,CAAEF,MAAM,GAEpE,EACC,EAxZDH,EAAaA,aAAeA,EAE5BA,EAAaxlB,UAAUqmB,aAAUjK,EACjCoJ,EAAaxlB,UAAUsmB,aAAe,EACtCd,EAAaxlB,UAAUumB,mBAAgBnK,EAIvC,IAAIoK,EAAsB,GAE1B,SAASC,EAAcC,GACrB,GAAwB,mBAAbA,EACT,MAAM,IAAIrpB,UAAU,0EAA4EqpB,EAEnG,CAoCD,SAASC,EAAiBC,GACxB,YAA2BxK,IAAvBwK,EAAKL,cACAf,EAAagB,oBACfI,EAAKL,aACb,CAkDD,SAASM,EAAa5B,EAAQvf,EAAMghB,EAAUI,GAC5C,IAAInZ,EACAoZ,EACAC,EA1HsBC,EAgJ1B,GApBAR,EAAcC,QAGCtK,KADf2K,EAAS9B,EAAOoB,UAEdU,EAAS9B,EAAOoB,QAAUxlB,OAAOqmB,OAAO,MACxCjC,EAAOqB,aAAe,SAIKlK,IAAvB2K,EAAOI,cACTlC,EAAOb,KAAK,cAAe1e,EACfghB,EAASA,SAAWA,EAASA,SAAWA,GAIpDK,EAAS9B,EAAOoB,SAElBW,EAAWD,EAAOrhB,SAGH0W,IAAb4K,EAEFA,EAAWD,EAAOrhB,GAAQghB,IACxBzB,EAAOqB,kBAeT,GAbwB,mBAAbU,EAETA,EAAWD,EAAOrhB,GAChBohB,EAAU,CAACJ,EAAUM,GAAY,CAACA,EAAUN,GAErCI,EACTE,EAASI,QAAQV,GAEjBM,EAAS5mB,KAAKsmB,IAIhB/Y,EAAIgZ,EAAiB1B,IACb,GAAK+B,EAASrqB,OAASgR,IAAMqZ,EAASK,OAAQ,CACpDL,EAASK,QAAS,EAGlB,IAAIxZ,EAAI,IAAInQ,MAAM,+CACEspB,EAASrqB,OAAS,IAAM0D,OAAOqF,GADjC,qEAIlBmI,EAAE5P,KAAO,8BACT4P,EAAE+V,QAAUqB,EACZpX,EAAEnI,KAAOA,EACTmI,EAAEyZ,MAAQN,EAASrqB,OA7KGsqB,EA8KHpZ,EA7KnB0Z,SAAWA,QAAQC,MAAMD,QAAQC,KAAKP,EA8KvC,CAGH,OAAOhC,CACR,CAaD,SAASwC,IACP,IAAKzpB,KAAK0pB,MAGR,OAFA1pB,KAAKinB,OAAOa,eAAe9nB,KAAK0H,KAAM1H,KAAK2pB,QAC3C3pB,KAAK0pB,OAAQ,EACY,IAArB1B,UAAUrpB,OACLqB,KAAK0oB,SAAS3lB,KAAK/C,KAAKinB,QAC1BjnB,KAAK0oB,SAASnmB,MAAMvC,KAAKinB,OAAQe,UAE3C,CAED,SAAS4B,EAAU3C,EAAQvf,EAAMghB,GAC/B,IAAIlK,EAAQ,CAAEkL,OAAO,EAAOC,YAAQvL,EAAW6I,OAAQA,EAAQvf,KAAMA,EAAMghB,SAAUA,GACjFmB,EAAUJ,EAAYK,KAAKtL,GAG/B,OAFAqL,EAAQnB,SAAWA,EACnBlK,EAAMmL,OAASE,EACRA,CACR,CAyHD,SAASE,EAAW9C,EAAQvf,EAAMsiB,GAChC,IAAIjB,EAAS9B,EAAOoB,QAEpB,QAAejK,IAAX2K,EACF,MAAO,GAET,IAAIkB,EAAalB,EAAOrhB,GACxB,YAAmB0W,IAAf6L,EACK,GAEiB,mBAAfA,EACFD,EAAS,CAACC,EAAWvB,UAAYuB,GAAc,CAACA,GAElDD,EAsDT,SAAyB7nB,GAEvB,IADA,IAAI+nB,EAAM,IAAIhnB,MAAMf,EAAIxD,QACfG,EAAI,EAAGA,EAAIorB,EAAIvrB,SAAUG,EAChCorB,EAAIprB,GAAKqD,EAAIrD,GAAG4pB,UAAYvmB,EAAIrD,GAElC,OAAOorB,CACR,CA3DGC,CAAgBF,GAAcG,EAAWH,EAAYA,EAAWtrB,OACnE,CAmBD,SAAS0rB,EAAc3iB,GACrB,IAAIqhB,EAAS/oB,KAAKqoB,QAElB,QAAejK,IAAX2K,EAAsB,CACxB,IAAIkB,EAAalB,EAAOrhB,GAExB,GAA0B,mBAAfuiB,EACT,OAAO,EACF,QAAmB7L,IAAf6L,EACT,OAAOA,EAAWtrB,MAErB,CAED,OAAO,CACR,CAMD,SAASyrB,EAAWjoB,EAAKmoB,GAEvB,IADA,IAAIC,EAAO,IAAIrnB,MAAMonB,GACZxrB,EAAI,EAAGA,EAAIwrB,IAAKxrB,EACvByrB,EAAKzrB,GAAKqD,EAAIrD,GAChB,OAAOyrB,CACR,CA2CD,SAAStC,EAA+BrC,EAAS3lB,EAAMyoB,EAAUR,GAC/D,GAA0B,mBAAftC,EAAQuC,GACbD,EAAMP,KACR/B,EAAQ+B,KAAK1nB,EAAMyoB,GAEnB9C,EAAQuC,GAAGloB,EAAMyoB,OAEd,IAAwC,mBAA7B9C,EAAQ4E,iBAYxB,MAAM,IAAInrB,UAAU,6EAA+EumB,GATnGA,EAAQ4E,iBAAiBvqB,EAAM,SAASwqB,EAAaC,GAG/CxC,EAAMP,MACR/B,EAAQ+E,oBAAoB1qB,EAAMwqB,GAEpC/B,EAASgC,EACf,EAGG,CACH,QAraA7nB,OAAO+S,eAAe4R,EAAc,sBAAuB,CACzD9N,YAAY,EACZvR,IAAK,WACH,OAAOqgB,CACR,EACDxpB,IAAK,SAAS0rB,GACZ,GAAmB,iBAARA,GAAoBA,EAAM,GAAKnD,EAAYmD,GACpD,MAAM,IAAIE,WAAW,kGAAoGF,EAAM,KAEjIlC,EAAsBkC,CACvB,IAGHlD,EAAavF,KAAO,gBAEG7D,IAAjBpe,KAAKqoB,SACLroB,KAAKqoB,UAAYxlB,OAAOG,eAAehD,MAAMqoB,UAC/CroB,KAAKqoB,QAAUxlB,OAAOqmB,OAAO,MAC7BlpB,KAAKsoB,aAAe,GAGtBtoB,KAAKuoB,cAAgBvoB,KAAKuoB,oBAAiBnK,CAC7C,EAIAoJ,EAAaxlB,UAAU6oB,gBAAkB,SAAyBP,GAChE,GAAiB,iBAANA,GAAkBA,EAAI,GAAK/C,EAAY+C,GAChD,MAAM,IAAIM,WAAW,gFAAkFN,EAAI,KAG7G,OADAtqB,KAAKuoB,cAAgB+B,EACdtqB,IACT,EAQAwnB,EAAaxlB,UAAU8oB,gBAAkB,WACvC,OAAOnC,EAAiB3oB,KAC1B,EAEAwnB,EAAaxlB,UAAUokB,KAAO,SAAc1e,GAE1C,IADA,IAAIkY,EAAO,GACF9gB,EAAI,EAAGA,EAAIkpB,UAAUrpB,OAAQG,IAAK8gB,EAAKxd,KAAK4lB,UAAUlpB,IAC/D,IAAIisB,EAAoB,UAATrjB,EAEXqhB,EAAS/oB,KAAKqoB,QAClB,QAAejK,IAAX2K,EACFgC,EAAWA,QAA4B3M,IAAjB2K,EAAOzT,WAC1B,IAAKyV,EACR,OAAO,EAGT,GAAIA,EAAS,CACX,IAAIC,EAGJ,GAFIpL,EAAKjhB,OAAS,IAChBqsB,EAAKpL,EAAK,IACRoL,aAActrB,MAGhB,MAAMsrB,EAGR,IAAIjS,EAAM,IAAIrZ,MAAM,oBAAsBsrB,EAAK,KAAOA,EAAGnrB,QAAU,IAAM,KAEzE,MADAkZ,EAAIkS,QAAUD,EACRjS,CACP,CAED,IAAIuD,EAAUyM,EAAOrhB,GAErB,QAAgB0W,IAAZ9B,EACF,OAAO,EAET,GAAuB,mBAAZA,EACT0K,EAAa1K,EAAStc,KAAM4f,OAE5B,KAAIsL,EAAM5O,EAAQ3d,OACdwsB,EAAYf,EAAW9N,EAAS4O,GACpC,IAASpsB,EAAI,EAAGA,EAAIosB,IAAOpsB,EACzBkoB,EAAamE,EAAUrsB,GAAIkB,KAAM4f,EAHX,CAM1B,OAAO,CACT,EAgEA4H,EAAaxlB,UAAUopB,YAAc,SAAqB1jB,EAAMghB,GAC9D,OAAOG,EAAa7oB,KAAM0H,EAAMghB,GAAU,EAC5C,EAEAlB,EAAaxlB,UAAUmmB,GAAKX,EAAaxlB,UAAUopB,YAEnD5D,EAAaxlB,UAAUqpB,gBACnB,SAAyB3jB,EAAMghB,GAC7B,OAAOG,EAAa7oB,KAAM0H,EAAMghB,GAAU,EAChD,EAoBAlB,EAAaxlB,UAAU2lB,KAAO,SAAcjgB,EAAMghB,GAGhD,OAFAD,EAAcC,GACd1oB,KAAKmoB,GAAGzgB,EAAMkiB,EAAU5pB,KAAM0H,EAAMghB,IAC7B1oB,IACT,EAEAwnB,EAAaxlB,UAAUspB,oBACnB,SAA6B5jB,EAAMghB,GAGjC,OAFAD,EAAcC,GACd1oB,KAAKqrB,gBAAgB3jB,EAAMkiB,EAAU5pB,KAAM0H,EAAMghB,IAC1C1oB,IACb,EAGAwnB,EAAaxlB,UAAU8lB,eACnB,SAAwBpgB,EAAMghB,GAC5B,IAAI6C,EAAMxC,EAAQyC,EAAU1sB,EAAG2sB,EAK/B,GAHAhD,EAAcC,QAGCtK,KADf2K,EAAS/oB,KAAKqoB,SAEZ,OAAOroB,KAGT,QAAaoe,KADbmN,EAAOxC,EAAOrhB,IAEZ,OAAO1H,KAET,GAAIurB,IAAS7C,GAAY6C,EAAK7C,WAAaA,EACb,MAAtB1oB,KAAKsoB,aACTtoB,KAAKqoB,QAAUxlB,OAAOqmB,OAAO,cAEtBH,EAAOrhB,GACVqhB,EAAOjB,gBACT9nB,KAAKomB,KAAK,iBAAkB1e,EAAM6jB,EAAK7C,UAAYA,SAElD,GAAoB,mBAAT6C,EAAqB,CAGrC,IAFAC,GAAY,EAEP1sB,EAAIysB,EAAK5sB,OAAS,EAAGG,GAAK,EAAGA,IAChC,GAAIysB,EAAKzsB,KAAO4pB,GAAY6C,EAAKzsB,GAAG4pB,WAAaA,EAAU,CACzD+C,EAAmBF,EAAKzsB,GAAG4pB,SAC3B8C,EAAW1sB,EACX,KACD,CAGH,GAAI0sB,EAAW,EACb,OAAOxrB,KAEQ,IAAbwrB,EACFD,EAAKG,QAiIf,SAAmBH,EAAMrV,GACvB,KAAOA,EAAQ,EAAIqV,EAAK5sB,OAAQuX,IAC9BqV,EAAKrV,GAASqV,EAAKrV,EAAQ,GAC7BqV,EAAK7hB,KACN,CAnISiiB,CAAUJ,EAAMC,GAGE,IAAhBD,EAAK5sB,SACPoqB,EAAOrhB,GAAQ6jB,EAAK,SAEQnN,IAA1B2K,EAAOjB,gBACT9nB,KAAKomB,KAAK,iBAAkB1e,EAAM+jB,GAAoB/C,EACzD,CAED,OAAO1oB,IACb,EAEAwnB,EAAaxlB,UAAU4pB,IAAMpE,EAAaxlB,UAAU8lB,eAEpDN,EAAaxlB,UAAU6pB,mBACnB,SAA4BnkB,GAC1B,IAAIyjB,EAAWpC,EAAQjqB,EAGvB,QAAesf,KADf2K,EAAS/oB,KAAKqoB,SAEZ,OAAOroB,KAGT,QAA8Boe,IAA1B2K,EAAOjB,eAUT,OATyB,IAArBE,UAAUrpB,QACZqB,KAAKqoB,QAAUxlB,OAAOqmB,OAAO,MAC7BlpB,KAAKsoB,aAAe,QACMlK,IAAjB2K,EAAOrhB,KACY,MAAtB1H,KAAKsoB,aACTtoB,KAAKqoB,QAAUxlB,OAAOqmB,OAAO,aAEtBH,EAAOrhB,IAEX1H,KAIT,GAAyB,IAArBgoB,UAAUrpB,OAAc,CAC1B,IACImH,EADA1C,EAAOP,OAAOO,KAAK2lB,GAEvB,IAAKjqB,EAAI,EAAGA,EAAIsE,EAAKzE,SAAUG,EAEjB,oBADZgH,EAAM1C,EAAKtE,KAEXkB,KAAK6rB,mBAAmB/lB,GAK1B,OAHA9F,KAAK6rB,mBAAmB,kBACxB7rB,KAAKqoB,QAAUxlB,OAAOqmB,OAAO,MAC7BlpB,KAAKsoB,aAAe,EACbtoB,IACR,CAID,GAAyB,mBAFzBmrB,EAAYpC,EAAOrhB,IAGjB1H,KAAK8nB,eAAepgB,EAAMyjB,QACrB,QAAkB/M,IAAd+M,EAET,IAAKrsB,EAAIqsB,EAAUxsB,OAAS,EAAGG,GAAK,EAAGA,IACrCkB,KAAK8nB,eAAepgB,EAAMyjB,EAAUrsB,IAIxC,OAAOkB,IACb,EAmBAwnB,EAAaxlB,UAAUmpB,UAAY,SAAmBzjB,GACpD,OAAOqiB,EAAW/pB,KAAM0H,GAAM,EAChC,EAEA8f,EAAaxlB,UAAU8pB,aAAe,SAAsBpkB,GAC1D,OAAOqiB,EAAW/pB,KAAM0H,GAAM,EAChC,EAEA8f,EAAa6C,cAAgB,SAASzE,EAASle,GAC7C,MAAqC,mBAA1Bke,EAAQyE,cACVzE,EAAQyE,cAAc3iB,GAEtB2iB,EAActnB,KAAK6iB,EAASle,EAEvC,EAEA8f,EAAaxlB,UAAUqoB,cAAgBA,EAiBvC7C,EAAaxlB,UAAU+pB,WAAa,WAClC,OAAO/rB,KAAKsoB,aAAe,EAAIzB,EAAe7mB,KAAKqoB,SAAW,EAChE,0BCnYqB,MAAA2D,WAA8B9I,GACjD,WAAAtjB,CAAYujB,EAAyBC,GACnCrjB,MAAMojB,EAAeC,EACtB,ECzCI,MAAM6I,WAA0BvsB,OAYvC,SAASwsB,GAAgB/b,GACrB,IAAIgc,EAAShc,EAAIvO,QAAQ,KAAM,KAAKA,QAAQ,KAAM,KAClD,OAAQuqB,EAAOxtB,OAAS,GACpB,KAAK,EACD,MACJ,KAAK,EACDwtB,GAAU,KACV,MACJ,KAAK,EACDA,GAAU,IACV,MACJ,QACI,MAAM,IAAIzsB,MAAM,8CAExB,IACI,OAxBR,SAA0ByQ,GACtB,OAAOic,mBAAmBtqB,KAAKqO,GAAKvO,QAAQ,OAAQ,CAAC+N,EAAG0c,KACpD,IAAI9sB,EAAO8sB,EAAE7sB,WAAW,GAAGsD,SAAS,IAAI6hB,cAIxC,OAHIplB,EAAKZ,OAAS,IACdY,EAAO,IAAMA,GAEV,IAAMA,IAErB,CAgBe+sB,CAAiBH,EAC3B,CACD,MAAOpT,GACH,OAAOjX,KAAKqqB,EACf,CACL,CA9BAF,GAAkBjqB,UAAU/B,KAAO,oBCDnC,IAMIssB,GACAC,GASFC,GAhBEC,GAAY,CACdC,MAAO,OACPC,KAAM,OACNpD,KAAM,OACNlU,MAAO,QAILuX,GAAsB,CAAEJ,IAC1BA,EAAKA,EAAW,KAAI,GAAK,OACzBA,EAAKA,EAAY,MAAI,GAAK,QAC1BA,EAAKA,EAAW,KAAI,GAAK,OACzBA,EAAKA,EAAW,KAAI,GAAK,OACzBA,EAAKA,EAAY,MAAI,GAAK,QACnBA,GANiB,CAOvBI,IAAO,CAAA,IACRJ,GAiBCI,KAAQA,GAAM,CAAE,IAZZC,MAJL,WACEP,GAAQ,EACRC,GAASE,EACV,EAQDD,GAAKM,SANL,SAAkB/oB,GAChB,KAAM,GAAgBA,GAASA,GAAS,GACtC,MAAM,IAAItE,MAAM,qBAElB6sB,GAAQvoB,CACT,EAKDyoB,GAAKO,UAHL,SAAmBhpB,GACjBwoB,GAASxoB,CACV,EAGH,IAAIipB,GAAS,MAAMC,EACjB,WAAAttB,CAAYutB,GACVntB,KAAKmtB,MAAQA,CACd,CAED,KAAAR,IAAS/M,GACH2M,IAAS,GACXC,GAAOG,MAAMO,EAAQE,QAAQptB,KAAKmtB,MAAOntB,KAAKqtB,YAAazN,EAE9D,CACD,IAAAgN,IAAQhN,GACF2M,IAAS,GACXC,GAAOI,KAAKM,EAAQE,QAAQptB,KAAKmtB,MAAOntB,KAAKqtB,YAAazN,EAE7D,CACD,IAAA4J,IAAQ5J,GACF2M,IAAS,GACXC,GAAOhD,KAAK0D,EAAQE,QAAQptB,KAAKmtB,MAAOntB,KAAKqtB,YAAazN,EAE7D,CACD,KAAAtK,IAASsK,GACH2M,IAAS,GACXC,GAAOlX,MAAM4X,EAAQE,QAAQptB,KAAKmtB,MAAOntB,KAAKqtB,YAAazN,EAE9D,CAED,MAAM7G,GAEJ,MADA/Y,KAAKsV,MAAMyD,GACLA,CACP,CACD,MAAAmQ,CAAOrQ,GACL,MAAMyU,EAAezqB,OAAOqmB,OAAOlpB,MAGnC,OAFAstB,EAAaD,QAAUxU,EACvByU,EAAaX,MAAM,SACZW,CACR,CACD,mBAAOC,CAAattB,EAAMutB,GACxB,MAAMC,EAAe,IAAIP,EAAQ,GAAGjtB,KAAQutB,KAE5C,OADAC,EAAad,MAAM,SACZc,CACR,CACD,cAAOL,CAAQntB,EAAM4Y,GACnB,MAAM6U,EAAS,IAAIztB,KACnB,OAAO4Y,EAAS,GAAG6U,KAAU7U,KAAY6U,CAC1C,CAGD,YAAOf,CAAM1sB,KAAS2f,GAChB2M,IAAS,GACXC,GAAOG,MAAMO,EAAQE,QAAQntB,MAAU2f,EAE1C,CACD,WAAOgN,CAAK3sB,KAAS2f,GACf2M,IAAS,GACXC,GAAOI,KAAKM,EAAQE,QAAQntB,MAAU2f,EAEzC,CACD,WAAO4J,CAAKvpB,KAAS2f,GACf2M,IAAS,GACXC,GAAOhD,KAAK0D,EAAQE,QAAQntB,MAAU2f,EAEzC,CACD,YAAOtK,CAAMrV,KAAS2f,GAChB2M,IAAS,GACXC,GAAOlX,MAAM4X,EAAQE,QAAQntB,MAAU2f,EAE1C,GAGHiN,GAAIC,QAIJ,IAAIa,GAAW,MAEb,aAAOtsB,CAAOwU,GACZ,IACE,OD/EC,SAAmBA,EAAO/V,GAC7B,GAAqB,iBAAV+V,EACP,MAAM,IAAIoW,GAAkB,6CAEhCnsB,IAAYA,EAAU,CAAA,GACtB,MAAM8tB,GAAyB,IAAnB9tB,EAAQ6D,OAAkB,EAAI,EACpCkqB,EAAOhY,EAAM7C,MAAM,KAAK4a,GAC9B,GAAoB,iBAATC,EACP,MAAM,IAAI5B,GAAkB,0CAA0C2B,EAAM,KAEhF,IAAIE,EACJ,IACIA,EAAU5B,GAAgB2B,EAC7B,CACD,MAAO7Q,GACH,MAAM,IAAIiP,GAAkB,qDAAqD2B,EAAM,MAAM5Q,EAAEnd,WAClG,CACD,IACI,OAAO4F,KAAKE,MAAMmoB,EACrB,CACD,MAAO9Q,GACH,MAAM,IAAIiP,GAAkB,mDAAmD2B,EAAM,MAAM5Q,EAAEnd,WAChG,CACL,CCwDakuB,CAAUlY,EAClB,CAAC,MAAOkD,GAEP,MADAkU,GAAO3X,MAAM,kBAAmByD,GAC1BA,CACP,CACF,CACD,8BAAaiV,CAAkBrqB,EAAQrD,EAAS4F,GAC9C,MAEM+nB,EAAe,GAFCC,GAAYC,iBAAgB,IAAIlwB,aAAciB,OAAOuG,KAAKC,UAAU/B,QACnEuqB,GAAYC,iBAAgB,IAAIlwB,aAAciB,OAAOuG,KAAKC,UAAUpF,OAErFyO,QAAkBqf,OAAO9jB,OAAOzB,OAAO6K,KAC3C,CACEzT,KAAM,QACNgK,KAAM,CAAEhK,KAAM,YAEhBiG,GACA,IAAIjI,aAAciB,OAAO+uB,IAG3B,MAAO,GAAGA,KADeC,GAAYC,gBAAgB,IAAItvB,WAAWkQ,KAErE,CACD,sCAAasf,CAA0B1qB,EAAQrD,EAASguB,GACtD,MAEML,EAAe,GAFCC,GAAYC,iBAAgB,IAAIlwB,aAAciB,OAAOuG,KAAKC,UAAU/B,QACnEuqB,GAAYC,iBAAgB,IAAIlwB,aAAciB,OAAOuG,KAAKC,UAAUpF,OAErFyO,QAAkBqf,OAAO9jB,OAAOzB,OAAO6K,KAC3C,OACA4a,GACA,IAAIrwB,aAAciB,OAAO+uB,IAG3B,MAAO,GAAGA,KADeC,GAAYC,gBAAgB,IAAItvB,WAAWkQ,KAErE,GAKC9M,GAAYssB,GAAQ9rB,KAAK,IAAI,IAAI5D,WAAW0vB,IAAM5Y,IAAK6Y,GAAQnsB,OAAOC,aAAaksB,IAAM9rB,KAAK,KAC9F+rB,GAAe,MAAMA,EACvB,kBAAOC,GACL,MAAMvsB,EAAM,IAAIwsB,YAAY,GAE5B,OADArkB,OAAOsQ,gBAAgBzY,GAChBA,EAAI,EACZ,CAID,qBAAOysB,GAKL,MAhBmB,uCAYWhtB,QAC5B,SACCitB,KAAQA,EAAIJ,EAAaC,cAAgB,KAAOG,EAAI,GAAG/rB,SAAS,KAEvDlB,QAAQ,KAAM,GAC3B,CAID,2BAAOktB,GACL,OAAOL,EAAaG,iBAAmBH,EAAaG,iBAAmBH,EAAaG,gBACrF,CAID,kCAAaG,CAAsBC,GACjC,IAAK1kB,OAAOzB,OACV,MAAM,IAAInJ,MAAM,+DAElB,IACE,MACMmP,GADU,IAAI5Q,aACCiB,OAAO8vB,GACtBC,QAAe3kB,OAAOzB,OAAOqmB,OAAO,UAAWrgB,GACrD,OAAO5M,GAASgtB,GAAQrtB,QAAQ,MAAO,KAAKA,QAAQ,MAAO,KAAKA,QAAQ,MAAO,GAChF,CAAC,MAAOmX,GAEP,MADAkU,GAAO3X,MAAM,oCAAqCyD,GAC5CA,CACP,CACF,CAID,wBAAOoW,CAAkBC,EAAWC,GAClC,MACMxgB,GADU,IAAI5Q,aACCiB,OAAO,CAACkwB,EAAWC,GAAe3sB,KAAK,MAC5D,OAAOT,GAAS4M,EACjB,CAMD,iBAAa5E,CAAKjE,EAAKnG,GACrB,MAAMyvB,GAAW,IAAIrxB,aAAciB,OAAOW,GACpC0vB,QAAmBjlB,OAAOzB,OAAOqmB,OAAOlpB,EAAKspB,GACnD,OAAO,IAAIzwB,WAAW0wB,EACvB,CAKD,yCAAaC,CAA6BnpB,GACxC,IAAIopB,EACJ,OAAQppB,EAAIO,KACV,IAAK,MACH6oB,EAAa,CACXzS,EAAK3W,EAAI2W,EACTpW,IAAOP,EAAIO,IACX0jB,EAAKjkB,EAAIikB,GAEX,MACF,IAAK,KACHmF,EAAa,CACXnnB,IAAOjC,EAAIiC,IACX1B,IAAOP,EAAIO,IACX8oB,EAAKrpB,EAAIqpB,EACT5f,EAAKzJ,EAAIyJ,GAEX,MACF,IAAK,MACH2f,EAAa,CACXnnB,IAAOjC,EAAIiC,IACX1B,IAAOP,EAAIO,IACX8oB,EAAKrpB,EAAIqpB,GAEX,MACF,IAAK,MACHD,EAAa,CACXnnB,IAAOjC,EAAIS,EACXF,IAAOP,EAAIO,KAEb,MACF,QACE,MAAM,IAAIlH,MAAM,oBAEpB,MAAMiwB,QAA6BlB,EAAaxkB,KAAK,UAAWxE,KAAKC,UAAU+pB,IAC/E,OAAOhB,EAAaN,gBAAgBwB,EACrC,CACD,8BAAaC,EAAkBpuB,IAC7BA,EAAG0jB,YACHA,EAAW2K,WACXA,EAAUC,QACVA,EAAOC,MACPA,IAEA,IAAIC,EACAC,EACJ,MAAM3vB,EAAU,CACd6T,IAAOia,OAAO9jB,OAAOkQ,aACrBkK,IAAqB,MAAdmL,EAAqBA,EAAa,MACzCpL,IAAOjjB,EACP+Q,IAAOhD,KAAKC,MAAMuB,KAAKuB,MAAQ,MAE7B4S,IACF8K,QAAoBvB,EAAaxkB,KAAK,UAAWib,GACjD+K,EAAcxB,EAAaN,gBAAgB6B,GAC3C1vB,EAAQ4vB,IAAMD,GAEZF,IACFzvB,EAAQyvB,MAAQA,GAElB,IACE,MAAMI,QAAkB7lB,OAAOzB,OAAOoM,UAAU,MAAO6a,EAAQlL,WACzDjhB,EAAS,CACbqC,IAAO,QACPsL,IAAO,WACPjL,IAAO,CACLiC,IAAO6nB,EAAU7nB,IACjB1B,IAAOupB,EAAUvpB,IACjB8oB,EAAKS,EAAUT,EACf5f,EAAKqgB,EAAUrgB,IAGnB,aAAa6d,GAASK,kBAAkBrqB,EAAQrD,EAASwvB,EAAQ5pB,WAClE,CAAC,MAAO6S,GACP,MAAIA,aAAe1Z,UACX,IAAIK,MAAM,oCAAoCqZ,EAAIlZ,WAElDkZ,CAET,CACF,CACD,4BAAaqX,CAAgBN,GAC3B,IACE,MAAMK,QAAkB7lB,OAAOzB,OAAOoM,UAAU,MAAO6a,EAAQlL,WAC/D,aAAa6J,EAAae,6BAA6BW,EACxD,CAAC,MAAOpX,GACP,MAAIA,aAAe1Z,UACX,IAAIK,MAAM,8CAA8CqZ,EAAIlZ,WAE5DkZ,CAET,CACF,CACD,6BAAasX,GACX,aAAajC,OAAO9jB,OAAOzB,OAAOqR,YAChC,CACEja,KAAM,QACNwI,WAAY,UAEd,EACA,CAAC,OAAQ,UAEZ,CAQD,uCAAa6nB,CAA2BlB,EAAWC,EAAe3d,EAAU3H,EAAY,SACtF,MAAMuI,EAAM/C,KAAKC,MAAMuB,KAAKuB,MAAQ,KAC9B3O,EAAS,CACbqC,IAAO+D,EACPuH,IAAO,OAEHhR,EAAU,CACd0R,IAAOod,EACPnd,IAAOmd,EACPld,IAAOR,EACPyC,IAAOsa,EAAaG,iBACpBnc,IAAOH,EAAM,IAEbC,IAAOD,GAOHie,EALU,CACdvjB,MAAS,UACTC,MAAS,UACTC,MAAS,WAEkBnD,GAC7B,IAAKwmB,EACH,MAAM,IAAI7wB,MAAM,0BAA0BqK,oDAE5C,MAAM/L,EAAU,IAAIC,YACdqwB,QAAkBhkB,OAAOzB,OAAO0B,UACpC,MACAvM,EAAQkB,OAAOmwB,GACf,CAAEpvB,KAAM,OAAQgK,KAAMsmB,IACtB,EACA,CAAC,SAEH,aAAa5C,GAASU,0BAA0B1qB,EAAQrD,EAASguB,EAClE,GAKHG,GAAaN,gBAAmB7sB,GACvBW,GAASX,GAAOM,QAAQ,KAAM,IAAIA,QAAQ,MAAO,KAAKA,QAAQ,MAAO,KAE9E,IAAIssB,GAAcO,GAGd+B,GAAQ,MACV,WAAA5wB,CAAYutB,GACVntB,KAAKmtB,MAAQA,EACbntB,KAAKywB,WAAa,GAClBzwB,KAAK0wB,QAAU,IAAIzD,GAAO,UAAUjtB,KAAKmtB,UAC1C,CACD,UAAAwD,CAAWC,GAET,OADA5wB,KAAKywB,WAAWruB,KAAKwuB,GACd,IAAM5wB,KAAK6wB,cAAcD,EACjC,CACD,aAAAC,CAAcD,GACZ,MAAME,EAAM9wB,KAAKywB,WAAWM,YAAYH,GACpCE,GAAO,GACT9wB,KAAKywB,WAAWO,OAAOF,EAAK,EAE/B,CACD,WAAMG,IAASC,GACblxB,KAAK0wB,QAAQ/D,MAAM,YAAauE,GAChC,IAAK,MAAMN,KAAM5wB,KAAKywB,iBACdG,KAAMM,EAEf,GAyBCC,GAAQ,MAAMC,UAAeZ,GAC/B,WAAA5wB,GACEG,SAASioB,WACThoB,KAAK0wB,QAAU,IAAIzD,GAAO,UAAUjtB,KAAKmtB,WACzCntB,KAAKqxB,aAAe,KACpBrxB,KAAKsxB,YAAc,EACnBtxB,KAAKuxB,UAAY,KACf,MAAMC,EAAOxxB,KAAKsxB,YAAcF,EAAOK,eACvCzxB,KAAK0wB,QAAQ/D,MAAM,qBAAsB6E,GACrCxxB,KAAKsxB,aAAeF,EAAOK,iBAC7BzxB,KAAK0xB,SACA3xB,MAAMkxB,SAGhB,CAED,mBAAOQ,GACL,OAAOliB,KAAKC,MAAMuB,KAAKuB,MAAQ,IAChC,CACD,IAAA2P,CAAK0P,GACH,MAAMC,EAAU5xB,KAAK0wB,QAAQxH,OAAO,QACpCyI,EAAoBpiB,KAAKsiB,IAAItiB,KAAKC,MAAMmiB,GAAoB,GAC5D,MAAMG,EAAaV,EAAOK,eAAiBE,EAC3C,GAAI3xB,KAAK8xB,aAAeA,GAAc9xB,KAAKqxB,aAEzC,YADAO,EAAQjF,MAAM,uDAAwD3sB,KAAK8xB,YAG7E9xB,KAAK0xB,SACLE,EAAQjF,MAAM,iBAAkBgF,GAChC3xB,KAAKsxB,YAAcQ,EACnB,MAAMC,EAAyBxiB,KAAKyiB,IAAIL,EAAmB,GAC3D3xB,KAAKqxB,aAAeY,YAAYjyB,KAAKuxB,UAAoC,IAAzBQ,EACjD,CACD,cAAID,GACF,OAAO9xB,KAAKsxB,WACb,CACD,MAAAI,GACE1xB,KAAK0wB,QAAQxH,OAAO,UAChBlpB,KAAKqxB,eACPa,cAAclyB,KAAKqxB,cACnBrxB,KAAKqxB,aAAe,KAEvB,GAICc,GAAW,MACb,iBAAOC,CAAW5wB,EAAK6wB,EAAe,SACpC,IAAK7wB,EAAK,MAAM,IAAInC,UAAU,eAC9B,MACMqJ,EADY,IAAI2O,IAAI7V,EAAK,oBACW,aAAjB6wB,EAA8B,OAAS,UAChE,OAAO,IAAIC,gBAAgB5pB,EAAO0R,MAAM,GACzC,GAECmY,GAAsB,IAGtBC,GAAgB,cAAc9yB,MAChC,WAAAE,CAAYggB,EAAM6S,GAChB,IAAIC,EAAIC,EAAIC,EAKZ,GAJA7yB,MAAM6f,EAAKiT,mBAAqBjT,EAAKtK,OAAS,IAC9CtV,KAAKyyB,KAAOA,EAEZzyB,KAAKC,KAAO,iBACP2f,EAAKtK,MAER,MADA2X,GAAO3X,MAAM,gBAAiB,mBACxB,IAAI5V,MAAM,mBAElBM,KAAKsV,MAAQsK,EAAKtK,MAClBtV,KAAK6yB,kBAAqD,OAAhCH,EAAK9S,EAAKiT,mBAA6BH,EAAK,KACtE1yB,KAAK8yB,UAAqC,OAAxBH,EAAK/S,EAAKkT,WAAqBH,EAAK,KACtD3yB,KAAKwe,MAAQoB,EAAKmT,UAClB/yB,KAAKgzB,cAA6C,OAA5BJ,EAAKhT,EAAKoT,eAAyBJ,EAAK,KAC9D5yB,KAAKizB,UAAYrT,EAAKqT,SACvB,GAICC,GAAe,cAAcxzB,MAC/B,WAAAE,CAAYC,GACVE,MAAMF,GAENG,KAAKC,KAAO,cACb,GA2ICkzB,GAAqB,MACvB,WAAAvzB,GACEI,KAAK0wB,QAAU,IAAIzD,GAAO,sBAC1BjtB,KAAKozB,MAAQ,EACd,CACD,KAAAhU,GACEpf,KAAK0wB,QAAQxH,OAAO,SACpBlpB,KAAKozB,MAAQ,EACd,CACD,OAAAC,CAAQvtB,GAEN,OADA9F,KAAK0wB,QAAQxH,OAAO,YAAYpjB,OACzB9F,KAAKozB,MAAMttB,EACnB,CACD,OAAAwtB,CAAQxtB,EAAK9B,GACXhE,KAAK0wB,QAAQxH,OAAO,YAAYpjB,OAChC9F,KAAKozB,MAAMttB,GAAO9B,CACnB,CACD,UAAAuvB,CAAWztB,GACT9F,KAAK0wB,QAAQxH,OAAO,eAAepjB,cAC5B9F,KAAKozB,MAAMttB,EACnB,CACD,UAAInH,GACF,OAAOkE,OAAOykB,oBAAoBtnB,KAAKozB,OAAOz0B,MAC/C,CACD,GAAAmH,CAAIoQ,GACF,OAAOrT,OAAOykB,oBAAoBtnB,KAAKozB,OAAOld,EAC/C,GAICsd,GAAiB,cAAc9zB,MACjC,WAAAE,CAAYmwB,EAAOlwB,GACjBE,MAAMF,GAENG,KAAKC,KAAO,iBACZD,KAAK+vB,MAAQA,CACd,GAIC0D,GAAc,MAChB,WAAA7zB,CAAY8zB,EAAyB,GAAIC,EAAc,KAAMC,EAAgB,IAC3E5zB,KAAK2zB,YAAcA,EACnB3zB,KAAK4zB,cAAgBA,EACrB5zB,KAAK0wB,QAAU,IAAIzD,GAAO,eAC1BjtB,KAAK6zB,cAAgB,GACrB7zB,KAAK6zB,cAAczxB,QAAQsxB,EAAwB,oBAC/CC,GACF3zB,KAAK6zB,cAAczxB,KAAK,kBAE3B,CACD,sBAAM0xB,CAAiBxyB,EAAO2gB,EAAO,IACnC,MAAM8R,iBAAEA,KAAqBC,GAAc/R,EAC3C,IAAK8R,EACH,aAAapb,MAAMrX,EAAO0yB,GAE5B,MAAMC,EAAa,IAAIC,gBACjBC,EAAY5N,WAAW,IAAM0N,EAAWG,QAA4B,IAAnBL,GACvD,IAKE,aAJuBpb,MAAMrX,EAAO,IAC/B2gB,EACHvJ,OAAQub,EAAWvb,QAGtB,CAAC,MAAOK,GACP,GAAIA,aAAesb,cAA6B,eAAbtb,EAAI9Y,KACrC,MAAM,IAAIizB,GAAa,qBAEzB,MAAMna,CACZ,CAAc,QACRuN,aAAa6N,EACd,CACF,CACD,aAAMG,CAAQ9yB,GAAKqU,MACjBA,EAAK0e,YACLA,EAAWR,iBACXA,GACE,IACF,MAAMnC,EAAU5xB,KAAK0wB,QAAQxH,OAAO,WAC9B1lB,EAAU,CACdgxB,OAAUx0B,KAAK6zB,cAAcnxB,KAAK,OAOpC,IAAIkW,EALA/C,IACF+b,EAAQjF,MAAM,8CACdnpB,EAAuB,cAAI,UAAYqS,GAEzC7V,KAAKy0B,oBAAoBjxB,GAEzB,IACEouB,EAAQjF,MAAM,OAAQnrB,GACtBoX,QAAiB5Y,KAAK8zB,iBAAiBtyB,EAAK,CAAEqX,OAAQ,MAAOrV,UAASuwB,mBAAkBQ,eACzF,CAAC,MAAOxb,GAEP,MADA6Y,EAAQtc,MAAM,iBACRyD,CACP,CACD6Y,EAAQjF,MAAM,iCAAkC/T,EAASI,QACzD,MAAM0b,EAAc9b,EAASpV,QAAQ2E,IAAI,gBAIzC,GAHIusB,IAAgB10B,KAAK6zB,cAAcc,KAAMC,GAASF,EAAY/d,WAAWie,KAC3EhD,EAAQiD,MAAM,IAAIn1B,MAAM,kCAAiD,MAAfg1B,EAAsBA,EAAc,0BAA0BlzB,MAEtHoX,EAAS+N,IAAM3mB,KAAK2zB,cAA+B,MAAfe,OAA2B,EAAIA,EAAY/d,WAAW,oBAC5F,aAAa3W,KAAK2zB,kBAAkB/a,EAASkc,QAE/C,IAAI7b,EACJ,IACEA,QAAaL,EAASK,MACvB,CAAC,MAAOF,GAEP,GADA6Y,EAAQtc,MAAM,8BAA+ByD,GACzCH,EAAS+N,GAAI,MAAM5N,EACvB,MAAM,IAAIrZ,MAAM,GAAGkZ,EAASmc,eAAenc,EAASI,UACrD,CACD,IAAKJ,EAAS+N,GAAI,CAEhB,GADAiL,EAAQtc,MAAM,qBAAsB2D,GAChCA,EAAK3D,MACP,MAAM,IAAIkd,GAAcvZ,GAE1B,MAAM,IAAIvZ,MAAM,GAAGkZ,EAASmc,eAAenc,EAASI,YAAYvT,KAAKC,UAAUuT,KAChF,CACD,OAAOA,CACR,CACD,cAAM+b,CAASxzB,GAAKyzB,KAClBA,EAAIC,UACJA,EAASnB,iBACTA,EAAgBoB,gBAChBA,EAAeC,aACfA,IAEA,MAAMxD,EAAU5xB,KAAK0wB,QAAQxH,OAAO,YAC9B1lB,EAAU,CACdgxB,OAAUx0B,KAAK6zB,cAAcnxB,KAAK,MAClC,eAAgB,uCACb0yB,GAML,IAAIxc,OAJmB,IAAnBsc,IACF1xB,EAAuB,cAAI,SAAW0xB,GAExCl1B,KAAKy0B,oBAAoBjxB,GAEzB,IACEouB,EAAQjF,MAAM,OAAQnrB,GACtBoX,QAAiB5Y,KAAK8zB,iBAAiBtyB,EAAK,CAAEqX,OAAQ,OAAQrV,UAASyxB,OAAMlB,mBAAkBQ,YAAaY,GAC7G,CAAC,MAAOpc,GAEP,MADA6Y,EAAQtc,MAAM,iBACRyD,CACP,CACD6Y,EAAQjF,MAAM,iCAAkC/T,EAASI,QACzD,MAAM0b,EAAc9b,EAASpV,QAAQ2E,IAAI,gBACzC,GAAIusB,IAAgB10B,KAAK6zB,cAAcc,KAAMC,GAASF,EAAY/d,WAAWie,IAC3E,MAAM,IAAIl1B,MAAM,kCAAiD,MAAfg1B,EAAsBA,EAAc,0BAA0BlzB,KAElH,MAAM6zB,QAAqBzc,EAASkc,OACpC,IAAI7b,EAAO,CAAA,EACX,GAAIoc,EACF,IACEpc,EAAOxT,KAAKE,MAAM0vB,EACnB,CAAC,MAAOtc,GAEP,GADA6Y,EAAQtc,MAAM,8BAA+ByD,GACzCH,EAAS+N,GAAI,MAAM5N,EACvB,MAAM,IAAIrZ,MAAM,GAAGkZ,EAASmc,eAAenc,EAASI,UACrD,CAEH,IAAKJ,EAAS+N,GAAI,CAEhB,GADAiL,EAAQtc,MAAM,qBAAsB2D,GAChCL,EAASpV,QAAQK,IAAI,cAAe,CACtC,MAAMksB,EAAQnX,EAASpV,QAAQ2E,IAAI,cACnC,MAAM,IAAIqrB,GAAezD,EAAO,GAAGtqB,KAAKC,UAAUuT,KACnD,CACD,GAAIA,EAAK3D,MACP,MAAM,IAAIkd,GAAcvZ,EAAMgc,GAEhC,MAAM,IAAIv1B,MAAM,GAAGkZ,EAASmc,eAAenc,EAASI,YAAYvT,KAAKC,UAAUuT,KAChF,CACD,OAAOA,CACR,CACD,mBAAAwb,CAAoBjxB,GAClB,MAAMouB,EAAU5xB,KAAK0wB,QAAQxH,OAAO,sBAC9BoM,EAAazyB,OAAOO,KAAKpD,KAAK4zB,eAC9B2B,EAAmB,CACvB,SACA,gBAEIC,EAAkB,CACtB,iBAEwB,IAAtBF,EAAW32B,QAGf22B,EAAWG,QAASC,IAClB,GAAIH,EAAiB5zB,SAAS+zB,EAAWC,qBAEvC,YADA/D,EAAQpI,KAAK,oCAAqCkM,EAAYH,GAGhE,GAAIC,EAAgB7zB,SAAS+zB,EAAWC,sBAAwB9yB,OAAOO,KAAKI,GAAS7B,SAAS+zB,GAE5F,YADA9D,EAAQpI,KAAK,iCAAkCkM,EAAYF,GAG7D,MAAMI,EAAoD,mBAAnC51B,KAAK4zB,cAAc8B,GAA6B11B,KAAK4zB,cAAc8B,KAAgB11B,KAAK4zB,cAAc8B,GACzHE,GAAuB,KAAZA,IACbpyB,EAAQkyB,GAAcE,IAG3B,GAICC,GAAkB,MACpB,WAAAj2B,CAAYk2B,GACV91B,KAAK81B,UAAYA,EACjB91B,KAAK0wB,QAAU,IAAIzD,GAAO,mBAC1BjtB,KAAK+1B,aAAe,KACpB/1B,KAAKg2B,UAAY,KACjBh2B,KAAKi2B,aAAej2B,KAAK81B,UAAUI,YACnCl2B,KAAKm2B,aAAe,IAAI1C,GACtB,CAAC,4BACD,KACAzzB,KAAK81B,UAAUV,cAEbp1B,KAAK81B,UAAUM,cACjBp2B,KAAK0wB,QAAQ/D,MAAM,mCACnB3sB,KAAK+1B,aAAe/1B,KAAK81B,UAAUM,aAEjCp2B,KAAK81B,UAAUpgB,WACjB1V,KAAK0wB,QAAQ/D,MAAM,gCACnB3sB,KAAKg2B,UAAYh2B,KAAK81B,UAAUpgB,UAE9B1V,KAAK81B,UAAUO,0BACjBr2B,KAAK0wB,QAAQ/D,MAAM,+CACnB3sB,KAAKs2B,yBAA2Bt2B,KAAK81B,UAAUO,wBAElD,CACD,gBAAAE,GACEv2B,KAAK+1B,aAAe,IACrB,CACD,iBAAMS,GACJ,MAAM5E,EAAU5xB,KAAK0wB,QAAQxH,OAAO,eACpC,GAAIlpB,KAAKg2B,UAEP,OADApE,EAAQjF,MAAM,uBACP3sB,KAAKg2B,UAEd,IAAKh2B,KAAKi2B,aAER,MADArE,EAAQiD,MAAM,IAAIn1B,MAAM,uDAClB,KAERkyB,EAAQjF,MAAM,wBAAyB3sB,KAAKi2B,cAC5C,MAAMvgB,QAAiB1V,KAAKm2B,aAAa7B,QAAQt0B,KAAKi2B,aAAc,CAAE1B,YAAav0B,KAAKs2B,yBAA0BvC,iBAAkB/zB,KAAK81B,UAAUW,0BAGnJ,OAFA7E,EAAQjF,MAAM,0CACd3sB,KAAKg2B,UAAYnzB,OAAO6zB,OAAO,CAAA,EAAIhhB,EAAU1V,KAAK81B,UAAUa,cACrD32B,KAAKg2B,SACb,CACD,SAAAY,GACE,OAAO52B,KAAK62B,qBAAqB,SAClC,CACD,wBAAAC,GACE,OAAO92B,KAAK62B,qBAAqB,yBAClC,CACD,mBAAAE,GACE,OAAO/2B,KAAK62B,qBAAqB,oBAClC,CACD,gBAAAG,CAAiBC,GAAW,GAC1B,OAAOj3B,KAAK62B,qBAAqB,iBAAkBI,EACpD,CACD,qBAAAC,GACE,OAAOl3B,KAAK62B,qBAAqB,wBAAwB,EAC1D,CACD,qBAAAM,GACE,OAAOn3B,KAAK62B,qBAAqB,wBAAwB,EAC1D,CACD,qBAAAO,CAAsBH,GAAW,GAC/B,OAAOj3B,KAAK62B,qBAAqB,sBAAuBI,EACzD,CACD,eAAAI,CAAgBJ,GAAW,GACzB,OAAOj3B,KAAK62B,qBAAqB,WAAYI,EAC9C,CACD,0BAAMJ,CAAqB52B,EAAMg3B,GAAW,GAC1C,MAAMrF,EAAU5xB,KAAK0wB,QAAQxH,OAAO,yBAAyBjpB,OACvDyV,QAAiB1V,KAAKw2B,cAE5B,GADA5E,EAAQjF,MAAM,iBACc,IAAxBjX,EAASzV,GAAkB,CAC7B,IAAiB,IAAbg3B,EAEF,YADArF,EAAQpI,KAAK,+CAGfoI,EAAQiD,MAAM,IAAIn1B,MAAM,sCAAwCO,GACjE,CACD,OAAOyV,EAASzV,EACjB,CACD,oBAAMq3B,GACJ,MAAM1F,EAAU5xB,KAAK0wB,QAAQxH,OAAO,kBACpC,GAAIlpB,KAAK+1B,aAEP,OADAnE,EAAQjF,MAAM,oCACP3sB,KAAK+1B,aAEd,MAAMwB,QAAiBv3B,KAAKq3B,iBAAgB,GAC5CzF,EAAQjF,MAAM,eAAgB4K,GAC9B,MAAMC,QAAex3B,KAAKm2B,aAAa7B,QAAQiD,EAAU,CAAExD,iBAAkB/zB,KAAK81B,UAAUW,0BAE5F,GADA7E,EAAQjF,MAAM,cAAe6K,IACxBt0B,MAAMC,QAAQq0B,EAAOp0B,MAExB,MADAwuB,EAAQiD,MAAM,IAAIn1B,MAAM,2BAClB,KAGR,OADAM,KAAK+1B,aAAeyB,EAAOp0B,KACpBpD,KAAK+1B,YACb,GAIC0B,GAAuB,MACzB,WAAA73B,EAAY8tB,OACVA,EAAS,QAAOgK,MAChBA,EAAQC,cACN,IACF33B,KAAK0wB,QAAU,IAAIzD,GAAO,wBAC1BjtB,KAAK43B,OAASF,EACd13B,KAAK63B,QAAUnK,CAChB,CACD,SAAM1uB,CAAI8G,EAAK9B,GACbhE,KAAK0wB,QAAQxH,OAAO,QAAQpjB,OAC5BA,EAAM9F,KAAK63B,QAAU/xB,QACf9F,KAAK43B,OAAOtE,QAAQxtB,EAAK9B,EAChC,CACD,SAAMmE,CAAIrC,GACR9F,KAAK0wB,QAAQxH,OAAO,QAAQpjB,OAC5BA,EAAM9F,KAAK63B,QAAU/xB,EAErB,aADmB9F,KAAK43B,OAAOvE,QAAQvtB,EAExC,CACD,YAAMgyB,CAAOhyB,GACX9F,KAAK0wB,QAAQxH,OAAO,WAAWpjB,OAC/BA,EAAM9F,KAAK63B,QAAU/xB,EACrB,MAAM8uB,QAAa50B,KAAK43B,OAAOvE,QAAQvtB,GAEvC,aADM9F,KAAK43B,OAAOrE,WAAWztB,GACtB8uB,CACR,CACD,gBAAMmD,GACJ/3B,KAAK0wB,QAAQxH,OAAO,cACpB,MAAMgC,QAAYlrB,KAAK43B,OAAOj5B,OACxByE,EAAO,GACb,IAAK,IAAI8S,EAAQ,EAAGA,EAAQgV,EAAKhV,IAAS,CACxC,MAAMpQ,QAAY9F,KAAK43B,OAAO9xB,IAAIoQ,GAC9BpQ,GAAqC,IAA9BA,EAAIuQ,QAAQrW,KAAK63B,UAC1Bz0B,EAAKhB,KAAK0D,EAAIkyB,OAAOh4B,KAAK63B,QAAQl5B,QAErC,CACD,OAAOyE,CACR,GAQC60B,GAA0B,MAC5B,WAAAr4B,EAAYs4B,UAEVA,EAAShC,YACTA,EAAWxgB,SACXA,EAAQ0gB,YACRA,EAAWO,aACXA,EAAYvH,UAEZA,EAASC,cACTA,EAAa8I,cACbA,EAfsB,OAeaC,MACnCA,EAfe,SAeKC,aACpBA,EAAYC,yBACZA,EAAwBC,sBACxBA,EAjB8B,qBAiBqBC,gCACnDA,EAAkC,QAAOC,OAEzCA,EAAMC,QACNA,EAAOC,QACPA,EAAOC,WACPA,EAAUC,WACVA,EAAUC,SACVA,EAAQC,cACRA,EAAaC,qBAEbA,GAAuB,EAAIC,aAC3BA,GAAe,EAAKxC,wBACpBA,EAAuByC,uBACvBA,EA9BgC,IA8BsBC,oBACtDA,EAAsB,CAAEC,MAAO,WAAWC,YAC1CA,GAAc,EAAKC,WAEnBA,EAAUC,kCACVA,EAAiClD,wBACjCA,EAAuBmD,yBACvBA,EAAwBC,iBAExBA,EAAmB,CAAE,EAAAC,iBACrBA,EAAmB,CAAE,EAAAtE,aACrBA,EAAe,CAAE,EAAAvW,KACjBA,EAAI8a,wBACJA,GAA0B,IAE1B,IAAIjH,EAwCJ,GAvCA1yB,KAAKk4B,UAAYA,EACbhC,EACFl2B,KAAKk2B,YAAcA,GAEnBl2B,KAAKk2B,YAAcgC,EACfA,IACGl4B,KAAKk2B,YAAY0D,SAAS,OAC7B55B,KAAKk2B,aAAe,KAEtBl2B,KAAKk2B,aAAe,qCAGxBl2B,KAAK0V,SAAWA,EAChB1V,KAAK22B,aAAeA,EACpB32B,KAAKo2B,YAAcA,EACnBp2B,KAAKovB,UAAYA,EACjBpvB,KAAKqvB,cAAgBA,EACrBrvB,KAAKm4B,cAAgBA,EACrBn4B,KAAKo4B,MAAQA,EACbp4B,KAAKq4B,aAAeA,EACpBr4B,KAAKs4B,yBAA2BA,EAChCt4B,KAAKu4B,sBAAwBA,EAC7Bv4B,KAAKw4B,gCAAkCA,EACvCx4B,KAAKy4B,OAASA,EACdz4B,KAAK04B,QAAUA,EACf14B,KAAK24B,QAAUA,EACf34B,KAAK44B,WAAaA,EAClB54B,KAAK64B,WAAaA,EAClB74B,KAAK84B,SAAWA,EAChB94B,KAAK+4B,cAAgBA,EACrB/4B,KAAKg5B,qBAA+C,MAAxBA,GAA+BA,EAC3Dh5B,KAAKi5B,eAAiBA,EACtBj5B,KAAKk5B,uBAAyBA,EAC9Bl5B,KAAKm5B,oBAAsBA,EAC3Bn5B,KAAK25B,wBAA0BA,EAC/B35B,KAAKq5B,cAAgBA,EACrBr5B,KAAKu5B,kCAAoCA,EACzCv5B,KAAKq2B,wBAA0BA,GAAoD,cACnFr2B,KAAKy2B,wBAA0BA,EAC3B6C,EACFt5B,KAAKs5B,WAAaA,MACb,CACL,MAAM5B,EAA0B,oBAAXtJ,OAAyBA,OAAOuJ,aAAe,IAAIxE,GACxEnzB,KAAKs5B,WAAa,IAAI7B,GAAqB,CAAEC,SAC9C,CAMD,GALA13B,KAAKw5B,yBAA2BA,EAChCx5B,KAAKy5B,iBAAmBA,EACxBz5B,KAAK05B,iBAAmBA,EACxB15B,KAAKo1B,aAAeA,EACpBp1B,KAAK6e,KAAOA,EACR7e,KAAK6e,QAA8B,OAAnB6T,EAAK1yB,KAAK6e,WAAqB,EAAI6T,EAAGgF,OACxD,MAAM,IAAIh4B,MAAM,+CAEnB,GAICm6B,GAAkB,MACpB,WAAAj6B,CAAYk2B,EAAWgE,GACrB95B,KAAK81B,UAAYA,EACjB91B,KAAK85B,iBAAmBA,EACxB95B,KAAK0wB,QAAU,IAAIzD,GAAO,mBAC1BjtB,KAAK+5B,kBAAoB74B,MAAOm0B,IAC9B,MAAMzD,EAAU5xB,KAAK0wB,QAAQxH,OAAO,qBACpC,IACE,MAAM5oB,EAAUqtB,GAAStsB,OAAOg0B,GAEhC,OADAzD,EAAQjF,MAAM,2BACPrsB,CACR,CAAC,MAAOyY,GAEP,MADA6Y,EAAQtc,MAAM,8BACRyD,CACP,GAEH/Y,KAAKm2B,aAAe,IAAI1C,QACjB,EACLzzB,KAAK+5B,kBACL/5B,KAAK81B,UAAUV,aAElB,CACD,eAAM4E,CAAUnkB,GACd,MAAM+b,EAAU5xB,KAAK0wB,QAAQxH,OAAO,aAC/BrT,GACH7V,KAAK0wB,QAAQmE,MAAM,IAAIn1B,MAAM,oBAE/B,MAAM8B,QAAYxB,KAAK85B,iBAAiB/C,sBACxCnF,EAAQjF,MAAM,mBAAoBnrB,GAClC,MAAMy4B,QAAej6B,KAAKm2B,aAAa7B,QAAQ9yB,EAAK,CAClDqU,QACA0e,YAAav0B,KAAK81B,UAAUO,wBAC5BtC,iBAAkB/zB,KAAK81B,UAAUW,0BAGnC,OADA7E,EAAQjF,MAAM,aAAcsN,GACrBA,CACR,GAICC,GAAc,MAChB,WAAAt6B,CAAYk2B,EAAWgE,GACrB95B,KAAK81B,UAAYA,EACjB91B,KAAK85B,iBAAmBA,EACxB95B,KAAK0wB,QAAU,IAAIzD,GAAO,eAC1BjtB,KAAKm2B,aAAe,IAAI1C,GACtBzzB,KAAK81B,UAAUyD,kCACf,KACAv5B,KAAK81B,UAAUV,aAElB,CAMD,kBAAM+E,EAAaC,WACjBA,EAAa,qBAAoB/B,aACjCA,EAAer4B,KAAK81B,UAAUuC,aAAYjJ,UAC1CA,EAAYpvB,KAAK81B,UAAU1G,UAASC,cACpCA,EAAgBrvB,KAAK81B,UAAUzG,cAAa+F,aAC5CA,KACGxV,IAEH,MAAMgS,EAAU5xB,KAAK0wB,QAAQxH,OAAO,gBAC/BkG,GACHwC,EAAQiD,MAAM,IAAIn1B,MAAM,4BAErB24B,GACHzG,EAAQiD,MAAM,IAAIn1B,MAAM,+BAErBkgB,EAAKrgB,MACRqyB,EAAQiD,MAAM,IAAIn1B,MAAM,uBAE1B,MAAMgJ,EAAS,IAAI4pB,gBAAgB,CAAE8H,aAAY/B,iBACjD,IAAK,MAAOvyB,EAAK9B,KAAUnB,OAAO6H,QAAQkV,GAC3B,MAAT5b,GACF0E,EAAO1J,IAAI8G,EAAK9B,GAGpB,IAA8C,wBAAzChE,KAAK81B,UAAUyC,uBAA4F,sBAAzCv4B,KAAK81B,UAAUyC,wBAAmD,MAAAlJ,EAEvI,MADAuC,EAAQiD,MAAM,IAAIn1B,MAAM,gCAClB,KAER,IAAIw1B,EACJ,MAAM1zB,QAAYxB,KAAK85B,iBAAiB9C,kBAAiB,GACzD,OAAQh3B,KAAK81B,UAAUyC,uBACrB,IAAK,sBACHrD,EAAYhH,GAAYiB,kBAAkBC,EAAWC,GACrD,MACF,IAAK,qBACH3mB,EAAOsY,OAAO,YAAaoO,GACvBC,GACF3mB,EAAOsY,OAAO,gBAAiBqO,GAEjC,MACF,IAAK,oBAAqB,CACxB,MAAMgL,QAAwBnM,GAAYoC,2BAA2BlB,EAAWC,EAAe7tB,EAAKxB,KAAK81B,UAAU0C,iCACnH9vB,EAAOsY,OAAO,YAAaoO,GAC3B1mB,EAAOsY,OAAO,wBAAyB,0DACvCtY,EAAOsY,OAAO,mBAAoBqZ,GAClC,KACD,EAEHzI,EAAQjF,MAAM,sBACd,MAAM/T,QAAiB5Y,KAAKm2B,aAAanB,SAASxzB,EAAK,CACrDyzB,KAAMvsB,EACNwsB,YACAnB,iBAAkB/zB,KAAK81B,UAAUW,wBACjCtB,gBAAiBn1B,KAAK81B,UAAUO,wBAChCjB,iBAGF,OADAxD,EAAQjF,MAAM,gBACP/T,CACR,CAMD,yBAAM0hB,EAAoBF,WACxBA,EAAa,WAAUhL,UACvBA,EAAYpvB,KAAK81B,UAAU1G,UAASC,cACpCA,EAAgBrvB,KAAK81B,UAAUzG,cAAa+I,MAC5CA,EAAQp4B,KAAK81B,UAAUsC,SACpBxY,IAEH,MAAMgS,EAAU5xB,KAAK0wB,QAAQxH,OAAO,uBAC/BkG,GACHwC,EAAQiD,MAAM,IAAIn1B,MAAM,4BAE1B,MAAMgJ,EAAS,IAAI4pB,gBAAgB,CAAE8H,eAChCp6B,KAAK81B,UAAU6D,yBAClBjxB,EAAO1J,IAAI,QAASo5B,GAEtB,IAAK,MAAOtyB,EAAK9B,KAAUnB,OAAO6H,QAAQkV,GAC3B,MAAT5b,GACF0E,EAAO1J,IAAI8G,EAAK9B,GAGpB,IAA8C,wBAAzChE,KAAK81B,UAAUyC,uBAA4F,sBAAzCv4B,KAAK81B,UAAUyC,wBAAmD,MAAAlJ,EAEvI,MADAuC,EAAQiD,MAAM,IAAIn1B,MAAM,gCAClB,KAER,IAAIw1B,EACJ,MAAM1zB,QAAYxB,KAAK85B,iBAAiB9C,kBAAiB,GACzD,OAAQh3B,KAAK81B,UAAUyC,uBACrB,IAAK,sBACHrD,EAAYhH,GAAYiB,kBAAkBC,EAAWC,GACrD,MACF,IAAK,qBACH3mB,EAAOsY,OAAO,YAAaoO,GACvBC,GACF3mB,EAAOsY,OAAO,gBAAiBqO,GAEjC,MACF,IAAK,oBAAqB,CACxB,MAAMgL,QAAwBnM,GAAYoC,2BAA2BlB,EAAWC,EAAe7tB,EAAKxB,KAAK81B,UAAU0C,iCACnH9vB,EAAOsY,OAAO,YAAaoO,GAC3B1mB,EAAOsY,OAAO,wBAAyB,0DACvCtY,EAAOsY,OAAO,mBAAoBqZ,GAClC,KACD,EAEHzI,EAAQjF,MAAM,sBACd,MAAM/T,QAAiB5Y,KAAKm2B,aAAanB,SAASxzB,EAAK,CAAEyzB,KAAMvsB,EAAQwsB,YAAWnB,iBAAkB/zB,KAAK81B,UAAUW,wBAAyBtB,gBAAiBn1B,KAAK81B,UAAUO,0BAE5K,OADAzE,EAAQjF,MAAM,gBACP/T,CACR,CAMD,0BAAM2hB,EAAqBH,WACzBA,EAAa,gBAAehL,UAC5BA,EAAYpvB,KAAK81B,UAAU1G,UAASC,cACpCA,EAAgBrvB,KAAK81B,UAAUzG,cAAa0E,iBAC5CA,EAAgBqB,aAChBA,KACGxV,IAEH,MAAMgS,EAAU5xB,KAAK0wB,QAAQxH,OAAO,wBAC/BkG,GACHwC,EAAQiD,MAAM,IAAIn1B,MAAM,4BAErBkgB,EAAK4a,eACR5I,EAAQiD,MAAM,IAAIn1B,MAAM,gCAE1B,MAAMgJ,EAAS,IAAI4pB,gBAAgB,CAAE8H,eACrC,IAAK,MAAOt0B,EAAK9B,KAAUnB,OAAO6H,QAAQkV,GACpC1c,MAAMC,QAAQa,GAChBA,EAAMyxB,QAASlZ,GAAU7T,EAAOsY,OAAOlb,EAAKyW,IAC1B,MAATvY,GACT0E,EAAO1J,IAAI8G,EAAK9B,GAGpB,IAA8C,wBAAzChE,KAAK81B,UAAUyC,uBAA4F,sBAAzCv4B,KAAK81B,UAAUyC,wBAAmD,MAAAlJ,EAEvI,MADAuC,EAAQiD,MAAM,IAAIn1B,MAAM,gCAClB,KAER,IAAIw1B,EACJ,MAAM1zB,QAAYxB,KAAK85B,iBAAiB9C,kBAAiB,GACzD,OAAQh3B,KAAK81B,UAAUyC,uBACrB,IAAK,sBACHrD,EAAYhH,GAAYiB,kBAAkBC,EAAWC,GACrD,MACF,IAAK,qBACH3mB,EAAOsY,OAAO,YAAaoO,GACvBC,GACF3mB,EAAOsY,OAAO,gBAAiBqO,GAEjC,MACF,IAAK,oBAAqB,CACxB,MAAMgL,QAAwBnM,GAAYoC,2BAA2BlB,EAAWC,EAAe7tB,EAAKxB,KAAK81B,UAAU0C,iCACnH9vB,EAAOsY,OAAO,YAAaoO,GAC3B1mB,EAAOsY,OAAO,wBAAyB,0DACvCtY,EAAOsY,OAAO,mBAAoBqZ,GAClC,KACD,EAEHzI,EAAQjF,MAAM,sBACd,MAAM/T,QAAiB5Y,KAAKm2B,aAAanB,SAASxzB,EAAK,CAAEyzB,KAAMvsB,EAAQwsB,YAAWnB,mBAAkBoB,gBAAiBn1B,KAAK81B,UAAUO,wBAAyBjB,iBAE7J,OADAxD,EAAQjF,MAAM,gBACP/T,CACR,CAMD,YAAM6hB,CAAO7a,GACX,IAAI8S,EACJ,MAAMd,EAAU5xB,KAAK0wB,QAAQxH,OAAO,UAC/BtJ,EAAK/J,OACR+b,EAAQiD,MAAM,IAAIn1B,MAAM,wBAE1B,MAAM8B,QAAYxB,KAAK85B,iBAAiB1C,uBAAsB,GAC9DxF,EAAQjF,MAAM,qCAAoE,OAA9B+F,EAAK9S,EAAK8a,iBAA2BhI,EAAK,wBAC9F,MAAMhqB,EAAS,IAAI4pB,gBACnB,IAAK,MAAOxsB,EAAK9B,KAAUnB,OAAO6H,QAAQkV,GAC3B,MAAT5b,GACF0E,EAAO1J,IAAI8G,EAAK9B,GAGpB0E,EAAO1J,IAAI,YAAagB,KAAK81B,UAAU1G,WACnCpvB,KAAK81B,UAAUzG,eACjB3mB,EAAO1J,IAAI,gBAAiBgB,KAAK81B,UAAUzG,qBAEvCrvB,KAAKm2B,aAAanB,SAASxzB,EAAK,CAAEyzB,KAAMvsB,EAAQqrB,iBAAkB/zB,KAAK81B,UAAUW,0BACvF7E,EAAQjF,MAAM,eACf,GAICgO,GAAoB,MACtB,WAAA/6B,CAAYk2B,EAAWgE,EAAkBc,GACvC56B,KAAK81B,UAAYA,EACjB91B,KAAK85B,iBAAmBA,EACxB95B,KAAK46B,eAAiBA,EACtB56B,KAAK0wB,QAAU,IAAIzD,GAAO,qBAC1BjtB,KAAK66B,iBAAmB,IAAIhB,GAAgB75B,KAAK81B,UAAW91B,KAAK85B,kBACjE95B,KAAK86B,aAAe,IAAIZ,GAAYl6B,KAAK81B,UAAW91B,KAAK85B,iBAC1D,CACD,4BAAMiB,CAAuBniB,EAAU4F,EAAO4W,GAC5C,MAAMxD,EAAU5xB,KAAK0wB,QAAQxH,OAAO,0BACpClpB,KAAKg7B,oBAAoBpiB,EAAU4F,GACnCoT,EAAQjF,MAAM,yBACR3sB,KAAKi7B,aAAariB,EAAU4F,EAAO4W,GACzCxD,EAAQjF,MAAM,kBACV/T,EAASsiB,UACXl7B,KAAKm7B,2BAA2BviB,EAAU,GAAI4F,EAAMuR,OAEtD6B,EAAQjF,MAAM,0BACR3sB,KAAKo7B,eAAexiB,EAAmB,MAAT4F,OAAqB,EAAIA,EAAM6c,aAAcziB,EAASsiB,UAC1FtJ,EAAQjF,MAAM,mBACf,CACD,iCAAM2O,CAA4B1iB,EAAUyiB,GAC1C,MAAMzJ,EAAU5xB,KAAK0wB,QAAQxH,OAAO,+BAC9BqS,EAAyB3iB,EAASsiB,YAActiB,EAAS4iB,SAC3DD,GACFv7B,KAAKm7B,2BAA2BviB,GAElCgZ,EAAQjF,MAAM,0BACR3sB,KAAKo7B,eAAexiB,EAAUyiB,EAAcE,GAClD3J,EAAQjF,MAAM,mBACf,CACD,6BAAM8O,CAAwB7iB,EAAU4F,GAEtC,MAAMoT,EAAU5xB,KAAK0wB,QAAQxH,OAAO,2BACpCtQ,EAASma,UAAYvU,EAAM3P,KACM,MAA3B+J,EAASoa,gBAA8Bpa,EAASoa,cAAgBxU,EAAMwU,eACnD,MAAnBpa,EAASwf,QAAsBxf,EAASwf,MAAQ5Z,EAAM4Z,OACxDxf,EAASsiB,UAActiB,EAAS4iB,WAClCx7B,KAAKm7B,2BAA2BviB,EAAU4F,EAAMgd,UAChD5J,EAAQjF,MAAM,uBAEX/T,EAAS4iB,WACZ5iB,EAAS4iB,SAAWhd,EAAMgd,SAC1B5iB,EAAS8iB,QAAUld,EAAMkd,SAE3B,MAAMC,EAAa/iB,EAASsiB,YAActiB,EAAS4iB,eAC7Cx7B,KAAKo7B,eAAexiB,GAAU,EAAO+iB,GAC3C/J,EAAQjF,MAAM,mBACf,CACD,uBAAAiP,CAAwBhjB,EAAU4F,GAChC,MAAMoT,EAAU5xB,KAAK0wB,QAAQxH,OAAO,2BAMpC,GALI1K,EAAMqd,KAAOjjB,EAAS4F,OACxBoT,EAAQiD,MAAM,IAAIn1B,MAAM,yBAE1BkyB,EAAQjF,MAAM,mBACd/T,EAASma,UAAYvU,EAAM3P,KACvB+J,EAAStD,MAEX,MADAsc,EAAQpI,KAAK,qBAAsB5Q,EAAStD,OACtC,IAAIkd,GAAc5Z,EAE3B,CACD,mBAAAoiB,CAAoBpiB,EAAU4F,GAE5B,MAAMoT,EAAU5xB,KAAK0wB,QAAQxH,OAAO,uBAoBpC,GAnBI1K,EAAMqd,KAAOjjB,EAAS4F,OACxBoT,EAAQiD,MAAM,IAAIn1B,MAAM,yBAErB8e,EAAM4Q,WACTwC,EAAQiD,MAAM,IAAIn1B,MAAM,0BAErB8e,EAAM0Z,WACTtG,EAAQiD,MAAM,IAAIn1B,MAAM,0BAEtBM,KAAK81B,UAAUoC,YAAc1Z,EAAM0Z,WACrCtG,EAAQiD,MAAM,IAAIn1B,MAAM,oDAEtBM,KAAK81B,UAAU1G,WAAapvB,KAAK81B,UAAU1G,YAAc5Q,EAAM4Q,WACjEwC,EAAQiD,MAAM,IAAIn1B,MAAM,oDAE1BkyB,EAAQjF,MAAM,mBACd/T,EAASma,UAAYvU,EAAM3P,KAC3B+J,EAASqa,UAAYzU,EAAMyU,UACF,MAAnBra,EAASwf,QAAsBxf,EAASwf,MAAQ5Z,EAAM4Z,OACxDxf,EAAStD,MAEX,MADAsc,EAAQpI,KAAK,qBAAsB5Q,EAAStD,OACtC,IAAIkd,GAAc5Z,GAEtB4F,EAAMwQ,gBAAkBpW,EAASrZ,MACnCqyB,EAAQiD,MAAM,IAAIn1B,MAAM,6BAE3B,CACD,oBAAM07B,CAAexiB,EAAUyiB,GAAe,EAAOS,GAAc,GACjE,MAAMlK,EAAU5xB,KAAK0wB,QAAQxH,OAAO,kBAEpC,GADAtQ,EAAS8iB,QAAU17B,KAAK46B,eAAe5B,qBAAqBpgB,EAAS8iB,SACjEL,IAAiBr7B,KAAK81B,UAAUmD,eAAiBrgB,EAASmjB,aAE5D,YADAnK,EAAQjF,MAAM,yBAGhBiF,EAAQjF,MAAM,qBACd,MAAMsN,QAAej6B,KAAK66B,iBAAiBb,UAAUphB,EAASmjB,cAC9DnK,EAAQjF,MAAM,qDACVmP,GAAe7B,EAAOhoB,MAAQ2G,EAAS8iB,QAAQzpB,KACjD2f,EAAQiD,MAAM,IAAIn1B,MAAM,sEAE1BkZ,EAAS8iB,QAAU17B,KAAK46B,eAAeoB,YAAYpjB,EAAS8iB,QAAS17B,KAAK46B,eAAe5B,qBAAqBiB,IAC9GrI,EAAQjF,MAAM,8CAA+C/T,EAAS8iB,QACvE,CACD,kBAAMT,CAAariB,EAAU4F,EAAO4W,GAClC,MAAMxD,EAAU5xB,KAAK0wB,QAAQxH,OAAO,gBACpC,GAAItQ,EAASrZ,KAAM,CACjBqyB,EAAQjF,MAAM,mBACd,MAAMsP,QAAsBj8B,KAAK86B,aAAaX,aAAa,CACzD/K,UAAW5Q,EAAM4Q,UACjBC,cAAe7Q,EAAM6Q,cACrB9vB,KAAMqZ,EAASrZ,KACf84B,aAAc7Z,EAAM6Z,aACpBrJ,cAAexQ,EAAMwQ,cACrBoG,kBACG5W,EAAMkb,mBAEX72B,OAAO6zB,OAAO9d,EAAUqjB,EAC9B,MACMrK,EAAQjF,MAAM,qBAEjB,CACD,0BAAAwO,CAA2BviB,EAAUsjB,EAAenM,GAClD,IAAI2C,EACJ,MAAMd,EAAU5xB,KAAK0wB,QAAQxH,OAAO,8BACpC0I,EAAQjF,MAAM,yBACd,MAAMwP,EAAWxO,GAAStsB,OAAmC,OAA3BqxB,EAAK9Z,EAAS4iB,UAAoB9I,EAAK,IAOzE,GANKyJ,EAASlqB,KACZ2f,EAAQiD,MAAM,IAAIn1B,MAAM,wCAEtBqwB,GAASoM,EAASpM,QAAUA,GAC9B6B,EAAQiD,MAAM,IAAIn1B,MAAM,6DAEtBw8B,EAAe,CACjB,MAAMlT,EAAW2E,GAAStsB,OAAO66B,GAC7BC,EAASlqB,MAAQ+W,EAAS/W,KAC5B2f,EAAQiD,MAAM,IAAIn1B,MAAM,+CAEtBy8B,EAASC,WAAaD,EAASC,YAAcpT,EAASoT,WACxDxK,EAAQiD,MAAM,IAAIn1B,MAAM,4DAEtBy8B,EAASjf,KAAOif,EAASjf,MAAQ8L,EAAS9L,KAC5C0U,EAAQiD,MAAM,IAAIn1B,MAAM,iDAErBy8B,EAASjf,KAAO8L,EAAS9L,KAC5B0U,EAAQiD,MAAM,IAAIn1B,MAAM,yDAE3B,CACDkZ,EAAS8iB,QAAUS,CACpB,GAICE,GAAQ,MAAMC,EAChB,WAAA18B,CAAYggB,GACV5f,KAAK67B,GAAKjc,EAAKic,IAAM3N,GAAYU,iBACjC5uB,KAAK6O,KAAO+Q,EAAK/Q,KACb+Q,EAAK2c,SAAW3c,EAAK2c,QAAU,EACjCv8B,KAAKu8B,QAAU3c,EAAK2c,QAEpBv8B,KAAKu8B,QAAUpL,GAAMM,eAEvBzxB,KAAKw8B,aAAe5c,EAAK4c,aACzBx8B,KAAKizB,UAAYrT,EAAKqT,SACvB,CACD,eAAAwJ,GAEE,OADA,IAAIxP,GAAO,SAAS/D,OAAO,mBACpBzjB,KAAKC,UAAU,CACpBm2B,GAAI77B,KAAK67B,GACThtB,KAAM7O,KAAK6O,KACX0tB,QAASv8B,KAAKu8B,QACdC,aAAcx8B,KAAKw8B,aACnBvJ,UAAWjzB,KAAKizB,WAEnB,CACD,wBAAOyJ,CAAkBC,GAEvB,OADA1P,GAAOM,aAAa,QAAS,qBACtBtR,QAAQtT,QAAQ,IAAI2zB,EAAO72B,KAAKE,MAAMg3B,IAC9C,CACD,4BAAaC,CAAgB/c,EAASnN,GACpC,MAAMkf,EAAU3E,GAAOM,aAAa,QAAS,mBACvCsP,EAAS1L,GAAMM,eAAiB/e,EAChCtP,QAAayc,EAAQkY,aAC3BnG,EAAQjF,MAAM,WAAYvpB,GAC1B,IAAK,IAAItE,EAAI,EAAGA,EAAIsE,EAAKzE,OAAQG,IAAK,CACpC,MAAMgH,EAAM1C,EAAKtE,GACX81B,QAAa/U,EAAQ1X,IAAIrC,GAC/B,IAAIgyB,GAAS,EACb,GAAIlD,EACF,IACE,MAAMpW,QAAc8d,EAAOI,kBAAkB9H,GAC7ChD,EAAQjF,MAAM,qBAAsB7mB,EAAK0Y,EAAM+d,SAC3C/d,EAAM+d,SAAWM,IACnB/E,GAAS,EAEZ,CAAC,MAAO/e,GACP6Y,EAAQtc,MAAM,+BAAgCxP,EAAKiT,GACnD+e,GAAS,CACV,MAEDlG,EAAQjF,MAAM,8BAA+B7mB,GAC7CgyB,GAAS,EAEPA,IACFlG,EAAQjF,MAAM,wBAAyB7mB,GAClC+Z,EAAQiY,OAAOhyB,GAEvB,CACF,GAICg3B,GAAc,MAAMC,UAAqBV,GAC3C,WAAAz8B,CAAYggB,GACV7f,MAAM6f,GACN5f,KAAKgvB,cAAgBpP,EAAKoP,cAC1BhvB,KAAKg9B,eAAiBpd,EAAKod,eAC3Bh9B,KAAKk4B,UAAYtY,EAAKsY,UACtBl4B,KAAKovB,UAAYxP,EAAKwP,UACtBpvB,KAAKq4B,aAAezY,EAAKyY,aACzBr4B,KAAKo4B,MAAQxY,EAAKwY,MAClBp4B,KAAKqvB,cAAgBzP,EAAKyP,cAC1BrvB,KAAK05B,iBAAmB9Z,EAAK8Z,iBAC7B15B,KAAK+4B,cAAgBnZ,EAAKmZ,cAC1B/4B,KAAKq7B,aAAezb,EAAKyb,aACzBr7B,KAAK+vB,MAAQnQ,EAAKmQ,KACnB,CACD,mBAAa7G,CAAOtJ,GAClB,MAAMoP,GAAuC,IAAvBpP,EAAKoP,cAAyBd,GAAYY,uBAAyBlP,EAAKoP,oBAAsB,EAC9GgO,EAAiBhO,QAAsBd,GAAYa,sBAAsBC,QAAsB,EACrG,OAAO,IAAI+N,EAAa,IACnBnd,EACHoP,gBACAgO,kBAEH,CACD,eAAAP,GAEE,OADA,IAAIxP,GAAO,eAAe/D,OAAO,mBAC1BzjB,KAAKC,UAAU,CACpBm2B,GAAI77B,KAAK67B,GACThtB,KAAM7O,KAAK6O,KACX0tB,QAASv8B,KAAKu8B,QACdC,aAAcx8B,KAAKw8B,aACnBvJ,UAAWjzB,KAAKizB,UAChBjE,cAAehvB,KAAKgvB,cACpBkJ,UAAWl4B,KAAKk4B,UAChB9I,UAAWpvB,KAAKovB,UAChBiJ,aAAcr4B,KAAKq4B,aACnBD,MAAOp4B,KAAKo4B,MACZ/I,cAAervB,KAAKqvB,cACpBqK,iBAAkB15B,KAAK05B,iBACvBX,cAAe/4B,KAAK+4B,cACpBsC,aAAcr7B,KAAKq7B,aACnBtL,MAAO/vB,KAAK+vB,OAEf,CACD,wBAAO2M,CAAkBC,GACvB1P,GAAOM,aAAa,cAAe,qBACnC,MAAM1e,EAAOpJ,KAAKE,MAAMg3B,GACxB,OAAOI,EAAa7T,OAAOra,EAC5B,GAICouB,GAAiB,MAAMA,EACzB,WAAAr9B,CAAYggB,GACV5f,KAAKwB,IAAMoe,EAAKpe,IAChBxB,KAAKwe,MAAQoB,EAAKpB,KACnB,CACD,mBAAa0K,EAAO1nB,IAElBA,EAAG02B,UACHA,EAAS9I,UACTA,EAASiJ,aACTA,EAAYF,cACZA,EAAaC,MACbA,EAAK8E,WAELA,EAAUnE,cACVA,EAAayD,aACbA,EAAYnN,cACZA,EAAaU,MACbA,EAAKkD,UACLA,EAAS6F,SACTA,EAAQuC,aACRA,EAAY5B,iBACZA,EAAgBC,iBAChBA,EAAgBL,YAChBA,EAAW8D,QACXA,EAAOxD,wBACPA,KACGyD,IAEH,IAAK57B,EAEH,MADAxB,KAAK0wB,QAAQpb,MAAM,yBACb,IAAI5V,MAAM,OAElB,IAAK0vB,EAEH,MADApvB,KAAK0wB,QAAQpb,MAAM,+BACb,IAAI5V,MAAM,aAElB,IAAK24B,EAEH,MADAr4B,KAAK0wB,QAAQpb,MAAM,kCACb,IAAI5V,MAAM,gBAElB,IAAKy4B,EAEH,MADAn4B,KAAK0wB,QAAQpb,MAAM,mCACb,IAAI5V,MAAM,iBAElB,IAAK04B,EAEH,MADAp4B,KAAK0wB,QAAQpb,MAAM,2BACb,IAAI5V,MAAM,SAElB,IAAKw4B,EAEH,MADAl4B,KAAK0wB,QAAQpb,MAAM,+BACb,IAAI5V,MAAM,aAElB,MAAM8e,QAAcse,GAAY5T,OAAO,CACrCra,KAAMquB,EACNV,eACAvJ,YACAjE,eAAgBqK,EAChBjK,YACA8I,YACAG,eACAU,gBACA1J,gBACA+I,QACAsB,mBACA2B,eACAtL,UAEIsN,EAAY,IAAIhmB,IAAI7V,GAC1B67B,EAAU5f,aAAauD,OAAO,YAAaoO,GAC3CiO,EAAU5f,aAAauD,OAAO,eAAgBqX,GAC9CgF,EAAU5f,aAAauD,OAAO,gBAAiBmX,GAC1CwB,GACH0D,EAAU5f,aAAauD,OAAO,QAASoX,GAErCrI,GACFsN,EAAU5f,aAAauD,OAAO,QAAS+O,GAErCoN,GACFE,EAAU5f,aAAauD,OAAO,WAAYmc,GAE5C,IAAIG,EAAa9e,EAAMqd,GASvB,GARI5I,IACFqK,EAAa,GAAGA,IAAa/K,KAAsBU,KAErDoK,EAAU5f,aAAauD,OAAO,QAASsc,GACnC9e,EAAMwe,iBACRK,EAAU5f,aAAauD,OAAO,iBAAkBxC,EAAMwe,gBACtDK,EAAU5f,aAAauD,OAAO,wBAAyB,SAErD8X,EAAU,EACM51B,MAAMC,QAAQ21B,GAAYA,EAAW,CAACA,IAC9CrD,QAAS8H,GAAMF,EAAU5f,aAAauD,OAAO,WAAYuc,GACpE,CACD,IAAK,MAAOz3B,EAAK9B,KAAUnB,OAAO6H,QAAQ,CAAEquB,mBAAkBqE,KAAmB3D,IAClE,MAATz1B,GACFq5B,EAAU5f,aAAauD,OAAOlb,EAAK9B,EAAMlB,YAG7C,OAAO,IAAIm6B,EAAe,CACxBz7B,IAAK67B,EAAU/lB,KACfkH,SAEH,GAEHye,GAAevM,QAAU,IAAIzD,GAAO,iBACpC,IAAIuQ,GAAgBP,GAIhBQ,GAAiB,MACnB,WAAA79B,CAAY8I,GASV,GAPA1I,KAAK+7B,aAAe,GAEpB/7B,KAAK09B,WAAa,GAElB19B,KAAK07B,QAAU,GACf17B,KAAKwe,MAAQ9V,EAAOP,IAAI,SACxBnI,KAAKgzB,cAAgBtqB,EAAOP,IAAI,iBAC5BnI,KAAKwe,MAAO,CACd,MAAMmf,EAAavR,mBAAmBpsB,KAAKwe,OAAOxL,MAAMuf,IACxDvyB,KAAKwe,MAAQmf,EAAW,GACpBA,EAAWh/B,OAAS,IACtBqB,KAAKizB,UAAY0K,EAAWvjB,MAAM,GAAG1X,KAAK6vB,IAE7C,CACDvyB,KAAKsV,MAAQ5M,EAAOP,IAAI,SACxBnI,KAAK6yB,kBAAoBnqB,EAAOP,IAAI,qBACpCnI,KAAK8yB,UAAYpqB,EAAOP,IAAI,aAC5BnI,KAAKT,KAAOmJ,EAAOP,IAAI,OACxB,CACD,cAAIy1B,GACF,QAA6B,IAAzB59B,KAAK69B,WAGT,OAAO79B,KAAK69B,WAAa1M,GAAMM,cAChC,CACD,cAAImM,CAAW55B,GACQ,iBAAVA,IAAoBA,EAAQ0M,OAAO1M,SAC3B,IAAfA,GAAoBA,GAAS,IAC/BhE,KAAK69B,WAAatuB,KAAKC,MAAMxL,GAASmtB,GAAMM,eAE/C,CACD,YAAIyJ,GACF,IAAIxI,EACJ,OAA6B,OAApBA,EAAK1yB,KAAKo4B,YAAsB,EAAI1F,EAAG1f,MAAM,KAAKrR,SArC/C,cAqCyE3B,KAAKw7B,QAC3F,GAICsC,GAAiB,MACnB,WAAAl+B,EAAY4B,IACVA,EAAG07B,WACHA,EAAUa,cACVA,EAAazF,yBACbA,EAAwBmB,iBACxBA,EAAgB+C,aAChBA,EAAYpN,UACZA,EAAS6D,UACTA,IAGA,GADAjzB,KAAK0wB,QAAU,IAAIzD,GAAO,mBACrBzrB,EAEH,MADAxB,KAAK0wB,QAAQpb,MAAM,uBACb,IAAI5V,MAAM,OAElB,MAAM29B,EAAY,IAAIhmB,IAAI7V,GAO1B,GANIu8B,GACFV,EAAU5f,aAAauD,OAAO,gBAAiB+c,GAE7C3O,GACFiO,EAAU5f,aAAauD,OAAO,YAAaoO,GAEzCkJ,IACF+E,EAAU5f,aAAauD,OAAO,2BAA4BsX,GACtD4E,GAAcjK,GAAW,CAC3BjzB,KAAKwe,MAAQ,IAAI6d,GAAM,CAAExtB,KAAMquB,EAAYV,eAAcvJ,cACzD,IAAIqK,EAAat9B,KAAKwe,MAAMqd,GACxB5I,IACFqK,EAAa,GAAGA,IAAa/K,KAAsBU,KAErDoK,EAAU5f,aAAauD,OAAO,QAASsc,EACxC,CAEH,IAAK,MAAOx3B,EAAK9B,KAAUnB,OAAO6H,QAAQ,IAAK+uB,IAChC,MAATz1B,GACFq5B,EAAU5f,aAAauD,OAAOlb,EAAK9B,EAAMlB,YAG7C9C,KAAKwB,IAAM67B,EAAU/lB,IACtB,GAIC0mB,GAAkB,MACpB,WAAAp+B,CAAY8I,GAEV,GADA1I,KAAKwe,MAAQ9V,EAAOP,IAAI,SACpBnI,KAAKwe,MAAO,CACd,MAAMmf,EAAavR,mBAAmBpsB,KAAKwe,OAAOxL,MAAMuf,IACxDvyB,KAAKwe,MAAQmf,EAAW,GACpBA,EAAWh/B,OAAS,IACtBqB,KAAKizB,UAAY0K,EAAWvjB,MAAM,GAAG1X,KAAK6vB,IAE7C,CACDvyB,KAAKsV,MAAQ5M,EAAOP,IAAI,SACxBnI,KAAK6yB,kBAAoBnqB,EAAOP,IAAI,qBACpCnI,KAAK8yB,UAAYpqB,EAAOP,IAAI,YAC7B,GAIC81B,GAAwB,CAC1B,MACA,MACA,YACA,QACA,MACA,MACA,MACA,WAGEC,GAAiC,CAAC,MAAO,MAAO,MAAO,MAAO,OAC9DC,GAAgB,MAClB,WAAAv+B,CAAYk2B,GACV91B,KAAK81B,UAAYA,EACjB91B,KAAK0wB,QAAU,IAAIzD,GAAO,gBAC3B,CACD,oBAAA+L,CAAqBiB,GACnB,MAAM9qB,EAAS,IAAK8qB,GACpB,GAAIj6B,KAAK81B,UAAUkD,qBAAsB,CACvC,IAAIoF,EAEFA,EADEl7B,MAAMC,QAAQnD,KAAK81B,UAAUkD,sBACdh5B,KAAK81B,UAAUkD,qBAEfiF,GAEnB,IAAK,MAAM79B,KAASg+B,EACbF,GAA+Bv8B,SAASvB,WACpC+O,EAAO/O,EAGnB,CACD,OAAO+O,CACR,CACD,WAAA6sB,CAAYqC,EAASC,GACnB,MAAMnvB,EAAS,IAAKkvB,GACpB,IAAK,MAAOj+B,EAAOsjB,KAAW7gB,OAAO6H,QAAQ4zB,GAC3C,GAAInvB,EAAO/O,KAAWsjB,EACpB,GAAIxgB,MAAMC,QAAQgM,EAAO/O,KAAW8C,MAAMC,QAAQugB,GAChD,GAAgD,WAA5C1jB,KAAK81B,UAAUqD,oBAAoBC,MACrCjqB,EAAO/O,GAASsjB,MACX,CACL,MAAM6a,EAAer7B,MAAMC,QAAQgM,EAAO/O,IAAU+O,EAAO/O,GAAS,CAAC+O,EAAO/O,IAC5E,IAAK,MAAM4D,KAASd,MAAMC,QAAQugB,GAAUA,EAAS,CAACA,GAC/C6a,EAAa58B,SAASqC,IACzBu6B,EAAan8B,KAAK4B,GAGtBmL,EAAO/O,GAASm+B,CACjB,KACiC,iBAAlBpvB,EAAO/O,IAAyC,iBAAXsjB,EACrDvU,EAAO/O,GAASJ,KAAKg8B,YAAY7sB,EAAO/O,GAAQsjB,GAEhDvU,EAAO/O,GAASsjB,EAItB,OAAOvU,CACR,GAICqvB,GAAY,MACd,WAAA5+B,CAAYwD,EAAM2sB,GAChB/vB,KAAKoD,KAAOA,EACZpD,KAAK+vB,MAAQA,CACd,GAIC0O,GAAa,MACf,WAAA7+B,CAAY8+B,EAAUC,GACpB3+B,KAAK0wB,QAAU,IAAIzD,GAAO,cAC1BjtB,KAAK0+B,SAAWA,aAAoBzG,GAA0ByG,EAAW,IAAIzG,GAAwByG,GACrG1+B,KAAK2+B,gBAAqC,MAAnBA,EAA0BA,EAAkB,IAAI9I,GAAgB71B,KAAK0+B,UAC5F1+B,KAAK46B,eAAiB,IAAIuD,GAAcn+B,KAAK0+B,UAC7C1+B,KAAK4+B,WAAa,IAAIjE,GAAkB36B,KAAK0+B,SAAU1+B,KAAK2+B,gBAAiB3+B,KAAK46B,gBAClF56B,KAAK86B,aAAe,IAAIZ,GAAYl6B,KAAK0+B,SAAU1+B,KAAK2+B,gBACzD,CACD,yBAAME,EAAoBrgB,MACxBA,EAAKwD,QACLA,EAAO8c,YACPA,EAAWtC,aACXA,EAAYuB,cACZA,EAAagB,WACbA,EAAU1D,aACVA,EAAYtL,MACZA,EAAKkD,UACLA,EAASkF,cACTA,EAAgBn4B,KAAK0+B,SAASvG,cAAaC,MAC3CA,EAAQp4B,KAAK0+B,SAAStG,MAAKC,aAC3BA,EAAer4B,KAAK0+B,SAASrG,aAAYI,OACzCA,EAASz4B,KAAK0+B,SAASjG,OAAMC,QAC7BA,EAAU14B,KAAK0+B,SAAShG,QAAOC,QAC/BA,EAAU34B,KAAK0+B,SAAS/F,QAAOC,WAC/BA,EAAa54B,KAAK0+B,SAAS9F,WAAUC,WACrCA,EAAa74B,KAAK0+B,SAAS7F,WAAUC,SACrCA,EAAW94B,KAAK0+B,SAAS5F,SAAQC,cACjCA,EAAgB/4B,KAAK0+B,SAAS3F,cAAaU,iBAC3CA,EAAmBz5B,KAAK0+B,SAASjF,iBAAgBC,iBACjDA,EAAmB15B,KAAK0+B,SAAShF,iBAAgByD,QACjDA,EAAOxD,wBACPA,EAA0B35B,KAAK0+B,SAAS/E,0BAExC,MAAM/H,EAAU5xB,KAAK0wB,QAAQxH,OAAO,uBACpC,GAAsB,SAAlBiP,EACF,MAAM,IAAIz4B,MAAM,6DAElB,MAAM8B,QAAYxB,KAAK2+B,gBAAgB7H,2BACvClF,EAAQjF,MAAM,kCAAmCnrB,GACjD,MAAMw9B,QAAsBxB,GAActU,OAAO,CAC/C1nB,MACA02B,UAAWl4B,KAAK0+B,SAASxG,UACzB9I,UAAWpvB,KAAK0+B,SAAStP,UACzBiJ,eACAF,gBACAC,QACA8E,WAAY1e,EACZyU,YACAwF,SACAC,UACAC,UACAC,aACAmF,gBACAgB,aACAlG,aACAsE,UACArE,WACA9W,UACA8c,cACArF,mBACAC,mBACA8C,eACAzD,gBACA1J,cAAervB,KAAK0+B,SAASrP,cAC7BgM,eACAtL,QACAsJ,YAAar5B,KAAK0+B,SAASrF,YAC3BM,kCAEI35B,KAAK48B,kBACX,MAAMqC,EAAcD,EAAcxgB,MAElC,aADMxe,KAAK0+B,SAASpF,WAAWt6B,IAAIigC,EAAYpD,GAAIoD,EAAYxC,mBACxDuC,CACR,CACD,6BAAME,CAAwB19B,EAAK29B,GAAc,GAC/C,MAAMvN,EAAU5xB,KAAK0wB,QAAQxH,OAAO,2BAC9BtQ,EAAW,IAAI6kB,GAAetL,GAASC,WAAW5wB,EAAKxB,KAAK0+B,SAAS3F,gBAC3E,IAAKngB,EAAS4F,MAEZ,MADAoT,EAAQiD,MAAM,IAAIn1B,MAAM,yBAClB,KAER,MAAM0/B,QAA0Bp/B,KAAK0+B,SAASpF,WAAW6F,EAAc,SAAW,OAAOvmB,EAAS4F,OAClG,IAAK4gB,EAEH,MADAxN,EAAQiD,MAAM,IAAIn1B,MAAM,uCAClB,KAGR,MAAO,CAAE8e,YADWse,GAAYJ,kBAAkB0C,GAClCxmB,WACjB,CACD,2BAAMymB,CAAsB79B,EAAK4zB,EAAc+J,GAAc,GAC3D,MAAMvN,EAAU5xB,KAAK0wB,QAAQxH,OAAO,0BAC9B1K,MAAEA,EAAK5F,SAAEA,SAAmB5Y,KAAKk/B,wBAAwB19B,EAAK29B,GAEpE,GADAvN,EAAQjF,MAAM,oDACV3sB,KAAK0+B,SAAS7f,MAAQ7e,KAAK0+B,SAAS7f,KAAK6Y,MAAO,CAClD,MAAM4H,QAAkBt/B,KAAKu/B,aAAav/B,KAAK0+B,SAAS7f,KAAK6Y,OAC7DtC,EAAe,IAAKA,EAAcoK,KAAQF,EAC3C,CACD,UACQt/B,KAAK4+B,WAAW7D,uBAAuBniB,EAAU4F,EAAO4W,EAC/D,CAAC,MAAOrc,GACP,KAAIA,aAAeya,IAAkBxzB,KAAK0+B,SAAS7f,MAKjD,MAAM9F,EALiD,CACvD,MAAMumB,QAAkBt/B,KAAKu/B,aAAav/B,KAAK0+B,SAAS7f,KAAK6Y,MAAO3e,EAAIgX,OACxEqF,EAAmB,KAAIkK,QACjBt/B,KAAK4+B,WAAW7D,uBAAuBniB,EAAU4F,EAAO4W,EACtE,CAGK,CACD,OAAOxc,CACR,CACD,kBAAM2mB,CAAaE,EAAW1P,GAC5B,IAAID,EACA4P,EAYJ,aAXYD,EAAU1H,cAAcp2B,SAAS3B,KAAK0+B,SAAStP,YAKzDsQ,QAAkBD,EAAUt3B,IAAInI,KAAK0+B,SAAStP,WAC1CsQ,EAAU3P,QAAUA,GAASA,IAC/B2P,EAAU3P,MAAQA,QACZ0P,EAAUzgC,IAAIgB,KAAK0+B,SAAStP,UAAWsQ,MAP/C5P,QAAgB5B,GAAYmC,mBAC5BqP,EAAY,IAAIlB,GAAU1O,EAASC,SAC7B0P,EAAUzgC,IAAIgB,KAAK0+B,SAAStP,UAAWsQ,UAQlCxR,GAAY0B,kBAAkB,CACzCpuB,UAAWxB,KAAK2+B,gBAAgB3H,kBAAiB,GACjDnH,WAAY,OACZC,QAAS4P,EAAUt8B,KACnB2sB,MAAO2P,EAAU3P,OAEpB,CACD,6CAAM4P,EAAwCC,SAC5CA,EAAQC,SACRA,EAAQxE,aACRA,GAAe,EAAK3B,iBACpBA,EAAmB,CAAE,IAErB,MAAMuC,QAAsBj8B,KAAK86B,aAAaR,oBAAoB,CAAEsF,WAAUC,cAAanG,IACrFoG,EAAiB,IAAIrC,GAAe,IAAInL,iBAG9C,OAFAzvB,OAAO6zB,OAAOoJ,EAAgB7D,SACxBj8B,KAAK4+B,WAAWtD,4BAA4BwE,EAAgBzE,GAC3DyE,CACR,CACD,qBAAMC,EAAgBvhB,MACpBA,EAAK6Z,aACLA,EAAYS,SACZA,EAAQ/E,iBACRA,EAAgBqB,aAChBA,EAAYsE,iBACZA,IAEA,IAAIhH,EACJ,MAAMd,EAAU5xB,KAAK0wB,QAAQxH,OAAO,mBACpC,IAAIkP,EAYAjpB,EAXJ,QAAoD,IAAhDnP,KAAK0+B,SAASlF,yBAChBpB,EAAQ5Z,EAAM4Z,UACT,CACL,MAAM4H,EAAkBhgC,KAAK0+B,SAASlF,yBAAyBxmB,MAAM,KAErEolB,IAD8C,OAArB1F,EAAKlU,EAAM4Z,YAAsB,EAAI1F,EAAG1f,MAAM,OAAS,IACzDgD,OAAQtR,GAAMs7B,EAAgBr+B,SAAS+C,IAAIhC,KAAK,IACxE,CACD,GAAI1C,KAAK0+B,SAAS7f,MAAQ7e,KAAK0+B,SAAS7f,KAAK6Y,MAAO,CAClD,MAAM4H,QAAkBt/B,KAAKu/B,aAAav/B,KAAK0+B,SAAS7f,KAAK6Y,OAC7DtC,EAAe,IAAKA,EAAcoK,KAAQF,EAC3C,CAED,IACEnwB,QAAenP,KAAK86B,aAAaP,qBAAqB,CACpDC,cAAehc,EAAMgc,cAErBpC,QACAC,eACAS,WACA/E,mBACAqB,kBACGsE,GAEN,CAAC,MAAO3gB,GACP,KAAIA,aAAeya,IAAkBxzB,KAAK0+B,SAAS7f,MAajD,MAAM9F,EAZNqc,EAAmB,WAAUp1B,KAAKu/B,aAAav/B,KAAK0+B,SAAS7f,KAAK6Y,MAAO3e,EAAIgX,OAC7E5gB,QAAenP,KAAK86B,aAAaP,qBAAqB,CACpDC,cAAehc,EAAMgc,cAErBpC,QACAC,eACAS,WACA/E,mBACAqB,kBACGsE,GAKR,CACD,MAAM9gB,EAAW,IAAI6kB,GAAe,IAAInL,iBASxC,OARAzvB,OAAO6zB,OAAO9d,EAAUzJ,GACxByiB,EAAQjF,MAAM,sBAAuB/T,SAC/B5Y,KAAK4+B,WAAWnD,wBAAwB7iB,EAAU,IACnD4F,EAGH4Z,UAEKxf,CACR,CACD,0BAAMqnB,EAAqBzhB,MACzBA,EAAKuf,cACLA,EAAa3O,UACbA,EAASoN,aACTA,EAAYvJ,UACZA,EAASqF,yBACTA,EAA2Bt4B,KAAK0+B,SAASpG,yBAAwBmB,iBACjEA,EAAmBz5B,KAAK0+B,SAASjF,kBAC/B,IACF,MAAM7H,EAAU5xB,KAAK0wB,QAAQxH,OAAO,wBAC9B1nB,QAAYxB,KAAK2+B,gBAAgBxH,wBACvC,IAAK31B,EAEH,MADAowB,EAAQiD,MAAM,IAAIn1B,MAAM,4BAClB,KAERkyB,EAAQjF,MAAM,gCAAiCnrB,GAC1C4tB,IAAakJ,GAA6ByF,IAC7C3O,EAAYpvB,KAAK0+B,SAAStP,WAE5B,MAAMpN,EAAU,IAAI8b,GAAe,CACjCt8B,MACAu8B,gBACA3O,YACAkJ,2BACA4E,WAAY1e,EACZib,mBACA+C,eACAvJ,oBAEIjzB,KAAK48B,kBACX,MAAMsD,EAAele,EAAQxD,MAK7B,OAJI0hB,IACFtO,EAAQjF,MAAM,8CACR3sB,KAAK0+B,SAASpF,WAAWt6B,IAAIkhC,EAAarE,GAAIqE,EAAazD,oBAE5Dza,CACR,CACD,8BAAMme,CAAyB3+B,EAAK29B,GAAc,GAChD,MAAMvN,EAAU5xB,KAAK0wB,QAAQxH,OAAO,4BAC9BtQ,EAAW,IAAIolB,GAAgB7L,GAASC,WAAW5wB,EAAKxB,KAAK0+B,SAAS3F,gBAC5E,IAAKngB,EAAS4F,MAAO,CAEnB,GADAoT,EAAQjF,MAAM,wBACV/T,EAAStD,MAEX,MADAsc,EAAQpI,KAAK,sBAAuB5Q,EAAStD,OACvC,IAAIkd,GAAc5Z,GAE1B,MAAO,CAAE4F,WAAY,EAAG5F,WACzB,CACD,MAAMwmB,QAA0Bp/B,KAAK0+B,SAASpF,WAAW6F,EAAc,SAAW,OAAOvmB,EAAS4F,OAClG,IAAK4gB,EAEH,MADAxN,EAAQiD,MAAM,IAAIn1B,MAAM,uCAClB,KAGR,MAAO,CAAE8e,YADW6d,GAAMK,kBAAkB0C,GAC5BxmB,WACjB,CACD,4BAAMwnB,CAAuB5+B,GAC3B,MAAMowB,EAAU5xB,KAAK0wB,QAAQxH,OAAO,2BAC9B1K,MAAEA,EAAK5F,SAAEA,SAAmB5Y,KAAKmgC,yBAAyB3+B,GAAK,GAOrE,OANIgd,GACFoT,EAAQjF,MAAM,oDACd3sB,KAAK4+B,WAAWhD,wBAAwBhjB,EAAU4F,IAElDoT,EAAQjF,MAAM,uDAET/T,CACR,CACD,eAAAgkB,GAEE,OADA58B,KAAK0wB,QAAQxH,OAAO,mBACbmT,GAAMO,gBAAgB58B,KAAK0+B,SAASpF,WAAYt5B,KAAK0+B,SAASxF,uBACtE,CACD,iBAAMmH,CAAYxqB,EAAOnO,GAEvB,OADA1H,KAAK0wB,QAAQxH,OAAO,qBACPlpB,KAAK86B,aAAaL,OAAO,CACpC5kB,QACA6kB,gBAAiBhzB,GAEpB,GC/kEH,SAAS44B,GAA6BC,EAAczgC,GAChD,GAPiC,iBAOhBygC,EAPEnR,UAQf,MAAM,IAAI1vB,MAAM,sEAAsE+F,KAAKC,UAAU66B,MAEzG,GAAIzgC,EAAQwd,aARhB,SAAwB2X,GACpB,OAAQ/xB,MAAMC,QAAQ8xB,EAAKuL,gBACvBvL,EAAKuL,cAAcl9B,MAAOm9B,GAAuB,iBAARA,EACjD,CAMQC,CAAeH,IACfA,EAAaC,cAAc,KAAO1gC,EAAQwd,YAAYxa,WACtD,MAAM,IAAIpD,MAAM,kEAAkE+F,KAAKC,UAAU66B,EAAaC,2CAA2C/6B,KAAKC,UAAU,CACpK5F,EAAQwd,YAAYxa,gBAG5B,OAAO,CACX,CACA5B,eAAey/B,GAAe7gC,EAASshB,GACnC,IAAKA,EAAawf,qBACd,MAAM,IAAIlhC,MAAM,gGAEpB,IAAKwD,MAAMC,QAAQie,EAAayf,kCAC5B,MAAM,IAAInhC,MAAM,uHAEpB,MAAMohC,GR6oBmBC,EQ7oBc3f,EAAayf,iCAAkC7lB,GR8oBpE2Z,KAAMmM,GACbC,EAAUp/B,SAASm/B,KACxB,MAHV,IAA6BC,EQ5oBzB,MAAMC,EAAS,CACXC,YAAanhC,EAAQ2hB,WACrByf,iBAAkB,MAClBV,cAAe,CAAC1gC,EAAQwd,aAAaxa,YACrCq+B,aAAc,SACdC,2BAA4B,sBAC5BC,6BAA8BP,EAC9BQ,YAAa,CAAC,qBAAsB,kBAKlCC,QAAyB5oB,MAAMyI,EAAawf,qBAAqB99B,WAAY,CAC/E+V,OAAQ,OACRrV,QALY,CACZ,eAAgB,oBAKhByxB,KAAMxvB,KAAKC,UAAUs7B,KAEzB,GAAIO,EAAiB5a,GAAI,CACrB,MAAM4Z,QAAqBgB,EAAiBtoB,OAE5C,OADAqnB,GAA6BC,EAAczgC,GACpC,CACH+c,SAAU0jB,EAAanR,UACvBvN,aAAc0e,EAAalR,cAC3BmS,UAAWjB,EAAakB,yBACxBC,yBAA0BnB,EAAac,6BACvC3f,WAAY,UAEnB,CAID,MAHgC,MAA5B6f,EAAiBvoB,QAxEzB,SAGAunB,EAAczgC,GAGV,GAA2B,yBAAvBygC,EAAajrB,MACb,MAAM,IAAI5V,MAAM,kEAAkEI,EAAQwd,aAAaxa,4BAA4By9B,EAAa1N,mBAAqB,MAEzK,GAA2B,4BAAvB0N,EAAajrB,MACb,MAAM,IAAI5V,MAAM,oEAAoE+F,KAAKC,UAAU5F,mBAAyBygC,EAAa1N,mBAAqB,MAIlK,MAAM,IAAInzB,MAAM,uCAAuC6gC,EAAajrB,WAAWirB,EAAa1N,mBAAqB,KACrH,CA0DQ8O,OAA2BJ,EAAiBtoB,OAAQnZ,GAElD,IAAIJ,MAAM,2DAA2D6hC,EAAiBvoB,UAAUuoB,EAAiBxM,sBAAsBwM,EAAiBzM,SAClK,CA0BA,SAAS8M,GAAoB59B,GACzB,YAAoCoa,IAA5Bpa,EAAM6uB,mBACyB,iBAA5B7uB,EAAM6uB,iBACrB,CA6BA,SAASgP,GAA8B5F,EAAepd,GAClD,QAnCuBT,KADTpa,EAoCDi4B,GAnCA3mB,OAA8C,iBAAhBtR,EAAMsR,MAoC7C,MAAM,IAAI2O,GAAkB,kCAAkCgY,EAAc3mB,SAASssB,GAAoB3F,GACnG,KAAKA,EAAcpJ,oBACnB,KAhCd,SAAqB7uB,GACjB,YAA2Boa,IAApBpa,EAAM8uB,WAAsD,iBAApB9uB,EAAM8uB,SACzD,CA8BmBgP,CAAY7F,GAAiB,SAASA,EAAcnJ,aAAe,KAAMmJ,EAAc3mB,MAAOssB,GAAoB3F,GACvHA,EAAcpJ,uBACdzU,GAzCd,IAAkBpa,EA2Cd,IAjCJ,SAAwBA,GACpB,YAA+Boa,IAAvBpa,EAAM+3B,cAA4D,iBAAvB/3B,EAAM+3B,YAC7D,CA+BSgG,CAAe9F,GAChB,MAAM,IAAIlY,GAAqB,CAAC,iBAEpC,IAjCJ,SAAoB/f,GAChB,YAA0Boa,IAAnBpa,EAAMw3B,UAAoD,iBAAnBx3B,EAAMw3B,QACxD,CA+BSG,CAAWM,GACZ,MAAM,IAAIlY,GAAqB,CAAC,aAEpC,IA9BJ,SAAsB/f,GAClB,YAA4Boa,IAArBpa,EAAM05B,YAAwD,iBAArB15B,EAAM05B,UAC1D,CA4BSsE,CAAa/F,GACd,MAAM,IAAIlY,GAAqB,CAAC,eAEpC,IA9BJ,SAAsB/f,GAClB,YAA4Boa,IAArBpa,EAAM45B,YAAwD,iBAArB55B,EAAM45B,UAC1D,CA4BSqE,CAAahG,GACd,MAAM,IAAIlY,GAAqB,CAAC,eAWpC,IAAKlF,GAAmD,WAA3Cod,EAAcyB,WAAWjtB,cAClC,MAAM,IAAI/Q,MAAM,iGAAiGu8B,EAAcyB,gBAEnI,OAAOzB,CACX,CACA/6B,eAAeghC,GAAU1wB,EAAQ2wB,EAAQtzB,EAAMgQ,IA5C/C,SAA+BrN,EAAQ3C,GACnC,GAAIA,EAAKuzB,aACH5wB,EAAO8M,sBACJ9M,EAAO8M,oBAAoB3c,SAASkN,EAAKuzB,YAC9C,MAAM,IAAI1iC,MAAM,eAAe8R,EAAOA,iCAAiC3C,EAAKuzB,oBAEhF,IAAK5wB,EAAO6wB,cACR,MAAM,IAAI3iC,MAAM,gBAAgB8R,EAAOA,yCAE/C,CAoCI8wB,CAAsB9wB,EAAQ3C,GAC9B,MAAMrL,EAAU,CACZ,eAAgB,qCAEpB,IAAIghB,EACA3F,IACA2F,QRojCRtjB,iBACI,MAAMgF,WAAEA,EAAU0e,UAAEA,SAAoB9K,GAAgBkB,GAAsB,GAAI,CAAE7Q,aAAa,IAC3Fo4B,EAAc,CAChBr8B,aACA0e,gBAAiB7P,GAAU6P,IAI/B,OADC2d,EAAY3d,UAAU5e,KAAOgV,GACvBunB,CACX,CQ7jCwBC,GAChBh/B,EAAQg8B,WAAajb,GAAiB/S,EAAO6wB,cAAe,OAAQ7d,IAKpE2d,EAAOtgB,eACPre,EAAQi/B,cAAgB,SAAShgC,KAAK,GAAG0/B,EAAOtlB,YAAYslB,EAAOtgB,mBAEvE,MAAM6gB,EAAc,CAChBtI,WAAYvrB,EAAKuzB,UACjB/J,aAAcxpB,EAAKyO,YACnB/d,KAAMsP,EAAKtP,KACXyvB,cAAengB,EAAK4P,aACpB2Q,UAAW+S,EAAOtlB,UAEhB8lB,EAAmB,CACrB9pB,OAAQ,OACRrV,UACAyxB,KAAM,IAAI3C,gBAAgBoQ,GAAa5/B,YAErC8/B,QAAyBjqB,MAAMnH,EAAO6wB,cAAeM,GAErD1G,EAAgB4F,SADWe,EAAiB3pB,OACqB4F,IACjEzB,MAAEA,EAAKP,SAAEA,SAAmBJ,GAAyBwf,EAAcT,SAAUhqB,EAAOqxB,QAASrxB,EAAOA,OAAQ2wB,EAAOtlB,UACzH,MAAO,CACHqI,YAAa+W,EAAcF,aAC3Brf,QAASuf,EAAcT,SACvBxV,cAxFiBhiB,EAwFai4B,OAvFF7d,IAAxBpa,EAAMw2B,eAA8D,iBAAxBx2B,EAAMw2B,cAwFhDyB,EAAczB,mBACdpc,GACNhB,QACAP,WACA2H,UACAc,UAAW2W,EAAc2B,YA9FjC,IAAyB55B,CAgGzB,CAiCA9C,eAAeilB,GAAQH,EAAcxU,EAAQ2wB,EAAQ3d,GACjD,QAAwBpG,IAApB+jB,EAAOtlB,SACP,MAAM,IAAInd,MAAM,mEAEpB,MAAMgjC,EAAc,CAChBtI,WAAY,gBACZI,cAAexU,GAEnB,IAAI8c,EAAa,CAAA,OACD1kB,IAAZoG,IACAse,EAAa,CACTtD,WAAYjb,GAAiB/S,EAAO6wB,cAAe,OAAQ7d,KAGnE,IAAIue,EAAa,CAAA,OACW3kB,IAAxB+jB,EAAOtgB,aACPkhB,EAAa,CAGTN,cAAe,SAAShgC,KAAK,GAAG0/B,EAAOtlB,YAAYslB,EAAOtgB,mBA/BnD,CAACrgB,IAChB,IAII,OADA,IAAI6V,IAAI7V,IACD,CACV,CACD,MACI,OAAO,CACV,GAyBQ0f,CAAWihB,EAAOtlB,YAIvB6lB,EAAYtT,UAAY+S,EAAOtlB,UAEnC,MAAMmmB,QAAoBrqB,MAAMnH,EAAO6wB,cAAe,CAClDxpB,OAAQ,OACRoc,KAAM,IAAI3C,gBAAgBoQ,GAAa5/B,WACvCU,QAAS,IACFs/B,KACAC,EACH,eAAgB,uCAGxB,IAAInqB,EACJ,IACIA,QAAiBoqB,EAAY/pB,MAChC,CACD,MAAO0E,GAEH,MAAM,IAAIje,MAAM,gCAAgC8R,EAAOA,wCAC1D,CACD,MAAMyxB,EAAoBpB,GAA8BjpB,OAAsBwF,IAAZoG,IAC5DpH,MAAEA,SAAgBX,GAAyBwmB,EAAkBzH,SAAUhqB,EAAOqxB,QAASrxB,EAAOA,OAAQ2wB,EAAOtlB,UACnH,MAAO,CACHqI,YAAa+d,EAAkBlH,aAC/Brf,QAASumB,EAAkBzH,SAC3BxV,aAAyD,iBAApCid,EAAkBzI,cACjCyI,EAAkBzI,mBAClBpc,EACNhB,QACAoH,UACAc,UAAW2d,EAAkBrF,WAErC,CC9QqB,MAAAsF,WAA6BC,GAGhDC,MAAQliC,MACNpB,EACA+lB,KAKuB,SAAnB/lB,EAAQ24B,cACJz4B,KAAKkf,mBAAmBE,MAAMtf,EAAQ8e,WAS9C,MAAMtB,EACJxd,EAAQwd,aDoRd,SAA8BA,GAC1B,MAAM+lB,EAAazlB,GAAmBN,GAKtC,OAFA+lB,EAAWp5B,KAAO,GAIlBqT,EAAY3b,SAAS,GAAG0hC,EAAW/e,WACxB+e,EAAW/rB,KAIf,GAAG+rB,EAAW/e,SAAS+e,EAAW/rB,KAAKgsB,UAE9CD,EAAW/e,OAAO3lB,OAAS,IAC/B,CCpS6B4kC,CAAqBnV,OAAOoV,SAASlsB,MAC9D,IAAK+F,GAAmBC,GACtB,MAAM,IAAI5d,MACR,GAAG4d,kJAGDtd,KAAKmiB,aAAa9F,OAAO,IAC1Bvc,EACHwd,cAEAmE,WAAY3hB,EAAQ2hB,YAAc3hB,EAAQ+c,SAC1CgJ,kBAQJ4d,uBAAyBviC,MACvBwiC,IAEA,MAAMC,QAAoB3jC,KAAKkf,mBAAmB/W,IAAIu7B,GACtD,YACkBtlB,IAAhBulB,QAC4BvlB,IAA5BulB,EAAYC,kBACWxlB,IAAvBulB,EAAYnyB,QA7DlB,SAAyBmyB,GAEvB,YACkCvlB,IAAhCulB,EAAYE,iBACoB,IAAhCF,EAAYE,iBAIPF,EAAYE,gBAAkBt0B,KAAKC,MAAMuB,KAAKuB,MAAQ,IAC/D,CAqDMwxB,CAAgBH,GAET,KAEFA,GAGTI,uBAAyB7iC,MACvBM,EACAqkB,KAEA,IACE,MAAMme,QAAqBhkC,KAAKoiB,gBAAgB/F,OAC9C7a,EACAqkB,OACAzH,GAYF,OANApe,KAAK2Y,MAAQqrB,EAAarrB,MAAMmR,KAAKsE,QACrCpuB,KAAKuiB,YAAcyhB,EAAaC,mBAG1BjkC,KAAKkkC,sBAAsB1iC,GAE1B,CACLme,WAAYqkB,EAAarkB,WACzBvC,MAAO4mB,EAAa5mB,MACpBwB,UAAWolB,EAAaplB,UACxBulB,eAAgBH,EAAaG,eAC7BP,YAAaI,EAAaJ,YAE7B,CAAC,MAAO7qB,GAWP,aATM/Y,KAAKkkC,sBAAsB1iC,QAOjCqkB,EAAaO,KAAKnL,GAAOC,MAAO,WAAYnC,EAG7C,GAGK,2BAAMmrB,CAAsB1iC,GAClC,MAAMqc,EAAeD,GAAmBpc,GAAK8V,KAQ7C,IADA8W,OAAOgW,QAAQC,aAAa,KAAM,GAAIxmB,GAC/BuQ,OAAOoV,SAASlsB,OAASuG,SAOxB,IAAI5B,QAAetT,IACvB4d,WAAW,IAAM5d,IAAW,IAGjC,EC/HH,SAAS27B,GACPxkC,GAEA,MAAqC,iBAAvBA,EAAQykC,UACxB,CAEA,SAASC,GACP1kC,GAEA,MAAsC,iBAAxBA,EAAQwd,WACxB,CAKc,MAAOmnB,GAETzmB,eACA0mB,YACApiB,oBACAjB,gBAJV,WAAAzhB,CACUoe,EACA0mB,EACApiB,EACAjB,GAHArhB,KAAcge,eAAdA,EACAhe,KAAW0kC,YAAXA,EACA1kC,KAAmBsiB,oBAAnBA,EACAtiB,KAAeqhB,gBAAfA,EAERrhB,KAAKge,eAAiBA,EACtBhe,KAAK0kC,YAAcA,EACnB1kC,KAAKsiB,oBAAsBA,EAC3BtiB,KAAKqhB,gBAAkBA,CACxB,CAED,eAAMjF,CAAUtc,GACd,OAAOwkC,GAAUxkC,IAAY0kC,GAAe1kC,EAC7C,CAED,YAAMuc,CAAOvc,GACX,IAAKwkC,GAAUxkC,GACb,MAAM,IAAI8jB,GACR,8EAA8Ene,KAAKC,UACjF5F,MAIN,IAAK0kC,GAAe1kC,GAClB,MAAM,IAAI8jB,GACR,+EAA+Ene,KAAKC,UAClF5F,MAMN,MAAMshB,QACEphB,KAAKsiB,oBAAoBW,YAAYnjB,EAAQykC,YAE/CI,QAA2BxjB,GAC/BrhB,EACAshB,EACAphB,KAAKge,eACLhe,KAAKqhB,iBAIDujB,EAA4B,CAMhCpzB,OAAQ4P,EAAa5P,OAErBqN,KAA0C,SAApC/e,EAAQ+kC,UAAUp0B,iBACrB3Q,EACHue,oBAAqB+C,EACrB+gB,OAAQwC,EACRG,QV6GmBA,EU7GKhlC,EAAQilC,aV8G7B7hC,MAAMC,QAAQ2hC,GAGZ5hC,MAAMG,KAEb,IAAIK,IAAI,IACDkY,MACAkpB,EAAO9uB,OAEToiB,GAA2B,iBAAVA,IAAuBA,EAAMz2B,SAAS,SARjDia,KAFf,IAAyBkpB,EUzGrB,OAAO9kC,KAAK0kC,YAAYroB,OAAOuoB,EAChC,EC/EkB,MAAAI,WACXjnB,GAGR,YAAM1B,CAAO8B,GACX,MAAM8mB,EAAc9mB,EAAiBb,aAAe,GAC9C4nB,EAAc,CAClBhN,UAAW/Z,EAAiB3M,OAAO1O,WACnCssB,UAAWjR,EAAiBgkB,OAAOtlB,SACnCwS,cAAelR,EAAiBgkB,OAAOtgB,aACvCwW,aAAc4M,EACd9M,cAAe,OACfC,MAAOja,EAAiB2mB,OAAOpiC,KAAK,KACpCs2B,sBAAsB,EAItBC,cAAc,EACdR,OAAQta,EAAiBsa,QAAU,WAG/B0M,EAAoB,IAAI1G,GAAWyG,GAEzC,IACE,MAAME,QAAuBD,EAAkBtG,oBAAoB,CAAE,GAErE,aAAa7+B,KAAKue,qBAAqB,CACrCJ,mBAEAK,MAAO4mB,EAAe5mB,MAAMqd,GAE5Bpd,aAAc2mB,EAAe5mB,MAAMwQ,eAAiB,GACpDtQ,UAAW0mB,EAAe5jC,IAAIsB,YAEjC,CAAC,MAAOiW,GACPwQ,QAAQjU,MAAMyD,EACf,CAIF,EC9CI,MAEDssB,GAGF,CACF7zB,OAAQ,CACN8zB,MAAO,SACPC,cAAc,GAEhBC,uBAAwB,CACtBF,MAAO,wBACPC,cAAc,GAEhBE,eAAgB,CACdH,MAAO,gBACPC,cAAc,GAEhBG,kBAAmB,CACjBJ,MAAO,mBACPC,cAAc,GAEhBhO,SAAU,CACR+N,MAAO,UACPC,cAAc,GAEhBI,sBAAuB,CACrBL,MAAO,uBACPC,cAAc,GAEhBK,qBAAsB,CACpBN,MAAO,qBACPC,cAAc,GAEhBM,iBAAkB,CAAEP,MAAO,mBAC3BQ,yBAA0B,CAAER,MAAO,0BACnCS,yBAA0B,CAAET,MAAO,0BACnCU,sBAAuB,CAAEV,MAAO,uBAChCW,qBAAsB,CAAEX,MAAO,sBAC/BY,wBAAyB,CAAEZ,MAAO,yBAClCa,sCAAuC,CACrCb,MAAO,oCAETc,yCAA0C,CACxCd,MAAO,uCAETe,yCAA0C,CACxCf,MAAO,uCAETgB,sCAAuC,CACrChB,MAAO,qCAETiB,yCAA0C,CACxCjB,MAAO,wCAETkB,yCAA0C,CACxClB,MAAO,wCAETmB,4CAA6C,CAC3CnB,MAAO,0CAEToB,+CAAgD,CAC9CpB,MAAO,6CAETqB,+CAAgD,CAC9CrB,MAAO,6CAETsB,sCAAuC,CACrCtB,MAAO,qCAETuB,iDAAkD,CAChDvB,MAAO,8CAETwB,yBAA0B,CAAExB,MAAO,0BACnCyB,sBAAuB,CAAEzB,MAAO,uBAChC0B,iBAAkB,CAAE1B,MAAO,mBAC3B2B,sBAAuB,CAAE3B,MAAO,wBAChC4B,yBAA0B,CAAE5B,MAAO,0BACnC6B,qBAAsB,CAAE7B,MAAO,sBAC/B8B,2BAA4B,CAAE9B,MAAO,4BACrC+B,4BAA6B,CAAE/B,MAAO,6BACtCgC,gCAAiC,CAAEhC,MAAO,gCAC1CiC,iCAAkC,CAAEjC,MAAO,iCAC3CkC,cAAe,CACblC,MAAO,cACPC,cAAc,GAEhBkC,WAAY,CACVnC,MAAO,WACPC,cAAc,IA0BJ,MAAOmC,GACC1pB,eAApB,WAAApe,CAAoBoe,GAAAhe,KAAcge,eAAdA,EAClBhe,KAAKge,eAAiBA,CACvB,CAIM,yBAAO2pB,CAAmBn2B,GAC/B,MAAO,gBAAgBA,GACxB,CAED,iBAAMyR,CAAYzR,GAChB,IAAI4P,EAEJ,MAAMwmB,EAAkB,IAAIvwB,IAjIQ,mCAqIlC7F,EAAOooB,SAAS,KAAOpoB,EAAS,GAAGA,MACnC8F,KACIuwB,QAAgClvB,MAAMivB,GAE5C,IACExmB,EA7CN,SACE4f,GAEA,MAAM8G,EAAkD,CAAA,EAaxD,OAZAjlC,OAAOO,KAAK49B,GAAQvL,QAAS3vB,IACvBu/B,GAAmBv/B,KAKrBgiC,EAAazC,GAAmBv/B,GAAKw/B,OAAStE,EAAOl7B,MAGpD5C,MAAMC,QAAQ2kC,EAAavmB,mBAC9BumB,EAAavmB,gBAAkB,CAAC,WAE3BumB,CACT,CA4BqBC,OAAoBF,EAAwB5uB,OAC5D,CAAC,MAAOF,GACP,MAAM,IAAI6K,GACR,IAAIpS,EAAO1O,6CACRiW,EAA4BlZ,UAGlC,CAQD,aALMG,KAAKge,eAAehf,IACxB0oC,GAAoBC,mBAAmBn2B,GACvC/L,KAAKC,UAAU0b,IAGVA,CACR,EClJIlgB,eAAeke,GACpBR,EACAiB,SAEMmoB,GAAUppB,EAAWiB,SLmU7B3e,iBACI,MAAMw2B,EAAQ,IAAID,GAAqB,CAAA,SACjC4E,GAAMO,gBAAgBlF,EAAO,KACnC,MAAMuQ,EAAY7Z,OAAOuJ,aACnBuQ,EAAgB,GACtB,IAAK,IAAIppC,EAAI,EAAGA,GAAKmpC,EAAUtpC,OAAQG,GAAK,EAAG,CAC3C,MAAMgH,EAAMmiC,EAAUniC,IAAIhH,GACtBgH,IACCA,EAAIqiC,MAAM,eACPriC,EAAIqiC,MAAM,wCACdD,EAAc9lC,KAAK0D,EAE1B,CACDoiC,EAAczS,QAAS3vB,GAAQmiC,EAAU1U,WAAWztB,GACxD,CKhVQsiC,EACR,CAKM,MAAOC,WACHroB,GAGR,SAAM7X,CACJyW,GAEA,MACEe,EACAvC,EACAP,EACAgF,EACAvE,EACA0I,EACAxU,EACAqzB,EACArD,SACQvlB,QAAQC,IAAI,CACpBlc,KAAKge,eAAe8E,WAAWlE,EAAW,aAAc,CACtDmB,QAAQ,IAEV/f,KAAKge,eAAe8E,WAAWlE,EAAW,QAAS,CACjDmB,QAAQ,IAEV/f,KAAKge,eAAe8E,WAAWlE,EAAW,WAAY,CACpDmB,QAAQ,IAEV/f,KAAKge,eAAe8E,WAAWlE,EAAW,eAAgB,CACxDmB,QAAQ,IAEV/f,KAAKge,eAAe8E,WAAWlE,EAAW,cAAe,CACvDmB,QAAQ,IAEV/f,KAAKge,eAAe8E,WAAWlE,EAAW,eAAgB,CACxDmB,QAAQ,IAEV/f,KAAKge,eAAe8E,WAAWlE,EAAW,SAAU,CAClDmB,QAAQ,IAEV/f,KAAKge,eAAe8E,WAAWlE,EAAW,YAAa,CACrDmB,QAAQ,IAEV/f,KAAKge,eAAe8E,WAAWlE,EAAW,YAAa,CACrDmB,QAAQ,MAIZ,GAA2B,iBAAhBzC,GAA6BD,GAAmBC,GAA3D,CAWA,QAAkBc,IAAdymB,IbwiBoB,iBADEhvB,EaviB2BgvB,KbwiBjB,CAAC,OAAQ,UAAUljC,SAASkU,IaviB9D,MAAM,IAAInW,MAAM,mBAAmBmlC,yBbsiBzC,IAA8BhvB,EaniB1B,QACeuI,IAAbvB,QACeuB,IAAfuB,QACUvB,IAAVhB,QACiBgB,IAAjB4H,EAKF,MAAO,CACLpH,YACAxB,QACAuC,WAA2B,SAAfA,EACZrC,cACA0I,eACAxU,SACAoyB,YAAa/mB,EACbyrB,gBAAiBzmB,EAEjBgjB,UAAWA,GAAa,OACxBhB,qBACgBzlB,IAAdojB,EAA0B9wB,OAAO63B,SAAS/G,EAAW,SAAMpjB,EA3B9D,YALOnC,QAAQC,IAAI,CAChBlc,KAAKge,eAAe8B,kBAAkBlB,EAAW,CAAEmB,QAAQ,IAC3D/f,KAAKge,eAAe8B,kBAAkBlB,EAAW,CAAEmB,QAAQ,KAgChE,CAQD,WAAMX,CAAMR,GACV,OAAOQ,GAAMR,EAAW5e,KAAKge,eAC9B,QClHUwqB,GACX,eAAMpsB,CAAUkB,GACd,IAIE,OADA,IAAIjG,IAAIiG,IACD,CACR,CAAC,MAAON,GACP,MAAM,IAAItd,MACR,IAAI4d,gEAA0EN,IAEjF,CACF,CAED,YAAMX,CAEJosB,GAEA,OAAO/oB,IACR,QCVUgpB,GAED1qB,eACAkB,mBACAoD,oBACAjB,gBACAsnB,eALV,WAAA/oC,CACUoe,EACAkB,EACAoD,EACAjB,EACAsnB,GAJA3oC,KAAcge,eAAdA,EACAhe,KAAkBkf,mBAAlBA,EACAlf,KAAmBsiB,oBAAnBA,EACAtiB,KAAeqhB,gBAAfA,EACArhB,KAAc2oC,eAAdA,EAER3oC,KAAKge,eAAiBA,EACtBhe,KAAKkf,mBAAqBA,EAC1Blf,KAAKsiB,oBAAsBA,EAC3BtiB,KAAKqhB,gBAAkBA,EACvBrhB,KAAK2oC,eAAiBA,CACvB,CAED,eAAMvsB,CAAUkB,GACd,IACE,MAAMsrB,EAAQ,IAAIvxB,IAAIiG,GACtB,OACqC,OAAnCsrB,EAAMnrB,aAAatV,IAAI,SACa,OAApCygC,EAAMnrB,aAAatV,IAAI,QAE1B,CAAC,MAAO6U,GACP,MAAM,IAAItd,MACR,IAAI4d,gEAA0EN,IAEjF,CACF,CAED,YAAMX,CACJiB,EACAuI,GAEA,UAAY7lB,KAAKoc,UAAUkB,GACzB,MAAM,IAAI5d,MACR,0CAA0C4d,2CAI9C,MAAM9b,EAAM,IAAI6V,IAAIiG,GACdurB,EAAarnC,EAAIic,aAAatV,IAAI,SAElC2gC,QAAyB9oC,KAAKge,eAAe8E,WACjD+lB,EACA,YACA,CACE9lB,aAAa,KAIX3B,aACJA,EAAY3C,aACZA,EACAnB,YAAauF,EACbhE,KAAMkqB,SACEpmB,GACRmmB,EACA9oC,KAAKge,eACLhe,KAAKsiB,qBAGDtQ,EAAMxQ,EAAIic,aAAatV,IAAI,OAEjC,GAAmB,iBAAR6J,GAAoBA,IAAQoP,EAAa5P,OAClD,MAAM,IAAI9R,MACR,mCAAmCsS,wEAA0EoP,EAAa5P,yFAI9H,QAAqB4M,IAAjBK,EACF,MAAM,IAAI/e,MACR,iCAAiCopC,8BAIrC,QAA0B1qB,IAAtByE,EACF,MAAM,IAAInjB,MACR,gCAAgCopC,8BAIpC,MAAM3G,QAAwBniC,KAAKqhB,gBAAgBO,UACjD,CAAEhD,UAAWkqB,GACb1nB,GAGI4nB,EAAiBj4B,KAAKuB,MACtB22B,QAAe/G,GACnB9gB,EACA+gB,EACA,CACEC,UAAW,qBAGX7iC,KAAMiC,EAAIic,aAAatV,IAAI,QAC3BsW,eACAnB,YAAauF,GAEfkmB,GAOF,IAAIpjB,EAFJyI,OAAOuJ,aAAapE,WAAW,QAAQsV,UAGXzqB,IAAxB6qB,EAAOjjB,eACTL,EAAiB,CACf/G,UAAWkqB,EACX9iB,aAAcijB,EAAOjjB,aACrBE,eAAgBlmB,KAAK2oC,iBAIzB,MAAMO,EAAY3jB,GAAwB0jB,EAAO/jB,YAAa,CAC5DV,QAASykB,EAAOzkB,QAChBmB,iBACAE,eACAP,UAAW2jB,EAAO3jB,kBfgwBxBpkB,eAAwC8c,EAAgBY,EAAWxB,EAAOP,EAAU8C,EAAYqG,EAAcjG,QAK5F3B,IAAVhB,SACMY,EAAeW,WAAWC,EAAW,CAAExB,SAAS,CAAE2C,gBAE3C3B,IAAbvB,SACMmB,EAAeW,WAAWC,EAAW,CAAE/B,YAAY,CAAEkD,iBAGrD/B,EAAeW,WAAWC,EAAW,CAAEe,cAAc,CAAEI,UAQrE,CejxBUopB,CACJnpC,KAAKge,eACL8qB,EACAG,EAAO7rB,MACP6rB,EAAOpsB,SACP,OACAuB,GACA,GAGF,MAAMulB,QAAoB3jC,KAAKkf,mBAAmB/W,IAAI2gC,GACtD,IAAKnF,EACH,MAAM,IAAIjkC,MAAM,gCAAgCopC,OAGlD,OAAOjmC,OAAO6zB,OAAOiN,EAAa,CAChChrB,MAAOuwB,EACPjF,aAActjB,GAA4B,CACxCE,YAAaooB,EAAOvsB,QACpBkE,mBAAoBQ,EAAaR,qBAEnCujB,eAC8B,iBAArB8E,EAAO3jB,UACV0jB,EAAoC,IAAnBC,EAAO3jB,eACxBlH,GAET,EC5JkB,MAAAgrB,WACXvtB,GAGR,WAAAjc,CAAYypC,GACVtpC,MAAMspC,EACP,ECdW,MAAOC,GACnB,WAAIzpB,GACF,OAAOuO,OAAOuJ,YACf,CAED,SAAMxvB,CAAIrC,GACR,OAAO9F,KAAK6f,QAAQwT,QAAQvtB,SAAQsY,CACrC,CAED,SAAMpf,CAAI8G,EAAa9B,GACrBhE,KAAK6f,QAAQyT,QAAQxtB,EAAK9B,EAC3B,CAED,YAAM,CAAO8B,GACX9F,KAAK6f,QAAQ0T,WAAWztB,EACzB,ECZW,MAAOyjC,GACnB,QAAAzwB,CAASwE,EAAqBxd,GACxBA,GAAWA,EAAQkf,eACrBlf,EAAQkf,eAAe1B,GACdxd,GAAWA,EAAQ0pC,yBAC5Bpb,OAAOgW,QAAQC,aAAa,CAAE,EAAE,GAAI/mB,GAEpC8Q,OAAOoV,SAASlsB,KAAOgG,CAE1B,ECJW,MAAOmsB,GACCzrB,eAApB,WAAApe,CAAoBoe,GAAAhe,KAAcge,eAAdA,EAClBhe,KAAKge,eAAiBA,CACvB,CAED,eAAM4D,CACJ9hB,EACAshB,GAGA,MACEsoB,EACAC,EACAnI,EACAoI,EACAC,SACQ5tB,QAAQC,IAAI,CACpBlc,KAAKge,eAAe8E,WAAWhjB,EAAQ8e,UAAW,WAAY,CAC5DmB,QAAQ,IAEV/f,KAAKge,eAAe8E,WAAWhjB,EAAQ8e,UAAW,eAAgB,CAChEmB,QAAQ,IAEV/f,KAAKge,eAAe8E,WAAWhjB,EAAQ8e,UAAW,YAAa,CAC7DmB,QAAQ,IAEV/f,KAAKge,eAAe8E,WAAWhjB,EAAQ8e,UAAW,aAAc,CAC9DmB,QAAQ,IAEV/f,KAAKge,eAAe8E,WAAWhjB,EAAQ8e,UAAW,aAAc,CAC9DmB,QAAQ,MAKNokB,OACU/lB,IAAdojB,EAA0B9wB,OAAO63B,SAAS/G,EAAW,KAAO,EAIxDsI,OACmB1rB,IAAvBurB,GACmB,IAAnBxF,GACA50B,KAAKC,MAAMuB,KAAKuB,MAAQ,KAAQ6xB,EAClC,GAAIuF,InB6oB0B,iBADPhoB,EmB5oBiBmoB,InB8oBpC,CAAC,UAAW,SAAU,cAAcloC,SAAS+f,MmB9oBaooB,EAC5D,YAA8B1rB,IAAvBurB,EACH,CACE9sB,SAAU6sB,EACV7nB,aAAc8nB,EACdloB,WAAYmoB,EAEZloB,WAAY,UACZ8f,UAAW2C,GAEZ,CACCtnB,SAAU6sB,EACVjoB,WAAYmoB,EAEZloB,WAAYmoB,GnB8nBxB,IAA2BnoB,EmBznBvB,IACE,MAAMqoB,QAAyBpJ,GAAe7gC,EAASshB,GAEjDU,EAAqC,CACzCjF,SAAUktB,EAAiBltB,SAC3B6E,WAAY,WAgBd,YAdsCtD,IAAlC2rB,EAAiBloB,eACnBC,EAAWD,aAAekoB,EAAiBloB,aAC3CC,EAAW0f,UAAYn/B,OAAO0nC,EAAiBvI,YAE7CuI,EAAiBrI,2BACnB5f,EAAW4f,yBACTqI,EAAiBrI,gCAEf1hC,KAAKge,eAAeW,WAAW7e,EAAQ8e,UAAWkD,EAAY,CAIlE/B,QAAQ,IAEHgqB,CACR,CAAC,MAAOz0B,GACP,MAAM,IAAI5V,MAAM,8BAA+B,CAAEa,MAAO+U,GACzD,CACF,QCtFU00B,GACX,eAAM5tB,CAAUkB,GACd,IACE,OAAO,IAAIjG,IAAIiG,GAAaG,aAAa5Z,IAAI,QAC9C,CAAC,MAAOmZ,GACP,MAAM,IAAItd,MACR,IAAI4d,gEAA0EN,IAEjF,CACF,CAED,YAAMX,CACJiB,EACAuI,GAEA,QAAqBzH,IAAjByH,EAA4B,CAC9B,MAAMrkB,EAAM,IAAI6V,IAAIiG,GACd2sB,EAAWzoC,EAAIic,aAAatV,IAAI,SAChC+hC,EAAsB1oC,EAAIic,aAAatV,IAAI,qBACjD0d,EAAaO,KAAKnL,GAAOC,MAAO+uB,EAAUC,EAC3C,CACD,OAAOxqB,IACR,ECfW,MAAOyqB,GAETnsB,eACAsE,oBACAjB,gBAHV,WAAAzhB,CACUoe,EACAsE,EACAjB,GAFArhB,KAAcge,eAAdA,EACAhe,KAAmBsiB,oBAAnBA,EACAtiB,KAAeqhB,gBAAfA,EAERrhB,KAAKge,eAAiBA,EACtBhe,KAAKsiB,oBAAsBA,EAC3BtiB,KAAKqhB,gBAAkBA,CACxB,CAED,aAAM8E,CACJvH,EACAoH,EACAxB,EACAqB,GAEA,MAAMukB,QAAoBznB,GACxB/D,EACA5e,KAAKge,eACLhe,KAAKsiB,qBAGDhB,QAA4BthB,KAAKqhB,gBAAgBO,UACrD,CAAEhD,aACFwrB,EAAYhpB,cAGd,QAAqBhD,IAAjB4H,EAEF,MAAM,IAAItmB,MACR,YAAYkf,oEAIhB,GAAIwrB,EAAYvrB,WAAoBT,IAAZoG,EACtB,MAAM,IAAI9kB,MACR,gBAAgBkf,6FAIpB,MAAMqH,QAAiBE,GACrBH,EACAokB,EAAYhpB,aACZE,EACAkD,GAMF,YAH8BpG,IAA1B6H,EAASD,cACXH,GAAcO,KAAKnL,GAAOI,kBAAmB4K,EAASD,cAEjDC,CACR,EC/CG,SAAUokB,GAAwCC,GAItD,MAAMC,EAAkB,IAAI5mB,GACtBR,EAAgBmnB,EAAannB,eAAiBonB,EAC9CnnB,EAAkBknB,EAAalnB,iBAAmB,IAAIkmB,GAEtDtrB,EAAiB,IAAIgO,GACzB7I,EACAC,GAGId,EAAsB,IAAIolB,GAAoB1pB,GAC9CqD,EAAkB,IAAIooB,GAAgBzrB,GAEtCkB,EAAqB,IAAImpB,GAAmBrqB,GAE5CkI,EAAiB,IAAIikB,GACzBnsB,EACAsE,EACAjB,GAGIpD,EAAa,IAAIsrB,GAGjBpnB,EAAe,IAAIsiB,GACvBzmB,EACA,IAAIgnB,GAAqChnB,EAAgBC,GACzDqE,EACAjB,GAGIe,EAAkB,IAAIgnB,GAAyB,CACnD,IAAIY,GACJ,IAAItB,GACF1qB,EACAkB,EACAoD,EACAjB,EACA6E,GAIF,IAAIsiB,KAGN,OAAO,IAAItF,GACT/gB,EACAC,EACA,IAAI5C,GAAwBN,EAAoBjB,GAChDiB,EACAoD,EAEJ,CCrFO,MAAMkoB,GAAsB,GAAGzvB,mBAEzB0vB,GAAkB,GAAG1vB,qBC8FrB2vB,GAIK9d,KAOA7D,OAER4hB,qBAEAC,wBAAyB,EAiBjC,WAAAhrC,CACEirC,EAA2C,GAC3CjsB,OAAgCR,GAEhCpe,KAAK+oB,OAAS,IAAIvB,GACdqjB,EAAeF,qBACjB3qC,KAAK2qC,qBAAuBE,EAAeF,qBAClCE,EAAe1nB,eAAiB0nB,EAAeznB,gBACxDpjB,KAAK2qC,qBAAuBN,GAAwC,CAClElnB,cAAe0nB,EAAe1nB,cAC9BC,gBAAiBynB,EAAeznB,kBAGlCpjB,KAAK2qC,qBAAuBN,GAAwC,CAAA,GAGlEQ,EAAelH,YACjB3jC,KAAK4sB,KAAO,CACVhO,UAAWisB,EAAelH,YAAY/kB,UACtCe,YAAY,EACZvC,MAAOytB,EAAelH,YAAYvmB,MAClCwmB,YAAaiH,EAAelH,YAAYC,aAG1C5jC,KAAK4sB,KAAO,CACVhO,UAAWA,GAAatE,KACxBqF,YAAY,GAQhB3f,KAAK+oB,OAAOZ,GAAGlN,GAAOE,MAAO,IAC3BiT,OAAOuJ,aAAarE,QAAQkX,GAAqBxqC,KAAK4sB,KAAKhO,YAG7D5e,KAAK+oB,OAAOZ,GAAGlN,GAAOO,gBAAiB,IAAMxb,KAAK8qC,gBAAe,IAEjE9qC,KAAK+oB,OAAOZ,GAAGlN,GAAOC,MAAO,IAAMlb,KAAK8qC,gBAAe,GACxD,CAUD1H,MAAQliC,MAAOpB,UACPE,KAAK2qC,qBAAqBvH,MAC9B,CACExkB,UAAW5e,KAAK4sB,KAAKhO,aAClB9e,EAEH+kC,UAAW/kC,EAAQ+kC,WAAa,QAElC7kC,KAAK+oB,QAMA,IAAI9M,QAAQ,SASrBtD,MAAsB,CAACnX,EAAKygB,IAC1BjiB,KAAK2qC,qBAAqBhyB,MAAMnX,EAAKygB,GAS/B6oB,eAAiB5pC,MACvB6pC,EACAjrC,KAKAsuB,OAAOuJ,aAAapE,WAAWiX,UACzBxqC,KAAK2qC,qBAAqBnoB,OAAOxiB,KAAK4sB,KAAKhO,UAAW9e,GAC5DE,KAAK4sB,KAAKjN,YAAa,EACnBorB,GACD/qC,KAAK+oB,OAAwB3C,KAAKnL,GAAOG,SAyC9CoH,OAASthB,MAAOpB,GACdE,KAAK8qC,gBAAe,EAAMhrC,GAQ5BikC,uBAAyB7iC,MACvB8pC,EAAwD,MAExD,GAAIhrC,KAAK4sB,KAAKjN,WACZ,OAAO3f,KAAK4sB,KAGd,GAAI5sB,KAAK4qC,uBACP,OAEF,MAAM9qC,EACoB,iBAAjBkrC,EAA4B,CAAExpC,IAAKwpC,GAAiBA,EACvDxpC,EAAM1B,EAAQ0B,KAAO4sB,OAAOoV,SAASlsB,KAE3CtX,KAAK4qC,wBAAyB,EAC9B,MAAMjH,QAAoB3jC,KAAK2qC,qBAAqB5G,uBAClDviC,EACAxB,KAAK+oB,QAEP,GA7MJ,SACE4a,GAEA,QAASA,GAAahkB,UACxB,CAyMQA,CAAWgkB,GAAc,CAC3B3jC,KAAKirC,eAAetH,GACpB,MAAMuH,EAAa9c,OAAOuJ,aAAatE,QAAQoX,IAC5B,OAAfS,EAGDlrC,KAAK+oB,OAAwB3C,KAAKnL,GAAOE,QAK1CiT,OAAOuJ,aAAapE,WAAWkX,IAC9BzqC,KAAK+oB,OAAwB3C,KAAKnL,GAAOS,iBAAkBwvB,GAE/D,MAAM,IAAuC,IAAnCprC,EAAQqrC,uBAAiC,CAMlD,MAAMrC,EAAkB1a,OAAOuJ,aAAatE,QAAQmX,IAGpD,GAAwB,OAApB1B,EAA0B,CAU5B,SA3QD5nC,eACL0d,EACAwsB,EACAC,GAEA,MAAMC,QAA0BF,EAAY3H,uBAAuB7kB,GACnE,OAA0B,OAAtB0sB,IAKFld,OAAOuJ,aAAarE,QAAQmX,GAAiBrc,OAAOoV,SAASlsB,YACvD8zB,EAAYhI,MAChB,CACExkB,YACA6Z,OAAQ,OACR8L,WAAY+G,EAAkB95B,OAC9B8L,YAAaguB,EAAkBhuB,YAC/BT,SAAUyuB,EAAkB1H,YAC5B/hB,aAAcypB,EAAkBhD,gBAChCzD,UAAWyG,EAAkBzG,WAAa,QAE5CwG,EAAQtiB,SAEH,EAGX,CAuOoDwiB,CAC1CzC,EACA9oC,KAAK2qC,qBACL3qC,MAOA,OAAO,IAAIic,QAAQ,OAEtB,CACF,CAED,OADAjc,KAAK4qC,wBAAyB,EACvBjH,GAGD,cAAAsH,CACNtH,GAEA3jC,KAAK4sB,KAAKjN,WAAagkB,EAAYhkB,WACnC3f,KAAK4sB,KAAKxP,MAAQumB,EAAYvmB,MAC9Bpd,KAAK4sB,KAAKhO,UAAY+kB,EAAY/kB,UAClC5e,KAAK4sB,KAAKgX,YAAcD,EAAYC,YACpC5jC,KAAK4sB,KAAKuX,eAAiBR,EAAYQ,eACvCnkC,KAAK+oB,OAAOZ,GAAGlN,GAAOQ,iBAAmB6J,IACvCtlB,KAAK4sB,KAAKuX,eAAiBpzB,KAAKuB,MAAoB,IAAZgT,GAE3C,ECzVH,IAAIkmB,YAYYC,KAId,YAH8B,IAAnBD,KACTA,GAAiB,IAAId,IAEhBc,EACT,2HAmEE,OAAOC,KAAoB1iB,MAC7B,UAzDgB,YACXnJ,GAGH,OADgB6rB,KACD9yB,SAASiH,EAC1B,kDAsCgB,YACXA,GAGH,OADgB6rB,KACD1H,0BAA0BnkB,EAC3C,UAlCgB,YACXA,GAGH,OADgB6rB,KACDrI,SAASxjB,EAC1B,WAWgB,YACXA,GAGH,OADgB6rB,KACDjpB,UAAU5C,EAC3B","x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,27,28,29]}
1
+ {"version":3,"file":"solid-client-authn.bundle.js","sources":["../../../node_modules/jose/dist/webapi/lib/buffer_utils.js","../../../node_modules/jose/dist/webapi/util/errors.js","../../../node_modules/jose/dist/webapi/util/base64url.js","../../../node_modules/jose/dist/webapi/lib/validate.js","../../../node_modules/jose/dist/webapi/lib/key.js","../../../node_modules/jose/dist/webapi/lib/key_descriptor.js","../../../node_modules/jose/dist/webapi/lib/jwe_algorithms.js","../../../node_modules/jose/dist/webapi/lib/jws_algorithms.js","../../../node_modules/jose/dist/webapi/lib/jws_verify.js","../../../node_modules/jose/dist/webapi/lib/jwt_claims_set.js","../../../node_modules/jose/dist/webapi/jwt/verify.js","../../../node_modules/jose/dist/webapi/lib/jws_sign.js","../../../node_modules/jose/dist/webapi/jwt/sign.js","../../../node_modules/jose/dist/webapi/lib/key_algorithm.js","../../../node_modules/jose/dist/webapi/key/export.js","../../../node_modules/jose/dist/webapi/jwks/local.js","../../../node_modules/jose/dist/webapi/jwks/remote.js","../../../node_modules/jose/dist/webapi/key/generate_key_pair.js","../../../node_modules/@inrupt/solid-client-authn-core/node_modules/uuid/dist/stringify.js","../../../node_modules/@inrupt/solid-client-authn-core/node_modules/uuid/dist/rng.js","../../../node_modules/@inrupt/solid-client-authn-core/node_modules/uuid/dist/v4.js","../../../node_modules/@inrupt/solid-client-authn-core/dist/index.mjs","../node_modules/uuid/dist/stringify.js","../node_modules/uuid/dist/rng.js","../node_modules/uuid/dist/v4.js","../../../node_modules/events/events.js","../src/storage/StorageUtility.ts","../../../node_modules/jwt-decode/build/esm/index.js","../../../node_modules/oidc-client-ts/dist/esm/oidc-client-ts.js","../../../node_modules/@inrupt/oidc-client-ext/dist/index.es.js","../src/ClientAuthentication.ts","../src/login/oidc/OidcLoginHandler.ts","../src/login/oidc/oidcHandlers/AuthorizationCodeWithPkceOidcHandler.ts","../src/login/oidc/IssuerConfigFetcher.ts","../src/sessionInfo/SessionInfoManager.ts","../src/login/oidc/incomingRedirectHandler/FallbackRedirectHandler.ts","../src/login/oidc/incomingRedirectHandler/AuthCodeRedirectHandler.ts","../src/login/oidc/AggregateRedirectHandler.ts","../src/storage/BrowserStorage.ts","../src/login/oidc/Redirector.ts","../src/login/oidc/ClientRegistrar.ts","../src/login/oidc/incomingRedirectHandler/ErrorOidcHandler.ts","../src/login/oidc/refresh/TokenRefresher.ts","../src/dependencies.ts","../src/constant.ts","../src/Session.ts","../src/defaultSession.ts"],"sourcesContent":["const encoder = new TextEncoder(), decoder = new TextDecoder(), strictDecoder = new TextDecoder(\"utf-8\", { fatal: !0 }), UINT32_RANGE = 2 ** 32;\nfunction concat(...buffers) {\n const size = buffers.reduce((acc, { length }) => acc + length, 0), buf = new Uint8Array(size);\n let i = 0;\n for (const buffer of buffers)\n buf.set(buffer, i), i += buffer.length;\n return buf;\n}\nfunction writeUInt32BE(buf, value, offset) {\n if (value < 0 || value >= UINT32_RANGE)\n throw new RangeError(`value must be >= 0 and <= ${UINT32_RANGE - 1}. Received ${value}`);\n buf.set([value >>> 24, value >>> 16, value >>> 8, value & 255], offset);\n}\nfunction uint64be(value) {\n const high = Math.floor(value / UINT32_RANGE), low = value % UINT32_RANGE, buf = new Uint8Array(8);\n return writeUInt32BE(buf, high, 0), writeUInt32BE(buf, low, 4), buf;\n}\nfunction uint32be(value) {\n const buf = new Uint8Array(4);\n return writeUInt32BE(buf, value), buf;\n}\nconst NON_ASCII = /[^\\x00-\\x7f]/;\nfunction encode(string) {\n if (typeof string == \"string\" && string.length >= 128) {\n if (NON_ASCII.test(string))\n throw new TypeError(\"non-ASCII string encountered in encode()\");\n return encoder.encode(string);\n }\n const bytes = new Uint8Array(string.length);\n for (let i = 0; i < string.length; i++) {\n const code = string.charCodeAt(i);\n if (code > 127)\n throw new TypeError(\"non-ASCII string encountered in encode()\");\n bytes[i] = code;\n }\n return bytes;\n}\nfunction encodeBase64(input, url = !1) {\n if (Uint8Array.prototype.toBase64)\n return input.toBase64({ alphabet: url ? \"base64url\" : \"base64\", omitPadding: url });\n const CHUNK_SIZE = 32768, arr = [];\n for (let i = 0; i < input.length; i += CHUNK_SIZE)\n arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n const encoded = btoa(arr.join(\"\"));\n return url ? encoded.replace(/=/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\") : encoded;\n}\nfunction decodeBase64(encoded, url = !1) {\n if (Uint8Array.fromBase64)\n return Uint8Array.fromBase64(encoded, { alphabet: url ? \"base64url\" : \"base64\" });\n if (url) {\n if (encoded.includes(\"+\") || encoded.includes(\"/\"))\n throw new TypeError(\"Invalid base64url\");\n encoded = encoded.replace(/-/g, \"+\").replace(/_/g, \"/\");\n }\n const binary = atob(encoded), bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++)\n bytes[i] = binary.charCodeAt(i);\n return bytes;\n}\nasync function digest(algorithm, data) {\n const subtleDigest = `SHA-${algorithm.slice(-3)}`;\n return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));\n}\nexport {\n concat,\n decodeBase64,\n decoder,\n digest,\n encode,\n encodeBase64,\n encoder,\n strictDecoder,\n uint32be,\n uint64be\n};\n","class JOSEError extends Error {\n static code = \"ERR_JOSE_GENERIC\";\n code = \"ERR_JOSE_GENERIC\";\n constructor(message, options) {\n super(message, options), this.name = this.constructor.name, Error.captureStackTrace?.(this, this.constructor);\n }\n}\nclass JWTClaimValidationFailed extends JOSEError {\n static code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n code = \"ERR_JWT_CLAIM_VALIDATION_FAILED\";\n claim;\n reason;\n payload;\n constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n }\n}\nclass JWTExpired extends JOSEError {\n static code = \"ERR_JWT_EXPIRED\";\n code = \"ERR_JWT_EXPIRED\";\n claim;\n reason;\n payload;\n constructor(message, payload, claim = \"unspecified\", reason = \"unspecified\") {\n super(message, { cause: { claim, reason, payload } }), this.claim = claim, this.reason = reason, this.payload = payload;\n }\n}\nclass JOSEAlgNotAllowed extends JOSEError {\n static code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n code = \"ERR_JOSE_ALG_NOT_ALLOWED\";\n}\nclass JOSENotSupported extends JOSEError {\n static code = \"ERR_JOSE_NOT_SUPPORTED\";\n code = \"ERR_JOSE_NOT_SUPPORTED\";\n}\nclass JWEDecryptionFailed extends JOSEError {\n static code = \"ERR_JWE_DECRYPTION_FAILED\";\n code = \"ERR_JWE_DECRYPTION_FAILED\";\n constructor(message = \"decryption operation failed\", options) {\n super(message, options);\n }\n}\nclass JWEInvalid extends JOSEError {\n static code = \"ERR_JWE_INVALID\";\n code = \"ERR_JWE_INVALID\";\n}\nclass JWSInvalid extends JOSEError {\n static code = \"ERR_JWS_INVALID\";\n code = \"ERR_JWS_INVALID\";\n}\nclass JWTInvalid extends JOSEError {\n static code = \"ERR_JWT_INVALID\";\n code = \"ERR_JWT_INVALID\";\n}\nclass JWKInvalid extends JOSEError {\n static code = \"ERR_JWK_INVALID\";\n code = \"ERR_JWK_INVALID\";\n}\nclass JWKSInvalid extends JOSEError {\n static code = \"ERR_JWKS_INVALID\";\n code = \"ERR_JWKS_INVALID\";\n}\nclass JWKSNoMatchingKey extends JOSEError {\n static code = \"ERR_JWKS_NO_MATCHING_KEY\";\n code = \"ERR_JWKS_NO_MATCHING_KEY\";\n constructor(message = \"no applicable key found in the JSON Web Key Set\", options) {\n super(message, options);\n }\n}\nclass JWKSMultipleMatchingKeys extends JOSEError {\n [Symbol.asyncIterator] = async function* () {\n };\n static code = \"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";\n code = \"ERR_JWKS_MULTIPLE_MATCHING_KEYS\";\n constructor(message = \"multiple matching keys found in the JSON Web Key Set\", options) {\n super(message, options);\n }\n}\nclass JWKSTimeout extends JOSEError {\n static code = \"ERR_JWKS_TIMEOUT\";\n code = \"ERR_JWKS_TIMEOUT\";\n constructor(message = \"request timed out\", options) {\n super(message, options);\n }\n}\nclass JWSSignatureVerificationFailed extends JOSEError {\n static code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n code = \"ERR_JWS_SIGNATURE_VERIFICATION_FAILED\";\n constructor(message = \"signature verification failed\", options) {\n super(message, options);\n }\n}\nexport {\n JOSEAlgNotAllowed,\n JOSEError,\n JOSENotSupported,\n JWEDecryptionFailed,\n JWEInvalid,\n JWKInvalid,\n JWKSInvalid,\n JWKSMultipleMatchingKeys,\n JWKSNoMatchingKey,\n JWKSTimeout,\n JWSInvalid,\n JWSSignatureVerificationFailed,\n JWTClaimValidationFailed,\n JWTExpired,\n JWTInvalid\n};\n","import { encoder, decoder, encodeBase64, decodeBase64 } from \"../lib/buffer_utils.js\";\nconst invalid = \"The input to be decoded is not correctly encoded.\";\nfunction decode(input) {\n try {\n return decodeBase64(typeof input == \"string\" ? input : decoder.decode(input), !0);\n } catch (cause) {\n throw new TypeError(invalid, { cause });\n }\n}\nfunction encode(input) {\n return encodeBase64(typeof input == \"string\" ? encoder.encode(input) : input, !0);\n}\nexport {\n decode,\n encode\n};\n","import { JOSENotSupported, JWSInvalid } from \"../util/errors.js\";\nimport { decode } from \"../util/base64url.js\";\nimport { encode, strictDecoder } from \"./buffer_utils.js\";\nfunction assertUint8Array(input, label) {\n if (!(input instanceof Uint8Array))\n throw new TypeError(`${label} must be an instance of Uint8Array`);\n}\nfunction isObject(input) {\n if (typeof input != \"object\" || input === null || Object.prototype.toString.call(input) !== \"[object Object]\")\n return !1;\n const prototype = Object.getPrototypeOf(input);\n return prototype === null || Object.getPrototypeOf(prototype) === null;\n}\nfunction isJwkSet(input) {\n return isObject(input) && Array.isArray(input.keys) && Array.from(input.keys).every(isObject);\n}\nfunction isDisjoint(...headers) {\n const parameters = /* @__PURE__ */ new Set();\n for (const header of headers)\n if (header)\n for (const parameter of Object.keys(header)) {\n if (parameters.has(parameter))\n return !1;\n parameters.add(parameter);\n }\n return !0;\n}\nfunction assertNotSet(value, name) {\n if (value !== void 0)\n throw new TypeError(`${name} can only be called once`);\n}\nfunction decodeBase64url(value, label, ErrorClass) {\n try {\n return decode(value);\n } catch (cause) {\n throw new ErrorClass(`Failed to base64url decode the ${label}`, { cause });\n }\n}\nfunction encodeAsciiMember(value, label, ErrorClass) {\n try {\n return encode(value);\n } catch (cause) {\n throw new ErrorClass(`The ${label} is not a valid base64url string`, { cause });\n }\n}\nfunction parseJoseHeader(encodedProtectedHeader, ErrorClass, message) {\n let parsed;\n try {\n parsed = JSON.parse(strictDecoder.decode(decode(encodedProtectedHeader)));\n } catch (cause) {\n throw new ErrorClass(message, { cause });\n }\n if (!isObject(parsed))\n throw new ErrorClass(message);\n return parsed;\n}\nconst JWS_RECOGNIZED = { __proto__: null, b64: !0 }, JWE_RECOGNIZED = { __proto__: null };\nfunction validateAlgorithms(option, algorithms) {\n if (algorithms !== void 0 && (!Array.isArray(algorithms) || algorithms.some((s) => typeof s != \"string\")))\n throw new TypeError(`\"${option}\" option must be an array of strings`);\n return algorithms === void 0 ? void 0 : new Set(algorithms);\n}\nfunction validateCritDuplicates(Err, protectedHeader) {\n const { crit } = protectedHeader ?? {};\n if (Array.isArray(crit) && new Set(crit).size !== crit.length)\n throw new Err('\"crit\" (Critical) Header Parameter MUST NOT contain duplicate values');\n}\nfunction validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {\n if (joseHeader.crit !== void 0 && protectedHeader?.crit === void 0)\n throw new Err('\"crit\" (Critical) Header Parameter MUST be integrity protected');\n if (!protectedHeader || protectedHeader.crit === void 0)\n return [];\n if (!Array.isArray(protectedHeader.crit) || protectedHeader.crit.length === 0 || protectedHeader.crit.some((input) => typeof input != \"string\" || input.length === 0))\n throw new Err('\"crit\" (Critical) Header Parameter MUST be an array of non-empty strings when present');\n const recognized = recognizedOption === void 0 ? recognizedDefault : { __proto__: null, ...recognizedOption, ...recognizedDefault };\n for (const parameter of protectedHeader.crit) {\n if (!(parameter in recognized))\n throw new JOSENotSupported(`Extension Header Parameter \"${parameter}\" is not recognized`);\n if (!Object.hasOwn(joseHeader, parameter) || joseHeader[parameter] === void 0)\n throw new Err(`Extension Header Parameter \"${parameter}\" is missing`);\n if (recognized[parameter] && (!Object.hasOwn(protectedHeader, parameter) || protectedHeader[parameter] === void 0))\n throw new Err(`Extension Header Parameter \"${parameter}\" MUST be integrity protected`);\n }\n return protectedHeader.crit;\n}\nfunction validateB64(protectedHeader, extensions) {\n if (extensions.includes(\"b64\")) {\n const b64 = protectedHeader.b64;\n if (typeof b64 != \"boolean\")\n throw new JWSInvalid('The \"b64\" (base64url-encode payload) Header Parameter must be a boolean');\n return b64;\n }\n return !0;\n}\nfunction serializeJoseHeader(Err, header) {\n let serialized, parsed;\n try {\n serialized = JSON.stringify(header), parsed = JSON.parse(serialized);\n } catch (cause) {\n throw new Err(\"JOSE Header is not valid JSON\", { cause });\n }\n if (!isObject(parsed))\n throw new Err(\"JOSE Header is not a JSON object\");\n return [parsed, serialized];\n}\nexport {\n JWE_RECOGNIZED,\n JWS_RECOGNIZED,\n assertNotSet,\n assertUint8Array,\n decodeBase64url,\n encodeAsciiMember,\n isDisjoint,\n isJwkSet,\n isObject,\n parseJoseHeader,\n serializeJoseHeader,\n validateAlgorithms,\n validateB64,\n validateCrit,\n validateCritDuplicates\n};\n","import { isObject } from \"./validate.js\";\nimport { decode } from \"../util/base64url.js\";\nimport { JOSENotSupported } from \"../util/errors.js\";\nconst tag = (key) => key[Symbol.toStringTag], jwkMatchesOp = (entry, key, usage) => {\n const { alg } = entry;\n if (key.use !== void 0) {\n const expected = usage === \"sign\" || usage === \"verify\" ? \"sig\" : \"enc\";\n if (key.use !== expected)\n throw new TypeError(`Invalid key for this operation, its \"use\" must be \"${expected}\" when present`);\n }\n if (key.alg !== void 0 && key.alg !== alg)\n throw new TypeError(`Invalid key for this operation, its \"alg\" must be \"${alg}\" when present`);\n if (Array.isArray(key.key_ops)) {\n const expectedKeyOp = usage === \"encrypt\" || usage === \"decrypt\" ? entry.ops?.[usage === \"encrypt\" ? 0 : 1] : usage;\n if (expectedKeyOp && !key.key_ops.includes(expectedKeyOp))\n throw new TypeError(`Invalid key for this operation, its \"key_ops\" must include \"${expectedKeyOp}\" when present`);\n }\n};\nasync function prepareKey(entry, key, usage) {\n const { alg, secret } = entry, requiresPrivateKey = usage === \"decrypt\" || usage === \"sign\";\n if (secret && key instanceof Uint8Array)\n return key;\n let normalized, keyObject;\n if (isObject(key)) {\n if (normalized = normalizeJwk(key), typeof normalized.kty != \"string\")\n throw invalidKeyType(alg, key, secret);\n if (!(secret ? normalized.kty === \"oct\" && typeof normalized.k == \"string\" : normalized.kty !== \"oct\" && (requiresPrivateKey ? normalized.kty === \"AKP\" && typeof normalized.priv == \"string\" || typeof normalized.d == \"string\" : normalized.d === void 0 && normalized.priv === void 0)))\n throw new TypeError(secret ? 'JSON Web Key for symmetric algorithms must have JWK \"kty\" (Key Type) equal to \"oct\" and the JWK \"k\" (Key Value) present' : `JSON Web Key for this operation must be a ${requiresPrivateKey ? \"private\" : \"public\"} JWK`);\n if (jwkMatchesOp(entry, normalized, usage), normalized.kty === \"oct\")\n return decode(normalized.k);\n if (!Object.isFrozen(key)) {\n const { key_ops } = key;\n Array.isArray(key_ops) && Object.freeze(key_ops), Object.freeze(key);\n }\n } else {\n if (!isKeyLike(key))\n throw invalidKeyType(alg, key, secret);\n const expectedType = secret ? \"secret\" : requiresPrivateKey ? \"private\" : \"public\";\n if (key.type !== expectedType && (secret || [\"secret\", \"public\", \"private\"].includes(key.type)))\n throw new TypeError(`${tag(key)} instances must be of type \"${expectedType}\" for the ${alg} algorithm`);\n if (isCryptoKey(key))\n return key;\n if (keyObject = key, keyObject.type === \"secret\")\n return keyObject.export();\n }\n cache ||= /* @__PURE__ */ new WeakMap();\n const cacheKey = key;\n let cached = cache.get(cacheKey);\n if (cached?.[alg])\n return cached[alg];\n if (cached || cache.set(cacheKey, cached = {}), keyObject && typeof keyObject.toCryptoKey == \"function\") {\n const isPublic = keyObject.type === \"public\", crv = nist[keyObject.asymmetricKeyDetails?.namedCurve], params = entry.resolve?.({ crv, asymmetricKeyType: keyObject.asymmetricKeyType }) ?? entry.subtle;\n return cached[alg] = keyObject.toCryptoKey(params, isPublic, entry.usages[isPublic ? 0 : 1]);\n }\n return normalized ??= keyObject.export({ format: \"jwk\" }), normalized.alg = alg, cached[alg] = await jwkToKey(entry, normalized);\n}\nlet cache;\nconst nist = {\n __proto__: null,\n prime256v1: \"P-256\",\n secp384r1: \"P-384\",\n secp521r1: \"P-521\"\n};\nfunction assertCryptoKey(key) {\n if (!isCryptoKey(key))\n throw new Error(\"CryptoKey instance expected\");\n}\nconst isCryptoKey = (key) => {\n if (key?.[Symbol.toStringTag] === \"CryptoKey\")\n return !0;\n try {\n return key instanceof CryptoKey;\n } catch {\n return !1;\n }\n}, isKeyObject = (key) => key?.[Symbol.toStringTag] === \"KeyObject\", isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);\nfunction message(msg, actual, ...types) {\n if (types.length > 2) {\n const last = types.pop();\n msg += `one of type ${types.join(\", \")}, or ${last}.`;\n } else types.length === 2 ? msg += `one of type ${types[0]} or ${types[1]}.` : msg += `of type ${types[0]}.`;\n return actual == null ? msg += ` Received ${actual}` : typeof actual == \"function\" && actual.name ? msg += ` Received function ${actual.name}` : typeof actual == \"object\" && actual != null && actual.constructor?.name && (msg += ` Received an instance of ${actual.constructor.name}`), msg;\n}\nconst invalidKeyInput = (actual, ...types) => message(\"Key must be \", actual, ...types);\nfunction invalidKeyType(alg, actual, secret) {\n const types = [\"CryptoKey\", \"KeyObject\", \"JSON Web Key\"];\n return secret && types.push(\"Uint8Array\"), new TypeError(message(`Key for the ${alg} algorithm must be `, actual, ...types));\n}\nconst unusable = (name, prop = \"algorithm.name\") => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);\nfunction checkUsage(key, usage) {\n if (usage && !key.usages.includes(usage))\n throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);\n}\nfunction checkModulusLength(alg, key) {\n const { modulusLength } = key.algorithm;\n if (typeof modulusLength != \"number\" || modulusLength < 2048)\n throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);\n}\nfunction checkCryptoKey(key, expected, usage) {\n const algorithm = key.algorithm;\n if (algorithm.name !== expected.name)\n throw unusable(expected.name);\n if (expected.hash && algorithm.hash?.name !== expected.hash)\n throw unusable(expected.hash, \"algorithm.hash\");\n if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve)\n throw unusable(expected.namedCurve, \"algorithm.namedCurve\");\n if (expected.length !== void 0 && algorithm.length !== expected.length)\n throw unusable(expected.length, \"algorithm.length\");\n checkUsage(key, usage);\n}\nfunction snapshotJwk(jwk) {\n return { __proto__: null, ...jwk };\n}\nfunction normalizeJwk(jwk) {\n const normalized = snapshotJwk(jwk);\n if (normalized.ext !== void 0 && typeof normalized.ext != \"boolean\")\n throw new TypeError('\"ext\" (Extractable) Parameter must be a boolean');\n if (normalized.key_ops !== void 0) {\n const value = normalized.key_ops, keyOps = Array.isArray(value) ? [...value] : void 0;\n if (!keyOps || keyOps.some((operation) => typeof operation != \"string\") || new Set(keyOps).size !== keyOps.length)\n throw new TypeError('\"key_ops\" (Key Operations) Parameter must be an array of unique strings');\n normalized.key_ops = keyOps;\n }\n return normalized;\n}\nfunction validateExtractableOption(extractable) {\n if (extractable !== void 0 && typeof extractable != \"boolean\")\n throw new TypeError('\"extractable\" option must be a boolean');\n return extractable;\n}\nasync function jwkToKey(entry, jwk, extractable) {\n if (!entry.kty.includes(jwk.kty))\n throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n const algorithm = entry.resolve?.({ kty: jwk.kty, crv: jwk.crv }) ?? entry.subtle, isPrivate = !!(jwk.d || jwk.priv), keyData = { ...jwk, ext: extractable ?? jwk.ext };\n return keyData.kty !== \"AKP\" && delete keyData.alg, delete keyData.use, crypto.subtle.importKey(\"jwk\", keyData, algorithm, keyData.ext ?? !isPrivate, jwk.key_ops ?? entry.usages[isPrivate ? 1 : 0]);\n}\nasync function rawKey(key, expected, usage, extractable = !1) {\n return key instanceof Uint8Array && (key = await crypto.subtle.importKey(\"raw\", key, expected, extractable, [usage])), checkCryptoKey(key, expected, usage), key;\n}\nexport {\n assertCryptoKey,\n checkCryptoKey,\n checkModulusLength,\n checkUsage,\n invalidKeyInput,\n isCryptoKey,\n isKeyLike,\n isKeyObject,\n jwkToKey,\n normalizeJwk,\n prepareKey,\n rawKey,\n snapshotJwk,\n validateExtractableOption\n};\n","function table(entries) {\n const out = { __proto__: null };\n for (const alg in entries)\n out[alg] = { ...entries[alg], alg };\n return out;\n}\nexport {\n table\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { table } from \"./key_descriptor.js\";\nconst wrap = [\n [\"encrypt\", \"wrapKey\"],\n [\"decrypt\", \"unwrapKey\"]\n], derive = [[], [\"deriveBits\"]], none = [[], []];\nfunction rsaes(bits) {\n return {\n kty: [\"RSA\"],\n mode: \"key-encryption\",\n subtle: { name: \"RSA-OAEP\", hash: `SHA-${bits}` },\n usages: wrap,\n ops: [\"wrapKey\", \"unwrapKey\"]\n };\n}\nfunction ecdh(mode) {\n return {\n kty: [\"EC\", \"OKP\"],\n mode,\n subtle: { name: \"ECDH\" },\n resolve: ({ kty, crv, asymmetricKeyType }) => {\n if (crv === \"X25519\" || asymmetricKeyType === \"x25519\")\n return { name: \"X25519\" };\n if (kty === \"OKP\")\n throw new JOSENotSupported('Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value');\n return { name: \"ECDH\", namedCurve: crv };\n },\n usages: derive,\n ops: [void 0, \"deriveBits\"]\n };\n}\nfunction aeskw(bits, gcm = !1) {\n return {\n kty: [\"oct\"],\n mode: \"key-wrapping\",\n secret: !0,\n subtle: { name: gcm ? \"AES-GCM\" : \"AES-KW\", length: bits },\n usages: none,\n ops: gcm ? [\"encrypt\", \"decrypt\"] : [\"wrapKey\", \"unwrapKey\"]\n };\n}\nfunction pbes2() {\n return {\n kty: [\"oct\"],\n mode: \"key-wrapping\",\n secret: !0,\n subtle: { name: \"PBKDF2\" },\n usages: none,\n ops: [\"deriveBits\", \"deriveBits\"]\n };\n}\nconst JWE = table({\n dir: {\n kty: [\"oct\"],\n mode: \"direct-encryption\",\n secret: !0,\n subtle: { name: \"AES-GCM\" },\n usages: none,\n ops: [\"encrypt\", \"decrypt\"]\n },\n \"RSA-OAEP\": rsaes(1),\n \"RSA-OAEP-256\": rsaes(256),\n \"RSA-OAEP-384\": rsaes(384),\n \"RSA-OAEP-512\": rsaes(512),\n \"ECDH-ES\": ecdh(\"direct-key-agreement\"),\n \"ECDH-ES+A128KW\": ecdh(\"key-agreement-with-key-wrapping\"),\n \"ECDH-ES+A192KW\": ecdh(\"key-agreement-with-key-wrapping\"),\n \"ECDH-ES+A256KW\": ecdh(\"key-agreement-with-key-wrapping\"),\n A128KW: aeskw(128),\n A192KW: aeskw(192),\n A256KW: aeskw(256),\n A128GCMKW: aeskw(128, !0),\n A192GCMKW: aeskw(192, !0),\n A256GCMKW: aeskw(256, !0),\n \"PBES2-HS256+A128KW\": pbes2(),\n \"PBES2-HS384+A192KW\": pbes2(),\n \"PBES2-HS512+A256KW\": pbes2()\n}), contentOps = [\"encrypt\", \"decrypt\"];\nfunction contentEncryption(bits, cbc = !1) {\n return {\n kty: [\"oct\"],\n secret: !0,\n subtle: { name: cbc ? \"AES-CBC\" : \"AES-GCM\", length: bits },\n usages: none,\n ops: contentOps,\n cekBits: bits,\n ivBits: cbc ? 128 : 96,\n cbc\n };\n}\nconst ENC = table({\n A128GCM: contentEncryption(128),\n A192GCM: contentEncryption(192),\n A256GCM: contentEncryption(256),\n \"A128CBC-HS256\": contentEncryption(256, !0),\n \"A192CBC-HS384\": contentEncryption(384, !0),\n \"A256CBC-HS512\": contentEncryption(512, !0)\n});\nfunction unsupported(parameter, name) {\n throw new JOSENotSupported(`Invalid or unsupported \"${parameter}\" (JWE ${name}) header value`);\n}\nfunction jweAlgorithm(alg) {\n return (typeof alg == \"string\" ? JWE[alg] : void 0) ?? unsupported(\"alg\", \"Algorithm\");\n}\nfunction isJWECEKTransport(algorithm) {\n return algorithm.mode === \"key-wrapping\" || algorithm.mode === \"key-encryption\" || algorithm.mode === \"key-agreement-with-key-wrapping\";\n}\nfunction jweEncryption(enc) {\n return (typeof enc == \"string\" ? ENC[enc] : void 0) ?? unsupported(\"enc\", \"Encryption Algorithm\");\n}\nexport {\n JWE,\n isJWECEKTransport,\n jweAlgorithm,\n jweEncryption\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { table } from \"./key_descriptor.js\";\nconst sig = [[\"verify\"], [\"sign\"]];\nfunction hmac(bits) {\n const subtle = { name: \"HMAC\", hash: `SHA-${bits}` };\n return { kty: [\"oct\"], secret: !0, subtle, signing: subtle, usages: sig };\n}\nfunction rsa(bits, saltLength) {\n const subtle = { name: saltLength ? \"RSA-PSS\" : \"RSASSA-PKCS1-v1_5\", hash: `SHA-${bits}` };\n return {\n kty: [\"RSA\"],\n subtle,\n signing: saltLength ? { ...subtle, saltLength } : subtle,\n usages: sig,\n minRsaBits: 2048\n };\n}\nfunction ecdsa(crv, bits) {\n return {\n kty: [\"EC\"],\n crv,\n subtle: { name: \"ECDSA\", namedCurve: crv },\n signing: { name: \"ECDSA\", hash: `SHA-${bits}` },\n usages: sig\n };\n}\nfunction eddsa() {\n const subtle = { name: \"Ed25519\" };\n return {\n kty: [\"OKP\"],\n crv: \"Ed25519\",\n subtle,\n signing: subtle,\n usages: sig\n };\n}\nfunction mldsa(parameterSet) {\n const subtle = { name: `ML-DSA-${parameterSet}` };\n return {\n kty: [\"AKP\"],\n subtle,\n signing: subtle,\n usages: sig\n };\n}\nconst JWS = table({\n HS256: hmac(256),\n HS384: hmac(384),\n HS512: hmac(512),\n RS256: rsa(256),\n RS384: rsa(384),\n RS512: rsa(512),\n PS256: rsa(256, 32),\n PS384: rsa(384, 48),\n PS512: rsa(512, 64),\n ES256: ecdsa(\"P-256\", 256),\n ES384: ecdsa(\"P-384\", 384),\n ES512: ecdsa(\"P-521\", 512),\n EdDSA: eddsa(),\n Ed25519: eddsa(),\n \"ML-DSA-44\": mldsa(44),\n \"ML-DSA-65\": mldsa(65),\n \"ML-DSA-87\": mldsa(87)\n});\nfunction jwsAlgorithm(alg) {\n const entry = typeof alg == \"string\" ? JWS[alg] : void 0;\n if (!entry)\n throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);\n return entry;\n}\nexport {\n JWS,\n jwsAlgorithm\n};\n","import { jwsAlgorithm } from \"./jws_algorithms.js\";\nimport { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from \"../util/errors.js\";\nimport { concat, decoder, encoder, encode } from \"./buffer_utils.js\";\nimport { decodeBase64url, encodeAsciiMember, parseJoseHeader, isDisjoint, isObject, validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from \"./validate.js\";\nimport { prepareKey, rawKey, checkModulusLength } from \"./key.js\";\nfunction snapshotJws(jws, sharedPayload) {\n const encodedProtectedHeader = jws.protected, inputHeader = jws.header, header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;\n let payload = sharedPayload ? sharedPayload[0] : jws.payload;\n !sharedPayload && payload instanceof Uint8Array && (payload = new Uint8Array(payload));\n const signature = jws.signature, snapshot = { payload, signature };\n if (encodedProtectedHeader !== void 0 && (snapshot.protected = encodedProtectedHeader), inputHeader !== void 0 && (snapshot.header = header), encodedProtectedHeader === void 0 && header === void 0)\n throw new JWSInvalid('Flattened JWS must have either of the \"protected\" or \"header\" members');\n if (encodedProtectedHeader !== void 0 && typeof encodedProtectedHeader != \"string\")\n throw new JWSInvalid(\"JWS Protected Header incorrect type\");\n if (payload === void 0)\n throw new JWSInvalid(\"JWS Payload missing\");\n if (typeof signature != \"string\")\n throw new JWSInvalid(\"JWS Signature missing or incorrect type\");\n if (header !== void 0 && !isObject(header))\n throw new JWSInvalid(\"JWS Unprotected Header incorrect type\");\n return snapshot;\n}\nfunction prepareVerify(options) {\n return [options && validateAlgorithms(\"algorithms\", options.algorithms), options?.crit];\n}\nfunction parseProtectedHeader(encodedProtectedHeader) {\n return encodedProtectedHeader === void 0 ? {} : parseJoseHeader(encodedProtectedHeader, JWSInvalid, \"JWS Protected Header is invalid\");\n}\nfunction encodeJsonUnencodedPayload(payload) {\n const invalid = /[\\p{Cs}\\p{Cn}]/u.exec(payload)?.[0];\n if (invalid !== void 0)\n throw new JWSInvalid(/\\p{Cs}/u.test(invalid) ? \"JWS Payload must be a well-formed Unicode string\" : \"JWS Payload must not contain unassigned Unicode code points\");\n return encoder.encode(payload);\n}\nfunction encodeCompactUnencodedPayload(payload) {\n try {\n return encode(payload);\n } catch (cause) {\n throw new JWSInvalid(\"JWS Compact Serialization payload must use only ASCII characters\", {\n cause\n });\n }\n}\nasync function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {\n const { protected: encodedProtectedHeader, header, payload: inputPayload } = jws, protectedHeader = parsedProtected ?? parseProtectedHeader(encodedProtectedHeader);\n if (!isDisjoint(protectedHeader, header))\n throw new JWSInvalid(\"JWS Protected and JWS Unprotected Header Parameter names must be disjoint\");\n const joseHeader = { ...protectedHeader, ...header }, b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], protectedHeader, joseHeader)), { alg } = joseHeader;\n if (typeof alg != \"string\" || !alg)\n throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n if (shared[0] && !shared[0].has(alg))\n throw new JOSEAlgNotAllowed('\"alg\" (Algorithm) Header Parameter value not allowed');\n if (b64) {\n if (typeof inputPayload != \"string\")\n throw new JWSInvalid(\"JWS Payload must be a string\");\n } else if (typeof inputPayload != \"string\" && !(inputPayload instanceof Uint8Array))\n throw new JWSInvalid(\"JWS Payload must be a string or an Uint8Array instance\");\n const signingPayload = b64 || typeof inputPayload != \"string\" ? inputPayload : encodeUnencodedPayload(inputPayload);\n let resolvedKey = !1;\n typeof key == \"function\" && (key = await key(protectedHeader, jws), resolvedKey = !0);\n const entry = jwsAlgorithm(alg), signingInput = concat(encodedProtectedHeader !== void 0 ? encode(encodedProtectedHeader) : new Uint8Array(), encode(\".\"), typeof signingPayload == \"string\" ? shared[2] ??= encodeAsciiMember(signingPayload, \"payload\", JWSInvalid) : signingPayload), signature = decodeBase64url(jws.signature, \"signature\", JWSInvalid), verificationKey = await prepareKey(entry, key, \"verify\"), cryptoKey = await rawKey(verificationKey, entry.subtle, \"verify\");\n entry.minRsaBits && checkModulusLength(entry.alg, cryptoKey);\n let verified = !1;\n try {\n verified = await crypto.subtle.verify(entry.signing, cryptoKey, signature, signingInput);\n } catch (cause) {\n throw new JWSSignatureVerificationFailed(void 0, { cause });\n }\n if (!verified)\n throw new JWSSignatureVerificationFailed();\n const result = { payload: typeof signingPayload == \"string\" ? decodeBase64url(signingPayload, \"payload\", JWSInvalid) : signingPayload };\n return encodedProtectedHeader !== void 0 && (result.protectedHeader = protectedHeader), header !== void 0 && (result.unprotectedHeader = header), resolvedKey ? [{ ...result, key: verificationKey }, b64] : [result, b64];\n}\nasync function verifyCompact(jws, shared, key) {\n if (jws instanceof Uint8Array && (jws = decoder.decode(jws)), typeof jws != \"string\")\n throw new JWSInvalid(\"Compact JWS must be a string or Uint8Array\");\n const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split(\".\");\n if (length !== 3)\n throw new JWSInvalid(\"Invalid Compact JWS\");\n return verifySignature({ payload, protected: protectedHeader, signature }, shared, key, encodeCompactUnencodedPayload);\n}\nexport {\n encodeJsonUnencodedPayload,\n parseProtectedHeader,\n prepareVerify,\n snapshotJws,\n verifyCompact,\n verifySignature\n};\n","import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from \"../util/errors.js\";\nimport { encoder, strictDecoder } from \"./buffer_utils.js\";\nimport { isObject } from \"./validate.js\";\nconst epoch = (date) => Math.floor(date.getTime() / 1e3), multipliers = {\n s: 1,\n m: 60,\n h: 3600,\n d: 86400,\n w: 604800,\n y: 31557600\n}, REGEX = /^(\\+|\\-)? ?(\\d+|\\d+\\.\\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i, checkFailed = \"check_failed\";\nfunction invalidDuration() {\n throw new TypeError(\"Invalid time period format\");\n}\nfunction secs(str) {\n typeof str != \"string\" && invalidDuration();\n const matched = REGEX.exec(str);\n (!matched || matched[4] && matched[1]) && invalidDuration();\n const value = parseFloat(matched[2]), durationSeconds = Math.round(value * multipliers[matched[3][0].toLowerCase()]);\n return Number.isFinite(durationSeconds) || invalidDuration(), matched[1] === \"-\" || matched[4] === \"ago\" ? -durationSeconds : durationSeconds;\n}\nfunction validateInput(label, input) {\n if (!Number.isFinite(input))\n throw new TypeError(`Invalid ${label} input`);\n return input;\n}\nfunction validateStringClaim(claim, value) {\n if (typeof value != \"string\")\n throw new TypeError(`\"${claim}\" claim must be a string`);\n}\nfunction validateAudienceClaim(value) {\n if (typeof value != \"string\" && (!Array.isArray(value) || Array.from(value).some((member) => typeof member != \"string\")))\n throw new TypeError('\"aud\" claim must be a string or an array of strings');\n}\nfunction numericDate(value, label) {\n return typeof value == \"number\" ? validateInput(label, value) : value instanceof Date ? validateInput(label, epoch(value)) : epoch(/* @__PURE__ */ new Date()) + secs(value);\n}\nconst normalizeTyp = (value) => {\n const normalized = value.toLowerCase();\n return value.includes(\"/\") ? normalized : `application/${normalized}`;\n}, checkAudiencePresence = (audPayload, audOption) => typeof audPayload == \"string\" ? audOption.includes(audPayload) : Array.isArray(audPayload) ? audOption.some((aud) => audPayload.includes(aud)) : !1;\nfunction validateNumericDate(claimsSet, claim, required = !1) {\n const value = claimsSet[claim];\n if (!(value === void 0 && !required)) {\n if (typeof value != \"number\")\n throw new JWTClaimValidationFailed(`\"${claim}\" claim must be a number`, claimsSet, claim, \"invalid\");\n return value;\n }\n}\nfunction unexpectedClaim(claimsSet, claim) {\n throw new JWTClaimValidationFailed(`unexpected \"${claim}\" claim value`, claimsSet, claim, checkFailed);\n}\nfunction validateClaimsSet(protectedHeader, claimsSetBytes, options = {}) {\n let claimsSet;\n try {\n claimsSet = JSON.parse(strictDecoder.decode(claimsSetBytes));\n } catch (cause) {\n throw new JWTInvalid(\"JWT Claims Set must be a top-level JSON object\", { cause });\n }\n if (!isObject(claimsSet))\n throw new JWTInvalid(\"JWT Claims Set must be a top-level JSON object\");\n const { typ } = options;\n if (typ !== void 0 && (typeof protectedHeader.typ != \"string\" || normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ)))\n throw new JWTClaimValidationFailed('unexpected \"typ\" JWT header value', claimsSet, \"typ\", checkFailed);\n const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options, presenceCheck = [...requiredClaims];\n maxTokenAge !== void 0 && presenceCheck.push(\"iat\"), audience !== void 0 && presenceCheck.push(\"aud\"), subject !== void 0 && presenceCheck.push(\"sub\"), issuer !== void 0 && presenceCheck.push(\"iss\");\n for (const claim of new Set(presenceCheck.reverse()))\n if (!Object.hasOwn(claimsSet, claim))\n throw new JWTClaimValidationFailed(`missing required \"${claim}\" claim`, claimsSet, claim, \"missing\");\n issuer !== void 0 && !(Array.isArray(issuer) ? issuer : [issuer]).includes(claimsSet.iss) && unexpectedClaim(claimsSet, \"iss\"), subject !== void 0 && claimsSet.sub !== subject && unexpectedClaim(claimsSet, \"sub\"), audience !== void 0 && !checkAudiencePresence(claimsSet.aud, typeof audience == \"string\" ? [audience] : audience) && unexpectedClaim(claimsSet, \"aud\");\n const { clockTolerance } = options;\n let tolerance = 0;\n if (typeof clockTolerance == \"string\")\n tolerance = secs(clockTolerance);\n else if (clockTolerance !== void 0) {\n if (typeof clockTolerance != \"number\")\n throw new TypeError(\"Invalid clockTolerance option type\");\n tolerance = clockTolerance;\n }\n validateInput(\"clockTolerance option\", tolerance);\n const { currentDate } = options, now = validateInput(\"currentDate option\", epoch(currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate)), iat = validateNumericDate(claimsSet, \"iat\", maxTokenAge !== void 0), nbf = validateNumericDate(claimsSet, \"nbf\");\n if (nbf !== void 0 && nbf > now + tolerance)\n throw new JWTClaimValidationFailed('\"nbf\" claim timestamp check failed', claimsSet, \"nbf\", checkFailed);\n const exp = validateNumericDate(claimsSet, \"exp\");\n if (exp !== void 0 && exp <= now - tolerance)\n throw new JWTExpired('\"exp\" claim timestamp check failed', claimsSet, \"exp\", checkFailed);\n if (maxTokenAge !== void 0) {\n const age = now - iat, max = validateInput(\"maxTokenAge option\", typeof maxTokenAge == \"number\" ? maxTokenAge : secs(maxTokenAge));\n if (age - tolerance > max)\n throw new JWTExpired('\"iat\" claim timestamp check failed (too far in the past)', claimsSet, \"iat\", checkFailed);\n if (age < -tolerance)\n throw new JWTClaimValidationFailed('\"iat\" claim timestamp check failed (it should be in the past)', claimsSet, \"iat\", checkFailed);\n }\n return claimsSet;\n}\nlet producerClaimsSets;\nfunction producerClaimsSet(producer) {\n return producerClaimsSets.get(producer);\n}\nfunction jwtClaimsSetBytes(producer) {\n const claimsSet = producerClaimsSet(producer);\n for (const claim of [\"iat\", \"nbf\", \"exp\"]) {\n const value = claimsSet[claim];\n if (typeof value == \"number\" && !Number.isFinite(value))\n throw new TypeError(`\"${claim}\" claim must be a finite number`);\n }\n return encoder.encode(JSON.stringify(claimsSet));\n}\nfunction jwtClaim(producer, claim) {\n return producerClaimsSet(producer)[claim];\n}\nclass JWTClaimsBuilder {\n constructor(claimsSet = {}) {\n if (!isObject(claimsSet))\n throw new TypeError(\"JWT Claims Set MUST be an object\");\n (producerClaimsSets ||= /* @__PURE__ */ new WeakMap()).set(this, structuredClone(claimsSet));\n }\n setIssuer(value) {\n return validateStringClaim(\"iss\", value), producerClaimsSet(this).iss = value, this;\n }\n setSubject(value) {\n return validateStringClaim(\"sub\", value), producerClaimsSet(this).sub = value, this;\n }\n setAudience(value) {\n return validateAudienceClaim(value), producerClaimsSet(this).aud = value, this;\n }\n setJti(value) {\n return validateStringClaim(\"jti\", value), producerClaimsSet(this).jti = value, this;\n }\n setNotBefore(value) {\n return producerClaimsSet(this).nbf = numericDate(value, \"setNotBefore\"), this;\n }\n setExpirationTime(value) {\n return producerClaimsSet(this).exp = numericDate(value, \"setExpirationTime\"), this;\n }\n setIssuedAt(value) {\n const claimsSet = producerClaimsSet(this);\n return value === void 0 ? claimsSet.iat = epoch(/* @__PURE__ */ new Date()) : typeof value == \"string\" ? claimsSet.iat = validateInput(\"setIssuedAt\", epoch(/* @__PURE__ */ new Date()) + secs(value)) : claimsSet.iat = numericDate(value, \"setIssuedAt\"), this;\n }\n}\nexport {\n JWTClaimsBuilder,\n jwtClaim,\n jwtClaimsSetBytes,\n secs,\n validateClaimsSet\n};\n","import { prepareVerify, verifyCompact } from \"../lib/jws_verify.js\";\nimport { validateClaimsSet } from \"../lib/jwt_claims_set.js\";\nimport { JWTInvalid } from \"../util/errors.js\";\nasync function jwtVerify(jwt, key, options) {\n const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);\n if (!b64)\n throw new JWTInvalid(\"JWTs MUST NOT use unencoded payload\");\n const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);\n return { ...verified, payload };\n}\nexport {\n jwtVerify\n};\n","import { encode as b64u } from \"../util/base64url.js\";\nimport { jwsAlgorithm } from \"./jws_algorithms.js\";\nimport { isDisjoint, serializeJoseHeader, validateB64, validateCrit, validateCritDuplicates, JWS_RECOGNIZED } from \"./validate.js\";\nimport { JWSInvalid } from \"../util/errors.js\";\nimport { concat, encode, encoder } from \"./buffer_utils.js\";\nimport { prepareKey, rawKey, checkModulusLength } from \"./key.js\";\nasync function createSignature(input, key, rejectUnencoded) {\n let [payload, protectedHeader, unprotectedHeader, crit] = input, encodedProtectedHeader = \"\";\n if (protectedHeader !== void 0) {\n const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);\n protectedHeader = normalized[0], encodedProtectedHeader = b64u(normalized[1]);\n }\n if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader)\n throw new JWSInvalid(\"either setProtectedHeader or setUnprotectedHeader must be called before #sign()\");\n if (!isDisjoint(protectedHeader, unprotectedHeader))\n throw new JWSInvalid(\"JWS Protected and JWS Unprotected Header Parameter names must be disjoint\");\n const joseHeader = { ...protectedHeader, ...unprotectedHeader };\n validateCritDuplicates(JWSInvalid, protectedHeader);\n const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));\n b64 || rejectUnencoded?.();\n const { alg } = joseHeader;\n if (typeof alg != \"string\" || !alg)\n throw new JWSInvalid('JWS \"alg\" (Algorithm) Header Parameter missing or invalid');\n const entry = jwsAlgorithm(alg);\n let encodedPayload = \"\", signingPayload = payload, signingInput;\n if (b64) {\n const encodedPayloadCache = input[4];\n encodedPayloadCache ? (encodedPayload = encodedPayloadCache[0] ??= b64u(payload), signingPayload = encodedPayloadCache[1] ??= encode(encodedPayload)) : (encodedPayload = b64u(payload), signingInput = encoder.encode(`${encodedProtectedHeader}.${encodedPayload}`));\n }\n signingInput ??= concat(encode(encodedProtectedHeader), encode(\".\"), signingPayload);\n const signingKey = await rawKey(await prepareKey(entry, key, \"sign\"), entry.subtle, \"sign\");\n entry.minRsaBits && checkModulusLength(entry.alg, signingKey);\n const jws = {\n signature: b64u(new Uint8Array(await crypto.subtle.sign(entry.signing, signingKey, signingInput))),\n payload: encodedPayload\n };\n return protectedHeader && (jws.protected = encodedProtectedHeader), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];\n}\nasync function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {\n const [jws] = await createSignature([payload, protectedHeader, void 0, crit], key, rejectUnencoded);\n return `${jws.protected}.${jws.payload}.${jws.signature}`;\n}\nexport {\n createCompactSignature,\n createSignature\n};\n","import { createCompactSignature } from \"../lib/jws_sign.js\";\nimport { JWTInvalid } from \"../util/errors.js\";\nimport { JWTClaimsBuilder, jwtClaimsSetBytes } from \"../lib/jwt_claims_set.js\";\nimport { assertNotSet } from \"../lib/validate.js\";\nconst SignJWT_base = JWTClaimsBuilder;\nclass SignJWT extends SignJWT_base {\n #protectedHeader;\n setProtectedHeader(protectedHeader) {\n return assertNotSet(this.#protectedHeader, \"setProtectedHeader\"), this.#protectedHeader = protectedHeader, this;\n }\n async sign(key, options) {\n return createCompactSignature(jwtClaimsSetBytes(this), this.#protectedHeader, options?.crit, key, () => {\n throw new JWTInvalid(\"JWTs MUST NOT use unencoded payload\");\n });\n }\n}\nexport {\n SignJWT\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { JWS } from \"./jws_algorithms.js\";\nimport { JWE } from \"./jwe_algorithms.js\";\nconst algArgument = '\"alg\" (Algorithm)';\nfunction unsupportedAlg(source = 'JWK \"alg\" (Algorithm) Parameter') {\n throw new JOSENotSupported(`Invalid or unsupported ${source} value`);\n}\nfunction keyAlgorithm(alg, source) {\n return (typeof alg == \"string\" ? JWS[alg] ?? JWE[alg] : void 0) ?? unsupportedAlg(source);\n}\nexport {\n algArgument,\n keyAlgorithm,\n unsupportedAlg\n};\n","import { toSPKI as exportPublic, toPKCS8 as exportPrivate } from \"../lib/asn1.js\";\nimport { invalidKeyInput, isCryptoKey, isKeyObject } from \"../lib/key.js\";\nimport { encode as b64u } from \"../util/base64url.js\";\nfunction exportSPKI(key) {\n return exportPublic(key);\n}\nfunction exportPKCS8(key) {\n return exportPrivate(key);\n}\nasync function exportJWK(key) {\n if (isKeyObject(key))\n if (key.type === \"secret\")\n key = key.export();\n else\n return key.export({ format: \"jwk\" });\n if (key instanceof Uint8Array)\n return {\n kty: \"oct\",\n k: b64u(key)\n };\n if (!isCryptoKey(key))\n throw new TypeError(invalidKeyInput(key, \"CryptoKey\", \"KeyObject\", \"Uint8Array\"));\n if (!key.extractable)\n throw new TypeError(\"non-extractable CryptoKey cannot be exported as a JWK\");\n const jwk = await crypto.subtle.exportKey(\"jwk\", key);\n delete jwk.ext, delete jwk.key_ops, delete jwk.use, jwk.kty !== \"AKP\" && delete jwk.alg;\n for (const parameter of Object.keys(jwk))\n jwk[parameter] === void 0 && delete jwk[parameter];\n return jwk;\n}\nexport {\n exportJWK,\n exportPKCS8,\n exportSPKI\n};\n","import { jwkToKey, snapshotJwk } from \"../lib/key.js\";\nimport { JWS } from \"../lib/jws_algorithms.js\";\nimport { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys } from \"../util/errors.js\";\nimport { isJwkSet } from \"../lib/validate.js\";\nfunction isUsableJWK(jwk, entry, alg, kid) {\n const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;\n return (ext === void 0 || typeof ext == \"boolean\") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == \"string\" && keyOps.indexOf(operation) === index) && keyOps.includes(\"verify\")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == \"string\" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== \"AKP\" : alg === jwkAlg) && (use === void 0 || use === \"sig\") && (!entry.crv || crv === entry.crv);\n}\nasync function importWithAlgCache(cache, jwk, entry) {\n const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;\n if (cached[alg] === void 0) {\n const pending = jwkToKey(entry, jwk, !0).then((key) => {\n if (key.type !== \"public\")\n throw new JWKSInvalid(\"JSON Web Key Set members must be public keys\");\n return cached[alg] = key, key;\n }).catch((error) => {\n throw cached[alg] === pending && delete cached[alg], error;\n });\n cached[alg] = pending;\n }\n return cached[alg];\n}\nfunction createLocalJWKSet(jwks) {\n let snapshot;\n try {\n snapshot = structuredClone(jwks);\n } catch (cause) {\n throw new JWKSInvalid(\"JSON Web Key Set malformed\", { cause });\n }\n if (!isJwkSet(snapshot))\n throw new JWKSInvalid(\"JSON Web Key Set malformed\");\n const metadata = snapshot.keys.map((jwk) => {\n const normalized = snapshotJwk(jwk);\n return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;\n }), cached = /* @__PURE__ */ new WeakMap();\n return Object.defineProperty(async (protectedHeader, token) => {\n const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == \"string\" ? JWS[alg] : void 0;\n if (!entry || entry.secret)\n throw new JOSENotSupported('Unsupported \"alg\" value for a JSON Web Key Set');\n const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;\n if (!length)\n throw new JWKSNoMatchingKey();\n if (length !== 1) {\n const error = new JWKSMultipleMatchingKeys();\n throw error[Symbol.asyncIterator] = async function* () {\n for (const jwk2 of candidates)\n try {\n yield await importWithAlgCache(cached, jwk2, entry);\n } catch {\n }\n }, error;\n }\n return importWithAlgCache(cached, jwk, entry);\n }, \"jwks\", {\n value: () => structuredClone(snapshot)\n });\n}\nexport {\n createLocalJWKSet\n};\n","import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from \"../util/errors.js\";\nimport { createLocalJWKSet } from \"./local.js\";\nimport { isJwkSet } from \"../lib/validate.js\";\nfunction isCloudflareWorkers() {\n return typeof WebSocketPair < \"u\" || typeof navigator < \"u\" && navigator.userAgent === \"Cloudflare-Workers\" || typeof EdgeRuntime < \"u\" && EdgeRuntime === \"vercel\";\n}\nlet USER_AGENT;\n(typeof navigator > \"u\" || !navigator.userAgent?.startsWith?.(\"Mozilla/5.0 \")) && (USER_AGENT = \"jose/v6.2.13\");\nconst customFetch = /* @__PURE__ */ Symbol();\nasync function fetchJwks(url, headers, signal, fetchImpl = fetch) {\n const response = await fetchImpl(url, {\n method: \"GET\",\n signal,\n redirect: \"manual\",\n headers\n }).catch((err) => {\n throw err.name === \"TimeoutError\" ? new JWKSTimeout(void 0, { cause: err }) : err;\n });\n if (response.status !== 200)\n throw new JOSEError(\"Expected 200 OK from the JSON Web Key Set HTTP response\");\n try {\n return await response.json();\n } catch (cause) {\n throw new JOSEError(\"Failed to parse the JSON Web Key Set HTTP response as JSON\", { cause });\n }\n}\nconst jwksCache = /* @__PURE__ */ Symbol();\nfunction isFreshFor(timestamp, duration) {\n return Number.isFinite(timestamp) && Date.now() < timestamp + duration;\n}\nfunction validateDuration(value, fallback, option) {\n if (Number.isNaN(value))\n throw new TypeError(`\"${option}\" option must not be NaN`);\n return typeof value == \"number\" ? value : fallback;\n}\nfunction createRemoteJWKSet(url, options) {\n if (!(url instanceof URL))\n throw new TypeError(\"url must be an instance of URL\");\n const href = new URL(url.href).href, opts = options ?? {}, timeoutOption = opts.timeoutDuration;\n if (typeof timeoutOption == \"number\" && (!Number.isInteger(timeoutOption) || timeoutOption < 0))\n throw new TypeError('\"timeoutDuration\" option must be a non-negative integer');\n const timeoutDuration = typeof timeoutOption == \"number\" ? timeoutOption : 5e3, cooldownDuration = validateDuration(opts.cooldownDuration, 3e4, \"cooldownDuration\"), cacheMaxAge = validateDuration(opts.cacheMaxAge, 6e5, \"cacheMaxAge\"), headers = new Headers(opts.headers);\n USER_AGENT && !headers.has(\"User-Agent\") && headers.set(\"User-Agent\", USER_AGENT), headers.has(\"accept\") || headers.set(\"accept\", \"application/json, application/jwk-set+json\");\n const fetchImpl = opts[customFetch], cache = opts[jwksCache];\n let jwksTimestamp, pendingFetch, reloadSequence = 0, appliedSequence = 0, local;\n if (cache && typeof cache == \"object\") {\n const { uat, jwks } = cache;\n isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks) && (jwksTimestamp = uat, local = createLocalJWKSet(jwks));\n }\n const reload = async () => {\n if (pendingFetch && isCloudflareWorkers() && (pendingFetch = void 0), !pendingFetch) {\n const sequence = ++reloadSequence, current = pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl).then((json) => {\n const next = createLocalJWKSet(json);\n if (sequence <= appliedSequence)\n return;\n local = next;\n const updatedAt = Date.now();\n cache && (cache.uat = updatedAt, cache.jwks = json), jwksTimestamp = updatedAt, appliedSequence = sequence;\n }).finally(() => {\n pendingFetch === current && (pendingFetch = void 0);\n });\n }\n await pendingFetch;\n };\n return Object.defineProperties(async (protectedHeader, token) => {\n (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) && await reload();\n try {\n return await local(protectedHeader, token);\n } catch (err) {\n if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration))\n return await reload(), local(protectedHeader, token);\n throw err;\n }\n }, {\n coolingDown: {\n get: () => isFreshFor(jwksTimestamp, cooldownDuration),\n enumerable: !0\n },\n fresh: {\n get: () => isFreshFor(jwksTimestamp, cacheMaxAge),\n enumerable: !0\n },\n reload: {\n value: reload,\n enumerable: !0\n },\n reloading: {\n get: () => !!pendingFetch,\n enumerable: !0\n },\n jwks: {\n value: () => local?.jwks(),\n enumerable: !0\n }\n });\n}\nexport {\n createRemoteJWKSet,\n customFetch,\n jwksCache\n};\n","import { JOSENotSupported } from \"../util/errors.js\";\nimport { validateExtractableOption } from \"../lib/key.js\";\nimport { keyAlgorithm, unsupportedAlg, algArgument } from \"../lib/key_algorithm.js\";\nfunction getModulusLengthOption(options) {\n const modulusLength = options?.modulusLength ?? 2048;\n if (typeof modulusLength != \"number\" || !Number.isInteger(modulusLength) || modulusLength < 2048)\n throw new JOSENotSupported(\"Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used\");\n return modulusLength;\n}\nasync function generateKeyPair(alg, options) {\n const extractable = validateExtractableOption(options?.extractable), entry = keyAlgorithm(alg, algArgument);\n entry.secret && unsupportedAlg(algArgument);\n let algorithm;\n if (entry.resolve) {\n const crv = options?.crv ?? \"P-256\";\n if (![\"P-256\", \"P-384\", \"P-521\", \"X25519\"].includes(crv))\n throw new JOSENotSupported(\"Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519\");\n algorithm = entry.resolve({ crv });\n } else {\n if (entry.crv !== void 0 && options?.crv !== void 0 && options.crv !== entry.crv)\n throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);\n algorithm = entry.kty[0] === \"RSA\" ? {\n ...entry.subtle,\n publicExponent: Uint8Array.of(1, 0, 1),\n modulusLength: getModulusLengthOption(options)\n } : entry.subtle;\n }\n return crypto.subtle.generateKey(algorithm, extractable ?? !1, [\n ...entry.usages[1],\n ...entry.usages[0]\n ]);\n}\nexport {\n generateKeyPair\n};\n","import validate from './validate.js';\nconst byteToHex = [];\nfor (let i = 0; i < 256; ++i) {\n byteToHex.push((i + 0x100).toString(16).slice(1));\n}\nexport function unsafeStringify(arr, offset = 0) {\n return (byteToHex[arr[offset + 0]] +\n byteToHex[arr[offset + 1]] +\n byteToHex[arr[offset + 2]] +\n byteToHex[arr[offset + 3]] +\n '-' +\n byteToHex[arr[offset + 4]] +\n byteToHex[arr[offset + 5]] +\n '-' +\n byteToHex[arr[offset + 6]] +\n byteToHex[arr[offset + 7]] +\n '-' +\n byteToHex[arr[offset + 8]] +\n byteToHex[arr[offset + 9]] +\n '-' +\n byteToHex[arr[offset + 10]] +\n byteToHex[arr[offset + 11]] +\n byteToHex[arr[offset + 12]] +\n byteToHex[arr[offset + 13]] +\n byteToHex[arr[offset + 14]] +\n byteToHex[arr[offset + 15]]).toLowerCase();\n}\nfunction stringify(arr, offset = 0) {\n const uuid = unsafeStringify(arr, offset);\n if (!validate(uuid)) {\n throw TypeError('Stringified UUID is invalid');\n }\n return uuid;\n}\nexport default stringify;\n","const rnds8 = new Uint8Array(16);\nexport default function rng() {\n return crypto.getRandomValues(rnds8);\n}\n","import rng from './rng.js';\nimport { unsafeStringify } from './stringify.js';\nfunction v4(options, buf, offset) {\n if (!buf && !options && crypto.randomUUID) {\n return crypto.randomUUID();\n }\n return _v4(options, buf, offset);\n}\nfunction _v4(options, buf, offset) {\n options = options || {};\n const rnds = options.random ?? options.rng?.() ?? rng();\n if (rnds.length < 16) {\n throw new Error('Random bytes length must be >= 16');\n }\n rnds[6] = (rnds[6] & 0x0f) | 0x40;\n rnds[8] = (rnds[8] & 0x3f) | 0x80;\n if (buf) {\n offset = offset || 0;\n if (offset < 0 || offset + 16 > buf.length) {\n throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);\n }\n for (let i = 0; i < 16; ++i) {\n buf[offset + i] = rnds[i];\n }\n return buf;\n }\n return unsafeStringify(rnds);\n}\nexport default v4;\n","import { jwtVerify, createRemoteJWKSet, exportJWK, SignJWT, generateKeyPair } from 'jose';\nimport { v4 } from 'uuid';\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * Intended to be used by dependent packages as a common prefix for keys into\n * storage mechanisms (so as to group all keys related to Solid Client Authn\n * within those storage mechanisms, e.g., window.localStorage).\n */\nconst SOLID_CLIENT_AUTHN_KEY_PREFIX = \"solidClientAuthn:\";\n/**\n * Ordered list of signature algorithms, from most preferred to least preferred.\n */\nconst PREFERRED_SIGNING_ALG = [\"ES256\", \"RS256\"];\nconst EVENTS = {\n // Note that an `error` events MUST be listened to: https://nodejs.org/dist/latest-v16.x/docs/api/events.html#error-events.\n ERROR: \"error\",\n LOGIN: \"login\",\n LOGOUT: \"logout\",\n NEW_REFRESH_TOKEN: \"newRefreshToken\",\n NEW_TOKENS: \"newTokens\",\n AUTHORIZATION_REQUEST: \"authorizationRequest\",\n SESSION_EXPIRED: \"sessionExpired\",\n SESSION_EXTENDED: \"sessionExtended\",\n SESSION_RESTORED: \"sessionRestore\",\n TIMEOUT_SET: \"timeoutSet\",\n};\n/**\n * We want to refresh a token 5 seconds before it expires.\n */\nconst REFRESH_BEFORE_EXPIRATION_SECONDS = 5;\n// The openid scope requests an OIDC ID token token to be returned.\nconst SCOPE_OPENID = \"openid\";\n// The offline_access scope requests a refresh token to be returned.\nconst SCOPE_OFFLINE = \"offline_access\";\n// The webid scope is required as per https://solid.github.io/solid-oidc/#webid-scope\nconst SCOPE_WEBID = \"webid\";\nconst DEFAULT_SCOPES = [SCOPE_OPENID, SCOPE_OFFLINE, SCOPE_WEBID];\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n */\nclass AggregateHandler {\n handleables;\n constructor(handleables) {\n this.handleables = handleables;\n this.handleables = handleables;\n }\n /**\n * Helper function that will asynchronously determine the proper handler to use. If multiple\n * handlers can handle, it will choose the first one in the list\n * @param params Paramerters to feed to the handler\n */\n async getProperHandler(params) {\n // TODO : This function doesn't currently operate as described. Tests need to be written\n // return new Promise<IHandleable<P, R> | null>((resolve, reject) => {\n // const resolvedValues: Array<boolean | null> = Array(this.handleables.length).map(() => null)\n // let numberResolved = 0\n // this.handleables.forEach(async (handleable: IHandleable<P, R>, index: number) => {\n // resolvedValues[index] = await handleable.canHandle(...params)\n // numberResolved++\n // let curResolvedValueIndex = 0\n // while (\n // resolvedValues[curResolvedValueIndex] !== null ||\n // resolvedValues[curResolvedValueIndex] !== undefined\n // ) {\n // if (resolvedValues[curResolvedValueIndex]) {\n // resolve(this.handleables[curResolvedValueIndex])\n // }\n // curResolvedValueIndex++\n // }\n // })\n // })\n const canHandleList = await Promise.all(this.handleables.map((handleable) => handleable.canHandle(...params)));\n for (let i = 0; i < canHandleList.length; i += 1) {\n if (canHandleList[i]) {\n return this.handleables[i];\n }\n }\n return null;\n }\n async canHandle(...params) {\n return (await this.getProperHandler(params)) !== null;\n }\n async handle(...params) {\n const handler = await this.getProperHandler(params);\n if (handler) {\n return handler.handle(...params);\n }\n throw new Error(`[${this.constructor.name}] cannot find a suitable handler for: ${params\n .map((param) => {\n try {\n return JSON.stringify(param);\n }\n catch (_err) {\n /* eslint-disable @typescript-eslint/no-explicit-any */\n return param.toString();\n }\n })\n .join(\", \")}`);\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * Extract a WebID and the clientID from an ID token payload based on https://github.com/solid/webid-oidc-spec.\n * Note that this does not yet implement the user endpoint lookup, and only checks\n * for `webid`, `azp` or IRI-like `sub` claims.\n *\n * @param idToken the payload of the ID token from which the WebID can be extracted.\n * @returns an object with entries webId and clientId extracted from the ID token.\n * @internal\n */\nasync function getWebidFromTokenPayload(idToken, jwksIri, issuerIri, clientId) {\n let payload;\n let clientIdInPayload;\n try {\n const { payload: verifiedPayload } = await jwtVerify(idToken, createRemoteJWKSet(new URL(jwksIri)), {\n issuer: issuerIri,\n audience: clientId,\n });\n payload = verifiedPayload;\n }\n catch (e) {\n throw new Error(`Token verification failed: ${e.stack}`);\n }\n if (typeof payload.azp === \"string\") {\n clientIdInPayload = payload.azp;\n }\n if (typeof payload.webid === \"string\") {\n return {\n webId: payload.webid,\n clientId: clientIdInPayload,\n };\n }\n if (typeof payload.sub !== \"string\") {\n throw new Error(`The token ${JSON.stringify(payload)} is invalid: it has no 'webid' claim and no 'sub' claim.`);\n }\n try {\n // This parses the 'sub' claim to check if it is a well-formed IRI.\n // However, the normalized value isn't returned to make sure the WebID is returned\n // as specified by the Identity Provider.\n new URL(payload.sub);\n return {\n webId: payload.sub,\n clientId: clientIdInPayload,\n };\n }\n catch (e) {\n throw new Error(`The token has no 'webid' claim, and its 'sub' claim of [${payload.sub}] is invalid as a URL - error [${e}].`);\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nfunction normalizeScopes(scopes) {\n if (!Array.isArray(scopes)) {\n return DEFAULT_SCOPES;\n }\n return Array.from(\n // De-dupe potentia conflicts if any.\n new Set([\n ...DEFAULT_SCOPES,\n ...scopes.filter(\n // Remove user-provided scopes that are not strings or include spaces.\n (scope) => typeof scope === \"string\" && !scope.includes(\" \")),\n ]));\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nfunction isValidRedirectUrl(redirectUrl) {\n // If the redirect URL is not a valid URL, an error will be thrown.\n try {\n const urlObject = new URL(redirectUrl);\n const noReservedQuery = !urlObject.searchParams.has(\"code\") &&\n !urlObject.searchParams.has(\"state\");\n // As per https://tools.ietf.org/html/rfc6749#section-3.1.2, the redirect URL\n // must not include a hash fragment.\n const noHash = urlObject.hash === \"\";\n return noReservedQuery && noHash;\n }\n catch (_e) {\n return false;\n }\n}\nfunction removeOpenIdParams(redirectUrl) {\n const cleanedUpUrl = new URL(redirectUrl);\n // For auth code flow\n cleanedUpUrl.searchParams.delete(\"state\");\n cleanedUpUrl.searchParams.delete(\"code\");\n // For login error\n cleanedUpUrl.searchParams.delete(\"error\");\n cleanedUpUrl.searchParams.delete(\"error_description\");\n // For RFC9207\n cleanedUpUrl.searchParams.delete(\"iss\");\n return cleanedUpUrl;\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n * @packageDocumentation\n */\nfunction booleanWithFallback(value, fallback) {\n if (typeof value === \"boolean\") {\n return Boolean(value);\n }\n return Boolean(fallback);\n}\n/**\n * @hidden\n * Authorization code flow spec: https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth\n * PKCE: https://tools.ietf.org/html/rfc7636\n */\nclass AuthorizationCodeWithPkceOidcHandlerBase {\n storageUtility;\n redirector;\n constructor(storageUtility, redirector) {\n this.storageUtility = storageUtility;\n this.redirector = redirector;\n this.storageUtility = storageUtility;\n this.redirector = redirector;\n }\n parametersGuard = (oidcLoginOptions) => {\n return (oidcLoginOptions.issuerConfiguration.grantTypesSupported !== undefined &&\n oidcLoginOptions.issuerConfiguration.grantTypesSupported.indexOf(\"authorization_code\") > -1 &&\n oidcLoginOptions.redirectUrl !== undefined);\n };\n async canHandle(oidcLoginOptions) {\n return this.parametersGuard(oidcLoginOptions);\n }\n async setupRedirectHandler({ oidcLoginOptions, state, codeVerifier, targetUrl, }) {\n if (!this.parametersGuard(oidcLoginOptions)) {\n throw new Error(\"The authorization code grant requires a redirectUrl.\");\n }\n await Promise.all([\n // We use the OAuth 'state' value (which should be crypto-random) as\n // the key in our storage to store our actual SessionID. We do this\n // 'cos we'll need to lookup our session information again when the\n // browser is redirected back to us (i.e. the OAuth client\n // application) from the Authorization Server.\n // We don't want to use our session ID as the OAuth 'state' value, as\n // that session ID can be any developer-specified value, and therefore\n // may not be appropriate (since the OAuth 'state' value should really\n // be an unguessable crypto-random value).\n this.storageUtility.setForUser(state, {\n sessionId: oidcLoginOptions.sessionId,\n }),\n // Store our login-process state using the session ID as the key.\n // Strictly speaking, this indirection from our OAuth state value to\n // our session ID is unnecessary, but it provides a slightly cleaner\n // separation of concerns.\n this.storageUtility.setForUser(oidcLoginOptions.sessionId, {\n codeVerifier,\n issuer: oidcLoginOptions.issuer.toString(),\n // The redirect URL is read after redirect, so it must be stored now.\n redirectUrl: oidcLoginOptions.redirectUrl,\n dpop: Boolean(oidcLoginOptions.dpop).toString(),\n keepAlive: booleanWithFallback(oidcLoginOptions.keepAlive, true).toString(),\n }),\n ]);\n this.redirector.redirect(targetUrl, {\n handleRedirect: oidcLoginOptions.handleRedirect,\n });\n return undefined;\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n */\nclass GeneralLogoutHandler {\n sessionInfoManager;\n constructor(sessionInfoManager) {\n this.sessionInfoManager = sessionInfoManager;\n this.sessionInfoManager = sessionInfoManager;\n }\n async canHandle() {\n return true;\n }\n async handle(userId) {\n await this.sessionInfoManager.clear(userId);\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nclass IRpLogoutHandler {\n redirector;\n constructor(redirector) {\n this.redirector = redirector;\n this.redirector = redirector;\n }\n async canHandle(userId, options) {\n return options?.logoutType === \"idp\";\n }\n async handle(userId, options) {\n if (options?.logoutType !== \"idp\") {\n throw new Error(\"Attempting to call idp logout handler to perform app logout\");\n }\n if (options.toLogoutUrl === undefined) {\n throw new Error(\"Cannot perform IDP logout. Did you log in using the OIDC authentication flow?\");\n }\n this.redirector.redirect(options.toLogoutUrl(options), {\n handleRedirect: options.handleRedirect,\n });\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nclass IWaterfallLogoutHandler {\n handlers;\n constructor(sessionInfoManager, redirector) {\n this.handlers = [\n new GeneralLogoutHandler(sessionInfoManager),\n new IRpLogoutHandler(redirector),\n ];\n }\n async canHandle() {\n return true;\n }\n async handle(userId, options) {\n for (const handler of this.handlers) {\n if (await handler.canHandle(userId, options))\n await handler.handle(userId, options);\n }\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n * @packageDocumentation\n */\nfunction getUnauthenticatedSession() {\n return {\n isLoggedIn: false,\n sessionId: v4(),\n fetch: (...args) => fetch(...args),\n };\n}\n/**\n * @param sessionId\n * @param storage\n * @hidden\n */\nasync function clear(sessionId, storage) {\n await Promise.all([\n storage.deleteAllUserData(sessionId, { secure: false }),\n storage.deleteAllUserData(sessionId, { secure: true }),\n ]);\n}\n/**\n * @hidden\n */\nclass SessionInfoManagerBase {\n storageUtility;\n constructor(storageUtility) {\n this.storageUtility = storageUtility;\n this.storageUtility = storageUtility;\n }\n update(_sessionId, _options) {\n throw new Error(\"Not Implemented\");\n }\n set(_sessionId, _sessionInfo) {\n throw new Error(\"Not Implemented\");\n }\n get(_) {\n throw new Error(\"Not implemented\");\n }\n async getAll() {\n throw new Error(\"Not implemented\");\n }\n /**\n * This function removes all session-related information from storage.\n * @param sessionId the session identifier\n * @hidden\n */\n async clear(sessionId) {\n return clear(sessionId, this.storageUtility);\n }\n /**\n * Registers a new session, so that its ID can be retrieved.\n */\n async register(_sessionId) {\n throw new Error(\"Not implemented\");\n }\n /**\n * Returns all the registered session IDs. Differs from getAll, which also\n * returns additional session information.\n */\n async getRegisteredSessionIdAll() {\n throw new Error(\"Not implemented\");\n }\n /**\n * Deletes all information about all sessions, including their registrations.\n */\n async clearAll() {\n throw new Error(\"Not implemented\");\n }\n /**\n * Sets authorization request state in storage for a given session ID.\n */\n async setOidcContext(_sessionId, _authorizationRequestState) {\n throw new Error(\"Not implemented\");\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * This function is designed to isomorphically capture the behavior in oidc-client-js and node-oidc-provider\n * - https://github.com/IdentityModel/oidc-client-js/blob/edec8f59897bdeedcb0b4167586d49626203c2c1/src/OidcClient.js#L138\n * - https://github.com/panva/node-openid-client/blob/35758419489ff751a71f5b66f5020087a63e1e88/lib/client.js#L284\n *\n * @param options IEndSessionOptions\n * @returns The URL to redirect to in order to perform RP Initiated Logout\n * @hidden\n */\nfunction getEndSessionUrl({ endSessionEndpoint, idTokenHint, postLogoutRedirectUri, state, }) {\n const url = new URL(endSessionEndpoint);\n if (idTokenHint !== undefined)\n url.searchParams.append(\"id_token_hint\", idTokenHint);\n if (postLogoutRedirectUri !== undefined) {\n url.searchParams.append(\"post_logout_redirect_uri\", postLogoutRedirectUri);\n if (state !== undefined)\n url.searchParams.append(\"state\", state);\n }\n return url.toString();\n}\n/**\n * @param options.endSessionEndpoint The end_session_endpoint advertised by the server\n * @param options.idTokenHint The idToken supplied by the server after logging in\n * Redirects the window to the location required to perform RP initiated logout\n *\n * @hidden\n */\nfunction maybeBuildRpInitiatedLogout({ endSessionEndpoint, idTokenHint, }) {\n if (endSessionEndpoint === undefined)\n return undefined;\n return function logout({ state, postLogoutUrl }) {\n return getEndSessionUrl({\n endSessionEndpoint,\n idTokenHint,\n state,\n postLogoutRedirectUri: postLogoutUrl,\n });\n };\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nfunction isSupportedTokenType(token) {\n return typeof token === \"string\" && [\"DPoP\", \"Bearer\"].includes(token);\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nconst USER_SESSION_PREFIX = \"solidClientAuthenticationUser\";\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nfunction isValidUrl(url) {\n try {\n // Here, the URL constructor is just called to parse the given string and\n // verify if it is a well-formed IRI.\n new URL(url);\n return true;\n }\n catch {\n return false;\n }\n}\nfunction determineSigningAlg(supported, preferred) {\n return (preferred.find((signingAlg) => {\n return supported.includes(signingAlg);\n }) ?? null);\n}\nfunction isStaticClient(options) {\n return options.clientId !== undefined && !isValidUrl(options.clientId);\n}\nfunction isSolidOidcClient(options, issuerConfig) {\n return (issuerConfig.scopesSupported.includes(\"webid\") &&\n options.clientId !== undefined &&\n isValidUrl(options.clientId));\n}\nfunction isKnownClientType(clientType) {\n return (typeof clientType === \"string\" &&\n [\"dynamic\", \"static\", \"solid-oidc\"].includes(clientType));\n}\nasync function handleRegistration(options, issuerConfig, storageUtility, clientRegistrar) {\n let clientInfo;\n if (isSolidOidcClient(options, issuerConfig)) {\n clientInfo = {\n clientId: options.clientId,\n clientName: options.clientName,\n clientType: \"solid-oidc\",\n };\n }\n else if (isStaticClient(options)) {\n clientInfo = {\n clientId: options.clientId,\n clientSecret: options.clientSecret,\n clientName: options.clientName,\n clientType: \"static\",\n };\n }\n else {\n // Case of a dynamically registered client.\n return clientRegistrar.getClient({\n sessionId: options.sessionId,\n clientName: options.clientName,\n redirectUrl: options.redirectUrl,\n }, issuerConfig);\n }\n // If a client_id was provided, and the Identity Provider is Solid-OIDC compliant,\n // or it is not compliant but the client_id isn't an IRI (we assume it has already\n // been registered with the IdP), then the client registration information needs\n // to be stored so that it can be retrieved later after redirect.\n const infoToSave = {\n clientId: clientInfo.clientId,\n clientType: clientInfo.clientType,\n };\n if (clientInfo.clientType === \"static\") {\n infoToSave.clientSecret = clientInfo.clientSecret;\n }\n if (clientInfo.clientName) {\n infoToSave.clientName = clientInfo.clientName;\n }\n // Note that due to the underlying implementation, doing a `Promise.all`\n // on multiple `storageUtility.setForUser` results in the last one\n // overriding the previous calls.\n await storageUtility.setForUser(options.sessionId, infoToSave);\n return clientInfo;\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nconst boundFetch = (request, init) => fetch(request, init);\n/**\n * @hidden\n */\nclass ClientAuthentication {\n loginHandler;\n redirectHandler;\n logoutHandler;\n sessionInfoManager;\n issuerConfigFetcher;\n boundLogout;\n constructor(loginHandler, redirectHandler, logoutHandler, sessionInfoManager, issuerConfigFetcher) {\n this.loginHandler = loginHandler;\n this.redirectHandler = redirectHandler;\n this.logoutHandler = logoutHandler;\n this.sessionInfoManager = sessionInfoManager;\n this.issuerConfigFetcher = issuerConfigFetcher;\n this.loginHandler = loginHandler;\n this.redirectHandler = redirectHandler;\n this.logoutHandler = logoutHandler;\n this.sessionInfoManager = sessionInfoManager;\n this.issuerConfigFetcher = issuerConfigFetcher;\n }\n // By default, our fetch() resolves to the environment fetch() function.\n fetch = boundFetch;\n logout = async (sessionId, options) => {\n // When doing IDP logout this will redirect away from the current page, so we should not expect\n // code after this condition to be run if it is true.\n // We also need to make sure that any other cleanup that we want to do for\n // our session takes place before this condition is run\n await this.logoutHandler.handle(sessionId, options?.logoutType === \"idp\"\n ? {\n ...options,\n toLogoutUrl: this.boundLogout,\n }\n : options);\n // Restore our fetch() function back to the environment fetch(), effectively\n // leaving us with un-authenticated fetches from now on.\n this.fetch = boundFetch;\n // Delete the bound logout function, so that it can't be called after this.\n delete this.boundLogout;\n };\n getSessionInfo = async (sessionId) => {\n // TODO complete\n return this.sessionInfoManager.get(sessionId);\n };\n getAllSessionInfo = async () => {\n return this.sessionInfoManager.getAll();\n };\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n * @packageDocumentation\n */\n/**\n * A helper class that will validate items taken from local storage\n */\nasync function getSessionIdFromOauthState(storageUtility, oauthState) {\n return storageUtility.getForUser(oauthState, \"sessionId\");\n}\n/**\n * Based on the provided state, this looks up contextual information stored\n * before redirecting the user to the OIDC issuer.\n * @param sessionId The state (~ correlation ID) of the OIDC request\n * @param storageUtility\n * @param configFetcher\n * @returns Information stored about the client issuing the request\n */\nasync function loadOidcContextFromStorage(sessionId, storageUtility, configFetcher) {\n try {\n const [issuerIri, codeVerifier, storedRedirectIri, dpop, keepAlive] = await Promise.all([\n storageUtility.getForUser(sessionId, \"issuer\", {\n errorIfNull: true,\n }),\n storageUtility.getForUser(sessionId, \"codeVerifier\"),\n storageUtility.getForUser(sessionId, \"redirectUrl\"),\n storageUtility.getForUser(sessionId, \"dpop\", { errorIfNull: true }),\n storageUtility.getForUser(sessionId, \"keepAlive\"),\n ]);\n // Clear the code verifier, which is one-time use.\n await storageUtility.deleteForUser(sessionId, \"codeVerifier\");\n // Unlike openid-client, this looks up the configuration from storage\n const issuerConfig = await configFetcher.fetchConfig(issuerIri);\n return {\n codeVerifier,\n redirectUrl: storedRedirectIri,\n issuerConfig,\n dpop: dpop === \"true\",\n // Default keepAlive to true if not found in storage.\n keepAlive: typeof keepAlive === \"string\" ? keepAlive === \"true\" : true,\n };\n }\n catch (e) {\n throw new Error(`Failed to retrieve OIDC context from storage associated with session [${sessionId}]: ${e}`);\n }\n}\n/**\n * Stores information about the session in the provided storage. Note that not\n * all storage are equally secure, and it is strongly advised not to store either\n * the refresh token or the DPoP key in the browser's local storage.\n *\n * @param storageUtility\n * @param sessionId\n * @param webId\n * @param clientId\n * @param isLoggedIn\n * @param refreshToken\n * @param secure\n * @param dpopKey\n */\nasync function saveSessionInfoToStorage(storageUtility, sessionId, webId, clientId, isLoggedIn, refreshToken, secure, dpopKey) {\n // TODO: Investigate why this does not work with a Promise.all\n if (refreshToken !== undefined) {\n await storageUtility.setForUser(sessionId, { refreshToken }, { secure });\n }\n if (webId !== undefined) {\n await storageUtility.setForUser(sessionId, { webId }, { secure });\n }\n if (clientId !== undefined) {\n await storageUtility.setForUser(sessionId, { clientId }, { secure });\n }\n if (isLoggedIn !== undefined) {\n await storageUtility.setForUser(sessionId, { isLoggedIn }, { secure });\n }\n if (dpopKey !== undefined) {\n await storageUtility.setForUser(sessionId, {\n publicKey: JSON.stringify(dpopKey.publicKey),\n privateKey: JSON.stringify(await exportJWK(dpopKey.privateKey)),\n }, { secure });\n }\n}\n// TOTEST: this does not handle all possible bad inputs for example what if it's not proper JSON\n/**\n * @hidden\n */\nclass StorageUtility {\n secureStorage;\n insecureStorage;\n constructor(secureStorage, insecureStorage) {\n this.secureStorage = secureStorage;\n this.insecureStorage = insecureStorage;\n this.secureStorage = secureStorage;\n this.insecureStorage = insecureStorage;\n }\n getKey(userId) {\n return `solidClientAuthenticationUser:${userId}`;\n }\n async getUserData(userId, secure) {\n const stored = await (secure ? this.secureStorage : this.insecureStorage).get(this.getKey(userId));\n if (stored === undefined) {\n return {};\n }\n try {\n return JSON.parse(stored);\n }\n catch (_err) {\n throw new Error(`Data for user [${userId}] in [${secure ? \"secure\" : \"unsecure\"}] storage is corrupted - expected valid JSON, but got: ${stored}`);\n }\n }\n async setUserData(userId, data, secure) {\n await (secure ? this.secureStorage : this.insecureStorage).set(this.getKey(userId), JSON.stringify(data));\n }\n async get(key, options) {\n const value = await (options?.secure ? this.secureStorage : this.insecureStorage).get(key);\n if (value === undefined && options?.errorIfNull) {\n throw new Error(`[${key}] is not stored`);\n }\n return value;\n }\n async set(key, value, options) {\n return (options?.secure ? this.secureStorage : this.insecureStorage).set(key, value);\n }\n async delete(key, options) {\n return (options?.secure ? this.secureStorage : this.insecureStorage).delete(key);\n }\n async getForUser(userId, key, options) {\n const userData = await this.getUserData(userId, options?.secure);\n let value;\n if (!userData || !userData[key]) {\n value = undefined;\n }\n value = userData[key];\n if (value === undefined && options?.errorIfNull) {\n throw new Error(`Field [${key}] for user [${userId}] is not stored`);\n }\n return value || undefined;\n }\n async setForUser(userId, values, options) {\n let userData;\n try {\n userData = await this.getUserData(userId, options?.secure);\n }\n catch {\n // if reading the user data throws, the data is corrupted, and we want to write over it\n userData = {};\n }\n await this.setUserData(userId, { ...userData, ...values }, options?.secure);\n }\n async deleteForUser(userId, key, options) {\n const userData = await this.getUserData(userId, options?.secure);\n delete userData[key];\n await this.setUserData(userId, userData, options?.secure);\n }\n async deleteAllUserData(userId, options) {\n await (options?.secure ? this.secureStorage : this.insecureStorage).delete(this.getKey(userId));\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n */\nclass InMemoryStorage {\n map = {};\n async get(key) {\n return this.map[key] || undefined;\n }\n async set(key, value) {\n this.map[key] = value;\n }\n async delete(key) {\n delete this.map[key];\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n * @packageDocumentation\n */\n/**\n * Error to be triggered when a poor configuration is received\n */\n// NOTE: There's a bug with istanbul and typescript that prevents full branch coverages\n// https://github.com/gotwarlost/istanbul/issues/690\n// The workaround is to put istanbul ignore on the constructor\n/**\n * @hidden\n */\nclass ConfigurationError extends Error {\n /* istanbul ignore next */\n constructor(message) {\n super(message);\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n * @packageDocumentation\n */\n/**\n * Error to be triggered if a method is not implemented\n * @hidden\n */\nclass NotImplementedError extends Error {\n /* istanbul ignore next */\n constructor(methodName) {\n super(`[${methodName}] is not implemented`);\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n * @packageDocumentation\n */\n/**\n * Error to be triggered when receiving a response missing mandatory elements\n */\n// NOTE: There's a bug with istanbul and typescript that prevents full branch coverages\n// https://github.com/gotwarlost/istanbul/issues/690\n// The workaround is to put istanbul ignore on the constructor\n/**\n * @hidden\n */\nclass InvalidResponseError extends Error {\n missingFields;\n /* istanbul ignore next */\n constructor(missingFields) {\n super(`Invalid response from OIDC provider: missing fields ${missingFields}`);\n this.missingFields = missingFields;\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * @hidden\n * @packageDocumentation\n */\n/**\n * Error to be triggered when receiving a response missing mandatory elements\n */\n// NOTE: There's a bug with istanbul and typescript that prevents full branch coverages\n// https://github.com/gotwarlost/istanbul/issues/690\n// The workaround is to put istanbul ignore on the constructor\n/**\n * @hidden\n */\nclass OidcProviderError extends Error {\n error;\n errorDescription;\n /* istanbul ignore next */\n constructor(message, error, errorDescription) {\n super(message);\n this.error = error;\n this.errorDescription = errorDescription;\n }\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * Normalizes a URL in order to generate the DPoP token based on a consistent scheme.\n *\n * @param audience The URL to normalize.\n * @returns The normalized URL as a string.\n * @hidden\n */\nfunction normalizeHTU(audience) {\n const audienceUrl = new URL(audience);\n return new URL(audienceUrl.pathname, audienceUrl.origin).toString();\n}\n/**\n * Creates a DPoP header according to https://tools.ietf.org/html/draft-fett-oauth-dpop-04,\n * based on the target URL and method, using the provided key.\n *\n * @param audience Target URL.\n * @param method HTTP method allowed.\n * @param dpopKey Key used to sign the token.\n * @returns A JWT that can be used as a DPoP Authorization header.\n */\nasync function createDpopHeader(audience, method, dpopKey) {\n return new SignJWT({\n htu: normalizeHTU(audience),\n htm: method.toUpperCase(),\n jti: v4(),\n })\n .setProtectedHeader({\n alg: PREFERRED_SIGNING_ALG[0],\n jwk: dpopKey.publicKey,\n typ: \"dpop+jwt\",\n })\n .setIssuedAt()\n .sign(dpopKey.privateKey, {});\n}\n/**\n * Generates an asymmetric key pair.\n *\n * @param extractable whether the private key should be extractable or not. Must be false in any potentially untrusted context, e.g. the browser.\n * @returns A public/private key pair\n */\nasync function generateDpopKeyPair(extractable = false) {\n const { privateKey, publicKey } = await generateKeyPair(PREFERRED_SIGNING_ALG[0], { extractable });\n const dpopKeyPair = {\n privateKey,\n publicKey: await exportJWK(publicKey),\n };\n // The alg property isn't set by exportJWK, so set it manually.\n [dpopKeyPair.publicKey.alg] = PREFERRED_SIGNING_ALG;\n return dpopKeyPair;\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * If expires_in isn't specified for the access token, we assume its lifetime is\n * 10 minutes.\n */\nconst DEFAULT_EXPIRATION_TIME_SECONDS = 600;\nfunction isExpectedAuthError(statusCode) {\n // As per https://tools.ietf.org/html/rfc7235#section-3.1 and https://tools.ietf.org/html/rfc7235#section-3.1,\n // a response failing because the provided credentials aren't accepted by the\n // server can get a 401 or a 403 response.\n return [401, 403].includes(statusCode);\n}\nasync function buildDpopFetchOptions(targetUrl, authToken, dpopKey, defaultOptions) {\n const headers = new Headers(defaultOptions?.headers);\n // Any pre-existing Authorization header should be overriden.\n headers.set(\"Authorization\", `DPoP ${authToken}`);\n headers.set(\"DPoP\", await createDpopHeader(targetUrl, defaultOptions?.method ?? \"get\", dpopKey));\n return {\n ...defaultOptions,\n headers,\n };\n}\nasync function buildAuthenticatedHeaders(targetUrl, authToken, dpopKey, defaultOptions) {\n if (dpopKey !== undefined) {\n return buildDpopFetchOptions(targetUrl, authToken, dpopKey, defaultOptions);\n }\n const headers = new Headers(defaultOptions?.headers);\n // Any pre-existing Authorization header should be overriden.\n headers.set(\"Authorization\", `Bearer ${authToken}`);\n return {\n ...defaultOptions,\n headers,\n };\n}\nasync function makeAuthenticatedRequest(accessToken, url, defaultRequestInit, dpopKey, unauthFetch = fetch) {\n return unauthFetch(url, await buildAuthenticatedHeaders(url.toString(), accessToken, dpopKey, defaultRequestInit));\n}\nasync function refreshAccessToken(refreshOptions, dpopKey, eventEmitter) {\n const tokenSet = await refreshOptions.tokenRefresher.refresh(refreshOptions.sessionId, refreshOptions.refreshToken, dpopKey);\n eventEmitter?.emit(EVENTS.SESSION_EXTENDED, tokenSet.expiresIn ?? DEFAULT_EXPIRATION_TIME_SECONDS);\n return {\n accessToken: tokenSet.accessToken,\n refreshToken: tokenSet.refreshToken,\n expiresIn: tokenSet.expiresIn,\n };\n}\n/**\n *\n * @param expiresIn Delay until the access token expires.\n * @returns a delay until the access token should be refreshed.\n */\nconst computeRefreshDelay = (expiresIn) => {\n if (expiresIn !== undefined) {\n return expiresIn - REFRESH_BEFORE_EXPIRATION_SECONDS > 0\n ? // We want to refresh the token 5 seconds before they actually expire.\n expiresIn - REFRESH_BEFORE_EXPIRATION_SECONDS\n : expiresIn;\n }\n return DEFAULT_EXPIRATION_TIME_SECONDS;\n};\n/**\n * @param accessToken an access token, either a Bearer token or a DPoP one.\n * @param options The option object may contain two objects: the DPoP key token\n * is bound to if applicable, and options to customize token renewal behavior.\n * @param {typeof fetch} [options.fetch=fetch] A custom fetch function (defaults to the global fetch).\n *\n * @returns A fetch function that adds an appropriate Authorization header with\n * the provided token, and adds a DPoP header if applicable.\n */\nfunction buildAuthenticatedFetch(accessToken, options) {\n let currentAccessToken = accessToken;\n let latestTimeout;\n const currentRefreshOptions = options?.refreshOptions;\n const emitter = options?.eventEmitter;\n // Setup the refresh timeout outside of the authenticated fetch, so that\n // an idle app will not get logged out if it doesn't issue a fetch before\n // the first expiration date.\n if (options !== undefined && currentRefreshOptions !== undefined) {\n const proactivelyRefreshToken = async () => {\n try {\n const { accessToken: refreshedAccessToken, refreshToken, expiresIn, } = await refreshAccessToken(currentRefreshOptions, options.dpopKey, emitter);\n // Update the tokens in the closure if appropriate.\n currentAccessToken = refreshedAccessToken;\n if (refreshToken !== undefined) {\n currentRefreshOptions.refreshToken = refreshToken;\n }\n // Each time the access token is refreshed, we must plan for the next\n // refresh iteration.\n clearTimeout(latestTimeout);\n latestTimeout = setTimeout(proactivelyRefreshToken, computeRefreshDelay(expiresIn) * 1000);\n // If currentRefreshOptions is defined, options is necessarily defined too.\n options.eventEmitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);\n }\n catch (e) {\n // It is possible that an underlying library throws an error on refresh flow failure.\n // If we used a log framework, the error could be logged at the `debug` level,\n // but otherwise the failure of the refresh flow should not blow up in the user's\n // face, so we just swallow the error.\n if (e instanceof OidcProviderError) {\n // The OIDC provider refused to refresh the access token and returned an error instead.\n /* istanbul ignore next 100% coverage would require testing that nothing\n happens here if the emitter is undefined, which is more cumbersome\n than what it's worth. */\n emitter?.emit(EVENTS.ERROR, e.error, e.errorDescription);\n /* istanbul ignore next 100% coverage would require testing that nothing\n happens here if the emitter is undefined, which is more cumbersome\n than what it's worth. */\n emitter?.emit(EVENTS.SESSION_EXPIRED);\n }\n if (e instanceof InvalidResponseError &&\n e.missingFields.includes(\"access_token\")) {\n // In this case, the OIDC provider returned a non-standard response, but\n // did not specify that it was an error. We cannot refresh nonetheless.\n /* istanbul ignore next 100% coverage would require testing that nothing\n happens here if the emitter is undefined, which is more cumbersome\n than what it's worth. */\n emitter?.emit(EVENTS.SESSION_EXPIRED);\n }\n }\n };\n latestTimeout = setTimeout(proactivelyRefreshToken, \n // If currentRefreshOptions is defined, options is necessarily defined too.\n computeRefreshDelay(options.expiresIn) * 1000);\n emitter?.emit(EVENTS.TIMEOUT_SET, latestTimeout);\n }\n else if (emitter !== undefined) {\n // If no refresh options are provided, the session expires when the access token does.\n const expirationTimeout = setTimeout(() => {\n emitter.emit(EVENTS.SESSION_EXPIRED);\n }, computeRefreshDelay(options?.expiresIn) * 1000);\n emitter.emit(EVENTS.TIMEOUT_SET, expirationTimeout);\n }\n return async (url, requestInit) => {\n let response = await makeAuthenticatedRequest(currentAccessToken, url, requestInit, options?.dpopKey, options?.fetch);\n const failedButNotExpectedAuthError = !response.ok && !isExpectedAuthError(response.status);\n if (response.ok || failedButNotExpectedAuthError) {\n // If there hasn't been a redirection, or if there has been a non-auth related\n // issue, it should be handled at the application level\n return response;\n }\n const hasBeenRedirected = response.url !== url;\n if (hasBeenRedirected && options?.dpopKey !== undefined) {\n // If the request failed for auth reasons, and has been redirected, we should\n // replay it generating a DPoP header for the rediration target IRI. This\n // doesn't apply to Bearer tokens, as the Bearer tokens aren't specific\n // to a given resource and method, while the DPoP header (associated to a\n // DPoP token) is.\n response = await makeAuthenticatedRequest(currentAccessToken, \n // Replace the original target IRI (`url`) by the redirection target\n response.url, requestInit, options.dpopKey, options.fetch);\n }\n return response;\n };\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nconst StorageUtilityGetResponse = \"getResponse\";\nconst StorageUtilityMock = {\n /* eslint-disable @typescript-eslint/no-unused-vars */\n get: async (key, options) => StorageUtilityGetResponse,\n set: async (key, value) => {\n /* do nothing */\n },\n delete: async (key) => {\n /* do nothing */\n },\n getForUser: async (userId, key, options) => StorageUtilityGetResponse,\n setForUser: async (userId, values, options) => {\n /* do nothing */\n },\n deleteForUser: async (userId, key, options) => {\n /* do nothing */\n },\n deleteAllUserData: async (userId, options) => {\n /* do nothing */\n },\n};\nconst mockStorage = (stored) => {\n const store = stored;\n return {\n get: async (key) => {\n if (store[key] === undefined) {\n return undefined;\n }\n if (typeof store[key] === \"string\") {\n return store[key];\n }\n return JSON.stringify(store[key]);\n },\n set: async (key, value) => {\n store[key] = value;\n },\n delete: async (key) => {\n delete store[key];\n },\n };\n};\nconst mockStorageUtility = (stored, isSecure = false) => {\n if (isSecure) {\n return new StorageUtility(mockStorage(stored), mockStorage({}));\n }\n return new StorageUtility(mockStorage({}), mockStorage(stored));\n};\n\nexport { AggregateHandler, AuthorizationCodeWithPkceOidcHandlerBase, ClientAuthentication, ConfigurationError, DEFAULT_SCOPES, EVENTS, GeneralLogoutHandler, IRpLogoutHandler, IWaterfallLogoutHandler, InMemoryStorage, InvalidResponseError, NotImplementedError, OidcProviderError, PREFERRED_SIGNING_ALG, REFRESH_BEFORE_EXPIRATION_SECONDS, SOLID_CLIENT_AUTHN_KEY_PREFIX, SessionInfoManagerBase, StorageUtility, StorageUtilityGetResponse, StorageUtilityMock, USER_SESSION_PREFIX, buildAuthenticatedFetch, clear, createDpopHeader, determineSigningAlg, generateDpopKeyPair, getEndSessionUrl, getSessionIdFromOauthState, getUnauthenticatedSession, getWebidFromTokenPayload, handleRegistration, isKnownClientType, isSupportedTokenType, isValidRedirectUrl, loadOidcContextFromStorage, maybeBuildRpInitiatedLogout, mockStorage, mockStorageUtility, normalizeScopes, removeOpenIdParams, saveSessionInfoToStorage };\n//# sourceMappingURL=index.mjs.map\n","import validate from './validate.js';\nconst byteToHex = [];\nfor (let i = 0; i < 256; ++i) {\n byteToHex.push((i + 0x100).toString(16).slice(1));\n}\nexport function unsafeStringify(arr, offset = 0) {\n return (byteToHex[arr[offset + 0]] +\n byteToHex[arr[offset + 1]] +\n byteToHex[arr[offset + 2]] +\n byteToHex[arr[offset + 3]] +\n '-' +\n byteToHex[arr[offset + 4]] +\n byteToHex[arr[offset + 5]] +\n '-' +\n byteToHex[arr[offset + 6]] +\n byteToHex[arr[offset + 7]] +\n '-' +\n byteToHex[arr[offset + 8]] +\n byteToHex[arr[offset + 9]] +\n '-' +\n byteToHex[arr[offset + 10]] +\n byteToHex[arr[offset + 11]] +\n byteToHex[arr[offset + 12]] +\n byteToHex[arr[offset + 13]] +\n byteToHex[arr[offset + 14]] +\n byteToHex[arr[offset + 15]]).toLowerCase();\n}\nfunction stringify(arr, offset = 0) {\n const uuid = unsafeStringify(arr, offset);\n if (!validate(uuid)) {\n throw TypeError('Stringified UUID is invalid');\n }\n return uuid;\n}\nexport default stringify;\n","const rnds8 = new Uint8Array(16);\nexport default function rng() {\n return crypto.getRandomValues(rnds8);\n}\n","import rng from './rng.js';\nimport { unsafeStringify } from './stringify.js';\nfunction v4(options, buf, offset) {\n if (!buf && !options && crypto.randomUUID) {\n return crypto.randomUUID();\n }\n return _v4(options, buf, offset);\n}\nfunction _v4(options, buf, offset) {\n options = options || {};\n const rnds = options.random ?? options.rng?.() ?? rng();\n if (rnds.length < 16) {\n throw new Error('Random bytes length must be >= 16');\n }\n rnds[6] = (rnds[6] & 0x0f) | 0x40;\n rnds[8] = (rnds[8] & 0x3f) | 0x80;\n if (buf) {\n offset = offset || 0;\n if (offset < 0 || offset + 16 > buf.length) {\n throw new RangeError(`UUID byte range ${offset}:${offset + 15} is out of buffer bounds`);\n }\n for (let i = 0; i < 16; ++i) {\n buf[offset + i] = rnds[i];\n }\n return buf;\n }\n return unsafeStringify(rnds);\n}\nexport default v4;\n","// Copyright Joyent, Inc. and other Node contributors.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a\n// copy of this software and associated documentation files (the\n// \"Software\"), to deal in the Software without restriction, including\n// without limitation the rights to use, copy, modify, merge, publish,\n// distribute, sublicense, and/or sell copies of the Software, and to permit\n// persons to whom the Software is furnished to do so, subject to the\n// following conditions:\n//\n// The above copyright notice and this permission notice shall be included\n// in all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS\n// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\n// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN\n// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,\n// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR\n// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE\n// USE OR OTHER DEALINGS IN THE SOFTWARE.\n\n'use strict';\n\nvar R = typeof Reflect === 'object' ? Reflect : null\nvar ReflectApply = R && typeof R.apply === 'function'\n ? R.apply\n : function ReflectApply(target, receiver, args) {\n return Function.prototype.apply.call(target, receiver, args);\n }\n\nvar ReflectOwnKeys\nif (R && typeof R.ownKeys === 'function') {\n ReflectOwnKeys = R.ownKeys\n} else if (Object.getOwnPropertySymbols) {\n ReflectOwnKeys = function ReflectOwnKeys(target) {\n return Object.getOwnPropertyNames(target)\n .concat(Object.getOwnPropertySymbols(target));\n };\n} else {\n ReflectOwnKeys = function ReflectOwnKeys(target) {\n return Object.getOwnPropertyNames(target);\n };\n}\n\nfunction ProcessEmitWarning(warning) {\n if (console && console.warn) console.warn(warning);\n}\n\nvar NumberIsNaN = Number.isNaN || function NumberIsNaN(value) {\n return value !== value;\n}\n\nfunction EventEmitter() {\n EventEmitter.init.call(this);\n}\nmodule.exports = EventEmitter;\nmodule.exports.once = once;\n\n// Backwards-compat with node 0.10.x\nEventEmitter.EventEmitter = EventEmitter;\n\nEventEmitter.prototype._events = undefined;\nEventEmitter.prototype._eventsCount = 0;\nEventEmitter.prototype._maxListeners = undefined;\n\n// By default EventEmitters will print a warning if more than 10 listeners are\n// added to it. This is a useful default which helps finding memory leaks.\nvar defaultMaxListeners = 10;\n\nfunction checkListener(listener) {\n if (typeof listener !== 'function') {\n throw new TypeError('The \"listener\" argument must be of type Function. Received type ' + typeof listener);\n }\n}\n\nObject.defineProperty(EventEmitter, 'defaultMaxListeners', {\n enumerable: true,\n get: function() {\n return defaultMaxListeners;\n },\n set: function(arg) {\n if (typeof arg !== 'number' || arg < 0 || NumberIsNaN(arg)) {\n throw new RangeError('The value of \"defaultMaxListeners\" is out of range. It must be a non-negative number. Received ' + arg + '.');\n }\n defaultMaxListeners = arg;\n }\n});\n\nEventEmitter.init = function() {\n\n if (this._events === undefined ||\n this._events === Object.getPrototypeOf(this)._events) {\n this._events = Object.create(null);\n this._eventsCount = 0;\n }\n\n this._maxListeners = this._maxListeners || undefined;\n};\n\n// Obviously not all Emitters should be limited to 10. This function allows\n// that to be increased. Set to zero for unlimited.\nEventEmitter.prototype.setMaxListeners = function setMaxListeners(n) {\n if (typeof n !== 'number' || n < 0 || NumberIsNaN(n)) {\n throw new RangeError('The value of \"n\" is out of range. It must be a non-negative number. Received ' + n + '.');\n }\n this._maxListeners = n;\n return this;\n};\n\nfunction _getMaxListeners(that) {\n if (that._maxListeners === undefined)\n return EventEmitter.defaultMaxListeners;\n return that._maxListeners;\n}\n\nEventEmitter.prototype.getMaxListeners = function getMaxListeners() {\n return _getMaxListeners(this);\n};\n\nEventEmitter.prototype.emit = function emit(type) {\n var args = [];\n for (var i = 1; i < arguments.length; i++) args.push(arguments[i]);\n var doError = (type === 'error');\n\n var events = this._events;\n if (events !== undefined)\n doError = (doError && events.error === undefined);\n else if (!doError)\n return false;\n\n // If there is no 'error' event listener then throw.\n if (doError) {\n var er;\n if (args.length > 0)\n er = args[0];\n if (er instanceof Error) {\n // Note: The comments on the `throw` lines are intentional, they show\n // up in Node's output if this results in an unhandled exception.\n throw er; // Unhandled 'error' event\n }\n // At least give some kind of context to the user\n var err = new Error('Unhandled error.' + (er ? ' (' + er.message + ')' : ''));\n err.context = er;\n throw err; // Unhandled 'error' event\n }\n\n var handler = events[type];\n\n if (handler === undefined)\n return false;\n\n if (typeof handler === 'function') {\n ReflectApply(handler, this, args);\n } else {\n var len = handler.length;\n var listeners = arrayClone(handler, len);\n for (var i = 0; i < len; ++i)\n ReflectApply(listeners[i], this, args);\n }\n\n return true;\n};\n\nfunction _addListener(target, type, listener, prepend) {\n var m;\n var events;\n var existing;\n\n checkListener(listener);\n\n events = target._events;\n if (events === undefined) {\n events = target._events = Object.create(null);\n target._eventsCount = 0;\n } else {\n // To avoid recursion in the case that type === \"newListener\"! Before\n // adding it to the listeners, first emit \"newListener\".\n if (events.newListener !== undefined) {\n target.emit('newListener', type,\n listener.listener ? listener.listener : listener);\n\n // Re-assign `events` because a newListener handler could have caused the\n // this._events to be assigned to a new object\n events = target._events;\n }\n existing = events[type];\n }\n\n if (existing === undefined) {\n // Optimize the case of one listener. Don't need the extra array object.\n existing = events[type] = listener;\n ++target._eventsCount;\n } else {\n if (typeof existing === 'function') {\n // Adding the second element, need to change to array.\n existing = events[type] =\n prepend ? [listener, existing] : [existing, listener];\n // If we've already got an array, just append.\n } else if (prepend) {\n existing.unshift(listener);\n } else {\n existing.push(listener);\n }\n\n // Check for listener leak\n m = _getMaxListeners(target);\n if (m > 0 && existing.length > m && !existing.warned) {\n existing.warned = true;\n // No error code for this since it is a Warning\n // eslint-disable-next-line no-restricted-syntax\n var w = new Error('Possible EventEmitter memory leak detected. ' +\n existing.length + ' ' + String(type) + ' listeners ' +\n 'added. Use emitter.setMaxListeners() to ' +\n 'increase limit');\n w.name = 'MaxListenersExceededWarning';\n w.emitter = target;\n w.type = type;\n w.count = existing.length;\n ProcessEmitWarning(w);\n }\n }\n\n return target;\n}\n\nEventEmitter.prototype.addListener = function addListener(type, listener) {\n return _addListener(this, type, listener, false);\n};\n\nEventEmitter.prototype.on = EventEmitter.prototype.addListener;\n\nEventEmitter.prototype.prependListener =\n function prependListener(type, listener) {\n return _addListener(this, type, listener, true);\n };\n\nfunction onceWrapper() {\n if (!this.fired) {\n this.target.removeListener(this.type, this.wrapFn);\n this.fired = true;\n if (arguments.length === 0)\n return this.listener.call(this.target);\n return this.listener.apply(this.target, arguments);\n }\n}\n\nfunction _onceWrap(target, type, listener) {\n var state = { fired: false, wrapFn: undefined, target: target, type: type, listener: listener };\n var wrapped = onceWrapper.bind(state);\n wrapped.listener = listener;\n state.wrapFn = wrapped;\n return wrapped;\n}\n\nEventEmitter.prototype.once = function once(type, listener) {\n checkListener(listener);\n this.on(type, _onceWrap(this, type, listener));\n return this;\n};\n\nEventEmitter.prototype.prependOnceListener =\n function prependOnceListener(type, listener) {\n checkListener(listener);\n this.prependListener(type, _onceWrap(this, type, listener));\n return this;\n };\n\n// Emits a 'removeListener' event if and only if the listener was removed.\nEventEmitter.prototype.removeListener =\n function removeListener(type, listener) {\n var list, events, position, i, originalListener;\n\n checkListener(listener);\n\n events = this._events;\n if (events === undefined)\n return this;\n\n list = events[type];\n if (list === undefined)\n return this;\n\n if (list === listener || list.listener === listener) {\n if (--this._eventsCount === 0)\n this._events = Object.create(null);\n else {\n delete events[type];\n if (events.removeListener)\n this.emit('removeListener', type, list.listener || listener);\n }\n } else if (typeof list !== 'function') {\n position = -1;\n\n for (i = list.length - 1; i >= 0; i--) {\n if (list[i] === listener || list[i].listener === listener) {\n originalListener = list[i].listener;\n position = i;\n break;\n }\n }\n\n if (position < 0)\n return this;\n\n if (position === 0)\n list.shift();\n else {\n spliceOne(list, position);\n }\n\n if (list.length === 1)\n events[type] = list[0];\n\n if (events.removeListener !== undefined)\n this.emit('removeListener', type, originalListener || listener);\n }\n\n return this;\n };\n\nEventEmitter.prototype.off = EventEmitter.prototype.removeListener;\n\nEventEmitter.prototype.removeAllListeners =\n function removeAllListeners(type) {\n var listeners, events, i;\n\n events = this._events;\n if (events === undefined)\n return this;\n\n // not listening for removeListener, no need to emit\n if (events.removeListener === undefined) {\n if (arguments.length === 0) {\n this._events = Object.create(null);\n this._eventsCount = 0;\n } else if (events[type] !== undefined) {\n if (--this._eventsCount === 0)\n this._events = Object.create(null);\n else\n delete events[type];\n }\n return this;\n }\n\n // emit removeListener for all listeners on all events\n if (arguments.length === 0) {\n var keys = Object.keys(events);\n var key;\n for (i = 0; i < keys.length; ++i) {\n key = keys[i];\n if (key === 'removeListener') continue;\n this.removeAllListeners(key);\n }\n this.removeAllListeners('removeListener');\n this._events = Object.create(null);\n this._eventsCount = 0;\n return this;\n }\n\n listeners = events[type];\n\n if (typeof listeners === 'function') {\n this.removeListener(type, listeners);\n } else if (listeners !== undefined) {\n // LIFO order\n for (i = listeners.length - 1; i >= 0; i--) {\n this.removeListener(type, listeners[i]);\n }\n }\n\n return this;\n };\n\nfunction _listeners(target, type, unwrap) {\n var events = target._events;\n\n if (events === undefined)\n return [];\n\n var evlistener = events[type];\n if (evlistener === undefined)\n return [];\n\n if (typeof evlistener === 'function')\n return unwrap ? [evlistener.listener || evlistener] : [evlistener];\n\n return unwrap ?\n unwrapListeners(evlistener) : arrayClone(evlistener, evlistener.length);\n}\n\nEventEmitter.prototype.listeners = function listeners(type) {\n return _listeners(this, type, true);\n};\n\nEventEmitter.prototype.rawListeners = function rawListeners(type) {\n return _listeners(this, type, false);\n};\n\nEventEmitter.listenerCount = function(emitter, type) {\n if (typeof emitter.listenerCount === 'function') {\n return emitter.listenerCount(type);\n } else {\n return listenerCount.call(emitter, type);\n }\n};\n\nEventEmitter.prototype.listenerCount = listenerCount;\nfunction listenerCount(type) {\n var events = this._events;\n\n if (events !== undefined) {\n var evlistener = events[type];\n\n if (typeof evlistener === 'function') {\n return 1;\n } else if (evlistener !== undefined) {\n return evlistener.length;\n }\n }\n\n return 0;\n}\n\nEventEmitter.prototype.eventNames = function eventNames() {\n return this._eventsCount > 0 ? ReflectOwnKeys(this._events) : [];\n};\n\nfunction arrayClone(arr, n) {\n var copy = new Array(n);\n for (var i = 0; i < n; ++i)\n copy[i] = arr[i];\n return copy;\n}\n\nfunction spliceOne(list, index) {\n for (; index + 1 < list.length; index++)\n list[index] = list[index + 1];\n list.pop();\n}\n\nfunction unwrapListeners(arr) {\n var ret = new Array(arr.length);\n for (var i = 0; i < ret.length; ++i) {\n ret[i] = arr[i].listener || arr[i];\n }\n return ret;\n}\n\nfunction once(emitter, name) {\n return new Promise(function (resolve, reject) {\n function errorListener(err) {\n emitter.removeListener(name, resolver);\n reject(err);\n }\n\n function resolver() {\n if (typeof emitter.removeListener === 'function') {\n emitter.removeListener('error', errorListener);\n }\n resolve([].slice.call(arguments));\n };\n\n eventTargetAgnosticAddListener(emitter, name, resolver, { once: true });\n if (name !== 'error') {\n addErrorHandlerIfEventEmitter(emitter, errorListener, { once: true });\n }\n });\n}\n\nfunction addErrorHandlerIfEventEmitter(emitter, handler, flags) {\n if (typeof emitter.on === 'function') {\n eventTargetAgnosticAddListener(emitter, 'error', handler, flags);\n }\n}\n\nfunction eventTargetAgnosticAddListener(emitter, name, listener, flags) {\n if (typeof emitter.on === 'function') {\n if (flags.once) {\n emitter.once(name, listener);\n } else {\n emitter.on(name, listener);\n }\n } else if (typeof emitter.addEventListener === 'function') {\n // EventTarget does not have `error` event semantics like Node\n // EventEmitters, we do not listen for `error` events here.\n emitter.addEventListener(name, function wrapListener(arg) {\n // IE does not have builtin `{ once: true }` support so we\n // have to do it manually.\n if (flags.once) {\n emitter.removeEventListener(name, wrapListener);\n }\n listener(arg);\n });\n } else {\n throw new TypeError('The \"emitter\" argument must be of type EventEmitter. Received type ' + typeof emitter);\n }\n}\n",null,"export class InvalidTokenError extends Error {\n}\nInvalidTokenError.prototype.name = \"InvalidTokenError\";\nfunction b64DecodeUnicode(str) {\n return decodeURIComponent(atob(str).replace(/(.)/g, (m, p) => {\n let code = p.charCodeAt(0).toString(16).toUpperCase();\n if (code.length < 2) {\n code = \"0\" + code;\n }\n return \"%\" + code;\n }));\n}\nfunction base64UrlDecode(str) {\n let output = str.replace(/-/g, \"+\").replace(/_/g, \"/\");\n switch (output.length % 4) {\n case 0:\n break;\n case 2:\n output += \"==\";\n break;\n case 3:\n output += \"=\";\n break;\n default:\n throw new Error(\"base64 string is not of the correct length\");\n }\n try {\n return b64DecodeUnicode(output);\n }\n catch (err) {\n return atob(output);\n }\n}\nexport function jwtDecode(token, options) {\n if (typeof token !== \"string\") {\n throw new InvalidTokenError(\"Invalid token specified: must be a string\");\n }\n options || (options = {});\n const pos = options.header === true ? 0 : 1;\n const part = token.split(\".\")[pos];\n if (typeof part !== \"string\") {\n throw new InvalidTokenError(`Invalid token specified: missing part #${pos + 1}`);\n }\n let decoded;\n try {\n decoded = base64UrlDecode(part);\n }\n catch (e) {\n throw new InvalidTokenError(`Invalid token specified: invalid base64 for part #${pos + 1} (${e.message})`);\n }\n try {\n return JSON.parse(decoded);\n }\n catch (e) {\n throw new InvalidTokenError(`Invalid token specified: invalid json for part #${pos + 1} (${e.message})`);\n }\n}\n","// src/utils/Logger.ts\nvar nopLogger = {\n debug: () => void 0,\n info: () => void 0,\n warn: () => void 0,\n error: () => void 0\n};\nvar level;\nvar logger;\nvar Log = /* @__PURE__ */ ((Log2) => {\n Log2[Log2[\"NONE\"] = 0] = \"NONE\";\n Log2[Log2[\"ERROR\"] = 1] = \"ERROR\";\n Log2[Log2[\"WARN\"] = 2] = \"WARN\";\n Log2[Log2[\"INFO\"] = 3] = \"INFO\";\n Log2[Log2[\"DEBUG\"] = 4] = \"DEBUG\";\n return Log2;\n})(Log || {});\n((Log2) => {\n function reset() {\n level = 3 /* INFO */;\n logger = nopLogger;\n }\n Log2.reset = reset;\n function setLevel(value) {\n if (!(0 /* NONE */ <= value && value <= 4 /* DEBUG */)) {\n throw new Error(\"Invalid log level\");\n }\n level = value;\n }\n Log2.setLevel = setLevel;\n function setLogger(value) {\n logger = value;\n }\n Log2.setLogger = setLogger;\n})(Log || (Log = {}));\nvar Logger = class _Logger {\n constructor(_name) {\n this._name = _name;\n }\n /* eslint-disable @typescript-eslint/no-unsafe-enum-comparison */\n debug(...args) {\n if (level >= 4 /* DEBUG */) {\n logger.debug(_Logger._format(this._name, this._method), ...args);\n }\n }\n info(...args) {\n if (level >= 3 /* INFO */) {\n logger.info(_Logger._format(this._name, this._method), ...args);\n }\n }\n warn(...args) {\n if (level >= 2 /* WARN */) {\n logger.warn(_Logger._format(this._name, this._method), ...args);\n }\n }\n error(...args) {\n if (level >= 1 /* ERROR */) {\n logger.error(_Logger._format(this._name, this._method), ...args);\n }\n }\n /* eslint-enable @typescript-eslint/no-unsafe-enum-comparison */\n throw(err) {\n this.error(err);\n throw err;\n }\n create(method) {\n const methodLogger = Object.create(this);\n methodLogger._method = method;\n methodLogger.debug(\"begin\");\n return methodLogger;\n }\n static createStatic(name, staticMethod) {\n const staticLogger = new _Logger(`${name}.${staticMethod}`);\n staticLogger.debug(\"begin\");\n return staticLogger;\n }\n static _format(name, method) {\n const prefix = `[${name}]`;\n return method ? `${prefix} ${method}:` : prefix;\n }\n /* eslint-disable @typescript-eslint/no-unsafe-enum-comparison */\n // helpers for static class methods\n static debug(name, ...args) {\n if (level >= 4 /* DEBUG */) {\n logger.debug(_Logger._format(name), ...args);\n }\n }\n static info(name, ...args) {\n if (level >= 3 /* INFO */) {\n logger.info(_Logger._format(name), ...args);\n }\n }\n static warn(name, ...args) {\n if (level >= 2 /* WARN */) {\n logger.warn(_Logger._format(name), ...args);\n }\n }\n static error(name, ...args) {\n if (level >= 1 /* ERROR */) {\n logger.error(_Logger._format(name), ...args);\n }\n }\n /* eslint-enable @typescript-eslint/no-unsafe-enum-comparison */\n};\nLog.reset();\n\n// src/utils/JwtUtils.ts\nimport { jwtDecode } from \"jwt-decode\";\nvar JwtUtils = class {\n // IMPORTANT: doesn't validate the token\n static decode(token) {\n try {\n return jwtDecode(token);\n } catch (err) {\n Logger.error(\"JwtUtils.decode\", err);\n throw err;\n }\n }\n static async generateSignedJwt(header, payload, privateKey) {\n const encodedHeader = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(header)));\n const encodedPayload = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(payload)));\n const encodedToken = `${encodedHeader}.${encodedPayload}`;\n const signature = await window.crypto.subtle.sign(\n {\n name: \"ECDSA\",\n hash: { name: \"SHA-256\" }\n },\n privateKey,\n new TextEncoder().encode(encodedToken)\n );\n const encodedSignature = CryptoUtils.encodeBase64Url(new Uint8Array(signature));\n return `${encodedToken}.${encodedSignature}`;\n }\n static async generateSignedJwtWithHmac(header, payload, secretKey) {\n const encodedHeader = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(header)));\n const encodedPayload = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(payload)));\n const encodedToken = `${encodedHeader}.${encodedPayload}`;\n const signature = await window.crypto.subtle.sign(\n \"HMAC\",\n secretKey,\n new TextEncoder().encode(encodedToken)\n );\n const encodedSignature = CryptoUtils.encodeBase64Url(new Uint8Array(signature));\n return `${encodedToken}.${encodedSignature}`;\n }\n};\n\n// src/utils/CryptoUtils.ts\nvar UUID_V4_TEMPLATE = \"10000000-1000-4000-8000-100000000000\";\nvar toBase64 = (val) => btoa([...new Uint8Array(val)].map((chr) => String.fromCharCode(chr)).join(\"\"));\nvar _CryptoUtils = class _CryptoUtils {\n static _randomWord() {\n const arr = new Uint32Array(1);\n crypto.getRandomValues(arr);\n return arr[0];\n }\n /**\n * Generates RFC4122 version 4 guid\n */\n static generateUUIDv4() {\n const uuid = UUID_V4_TEMPLATE.replace(\n /[018]/g,\n (c) => (+c ^ _CryptoUtils._randomWord() & 15 >> +c / 4).toString(16)\n );\n return uuid.replace(/-/g, \"\");\n }\n /**\n * PKCE: Generate a code verifier\n */\n static generateCodeVerifier() {\n return _CryptoUtils.generateUUIDv4() + _CryptoUtils.generateUUIDv4() + _CryptoUtils.generateUUIDv4();\n }\n /**\n * PKCE: Generate a code challenge\n */\n static async generateCodeChallenge(code_verifier) {\n if (!crypto.subtle) {\n throw new Error(\"Crypto.subtle is available only in secure contexts (HTTPS).\");\n }\n try {\n const encoder = new TextEncoder();\n const data = encoder.encode(code_verifier);\n const hashed = await crypto.subtle.digest(\"SHA-256\", data);\n return toBase64(hashed).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n } catch (err) {\n Logger.error(\"CryptoUtils.generateCodeChallenge\", err);\n throw err;\n }\n }\n /**\n * Generates a base64-encoded string for a basic auth header\n */\n static generateBasicAuth(client_id, client_secret) {\n const encoder = new TextEncoder();\n const data = encoder.encode([client_id, client_secret].join(\":\"));\n return toBase64(data);\n }\n /**\n * Generates a hash of a string using a given algorithm\n * @param alg\n * @param message\n */\n static async hash(alg, message) {\n const msgUint8 = new TextEncoder().encode(message);\n const hashBuffer = await crypto.subtle.digest(alg, msgUint8);\n return new Uint8Array(hashBuffer);\n }\n /**\n * Generates a rfc7638 compliant jwk thumbprint\n * @param jwk\n */\n static async customCalculateJwkThumbprint(jwk) {\n let jsonObject;\n switch (jwk.kty) {\n case \"RSA\":\n jsonObject = {\n \"e\": jwk.e,\n \"kty\": jwk.kty,\n \"n\": jwk.n\n };\n break;\n case \"EC\":\n jsonObject = {\n \"crv\": jwk.crv,\n \"kty\": jwk.kty,\n \"x\": jwk.x,\n \"y\": jwk.y\n };\n break;\n case \"OKP\":\n jsonObject = {\n \"crv\": jwk.crv,\n \"kty\": jwk.kty,\n \"x\": jwk.x\n };\n break;\n case \"oct\":\n jsonObject = {\n \"crv\": jwk.k,\n \"kty\": jwk.kty\n };\n break;\n default:\n throw new Error(\"Unknown jwk type\");\n }\n const utf8encodedAndHashed = await _CryptoUtils.hash(\"SHA-256\", JSON.stringify(jsonObject));\n return _CryptoUtils.encodeBase64Url(utf8encodedAndHashed);\n }\n static async generateDPoPProof({\n url,\n accessToken,\n httpMethod,\n keyPair,\n nonce\n }) {\n let hashedToken;\n let encodedHash;\n const payload = {\n \"jti\": window.crypto.randomUUID(),\n \"htm\": httpMethod != null ? httpMethod : \"GET\",\n \"htu\": url,\n \"iat\": Math.floor(Date.now() / 1e3)\n };\n if (accessToken) {\n hashedToken = await _CryptoUtils.hash(\"SHA-256\", accessToken);\n encodedHash = _CryptoUtils.encodeBase64Url(hashedToken);\n payload.ath = encodedHash;\n }\n if (nonce) {\n payload.nonce = nonce;\n }\n try {\n const publicJwk = await crypto.subtle.exportKey(\"jwk\", keyPair.publicKey);\n const header = {\n \"alg\": \"ES256\",\n \"typ\": \"dpop+jwt\",\n \"jwk\": {\n \"crv\": publicJwk.crv,\n \"kty\": publicJwk.kty,\n \"x\": publicJwk.x,\n \"y\": publicJwk.y\n }\n };\n return await JwtUtils.generateSignedJwt(header, payload, keyPair.privateKey);\n } catch (err) {\n if (err instanceof TypeError) {\n throw new Error(`Error exporting dpop public key: ${err.message}`);\n } else {\n throw err;\n }\n }\n }\n static async generateDPoPJkt(keyPair) {\n try {\n const publicJwk = await crypto.subtle.exportKey(\"jwk\", keyPair.publicKey);\n return await _CryptoUtils.customCalculateJwkThumbprint(publicJwk);\n } catch (err) {\n if (err instanceof TypeError) {\n throw new Error(`Could not retrieve dpop keys from storage: ${err.message}`);\n } else {\n throw err;\n }\n }\n }\n static async generateDPoPKeys() {\n return await window.crypto.subtle.generateKey(\n {\n name: \"ECDSA\",\n namedCurve: \"P-256\"\n },\n false,\n [\"sign\", \"verify\"]\n );\n }\n /**\n * Generates a client assertion JWT for client_secret_jwt authentication\n * @param client_id The client identifier\n * @param client_secret The client secret\n * @param audience The token endpoint URL (audience)\n * @param algorithm The HMAC algorithm to use (HS256, HS384, HS512). Defaults to HS256\n */\n static async generateClientAssertionJwt(client_id, client_secret, audience, algorithm = \"HS256\") {\n const now = Math.floor(Date.now() / 1e3);\n const header = {\n \"alg\": algorithm,\n \"typ\": \"JWT\"\n };\n const payload = {\n \"iss\": client_id,\n \"sub\": client_id,\n \"aud\": audience,\n \"jti\": _CryptoUtils.generateUUIDv4(),\n \"exp\": now + 300,\n // 5 minutes\n \"iat\": now\n };\n const hashMap = {\n \"HS256\": \"SHA-256\",\n \"HS384\": \"SHA-384\",\n \"HS512\": \"SHA-512\"\n };\n const hashFunction = hashMap[algorithm];\n if (!hashFunction) {\n throw new Error(`Unsupported algorithm: ${algorithm}. Supported algorithms are: HS256, HS384, HS512`);\n }\n const encoder = new TextEncoder();\n const secretKey = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(client_secret),\n { name: \"HMAC\", hash: hashFunction },\n false,\n [\"sign\"]\n );\n return await JwtUtils.generateSignedJwtWithHmac(header, payload, secretKey);\n }\n};\n/**\n * Generates a base64url encoded string\n */\n_CryptoUtils.encodeBase64Url = (input) => {\n return toBase64(input).replace(/=/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\");\n};\nvar CryptoUtils = _CryptoUtils;\n\n// src/utils/Event.ts\nvar Event = class {\n constructor(_name) {\n this._name = _name;\n this._callbacks = [];\n this._logger = new Logger(`Event('${this._name}')`);\n }\n addHandler(cb) {\n this._callbacks.push(cb);\n return () => this.removeHandler(cb);\n }\n removeHandler(cb) {\n const idx = this._callbacks.lastIndexOf(cb);\n if (idx >= 0) {\n this._callbacks.splice(idx, 1);\n }\n }\n async raise(...ev) {\n this._logger.debug(\"raise:\", ...ev);\n for (const cb of this._callbacks) {\n await cb(...ev);\n }\n }\n};\n\n// src/utils/PopupUtils.ts\nvar PopupUtils = class {\n /**\n * Populates a map of window features with a placement centered in front of\n * the current window. If no explicit width is given, a default value is\n * binned into [800, 720, 600, 480, 360] based on the current window's width.\n */\n static center({ ...features }) {\n var _a, _b, _c;\n if (features.width == null)\n features.width = (_a = [800, 720, 600, 480].find((width) => width <= window.outerWidth / 1.618)) != null ? _a : 360;\n (_b = features.left) != null ? _b : features.left = Math.max(0, Math.round(window.screenX + (window.outerWidth - features.width) / 2));\n if (features.height != null)\n (_c = features.top) != null ? _c : features.top = Math.max(0, Math.round(window.screenY + (window.outerHeight - features.height) / 2));\n return features;\n }\n static serialize(features) {\n return Object.entries(features).filter(([, value]) => value != null).map(([key, value]) => `${key}=${typeof value !== \"boolean\" ? value : value ? \"yes\" : \"no\"}`).join(\",\");\n }\n};\n\n// src/utils/Timer.ts\nvar Timer = class _Timer extends Event {\n constructor() {\n super(...arguments);\n this._logger = new Logger(`Timer('${this._name}')`);\n this._timerHandle = null;\n this._expiration = 0;\n this._callback = () => {\n const diff = this._expiration - _Timer.getEpochTime();\n this._logger.debug(\"timer completes in\", diff);\n if (this._expiration <= _Timer.getEpochTime()) {\n this.cancel();\n void super.raise();\n }\n };\n }\n // get the time\n static getEpochTime() {\n return Math.floor(Date.now() / 1e3);\n }\n init(durationInSeconds) {\n const logger2 = this._logger.create(\"init\");\n durationInSeconds = Math.max(Math.floor(durationInSeconds), 1);\n const expiration = _Timer.getEpochTime() + durationInSeconds;\n if (this.expiration === expiration && this._timerHandle) {\n logger2.debug(\"skipping since already initialized for expiration at\", this.expiration);\n return;\n }\n this.cancel();\n logger2.debug(\"using duration\", durationInSeconds);\n this._expiration = expiration;\n const timerDurationInSeconds = Math.min(durationInSeconds, 5);\n this._timerHandle = setInterval(this._callback, timerDurationInSeconds * 1e3);\n }\n get expiration() {\n return this._expiration;\n }\n cancel() {\n this._logger.create(\"cancel\");\n if (this._timerHandle) {\n clearInterval(this._timerHandle);\n this._timerHandle = null;\n }\n }\n};\n\n// src/utils/UrlUtils.ts\nvar UrlUtils = class {\n static readParams(url, responseMode = \"query\") {\n if (!url) throw new TypeError(\"Invalid URL\");\n const parsedUrl = new URL(url, \"http://127.0.0.1\");\n const params = parsedUrl[responseMode === \"fragment\" ? \"hash\" : \"search\"];\n return new URLSearchParams(params.slice(1));\n }\n};\nvar URL_STATE_DELIMITER = \";\";\n\n// src/errors/ErrorResponse.ts\nvar ErrorResponse = class extends Error {\n constructor(args, form) {\n var _a, _b, _c;\n super(args.error_description || args.error || \"\");\n this.form = form;\n /** Marker to detect class: \"ErrorResponse\" */\n this.name = \"ErrorResponse\";\n if (!args.error) {\n Logger.error(\"ErrorResponse\", \"No error passed\");\n throw new Error(\"No error passed\");\n }\n this.error = args.error;\n this.error_description = (_a = args.error_description) != null ? _a : null;\n this.error_uri = (_b = args.error_uri) != null ? _b : null;\n this.state = args.userState;\n this.session_state = (_c = args.session_state) != null ? _c : null;\n this.url_state = args.url_state;\n }\n};\n\n// src/errors/ErrorTimeout.ts\nvar ErrorTimeout = class extends Error {\n constructor(message) {\n super(message);\n /** Marker to detect class: \"ErrorTimeout\" */\n this.name = \"ErrorTimeout\";\n }\n};\n\n// src/AccessTokenEvents.ts\nvar AccessTokenEvents = class {\n constructor(args) {\n this._logger = new Logger(\"AccessTokenEvents\");\n this._expiringTimer = new Timer(\"Access token expiring\");\n this._expiredTimer = new Timer(\"Access token expired\");\n this._expiringNotificationTimeInSeconds = args.expiringNotificationTimeInSeconds;\n }\n async load(container) {\n const logger2 = this._logger.create(\"load\");\n if (container.access_token && container.expires_in !== void 0) {\n const duration = container.expires_in;\n logger2.debug(\"access token present, remaining duration:\", duration);\n if (duration > 0) {\n let expiring = duration - this._expiringNotificationTimeInSeconds;\n if (expiring <= 0) {\n expiring = 1;\n }\n logger2.debug(\"registering expiring timer, raising in\", expiring, \"seconds\");\n this._expiringTimer.init(expiring);\n } else {\n logger2.debug(\"canceling existing expiring timer because we're past expiration.\");\n this._expiringTimer.cancel();\n }\n const expired = duration + 1;\n logger2.debug(\"registering expired timer, raising in\", expired, \"seconds\");\n this._expiredTimer.init(expired);\n } else {\n this._expiringTimer.cancel();\n this._expiredTimer.cancel();\n }\n }\n async unload() {\n this._logger.debug(\"unload: canceling existing access token timers\");\n this._expiringTimer.cancel();\n this._expiredTimer.cancel();\n }\n /**\n * Add callback: Raised prior to the access token expiring.\n */\n addAccessTokenExpiring(cb) {\n return this._expiringTimer.addHandler(cb);\n }\n /**\n * Remove callback: Raised prior to the access token expiring.\n */\n removeAccessTokenExpiring(cb) {\n this._expiringTimer.removeHandler(cb);\n }\n /**\n * Add callback: Raised after the access token has expired.\n */\n addAccessTokenExpired(cb) {\n return this._expiredTimer.addHandler(cb);\n }\n /**\n * Remove callback: Raised after the access token has expired.\n */\n removeAccessTokenExpired(cb) {\n this._expiredTimer.removeHandler(cb);\n }\n};\n\n// src/CheckSessionIFrame.ts\nvar CheckSessionIFrame = class {\n constructor(_callback, _client_id, url, _intervalInSeconds, _stopOnError) {\n this._callback = _callback;\n this._client_id = _client_id;\n this._intervalInSeconds = _intervalInSeconds;\n this._stopOnError = _stopOnError;\n this._logger = new Logger(\"CheckSessionIFrame\");\n this._timer = null;\n this._session_state = null;\n this._message = (e) => {\n if (e.origin === this._frame_origin && e.source === this._frame.contentWindow) {\n if (e.data === \"error\") {\n this._logger.error(\"error message from check session op iframe\");\n if (this._stopOnError) {\n this.stop();\n }\n } else if (e.data === \"changed\") {\n this._logger.debug(\"changed message from check session op iframe\");\n this.stop();\n void this._callback();\n } else {\n this._logger.debug(e.data + \" message from check session op iframe\");\n }\n }\n };\n const parsedUrl = new URL(url);\n this._frame_origin = parsedUrl.origin;\n this._frame = window.document.createElement(\"iframe\");\n this._frame.style.visibility = \"hidden\";\n this._frame.style.position = \"fixed\";\n this._frame.style.left = \"-1000px\";\n this._frame.style.top = \"0\";\n this._frame.width = \"0\";\n this._frame.height = \"0\";\n this._frame.src = parsedUrl.href;\n }\n load() {\n return new Promise((resolve) => {\n this._frame.onload = () => {\n resolve();\n };\n window.document.body.appendChild(this._frame);\n window.addEventListener(\"message\", this._message, false);\n });\n }\n start(session_state) {\n if (this._session_state === session_state) {\n return;\n }\n this._logger.create(\"start\");\n this.stop();\n this._session_state = session_state;\n const send = () => {\n if (!this._frame.contentWindow || !this._session_state) {\n return;\n }\n this._frame.contentWindow.postMessage(this._client_id + \" \" + this._session_state, this._frame_origin);\n };\n send();\n this._timer = setInterval(send, this._intervalInSeconds * 1e3);\n }\n stop() {\n this._logger.create(\"stop\");\n this._session_state = null;\n if (this._timer) {\n clearInterval(this._timer);\n this._timer = null;\n }\n }\n};\n\n// src/InMemoryWebStorage.ts\nvar InMemoryWebStorage = class {\n constructor() {\n this._logger = new Logger(\"InMemoryWebStorage\");\n this._data = {};\n }\n clear() {\n this._logger.create(\"clear\");\n this._data = {};\n }\n getItem(key) {\n this._logger.create(`getItem('${key}')`);\n return this._data[key];\n }\n setItem(key, value) {\n this._logger.create(`setItem('${key}')`);\n this._data[key] = value;\n }\n removeItem(key) {\n this._logger.create(`removeItem('${key}')`);\n delete this._data[key];\n }\n get length() {\n return Object.getOwnPropertyNames(this._data).length;\n }\n key(index) {\n return Object.getOwnPropertyNames(this._data)[index];\n }\n};\n\n// src/errors/ErrorDPoPNonce.ts\nvar ErrorDPoPNonce = class extends Error {\n constructor(nonce, message) {\n super(message);\n /** Marker to detect class: \"ErrorDPoPNonce\" */\n this.name = \"ErrorDPoPNonce\";\n this.nonce = nonce;\n }\n};\n\n// src/JsonService.ts\nvar JsonService = class {\n constructor(additionalContentTypes = [], _jwtHandler = null, _extraHeaders = {}) {\n this._jwtHandler = _jwtHandler;\n this._extraHeaders = _extraHeaders;\n this._logger = new Logger(\"JsonService\");\n this._contentTypes = [];\n this._contentTypes.push(...additionalContentTypes, \"application/json\");\n if (_jwtHandler) {\n this._contentTypes.push(\"application/jwt\");\n }\n }\n async fetchWithTimeout(input, init = {}) {\n const { timeoutInSeconds, ...initFetch } = init;\n if (!timeoutInSeconds) {\n return await fetch(input, initFetch);\n }\n const controller = new AbortController();\n const timeoutId = setTimeout(() => controller.abort(), timeoutInSeconds * 1e3);\n try {\n const response = await fetch(input, {\n ...init,\n signal: controller.signal\n });\n return response;\n } catch (err) {\n if (err instanceof DOMException && err.name === \"AbortError\") {\n throw new ErrorTimeout(\"Network timed out\");\n }\n throw err;\n } finally {\n clearTimeout(timeoutId);\n }\n }\n async getJson(url, {\n token,\n credentials,\n timeoutInSeconds\n } = {}) {\n const logger2 = this._logger.create(\"getJson\");\n const headers = {\n \"Accept\": this._contentTypes.join(\", \")\n };\n if (token) {\n logger2.debug(\"token passed, setting Authorization header\");\n headers[\"Authorization\"] = \"Bearer \" + token;\n }\n this._appendExtraHeaders(headers);\n let response;\n try {\n logger2.debug(\"url:\", url);\n response = await this.fetchWithTimeout(url, { method: \"GET\", headers, timeoutInSeconds, credentials });\n } catch (err) {\n logger2.error(\"Network Error\");\n throw err;\n }\n logger2.debug(\"HTTP response received, status\", response.status);\n const contentType = response.headers.get(\"Content-Type\");\n if (contentType && !this._contentTypes.find((item) => contentType.startsWith(item))) {\n logger2.throw(new Error(`Invalid response Content-Type: ${contentType != null ? contentType : \"undefined\"}, from URL: ${url}`));\n }\n if (response.ok && this._jwtHandler && (contentType == null ? void 0 : contentType.startsWith(\"application/jwt\"))) {\n return await this._jwtHandler(await response.text());\n }\n let json;\n try {\n json = await response.json();\n } catch (err) {\n logger2.error(\"Error parsing JSON response\", err);\n if (response.ok) throw err;\n throw new Error(`${response.statusText} (${response.status})`);\n }\n if (!response.ok) {\n logger2.error(\"Error from server:\", json);\n if (json.error) {\n throw new ErrorResponse(json);\n }\n throw new Error(`${response.statusText} (${response.status}): ${JSON.stringify(json)}`);\n }\n return json;\n }\n async postForm(url, {\n body,\n basicAuth,\n timeoutInSeconds,\n initCredentials,\n extraHeaders\n }) {\n const logger2 = this._logger.create(\"postForm\");\n const headers = {\n \"Accept\": this._contentTypes.join(\", \"),\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n ...extraHeaders\n };\n if (basicAuth !== void 0) {\n headers[\"Authorization\"] = \"Basic \" + basicAuth;\n }\n this._appendExtraHeaders(headers);\n let response;\n try {\n logger2.debug(\"url:\", url);\n response = await this.fetchWithTimeout(url, { method: \"POST\", headers, body, timeoutInSeconds, credentials: initCredentials });\n } catch (err) {\n logger2.error(\"Network error\");\n throw err;\n }\n logger2.debug(\"HTTP response received, status\", response.status);\n const contentType = response.headers.get(\"Content-Type\");\n if (contentType && !this._contentTypes.find((item) => contentType.startsWith(item))) {\n throw new Error(`Invalid response Content-Type: ${contentType != null ? contentType : \"undefined\"}, from URL: ${url}`);\n }\n const responseText = await response.text();\n let json = {};\n if (responseText) {\n try {\n json = JSON.parse(responseText);\n } catch (err) {\n logger2.error(\"Error parsing JSON response\", err);\n if (response.ok) throw err;\n throw new Error(`${response.statusText} (${response.status})`);\n }\n }\n if (!response.ok) {\n logger2.error(\"Error from server:\", json);\n if (response.headers.has(\"dpop-nonce\")) {\n const nonce = response.headers.get(\"dpop-nonce\");\n throw new ErrorDPoPNonce(nonce, `${JSON.stringify(json)}`);\n }\n if (json.error) {\n throw new ErrorResponse(json, body);\n }\n throw new Error(`${response.statusText} (${response.status}): ${JSON.stringify(json)}`);\n }\n return json;\n }\n _appendExtraHeaders(headers) {\n const logger2 = this._logger.create(\"appendExtraHeaders\");\n const customKeys = Object.keys(this._extraHeaders);\n const protectedHeaders = [\n \"accept\",\n \"content-type\"\n ];\n const preventOverride = [\n \"authorization\"\n ];\n if (customKeys.length === 0) {\n return;\n }\n customKeys.forEach((headerName) => {\n if (protectedHeaders.includes(headerName.toLocaleLowerCase())) {\n logger2.warn(\"Protected header could not be set\", headerName, protectedHeaders);\n return;\n }\n if (preventOverride.includes(headerName.toLocaleLowerCase()) && Object.keys(headers).includes(headerName)) {\n logger2.warn(\"Header could not be overridden\", headerName, preventOverride);\n return;\n }\n const content = typeof this._extraHeaders[headerName] === \"function\" ? this._extraHeaders[headerName]() : this._extraHeaders[headerName];\n if (content && content !== \"\") {\n headers[headerName] = content;\n }\n });\n }\n};\n\n// src/MetadataService.ts\nvar MetadataService = class {\n constructor(_settings) {\n this._settings = _settings;\n this._logger = new Logger(\"MetadataService\");\n this._signingKeys = null;\n this._metadata = null;\n this._metadataUrl = this._settings.metadataUrl;\n this._jsonService = new JsonService(\n [\"application/jwk-set+json\"],\n null,\n this._settings.extraHeaders\n );\n if (this._settings.signingKeys) {\n this._logger.debug(\"using signingKeys from settings\");\n this._signingKeys = this._settings.signingKeys;\n }\n if (this._settings.metadata) {\n this._logger.debug(\"using metadata from settings\");\n this._metadata = this._settings.metadata;\n }\n if (this._settings.fetchRequestCredentials) {\n this._logger.debug(\"using fetchRequestCredentials from settings\");\n this._fetchRequestCredentials = this._settings.fetchRequestCredentials;\n }\n }\n resetSigningKeys() {\n this._signingKeys = null;\n }\n async getMetadata() {\n const logger2 = this._logger.create(\"getMetadata\");\n if (this._metadata) {\n logger2.debug(\"using cached values\");\n return this._metadata;\n }\n if (!this._metadataUrl) {\n logger2.throw(new Error(\"No authority or metadataUrl configured on settings\"));\n throw null;\n }\n logger2.debug(\"getting metadata from\", this._metadataUrl);\n const metadata = await this._jsonService.getJson(this._metadataUrl, { credentials: this._fetchRequestCredentials, timeoutInSeconds: this._settings.requestTimeoutInSeconds });\n logger2.debug(\"merging remote JSON with seed metadata\");\n this._metadata = Object.assign({}, metadata, this._settings.metadataSeed);\n return this._metadata;\n }\n getIssuer() {\n return this._getMetadataProperty(\"issuer\");\n }\n getAuthorizationEndpoint() {\n return this._getMetadataProperty(\"authorization_endpoint\");\n }\n getUserInfoEndpoint() {\n return this._getMetadataProperty(\"userinfo_endpoint\");\n }\n getTokenEndpoint(optional = true) {\n return this._getMetadataProperty(\"token_endpoint\", optional);\n }\n getCheckSessionIframe() {\n return this._getMetadataProperty(\"check_session_iframe\", true);\n }\n getEndSessionEndpoint() {\n return this._getMetadataProperty(\"end_session_endpoint\", true);\n }\n getRevocationEndpoint(optional = true) {\n return this._getMetadataProperty(\"revocation_endpoint\", optional);\n }\n getKeysEndpoint(optional = true) {\n return this._getMetadataProperty(\"jwks_uri\", optional);\n }\n async _getMetadataProperty(name, optional = false) {\n const logger2 = this._logger.create(`_getMetadataProperty('${name}')`);\n const metadata = await this.getMetadata();\n logger2.debug(\"resolved\");\n if (metadata[name] === void 0) {\n if (optional === true) {\n logger2.warn(\"Metadata does not contain optional property\");\n return void 0;\n }\n logger2.throw(new Error(\"Metadata does not contain property \" + name));\n }\n return metadata[name];\n }\n async getSigningKeys() {\n const logger2 = this._logger.create(\"getSigningKeys\");\n if (this._signingKeys) {\n logger2.debug(\"returning signingKeys from cache\");\n return this._signingKeys;\n }\n const jwks_uri = await this.getKeysEndpoint(false);\n logger2.debug(\"got jwks_uri\", jwks_uri);\n const keySet = await this._jsonService.getJson(jwks_uri, { timeoutInSeconds: this._settings.requestTimeoutInSeconds });\n logger2.debug(\"got key set\", keySet);\n if (!Array.isArray(keySet.keys)) {\n logger2.throw(new Error(\"Missing keys on keyset\"));\n throw null;\n }\n this._signingKeys = keySet.keys;\n return this._signingKeys;\n }\n};\n\n// src/WebStorageStateStore.ts\nvar WebStorageStateStore = class {\n constructor({\n prefix = \"oidc.\",\n store = localStorage\n } = {}) {\n this._logger = new Logger(\"WebStorageStateStore\");\n this._store = store;\n this._prefix = prefix;\n }\n async set(key, value) {\n this._logger.create(`set('${key}')`);\n key = this._prefix + key;\n await this._store.setItem(key, value);\n }\n async get(key) {\n this._logger.create(`get('${key}')`);\n key = this._prefix + key;\n const item = await this._store.getItem(key);\n return item;\n }\n async remove(key) {\n this._logger.create(`remove('${key}')`);\n key = this._prefix + key;\n const item = await this._store.getItem(key);\n await this._store.removeItem(key);\n return item;\n }\n async getAllKeys() {\n this._logger.create(\"getAllKeys\");\n const len = await this._store.length;\n const keys = [];\n for (let index = 0; index < len; index++) {\n const key = await this._store.key(index);\n if (key && key.indexOf(this._prefix) === 0) {\n keys.push(key.substr(this._prefix.length));\n }\n }\n return keys;\n }\n};\n\n// src/OidcClientSettings.ts\nvar DefaultResponseType = \"code\";\nvar DefaultScope = \"openid\";\nvar DefaultClientAuthentication = \"client_secret_post\";\nvar DefaultStaleStateAgeInSeconds = 60 * 15;\nvar OidcClientSettingsStore = class {\n constructor({\n // metadata related\n authority,\n metadataUrl,\n metadata,\n signingKeys,\n metadataSeed,\n // client related\n client_id,\n client_secret,\n response_type = DefaultResponseType,\n scope = DefaultScope,\n redirect_uri,\n post_logout_redirect_uri,\n client_authentication = DefaultClientAuthentication,\n token_endpoint_auth_signing_alg = \"HS256\",\n // optional protocol\n prompt,\n display,\n max_age,\n ui_locales,\n acr_values,\n resource,\n response_mode,\n // behavior flags\n filterProtocolClaims = true,\n loadUserInfo = false,\n requestTimeoutInSeconds,\n staleStateAgeInSeconds = DefaultStaleStateAgeInSeconds,\n mergeClaimsStrategy = { array: \"replace\" },\n disablePKCE = false,\n // other behavior\n stateStore,\n revokeTokenAdditionalContentTypes,\n fetchRequestCredentials,\n refreshTokenAllowedScope,\n // extra\n extraQueryParams = {},\n extraTokenParams = {},\n extraHeaders = {},\n dpop,\n omitScopeWhenRequesting = false\n }) {\n var _a;\n this.authority = authority;\n if (metadataUrl) {\n this.metadataUrl = metadataUrl;\n } else {\n this.metadataUrl = authority;\n if (authority) {\n if (!this.metadataUrl.endsWith(\"/\")) {\n this.metadataUrl += \"/\";\n }\n this.metadataUrl += \".well-known/openid-configuration\";\n }\n }\n this.metadata = metadata;\n this.metadataSeed = metadataSeed;\n this.signingKeys = signingKeys;\n this.client_id = client_id;\n this.client_secret = client_secret;\n this.response_type = response_type;\n this.scope = scope;\n this.redirect_uri = redirect_uri;\n this.post_logout_redirect_uri = post_logout_redirect_uri;\n this.client_authentication = client_authentication;\n this.token_endpoint_auth_signing_alg = token_endpoint_auth_signing_alg;\n this.prompt = prompt;\n this.display = display;\n this.max_age = max_age;\n this.ui_locales = ui_locales;\n this.acr_values = acr_values;\n this.resource = resource;\n this.response_mode = response_mode;\n this.filterProtocolClaims = filterProtocolClaims != null ? filterProtocolClaims : true;\n this.loadUserInfo = !!loadUserInfo;\n this.staleStateAgeInSeconds = staleStateAgeInSeconds;\n this.mergeClaimsStrategy = mergeClaimsStrategy;\n this.omitScopeWhenRequesting = omitScopeWhenRequesting;\n this.disablePKCE = !!disablePKCE;\n this.revokeTokenAdditionalContentTypes = revokeTokenAdditionalContentTypes;\n this.fetchRequestCredentials = fetchRequestCredentials ? fetchRequestCredentials : \"same-origin\";\n this.requestTimeoutInSeconds = requestTimeoutInSeconds;\n if (stateStore) {\n this.stateStore = stateStore;\n } else {\n const store = typeof window !== \"undefined\" ? window.localStorage : new InMemoryWebStorage();\n this.stateStore = new WebStorageStateStore({ store });\n }\n this.refreshTokenAllowedScope = refreshTokenAllowedScope;\n this.extraQueryParams = extraQueryParams;\n this.extraTokenParams = extraTokenParams;\n this.extraHeaders = extraHeaders;\n this.dpop = dpop;\n if (this.dpop && !((_a = this.dpop) == null ? void 0 : _a.store)) {\n throw new Error(\"A DPoPStore is required when dpop is enabled\");\n }\n }\n};\n\n// src/UserInfoService.ts\nvar UserInfoService = class {\n constructor(_settings, _metadataService) {\n this._settings = _settings;\n this._metadataService = _metadataService;\n this._logger = new Logger(\"UserInfoService\");\n this._getClaimsFromJwt = async (responseText) => {\n const logger2 = this._logger.create(\"_getClaimsFromJwt\");\n try {\n const payload = JwtUtils.decode(responseText);\n logger2.debug(\"JWT decoding successful\");\n return payload;\n } catch (err) {\n logger2.error(\"Error parsing JWT response\");\n throw err;\n }\n };\n this._jsonService = new JsonService(\n void 0,\n this._getClaimsFromJwt,\n this._settings.extraHeaders\n );\n }\n async getClaims(token) {\n const logger2 = this._logger.create(\"getClaims\");\n if (!token) {\n this._logger.throw(new Error(\"No token passed\"));\n }\n const url = await this._metadataService.getUserInfoEndpoint();\n logger2.debug(\"got userinfo url\", url);\n const claims = await this._jsonService.getJson(url, {\n token,\n credentials: this._settings.fetchRequestCredentials,\n timeoutInSeconds: this._settings.requestTimeoutInSeconds\n });\n logger2.debug(\"got claims\", claims);\n return claims;\n }\n};\n\n// src/TokenClient.ts\nvar TokenClient = class {\n constructor(_settings, _metadataService) {\n this._settings = _settings;\n this._metadataService = _metadataService;\n this._logger = new Logger(\"TokenClient\");\n this._jsonService = new JsonService(\n this._settings.revokeTokenAdditionalContentTypes,\n null,\n this._settings.extraHeaders\n );\n }\n /**\n * Exchange code.\n *\n * @see https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3\n */\n async exchangeCode({\n grant_type = \"authorization_code\",\n redirect_uri = this._settings.redirect_uri,\n client_id = this._settings.client_id,\n client_secret = this._settings.client_secret,\n extraHeaders,\n ...args\n }) {\n const logger2 = this._logger.create(\"exchangeCode\");\n if (!client_id) {\n logger2.throw(new Error(\"A client_id is required\"));\n }\n if (!redirect_uri) {\n logger2.throw(new Error(\"A redirect_uri is required\"));\n }\n if (!args.code) {\n logger2.throw(new Error(\"A code is required\"));\n }\n const params = new URLSearchParams({ grant_type, redirect_uri });\n for (const [key, value] of Object.entries(args)) {\n if (value != null) {\n params.set(key, value);\n }\n }\n if ((this._settings.client_authentication === \"client_secret_basic\" || this._settings.client_authentication === \"client_secret_jwt\") && (client_secret === void 0 || client_secret === null)) {\n logger2.throw(new Error(\"A client_secret is required\"));\n throw null;\n }\n let basicAuth;\n const url = await this._metadataService.getTokenEndpoint(false);\n switch (this._settings.client_authentication) {\n case \"client_secret_basic\":\n basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret);\n break;\n case \"client_secret_post\":\n params.append(\"client_id\", client_id);\n if (client_secret) {\n params.append(\"client_secret\", client_secret);\n }\n break;\n case \"client_secret_jwt\": {\n const clientAssertion = await CryptoUtils.generateClientAssertionJwt(client_id, client_secret, url, this._settings.token_endpoint_auth_signing_alg);\n params.append(\"client_id\", client_id);\n params.append(\"client_assertion_type\", \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\");\n params.append(\"client_assertion\", clientAssertion);\n break;\n }\n }\n logger2.debug(\"got token endpoint\");\n const response = await this._jsonService.postForm(url, {\n body: params,\n basicAuth,\n timeoutInSeconds: this._settings.requestTimeoutInSeconds,\n initCredentials: this._settings.fetchRequestCredentials,\n extraHeaders\n });\n logger2.debug(\"got response\");\n return response;\n }\n /**\n * Exchange credentials.\n *\n * @see https://www.rfc-editor.org/rfc/rfc6749#section-4.3.2\n */\n async exchangeCredentials({\n grant_type = \"password\",\n client_id = this._settings.client_id,\n client_secret = this._settings.client_secret,\n scope = this._settings.scope,\n ...args\n }) {\n const logger2 = this._logger.create(\"exchangeCredentials\");\n if (!client_id) {\n logger2.throw(new Error(\"A client_id is required\"));\n }\n const params = new URLSearchParams({ grant_type });\n if (!this._settings.omitScopeWhenRequesting) {\n params.set(\"scope\", scope);\n }\n for (const [key, value] of Object.entries(args)) {\n if (value != null) {\n params.set(key, value);\n }\n }\n if ((this._settings.client_authentication === \"client_secret_basic\" || this._settings.client_authentication === \"client_secret_jwt\") && (client_secret === void 0 || client_secret === null)) {\n logger2.throw(new Error(\"A client_secret is required\"));\n throw null;\n }\n let basicAuth;\n const url = await this._metadataService.getTokenEndpoint(false);\n switch (this._settings.client_authentication) {\n case \"client_secret_basic\":\n basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret);\n break;\n case \"client_secret_post\":\n params.append(\"client_id\", client_id);\n if (client_secret) {\n params.append(\"client_secret\", client_secret);\n }\n break;\n case \"client_secret_jwt\": {\n const clientAssertion = await CryptoUtils.generateClientAssertionJwt(client_id, client_secret, url, this._settings.token_endpoint_auth_signing_alg);\n params.append(\"client_id\", client_id);\n params.append(\"client_assertion_type\", \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\");\n params.append(\"client_assertion\", clientAssertion);\n break;\n }\n }\n logger2.debug(\"got token endpoint\");\n const response = await this._jsonService.postForm(url, { body: params, basicAuth, timeoutInSeconds: this._settings.requestTimeoutInSeconds, initCredentials: this._settings.fetchRequestCredentials });\n logger2.debug(\"got response\");\n return response;\n }\n /**\n * Exchange a refresh token.\n *\n * @see https://www.rfc-editor.org/rfc/rfc6749#section-6\n */\n async exchangeRefreshToken({\n grant_type = \"refresh_token\",\n client_id = this._settings.client_id,\n client_secret = this._settings.client_secret,\n timeoutInSeconds,\n extraHeaders,\n ...args\n }) {\n const logger2 = this._logger.create(\"exchangeRefreshToken\");\n if (!client_id) {\n logger2.throw(new Error(\"A client_id is required\"));\n }\n if (!args.refresh_token) {\n logger2.throw(new Error(\"A refresh_token is required\"));\n }\n const params = new URLSearchParams({ grant_type });\n for (const [key, value] of Object.entries(args)) {\n if (Array.isArray(value)) {\n value.forEach((param) => params.append(key, param));\n } else if (value != null) {\n params.set(key, value);\n }\n }\n if ((this._settings.client_authentication === \"client_secret_basic\" || this._settings.client_authentication === \"client_secret_jwt\") && (client_secret === void 0 || client_secret === null)) {\n logger2.throw(new Error(\"A client_secret is required\"));\n throw null;\n }\n let basicAuth;\n const url = await this._metadataService.getTokenEndpoint(false);\n switch (this._settings.client_authentication) {\n case \"client_secret_basic\":\n basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret);\n break;\n case \"client_secret_post\":\n params.append(\"client_id\", client_id);\n if (client_secret) {\n params.append(\"client_secret\", client_secret);\n }\n break;\n case \"client_secret_jwt\": {\n const clientAssertion = await CryptoUtils.generateClientAssertionJwt(client_id, client_secret, url, this._settings.token_endpoint_auth_signing_alg);\n params.append(\"client_id\", client_id);\n params.append(\"client_assertion_type\", \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\");\n params.append(\"client_assertion\", clientAssertion);\n break;\n }\n }\n logger2.debug(\"got token endpoint\");\n const response = await this._jsonService.postForm(url, { body: params, basicAuth, timeoutInSeconds, initCredentials: this._settings.fetchRequestCredentials, extraHeaders });\n logger2.debug(\"got response\");\n return response;\n }\n /**\n * Revoke an access or refresh token.\n *\n * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1\n */\n async revoke(args) {\n var _a;\n const logger2 = this._logger.create(\"revoke\");\n if (!args.token) {\n logger2.throw(new Error(\"A token is required\"));\n }\n const url = await this._metadataService.getRevocationEndpoint(false);\n logger2.debug(`got revocation endpoint, revoking ${(_a = args.token_type_hint) != null ? _a : \"default token type\"}`);\n const params = new URLSearchParams();\n for (const [key, value] of Object.entries(args)) {\n if (value != null) {\n params.set(key, value);\n }\n }\n params.set(\"client_id\", this._settings.client_id);\n if (this._settings.client_secret) {\n params.set(\"client_secret\", this._settings.client_secret);\n }\n await this._jsonService.postForm(url, { body: params, timeoutInSeconds: this._settings.requestTimeoutInSeconds });\n logger2.debug(\"got response\");\n }\n};\n\n// src/ResponseValidator.ts\nvar ResponseValidator = class {\n constructor(_settings, _metadataService, _claimsService) {\n this._settings = _settings;\n this._metadataService = _metadataService;\n this._claimsService = _claimsService;\n this._logger = new Logger(\"ResponseValidator\");\n this._userInfoService = new UserInfoService(this._settings, this._metadataService);\n this._tokenClient = new TokenClient(this._settings, this._metadataService);\n }\n async validateSigninResponse(response, state, extraHeaders) {\n const logger2 = this._logger.create(\"validateSigninResponse\");\n this._processSigninState(response, state);\n logger2.debug(\"state processed\");\n await this._processCode(response, state, extraHeaders);\n logger2.debug(\"code processed\");\n if (response.isOpenId) {\n this._validateIdTokenAttributes(response, \"\", state.nonce);\n }\n logger2.debug(\"tokens validated\");\n await this._processClaims(response, state == null ? void 0 : state.skipUserInfo, response.isOpenId);\n logger2.debug(\"claims processed\");\n }\n async validateCredentialsResponse(response, skipUserInfo) {\n const logger2 = this._logger.create(\"validateCredentialsResponse\");\n const shouldValidateSubClaim = response.isOpenId && !!response.id_token;\n if (shouldValidateSubClaim) {\n this._validateIdTokenAttributes(response);\n }\n logger2.debug(\"tokens validated\");\n await this._processClaims(response, skipUserInfo, shouldValidateSubClaim);\n logger2.debug(\"claims processed\");\n }\n async validateRefreshResponse(response, state) {\n var _a, _b;\n const logger2 = this._logger.create(\"validateRefreshResponse\");\n response.userState = state.data;\n (_a = response.session_state) != null ? _a : response.session_state = state.session_state;\n (_b = response.scope) != null ? _b : response.scope = state.scope;\n if (response.isOpenId && !!response.id_token) {\n this._validateIdTokenAttributes(response, state.id_token);\n logger2.debug(\"ID Token validated\");\n }\n if (!response.id_token) {\n response.id_token = state.id_token;\n response.profile = state.profile;\n }\n const hasIdToken = response.isOpenId && !!response.id_token;\n await this._processClaims(response, false, hasIdToken);\n logger2.debug(\"claims processed\");\n }\n validateSignoutResponse(response, state) {\n const logger2 = this._logger.create(\"validateSignoutResponse\");\n if (state.id !== response.state) {\n logger2.throw(new Error(\"State does not match\"));\n }\n logger2.debug(\"state validated\");\n response.userState = state.data;\n if (response.error) {\n logger2.warn(\"Response was error\", response.error);\n throw new ErrorResponse(response);\n }\n }\n _processSigninState(response, state) {\n var _a;\n const logger2 = this._logger.create(\"_processSigninState\");\n if (state.id !== response.state) {\n logger2.throw(new Error(\"State does not match\"));\n }\n if (!state.client_id) {\n logger2.throw(new Error(\"No client_id on state\"));\n }\n if (!state.authority) {\n logger2.throw(new Error(\"No authority on state\"));\n }\n if (this._settings.authority !== state.authority) {\n logger2.throw(new Error(\"authority mismatch on settings vs. signin state\"));\n }\n if (this._settings.client_id && this._settings.client_id !== state.client_id) {\n logger2.throw(new Error(\"client_id mismatch on settings vs. signin state\"));\n }\n logger2.debug(\"state validated\");\n response.userState = state.data;\n response.url_state = state.url_state;\n (_a = response.scope) != null ? _a : response.scope = state.scope;\n if (response.error) {\n logger2.warn(\"Response was error\", response.error);\n throw new ErrorResponse(response);\n }\n if (state.code_verifier && !response.code) {\n logger2.throw(new Error(\"Expected code in response\"));\n }\n }\n async _processClaims(response, skipUserInfo = false, validateSub = true) {\n const logger2 = this._logger.create(\"_processClaims\");\n response.profile = this._claimsService.filterProtocolClaims(response.profile);\n if (skipUserInfo || !this._settings.loadUserInfo || !response.access_token) {\n logger2.debug(\"not loading user info\");\n return;\n }\n logger2.debug(\"loading user info\");\n const claims = await this._userInfoService.getClaims(response.access_token);\n logger2.debug(\"user info claims received from user info endpoint\");\n if (validateSub && claims.sub !== response.profile.sub) {\n logger2.throw(new Error(\"subject from UserInfo response does not match subject in ID Token\"));\n }\n response.profile = this._claimsService.mergeClaims(response.profile, this._claimsService.filterProtocolClaims(claims));\n logger2.debug(\"user info claims received, updated profile:\", response.profile);\n }\n async _processCode(response, state, extraHeaders) {\n const logger2 = this._logger.create(\"_processCode\");\n if (response.code) {\n logger2.debug(\"Validating code\");\n const tokenResponse = await this._tokenClient.exchangeCode({\n client_id: state.client_id,\n client_secret: state.client_secret,\n code: response.code,\n redirect_uri: state.redirect_uri,\n code_verifier: state.code_verifier,\n extraHeaders,\n ...state.extraTokenParams\n });\n Object.assign(response, tokenResponse);\n } else {\n logger2.debug(\"No code to process\");\n }\n }\n _validateIdTokenAttributes(response, existingToken, nonce) {\n var _a;\n const logger2 = this._logger.create(\"_validateIdTokenAttributes\");\n logger2.debug(\"decoding ID Token JWT\");\n const incoming = JwtUtils.decode((_a = response.id_token) != null ? _a : \"\");\n if (!incoming.sub) {\n logger2.throw(new Error(\"ID Token is missing a subject claim\"));\n }\n if (nonce && incoming.nonce !== nonce) {\n logger2.throw(new Error(\"nonce in id_token does not match nonce in client storage\"));\n }\n if (existingToken) {\n const existing = JwtUtils.decode(existingToken);\n if (incoming.sub !== existing.sub) {\n logger2.throw(new Error(\"sub in id_token does not match current sub\"));\n }\n if (incoming.auth_time && incoming.auth_time !== existing.auth_time) {\n logger2.throw(new Error(\"auth_time in id_token does not match original auth_time\"));\n }\n if (incoming.azp && incoming.azp !== existing.azp) {\n logger2.throw(new Error(\"azp in id_token does not match original azp\"));\n }\n if (!incoming.azp && existing.azp) {\n logger2.throw(new Error(\"azp not in id_token, but present in original id_token\"));\n }\n }\n response.profile = incoming;\n }\n};\n\n// src/State.ts\nvar State = class _State {\n constructor(args) {\n this.id = args.id || CryptoUtils.generateUUIDv4();\n this.data = args.data;\n if (args.created && args.created > 0) {\n this.created = args.created;\n } else {\n this.created = Timer.getEpochTime();\n }\n this.request_type = args.request_type;\n this.url_state = args.url_state;\n }\n toStorageString() {\n new Logger(\"State\").create(\"toStorageString\");\n return JSON.stringify({\n id: this.id,\n data: this.data,\n created: this.created,\n request_type: this.request_type,\n url_state: this.url_state\n });\n }\n static fromStorageString(storageString) {\n Logger.createStatic(\"State\", \"fromStorageString\");\n return Promise.resolve(new _State(JSON.parse(storageString)));\n }\n static async clearStaleState(storage, age) {\n const logger2 = Logger.createStatic(\"State\", \"clearStaleState\");\n const cutoff = Timer.getEpochTime() - age;\n const keys = await storage.getAllKeys();\n logger2.debug(\"got keys\", keys);\n for (let i = 0; i < keys.length; i++) {\n const key = keys[i];\n const item = await storage.get(key);\n let remove = false;\n if (item) {\n try {\n const state = await _State.fromStorageString(item);\n logger2.debug(\"got item from key:\", key, state.created);\n if (state.created <= cutoff) {\n remove = true;\n }\n } catch (err) {\n logger2.error(\"Error parsing state for key:\", key, err);\n remove = true;\n }\n } else {\n logger2.debug(\"no item in storage for key:\", key);\n remove = true;\n }\n if (remove) {\n logger2.debug(\"removed item for key:\", key);\n void storage.remove(key);\n }\n }\n }\n};\n\n// src/SigninState.ts\nvar SigninState = class _SigninState extends State {\n constructor(args) {\n super(args);\n this.code_verifier = args.code_verifier;\n this.code_challenge = args.code_challenge;\n this.authority = args.authority;\n this.client_id = args.client_id;\n this.redirect_uri = args.redirect_uri;\n this.scope = args.scope;\n this.client_secret = args.client_secret;\n this.extraTokenParams = args.extraTokenParams;\n this.response_mode = args.response_mode;\n this.skipUserInfo = args.skipUserInfo;\n this.nonce = args.nonce;\n }\n static async create(args) {\n const code_verifier = args.code_verifier === true ? CryptoUtils.generateCodeVerifier() : args.code_verifier || void 0;\n const code_challenge = code_verifier ? await CryptoUtils.generateCodeChallenge(code_verifier) : void 0;\n return new _SigninState({\n ...args,\n code_verifier,\n code_challenge\n });\n }\n toStorageString() {\n new Logger(\"SigninState\").create(\"toStorageString\");\n return JSON.stringify({\n id: this.id,\n data: this.data,\n created: this.created,\n request_type: this.request_type,\n url_state: this.url_state,\n code_verifier: this.code_verifier,\n authority: this.authority,\n client_id: this.client_id,\n redirect_uri: this.redirect_uri,\n scope: this.scope,\n client_secret: this.client_secret,\n extraTokenParams: this.extraTokenParams,\n response_mode: this.response_mode,\n skipUserInfo: this.skipUserInfo,\n nonce: this.nonce\n });\n }\n static fromStorageString(storageString) {\n Logger.createStatic(\"SigninState\", \"fromStorageString\");\n const data = JSON.parse(storageString);\n return _SigninState.create(data);\n }\n};\n\n// src/SigninRequest.ts\nvar _SigninRequest = class _SigninRequest {\n constructor(args) {\n this.url = args.url;\n this.state = args.state;\n }\n static async create({\n // mandatory\n url,\n authority,\n client_id,\n redirect_uri,\n response_type,\n scope,\n // optional\n state_data,\n response_mode,\n request_type,\n client_secret,\n nonce,\n url_state,\n resource,\n skipUserInfo,\n extraQueryParams,\n extraTokenParams,\n disablePKCE,\n dpopJkt,\n omitScopeWhenRequesting,\n ...optionalParams\n }) {\n if (!url) {\n this._logger.error(\"create: No url passed\");\n throw new Error(\"url\");\n }\n if (!client_id) {\n this._logger.error(\"create: No client_id passed\");\n throw new Error(\"client_id\");\n }\n if (!redirect_uri) {\n this._logger.error(\"create: No redirect_uri passed\");\n throw new Error(\"redirect_uri\");\n }\n if (!response_type) {\n this._logger.error(\"create: No response_type passed\");\n throw new Error(\"response_type\");\n }\n if (!scope) {\n this._logger.error(\"create: No scope passed\");\n throw new Error(\"scope\");\n }\n if (!authority) {\n this._logger.error(\"create: No authority passed\");\n throw new Error(\"authority\");\n }\n const state = await SigninState.create({\n data: state_data,\n request_type,\n url_state,\n code_verifier: !disablePKCE,\n client_id,\n authority,\n redirect_uri,\n response_mode,\n client_secret,\n scope,\n extraTokenParams,\n skipUserInfo,\n nonce\n });\n const parsedUrl = new URL(url);\n parsedUrl.searchParams.append(\"client_id\", client_id);\n parsedUrl.searchParams.append(\"redirect_uri\", redirect_uri);\n parsedUrl.searchParams.append(\"response_type\", response_type);\n if (!omitScopeWhenRequesting) {\n parsedUrl.searchParams.append(\"scope\", scope);\n }\n if (nonce) {\n parsedUrl.searchParams.append(\"nonce\", nonce);\n }\n if (dpopJkt) {\n parsedUrl.searchParams.append(\"dpop_jkt\", dpopJkt);\n }\n let stateParam = state.id;\n if (url_state) {\n stateParam = `${stateParam}${URL_STATE_DELIMITER}${url_state}`;\n }\n parsedUrl.searchParams.append(\"state\", stateParam);\n if (state.code_challenge) {\n parsedUrl.searchParams.append(\"code_challenge\", state.code_challenge);\n parsedUrl.searchParams.append(\"code_challenge_method\", \"S256\");\n }\n if (resource) {\n const resources = Array.isArray(resource) ? resource : [resource];\n resources.forEach((r) => parsedUrl.searchParams.append(\"resource\", r));\n }\n for (const [key, value] of Object.entries({ response_mode, ...optionalParams, ...extraQueryParams })) {\n if (value != null) {\n parsedUrl.searchParams.append(key, value.toString());\n }\n }\n return new _SigninRequest({\n url: parsedUrl.href,\n state\n });\n }\n};\n_SigninRequest._logger = new Logger(\"SigninRequest\");\nvar SigninRequest = _SigninRequest;\n\n// src/SigninResponse.ts\nvar OidcScope = \"openid\";\nvar SigninResponse = class {\n constructor(params) {\n /** @see {@link User.access_token} */\n this.access_token = \"\";\n /** @see {@link User.token_type} */\n this.token_type = \"\";\n /** @see {@link User.profile} */\n this.profile = {};\n this.state = params.get(\"state\");\n this.session_state = params.get(\"session_state\");\n if (this.state) {\n const splitState = decodeURIComponent(this.state).split(URL_STATE_DELIMITER);\n this.state = splitState[0];\n if (splitState.length > 1) {\n this.url_state = splitState.slice(1).join(URL_STATE_DELIMITER);\n }\n }\n this.error = params.get(\"error\");\n this.error_description = params.get(\"error_description\");\n this.error_uri = params.get(\"error_uri\");\n this.code = params.get(\"code\");\n }\n get expires_in() {\n if (this.expires_at === void 0) {\n return void 0;\n }\n return this.expires_at - Timer.getEpochTime();\n }\n set expires_in(value) {\n if (typeof value === \"string\") value = Number(value);\n if (value !== void 0 && value >= 0) {\n this.expires_at = Math.floor(value) + Timer.getEpochTime();\n }\n }\n get isOpenId() {\n var _a;\n return ((_a = this.scope) == null ? void 0 : _a.split(\" \").includes(OidcScope)) || !!this.id_token;\n }\n};\n\n// src/SignoutRequest.ts\nvar SignoutRequest = class {\n constructor({\n url,\n state_data,\n id_token_hint,\n post_logout_redirect_uri,\n extraQueryParams,\n request_type,\n client_id,\n url_state\n }) {\n this._logger = new Logger(\"SignoutRequest\");\n if (!url) {\n this._logger.error(\"ctor: No url passed\");\n throw new Error(\"url\");\n }\n const parsedUrl = new URL(url);\n if (id_token_hint) {\n parsedUrl.searchParams.append(\"id_token_hint\", id_token_hint);\n }\n if (client_id) {\n parsedUrl.searchParams.append(\"client_id\", client_id);\n }\n if (post_logout_redirect_uri) {\n parsedUrl.searchParams.append(\"post_logout_redirect_uri\", post_logout_redirect_uri);\n if (state_data || url_state) {\n this.state = new State({ data: state_data, request_type, url_state });\n let stateParam = this.state.id;\n if (url_state) {\n stateParam = `${stateParam}${URL_STATE_DELIMITER}${url_state}`;\n }\n parsedUrl.searchParams.append(\"state\", stateParam);\n }\n }\n for (const [key, value] of Object.entries({ ...extraQueryParams })) {\n if (value != null) {\n parsedUrl.searchParams.append(key, value.toString());\n }\n }\n this.url = parsedUrl.href;\n }\n};\n\n// src/SignoutResponse.ts\nvar SignoutResponse = class {\n constructor(params) {\n this.state = params.get(\"state\");\n if (this.state) {\n const splitState = decodeURIComponent(this.state).split(URL_STATE_DELIMITER);\n this.state = splitState[0];\n if (splitState.length > 1) {\n this.url_state = splitState.slice(1).join(URL_STATE_DELIMITER);\n }\n }\n this.error = params.get(\"error\");\n this.error_description = params.get(\"error_description\");\n this.error_uri = params.get(\"error_uri\");\n }\n};\n\n// src/ClaimsService.ts\nvar DefaultProtocolClaims = [\n \"nbf\",\n \"jti\",\n \"auth_time\",\n \"nonce\",\n \"acr\",\n \"amr\",\n \"azp\",\n \"at_hash\"\n // https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken\n];\nvar InternalRequiredProtocolClaims = [\"sub\", \"iss\", \"aud\", \"exp\", \"iat\"];\nvar ClaimsService = class {\n constructor(_settings) {\n this._settings = _settings;\n this._logger = new Logger(\"ClaimsService\");\n }\n filterProtocolClaims(claims) {\n const result = { ...claims };\n if (this._settings.filterProtocolClaims) {\n let protocolClaims;\n if (Array.isArray(this._settings.filterProtocolClaims)) {\n protocolClaims = this._settings.filterProtocolClaims;\n } else {\n protocolClaims = DefaultProtocolClaims;\n }\n for (const claim of protocolClaims) {\n if (!InternalRequiredProtocolClaims.includes(claim)) {\n delete result[claim];\n }\n }\n }\n return result;\n }\n mergeClaims(claims1, claims2) {\n const result = { ...claims1 };\n for (const [claim, values] of Object.entries(claims2)) {\n if (result[claim] !== values) {\n if (Array.isArray(result[claim]) || Array.isArray(values)) {\n if (this._settings.mergeClaimsStrategy.array == \"replace\") {\n result[claim] = values;\n } else {\n const mergedValues = Array.isArray(result[claim]) ? result[claim] : [result[claim]];\n for (const value of Array.isArray(values) ? values : [values]) {\n if (!mergedValues.includes(value)) {\n mergedValues.push(value);\n }\n }\n result[claim] = mergedValues;\n }\n } else if (typeof result[claim] === \"object\" && typeof values === \"object\") {\n result[claim] = this.mergeClaims(result[claim], values);\n } else {\n result[claim] = values;\n }\n }\n }\n return result;\n }\n};\n\n// src/DPoPStore.ts\nvar DPoPState = class {\n constructor(keys, nonce) {\n this.keys = keys;\n this.nonce = nonce;\n }\n};\n\n// src/OidcClient.ts\nvar OidcClient = class {\n constructor(settings, metadataService) {\n this._logger = new Logger(\"OidcClient\");\n this.settings = settings instanceof OidcClientSettingsStore ? settings : new OidcClientSettingsStore(settings);\n this.metadataService = metadataService != null ? metadataService : new MetadataService(this.settings);\n this._claimsService = new ClaimsService(this.settings);\n this._validator = new ResponseValidator(this.settings, this.metadataService, this._claimsService);\n this._tokenClient = new TokenClient(this.settings, this.metadataService);\n }\n async createSigninRequest({\n state,\n request,\n request_uri,\n request_type,\n id_token_hint,\n login_hint,\n skipUserInfo,\n nonce,\n url_state,\n response_type = this.settings.response_type,\n scope = this.settings.scope,\n redirect_uri = this.settings.redirect_uri,\n prompt = this.settings.prompt,\n display = this.settings.display,\n max_age = this.settings.max_age,\n ui_locales = this.settings.ui_locales,\n acr_values = this.settings.acr_values,\n resource = this.settings.resource,\n response_mode = this.settings.response_mode,\n extraQueryParams = this.settings.extraQueryParams,\n extraTokenParams = this.settings.extraTokenParams,\n dpopJkt,\n omitScopeWhenRequesting = this.settings.omitScopeWhenRequesting\n }) {\n const logger2 = this._logger.create(\"createSigninRequest\");\n if (response_type !== \"code\") {\n throw new Error(\"Only the Authorization Code flow (with PKCE) is supported\");\n }\n const url = await this.metadataService.getAuthorizationEndpoint();\n logger2.debug(\"Received authorization endpoint\", url);\n const signinRequest = await SigninRequest.create({\n url,\n authority: this.settings.authority,\n client_id: this.settings.client_id,\n redirect_uri,\n response_type,\n scope,\n state_data: state,\n url_state,\n prompt,\n display,\n max_age,\n ui_locales,\n id_token_hint,\n login_hint,\n acr_values,\n dpopJkt,\n resource,\n request,\n request_uri,\n extraQueryParams,\n extraTokenParams,\n request_type,\n response_mode,\n client_secret: this.settings.client_secret,\n skipUserInfo,\n nonce,\n disablePKCE: this.settings.disablePKCE,\n omitScopeWhenRequesting\n });\n await this.clearStaleState();\n const signinState = signinRequest.state;\n await this.settings.stateStore.set(signinState.id, signinState.toStorageString());\n return signinRequest;\n }\n async readSigninResponseState(url, removeState = false) {\n const logger2 = this._logger.create(\"readSigninResponseState\");\n const response = new SigninResponse(UrlUtils.readParams(url, this.settings.response_mode));\n if (!response.state) {\n logger2.throw(new Error(\"No state in response\"));\n throw null;\n }\n const storedStateString = await this.settings.stateStore[removeState ? \"remove\" : \"get\"](response.state);\n if (!storedStateString) {\n logger2.throw(new Error(\"No matching state found in storage\"));\n throw null;\n }\n const state = await SigninState.fromStorageString(storedStateString);\n return { state, response };\n }\n async processSigninResponse(url, extraHeaders, removeState = true) {\n const logger2 = this._logger.create(\"processSigninResponse\");\n const { state, response } = await this.readSigninResponseState(url, removeState);\n logger2.debug(\"received state from storage; validating response\");\n if (this.settings.dpop && this.settings.dpop.store) {\n const dpopProof = await this.getDpopProof(this.settings.dpop.store);\n extraHeaders = { ...extraHeaders, \"DPoP\": dpopProof };\n }\n try {\n await this._validator.validateSigninResponse(response, state, extraHeaders);\n } catch (err) {\n if (err instanceof ErrorDPoPNonce && this.settings.dpop) {\n const dpopProof = await this.getDpopProof(this.settings.dpop.store, err.nonce);\n extraHeaders[\"DPoP\"] = dpopProof;\n await this._validator.validateSigninResponse(response, state, extraHeaders);\n } else {\n throw err;\n }\n }\n return response;\n }\n async getDpopProof(dpopStore, nonce) {\n let keyPair;\n let dpopState;\n if (!(await dpopStore.getAllKeys()).includes(this.settings.client_id)) {\n keyPair = await CryptoUtils.generateDPoPKeys();\n dpopState = new DPoPState(keyPair, nonce);\n await dpopStore.set(this.settings.client_id, dpopState);\n } else {\n dpopState = await dpopStore.get(this.settings.client_id);\n if (dpopState.nonce !== nonce && nonce) {\n dpopState.nonce = nonce;\n await dpopStore.set(this.settings.client_id, dpopState);\n }\n }\n return await CryptoUtils.generateDPoPProof({\n url: await this.metadataService.getTokenEndpoint(false),\n httpMethod: \"POST\",\n keyPair: dpopState.keys,\n nonce: dpopState.nonce\n });\n }\n async processResourceOwnerPasswordCredentials({\n username,\n password,\n skipUserInfo = false,\n extraTokenParams = {}\n }) {\n const tokenResponse = await this._tokenClient.exchangeCredentials({ username, password, ...extraTokenParams });\n const signinResponse = new SigninResponse(new URLSearchParams());\n Object.assign(signinResponse, tokenResponse);\n await this._validator.validateCredentialsResponse(signinResponse, skipUserInfo);\n return signinResponse;\n }\n async useRefreshToken({\n state,\n redirect_uri,\n resource,\n timeoutInSeconds,\n extraHeaders,\n extraTokenParams\n }) {\n var _a;\n const logger2 = this._logger.create(\"useRefreshToken\");\n let scope;\n if (this.settings.refreshTokenAllowedScope === void 0) {\n scope = state.scope;\n } else {\n const allowableScopes = this.settings.refreshTokenAllowedScope.split(\" \");\n const providedScopes = ((_a = state.scope) == null ? void 0 : _a.split(\" \")) || [];\n scope = providedScopes.filter((s) => allowableScopes.includes(s)).join(\" \");\n }\n if (this.settings.dpop && this.settings.dpop.store) {\n const dpopProof = await this.getDpopProof(this.settings.dpop.store);\n extraHeaders = { ...extraHeaders, \"DPoP\": dpopProof };\n }\n let result;\n try {\n result = await this._tokenClient.exchangeRefreshToken({\n refresh_token: state.refresh_token,\n // provide the (possible filtered) scope list\n scope,\n redirect_uri,\n resource,\n timeoutInSeconds,\n extraHeaders,\n ...extraTokenParams\n });\n } catch (err) {\n if (err instanceof ErrorDPoPNonce && this.settings.dpop) {\n extraHeaders[\"DPoP\"] = await this.getDpopProof(this.settings.dpop.store, err.nonce);\n result = await this._tokenClient.exchangeRefreshToken({\n refresh_token: state.refresh_token,\n // provide the (possible filtered) scope list\n scope,\n redirect_uri,\n resource,\n timeoutInSeconds,\n extraHeaders,\n ...extraTokenParams\n });\n } else {\n throw err;\n }\n }\n const response = new SigninResponse(new URLSearchParams());\n Object.assign(response, result);\n logger2.debug(\"validating response\", response);\n await this._validator.validateRefreshResponse(response, {\n ...state,\n // override the scope in the state handed over to the validator\n // so it can set the granted scope to the requested scope in case none is included in the response\n scope\n });\n return response;\n }\n async createSignoutRequest({\n state,\n id_token_hint,\n client_id,\n request_type,\n url_state,\n post_logout_redirect_uri = this.settings.post_logout_redirect_uri,\n extraQueryParams = this.settings.extraQueryParams\n } = {}) {\n const logger2 = this._logger.create(\"createSignoutRequest\");\n const url = await this.metadataService.getEndSessionEndpoint();\n if (!url) {\n logger2.throw(new Error(\"No end session endpoint\"));\n throw null;\n }\n logger2.debug(\"Received end session endpoint\", url);\n if (!client_id && post_logout_redirect_uri && !id_token_hint) {\n client_id = this.settings.client_id;\n }\n const request = new SignoutRequest({\n url,\n id_token_hint,\n client_id,\n post_logout_redirect_uri,\n state_data: state,\n extraQueryParams,\n request_type,\n url_state\n });\n await this.clearStaleState();\n const signoutState = request.state;\n if (signoutState) {\n logger2.debug(\"Signout request has state to persist\");\n await this.settings.stateStore.set(signoutState.id, signoutState.toStorageString());\n }\n return request;\n }\n async readSignoutResponseState(url, removeState = false) {\n const logger2 = this._logger.create(\"readSignoutResponseState\");\n const response = new SignoutResponse(UrlUtils.readParams(url, this.settings.response_mode));\n if (!response.state) {\n logger2.debug(\"No state in response\");\n if (response.error) {\n logger2.warn(\"Response was error:\", response.error);\n throw new ErrorResponse(response);\n }\n return { state: void 0, response };\n }\n const storedStateString = await this.settings.stateStore[removeState ? \"remove\" : \"get\"](response.state);\n if (!storedStateString) {\n logger2.throw(new Error(\"No matching state found in storage\"));\n throw null;\n }\n const state = await State.fromStorageString(storedStateString);\n return { state, response };\n }\n async processSignoutResponse(url) {\n const logger2 = this._logger.create(\"processSignoutResponse\");\n const { state, response } = await this.readSignoutResponseState(url, true);\n if (state) {\n logger2.debug(\"Received state from storage; validating response\");\n this._validator.validateSignoutResponse(response, state);\n } else {\n logger2.debug(\"No state from storage; skipping response validation\");\n }\n return response;\n }\n clearStaleState() {\n this._logger.create(\"clearStaleState\");\n return State.clearStaleState(this.settings.stateStore, this.settings.staleStateAgeInSeconds);\n }\n async revokeToken(token, type) {\n this._logger.create(\"revokeToken\");\n return await this._tokenClient.revoke({\n token,\n token_type_hint: type\n });\n }\n};\n\n// src/SessionMonitor.ts\nvar SessionMonitor = class {\n constructor(_userManager) {\n this._userManager = _userManager;\n this._logger = new Logger(\"SessionMonitor\");\n this._start = async (user) => {\n const session_state = user.session_state;\n if (!session_state) {\n return;\n }\n const logger2 = this._logger.create(\"_start\");\n if (user.profile) {\n this._sub = user.profile.sub;\n logger2.debug(\"session_state\", session_state, \", sub\", this._sub);\n } else {\n this._sub = void 0;\n logger2.debug(\"session_state\", session_state, \", anonymous user\");\n }\n if (this._checkSessionIFrame) {\n this._checkSessionIFrame.start(session_state);\n return;\n }\n try {\n const url = await this._userManager.metadataService.getCheckSessionIframe();\n if (url) {\n logger2.debug(\"initializing check session iframe\");\n const client_id = this._userManager.settings.client_id;\n const intervalInSeconds = this._userManager.settings.checkSessionIntervalInSeconds;\n const stopOnError = this._userManager.settings.stopCheckSessionOnError;\n const checkSessionIFrame = new CheckSessionIFrame(this._callback, client_id, url, intervalInSeconds, stopOnError);\n await checkSessionIFrame.load();\n this._checkSessionIFrame = checkSessionIFrame;\n checkSessionIFrame.start(session_state);\n } else {\n logger2.warn(\"no check session iframe found in the metadata\");\n }\n } catch (err) {\n logger2.error(\"Error from getCheckSessionIframe:\", err instanceof Error ? err.message : err);\n }\n };\n this._stop = () => {\n const logger2 = this._logger.create(\"_stop\");\n this._sub = void 0;\n if (this._checkSessionIFrame) {\n this._checkSessionIFrame.stop();\n }\n if (this._userManager.settings.monitorAnonymousSession) {\n const timerHandle = setInterval(async () => {\n clearInterval(timerHandle);\n try {\n const session = await this._userManager.querySessionStatus();\n if (session) {\n const tmpUser = {\n session_state: session.session_state,\n profile: session.sub ? {\n sub: session.sub\n } : null\n };\n void this._start(tmpUser);\n }\n } catch (err) {\n logger2.error(\"error from querySessionStatus\", err instanceof Error ? err.message : err);\n }\n }, 1e3);\n }\n };\n this._callback = async () => {\n const logger2 = this._logger.create(\"_callback\");\n try {\n const session = await this._userManager.querySessionStatus();\n let raiseEvent = true;\n if (session && this._checkSessionIFrame) {\n if (session.sub === this._sub) {\n raiseEvent = false;\n this._checkSessionIFrame.start(session.session_state);\n logger2.debug(\"same sub still logged in at OP, session state has changed, restarting check session iframe; session_state\", session.session_state);\n await this._userManager.events._raiseUserSessionChanged();\n } else {\n logger2.debug(\"different subject signed into OP\", session.sub);\n }\n } else {\n logger2.debug(\"subject no longer signed into OP\");\n }\n if (raiseEvent) {\n if (this._sub) {\n await this._userManager.events._raiseUserSignedOut();\n } else {\n await this._userManager.events._raiseUserSignedIn();\n }\n } else {\n logger2.debug(\"no change in session detected, no event to raise\");\n }\n } catch (err) {\n if (this._sub) {\n logger2.debug(\"Error calling queryCurrentSigninSession; raising signed out event\", err);\n await this._userManager.events._raiseUserSignedOut();\n }\n }\n };\n if (!_userManager) {\n this._logger.throw(new Error(\"No user manager passed\"));\n }\n this._userManager.events.addUserLoaded(this._start);\n this._userManager.events.addUserUnloaded(this._stop);\n this._init().catch((err) => {\n this._logger.error(err);\n });\n }\n async _init() {\n this._logger.create(\"_init\");\n const user = await this._userManager.getUser();\n if (user) {\n void this._start(user);\n } else if (this._userManager.settings.monitorAnonymousSession) {\n const session = await this._userManager.querySessionStatus();\n if (session) {\n const tmpUser = {\n session_state: session.session_state,\n profile: session.sub ? {\n sub: session.sub\n } : null\n };\n void this._start(tmpUser);\n }\n }\n }\n};\n\n// src/User.ts\nvar User = class _User {\n constructor(args) {\n var _a;\n this.id_token = args.id_token;\n this.session_state = (_a = args.session_state) != null ? _a : null;\n this.access_token = args.access_token;\n this.refresh_token = args.refresh_token;\n this.token_type = args.token_type;\n this.scope = args.scope;\n this.profile = args.profile;\n this.expires_at = args.expires_at;\n this.state = args.userState;\n this.url_state = args.url_state;\n }\n /** Computed number of seconds the access token has remaining. */\n get expires_in() {\n if (this.expires_at === void 0) {\n return void 0;\n }\n return this.expires_at - Timer.getEpochTime();\n }\n set expires_in(value) {\n if (value !== void 0) {\n this.expires_at = Math.floor(value) + Timer.getEpochTime();\n }\n }\n /** Computed value indicating if the access token is expired. */\n get expired() {\n const expires_in = this.expires_in;\n if (expires_in === void 0) {\n return void 0;\n }\n return expires_in <= 0;\n }\n /** Array representing the parsed values from the `scope`. */\n get scopes() {\n var _a, _b;\n return (_b = (_a = this.scope) == null ? void 0 : _a.split(\" \")) != null ? _b : [];\n }\n toStorageString() {\n new Logger(\"User\").create(\"toStorageString\");\n return JSON.stringify({\n id_token: this.id_token,\n session_state: this.session_state,\n access_token: this.access_token,\n refresh_token: this.refresh_token,\n token_type: this.token_type,\n scope: this.scope,\n profile: this.profile,\n expires_at: this.expires_at\n });\n }\n static fromStorageString(storageString) {\n Logger.createStatic(\"User\", \"fromStorageString\");\n return new _User(JSON.parse(storageString));\n }\n};\n\n// src/navigators/AbstractChildWindow.ts\nvar messageSource = \"oidc-client\";\nvar AbstractChildWindow = class {\n constructor() {\n this._abort = new Event(\"Window navigation aborted\");\n this._disposeHandlers = /* @__PURE__ */ new Set();\n this._window = null;\n }\n async navigate(params) {\n const logger2 = this._logger.create(\"navigate\");\n if (!this._window) {\n throw new Error(\"Attempted to navigate on a disposed window\");\n }\n logger2.debug(\"setting URL in window\");\n this._window.location.replace(params.url);\n const { url, keepOpen } = await new Promise((resolve, reject) => {\n const listener = (e) => {\n var _a;\n const data = e.data;\n const origin = (_a = params.scriptOrigin) != null ? _a : window.location.origin;\n if (e.origin !== origin || (data == null ? void 0 : data.source) !== messageSource) {\n return;\n }\n try {\n const state = UrlUtils.readParams(data.url, params.response_mode).get(\"state\");\n if (!state) {\n logger2.warn(\"no state found in response url\");\n }\n if (e.source !== this._window && state !== params.state) {\n return;\n }\n } catch {\n this._dispose();\n reject(new Error(\"Invalid response from window\"));\n }\n resolve(data);\n };\n window.addEventListener(\"message\", listener, false);\n this._disposeHandlers.add(() => window.removeEventListener(\"message\", listener, false));\n const channel = new BroadcastChannel(`oidc-client-popup-${params.state}`);\n channel.addEventListener(\"message\", listener, false);\n this._disposeHandlers.add(() => channel.close());\n this._disposeHandlers.add(this._abort.addHandler((reason) => {\n this._dispose();\n reject(reason);\n }));\n });\n logger2.debug(\"got response from window\");\n this._dispose();\n if (!keepOpen) {\n this.close();\n }\n return { url };\n }\n _dispose() {\n this._logger.create(\"_dispose\");\n for (const dispose of this._disposeHandlers) {\n dispose();\n }\n this._disposeHandlers.clear();\n }\n static _notifyParent(parent, url, keepOpen = false, targetOrigin = window.location.origin) {\n const msgData = {\n source: messageSource,\n url,\n keepOpen\n };\n const logger2 = new Logger(\"_notifyParent\");\n if (parent) {\n logger2.debug(\"With parent. Using parent.postMessage.\");\n parent.postMessage(msgData, targetOrigin);\n } else {\n logger2.debug(\"No parent. Using BroadcastChannel.\");\n const state = new URL(url).searchParams.get(\"state\");\n if (!state) {\n throw new Error(\"No parent and no state in URL. Can't complete notification.\");\n }\n const channel = new BroadcastChannel(`oidc-client-popup-${state}`);\n channel.postMessage(msgData);\n channel.close();\n }\n }\n};\n\n// src/UserManagerSettings.ts\nvar DefaultPopupWindowFeatures = {\n location: false,\n toolbar: false,\n height: 640,\n closePopupWindowAfterInSeconds: -1\n};\nvar DefaultPopupTarget = \"_blank\";\nvar DefaultAccessTokenExpiringNotificationTimeInSeconds = 60;\nvar DefaultCheckSessionIntervalInSeconds = 2;\nvar DefaultSilentRequestTimeoutInSeconds = 10;\nvar UserManagerSettingsStore = class extends OidcClientSettingsStore {\n constructor(args) {\n const {\n popup_redirect_uri = args.redirect_uri,\n popup_post_logout_redirect_uri = args.post_logout_redirect_uri,\n popupWindowFeatures = DefaultPopupWindowFeatures,\n popupWindowTarget = DefaultPopupTarget,\n redirectMethod = \"assign\",\n redirectTarget = \"self\",\n iframeNotifyParentOrigin = args.iframeNotifyParentOrigin,\n iframeScriptOrigin = args.iframeScriptOrigin,\n requestTimeoutInSeconds,\n silent_redirect_uri = args.redirect_uri,\n silentRequestTimeoutInSeconds,\n automaticSilentRenew = true,\n validateSubOnSilentRenew = true,\n includeIdTokenInSilentRenew = false,\n monitorSession = false,\n monitorAnonymousSession = false,\n checkSessionIntervalInSeconds = DefaultCheckSessionIntervalInSeconds,\n query_status_response_type = \"code\",\n stopCheckSessionOnError = true,\n revokeTokenTypes = [\"access_token\", \"refresh_token\"],\n revokeTokensOnSignout = false,\n includeIdTokenInSilentSignout = false,\n accessTokenExpiringNotificationTimeInSeconds = DefaultAccessTokenExpiringNotificationTimeInSeconds,\n maxSilentRenewTimeoutRetries,\n userStore\n } = args;\n super(args);\n this.popup_redirect_uri = popup_redirect_uri;\n this.popup_post_logout_redirect_uri = popup_post_logout_redirect_uri;\n this.popupWindowFeatures = popupWindowFeatures;\n this.popupWindowTarget = popupWindowTarget;\n this.redirectMethod = redirectMethod;\n this.redirectTarget = redirectTarget;\n this.iframeNotifyParentOrigin = iframeNotifyParentOrigin;\n this.iframeScriptOrigin = iframeScriptOrigin;\n this.silent_redirect_uri = silent_redirect_uri;\n this.silentRequestTimeoutInSeconds = silentRequestTimeoutInSeconds || requestTimeoutInSeconds || DefaultSilentRequestTimeoutInSeconds;\n this.automaticSilentRenew = automaticSilentRenew;\n this.validateSubOnSilentRenew = validateSubOnSilentRenew;\n this.includeIdTokenInSilentRenew = includeIdTokenInSilentRenew;\n this.monitorSession = monitorSession;\n this.monitorAnonymousSession = monitorAnonymousSession;\n this.checkSessionIntervalInSeconds = checkSessionIntervalInSeconds;\n this.stopCheckSessionOnError = stopCheckSessionOnError;\n this.query_status_response_type = query_status_response_type;\n this.revokeTokenTypes = revokeTokenTypes;\n this.revokeTokensOnSignout = revokeTokensOnSignout;\n this.includeIdTokenInSilentSignout = includeIdTokenInSilentSignout;\n this.accessTokenExpiringNotificationTimeInSeconds = accessTokenExpiringNotificationTimeInSeconds;\n this.maxSilentRenewTimeoutRetries = maxSilentRenewTimeoutRetries;\n if (userStore) {\n this.userStore = userStore;\n } else {\n const store = typeof window !== \"undefined\" ? window.sessionStorage : new InMemoryWebStorage();\n this.userStore = new WebStorageStateStore({ store });\n }\n }\n};\n\n// src/navigators/IFrameWindow.ts\nvar IFrameWindow = class _IFrameWindow extends AbstractChildWindow {\n constructor({\n silentRequestTimeoutInSeconds = DefaultSilentRequestTimeoutInSeconds\n }) {\n super();\n this._logger = new Logger(\"IFrameWindow\");\n this._timeoutInSeconds = silentRequestTimeoutInSeconds;\n this._frame = _IFrameWindow.createHiddenIframe();\n this._window = this._frame.contentWindow;\n }\n static createHiddenIframe() {\n const iframe = window.document.createElement(\"iframe\");\n iframe.style.visibility = \"hidden\";\n iframe.style.position = \"fixed\";\n iframe.style.left = \"-1000px\";\n iframe.style.top = \"0\";\n iframe.width = \"0\";\n iframe.height = \"0\";\n window.document.body.appendChild(iframe);\n return iframe;\n }\n async navigate(params) {\n this._logger.debug(\"navigate: Using timeout of:\", this._timeoutInSeconds);\n const timer = setTimeout(() => void this._abort.raise(new ErrorTimeout(\"IFrame timed out without a response\")), this._timeoutInSeconds * 1e3);\n this._disposeHandlers.add(() => clearTimeout(timer));\n return await super.navigate(params);\n }\n close() {\n var _a;\n if (this._frame) {\n if (this._frame.parentNode) {\n this._frame.addEventListener(\"load\", (ev) => {\n var _a2;\n const frame = ev.target;\n (_a2 = frame.parentNode) == null ? void 0 : _a2.removeChild(frame);\n void this._abort.raise(new Error(\"IFrame removed from DOM\"));\n }, true);\n (_a = this._frame.contentWindow) == null ? void 0 : _a.location.replace(\"about:blank\");\n }\n this._frame = null;\n }\n this._window = null;\n }\n static notifyParent(url, targetOrigin) {\n return super._notifyParent(window.parent, url, false, targetOrigin);\n }\n};\n\n// src/navigators/IFrameNavigator.ts\nvar IFrameNavigator = class {\n constructor(_settings) {\n this._settings = _settings;\n this._logger = new Logger(\"IFrameNavigator\");\n }\n async prepare({\n silentRequestTimeoutInSeconds = this._settings.silentRequestTimeoutInSeconds\n }) {\n return new IFrameWindow({ silentRequestTimeoutInSeconds });\n }\n async callback(url) {\n this._logger.create(\"callback\");\n IFrameWindow.notifyParent(url, this._settings.iframeNotifyParentOrigin);\n }\n};\n\n// src/navigators/PopupWindow.ts\nvar checkForPopupClosedInterval = 500;\nvar second = 1e3;\nvar PopupWindow = class extends AbstractChildWindow {\n constructor({\n popupWindowTarget = DefaultPopupTarget,\n popupWindowFeatures = {},\n popupSignal,\n popupAbortOnClose\n }) {\n super();\n this._logger = new Logger(\"PopupWindow\");\n const centeredPopup = PopupUtils.center({ ...DefaultPopupWindowFeatures, ...popupWindowFeatures });\n this._window = window.open(void 0, popupWindowTarget, PopupUtils.serialize(centeredPopup));\n this.abortOnClose = Boolean(popupAbortOnClose);\n if (popupSignal) {\n popupSignal.addEventListener(\"abort\", () => {\n var _a;\n void this._abort.raise(new Error((_a = popupSignal.reason) != null ? _a : \"Popup aborted\"));\n });\n }\n if (popupWindowFeatures.closePopupWindowAfterInSeconds && popupWindowFeatures.closePopupWindowAfterInSeconds > 0) {\n setTimeout(() => {\n if (!this._window || typeof this._window.closed !== \"boolean\" || this._window.closed) {\n void this._abort.raise(new Error(\"Popup blocked by user\"));\n return;\n }\n this.close();\n }, popupWindowFeatures.closePopupWindowAfterInSeconds * second);\n }\n }\n async navigate(params) {\n var _a;\n (_a = this._window) == null ? void 0 : _a.focus();\n const popupClosedInterval = setInterval(() => {\n if (!this._window || this._window.closed) {\n this._logger.debug(\"Popup closed by user or isolated by redirect\");\n clearPopupClosedInterval();\n this._disposeHandlers.delete(clearPopupClosedInterval);\n if (this.abortOnClose) {\n void this._abort.raise(new Error(\"Popup closed by user\"));\n }\n }\n }, checkForPopupClosedInterval);\n const clearPopupClosedInterval = () => clearInterval(popupClosedInterval);\n this._disposeHandlers.add(clearPopupClosedInterval);\n return await super.navigate(params);\n }\n close() {\n if (this._window) {\n if (!this._window.closed) {\n this._window.close();\n void this._abort.raise(new Error(\"Popup closed\"));\n }\n }\n this._window = null;\n }\n static notifyOpener(url, keepOpen) {\n super._notifyParent(window.opener, url, keepOpen);\n if (!keepOpen && !window.opener) {\n window.close();\n }\n }\n};\n\n// src/navigators/PopupNavigator.ts\nvar PopupNavigator = class {\n constructor(_settings) {\n this._settings = _settings;\n this._logger = new Logger(\"PopupNavigator\");\n }\n async prepare({\n popupWindowFeatures = this._settings.popupWindowFeatures,\n popupWindowTarget = this._settings.popupWindowTarget,\n popupSignal,\n popupAbortOnClose\n }) {\n return new PopupWindow({\n popupWindowFeatures,\n popupWindowTarget,\n popupSignal,\n popupAbortOnClose\n });\n }\n async callback(url, { keepOpen = false }) {\n this._logger.create(\"callback\");\n PopupWindow.notifyOpener(url, keepOpen);\n }\n};\n\n// src/navigators/RedirectNavigator.ts\nvar RedirectNavigator = class {\n constructor(_settings) {\n this._settings = _settings;\n this._logger = new Logger(\"RedirectNavigator\");\n }\n async prepare({\n redirectMethod = this._settings.redirectMethod,\n redirectTarget = this._settings.redirectTarget\n }) {\n var _a;\n this._logger.create(\"prepare\");\n let targetWindow = window.self;\n if (redirectTarget === \"top\") {\n targetWindow = (_a = window.top) != null ? _a : window.self;\n }\n const redirect = targetWindow.location[redirectMethod].bind(targetWindow.location);\n let abort;\n return {\n navigate: async (params) => {\n this._logger.create(\"navigate\");\n const promise = new Promise((resolve, reject) => {\n abort = reject;\n window.addEventListener(\"pageshow\", () => resolve(window.location.href));\n redirect(params.url);\n });\n return await promise;\n },\n close: () => {\n this._logger.create(\"close\");\n abort == null ? void 0 : abort(new Error(\"Redirect aborted\"));\n targetWindow.stop();\n }\n };\n }\n async callback() {\n return;\n }\n};\n\n// src/UserManagerEvents.ts\nvar UserManagerEvents = class extends AccessTokenEvents {\n constructor(settings) {\n super({ expiringNotificationTimeInSeconds: settings.accessTokenExpiringNotificationTimeInSeconds });\n this._logger = new Logger(\"UserManagerEvents\");\n this._userLoaded = new Event(\"User loaded\");\n this._userUnloaded = new Event(\"User unloaded\");\n this._silentRenewError = new Event(\"Silent renew error\");\n this._userSignedIn = new Event(\"User signed in\");\n this._userSignedOut = new Event(\"User signed out\");\n this._userSessionChanged = new Event(\"User session changed\");\n }\n async load(user, raiseEvent = true) {\n await super.load(user);\n if (raiseEvent) {\n await this._userLoaded.raise(user);\n }\n }\n async unload() {\n await super.unload();\n await this._userUnloaded.raise();\n }\n /**\n * Add callback: Raised when a user session has been established (or re-established).\n */\n addUserLoaded(cb) {\n return this._userLoaded.addHandler(cb);\n }\n /**\n * Remove callback: Raised when a user session has been established (or re-established).\n */\n removeUserLoaded(cb) {\n return this._userLoaded.removeHandler(cb);\n }\n /**\n * Add callback: Raised when a user session has been terminated.\n */\n addUserUnloaded(cb) {\n return this._userUnloaded.addHandler(cb);\n }\n /**\n * Remove callback: Raised when a user session has been terminated.\n */\n removeUserUnloaded(cb) {\n return this._userUnloaded.removeHandler(cb);\n }\n /**\n * Add callback: Raised when the automatic silent renew has failed.\n */\n addSilentRenewError(cb) {\n return this._silentRenewError.addHandler(cb);\n }\n /**\n * Remove callback: Raised when the automatic silent renew has failed.\n */\n removeSilentRenewError(cb) {\n return this._silentRenewError.removeHandler(cb);\n }\n /**\n * @internal\n */\n async _raiseSilentRenewError(e) {\n await this._silentRenewError.raise(e);\n }\n /**\n * Add callback: Raised when the user is signed in (when `monitorSession` is set).\n * @see {@link UserManagerSettings.monitorSession}\n */\n addUserSignedIn(cb) {\n return this._userSignedIn.addHandler(cb);\n }\n /**\n * Remove callback: Raised when the user is signed in (when `monitorSession` is set).\n */\n removeUserSignedIn(cb) {\n this._userSignedIn.removeHandler(cb);\n }\n /**\n * @internal\n */\n async _raiseUserSignedIn() {\n await this._userSignedIn.raise();\n }\n /**\n * Add callback: Raised when the user's sign-in status at the OP has changed (when `monitorSession` is set).\n * @see {@link UserManagerSettings.monitorSession}\n */\n addUserSignedOut(cb) {\n return this._userSignedOut.addHandler(cb);\n }\n /**\n * Remove callback: Raised when the user's sign-in status at the OP has changed (when `monitorSession` is set).\n */\n removeUserSignedOut(cb) {\n this._userSignedOut.removeHandler(cb);\n }\n /**\n * @internal\n */\n async _raiseUserSignedOut() {\n await this._userSignedOut.raise();\n }\n /**\n * Add callback: Raised when the user session changed (when `monitorSession` is set).\n * @see {@link UserManagerSettings.monitorSession}\n */\n addUserSessionChanged(cb) {\n return this._userSessionChanged.addHandler(cb);\n }\n /**\n * Remove callback: Raised when the user session changed (when `monitorSession` is set).\n */\n removeUserSessionChanged(cb) {\n this._userSessionChanged.removeHandler(cb);\n }\n /**\n * @internal\n */\n async _raiseUserSessionChanged() {\n await this._userSessionChanged.raise();\n }\n};\n\n// src/SilentRenewService.ts\nvar SilentRenewService = class {\n constructor(_userManager) {\n this._userManager = _userManager;\n this._logger = new Logger(\"SilentRenewService\");\n this._isStarted = false;\n this._retryTimer = new Timer(\"Retry Silent Renew\");\n this._timeoutRetryCount = 0;\n this._tokenExpiring = async () => {\n const logger2 = this._logger.create(\"_tokenExpiring\");\n try {\n await this._userManager.signinSilent();\n this._timeoutRetryCount = 0;\n logger2.debug(\"silent token renewal successful\");\n } catch (err) {\n if (err instanceof ErrorTimeout) {\n this._timeoutRetryCount++;\n const maxRetries = this._userManager.settings.maxSilentRenewTimeoutRetries;\n const hasReachedLimit = maxRetries !== void 0 && this._timeoutRetryCount > maxRetries;\n if (hasReachedLimit) {\n logger2.error(\n `Timeout retry limit reached (${this._timeoutRetryCount} > ${maxRetries}), raising silentRenewError:`,\n err\n );\n this._timeoutRetryCount = 0;\n await this._userManager.events._raiseSilentRenewError(err);\n return;\n }\n logger2.warn(\n `ErrorTimeout from signinSilent (attempt ${this._timeoutRetryCount}), retry in 5s:`,\n err\n );\n this._retryTimer.init(5);\n return;\n }\n logger2.error(\"Error from signinSilent:\", err);\n this._timeoutRetryCount = 0;\n await this._userManager.events._raiseSilentRenewError(err);\n }\n };\n }\n async start() {\n const logger2 = this._logger.create(\"start\");\n if (!this._isStarted) {\n this._isStarted = true;\n this._userManager.events.addAccessTokenExpiring(this._tokenExpiring);\n this._retryTimer.addHandler(this._tokenExpiring);\n try {\n await this._userManager.getUser();\n } catch (err) {\n logger2.error(\"getUser error\", err);\n }\n }\n }\n stop() {\n if (this._isStarted) {\n this._retryTimer.cancel();\n this._retryTimer.removeHandler(this._tokenExpiring);\n this._userManager.events.removeAccessTokenExpiring(this._tokenExpiring);\n this._isStarted = false;\n }\n }\n};\n\n// src/RefreshState.ts\nvar RefreshState = class {\n constructor(args) {\n this.refresh_token = args.refresh_token;\n this.id_token = args.id_token;\n this.session_state = args.session_state;\n this.scope = args.scope;\n this.profile = args.profile;\n this.data = args.state;\n }\n};\n\n// src/UserManager.ts\nvar UserManager = class {\n constructor(settings, redirectNavigator, popupNavigator, iframeNavigator) {\n this._logger = new Logger(\"UserManager\");\n this.settings = new UserManagerSettingsStore(settings);\n this._client = new OidcClient(settings);\n this._redirectNavigator = redirectNavigator != null ? redirectNavigator : new RedirectNavigator(this.settings);\n this._popupNavigator = popupNavigator != null ? popupNavigator : new PopupNavigator(this.settings);\n this._iframeNavigator = iframeNavigator != null ? iframeNavigator : new IFrameNavigator(this.settings);\n this._events = new UserManagerEvents(this.settings);\n this._silentRenewService = new SilentRenewService(this);\n if (this.settings.automaticSilentRenew) {\n this.startSilentRenew();\n }\n this._sessionMonitor = null;\n if (this.settings.monitorSession) {\n this._sessionMonitor = new SessionMonitor(this);\n }\n }\n /**\n * Get object used to register for events raised by the `UserManager`.\n */\n get events() {\n return this._events;\n }\n /**\n * Get object used to access the metadata configuration of the identity provider.\n */\n get metadataService() {\n return this._client.metadataService;\n }\n /**\n * Load the `User` object for the currently authenticated user.\n *\n * @param raiseEvent - If `true`, the `UserLoaded` event will be raised. Defaults to false.\n * @returns A promise\n */\n async getUser(raiseEvent = false) {\n const logger2 = this._logger.create(\"getUser\");\n const user = await this._loadUser();\n if (user) {\n logger2.info(\"user loaded\");\n await this._events.load(user, raiseEvent);\n return user;\n }\n logger2.info(\"user not found in storage\");\n return null;\n }\n /**\n * Remove from any storage the currently authenticated user.\n *\n * @returns A promise\n */\n async removeUser() {\n const logger2 = this._logger.create(\"removeUser\");\n await this.storeUser(null);\n logger2.info(\"user removed from storage\");\n await this._events.unload();\n }\n /**\n * Trigger a redirect of the current window to the authorization endpoint.\n *\n * @returns A promise\n *\n * @throws `Error` In cases of wrong authentication.\n */\n async signinRedirect(args = {}) {\n var _a;\n this._logger.create(\"signinRedirect\");\n const {\n redirectMethod,\n ...requestArgs\n } = args;\n let dpopJkt;\n if ((_a = this.settings.dpop) == null ? void 0 : _a.bind_authorization_code) {\n dpopJkt = await this.generateDPoPJkt(this.settings.dpop);\n }\n const handle = await this._redirectNavigator.prepare({ redirectMethod });\n await this._signinStart({\n request_type: \"si:r\",\n dpopJkt,\n ...requestArgs\n }, handle);\n }\n /**\n * Process the response (callback) from the authorization endpoint.\n * It is recommended to use {@link UserManager.signinCallback} instead.\n *\n * @returns A promise containing the authenticated `User`.\n *\n * @see {@link UserManager.signinCallback}\n */\n async signinRedirectCallback(url = window.location.href) {\n const logger2 = this._logger.create(\"signinRedirectCallback\");\n const user = await this._signinEnd(url);\n if (user.profile && user.profile.sub) {\n logger2.info(\"success, signed in subject\", user.profile.sub);\n } else {\n logger2.info(\"no subject\");\n }\n return user;\n }\n /**\n * Trigger the signin with user/password.\n *\n * @returns A promise containing the authenticated `User`.\n * @throws {@link ErrorResponse} In cases of wrong authentication.\n */\n async signinResourceOwnerCredentials({\n username,\n password,\n skipUserInfo = false\n }) {\n const logger2 = this._logger.create(\"signinResourceOwnerCredential\");\n const signinResponse = await this._client.processResourceOwnerPasswordCredentials({\n username,\n password,\n skipUserInfo,\n extraTokenParams: this.settings.extraTokenParams\n });\n logger2.debug(\"got signin response\");\n const user = await this._buildUser(signinResponse);\n if (user.profile && user.profile.sub) {\n logger2.info(\"success, signed in subject\", user.profile.sub);\n } else {\n logger2.info(\"no subject\");\n }\n return user;\n }\n /**\n * Trigger a request (via a popup window) to the authorization endpoint.\n *\n * @returns A promise containing the authenticated `User`.\n * @throws `Error` In cases of wrong authentication.\n */\n async signinPopup(args = {}) {\n var _a;\n const logger2 = this._logger.create(\"signinPopup\");\n let dpopJkt;\n if ((_a = this.settings.dpop) == null ? void 0 : _a.bind_authorization_code) {\n dpopJkt = await this.generateDPoPJkt(this.settings.dpop);\n }\n const {\n popupWindowFeatures,\n popupWindowTarget,\n popupSignal,\n popupAbortOnClose,\n ...requestArgs\n } = args;\n const url = this.settings.popup_redirect_uri;\n if (!url) {\n logger2.throw(new Error(\"No popup_redirect_uri configured\"));\n }\n const handle = await this._popupNavigator.prepare({ popupWindowFeatures, popupWindowTarget, popupSignal, popupAbortOnClose });\n const user = await this._signin({\n request_type: \"si:p\",\n redirect_uri: url,\n display: \"popup\",\n dpopJkt,\n ...requestArgs\n }, handle);\n if (user) {\n if (user.profile && user.profile.sub) {\n logger2.info(\"success, signed in subject\", user.profile.sub);\n } else {\n logger2.info(\"no subject\");\n }\n }\n return user;\n }\n /**\n * Notify the opening window of response (callback) from the authorization endpoint.\n * It is recommended to use {@link UserManager.signinCallback} instead.\n *\n * @returns A promise\n *\n * @see {@link UserManager.signinCallback}\n */\n async signinPopupCallback(url = window.location.href, keepOpen = false) {\n const logger2 = this._logger.create(\"signinPopupCallback\");\n await this._popupNavigator.callback(url, { keepOpen });\n logger2.info(\"success\");\n }\n /**\n * Trigger a silent request (via refresh token or an iframe) to the authorization endpoint.\n *\n * @returns A promise that contains the authenticated `User`.\n */\n async signinSilent(args = {}) {\n var _a, _b;\n const logger2 = this._logger.create(\"signinSilent\");\n const {\n silentRequestTimeoutInSeconds,\n ...requestArgs\n } = args;\n let user = await this._loadUser();\n if (!args.forceIframeAuth && (user == null ? void 0 : user.refresh_token)) {\n logger2.debug(\"using refresh token\");\n const state = new RefreshState(user);\n return await this._useRefreshToken({\n state,\n redirect_uri: requestArgs.redirect_uri,\n resource: requestArgs.resource,\n extraTokenParams: requestArgs.extraTokenParams,\n timeoutInSeconds: silentRequestTimeoutInSeconds\n });\n }\n let dpopJkt;\n if ((_a = this.settings.dpop) == null ? void 0 : _a.bind_authorization_code) {\n dpopJkt = await this.generateDPoPJkt(this.settings.dpop);\n }\n const url = this.settings.silent_redirect_uri;\n if (!url) {\n logger2.throw(new Error(\"No silent_redirect_uri configured\"));\n }\n let verifySub;\n if (user && this.settings.validateSubOnSilentRenew) {\n logger2.debug(\"subject prior to silent renew:\", user.profile.sub);\n verifySub = user.profile.sub;\n }\n const handle = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds });\n user = await this._signin({\n request_type: \"si:s\",\n redirect_uri: url,\n prompt: \"none\",\n id_token_hint: this.settings.includeIdTokenInSilentRenew ? user == null ? void 0 : user.id_token : void 0,\n dpopJkt,\n ...requestArgs\n }, handle, verifySub);\n if (user) {\n if ((_b = user.profile) == null ? void 0 : _b.sub) {\n logger2.info(\"success, signed in subject\", user.profile.sub);\n } else {\n logger2.info(\"no subject\");\n }\n }\n return user;\n }\n async _useRefreshToken(args) {\n const response = await this._client.useRefreshToken({\n timeoutInSeconds: this.settings.silentRequestTimeoutInSeconds,\n ...args\n });\n const user = new User({ ...args.state, ...response });\n await this.storeUser(user);\n await this._events.load(user);\n return user;\n }\n /**\n *\n * Notify the parent window of response (callback) from the authorization endpoint.\n * It is recommended to use {@link UserManager.signinCallback} instead.\n *\n * @returns A promise\n *\n * @see {@link UserManager.signinCallback}\n */\n async signinSilentCallback(url = window.location.href) {\n const logger2 = this._logger.create(\"signinSilentCallback\");\n await this._iframeNavigator.callback(url);\n logger2.info(\"success\");\n }\n /**\n * Process any response (callback) from the authorization endpoint, by dispatching the request_type\n * and executing one of the following functions:\n * - {@link UserManager.signinRedirectCallback}\n * - {@link UserManager.signinPopupCallback}\n * - {@link UserManager.signinSilentCallback}\n *\n * @throws `Error` If request_type is unknown or signin cannot be processed.\n */\n async signinCallback(url = window.location.href) {\n const { state } = await this._client.readSigninResponseState(url);\n switch (state.request_type) {\n case \"si:r\":\n return await this.signinRedirectCallback(url);\n case \"si:p\":\n await this.signinPopupCallback(url);\n break;\n case \"si:s\":\n await this.signinSilentCallback(url);\n break;\n default:\n throw new Error(\"invalid request_type in state\");\n }\n return void 0;\n }\n /**\n * Process any response (callback) from the end session endpoint, by dispatching the request_type\n * and executing one of the following functions:\n * - {@link UserManager.signoutRedirectCallback}\n * - {@link UserManager.signoutPopupCallback}\n * - {@link UserManager.signoutSilentCallback}\n *\n * @throws `Error` If request_type is unknown or signout cannot be processed.\n */\n async signoutCallback(url = window.location.href, keepOpen = false) {\n const { state } = await this._client.readSignoutResponseState(url);\n if (!state) {\n return void 0;\n }\n switch (state.request_type) {\n case \"so:r\":\n return await this.signoutRedirectCallback(url);\n case \"so:p\":\n await this.signoutPopupCallback(url, keepOpen);\n break;\n case \"so:s\":\n await this.signoutSilentCallback(url);\n break;\n default:\n throw new Error(\"invalid request_type in state\");\n }\n return void 0;\n }\n /**\n * Query OP for user's current signin status.\n *\n * @returns A promise object with session_state and subject identifier.\n */\n async querySessionStatus(args = {}) {\n const logger2 = this._logger.create(\"querySessionStatus\");\n const {\n silentRequestTimeoutInSeconds,\n ...requestArgs\n } = args;\n const url = this.settings.silent_redirect_uri;\n if (!url) {\n logger2.throw(new Error(\"No silent_redirect_uri configured\"));\n }\n const user = await this._loadUser();\n const handle = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds });\n const navResponse = await this._signinStart({\n request_type: \"si:s\",\n // this acts like a signin silent\n redirect_uri: url,\n prompt: \"none\",\n id_token_hint: this.settings.includeIdTokenInSilentRenew ? user == null ? void 0 : user.id_token : void 0,\n response_type: this.settings.query_status_response_type,\n scope: \"openid\",\n skipUserInfo: true,\n ...requestArgs\n }, handle);\n try {\n const extraHeaders = {};\n const signinResponse = await this._client.processSigninResponse(navResponse.url, extraHeaders);\n logger2.debug(\"got signin response\");\n if (signinResponse.session_state && signinResponse.profile.sub) {\n logger2.info(\"success for subject\", signinResponse.profile.sub);\n return {\n session_state: signinResponse.session_state,\n sub: signinResponse.profile.sub\n };\n }\n logger2.info(\"success, user not authenticated\");\n return null;\n } catch (err) {\n if (this.settings.monitorAnonymousSession && err instanceof ErrorResponse) {\n switch (err.error) {\n case \"login_required\":\n case \"consent_required\":\n case \"interaction_required\":\n case \"account_selection_required\":\n logger2.info(\"success for anonymous user\");\n return {\n session_state: err.session_state\n };\n }\n }\n throw err;\n }\n }\n async _signin(args, handle, verifySub) {\n const navResponse = await this._signinStart(args, handle);\n return await this._signinEnd(navResponse.url, verifySub);\n }\n async _signinStart(args, handle) {\n const logger2 = this._logger.create(\"_signinStart\");\n try {\n const signinRequest = await this._client.createSigninRequest(args);\n logger2.debug(\"got signin request\");\n return await handle.navigate({\n url: signinRequest.url,\n state: signinRequest.state.id,\n response_mode: signinRequest.state.response_mode,\n scriptOrigin: this.settings.iframeScriptOrigin\n });\n } catch (err) {\n logger2.debug(\"error after preparing navigator, closing navigator window\");\n handle.close();\n throw err;\n }\n }\n async _signinEnd(url, verifySub) {\n const logger2 = this._logger.create(\"_signinEnd\");\n const extraHeaders = {};\n const signinResponse = await this._client.processSigninResponse(url, extraHeaders);\n logger2.debug(\"got signin response\");\n const user = await this._buildUser(signinResponse, verifySub);\n return user;\n }\n async _buildUser(signinResponse, verifySub) {\n const logger2 = this._logger.create(\"_buildUser\");\n const user = new User(signinResponse);\n if (verifySub) {\n if (verifySub !== user.profile.sub) {\n logger2.debug(\"current user does not match user returned from signin. sub from signin:\", user.profile.sub);\n throw new ErrorResponse({ ...signinResponse, error: \"login_required\" });\n }\n logger2.debug(\"current user matches user returned from signin\");\n }\n await this.storeUser(user);\n logger2.debug(\"user stored\");\n await this._events.load(user);\n return user;\n }\n /**\n * Trigger a redirect of the current window to the end session endpoint.\n *\n * @returns A promise\n */\n async signoutRedirect(args = {}) {\n const logger2 = this._logger.create(\"signoutRedirect\");\n const {\n redirectMethod,\n ...requestArgs\n } = args;\n const handle = await this._redirectNavigator.prepare({ redirectMethod });\n await this._signoutStart({\n request_type: \"so:r\",\n post_logout_redirect_uri: this.settings.post_logout_redirect_uri,\n ...requestArgs\n }, handle);\n logger2.info(\"success\");\n }\n /**\n * Process response (callback) from the end session endpoint.\n * It is recommended to use {@link UserManager.signoutCallback} instead.\n *\n * @returns A promise containing signout response\n *\n * @see {@link UserManager.signoutCallback}\n */\n async signoutRedirectCallback(url = window.location.href) {\n const logger2 = this._logger.create(\"signoutRedirectCallback\");\n const response = await this._signoutEnd(url);\n logger2.info(\"success\");\n return response;\n }\n /**\n * Trigger a redirect of a popup window to the end session endpoint.\n *\n * @returns A promise\n */\n async signoutPopup(args = {}) {\n const logger2 = this._logger.create(\"signoutPopup\");\n const {\n popupWindowFeatures,\n popupWindowTarget,\n popupSignal,\n ...requestArgs\n } = args;\n const url = this.settings.popup_post_logout_redirect_uri;\n const handle = await this._popupNavigator.prepare({ popupWindowFeatures, popupWindowTarget, popupSignal });\n await this._signout({\n request_type: \"so:p\",\n post_logout_redirect_uri: url,\n // we're putting a dummy entry in here because we\n // need a unique id from the state for notification\n // to the parent window, which is necessary if we\n // plan to return back to the client after signout\n // and so we can close the popup after signout\n state: url == null ? void 0 : {},\n ...requestArgs\n }, handle);\n logger2.info(\"success\");\n }\n /**\n * Process response (callback) from the end session endpoint from a popup window.\n * It is recommended to use {@link UserManager.signoutCallback} instead.\n *\n * @returns A promise\n *\n * @see {@link UserManager.signoutCallback}\n */\n async signoutPopupCallback(url = window.location.href, keepOpen = false) {\n const logger2 = this._logger.create(\"signoutPopupCallback\");\n await this._popupNavigator.callback(url, { keepOpen });\n logger2.info(\"success\");\n }\n async _signout(args, handle) {\n const navResponse = await this._signoutStart(args, handle);\n return await this._signoutEnd(navResponse.url);\n }\n async _signoutStart(args = {}, handle) {\n var _a;\n const logger2 = this._logger.create(\"_signoutStart\");\n try {\n const user = await this._loadUser();\n logger2.debug(\"loaded current user from storage\");\n if (this.settings.revokeTokensOnSignout) {\n await this._revokeInternal(user);\n }\n const id_token = args.id_token_hint || user && user.id_token;\n if (id_token) {\n logger2.debug(\"setting id_token_hint in signout request\");\n args.id_token_hint = id_token;\n }\n await this.removeUser();\n logger2.debug(\"user removed, creating signout request\");\n const signoutRequest = await this._client.createSignoutRequest(args);\n logger2.debug(\"got signout request\");\n return await handle.navigate({\n url: signoutRequest.url,\n state: (_a = signoutRequest.state) == null ? void 0 : _a.id,\n scriptOrigin: this.settings.iframeScriptOrigin\n });\n } catch (err) {\n logger2.debug(\"error after preparing navigator, closing navigator window\");\n handle.close();\n throw err;\n }\n }\n async _signoutEnd(url) {\n const logger2 = this._logger.create(\"_signoutEnd\");\n const signoutResponse = await this._client.processSignoutResponse(url);\n logger2.debug(\"got signout response\");\n return signoutResponse;\n }\n /**\n * Trigger a silent request (via an iframe) to the end session endpoint.\n *\n * @returns A promise\n */\n async signoutSilent(args = {}) {\n var _a;\n const logger2 = this._logger.create(\"signoutSilent\");\n const {\n silentRequestTimeoutInSeconds,\n ...requestArgs\n } = args;\n const id_token_hint = this.settings.includeIdTokenInSilentSignout ? (_a = await this._loadUser()) == null ? void 0 : _a.id_token : void 0;\n const url = this.settings.popup_post_logout_redirect_uri;\n const handle = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds });\n await this._signout({\n request_type: \"so:s\",\n post_logout_redirect_uri: url,\n id_token_hint,\n ...requestArgs\n }, handle);\n logger2.info(\"success\");\n }\n /**\n * Notify the parent window of response (callback) from the end session endpoint.\n * It is recommended to use {@link UserManager.signoutCallback} instead.\n *\n * @returns A promise\n *\n * @see {@link UserManager.signoutCallback}\n */\n async signoutSilentCallback(url = window.location.href) {\n const logger2 = this._logger.create(\"signoutSilentCallback\");\n await this._iframeNavigator.callback(url);\n logger2.info(\"success\");\n }\n async revokeTokens(types) {\n const user = await this._loadUser();\n await this._revokeInternal(user, types);\n }\n async _revokeInternal(user, types = this.settings.revokeTokenTypes) {\n const logger2 = this._logger.create(\"_revokeInternal\");\n if (!user) return;\n const typesPresent = types.filter((type) => typeof user[type] === \"string\");\n if (!typesPresent.length) {\n logger2.debug(\"no need to revoke due to no token(s)\");\n return;\n }\n for (const type of typesPresent) {\n await this._client.revokeToken(\n user[type],\n type\n );\n logger2.info(`${type} revoked successfully`);\n if (type !== \"access_token\") {\n user[type] = null;\n }\n }\n await this.storeUser(user);\n logger2.debug(\"user stored\");\n await this._events.load(user);\n }\n /**\n * Enables silent renew for the `UserManager`.\n */\n startSilentRenew() {\n this._logger.create(\"startSilentRenew\");\n void this._silentRenewService.start();\n }\n /**\n * Disables silent renew for the `UserManager`.\n */\n stopSilentRenew() {\n this._silentRenewService.stop();\n }\n get _userStoreKey() {\n return `user:${this.settings.authority}:${this.settings.client_id}`;\n }\n async _loadUser() {\n const logger2 = this._logger.create(\"_loadUser\");\n const storageString = await this.settings.userStore.get(this._userStoreKey);\n if (storageString) {\n logger2.debug(\"user storageString loaded\");\n return User.fromStorageString(storageString);\n }\n logger2.debug(\"no user storageString\");\n return null;\n }\n async storeUser(user) {\n const logger2 = this._logger.create(\"storeUser\");\n if (user) {\n logger2.debug(\"storing user\");\n const storageString = user.toStorageString();\n await this.settings.userStore.set(this._userStoreKey, storageString);\n } else {\n this._logger.debug(\"removing user\");\n await this.settings.userStore.remove(this._userStoreKey);\n if (this.settings.dpop) {\n await this.settings.dpop.store.remove(this.settings.client_id);\n }\n }\n }\n /**\n * Removes stale state entries in storage for incomplete authorize requests.\n */\n async clearStaleState() {\n await this._client.clearStaleState();\n }\n /**\n * Dynamically generates a DPoP proof for a given user, URL and optional Http method.\n * This method is useful when you need to make a request to a resource server\n * with fetch or similar, and you need to include a DPoP proof in a DPoP header.\n * @param url - The URL to generate the DPoP proof for\n * @param user - The user to generate the DPoP proof for\n * @param httpMethod - Optional, defaults to \"GET\"\n * @param nonce - Optional nonce provided by the resource server\n *\n * @returns A promise containing the DPoP proof or undefined if DPoP is not enabled/no user is found.\n */\n async dpopProof(url, user, httpMethod, nonce) {\n var _a, _b;\n const dpopState = await ((_b = (_a = this.settings.dpop) == null ? void 0 : _a.store) == null ? void 0 : _b.get(this.settings.client_id));\n if (dpopState) {\n return await CryptoUtils.generateDPoPProof({\n url,\n accessToken: user == null ? void 0 : user.access_token,\n httpMethod,\n keyPair: dpopState.keys,\n nonce\n });\n }\n return void 0;\n }\n async generateDPoPJkt(dpopSettings) {\n let dpopState = await dpopSettings.store.get(this.settings.client_id);\n if (!dpopState) {\n const dpopKeys = await CryptoUtils.generateDPoPKeys();\n dpopState = new DPoPState(dpopKeys);\n await dpopSettings.store.set(this.settings.client_id, dpopState);\n }\n return await CryptoUtils.generateDPoPJkt(dpopState.keys);\n }\n};\n\n// package.json\nvar version = \"3.5.0\";\n\n// src/Version.ts\nvar Version = version;\n\n// src/IndexedDbDPoPStore.ts\nvar IndexedDbDPoPStore = class {\n constructor() {\n this._dbName = \"oidc\";\n this._storeName = \"dpop\";\n }\n async set(key, value) {\n const store = await this.createStore(this._dbName, this._storeName);\n await store(\"readwrite\", (str) => {\n str.put(value, key);\n return this.promisifyRequest(str.transaction);\n });\n }\n async get(key) {\n const store = await this.createStore(this._dbName, this._storeName);\n return await store(\"readonly\", (str) => {\n return this.promisifyRequest(str.get(key));\n });\n }\n async remove(key) {\n const item = await this.get(key);\n const store = await this.createStore(this._dbName, this._storeName);\n await store(\"readwrite\", (str) => {\n return this.promisifyRequest(str.delete(key));\n });\n return item;\n }\n async getAllKeys() {\n const store = await this.createStore(this._dbName, this._storeName);\n return await store(\"readonly\", (str) => {\n return this.promisifyRequest(str.getAllKeys());\n });\n }\n promisifyRequest(request) {\n return new Promise((resolve, reject) => {\n request.oncomplete = request.onsuccess = () => resolve(request.result);\n request.onabort = request.onerror = () => reject(request.error);\n });\n }\n async createStore(dbName, storeName) {\n const request = indexedDB.open(dbName);\n request.onupgradeneeded = () => request.result.createObjectStore(storeName);\n const db = await this.promisifyRequest(request);\n return async (txMode, callback) => {\n const tx = db.transaction(storeName, txMode);\n const store = tx.objectStore(storeName);\n return await callback(store);\n };\n }\n};\nexport {\n AccessTokenEvents,\n CheckSessionIFrame,\n DPoPState,\n ErrorResponse,\n ErrorTimeout,\n InMemoryWebStorage,\n IndexedDbDPoPStore,\n Log,\n Logger,\n MetadataService,\n OidcClient,\n OidcClientSettingsStore,\n SessionMonitor,\n SigninResponse,\n SigninState,\n SignoutResponse,\n State,\n User,\n UserManager,\n UserManagerSettingsStore,\n Version,\n WebStorageStateStore\n};\n//# sourceMappingURL=oidc-client-ts.js.map\n","import { WebStorageStateStore, State } from 'oidc-client-ts';\nexport { AccessTokenEvents, CheckSessionIFrame, InMemoryWebStorage, Log, MetadataService, OidcClient, SessionMonitor, SigninResponse, User, UserManager, WebStorageStateStore } from 'oidc-client-ts';\nimport { determineSigningAlg, PREFERRED_SIGNING_ALG, generateDpopKeyPair, createDpopHeader, getWebidFromTokenPayload, OidcProviderError, InvalidResponseError, removeOpenIdParams } from '@inrupt/solid-client-authn-core';\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n// Camelcase identifiers are required in the OIDC specification.\n/* eslint-disable camelcase*/\nfunction processErrorResponse(\n// The type is any here because the object is parsed from a JSON response\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nresponseBody, options) {\n // The following errors are defined by the spec, and allow providing some context.\n // See https://tools.ietf.org/html/rfc7591#section-3.2.2 for more information\n if (responseBody.error === \"invalid_redirect_uri\") {\n throw new Error(`Dynamic client registration failed: the provided redirect uri [${options.redirectUrl?.toString()}] is invalid - ${responseBody.error_description ?? \"\"}`);\n }\n if (responseBody.error === \"invalid_client_metadata\") {\n throw new Error(`Dynamic client registration failed: the provided client metadata ${JSON.stringify(options)} is invalid - ${responseBody.error_description ?? \"\"}`);\n }\n // We currently don't support software statements, so no related error should happen.\n // If an error outside of the spec happens, no additional context can be provided\n throw new Error(`Dynamic client registration failed: ${responseBody.error} - ${responseBody.error_description ?? \"\"}`);\n}\nfunction hasClientId(body) {\n return typeof body.client_id === \"string\";\n}\nfunction hasRedirectUri(body) {\n return (Array.isArray(body.redirect_uris) &&\n body.redirect_uris.every((uri) => typeof uri === \"string\"));\n}\nfunction validateRegistrationResponse(responseBody, options) {\n if (!hasClientId(responseBody)) {\n throw new Error(`Dynamic client registration failed: no client_id has been found on ${JSON.stringify(responseBody)}`);\n }\n if (options.redirectUrl &&\n hasRedirectUri(responseBody) &&\n responseBody.redirect_uris[0] !== options.redirectUrl.toString()) {\n throw new Error(`Dynamic client registration failed: the returned redirect URIs ${JSON.stringify(responseBody.redirect_uris)} don't match the provided ${JSON.stringify([\n options.redirectUrl.toString(),\n ])}`);\n }\n return true;\n}\nasync function registerClient(options, issuerConfig) {\n if (!issuerConfig.registrationEndpoint) {\n throw new Error(\"Dynamic Registration could not be completed because the issuer has no registration endpoint.\");\n }\n if (!Array.isArray(issuerConfig.idTokenSigningAlgValuesSupported)) {\n throw new Error(\"The OIDC issuer discovery profile is missing the 'id_token_signing_alg_values_supported' value, which is mandatory.\");\n }\n const signingAlg = determineSigningAlg(issuerConfig.idTokenSigningAlgValuesSupported, PREFERRED_SIGNING_ALG);\n const config = {\n client_name: options.clientName,\n application_type: \"web\",\n redirect_uris: [options.redirectUrl?.toString()],\n subject_type: \"public\",\n token_endpoint_auth_method: \"client_secret_basic\",\n id_token_signed_response_alg: signingAlg,\n grant_types: [\"authorization_code\", \"refresh_token\"],\n };\n const headers = {\n \"Content-Type\": \"application/json\",\n };\n const registerResponse = await fetch(issuerConfig.registrationEndpoint.toString(), {\n method: \"POST\",\n headers,\n body: JSON.stringify(config),\n });\n if (registerResponse.ok) {\n const responseBody = await registerResponse.json();\n validateRegistrationResponse(responseBody, options);\n return {\n clientId: responseBody.client_id,\n clientSecret: responseBody.client_secret,\n expiresAt: responseBody.client_secret_expires_at,\n idTokenSignedResponseAlg: responseBody.id_token_signed_response_alg,\n clientType: \"dynamic\",\n };\n }\n if (registerResponse.status === 400) {\n processErrorResponse(await registerResponse.json(), options);\n }\n throw new Error(`Dynamic client registration failed: the server returned ${registerResponse.status} ${registerResponse.statusText} - ${await registerResponse.text()}`);\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n// Camelcase identifiers are required in the OAuth specification.\n/* eslint-disable camelcase*/\nfunction hasError(value) {\n return value.error !== undefined && typeof value.error === \"string\";\n}\nfunction hasErrorDescription(value) {\n return (value.error_description !== undefined &&\n typeof value.error_description === \"string\");\n}\nfunction hasErrorUri(value) {\n return value.error_uri !== undefined && typeof value.error_uri === \"string\";\n}\nfunction hasAccessToken(value) {\n return (value.access_token !== undefined && typeof value.access_token === \"string\");\n}\nfunction hasIdToken(value) {\n return value.id_token !== undefined && typeof value.id_token === \"string\";\n}\nfunction hasRefreshToken(value) {\n return (value.refresh_token !== undefined && typeof value.refresh_token === \"string\");\n}\nfunction hasTokenType(value) {\n return value.token_type !== undefined && typeof value.token_type === \"string\";\n}\nfunction hasExpiresIn(value) {\n return value.expires_in === undefined || typeof value.expires_in === \"number\";\n}\nfunction validatePreconditions(issuer, data) {\n if (data.grantType &&\n (!issuer.grantTypesSupported ||\n !issuer.grantTypesSupported.includes(data.grantType))) {\n throw new Error(`The issuer [${issuer.issuer}] does not support the [${data.grantType}] grant`);\n }\n if (!issuer.tokenEndpoint) {\n throw new Error(`This issuer [${issuer.issuer}] does not have a token endpoint`);\n }\n}\nfunction validateTokenEndpointResponse(tokenResponse, dpop) {\n if (hasError(tokenResponse)) {\n throw new OidcProviderError(`Token endpoint returned error [${tokenResponse.error}]${hasErrorDescription(tokenResponse)\n ? `: ${tokenResponse.error_description}`\n : \"\"}${hasErrorUri(tokenResponse) ? ` (see ${tokenResponse.error_uri})` : \"\"}`, tokenResponse.error, hasErrorDescription(tokenResponse)\n ? tokenResponse.error_description\n : undefined);\n }\n if (!hasAccessToken(tokenResponse)) {\n throw new InvalidResponseError([\"access_token\"]);\n }\n if (!hasIdToken(tokenResponse)) {\n throw new InvalidResponseError([\"id_token\"]);\n }\n if (!hasTokenType(tokenResponse)) {\n throw new InvalidResponseError([\"token_type\"]);\n }\n if (!hasExpiresIn(tokenResponse)) {\n throw new InvalidResponseError([\"expires_in\"]);\n }\n // TODO: Due to a bug in both the ESS ID broker AND NSS (what were the odds), a DPoP token is returned\n // with a token_type 'Bearer'. To work around this, this test is currently disabled.\n // https://github.com/solid/oidc-op/issues/26\n // Fixed, but unreleased for the ESS (current version: inrupt-oidc-server-0.5.2)\n // if (dpop && tokenResponse.token_type.toLowerCase() !== \"dpop\") {\n // throw new Error(\n // `Invalid token endpoint response: requested a [DPoP] token, but got a 'token_type' value of [${tokenResponse.token_type}].`\n // );\n // }\n if (!dpop && tokenResponse.token_type.toLowerCase() !== \"bearer\") {\n throw new Error(`Invalid token endpoint response: requested a [Bearer] token, but got a 'token_type' value of [${tokenResponse.token_type}].`);\n }\n return tokenResponse;\n}\nasync function getTokens(issuer, client, data, dpop) {\n validatePreconditions(issuer, data);\n const headers = {\n \"content-type\": \"application/x-www-form-urlencoded\",\n };\n let dpopKey;\n if (dpop) {\n dpopKey = await generateDpopKeyPair(false);\n headers.DPoP = await createDpopHeader(issuer.tokenEndpoint, \"POST\", dpopKey);\n }\n // Note: this defaults to client_secret_basic. client_secret_post\n // is currently not supported. See https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication\n // for details.\n if (client.clientSecret) {\n headers.Authorization = `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`;\n }\n const requestBody = {\n grant_type: data.grantType,\n redirect_uri: data.redirectUrl,\n code: data.code,\n code_verifier: data.codeVerifier,\n client_id: client.clientId,\n };\n const tokenRequestInit = {\n method: \"POST\",\n headers,\n body: new URLSearchParams(requestBody).toString(),\n };\n const rawTokenResponse = await fetch(issuer.tokenEndpoint, tokenRequestInit);\n const jsonTokenResponse = (await rawTokenResponse.json());\n const tokenResponse = validateTokenEndpointResponse(jsonTokenResponse, dpop);\n const { webId, clientId } = await getWebidFromTokenPayload(tokenResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);\n return {\n accessToken: tokenResponse.access_token,\n idToken: tokenResponse.id_token,\n refreshToken: hasRefreshToken(tokenResponse)\n ? tokenResponse.refresh_token\n : undefined,\n webId,\n clientId,\n dpopKey,\n expiresIn: tokenResponse.expires_in,\n };\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\nconst isValidUrl = (url) => {\n try {\n // Here, the URL constructor is just called to parse the given string and\n // verify if it is a well-formed IRI.\n new URL(url);\n return true;\n }\n catch {\n return false;\n }\n};\n// Identifiers in snake_case are mandated by the OAuth spec.\nasync function refresh(refreshToken, issuer, client, dpopKey) {\n if (client.clientId === undefined) {\n throw new Error(\"No client ID available when trying to refresh the access token.\");\n }\n const requestBody = {\n grant_type: \"refresh_token\",\n refresh_token: refreshToken,\n };\n let dpopHeader = {};\n if (dpopKey !== undefined) {\n dpopHeader = {\n DPoP: await createDpopHeader(issuer.tokenEndpoint, \"POST\", dpopKey),\n };\n }\n let authHeader = {};\n if (client.clientSecret !== undefined) {\n authHeader = {\n // We assume that client_secret_basic is the client authentication method.\n // TODO: Get the authentication method from the IClient configuration object.\n Authorization: `Basic ${btoa(`${client.clientId}:${client.clientSecret}`)}`,\n };\n }\n else if (isValidUrl(client.clientId)) {\n // If the client ID is an URL, and there is no client secret, the client\n // has a Solid-OIDC Client Identifier, and it should be present in the\n // request body.\n requestBody.client_id = client.clientId;\n }\n const rawResponse = await fetch(issuer.tokenEndpoint, {\n method: \"POST\",\n body: new URLSearchParams(requestBody).toString(),\n headers: {\n ...dpopHeader,\n ...authHeader,\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n });\n let response;\n try {\n response = await rawResponse.json();\n }\n catch (_e) {\n // The response is left out of the error on purpose not to leak any sensitive information.\n throw new Error(`The token endpoint of issuer ${issuer.issuer} returned a malformed response.`);\n }\n const validatedResponse = validateTokenEndpointResponse(response, dpopKey !== undefined);\n const { webId } = await getWebidFromTokenPayload(validatedResponse.id_token, issuer.jwksUri, issuer.issuer, client.clientId);\n return {\n accessToken: validatedResponse.access_token,\n idToken: validatedResponse.id_token,\n refreshToken: typeof validatedResponse.refresh_token === \"string\"\n ? validatedResponse.refresh_token\n : undefined,\n webId,\n dpopKey,\n expiresIn: validatedResponse.expires_in,\n };\n}\n\n// Copyright Inrupt Inc.\n//\n// Permission is hereby granted, free of charge, to any person obtaining a copy\n// of this software and associated documentation files (the \"Software\"), to deal in\n// the Software without restriction, including without limitation the rights to use,\n// copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the\n// Software, and to permit persons to whom the Software is furnished to do so,\n// subject to the following conditions:\n//\n// The above copyright notice and this permission notice shall be included in\n// all copies or substantial portions of the Software.\n//\n// THE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\n// INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A\n// PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT\n// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION\n// OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\n// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.\n//\n/**\n * Removes OIDC-specific query parameters from a given URL (state, code...), and\n * sanitizes the URL (e.g. removes the hash fragment).\n * @param redirectUrl The URL to clean up.\n * @returns A copy of the URL, without OIDC-specific query params.\n */\nfunction normalizeCallbackUrl(redirectUrl) {\n const cleanedUrl = removeOpenIdParams(redirectUrl);\n // As per https://tools.ietf.org/html/rfc6749#section-3.1.2, the redirect URL\n // must not include a hash fragment.\n cleanedUrl.hash = \"\";\n // Do not normalize the trailing slash, and respect the original redirect URL.\n if (\n // The trailing slash is present in the original redirect URL\n redirectUrl.includes(`${cleanedUrl.origin}/`)) {\n return cleanedUrl.href;\n }\n // Calling cleanedUrl.href appends a trailing slash to the origin, which may\n // create a redirect URL mismatch if it wasn't originally present.\n return `${cleanedUrl.origin}${cleanedUrl.href.substring(\n // Adds 1 to the origin length to remove the trailing slash\n cleanedUrl.origin.length + 1)}`;\n}\n/**\n * Clears any OIDC-related data lingering in the local storage.\n */\nasync function clearOidcPersistentStorage() {\n const store = new WebStorageStateStore({});\n await State.clearStaleState(store, 60 * 15);\n const myStorage = window.localStorage;\n const itemsToRemove = [];\n for (let i = 0; i <= myStorage.length; i += 1) {\n const key = myStorage.key(i);\n if (key &&\n (key.match(/^oidc\\..+$/) ||\n key.match(/^solidClientAuthenticationUser:.+$/))) {\n itemsToRemove.push(key);\n }\n }\n itemsToRemove.forEach((key) => myStorage.removeItem(key));\n}\n\nexport { clearOidcPersistentStorage, getTokens, normalizeCallbackUrl, refresh, registerClient };\n",null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null],"names":["encoder","TextEncoder","decoder","TextDecoder","strictDecoder","fatal","concat","buffers","size","reduce","acc","length","buf","Uint8Array","i","buffer","set","NON_ASCII","encode","string","test","TypeError","bytes","code","charCodeAt","JOSEError","Error","static","constructor","message","options","super","this","name","captureStackTrace","JWTClaimValidationFailed","claim","reason","payload","cause","JWTExpired","JOSEAlgNotAllowed","JOSENotSupported","JWSInvalid","JWTInvalid","JWKSInvalid","JWKSNoMatchingKey","JWKSMultipleMatchingKeys","Symbol","asyncIterator","async","JWKSTimeout","JWSSignatureVerificationFailed","decode","input","encoded","url","fromBase64","alphabet","includes","replace","binary","atob","decodeBase64","prototype","toBase64","omitPadding","arr","push","String","fromCharCode","apply","subarray","btoa","join","encodeBase64","isObject","Object","toString","call","getPrototypeOf","isJwkSet","Array","isArray","keys","from","every","isDisjoint","headers","parameters","Set","header","parameter","has","add","decodeBase64url","value","label","ErrorClass","JWS_RECOGNIZED","__proto__","b64","validateAlgorithms","option","algorithms","some","s","validateCrit","Err","recognizedDefault","recognizedOption","protectedHeader","joseHeader","crit","recognized","hasOwn","validateB64","extensions","serializeJoseHeader","serialized","parsed","JSON","stringify","parse","prepareKey","entry","key","usage","alg","secret","requiresPrivateKey","normalized","keyObject","jwk","snapshotJwk","ext","key_ops","keyOps","operation","normalizeJwk","kty","invalidKeyType","k","priv","d","use","expected","expectedKeyOp","ops","jwkMatchesOp","isFrozen","freeze","isKeyLike","expectedType","type","toStringTag","tag","isCryptoKey","export","cache","WeakMap","cacheKey","cached","get","toCryptoKey","isPublic","crv","nist","asymmetricKeyDetails","namedCurve","params","resolve","asymmetricKeyType","subtle","usages","format","jwkToKey","prime256v1","secp384r1","secp521r1","CryptoKey","isKeyObject","msg","actual","types","last","pop","unusable","prop","checkModulusLength","modulusLength","algorithm","checkCryptoKey","hash","checkUsage","extractable","isPrivate","keyData","crypto","importKey","rawKey","table","entries","out","wrap","derive","none","rsaes","bits","mode","ecdh","aeskw","gcm","pbes2","JWE","dir","A128KW","A192KW","A256KW","A128GCMKW","A192GCMKW","A256GCMKW","contentOps","contentEncryption","cbc","cekBits","ivBits","A128GCM","A192GCM","A256GCM","sig","hmac","signing","rsa","saltLength","minRsaBits","ecdsa","eddsa","mldsa","parameterSet","JWS","HS256","HS384","HS512","RS256","RS384","RS512","PS256","PS384","PS512","ES256","ES384","ES512","EdDSA","Ed25519","jwsAlgorithm","parseProtectedHeader","encodedProtectedHeader","parseJoseHeader","encodeCompactUnencodedPayload","verifySignature","jws","shared","encodeUnencodedPayload","parsedProtected","protected","inputPayload","signingPayload","resolvedKey","signingInput","encodeAsciiMember","signature","verificationKey","cryptoKey","verified","verify","result","unprotectedHeader","epoch","date","Math","floor","getTime","multipliers","m","h","w","y","REGEX","checkFailed","invalidDuration","secs","str","matched","exec","parseFloat","durationSeconds","round","toLowerCase","Number","isFinite","validateInput","validateStringClaim","numericDate","Date","normalizeTyp","validateNumericDate","claimsSet","required","unexpectedClaim","validateClaimsSet","claimsSetBytes","typ","requiredClaims","issuer","subject","audience","maxTokenAge","presenceCheck","reverse","audPayload","audOption","iss","sub","aud","clockTolerance","tolerance","currentDate","now","iat","nbf","exp","age","producerClaimsSets","producerClaimsSet","producer","jwtVerify","jwt","split","verifyCompact","prepareVerify","createSignature","rejectUnencoded","b64u","validateCritDuplicates","encodedPayload","signingKey","sign","SignJWT_base","structuredClone","setIssuer","setSubject","setAudience","member","validateAudienceClaim","setJti","jti","setNotBefore","setExpirationTime","setIssuedAt","SignJWT","setProtectedHeader","assertNotSet","createCompactSignature","jwtClaimsSetBytes","algArgument","unsupportedAlg","source","exportJWK","invalidKeyInput","exportKey","importWithAlgCache","pending","then","catch","error","createLocalJWKSet","jwks","snapshot","metadata","map","defineProperty","token","kid","candidates","filter","_","index","jwkKid","jwkAlg","indexOf","isUsableJWK","jwk2","USER_AGENT","navigator","userAgent","startsWith","customFetch","jwksCache","isFreshFor","timestamp","duration","validateDuration","fallback","isNaN","createRemoteJWKSet","URL","href","opts","timeoutOption","timeoutDuration","isInteger","cooldownDuration","cacheMaxAge","Headers","fetchImpl","jwksTimestamp","pendingFetch","local","reloadSequence","appliedSequence","uat","reload","WebSocketPair","EdgeRuntime","sequence","current","signal","fetch","response","method","redirect","err","status","json","fetchJwks","AbortSignal","timeout","next","updatedAt","finally","defineProperties","coolingDown","enumerable","fresh","reloading","getModulusLengthOption","generateKeyPair","validateExtractableOption","keyAlgorithm","publicExponent","of","generateKey","byteToHex","slice","rnds8","v4","offset","randomUUID","rnds","random","rng","getRandomValues","unsafeStringify","_v4","SOLID_CLIENT_AUTHN_KEY_PREFIX","PREFERRED_SIGNING_ALG","EVENTS","ERROR","LOGIN","LOGOUT","NEW_REFRESH_TOKEN","NEW_TOKENS","AUTHORIZATION_REQUEST","SESSION_EXPIRED","SESSION_EXTENDED","SESSION_RESTORED","TIMEOUT_SET","DEFAULT_SCOPES","AggregateHandler","handleables","getProperHandler","canHandleList","Promise","all","handleable","canHandle","handle","handler","param","_err","getWebidFromTokenPayload","idToken","jwksIri","issuerIri","clientId","clientIdInPayload","verifiedPayload","e","stack","azp","webid","webId","isValidRedirectUrl","redirectUrl","urlObject","noReservedQuery","searchParams","noHash","_e","removeOpenIdParams","cleanedUpUrl","delete","AuthorizationCodeWithPkceOidcHandlerBase","storageUtility","redirector","parametersGuard","oidcLoginOptions","undefined","issuerConfiguration","grantTypesSupported","setupRedirectHandler","state","codeVerifier","targetUrl","setForUser","sessionId","dpop","Boolean","keepAlive","handleRedirect","GeneralLogoutHandler","sessionInfoManager","userId","clear","IRpLogoutHandler","logoutType","toLogoutUrl","IWaterfallLogoutHandler","handlers","getUnauthenticatedSession","isLoggedIn","args","storage","deleteAllUserData","secure","SessionInfoManagerBase","update","_sessionId","_options","_sessionInfo","getAll","register","getRegisteredSessionIdAll","clearAll","setOidcContext","_authorizationRequestState","maybeBuildRpInitiatedLogout","endSessionEndpoint","idTokenHint","postLogoutUrl","postLogoutRedirectUri","append","getEndSessionUrl","isValidUrl","handleRegistration","issuerConfig","clientRegistrar","clientInfo","scopesSupported","isSolidOidcClient","clientName","clientType","isStaticClient","getClient","clientSecret","infoToSave","boundFetch","request","init","ClientAuthentication$1","loginHandler","redirectHandler","logoutHandler","issuerConfigFetcher","boundLogout","logout","getSessionInfo","getAllSessionInfo","loadOidcContextFromStorage","configFetcher","storedRedirectIri","getForUser","errorIfNull","deleteForUser","fetchConfig","StorageUtility","secureStorage","insecureStorage","getKey","getUserData","stored","setUserData","data","userData","values","InMemoryStorage","ConfigurationError","NotImplementedError","methodName","InvalidResponseError","missingFields","OidcProviderError","errorDescription","normalizeHTU","audienceUrl","pathname","origin","createDpopHeader","dpopKey","htu","htm","toUpperCase","publicKey","privateKey","buildAuthenticatedHeaders","authToken","defaultOptions","buildDpopFetchOptions","makeAuthenticatedRequest","accessToken","defaultRequestInit","unauthFetch","computeRefreshDelay","expiresIn","buildAuthenticatedFetch","latestTimeout","currentAccessToken","currentRefreshOptions","refreshOptions","emitter","eventEmitter","proactivelyRefreshToken","refreshedAccessToken","refreshToken","tokenSet","tokenRefresher","refresh","emit","refreshAccessToken","clearTimeout","setTimeout","expirationTimeout","requestInit","failedButNotExpectedAuthError","ok","statusCode","ReflectOwnKeys","R","Reflect","ReflectApply","target","receiver","Function","ownKeys","getOwnPropertySymbols","getOwnPropertyNames","NumberIsNaN","EventEmitter","eventsModule","exports","once","reject","errorListener","removeListener","resolver","arguments","eventTargetAgnosticAddListener","flags","on","addErrorHandlerIfEventEmitter","_events","_eventsCount","_maxListeners","defaultMaxListeners","checkListener","listener","_getMaxListeners","that","_addListener","prepend","events","existing","warning","create","newListener","unshift","warned","count","console","warn","onceWrapper","fired","wrapFn","_onceWrap","wrapped","bind","_listeners","unwrap","evlistener","ret","unwrapListeners","arrayClone","listenerCount","n","copy","addEventListener","wrapListener","arg","removeEventListener","RangeError","setMaxListeners","getMaxListeners","doError","er","context","len","listeners","addListener","prependListener","prependOnceListener","list","position","originalListener","shift","spliceOne","off","removeAllListeners","rawListeners","eventNames","StorageUtilityBrowser","InvalidTokenError","base64UrlDecode","output","decodeURIComponent","p","b64DecodeUnicode","level","logger","Log2","nopLogger","debug","info","Log","reset","setLevel","setLogger","Logger","_Logger","_name","_format","_method","methodLogger","createStatic","staticMethod","staticLogger","prefix","JwtUtils","pos","part","decoded","jwtDecode","generateSignedJwt","encodedToken","CryptoUtils","encodeBase64Url","window","generateSignedJwtWithHmac","secretKey","val","chr","_CryptoUtils","_randomWord","Uint32Array","generateUUIDv4","c","generateCodeVerifier","generateCodeChallenge","code_verifier","hashed","digest","generateBasicAuth","client_id","client_secret","msgUint8","hashBuffer","customCalculateJwkThumbprint","jsonObject","x","utf8encodedAndHashed","generateDPoPProof","httpMethod","keyPair","nonce","hashedToken","encodedHash","ath","publicJwk","generateDPoPJkt","generateDPoPKeys","generateClientAssertionJwt","hashFunction","Event","_callbacks","_logger","addHandler","cb","removeHandler","idx","lastIndexOf","splice","raise","ev","Timer","_Timer","_timerHandle","_expiration","_callback","diff","getEpochTime","cancel","durationInSeconds","logger2","max","expiration","timerDurationInSeconds","min","setInterval","clearInterval","UrlUtils","readParams","responseMode","URLSearchParams","URL_STATE_DELIMITER","ErrorResponse","form","_a","_b","_c","error_description","error_uri","userState","session_state","url_state","ErrorTimeout","InMemoryWebStorage","_data","getItem","setItem","removeItem","ErrorDPoPNonce","JsonService","additionalContentTypes","_jwtHandler","_extraHeaders","_contentTypes","fetchWithTimeout","timeoutInSeconds","initFetch","controller","AbortController","timeoutId","abort","DOMException","getJson","credentials","Accept","_appendExtraHeaders","contentType","find","item","throw","text","statusText","postForm","body","basicAuth","initCredentials","extraHeaders","responseText","customKeys","protectedHeaders","preventOverride","forEach","headerName","toLocaleLowerCase","content","MetadataService","_settings","_signingKeys","_metadata","_metadataUrl","metadataUrl","_jsonService","signingKeys","fetchRequestCredentials","_fetchRequestCredentials","resetSigningKeys","getMetadata","requestTimeoutInSeconds","assign","metadataSeed","getIssuer","_getMetadataProperty","getAuthorizationEndpoint","getUserInfoEndpoint","getTokenEndpoint","optional","getCheckSessionIframe","getEndSessionEndpoint","getRevocationEndpoint","getKeysEndpoint","getSigningKeys","jwks_uri","keySet","WebStorageStateStore","store","localStorage","_store","_prefix","remove","getAllKeys","substr","OidcClientSettingsStore","authority","response_type","scope","redirect_uri","post_logout_redirect_uri","client_authentication","token_endpoint_auth_signing_alg","prompt","display","max_age","ui_locales","acr_values","resource","response_mode","filterProtocolClaims","loadUserInfo","staleStateAgeInSeconds","mergeClaimsStrategy","array","disablePKCE","stateStore","revokeTokenAdditionalContentTypes","refreshTokenAllowedScope","extraQueryParams","extraTokenParams","omitScopeWhenRequesting","endsWith","UserInfoService","_metadataService","_getClaimsFromJwt","getClaims","claims","TokenClient","exchangeCode","grant_type","clientAssertion","exchangeCredentials","exchangeRefreshToken","refresh_token","revoke","token_type_hint","ResponseValidator","_claimsService","_userInfoService","_tokenClient","validateSigninResponse","_processSigninState","_processCode","isOpenId","_validateIdTokenAttributes","_processClaims","skipUserInfo","validateCredentialsResponse","shouldValidateSubClaim","id_token","validateRefreshResponse","profile","hasIdToken","validateSignoutResponse","id","validateSub","access_token","mergeClaims","tokenResponse","existingToken","incoming","auth_time","State","_State","created","request_type","toStorageString","fromStorageString","storageString","clearStaleState","cutoff","SigninState","_SigninState","code_challenge","_SigninRequest","state_data","dpopJkt","optionalParams","parsedUrl","stateParam","r","SigninRequest","SigninResponse","token_type","splitState","expires_in","expires_at","SignoutRequest","id_token_hint","SignoutResponse","DefaultProtocolClaims","InternalRequiredProtocolClaims","ClaimsService","protocolClaims","claims1","claims2","mergedValues","DPoPState","OidcClient","settings","metadataService","_validator","createSigninRequest","request_uri","login_hint","signinRequest","signinState","readSigninResponseState","removeState","storedStateString","processSigninResponse","dpopProof","getDpopProof","DPoP","dpopStore","dpopState","processResourceOwnerPasswordCredentials","username","password","signinResponse","useRefreshToken","allowableScopes","createSignoutRequest","signoutState","readSignoutResponseState","processSignoutResponse","revokeToken","validateRegistrationResponse","responseBody","redirect_uris","uri","hasRedirectUri","registerClient","registrationEndpoint","idTokenSigningAlgValuesSupported","signingAlg","supported","config","client_name","application_type","subject_type","token_endpoint_auth_method","id_token_signed_response_alg","grant_types","registerResponse","expiresAt","client_secret_expires_at","idTokenSignedResponseAlg","processErrorResponse","hasErrorDescription","validateTokenEndpointResponse","hasErrorUri","hasAccessToken","hasTokenType","hasExpiresIn","getTokens","client","grantType","tokenEndpoint","validatePreconditions","dpopKeyPair","generateDpopKeyPair","Authorization","requestBody","tokenRequestInit","rawTokenResponse","jwksUri","dpopHeader","authHeader","rawResponse","validatedResponse","ClientAuthentication","ClientAuthenticationBase","login","cleanedUrl","substring","normalizeCallbackUrl","location","validateCurrentSession","currentSessionId","sessionInfo","clientAppId","clientExpiresAt","isClientExpired","handleIncomingRedirect","redirectInfo","getLogoutUrl","cleanUrlAfterRedirect","expirationDate","history","replaceState","hasIssuer","oidcIssuer","hasRedirectUrl","OidcLoginHandler","oidcHandler","clientRegistration","OidcOptions","tokenType","scopes","customScopes","AuthorizationCodeWithPkceOidcHandler","redirectUri","oidcOptions","oidcClientLibrary","signingRequest","issuerConfigKeyMap","toKey","convertToUrl","authorization_endpoint","token_endpoint","userinfo_endpoint","registration_endpoint","end_session_endpoint","scopes_supported","response_types_supported","response_modes_supported","grant_types_supported","acr_values_supported","subject_types_supported","id_token_signing_alg_values_supported","id_token_encryption_alg_values_supported","id_token_encryption_enc_values_supported","userinfo_signing_alg_values_supported","userinfo_encryption_alg_values_supported","userinfo_encryption_enc_values_supported","request_object_signing_alg_values_supported","request_object_encryption_alg_values_supported","request_object_encryption_enc_values_supported","token_endpoint_auth_methods_supported","token_endpoint_auth_signing_alg_values_supported","display_values_supported","claim_types_supported","claims_supported","service_documentation","claims_locales_supported","ui_locales_supported","claims_parameter_supported","request_parameter_supported","request_uri_parameter_supported","require_request_uri_registration","op_policy_uri","op_tos_uri","IssuerConfigFetcher","getLocalStorageKey","openIdConfigUrl","issuerConfigRequestBody","parsedConfig","processConfig","clearBase","myStorage","itemsToRemove","match","clearOidcPersistentStorage","SessionInfoManager","clientAppSecret","parseInt","FallbackRedirectHandler","_redirectUrl","AuthCodeRedirectHandler","tokerRefresher","myUrl","oauthState","storedSessionId","isDpop","tokenCreatedAt","tokens","authFetch","saveSessionInfoToStorage","AggregateRedirectHandler","redirectHandlers","BrowserStorage","Redirector","redirectByReplacingState","ClientRegistrar","storedClientId","storedClientSecret","storedClientName","storedClientType","expired","registeredClient","ErrorOidcHandler","errorUrl","errorDescriptionUrl","TokenRefresher","oidcContext","getClientAuthenticationWithDependencies","dependencies","inMemoryStorage","KEY_CURRENT_SESSION","KEY_CURRENT_URL","Session","clientAuthentication","tokenRequestInProgress","sessionOptions","internalLogout","emitSignal","inputOptions","setSessionInfo","currentUrl","restorePreviousSession","clientAuthn","session","storedSessionInfo","silentlyAuthenticate","defaultSession","getDefaultSession"],"mappings":"uDAAK,MAACA,EAAU,IAAIC,YAAeC,EAAU,IAAIC,YAAeC,EAAgB,IAAID,YAAY,QAAS,CAAEE,OAAO,IAClH,SAASC,KAAUC,GACjB,MAAMC,EAAOD,EAAQE,OAAO,CAACC,GAAOC,YAAaD,EAAMC,EAAQ,GAAIC,EAAM,IAAIC,WAAWL,GACxF,IAAIM,EAAI,EACR,IAAK,MAAMC,KAAUR,EACnBK,EAAII,IAAID,EAAQD,GAAIA,GAAKC,EAAOJ,OAClC,OAAOC,CACT,CAcA,MAAMK,EAAY,eAClB,SAASC,EAAOC,GACd,GAAqB,iBAAVA,GAAsBA,EAAOR,QAAU,IAAK,CACrD,GAAIM,EAAUG,KAAKD,GACjB,MAAM,IAAIE,UAAU,4CACtB,OAAOrB,EAAQkB,OAAOC,EACvB,CACD,MAAMG,EAAQ,IAAIT,WAAWM,EAAOR,QACpC,IAAK,IAAIG,EAAI,EAAGA,EAAIK,EAAOR,OAAQG,IAAK,CACtC,MAAMS,EAAOJ,EAAOK,WAAWV,GAC/B,GAAIS,EAAO,IACT,MAAM,IAAIF,UAAU,4CACtBC,EAAMR,GAAKS,CACZ,CACD,OAAOD,CACT,CCpCA,MAAMG,UAAkBC,MACtBC,YAAc,mBACdJ,KAAO,mBACP,WAAAK,CAAYC,EAASC,GACnBC,MAAMF,EAASC,GAAUE,KAAKC,KAAOD,KAAKJ,YAAYK,KAAMP,MAAMQ,oBAAoBF,KAAMA,KAAKJ,YAClG,EAEH,MAAMO,UAAiCV,EACrCE,YAAc,kCACdJ,KAAO,kCACPa,MACAC,OACAC,QACA,WAAAV,CAAYC,EAASS,EAASF,EAAQ,cAAeC,EAAS,eAC5DN,MAAMF,EAAS,CAAEU,MAAO,CAAEH,QAAOC,SAAQC,aAAcN,KAAKI,MAAQA,EAAOJ,KAAKK,OAASA,EAAQL,KAAKM,QAAUA,CACjH,EAEH,MAAME,UAAmBf,EACvBE,YAAc,kBACdJ,KAAO,kBACPa,MACAC,OACAC,QACA,WAAAV,CAAYC,EAASS,EAASF,EAAQ,cAAeC,EAAS,eAC5DN,MAAMF,EAAS,CAAEU,MAAO,CAAEH,QAAOC,SAAQC,aAAcN,KAAKI,MAAQA,EAAOJ,KAAKK,OAASA,EAAQL,KAAKM,QAAUA,CACjH,EAEH,MAAMG,UAA0BhB,EAC9BE,YAAc,2BACdJ,KAAO,2BAET,MAAMmB,UAAyBjB,EAC7BE,YAAc,yBACdJ,KAAO,yBAaT,MAAMoB,UAAmBlB,EACvBE,YAAc,kBACdJ,KAAO,kBAET,MAAMqB,UAAmBnB,EACvBE,YAAc,kBACdJ,KAAO,kBAMT,MAAMsB,UAAoBpB,EACxBE,YAAc,mBACdJ,KAAO,mBAET,MAAMuB,UAA0BrB,EAC9BE,YAAc,2BACdJ,KAAO,2BACP,WAAAK,CAAYC,EAAU,kDAAmDC,GACvEC,MAAMF,EAASC,EAChB,EAEH,MAAMiB,UAAiCtB,EACrC,CAACuB,OAAOC,eAAiBC,kBAC3B,EACEvB,YAAc,kCACdJ,KAAO,kCACP,WAAAK,CAAYC,EAAU,uDAAwDC,GAC5EC,MAAMF,EAASC,EAChB,EAEH,MAAMqB,UAAoB1B,EACxBE,YAAc,mBACdJ,KAAO,mBACP,WAAAK,CAAYC,EAAU,oBAAqBC,GACzCC,MAAMF,EAASC,EAChB,EAEH,MAAMsB,UAAuC3B,EAC3CE,YAAc,wCACdJ,KAAO,wCACP,WAAAK,CAAYC,EAAU,gCAAiCC,GACrDC,MAAMF,EAASC,EAChB,ECxFH,SAASuB,EAAOC,GACd,IACE,OF0CJ,SAAsBC,EAASC,GAAM,GACnC,GAAI3C,WAAW4C,WACb,OAAO5C,WAAW4C,WAAWF,EAAS,CAAEG,SAAUF,EAAM,YAAc,WACxE,GAAIA,EAAK,CACP,GAAID,EAAQI,SAAS,MAAQJ,EAAQI,SAAS,KAC5C,MAAM,IAAItC,UAAU,qBACtBkC,EAAUA,EAAQK,QAAQ,KAAM,KAAKA,QAAQ,KAAM,IACpD,CACD,MAAMC,EAASC,KAAKP,GAAUjC,EAAQ,IAAIT,WAAWgD,EAAOlD,QAC5D,IAAK,IAAIG,EAAI,EAAGA,EAAI+C,EAAOlD,OAAQG,IACjCQ,EAAMR,GAAK+C,EAAOrC,WAAWV,GAC/B,OAAOQ,CACT,CEtDWyC,CAA6B,iBAATT,EAAoBA,EAAQpD,EAAQmD,OAAOC,IAAQ,EAC/E,CAAC,MAAOf,GACP,MAAM,IAAIlB,UALE,oDAKiB,CAAEkB,SAChC,CACH,CACA,SAASrB,EAAOoC,GACd,OF2BF,SAAsBA,EAAOE,GAAM,GACjC,GAAI3C,WAAWmD,UAAUC,SACvB,OAAOX,EAAMW,SAAS,CAAEP,SAAUF,EAAM,YAAc,SAAUU,YAAaV,IAC/E,MAA0BW,EAAM,GAChC,IAAK,IAAIrD,EAAI,EAAGA,EAAIwC,EAAM3C,OAAQG,GADf,MAEjBqD,EAAIC,KAAKC,OAAOC,aAAaC,MAAM,KAAMjB,EAAMkB,SAAS1D,EAAGA,EAF1C,SAGnB,MAAMyC,EAAUkB,KAAKN,EAAIO,KAAK,KAC9B,OAAOlB,EAAMD,EAAQK,QAAQ,KAAM,IAAIA,QAAQ,MAAO,KAAKA,QAAQ,MAAO,KAAOL,CACnF,CEnCSoB,CAA6B,iBAATrB,EAAoBtD,EAAQkB,OAAOoC,GAASA,GAAO,EAChF,CCJA,SAASsB,EAAStB,GAChB,GAAoB,iBAATA,GAA+B,OAAVA,GAA4D,oBAA1CuB,OAAOb,UAAUc,SAASC,KAAKzB,GAC/E,OAAO,EACT,MAAMU,EAAYa,OAAOG,eAAe1B,GACxC,OAAqB,OAAdU,GAA2D,OAArCa,OAAOG,eAAehB,EACrD,CACA,SAASiB,EAAS3B,GAChB,OAAOsB,EAAStB,IAAU4B,MAAMC,QAAQ7B,EAAM8B,OAASF,MAAMG,KAAK/B,EAAM8B,MAAME,MAAMV,EACtF,CACA,SAASW,KAAcC,GACrB,MAAMC,EAA6B,IAAIC,IACvC,IAAK,MAAMC,KAAUH,EACnB,GAAIG,EACF,IAAK,MAAMC,KAAaf,OAAOO,KAAKO,GAAS,CAC3C,GAAIF,EAAWI,IAAID,GACjB,OAAO,EACTH,EAAWK,IAAIF,EAChB,CACL,OAAO,CACT,CAKA,SAASG,EAAgBC,EAAOC,EAAOC,GACrC,IACE,OAAO7C,EAAO2C,EACf,CAAC,MAAOzD,GACP,MAAM,IAAI2D,EAAW,kCAAkCD,IAAS,CAAE1D,SACnE,CACH,CAmBK,MAAC4D,EAAiB,CAAEC,UAAW,KAAMC,KAAK,GAC/C,SAASC,EAAmBC,EAAQC,GAClC,QAAwB,IAApBA,KAA2BtB,MAAMC,QAAQqB,IAAeA,EAAWC,KAAMC,GAAkB,iBAALA,IACxF,MAAM,IAAIrF,UAAU,IAAIkF,yCAC1B,YAA2B,IAApBC,OAA6B,EAAI,IAAId,IAAIc,EAClD,CAMA,SAASG,EAAaC,EAAKC,EAAmBC,EAAkBC,EAAiBC,GAC/E,QAA6B,IAAzBA,EAAWC,WAAkD,IAA/BF,GAAiBE,KACjD,MAAM,IAAIL,EAAI,kEAChB,IAAKG,QAAiD,IAA9BA,EAAgBE,KACtC,MAAO,GACT,IAAK/B,MAAMC,QAAQ4B,EAAgBE,OAAyC,IAAhCF,EAAgBE,KAAKtG,QAAgBoG,EAAgBE,KAAKR,KAAMnD,GAA0B,iBAATA,GAAsC,IAAjBA,EAAM3C,QACtJ,MAAM,IAAIiG,EAAI,yFAChB,MAAMM,OAAuC,IAA1BJ,EAA8BD,EAAoB,CAAET,UAAW,QAASU,KAAqBD,GAChH,IAAK,MAAMjB,KAAamB,EAAgBE,KAAM,CAC5C,KAAMrB,KAAasB,GACjB,MAAM,IAAIxE,EAAiB,+BAA+BkD,wBAC5D,IAAKf,OAAOsC,OAAOH,EAAYpB,SAA6C,IAA/BoB,EAAWpB,GACtD,MAAM,IAAIgB,EAAI,+BAA+BhB,iBAC/C,GAAIsB,EAAWtB,MAAgBf,OAAOsC,OAAOJ,EAAiBnB,SAAkD,IAApCmB,EAAgBnB,IAC1F,MAAM,IAAIgB,EAAI,+BAA+BhB,iCAChD,CACD,OAAOmB,EAAgBE,IACzB,CACA,SAASG,EAAYL,EAAiBM,GACpC,GAAIA,EAAW1D,SAAS,OAAQ,CAC9B,MAAM0C,EAAMU,EAAgBV,IAC5B,GAAkB,kBAAPA,EACT,MAAM,IAAI1D,EAAW,2EACvB,OAAO0D,CACR,CACD,OAAO,CACT,CACA,SAASiB,EAAoBV,EAAKjB,GAChC,IAAI4B,EAAYC,EAChB,IACED,EAAaE,KAAKC,UAAU/B,GAAS6B,EAASC,KAAKE,MAAMJ,EAC1D,CAAC,MAAOhF,GACP,MAAM,IAAIqE,EAAI,gCAAiC,CAAErE,SAClD,CACD,IAAKqC,EAAS4C,GACZ,MAAM,IAAIZ,EAAI,oCAChB,MAAO,CAACY,EAAQD,EAClB,CCtFArE,eAAe0E,EAAWC,EAAOC,EAAKC,GACpC,MAAMC,IAAEA,EAAGC,OAAEA,GAAWJ,EAAOK,EAA+B,YAAVH,GAAiC,SAAVA,EAC3E,GAAIE,GAAUH,aAAejH,WAC3B,OAAOiH,EACT,IAAIK,EAAYC,EAChB,GAAIxD,EAASkD,GAAM,CACjB,GAAIK,EAyFR,SAAsBE,GACpB,MAAMF,EAAaG,EAAYD,GAC/B,QAA4B,IAAxBF,EAAWI,KAA2C,kBAAlBJ,EAAWI,IACjD,MAAM,IAAIlH,UAAU,mDACtB,QAAgC,IAA5B8G,EAAWK,QAAoB,CACjC,MAAMxC,EAAQmC,EAAWK,QAASC,EAASvD,MAAMC,QAAQa,GAAS,IAAIA,QAAc,EACpF,IAAKyC,GAAUA,EAAOhC,KAAMiC,GAAkC,iBAAbA,IAA0B,IAAIhD,IAAI+C,GAAQjI,OAASiI,EAAO9H,OACzG,MAAM,IAAIU,UAAU,2EACtB8G,EAAWK,QAAUC,CACtB,CACD,OAAON,CACT,CApGqBQ,CAAab,GAA+B,iBAAlBK,EAAWS,IACpD,MAAMC,EAAeb,EAAKF,EAAKG,GACjC,KAAMA,EAA4B,QAAnBE,EAAWS,KAAwC,iBAAhBT,EAAWW,EAAmC,QAAnBX,EAAWS,MAAkBV,EAAwC,QAAnBC,EAAWS,KAA2C,iBAAnBT,EAAWY,MAA2C,iBAAhBZ,EAAWa,OAAsC,IAAtBb,EAAWa,QAAyC,IAAzBb,EAAWY,OACvQ,MAAM,IAAI1H,UAAU4G,EAAS,0HAA4H,6CAA6CC,EAAqB,UAAY,gBACzO,GAzByD,EAACL,EAAOC,EAAKC,KACxE,MAAMC,IAAEA,GAAQH,EAChB,QAAqB,IAAjBC,EAAImB,IAAgB,CACtB,MAAMC,EAAqB,SAAVnB,GAA8B,WAAVA,EAAqB,MAAQ,MAClE,GAAID,EAAImB,MAAQC,EACd,MAAM,IAAI7H,UAAU,sDAAsD6H,kBAC7E,CACD,QAAqB,IAAjBpB,EAAIE,KAAkBF,EAAIE,MAAQA,EACpC,MAAM,IAAI3G,UAAU,sDAAsD2G,mBAC5E,GAAI9C,MAAMC,QAAQ2C,EAAIU,SAAU,CAC9B,MAAMW,EAA0B,YAAVpB,GAAiC,YAAVA,EAAsBF,EAAMuB,MAAgB,YAAVrB,EAAsB,EAAI,GAAKA,EAC9G,GAAIoB,IAAkBrB,EAAIU,QAAQ7E,SAASwF,GACzC,MAAM,IAAI9H,UAAU,+DAA+D8H,kBACtF,GAYKE,CAAaxB,EAAOM,EAAYJ,GAA2B,QAAnBI,EAAWS,IACrD,OAAOvF,EAAO8E,EAAWW,GAC3B,IAAKjE,OAAOyE,SAASxB,GAAM,CACzB,MAAMU,QAAEA,GAAYV,EACpB5C,MAAMC,QAAQqD,IAAY3D,OAAO0E,OAAOf,GAAU3D,OAAO0E,OAAOzB,EACjE,CACL,KAAS,CACL,IAAK0B,EAAU1B,GACb,MAAMe,EAAeb,EAAKF,EAAKG,GACjC,MAAMwB,EAAexB,EAAS,SAAWC,EAAqB,UAAY,SAC1E,GAAIJ,EAAI4B,OAASD,IAAiBxB,GAAU,CAAC,SAAU,SAAU,WAAWtE,SAASmE,EAAI4B,OACvF,MAAM,IAAIrI,UAAU,GApCd,CAACyG,GAAQA,EAAI9E,OAAO2G,aAoCHC,CAAI9B,iCAAmC2B,cAAyBzB,eACzF,GAAI6B,EAAY/B,GACd,OAAOA,EACT,GAAIM,EAAYN,EAAwB,WAAnBM,EAAUsB,KAC7B,OAAOtB,EAAU0B,QACpB,CACDC,IAA0B,IAAIC,QAC9B,MAAMC,EAAWnC,EACjB,IAAIoC,EAASH,EAAMI,IAAIF,GACvB,GAAIC,IAASlC,GACX,OAAOkC,EAAOlC,GAChB,GAAIkC,GAAUH,EAAM/I,IAAIiJ,EAAUC,EAAS,IAAK9B,GAA6C,mBAAzBA,EAAUgC,YAA2B,CACvG,MAAMC,EAA8B,WAAnBjC,EAAUsB,KAAmBY,EAAMC,EAAKnC,EAAUoC,sBAAsBC,YAAaC,EAAS7C,EAAM8C,UAAU,CAAEL,MAAKM,kBAAmBxC,EAAUwC,qBAAwB/C,EAAMgD,OACjM,OAAOX,EAAOlC,GAAOI,EAAUgC,YAAYM,EAAQL,EAAUxC,EAAMiD,OAAOT,EAAW,EAAI,GAC1F,CACD,OAAOlC,IAAeC,EAAU0B,OAAO,CAAEiB,OAAQ,QAAU5C,EAAWH,IAAMA,EAAKkC,EAAOlC,SAAagD,EAASnD,EAAOM,EACvH,CACA,IAAI4B,EACJ,MAAMQ,EAAO,CACXnE,UAAW,KACX6E,WAAY,QACZC,UAAW,QACXC,UAAW,SAMPtB,EAAe/B,IACnB,GAAkC,cAA9BA,IAAM9E,OAAO2G,aACf,OAAO,EACT,IACE,OAAO7B,aAAesD,SAC1B,CAAI,MACA,OAAO,CACR,GACAC,EAAevD,GAAsC,cAA9BA,IAAM9E,OAAO2G,aAA8BH,EAAa1B,GAAQ+B,EAAY/B,IAAQuD,EAAYvD,GAC1H,SAASjG,EAAQyJ,EAAKC,KAAWC,GAC/B,GAAIA,EAAM7K,OAAS,EAAG,CACpB,MAAM8K,EAAOD,EAAME,MACnBJ,GAAO,eAAeE,EAAM9G,KAAK,aAAa+G,IAClD,MAA0B,IAAjBD,EAAM7K,OAAe2K,GAAO,eAAeE,EAAM,SAASA,EAAM,MAAQF,GAAO,WAAWE,EAAM,MACvG,OAAiB,MAAVD,EAAiBD,GAAO,aAAaC,IAA4B,mBAAVA,GAAwBA,EAAOtJ,KAAOqJ,GAAO,sBAAsBC,EAAOtJ,OAA0B,iBAAVsJ,GAAgC,MAAVA,GAAkBA,EAAO3J,aAAaK,OAASqJ,GAAO,4BAA4BC,EAAO3J,YAAYK,QAASqJ,CAC9R,CAEA,SAASzC,EAAeb,EAAKuD,EAAQtD,GACnC,MAAMuD,EAAQ,CAAC,YAAa,YAAa,gBACzC,OAAOvD,GAAUuD,EAAMpH,KAAK,cAAe,IAAI/C,UAAUQ,EAAQ,eAAemG,uBAA0BuD,KAAWC,GACvH,CACA,MAAMG,EAAW,CAAC1J,EAAM2J,EAAO,mBAAqB,IAAIvK,UAAU,kDAAkDuK,aAAgB3J,KAKpI,SAAS4J,EAAmB7D,EAAKF,GAC/B,MAAMgE,cAAEA,GAAkBhE,EAAIiE,UAC9B,GAA4B,iBAAjBD,GAA6BA,EAAgB,KACtD,MAAM,IAAIzK,UAAU,GAAG2G,yDAC3B,CACA,SAASgE,EAAelE,EAAKoB,EAAUnB,GACrC,MAAMgE,EAAYjE,EAAIiE,UACtB,GAAIA,EAAU9J,OAASiH,EAASjH,KAC9B,MAAM0J,EAASzC,EAASjH,MAC1B,GAAIiH,EAAS+C,MAAQF,EAAUE,MAAMhK,OAASiH,EAAS+C,KACrD,MAAMN,EAASzC,EAAS+C,KAAM,kBAChC,GAAI/C,EAASuB,YAAcsB,EAAUtB,aAAevB,EAASuB,WAC3D,MAAMkB,EAASzC,EAASuB,WAAY,wBACtC,QAA6B,IAAzBvB,EAASvI,QAAqBoL,EAAUpL,SAAWuI,EAASvI,OAC9D,MAAMgL,EAASzC,EAASvI,OAAQ,qBAlBpC,SAAoBmH,EAAKC,GACvB,GAAIA,IAAUD,EAAIgD,OAAOnH,SAASoE,GAChC,MAAM,IAAI1G,UAAU,sEAAsE0G,KAC9F,CAgBEmE,CAAWpE,EAAKC,EAClB,CACA,SAASO,EAAYD,GACnB,MAAO,CAAEjC,UAAW,QAASiC,EAC/B,CAkBAnF,eAAe8H,EAASnD,EAAOQ,EAAK8D,GAClC,IAAKtE,EAAMe,IAAIjF,SAAS0E,EAAIO,KAC1B,MAAM,IAAIlG,EAAiB,gEAC7B,MAAMqJ,EAAYlE,EAAM8C,UAAU,CAAE/B,IAAKP,EAAIO,IAAK0B,IAAKjC,EAAIiC,OAAUzC,EAAMgD,OAAQuB,KAAe/D,EAAIW,IAAKX,EAAIU,MAAOsD,EAAU,IAAKhE,EAAKE,IAAK4D,GAAe9D,EAAIE,KAClK,MAAuB,QAAhB8D,EAAQzD,YAAwByD,EAAQrE,WAAYqE,EAAQpD,IAAKqD,OAAOzB,OAAO0B,UAAU,MAAOF,EAASN,EAAWM,EAAQ9D,MAAQ6D,EAAW/D,EAAIG,SAAWX,EAAMiD,OAAOsB,EAAY,EAAI,GACpM,CACAlJ,eAAesJ,EAAO1E,EAAKoB,EAAUnB,EAAOoE,GAAc,GACxD,OAAOrE,aAAejH,aAAeiH,QAAYwE,OAAOzB,OAAO0B,UAAU,MAAOzE,EAAKoB,EAAUiD,EAAa,CAACpE,KAAUiE,EAAelE,EAAKoB,EAAUnB,GAAQD,CAC/J,CC1IA,SAAS2E,EAAMC,GACb,MAAMC,EAAM,CAAEvG,UAAW,MACzB,IAAK,MAAM4B,KAAO0E,EAChBC,EAAI3E,GAAO,IAAK0E,EAAQ1E,GAAMA,OAChC,OAAO2E,CACT,CCHA,MAAMC,EAAO,CACX,CAAC,UAAW,WACZ,CAAC,UAAW,cACXC,EAAS,CAAC,GAAI,CAAC,eAAgBC,EAAO,CAAC,GAAI,IAC9C,SAASC,EAAMC,GACb,MAAO,CACLpE,IAAK,CAAC,OACNqE,KAAM,iBACNpC,OAAQ,CAAE5I,KAAM,WAAYgK,KAAM,OAAOe,KACzClC,OAAQ8B,EACRxD,IAAK,CAAC,UAAW,aAErB,CACA,SAAS8D,EAAKD,GACZ,MAAO,CACLrE,IAAK,CAAC,KAAM,OACZqE,OACApC,OAAQ,CAAE5I,KAAM,QAChB0I,QAAS,EAAG/B,MAAK0B,MAAKM,wBACpB,GAAY,WAARN,GAA0C,WAAtBM,EACtB,MAAO,CAAE3I,KAAM,UACjB,GAAY,QAAR2G,EACF,MAAM,IAAIlG,EAAiB,gEAC7B,MAAO,CAAET,KAAM,OAAQwI,WAAYH,IAErCQ,OAAQ+B,EACRzD,IAAK,MAAM,EAAG,cAElB,CACA,SAAS+D,EAAMH,EAAMI,GAAM,GACzB,MAAO,CACLxE,IAAK,CAAC,OACNqE,KAAM,eACNhF,QAAQ,EACR4C,OAAQ,CAAE5I,KAAMmL,EAAM,UAAY,SAAUzM,OAAQqM,GACpDlC,OAAQgC,EACR1D,IAAKgE,EAAM,CAAC,UAAW,WAAa,CAAC,UAAW,aAEpD,CACA,SAASC,IACP,MAAO,CACLzE,IAAK,CAAC,OACNqE,KAAM,eACNhF,QAAQ,EACR4C,OAAQ,CAAE5I,KAAM,UAChB6I,OAAQgC,EACR1D,IAAK,CAAC,aAAc,cAExB,CACA,MAAMkE,EAAMb,EAAM,CAChBc,IAAK,CACH3E,IAAK,CAAC,OACNqE,KAAM,oBACNhF,QAAQ,EACR4C,OAAQ,CAAE5I,KAAM,WAChB6I,OAAQgC,EACR1D,IAAK,CAAC,UAAW,YAEnB,WAAY2D,EAAM,GAClB,eAAgBA,EAAM,KACtB,eAAgBA,EAAM,KACtB,eAAgBA,EAAM,KACtB,UAAWG,EAAK,wBAChB,iBAAkBA,EAAK,mCACvB,iBAAkBA,EAAK,mCACvB,iBAAkBA,EAAK,mCACvBM,OAAQL,EAAM,KACdM,OAAQN,EAAM,KACdO,OAAQP,EAAM,KACdQ,UAAWR,EAAM,KAAK,GACtBS,UAAWT,EAAM,KAAK,GACtBU,UAAWV,EAAM,KAAK,GACtB,qBAAsBE,IACtB,qBAAsBA,IACtB,qBAAsBA,MACpBS,EAAa,CAAC,UAAW,WAC7B,SAASC,GAAkBf,EAAMgB,GAAM,GACrC,MAAO,CACLpF,IAAK,CAAC,OACNX,QAAQ,EACR4C,OAAQ,CAAE5I,KAAM+L,EAAM,UAAY,UAAWrN,OAAQqM,GACrDlC,OAAQgC,EACR1D,IAAK0E,EACLG,QAASjB,EACTkB,OAAQF,EAAM,IAAM,GACpBA,MAEJ,CACYvB,EAAM,CAChB0B,QAASJ,GAAkB,KAC3BK,QAASL,GAAkB,KAC3BM,QAASN,GAAkB,KAC3B,gBAAiBA,GAAkB,KAAK,GACxC,gBAAiBA,GAAkB,KAAK,GACxC,gBAAiBA,GAAkB,KAAK,KC9F1C,MAAMO,GAAM,CAAC,CAAC,UAAW,CAAC,SAC1B,SAASC,GAAKvB,GACZ,MAAMnC,EAAS,CAAE5I,KAAM,OAAQgK,KAAM,OAAOe,KAC5C,MAAO,CAAEpE,IAAK,CAAC,OAAQX,QAAQ,EAAI4C,SAAQ2D,QAAS3D,EAAQC,OAAQwD,GACtE,CACA,SAASG,GAAIzB,EAAM0B,GACjB,MAAM7D,EAAS,CAAE5I,KAAMyM,EAAa,UAAY,oBAAqBzC,KAAM,OAAOe,KAClF,MAAO,CACLpE,IAAK,CAAC,OACNiC,SACA2D,QAASE,EAAa,IAAK7D,EAAQ6D,cAAe7D,EAClDC,OAAQwD,GACRK,WAAY,KAEhB,CACA,SAASC,GAAMtE,EAAK0C,GAClB,MAAO,CACLpE,IAAK,CAAC,MACN0B,MACAO,OAAQ,CAAE5I,KAAM,QAASwI,WAAYH,GACrCkE,QAAS,CAAEvM,KAAM,QAASgK,KAAM,OAAOe,KACvClC,OAAQwD,GAEZ,CACA,SAASO,KACP,MAAMhE,EAAS,CAAE5I,KAAM,WACvB,MAAO,CACL2G,IAAK,CAAC,OACN0B,IAAK,UACLO,SACA2D,QAAS3D,EACTC,OAAQwD,GAEZ,CACA,SAASQ,GAAMC,GACb,MAAMlE,EAAS,CAAE5I,KAAM,UAAU8M,KACjC,MAAO,CACLnG,IAAK,CAAC,OACNiC,SACA2D,QAAS3D,EACTC,OAAQwD,GAEZ,CACA,MAAMU,GAAMvC,EAAM,CAChBwC,MAAOV,GAAK,KACZW,MAAOX,GAAK,KACZY,MAAOZ,GAAK,KACZa,MAAOX,GAAI,KACXY,MAAOZ,GAAI,KACXa,MAAOb,GAAI,KACXc,MAAOd,GAAI,IAAK,IAChBe,MAAOf,GAAI,IAAK,IAChBgB,MAAOhB,GAAI,IAAK,IAChBiB,MAAOd,GAAM,QAAS,KACtBe,MAAOf,GAAM,QAAS,KACtBgB,MAAOhB,GAAM,QAAS,KACtBiB,MAAOhB,KACPiB,QAASjB,KACT,YAAaC,GAAM,IACnB,YAAaA,GAAM,IACnB,YAAaA,GAAM,MAErB,SAASiB,GAAa/H,GACpB,MAAMH,EAAsB,iBAAPG,EAAkBgH,GAAIhH,QAAY,EACvD,IAAKH,EACH,MAAM,IAAInF,EAAiB,OAAOsF,gEACpC,OAAOH,CACT,CC5CA,SAASmI,GAAqBC,GAC5B,YAAuC,IAAhCA,EAAoC,CAAE,ELmB/C,SAAyBA,EAAwB/J,EAAYrE,GAC3D,IAAI2F,EACJ,IACEA,EAASC,KAAKE,MAAMvH,EAAciD,OAAOA,EAAO4M,IACjD,CAAC,MAAO1N,GACP,MAAM,IAAI2D,EAAWrE,EAAS,CAAEU,SACjC,CACD,IAAKqC,EAAS4C,GACZ,MAAM,IAAItB,EAAWrE,GACvB,OAAO2F,CACT,CK7BkD0I,CAAgBD,EAAwBtN,EAAY,kCACtG,CAOA,SAASwN,GAA8B7N,GACrC,IACE,OAAOpB,EAAOoB,EACf,CAAC,MAAOC,GACP,MAAM,IAAII,EAAW,mEAAoE,CACvFJ,SAEH,CACH,CACAW,eAAekN,GAAgBC,EAAKC,EAAQxI,EAAKyI,EAAwBC,GACvE,MAAQC,UAAWR,EAAsBtK,OAAEA,EAAQrD,QAASoO,GAAiBL,EAAKtJ,EAAqCiJ,GAAqBC,GAC5I,IAAK1K,EAAWwB,EAAiBpB,GAC/B,MAAM,IAAIhD,EAAW,6EACvB,MAAMqE,EAAa,IAAKD,KAAoBpB,GAAUU,EAAMe,EAAYL,EAAiBJ,EAAahE,EAAYwD,EAAgBmK,EAAO,GAAIvJ,EAAiBC,KAAcgB,IAAEA,GAAQhB,EACtL,GAAkB,iBAAPgB,IAAoBA,EAC7B,MAAM,IAAIrF,EAAW,6DACvB,GAAI2N,EAAO,KAAOA,EAAO,GAAGzK,IAAImC,GAC9B,MAAM,IAAIvF,EAAkB,wDAC9B,GAAI4D,GACF,GAA2B,iBAAhBqK,EACT,MAAM,IAAI/N,EAAW,qCAClB,GAA2B,iBAAhB+N,KAA8BA,aAAwB7P,YACtE,MAAM,IAAI8B,EAAW,0DACvB,MAAMgO,EAAiBtK,GAA8B,iBAAhBqK,EAA2BA,EAAeH,EAAuBG,GACtG,IAAIE,GAAc,EACJ,mBAAP9I,IAAsBA,QAAYA,EAAIf,EAAiBsJ,GAAMO,GAAc,GAClF,MAAM/I,EAAQkI,GAAa/H,GAAM6I,EAAevQ,OAAuC,IAAhC2P,EAAoC/O,EAAO+O,GAA0B,IAAIpP,WAAcK,EAAO,KAA+B,iBAAlByP,EAA6BL,EAAO,KLtBxM,SAA2BtK,EAAOC,EAAOC,GACvC,IACE,OAAOhF,EAAO8E,EACf,CAAC,MAAOzD,GACP,MAAM,IAAI2D,EAAW,OAAOD,oCAAyC,CAAE1D,SACxE,CACH,CKgB+MuO,CAAkBH,EAAgB,UAAWhO,GAAcgO,GAAiBI,EAAYhL,EAAgBsK,EAAIU,UAAW,YAAapO,GAAaqO,QAAwBpJ,EAAWC,EAAOC,EAAK,UAAWmJ,QAAkBzE,EAAOwE,EAAiBnJ,EAAMgD,OAAQ,UAChdhD,EAAM8G,YAAc9C,EAAmBhE,EAAMG,IAAKiJ,GAClD,IAAIC,GAAW,EACf,IACEA,QAAiB5E,OAAOzB,OAAOsG,OAAOtJ,EAAM2G,QAASyC,EAAWF,EAAWF,EAC5E,CAAC,MAAOtO,GACP,MAAM,IAAIa,OAAoC,EAAG,CAAEb,SACpD,CACD,IAAK2O,EACH,MAAM,IAAI9N,EACZ,MAAMgO,EAAS,CAAE9O,QAAkC,iBAAlBqO,EAA6B5K,EAAgB4K,EAAgB,UAAWhO,GAAcgO,GACvH,YAAuC,IAAhCV,IAAsCmB,EAAOrK,gBAAkBA,QAAkC,IAAhBpB,IAAsByL,EAAOC,kBAAoB1L,GAASiL,EAAc,CAAC,IAAKQ,EAAQtJ,IAAKkJ,GAAmB3K,GAAO,CAAC+K,EAAQ/K,EACxN,CCrEA,MAAMiL,GAASC,GAASC,KAAKC,MAAMF,EAAKG,UAAY,KAAMC,GAAc,CACtEjL,EAAG,EACHkL,EAAG,GACHC,EAAG,KACH7I,EAAG,MACH8I,EAAG,OACHC,EAAG,UACFC,GAAQ,oIAAqIC,GAAc,eAC9J,SAASC,KACP,MAAM,IAAI7Q,UAAU,6BACtB,CACA,SAAS8Q,GAAKC,GACE,iBAAPA,GAAmBF,KAC1B,MAAMG,EAAUL,GAAMM,KAAKF,KACzBC,GAAWA,EAAQ,IAAMA,EAAQ,KAAOH,KAC1C,MAAMlM,EAAQuM,WAAWF,EAAQ,IAAKG,EAAkBhB,KAAKiB,MAAMzM,EAAQ2L,GAAYU,EAAQ,GAAG,GAAGK,gBACrG,OAAOC,OAAOC,SAASJ,IAAoBN,KAAkC,MAAfG,EAAQ,IAA6B,QAAfA,EAAQ,IAAgBG,EAAkBA,CAChI,CACA,SAASK,GAAc5M,EAAO3C,GAC5B,IAAKqP,OAAOC,SAAStP,GACnB,MAAM,IAAIjC,UAAU,WAAW4E,WACjC,OAAO3C,CACT,CACA,SAASwP,GAAoB1Q,EAAO4D,GAClC,GAAoB,iBAATA,EACT,MAAM,IAAI3E,UAAU,IAAIe,4BAC5B,CAKA,SAAS2Q,GAAY/M,EAAOC,GAC1B,MAAuB,iBAATD,EAAoB6M,GAAc5M,EAAOD,GAASA,aAAiBgN,KAAOH,GAAc5M,EAAOqL,GAAMtL,IAAUsL,GAAsB,IAAI0B,MAAUb,GAAKnM,EACxK,CACA,MAAMiN,GAAgBjN,IACpB,MAAMmC,EAAanC,EAAM0M,cACzB,OAAO1M,EAAMrC,SAAS,KAAOwE,EAAa,eAAeA,KAE3D,SAAS+K,GAAoBC,EAAW/Q,EAAOgR,GAAW,GACxD,MAAMpN,EAAQmN,EAAU/Q,GACxB,QAAqB,IAAf4D,GAAqBoN,EAAW,CACpC,GAAoB,iBAATpN,EACT,MAAM,IAAI7D,EAAyB,IAAIC,4BAAiC+Q,EAAW/Q,EAAO,WAC5F,OAAO4D,CACR,CACH,CACA,SAASqN,GAAgBF,EAAW/Q,GAClC,MAAM,IAAID,EAAyB,eAAeC,iBAAsB+Q,EAAW/Q,EAAO6P,GAC5F,CACA,SAASqB,GAAkBvM,EAAiBwM,EAAgBzR,EAAU,CAAA,GACpE,IAAIqR,EACJ,IACEA,EAAY1L,KAAKE,MAAMvH,EAAciD,OAAOkQ,GAC7C,CAAC,MAAOhR,GACP,MAAM,IAAIK,EAAW,iDAAkD,CAAEL,SAC1E,CACD,IAAKqC,EAASuO,GACZ,MAAM,IAAIvQ,EAAW,kDACvB,MAAM4Q,IAAEA,GAAQ1R,EAChB,QAAiB,IAAb0R,IAAiD,iBAAvBzM,EAAgByM,KAAmBP,GAAalM,EAAgByM,OAASP,GAAaO,IAClH,MAAM,IAAIrR,EAAyB,oCAAqCgR,EAAW,MAAOlB,IAC5F,MAAMwB,eAAEA,EAAiB,GAAEC,OAAEA,EAAMC,QAAEA,EAAOC,SAAEA,EAAQC,YAAEA,GAAgB/R,EAASgS,EAAgB,IAAIL,QAChF,IAArBI,GAA0BC,EAAc1P,KAAK,YAA0B,IAAlBwP,GAAuBE,EAAc1P,KAAK,YAAyB,IAAjBuP,GAAsBG,EAAc1P,KAAK,YAAwB,IAAhBsP,GAAqBI,EAAc1P,KAAK,OAChM,IAAK,MAAMhC,KAAS,IAAIsD,IAAIoO,EAAcC,WACxC,IAAKlP,OAAOsC,OAAOgM,EAAW/Q,GAC5B,MAAM,IAAID,EAAyB,qBAAqBC,WAAgB+Q,EAAW/Q,EAAO,WA5BrE,IAAC4R,EAAYC,OA6BtB,IAAhBP,KAAuBxO,MAAMC,QAAQuO,GAAUA,EAAS,CAACA,IAAS/P,SAASwP,EAAUe,MAAQb,GAAgBF,EAAW,YAAyB,IAAjBQ,GAAsBR,EAAUgB,MAAQR,GAAWN,GAAgBF,EAAW,YAA0B,IAAlBS,IA7B5LI,EA6B0Ob,EAAUiB,IA7BxOH,EA6BgQ,iBAAZL,EAAuB,CAACA,GAAYA,IA7BrP,iBAAdI,EAAyBC,EAAUtQ,SAASqQ,GAAc9O,MAAMC,QAAQ6O,IAAcC,EAAUxN,KAAM2N,GAAQJ,EAAWrQ,SAASyQ,OA6B8If,GAAgBF,EAAW,OACtW,MAAMkB,eAAEA,GAAmBvS,EAC3B,IAAIwS,EAAY,EAChB,GAA6B,iBAAlBD,EACTC,EAAYnC,GAAKkC,QACd,QAA4B,IAAxBA,EAA2B,CAClC,GAA6B,iBAAlBA,EACT,MAAM,IAAIhT,UAAU,sCACtBiT,EAAYD,CACb,CACDxB,GAAc,wBAAyByB,GACvC,MAAMC,YAAEA,GAAgBzS,EAAS0S,EAAM3B,GAAc,qBAAsBvB,QAA2B,IAArBiD,EAAyC,IAAIvB,KAASuB,IAAeE,EAAMvB,GAAoBC,EAAW,WAA4B,IAArBU,GAAyBa,EAAMxB,GAAoBC,EAAW,OAChQ,QAAiB,IAAbuB,GAAkBA,EAAMF,EAAMF,EAChC,MAAM,IAAInS,EAAyB,qCAAsCgR,EAAW,MAAOlB,IAC7F,MAAM0C,EAAMzB,GAAoBC,EAAW,OAC3C,QAAiB,IAAbwB,GAAkBA,GAAOH,EAAMF,EACjC,MAAM,IAAI9R,EAAW,qCAAsC2Q,EAAW,MAAOlB,IAC/E,QAAyB,IAArB4B,EAAwB,CAC1B,MAAMe,EAAMJ,EAAMC,EAClB,GAAIG,EAAMN,EADmBzB,GAAc,qBAA4C,iBAAfgB,EAA0BA,EAAc1B,GAAK0B,IAEnH,MAAM,IAAIrR,EAAW,2DAA4D2Q,EAAW,MAAOlB,IACrG,GAAI2C,GAAON,EACT,MAAM,IAAInS,EAAyB,gEAAiEgR,EAAW,MAAOlB,GACzH,CACD,OAAOkB,CACT,CACA,IAAI0B,GACJ,SAASC,GAAkBC,GACzB,OAAOF,GAAmB1K,IAAI4K,EAChC,CC/FA7R,eAAe8R,GAAUC,EAAKnN,EAAKhG,GACjC,MAAOoP,EAAU7K,SFqEnBnD,eAA6BmN,EAAKC,EAAQxI,GACxC,GAAIuI,aAAexP,aAAewP,EAAMnQ,EAAQmD,OAAOgN,IAAqB,iBAAPA,EACnE,MAAM,IAAI1N,EAAW,8CACvB,MAAQ,EAAGoE,EAAiB,EAAGzE,EAAS,EAAGyO,EAASpQ,OAAEA,GAAW0P,EAAI6E,MAAM,KAC3E,GAAe,IAAXvU,EACF,MAAM,IAAIgC,EAAW,uBACvB,OAAOyN,GAAgB,CAAE9N,UAASmO,UAAW1J,EAAiBgK,aAAaT,EAAQxI,EAAKqI,GAC1F,CE5EgCgF,CAAcF,EFkB9C,SAAuBnT,GACrB,MAAO,CAACA,GAAWwE,EAAmB,aAAcxE,EAAQ0E,YAAa1E,GAASmF,KACpF,CEpBmDmO,CAActT,GAAUgG,GACzE,IAAKzB,EACH,MAAM,IAAIzD,EAAW,uCACvB,MAAMN,EAAUgR,GAAkBpC,EAASnK,gBAAiBmK,EAAS5O,QAASR,GAC9E,MAAO,IAAKoP,EAAU5O,UACxB,CCHAY,eAAemS,GAAgB/R,EAAOwE,EAAKwN,GACzC,IAAKhT,EAASyE,EAAiBsK,EAAmBpK,GAAQ3D,EAAO2M,EAAyB,GAC1F,QAA6B,IAAzBlJ,EAA4B,CAC9B,MAAMoB,EAAab,EAAoB3E,EAAYoE,GACnDA,EAAkBoB,EAAW,GAAI8H,EAAyBsF,EAAKpN,EAAW,GAC3E,CACD,QAA+B,IAA3BkJ,IAAiCA,EAAoB/J,EAAoB3E,EAAY0O,GAAmB,KAAMtK,IAAoBsK,EACpI,MAAM,IAAI1O,EAAW,mFACvB,IAAK4C,EAAWwB,EAAiBsK,GAC/B,MAAM,IAAI1O,EAAW,6EACvB,MAAMqE,EAAa,IAAKD,KAAoBsK,IR8C9C,SAAgCzK,EAAKG,GACnC,MAAME,KAAEA,GAASF,GAAmB,GACpC,GAAI7B,MAAMC,QAAQ8B,IAAS,IAAIvB,IAAIuB,GAAMzG,OAASyG,EAAKtG,OACrD,MAAM,IAAIiG,EAAI,uEAClB,CQjDE4O,CAAuB7S,EAAYoE,GACnC,MAAMV,EAAMe,EAAYL,EAAiBJ,EAAahE,EAAYwD,EAAgBc,EAAMF,EAAiBC,IACzGX,GAAOiP,MACP,MAAMtN,IAAEA,GAAQhB,EAChB,GAAkB,iBAAPgB,IAAoBA,EAC7B,MAAM,IAAIrF,EAAW,6DACvB,MAAMkF,EAAQkI,GAAa/H,GAC3B,IAAmD6I,EAA/C4E,EAAiB,GAAI9E,EAAiBrO,EACtC+D,IAEuJoP,EAAiBF,EAAKjT,GAAUuO,EAAe7Q,EAAQkB,OAAO,GAAG+O,KAA0BwF,MAEtP5E,IAAiBvQ,EAAOY,EAAO+O,GAAyB/O,EAAO,KAAMyP,GACrE,MAAM+E,QAAmBlJ,QAAa5E,EAAWC,EAAOC,EAAK,QAASD,EAAMgD,OAAQ,QACpFhD,EAAM8G,YAAc9C,EAAmBhE,EAAMG,IAAK0N,GAClD,MAAMrF,EAAM,CACVU,UAAWwE,EAAK,IAAI1U,iBAAiByL,OAAOzB,OAAO8K,KAAK9N,EAAM2G,QAASkH,EAAY7E,KACnFvO,QAASmT,GAEX,OAAO1O,IAAoBsJ,EAAII,UAAYR,GAAyBoB,IAAsBhB,EAAI1K,OAAS0L,GAAoB,CAAChB,EAAKhK,EACnI,CCjCA,MAAMuP,GH2GN,MACE,WAAAhU,CAAYuR,EAAY,IACtB,IAAKvO,EAASuO,GACZ,MAAM,IAAI9R,UAAU,qCACrBwT,KAAuC,IAAI7K,SAAWhJ,IAAIgB,KAAM6T,gBAAgB1C,GAClF,CACD,SAAA2C,CAAU9P,GACR,OAAO8M,GAAoB,MAAO9M,GAAQ8O,GAAkB9S,MAAMkS,IAAMlO,EAAOhE,IAChF,CACD,UAAA+T,CAAW/P,GACT,OAAO8M,GAAoB,MAAO9M,GAAQ8O,GAAkB9S,MAAMmS,IAAMnO,EAAOhE,IAChF,CACD,WAAAgU,CAAYhQ,GACV,OA9FJ,SAA+BA,GAC7B,GAAoB,iBAATA,KAAuBd,MAAMC,QAAQa,IAAUd,MAAMG,KAAKW,GAAOS,KAAMwP,GAA4B,iBAAVA,IAClG,MAAM,IAAI5U,UAAU,sDACxB,CA2FW6U,CAAsBlQ,GAAQ8O,GAAkB9S,MAAMoS,IAAMpO,EAAOhE,IAC3E,CACD,MAAAmU,CAAOnQ,GACL,OAAO8M,GAAoB,MAAO9M,GAAQ8O,GAAkB9S,MAAMoU,IAAMpQ,EAAOhE,IAChF,CACD,YAAAqU,CAAarQ,GACX,OAAO8O,GAAkB9S,MAAM0S,IAAM3B,GAAY/M,EAAO,gBAAiBhE,IAC1E,CACD,iBAAAsU,CAAkBtQ,GAChB,OAAO8O,GAAkB9S,MAAM2S,IAAM5B,GAAY/M,EAAO,qBAAsBhE,IAC/E,CACD,WAAAuU,CAAYvQ,GACV,MAAMmN,EAAY2B,GAAkB9S,MACpC,OAA0BmR,EAAUsB,SAAd,IAAfzO,EAAmCsL,GAAsB,IAAI0B,MAA0B,iBAAThN,EAAoC6M,GAAc,cAAevB,GAAsB,IAAI0B,MAAUb,GAAKnM,IAA0B+M,GAAY/M,EAAO,eAAgBhE,IAC7P,GGrIH,MAAMwU,WAAgBZ,GACpB7O,GACA,kBAAA0P,CAAmB1P,GACjB,OTmBJ,SAAsBf,EAAO/D,GAC3B,QAAmB,IAAf+D,EACF,MAAM,IAAI3E,UAAU,GAAGY,4BAC3B,CStBWyU,CAAa1U,MAAK+E,EAAkB,sBAAuB/E,MAAK+E,EAAmBA,EAAiB/E,IAC5G,CACD,UAAM2T,CAAK7N,EAAKhG,GACd,OD2BJoB,eAAsCZ,EAASyE,EAAiBE,EAAMa,EAAKwN,GACzE,MAAOjF,SAAagF,GAAgB,CAAC/S,EAASyE,OAAsB,EAAGE,GAAOa,EAAKwN,GACnF,MAAO,GAAGjF,EAAII,aAAaJ,EAAI/N,WAAW+N,EAAIU,WAChD,CC9BW4F,CHwFX,SAA2B5B,GACzB,MAAM5B,EAAY2B,GAAkBC,GACpC,IAAK,MAAM3S,IAAS,CAAC,MAAO,MAAO,OAAQ,CACzC,MAAM4D,EAAQmN,EAAU/Q,GACxB,GAAoB,iBAAT4D,IAAsB2M,OAAOC,SAAS5M,GAC/C,MAAM,IAAI3E,UAAU,IAAIe,mCAC3B,CACD,OAAOpC,EAAQkB,OAAOuG,KAAKC,UAAUyL,GACvC,CGhGkCyD,CAAkB5U,MAAOA,MAAK+E,EAAkBjF,GAASmF,KAAMa,EAAK,KAChG,MAAM,IAAIlF,EAAW,wCAExB,ECXH,MAAMiU,GAAc,oBACpB,SAASC,GAAeC,EAAS,mCAC/B,MAAM,IAAIrU,EAAiB,0BAA0BqU,UACvD,CCGA7T,eAAe8T,GAAUlP,GACvB,GAAIuD,EAAYvD,GACd,IAAiB,WAAbA,EAAI4B,KAGN,OAAO5B,EAAIgC,OAAO,CAAEiB,OAAQ,QAF5BjD,EAAMA,EAAIgC,QAE0B,CACxC,GAAIhC,aAAejH,WACjB,MAAO,CACL+H,IAAK,MACLE,EAAGyM,EAAKzN,IAEZ,IAAK+B,EAAY/B,GACf,MAAM,IAAIzG,UV8DU,EAACkK,KAAWC,IAAU3J,EAAQ,eAAgB0J,KAAWC,GU9DzDyL,CAAgBnP,EAAK,YAAa,YAAa,eACrE,IAAKA,EAAIqE,YACP,MAAM,IAAI9K,UAAU,yDACtB,MAAMgH,QAAYiE,OAAOzB,OAAOqM,UAAU,MAAOpP,UAC1CO,EAAIE,WAAYF,EAAIG,eAAgBH,EAAIY,IAAiB,QAAZZ,EAAIO,YAAwBP,EAAIL,IACpF,IAAK,MAAMpC,KAAaf,OAAOO,KAAKiD,QACV,IAAxBA,EAAIzC,WAAgCyC,EAAIzC,GAC1C,OAAOyC,CACT,CCrBAnF,eAAeiU,GAAmBpN,EAAO1B,EAAKR,GAC5C,MAAMqC,EAASH,EAAMI,IAAI9B,IAAQ0B,EAAM/I,IAAIqH,EAAK,CAAE,GAAE8B,IAAI9B,IAAML,IAAEA,GAAQH,EACxE,QAAyB,IAArBqC,EAAOlC,GAAiB,CAC1B,MAAMoP,EAAUpM,EAASnD,EAAOQ,GAAK,GAAIgP,KAAMvP,IAC7C,GAAiB,WAAbA,EAAI4B,KACN,MAAM,IAAI7G,EAAY,gDACxB,OAAOqH,EAAOlC,GAAOF,EAAKA,IACzBwP,MAAOC,IACR,MAAMrN,EAAOlC,KAASoP,UAAkBlN,EAAOlC,GAAMuP,IAEvDrN,EAAOlC,GAAOoP,CACf,CACD,OAAOlN,EAAOlC,EAChB,CACA,SAASwP,GAAkBC,GACzB,IAAIC,EACJ,IACEA,EAAW7B,gBAAgB4B,EAC5B,CAAC,MAAOlV,GACP,MAAM,IAAIM,EAAY,6BAA8B,CAAEN,SACvD,CACD,IAAK0C,EAASyS,GACZ,MAAM,IAAI7U,EAAY,8BACxB,MAAM8U,EAAWD,EAAStS,KAAKwS,IAAKvP,IAClC,MAAMF,EAAaG,EAAYD,GAC/B,OAAOnD,MAAMC,QAAQgD,EAAWK,WAAaL,EAAWK,QAAU,IAAIL,EAAWK,UAAWL,IAC1F+B,EAAyB,IAAIF,QACjC,OAAOnF,OAAOgT,eAAe3U,MAAO6D,EAAiB+Q,KACnD,MAAM9P,IAAEA,EAAG+P,IAAEA,GAAQ,IAAKhR,KAAoB+Q,GAAOnS,QAAUkC,EAAsB,iBAAPG,EAAkBgH,GAAIhH,QAAY,EAChH,IAAKH,GAASA,EAAMI,OAClB,MAAM,IAAIvF,EAAiB,kDAC7B,MAAMsV,EAAaN,EAAStS,KAAK6S,OAAO,CAACC,EAAGC,IAnChD,SAAqB9P,EAAKR,EAAOG,EAAK+P,GACpC,MAAMnP,IAAEA,EAAKJ,QAASC,EAAMF,IAAEA,EAAKwP,IAAKK,EAAQpQ,IAAKqQ,EAAMpP,IAAEA,EAAGqB,IAAEA,GAAQjC,EAC1E,YAAqB,IAAbE,GAAgC,kBAAPA,UAAsC,IAAhBE,GAAqBvD,MAAMC,QAAQsD,IAAWA,EAAOnD,MAAM,CAACoD,EAAWyP,IAA8B,iBAAbzP,GAAyBD,EAAO6P,QAAQ5P,KAAeyP,IAAU1P,EAAO9E,SAAS,YAAckE,EAAMe,IAAIjF,SAASiF,UAAsB,IAAbmP,GAAgC,iBAAPA,GAAmBA,IAAQK,UAA4B,IAAhBC,EAA4B,QAARzP,EAAgBZ,IAAQqQ,UAAyB,IAAbpP,GAA0B,QAARA,MAAoBpB,EAAMyC,KAAOA,IAAQzC,EAAMyC,IACrc,CAgC0DiO,CAAYZ,EAASQ,GAAQtQ,EAAOG,EAAK+P,KAAS,EAAG1P,EAAG1H,OAAEA,GAAWqX,EAC3H,IAAKrX,EACH,MAAM,IAAImC,EACZ,GAAe,IAAXnC,EAAc,CAChB,MAAM4W,EAAQ,IAAIxU,EAClB,MAAMwU,EAAMvU,OAAOC,eAAiBC,kBAClC,IAAK,MAAMsV,KAAQR,EACjB,gBACcb,GAAmBjN,EAAQsO,EAAM3Q,EACzD,CAAY,MACD,CACJ,EAAE0P,CACJ,CACD,OAAOJ,GAAmBjN,EAAQ7B,EAAKR,IACtC,OAAQ,CACT7B,MAAO,IAAM6P,gBAAgB6B,IAEjC,CClDA,IAAIe,WACIC,UAAY,MAAQA,UAAUC,WAAWC,aAAa,mBAAqBH,GAAa,gBAChG,MAAMI,GAA8B7V,SAkBpC,MAAM8V,GAA4B9V,SAClC,SAAS+V,GAAWC,EAAWC,GAC7B,OAAOtG,OAAOC,SAASoG,IAAchG,KAAKwB,MAAQwE,EAAYC,CAChE,CACA,SAASC,GAAiBlT,EAAOmT,EAAU5S,GACzC,GAAIoM,OAAOyG,MAAMpT,GACf,MAAM,IAAI3E,UAAU,IAAIkF,6BAC1B,MAAuB,iBAATP,EAAoBA,EAAQmT,CAC5C,CACA,SAASE,GAAmB7V,EAAK1B,GAC/B,KAAM0B,aAAe8V,KACnB,MAAM,IAAIjY,UAAU,kCACtB,MAAMkY,EAAO,IAAID,IAAI9V,EAAI+V,MAAMA,KAAMC,EAAkB,CAAE,EAAEC,EAAgBD,EAAKE,gBAChF,GAA4B,iBAAjBD,KAA+B9G,OAAOgH,UAAUF,IAAkBA,EAAgB,GAC3F,MAAM,IAAIpY,UAAU,2DACtB,MAAMqY,EAA0C,iBAAjBD,EAA4BA,EAAgB,IAAKG,EAAmBV,GAAiBM,EAAKI,iBAAkB,IAAK,oBAAqBC,EAAcX,GAAiBM,EAAKK,YAAa,IAAK,eAAgBrU,EAAU,IAAIsU,QAAQN,EAAKhU,SACtQiT,KAAejT,EAAQK,IAAI,eAAiBL,EAAQxE,IAAI,aAAcyX,IAAajT,EAAQK,IAAI,WAAaL,EAAQxE,IAAI,SAAU,8CAClI,MAAM+Y,EAAYP,EAAKX,IAAc9O,EAAQyP,EAAKV,IAClD,IAAIkB,EAAeC,EAAuDC,EAAzCC,EAAiB,EAAGC,EAAkB,EACvE,GAAIrQ,GAAyB,iBAATA,EAAmB,CACrC,MAAMsQ,IAAEA,EAAG5C,KAAEA,GAAS1N,EACtBgP,GAAWsB,EAAKR,IAAgB5U,EAASwS,KAAUuC,EAAgBK,EAAKH,EAAQ1C,GAAkBC,GACnG,CACD,MAAM6C,EAASpX,UACb,GAAI+W,WA9CQM,cAAgB,YAAc7B,UAAY,KAA+B,uBAAxBA,UAAUC,kBAA6C6B,YAAc,KAAuB,WAAhBA,eA8C3FP,OAAoB,IAAKA,EAAc,CACnF,MAAMQ,IAAaN,EAAgBO,EAAUT,EA1CnD/W,eAAyBM,EAAKgC,EAASmV,EAAQZ,EAAYa,OACzD,MAAMC,QAAiBd,EAAUvW,EAAK,CACpCsX,OAAQ,MACRH,SACAI,SAAU,SACVvV,YACC8R,MAAO0D,IACR,KAAmB,iBAAbA,EAAI/Y,KAA0B,IAAIkB,OAAiB,EAAG,CAAEZ,MAAOyY,IAASA,IAEhF,GAAwB,MAApBH,EAASI,OACX,MAAM,IAAIxZ,EAAU,2DACtB,IACE,aAAaoZ,EAASK,MACvB,CAAC,MAAO3Y,GACP,MAAM,IAAId,EAAU,6DAA8D,CAAEc,SACrF,CACH,CA0BkE4Y,CAAU5B,EAAM/T,EAAS4V,YAAYC,QAAQ3B,GAAkBK,GAAW1C,KAAM6D,IAC1I,MAAMI,EAAO9D,GAAkB0D,GAC/B,GAAIT,GAAYL,EACd,OACFF,EAAQoB,EACR,MAAMC,EAAYvI,KAAKwB,MACvBzK,IAAUA,EAAMsQ,IAAMkB,EAAWxR,EAAM0N,KAAOyD,GAAOlB,EAAgBuB,EAAWnB,EAAkBK,IACjGe,QAAQ,KACTvB,IAAiBS,IAAYT,OAAoB,IAEpD,OACKA,GAER,OAAOpV,OAAO4W,iBAAiBvY,MAAO6D,EAAiB+Q,OACnDoC,IAAUnB,GAAWiB,EAAeH,WAAuBS,IAC7D,IACE,aAAaJ,EAAMnT,EAAiB+Q,EACrC,CAAC,MAAOkD,GACP,GAAIA,aAAelY,IAAsBiW,GAAWiB,EAAeJ,GACjE,aAAaU,IAAUJ,EAAMnT,EAAiB+Q,GAChD,MAAMkD,CACP,GACA,CACDU,YAAa,CACXvR,IAAK,IAAM4O,GAAWiB,EAAeJ,GACrC+B,YAAY,GAEdC,MAAO,CACLzR,IAAK,IAAM4O,GAAWiB,EAAeH,GACrC8B,YAAY,GAEdrB,OAAQ,CACNtU,MAAOsU,EACPqB,YAAY,GAEdE,UAAW,CACT1R,IAAK,MAAQ8P,EACb0B,YAAY,GAEdlE,KAAM,CACJzR,MAAO,IAAMkU,GAAOzC,OACpBkE,YAAY,IAGlB,CC5FA,SAASG,GAAuBha,GAC9B,MAAMgK,EAAgBhK,GAASgK,eAAiB,KAChD,GAA4B,iBAAjBA,IAA8B6G,OAAOgH,UAAU7N,IAAkBA,EAAgB,KAC1F,MAAM,IAAIpJ,EAAiB,+FAC7B,OAAOoJ,CACT,CACA5I,eAAe6Y,GAAgB/T,EAAKlG,GAClC,MAAMqK,EbmHR,SAAmCA,GACjC,QAAyB,IAArBA,GAAgD,kBAAfA,EACnC,MAAM,IAAI9K,UAAU,0CACtB,OAAO8K,CACT,CavHsB6P,CAA0Bla,GAASqK,aAActE,EJHvE,SAAsBG,EAAK+O,GACzB,OAAsB,iBAAP/O,EAAkBgH,GAAIhH,IAAQsF,EAAItF,QAAY,IAAM8O,GAAeC,EACpF,CIC+EkF,CAAajU,EAAK6O,IAE/F,IAAI9K,EACJ,GAFAlE,EAAMI,QAAU6O,GAAeD,IAE3BhP,EAAM8C,QAAS,CACjB,MAAML,EAAMxI,GAASwI,KAAO,QAC5B,IAAK,CAAC,QAAS,QAAS,QAAS,UAAU3G,SAAS2G,GAClD,MAAM,IAAI5H,EAAiB,oGAC7BqJ,EAAYlE,EAAM8C,QAAQ,CAAEL,OAChC,KAAS,CACL,QAAuB,IAAnBzC,EAAMyC,UAAwC,IAAtBxI,GAASwI,KAAkBxI,EAAQwI,MAAQzC,EAAMyC,IAC3E,MAAM,IAAI5H,EAAiB,4EAA4EsF,QAAUH,EAAMyC,OACzHyB,EAA6B,QAAjBlE,EAAMe,IAAI,GAAe,IAChCf,EAAMgD,OACTqR,eAAgBrb,WAAWsb,GAAG,EAAG,EAAG,GACpCrQ,cAAegQ,GAAuBha,IACpC+F,EAAMgD,MACX,CACD,OAAOyB,OAAOzB,OAAOuR,YAAYrQ,EAAWI,IAAe,EAAI,IAC1DtE,EAAMiD,OAAO,MACbjD,EAAMiD,OAAO,IAEpB,CC9BA,MAAMuR,GAAY,GAClB,IAAK,IAAIvb,EAAI,EAAGA,EAAI,MAAOA,EACvBub,GAAUjY,MAAMtD,EAAI,KAAOgE,SAAS,IAAIwX,MAAM,ICHlD,MAAMC,GAAQ,IAAI1b,WAAW,ICE7B,SAAS2b,GAAG1a,EAASlB,EAAK6b,GACtB,OAAwBnQ,OAAOoQ,WACpBpQ,OAAOoQ,aAItB,SAAa5a,GACTA,EAAUA,GAAW,GACrB,MAAM6a,EAAO7a,EAAQ8a,QAAU9a,EAAQ+a,SDRhCvQ,OAAOwQ,gBAAgBP,ICS9B,GAAII,EAAKhc,OAAS,GACd,MAAM,IAAIe,MAAM,qCAcpB,OAZAib,EAAK,GAAgB,GAAVA,EAAK,GAAa,GAC7BA,EAAK,GAAgB,GAAVA,EAAK,GAAa,IFV1B,SAAyBxY,EAAKsY,EAAS,GAC1C,OAAQJ,GAAUlY,EAAIsY,EAAS,IAC3BJ,GAAUlY,EAAIsY,EAAS,IACvBJ,GAAUlY,EAAIsY,EAAS,IACvBJ,GAAUlY,EAAIsY,EAAS,IACvB,IACAJ,GAAUlY,EAAIsY,EAAS,IACvBJ,GAAUlY,EAAIsY,EAAS,IACvB,IACAJ,GAAUlY,EAAIsY,EAAS,IACvBJ,GAAUlY,EAAIsY,EAAS,IACvB,IACAJ,GAAUlY,EAAIsY,EAAS,IACvBJ,GAAUlY,EAAIsY,EAAS,IACvB,IACAJ,GAAUlY,EAAIsY,EAAS,KACvBJ,GAAUlY,EAAIsY,EAAS,KACvBJ,GAAUlY,EAAIsY,EAAS,KACvBJ,GAAUlY,EAAIsY,EAAS,KACvBJ,GAAUlY,EAAIsY,EAAS,KACvBJ,GAAUlY,EAAIsY,EAAS,MAAM/J,aACrC,CEAWqK,CAAgBJ,EAC3B,CArBWK,CAAIlb,EACf,CCoBA,MAAMmb,GAAgC,oBAIhCC,GAAwB,CAAC,QAAS,SAClCC,GAAS,CAEXC,MAAO,QACPC,MAAO,QACPC,OAAQ,SACRC,kBAAmB,kBACnBC,WAAY,YACZC,sBAAuB,uBACvBC,gBAAiB,iBACjBC,iBAAkB,kBAClBC,iBAAkB,iBAClBC,YAAa,cAYXC,GAAiB,CALF,SAEC,iBAEF,SAyBpB,MAAMC,GACFC,YACA,WAAApc,CAAYoc,GACRhc,KAAKgc,YAAcA,EACnBhc,KAAKgc,YAAcA,CACtB,CAMD,sBAAMC,CAAiBvT,GAoBnB,MAAMwT,QAAsBC,QAAQC,IAAIpc,KAAKgc,YAAYpG,IAAKyG,GAAeA,EAAWC,aAAa5T,KACrG,IAAK,IAAI5J,EAAI,EAAGA,EAAIod,EAAcvd,OAAQG,GAAK,EAC3C,GAAIod,EAAcpd,GACd,OAAOkB,KAAKgc,YAAYld,GAGhC,OAAO,IACV,CACD,eAAMwd,IAAa5T,GACf,OAAiD,aAAnC1I,KAAKic,iBAAiBvT,EACvC,CACD,YAAM6T,IAAU7T,GACZ,MAAM8T,QAAgBxc,KAAKic,iBAAiBvT,GAC5C,GAAI8T,EACA,OAAOA,EAAQD,UAAU7T,GAE7B,MAAM,IAAIhJ,MAAM,IAAIM,KAAKJ,YAAYK,6CAA6CyI,EAC7EkN,IAAK6G,IACN,IACI,OAAOhX,KAAKC,UAAU+W,EACzB,CACD,MAAOC,GAEH,OAAOD,EAAM3Z,UAChB,IAEAJ,KAAK,QACb,EA+BLxB,eAAeyb,GAAyBC,EAASC,EAASC,EAAWC,GACjE,IAAIzc,EACA0c,EACJ,IACI,MAAQ1c,QAAS2c,SAA0BjK,GAAU4J,EAASvF,GAAmB,IAAIC,IAAIuF,IAAW,CAChGnL,OAAQoL,EACRlL,SAAUmL,IAEdzc,EAAU2c,CACb,CACD,MAAOC,GACH,MAAM,IAAIxd,MAAM,8BAA8Bwd,EAAEC,QACnD,CAID,GAH2B,iBAAhB7c,EAAQ8c,MACfJ,EAAoB1c,EAAQ8c,KAEH,iBAAlB9c,EAAQ+c,MACf,MAAO,CACHC,MAAOhd,EAAQ+c,MACfN,SAAUC,GAGlB,GAA2B,iBAAhB1c,EAAQ6R,IACf,MAAM,IAAIzS,MAAM,aAAa+F,KAAKC,UAAUpF,8DAEhD,IAKI,OADA,IAAIgX,IAAIhX,EAAQ6R,KACT,CACHmL,MAAOhd,EAAQ6R,IACf4K,SAAUC,EAEjB,CACD,MAAOE,GACH,MAAM,IAAIxd,MAAM,2DAA2DY,EAAQ6R,qCAAqC+K,MAC3H,CACL,CAsDA,SAASK,GAAmBC,GAExB,IACI,MAAMC,EAAY,IAAInG,IAAIkG,GACpBE,GAAmBD,EAAUE,aAAa9Z,IAAI,UAC/C4Z,EAAUE,aAAa9Z,IAAI,SAG1B+Z,EAA4B,KAAnBH,EAAUxT,KACzB,OAAOyT,GAAmBE,CAC7B,CACD,MAAOC,GACH,OAAO,CACV,CACL,CACA,SAASC,GAAmBN,GACxB,MAAMO,EAAe,IAAIzG,IAAIkG,GAS7B,OAPAO,EAAaJ,aAAaK,OAAO,SACjCD,EAAaJ,aAAaK,OAAO,QAEjCD,EAAaJ,aAAaK,OAAO,SACjCD,EAAaJ,aAAaK,OAAO,qBAEjCD,EAAaJ,aAAaK,OAAO,OAC1BD,CACX,CAoCA,MAAME,GACFC,eACAC,WACA,WAAAve,CAAYse,EAAgBC,GACxBne,KAAKke,eAAiBA,EACtBle,KAAKme,WAAaA,EAClBne,KAAKke,eAAiBA,EACtBle,KAAKme,WAAaA,CACrB,CACDC,gBAAmBC,QACsDC,IAA7DD,EAAiBE,oBAAoBC,qBACzCH,EAAiBE,oBAAoBC,oBAAoBlI,QAAQ,uBAAyB,QACzDgI,IAAjCD,EAAiBb,YAEzB,eAAMlB,CAAU+B,GACZ,OAAOre,KAAKoe,gBAAgBC,EAC/B,CACD,0BAAMI,EAAqBJ,iBAAEA,EAAgBK,MAAEA,EAAKC,aAAEA,EAAYC,UAAEA,IAChE,IAAK5e,KAAKoe,gBAAgBC,GACtB,MAAM,IAAI3e,MAAM,wDA9B5B,IAA6BsE,EAAOmT,QAgCtBgF,QAAQC,IAAI,CAUdpc,KAAKke,eAAeW,WAAWH,EAAO,CAClCI,UAAWT,EAAiBS,YAMhC9e,KAAKke,eAAeW,WAAWR,EAAiBS,UAAW,CACvDH,eACAjN,OAAQ2M,EAAiB3M,OAAO5O,WAEhC0a,YAAaa,EAAiBb,YAC9BuB,KAAMC,QAAQX,EAAiBU,MAAMjc,WACrCmc,WAvDajb,EAuDkBqa,EAAiBY,UAvD5B9H,GAuDuC,EAtDlD,kBAAVnT,EACAgb,QAAQhb,GAEZgb,QAAQ7H,IAmD8DrU,eAGzE9C,KAAKme,WAAWpF,SAAS6F,EAAW,CAChCM,eAAgBb,EAAiBa,gBAGxC,EAyBL,MAAMC,GACFC,mBACA,WAAAxf,CAAYwf,GACRpf,KAAKof,mBAAqBA,EAC1Bpf,KAAKof,mBAAqBA,CAC7B,CACD,eAAM9C,GACF,OAAO,CACV,CACD,YAAMC,CAAO8C,SACHrf,KAAKof,mBAAmBE,MAAMD,EACvC,EAsBL,MAAME,GACFpB,WACA,WAAAve,CAAYue,GACRne,KAAKme,WAAaA,EAClBne,KAAKme,WAAaA,CACrB,CACD,eAAM7B,CAAU+C,EAAQvf,GACpB,MAA+B,QAAxBA,GAAS0f,UACnB,CACD,YAAMjD,CAAO8C,EAAQvf,GACjB,GAA4B,QAAxBA,GAAS0f,WACT,MAAM,IAAI9f,MAAM,+DAEpB,QAA4B4e,IAAxBxe,EAAQ2f,YACR,MAAM,IAAI/f,MAAM,iFAEpBM,KAAKme,WAAWpF,SAASjZ,EAAQ2f,YAAY3f,GAAU,CACnDof,eAAgBpf,EAAQof,gBAE/B,EAsBL,MAAMQ,GACFC,SACA,WAAA/f,CAAYwf,EAAoBjB,GAC5Bne,KAAK2f,SAAW,CACZ,IAAIR,GAAqBC,GACzB,IAAIG,GAAiBpB,GAE5B,CACD,eAAM7B,GACF,OAAO,CACV,CACD,YAAMC,CAAO8C,EAAQvf,GACjB,IAAK,MAAM0c,KAAWxc,KAAK2f,eACbnD,EAAQF,UAAU+C,EAAQvf,UAC1B0c,EAAQD,OAAO8C,EAAQvf,EAExC,EA0BL,SAAS8f,KACL,MAAO,CACHC,YAAY,EACZf,UAAWtE,KACX5B,MAAO,IAAIkH,IAASlH,SAASkH,GAErC,CAMA5e,eAAeoe,GAAMR,EAAWiB,SACtB5D,QAAQC,IAAI,CACd2D,EAAQC,kBAAkBlB,EAAW,CAAEmB,QAAQ,IAC/CF,EAAQC,kBAAkBlB,EAAW,CAAEmB,QAAQ,KAEvD,CAIA,MAAMC,GACFhC,eACA,WAAAte,CAAYse,GACRle,KAAKke,eAAiBA,EACtBle,KAAKke,eAAiBA,CACzB,CACD,MAAAiC,CAAOC,EAAYC,GACf,MAAM,IAAI3gB,MAAM,kBACnB,CACD,GAAAV,CAAIohB,EAAYE,GACZ,MAAM,IAAI5gB,MAAM,kBACnB,CACD,GAAAyI,CAAI+N,GACA,MAAM,IAAIxW,MAAM,kBACnB,CACD,YAAM6gB,GACF,MAAM,IAAI7gB,MAAM,kBACnB,CAMD,WAAM4f,CAAMR,GACR,OAAOQ,GAAMR,EAAW9e,KAAKke,eAChC,CAID,cAAMsC,CAASJ,GACX,MAAM,IAAI1gB,MAAM,kBACnB,CAKD,+BAAM+gB,GACF,MAAM,IAAI/gB,MAAM,kBACnB,CAID,cAAMghB,GACF,MAAM,IAAIhhB,MAAM,kBACnB,CAID,oBAAMihB,CAAeP,EAAYQ,GAC7B,MAAM,IAAIlhB,MAAM,kBACnB,EAiDL,SAASmhB,IAA4BC,mBAAEA,EAAkBC,YAAEA,IACvD,QAA2BzC,IAAvBwC,EAEJ,OAAO,UAAgBpC,MAAEA,EAAKsC,cAAEA,IAC5B,OAtBR,UAA0BF,mBAAEA,EAAkBC,YAAEA,EAAWE,sBAAEA,EAAqBvC,MAAEA,IAChF,MAAMld,EAAM,IAAI8V,IAAIwJ,GAQpB,YAPoBxC,IAAhByC,GACAvf,EAAImc,aAAauD,OAAO,gBAAiBH,QACfzC,IAA1B2C,IACAzf,EAAImc,aAAauD,OAAO,2BAA4BD,QACtC3C,IAAVI,GACAld,EAAImc,aAAauD,OAAO,QAASxC,IAElCld,EAAIsB,UACf,CAYeqe,CAAiB,CACpBL,qBACAC,cACArC,QACAuC,sBAAuBD,GAEnC,CACA,CAiEA,SAASI,GAAW5f,GAChB,IAII,OADA,IAAI8V,IAAI9V,IACD,CACV,CACD,MACI,OAAO,CACV,CACL,CAkBAN,eAAemgB,GAAmBvhB,EAASwhB,EAAcpD,EAAgBqD,GACrE,IAAIC,EACJ,GAXJ,SAA2B1hB,EAASwhB,GAChC,OAAQA,EAAaG,gBAAgB9f,SAAS,eACrB2c,IAArBxe,EAAQid,UACRqE,GAAWthB,EAAQid,SAC3B,CAOQ2E,CAAkB5hB,EAASwhB,GAC3BE,EAAa,CACTzE,SAAUjd,EAAQid,SAClB4E,WAAY7hB,EAAQ6hB,WACpBC,WAAY,kBAGf,KArBT,SAAwB9hB,GACpB,YAA4Bwe,IAArBxe,EAAQid,WAA2BqE,GAAWthB,EAAQid,SACjE,CAmBa8E,CAAe/hB,GAUpB,OAAOyhB,EAAgBO,UAAU,CAC7BhD,UAAWhf,EAAQgf,UACnB6C,WAAY7hB,EAAQ6hB,WACpBnE,YAAa1d,EAAQ0d,aACtB8D,GAbHE,EAAa,CACTzE,SAAUjd,EAAQid,SAClBgF,aAAcjiB,EAAQiiB,aACtBJ,WAAY7hB,EAAQ6hB,WACpBC,WAAY,SAUnB,CAKD,MAAMI,EAAa,CACfjF,SAAUyE,EAAWzE,SACrB6E,WAAYJ,EAAWI,YAY3B,MAV8B,WAA1BJ,EAAWI,aACXI,EAAWD,aAAeP,EAAWO,cAErCP,EAAWG,aACXK,EAAWL,WAAaH,EAAWG,kBAKjCzD,EAAeW,WAAW/e,EAAQgf,UAAWkD,GAC5CR,CACX,CAqBA,MAAMS,GAAa,CAACC,EAASC,IAASvJ,MAAMsJ,EAASC,GAIrD,IAAAC,GAAA,MACIC,aACAC,gBACAC,cACAnD,mBACAoD,oBACAC,YACA,WAAA7iB,CAAYyiB,EAAcC,EAAiBC,EAAenD,EAAoBoD,GAC1ExiB,KAAKqiB,aAAeA,EACpBriB,KAAKsiB,gBAAkBA,EACvBtiB,KAAKuiB,cAAgBA,EACrBviB,KAAKof,mBAAqBA,EAC1Bpf,KAAKwiB,oBAAsBA,EAC3BxiB,KAAKqiB,aAAeA,EACpBriB,KAAKsiB,gBAAkBA,EACvBtiB,KAAKuiB,cAAgBA,EACrBviB,KAAKof,mBAAqBA,EAC1Bpf,KAAKwiB,oBAAsBA,CAC9B,CAED5J,MAAQqJ,GACRS,OAASxhB,MAAO4d,EAAWhf,WAKjBE,KAAKuiB,cAAchG,OAAOuC,EAAmC,QAAxBhf,GAAS0f,WAC9C,IACK1f,EACH2f,YAAazf,KAAKyiB,aAEpB3iB,GAGNE,KAAK4Y,MAAQqJ,UAENjiB,KAAKyiB,aAEhBE,eAAiBzhB,MAAO4d,GAEb9e,KAAKof,mBAAmBjX,IAAI2W,GAEvC8D,kBAAoB1hB,SACTlB,KAAKof,mBAAmBmB,UAyCvCrf,eAAe2hB,GAA2B/D,EAAWZ,EAAgB4E,GACjE,IACI,MAAOhG,EAAW6B,EAAcoE,EAAmBhE,EAAME,SAAmB9C,QAAQC,IAAI,CACpF8B,EAAe8E,WAAWlE,EAAW,SAAU,CAC3CmE,aAAa,IAEjB/E,EAAe8E,WAAWlE,EAAW,gBACrCZ,EAAe8E,WAAWlE,EAAW,eACrCZ,EAAe8E,WAAWlE,EAAW,OAAQ,CAAEmE,aAAa,IAC5D/E,EAAe8E,WAAWlE,EAAW,qBAGnCZ,EAAegF,cAAcpE,EAAW,gBAG9C,MAAO,CACHH,eACAnB,YAAauF,EACbzB,mBAJuBwB,EAAcK,YAAYrG,GAKjDiC,KAAe,SAATA,EAENE,UAAgC,iBAAdA,GAAuC,SAAdA,EAElD,CACD,MAAO/B,GACH,MAAM,IAAIxd,MAAM,yEAAyEof,OAAe5B,IAC3G,CACL,CAwCA,MAAMkG,GACFC,cACAC,gBACA,WAAA1jB,CAAYyjB,EAAeC,GACvBtjB,KAAKqjB,cAAgBA,EACrBrjB,KAAKsjB,gBAAkBA,EACvBtjB,KAAKqjB,cAAgBA,EACrBrjB,KAAKsjB,gBAAkBA,CAC1B,CACD,MAAAC,CAAOlE,GACH,MAAO,iCAAiCA,GAC3C,CACD,iBAAMmE,CAAYnE,EAAQY,GACtB,MAAMwD,QAAgBxD,EAASjgB,KAAKqjB,cAAgBrjB,KAAKsjB,iBAAiBnb,IAAInI,KAAKujB,OAAOlE,IAC1F,QAAef,IAAXmF,EACA,MAAO,GAEX,IACI,OAAOhe,KAAKE,MAAM8d,EACrB,CACD,MAAO/G,GACH,MAAM,IAAIhd,MAAM,kBAAkB2f,UAAeY,EAAS,SAAW,oEAAoEwD,IAC5I,CACJ,CACD,iBAAMC,CAAYrE,EAAQsE,EAAM1D,SACrBA,EAASjgB,KAAKqjB,cAAgBrjB,KAAKsjB,iBAAiBtkB,IAAIgB,KAAKujB,OAAOlE,GAAS5Z,KAAKC,UAAUie,GACtG,CACD,SAAMxb,CAAIrC,EAAKhG,GACX,MAAMkE,QAAelE,GAASmgB,OAASjgB,KAAKqjB,cAAgBrjB,KAAKsjB,iBAAiBnb,IAAIrC,GACtF,QAAcwY,IAAVta,GAAuBlE,GAASmjB,YAChC,MAAM,IAAIvjB,MAAM,IAAIoG,oBAExB,OAAO9B,CACV,CACD,SAAMhF,CAAI8G,EAAK9B,EAAOlE,GAClB,OAAQA,GAASmgB,OAASjgB,KAAKqjB,cAAgBrjB,KAAKsjB,iBAAiBtkB,IAAI8G,EAAK9B,EACjF,CACD,YAAM,CAAO8B,EAAKhG,GACd,OAAQA,GAASmgB,OAASjgB,KAAKqjB,cAAgBrjB,KAAKsjB,iBAAiBtF,OAAOlY,EAC/E,CACD,gBAAMkd,CAAW3D,EAAQvZ,EAAKhG,GAC1B,MAAM8jB,QAAiB5jB,KAAKwjB,YAAYnE,EAAQvf,GAASmgB,QACzD,IAAIjc,EAKJ,GAJK4f,GAAaA,EAAS9d,KACvB9B,OAAQsa,GAEZta,EAAQ4f,EAAS9d,QACHwY,IAAVta,GAAuBlE,GAASmjB,YAChC,MAAM,IAAIvjB,MAAM,UAAUoG,gBAAkBuZ,oBAEhD,OAAOrb,QAASsa,CACnB,CACD,gBAAMO,CAAWQ,EAAQwE,EAAQ/jB,GAC7B,IAAI8jB,EACJ,IACIA,QAAiB5jB,KAAKwjB,YAAYnE,EAAQvf,GAASmgB,OACtD,CACD,MAEI2D,EAAW,CAAA,CACd,OACK5jB,KAAK0jB,YAAYrE,EAAQ,IAAKuE,KAAaC,GAAU/jB,GAASmgB,OACvE,CACD,mBAAMiD,CAAc7D,EAAQvZ,EAAKhG,GAC7B,MAAM8jB,QAAiB5jB,KAAKwjB,YAAYnE,EAAQvf,GAASmgB,eAClD2D,EAAS9d,SACV9F,KAAK0jB,YAAYrE,EAAQuE,EAAU9jB,GAASmgB,OACrD,CACD,uBAAMD,CAAkBX,EAAQvf,SACrBA,GAASmgB,OAASjgB,KAAKqjB,cAAgBrjB,KAAKsjB,iBAAiBtF,OAAOhe,KAAKujB,OAAOlE,GAC1F,EAyBL,MAAMyE,GACFlO,IAAM,CAAA,EACN,SAAMzN,CAAIrC,GACN,OAAO9F,KAAK4V,IAAI9P,SAAQwY,CAC3B,CACD,SAAMtf,CAAI8G,EAAK9B,GACXhE,KAAK4V,IAAI9P,GAAO9B,CACnB,CACD,YAAM,CAAO8B,UACF9F,KAAK4V,IAAI9P,EACnB,EAmCL,MAAMie,WAA2BrkB,MAE7B,WAAAE,CAAYC,GACRE,MAAMF,EACT,EA8BL,MAAMmkB,WAA4BtkB,MAE9B,WAAAE,CAAYqkB,GACRlkB,MAAM,IAAIkkB,wBACb,EAmCL,MAAMC,WAA6BxkB,MAC/BykB,cAEA,WAAAvkB,CAAYukB,GACRpkB,MAAM,uDAAuDokB,KAC7DnkB,KAAKmkB,cAAgBA,CACxB,EAmCL,MAAMC,WAA0B1kB,MAC5B6V,MACA8O,iBAEA,WAAAzkB,CAAYC,EAAS0V,EAAO8O,GACxBtkB,MAAMF,GACNG,KAAKuV,MAAQA,EACbvV,KAAKqkB,iBAAmBA,CAC3B,EA6BL,SAASC,GAAa1S,GAClB,MAAM2S,EAAc,IAAIjN,IAAI1F,GAC5B,OAAO,IAAI0F,IAAIiN,EAAYC,SAAUD,EAAYE,QAAQ3hB,UAC7D,CAUA5B,eAAewjB,GAAiB9S,EAAUkH,EAAQ6L,GAC9C,OAAO,IAAInQ,GAAQ,CACfoQ,IAAKN,GAAa1S,GAClBiT,IAAK/L,EAAOgM,cACZ1Q,IAAKoG,OAEJ/F,mBAAmB,CACpBzO,IAAKkV,GAAsB,GAC3B7U,IAAKse,EAAQI,UACbvT,IAAK,aAEJ+C,cACAZ,KAAKgR,EAAQK,WAAY,CAAA,EAClC,CA0DA9jB,eAAe+jB,GAA0BrG,EAAWsG,EAAWP,EAASQ,GACpE,QAAgB7G,IAAZqG,EACA,OAZRzjB,eAAqC0d,EAAWsG,EAAWP,EAASQ,GAChE,MAAM3hB,EAAU,IAAIsU,QAAQqN,GAAgB3hB,SAI5C,OAFAA,EAAQxE,IAAI,gBAAiB,QAAQkmB,KACrC1hB,EAAQxE,IAAI,aAAc0lB,GAAiB9F,EAAWuG,GAAgBrM,QAAU,MAAO6L,IAChF,IACAQ,EACH3hB,UAER,CAGe4hB,CAAsBxG,EAAWsG,EAAWP,EAASQ,GAEhE,MAAM3hB,EAAU,IAAIsU,QAAQqN,GAAgB3hB,SAG5C,OADAA,EAAQxE,IAAI,gBAAiB,UAAUkmB,KAChC,IACAC,EACH3hB,UAER,CACAtC,eAAemkB,GAAyBC,EAAa9jB,EAAK+jB,EAAoBZ,EAASa,EAAc5M,OACjG,OAAO4M,EAAYhkB,QAAWyjB,GAA0BzjB,EAAIsB,WAAYwiB,EAAaX,EAASY,GAClG,CAeA,MAAME,GAAuBC,QACPpH,IAAdoH,EACOA,EApyC2B,EAoyCqB,EAE/CA,EAtyC0B,EAuyC5BA,EAnD0B,IAgExC,SAASC,GAAwBL,EAAaxlB,GAC1C,IACI8lB,EADAC,EAAqBP,EAEzB,MAAMQ,EAAwBhmB,GAASimB,eACjCC,EAAUlmB,GAASmmB,aAIzB,QAAgB3H,IAAZxe,QAAmDwe,IAA1BwH,EAAqC,CAC9D,MAAMI,EAA0BhlB,UAC5B,IACI,MAAQokB,YAAaa,EAAoBC,aAAEA,EAAYV,UAAEA,SA3CzExkB,eAAkC6kB,EAAgBpB,EAASsB,GACvD,MAAMI,QAAiBN,EAAeO,eAAeC,QAAQR,EAAejH,UAAWiH,EAAeK,aAAczB,GAEpH,OADAsB,GAAcO,KAAKrL,GAAOQ,iBAAkB0K,EAASX,WAlCjB,KAmC7B,CACHJ,YAAae,EAASf,YACtBc,aAAcC,EAASD,aACvBV,UAAWW,EAASX,UAE5B,CAmC8Fe,CAAmBX,EAAuBhmB,EAAQ6kB,QAASqB,GAEzIH,EAAqBM,OACA7H,IAAjB8H,IACAN,EAAsBM,aAAeA,GAIzCM,aAAad,GACbA,EAAgBe,WAAWT,EAA0D,IAAjCT,GAAoBC,IAExE5lB,EAAQmmB,cAAcO,KAAKrL,GAAOU,YAAa+J,EAClD,CACD,MAAO1I,GAKCA,aAAakH,KAKb4B,GAASQ,KAAKrL,GAAOC,MAAO8B,EAAE3H,MAAO2H,EAAEmH,kBAIvC2B,GAASQ,KAAKrL,GAAOO,kBAErBwB,aAAagH,IACbhH,EAAEiH,cAAcxiB,SAAS,iBAMzBqkB,GAASQ,KAAKrL,GAAOO,gBAE5B,GAELkK,EAAgBe,WAAWT,EAEc,IAAzCT,GAAoB3lB,EAAQ4lB,YAC5BM,GAASQ,KAAKrL,GAAOU,YAAa+J,EACrC,MACI,QAAgBtH,IAAZ0H,EAAuB,CAE5B,MAAMY,EAAoBD,WAAW,KACjCX,EAAQQ,KAAKrL,GAAOO,kBACqB,IAA1C+J,GAAoB3lB,GAAS4lB,YAChCM,EAAQQ,KAAKrL,GAAOU,YAAa+K,EACpC,CACD,OAAO1lB,MAAOM,EAAKqlB,KACf,IAAIhO,QAAiBwM,GAAyBQ,EAAoBrkB,EAAKqlB,EAAa/mB,GAAS6kB,QAAS7kB,GAAS8Y,OAC/G,MAAMkO,GAAiCjO,EAASkO,KAhI3BC,EAgIsDnO,EAASI,QA5HjF,CAAC,IAAK,KAAKtX,SAASqlB,IAJ/B,IAA6BA,EAiIrB,GAAInO,EAASkO,IAAMD,EAGf,OAAOjO,EAaX,OAX0BA,EAASrX,MAAQA,QACG8c,IAArBxe,GAAS6kB,UAM9B9L,QAAiBwM,GAAyBQ,EAE1ChN,EAASrX,IAAKqlB,EAAa/mB,EAAQ6kB,QAAS7kB,EAAQ8Y,QAEjDC,EAEf,CCv7CA,MAAMwB,GAAY,GAClB,IAAK,IAAIvb,EAAI,EAAGA,EAAI,MAAOA,EACvBub,GAAUjY,MAAMtD,EAAI,KAAOgE,SAAS,IAAIwX,MAAM,ICHlD,MAAMC,GAAQ,IAAI1b,WAAW,ICE7B,SAAS2b,GAAG1a,EAASlB,EAAK6b,GACtB,OAAwBnQ,OAAOoQ,WACpBpQ,OAAOoQ,aAItB,SAAa5a,GACTA,EAAUA,GAAW,GACrB,MAAM6a,EAAO7a,EAAQ8a,QAAU9a,EAAQ+a,SDRhCvQ,OAAOwQ,gBAAgBP,ICS9B,GAAII,EAAKhc,OAAS,GACd,MAAM,IAAIe,MAAM,qCAcpB,OAZAib,EAAK,GAAgB,GAAVA,EAAK,GAAa,GAC7BA,EAAK,GAAgB,GAAVA,EAAK,GAAa,IFV1B,SAAyBxY,EAAKsY,EAAS,GAC1C,OAAQJ,GAAUlY,EAAIsY,EAAS,IAC3BJ,GAAUlY,EAAIsY,EAAS,IACvBJ,GAAUlY,EAAIsY,EAAS,IACvBJ,GAAUlY,EAAIsY,EAAS,IACvB,IACAJ,GAAUlY,EAAIsY,EAAS,IACvBJ,GAAUlY,EAAIsY,EAAS,IACvB,IACAJ,GAAUlY,EAAIsY,EAAS,IACvBJ,GAAUlY,EAAIsY,EAAS,IACvB,IACAJ,GAAUlY,EAAIsY,EAAS,IACvBJ,GAAUlY,EAAIsY,EAAS,IACvB,IACAJ,GAAUlY,EAAIsY,EAAS,KACvBJ,GAAUlY,EAAIsY,EAAS,KACvBJ,GAAUlY,EAAIsY,EAAS,KACvBJ,GAAUlY,EAAIsY,EAAS,KACvBJ,GAAUlY,EAAIsY,EAAS,KACvBJ,GAAUlY,EAAIsY,EAAS,MAAM/J,aACrC,CEAWqK,CAAgBJ,EAC3B,CArBWK,CAAIlb,EACf,4KCgBA,IAOImnB,EAPAC,EAAuB,iBAAZC,QAAuBA,QAAU,KAC5CC,EAAeF,GAAwB,mBAAZA,EAAE3kB,MAC7B2kB,EAAE3kB,MACF,SAAsB8kB,EAAQC,EAAUxH,GACxC,OAAOyH,SAASvlB,UAAUO,MAAMQ,KAAKskB,EAAQC,EAAUxH,EACxD,EAIDmH,EADEC,GAA0B,mBAAdA,EAAEM,QACCN,EAAEM,QACV3kB,OAAO4kB,sBACC,SAAwBJ,GACvC,OAAOxkB,OAAO6kB,oBAAoBL,GAC/B/oB,OAAOuE,OAAO4kB,sBAAsBJ,GAC3C,EAEmB,SAAwBA,GACvC,OAAOxkB,OAAO6kB,oBAAoBL,EACtC,EAOA,IAAIM,EAAchX,OAAOyG,OAAS,SAAqBpT,GACrD,OAAOA,GAAUA,CAClB,EAED,SAAS4jB,IACPA,EAAazF,KAAKpf,KAAK/C,KACxB,CACa6nB,GAAAC,QAAGF,EACEC,GAAAC,QAAAC,KAwYnB,SAAc/B,EAAS/lB,GACrB,OAAO,IAAIkc,QAAQ,SAAUxT,EAASqf,GACpC,SAASC,EAAcjP,GACrBgN,EAAQkC,eAAejoB,EAAMkoB,GAC7BH,EAAOhP,EACR,CAED,SAASmP,IAC+B,mBAA3BnC,EAAQkC,gBACjBlC,EAAQkC,eAAe,QAASD,GAElCtf,EAAQ,GAAG2R,MAAMvX,KAAKqlB,WAE5B,CACIC,EAA+BrC,EAAS/lB,EAAMkoB,EAAU,CAAEJ,MAAM,IACnD,UAAT9nB,GAMR,SAAuC+lB,EAASxJ,EAAS8L,GAC7B,mBAAftC,EAAQuC,IACjBF,EAA+BrC,EAAS,QAASxJ,EAAS8L,EAE7D,CATKE,CAA8BxC,EAASiC,EAAe,CAAEF,MAAM,GAEpE,EACC,EAxZDH,EAAaA,aAAeA,EAE5BA,EAAa5lB,UAAUymB,aAAUnK,EACjCsJ,EAAa5lB,UAAU0mB,aAAe,EACtCd,EAAa5lB,UAAU2mB,mBAAgBrK,EAIvC,IAAIsK,EAAsB,GAE1B,SAASC,EAAcC,GACrB,GAAwB,mBAAbA,EACT,MAAM,IAAIzpB,UAAU,0EAA4EypB,EAEnG,CAoCD,SAASC,EAAiBC,GACxB,YAA2B1K,IAAvB0K,EAAKL,cACAf,EAAagB,oBACfI,EAAKL,aACb,CAkDD,SAASM,EAAa5B,EAAQ3f,EAAMohB,EAAUI,GAC5C,IAAItZ,EACAuZ,EACAC,EA1HsBC,EAgJ1B,GApBAR,EAAcC,QAGCxK,KADf6K,EAAS9B,EAAOoB,UAEdU,EAAS9B,EAAOoB,QAAU5lB,OAAOymB,OAAO,MACxCjC,EAAOqB,aAAe,SAIKpK,IAAvB6K,EAAOI,cACTlC,EAAOb,KAAK,cAAe9e,EACfohB,EAASA,SAAWA,EAASA,SAAWA,GAIpDK,EAAS9B,EAAOoB,SAElBW,EAAWD,EAAOzhB,SAGH4W,IAAb8K,EAEFA,EAAWD,EAAOzhB,GAAQohB,IACxBzB,EAAOqB,kBAeT,GAbwB,mBAAbU,EAETA,EAAWD,EAAOzhB,GAChBwhB,EAAU,CAACJ,EAAUM,GAAY,CAACA,EAAUN,GAErCI,EACTE,EAASI,QAAQV,GAEjBM,EAAShnB,KAAK0mB,IAIhBlZ,EAAImZ,EAAiB1B,IACb,GAAK+B,EAASzqB,OAASiR,IAAMwZ,EAASK,OAAQ,CACpDL,EAASK,QAAS,EAGlB,IAAI3Z,EAAI,IAAIpQ,MAAM,+CACE0pB,EAASzqB,OAAS,IAAM0D,OAAOqF,GADjC,qEAIlBoI,EAAE7P,KAAO,8BACT6P,EAAEkW,QAAUqB,EACZvX,EAAEpI,KAAOA,EACToI,EAAE4Z,MAAQN,EAASzqB,OA7KG0qB,EA8KHvZ,EA7KnB6Z,SAAWA,QAAQC,MAAMD,QAAQC,KAAKP,EA8KvC,CAGH,OAAOhC,CACR,CAaD,SAASwC,IACP,IAAK7pB,KAAK8pB,MAGR,OAFA9pB,KAAKqnB,OAAOa,eAAeloB,KAAK0H,KAAM1H,KAAK+pB,QAC3C/pB,KAAK8pB,OAAQ,EACY,IAArB1B,UAAUzpB,OACLqB,KAAK8oB,SAAS/lB,KAAK/C,KAAKqnB,QAC1BrnB,KAAK8oB,SAASvmB,MAAMvC,KAAKqnB,OAAQe,UAE3C,CAED,SAAS4B,EAAU3C,EAAQ3f,EAAMohB,GAC/B,IAAIpK,EAAQ,CAAEoL,OAAO,EAAOC,YAAQzL,EAAW+I,OAAQA,EAAQ3f,KAAMA,EAAMohB,SAAUA,GACjFmB,EAAUJ,EAAYK,KAAKxL,GAG/B,OAFAuL,EAAQnB,SAAWA,EACnBpK,EAAMqL,OAASE,EACRA,CACR,CAyHD,SAASE,EAAW9C,EAAQ3f,EAAM0iB,GAChC,IAAIjB,EAAS9B,EAAOoB,QAEpB,QAAenK,IAAX6K,EACF,MAAO,GAET,IAAIkB,EAAalB,EAAOzhB,GACxB,YAAmB4W,IAAf+L,EACK,GAEiB,mBAAfA,EACFD,EAAS,CAACC,EAAWvB,UAAYuB,GAAc,CAACA,GAElDD,EAsDT,SAAyBjoB,GAEvB,IADA,IAAImoB,EAAM,IAAIpnB,MAAMf,EAAIxD,QACfG,EAAI,EAAGA,EAAIwrB,EAAI3rB,SAAUG,EAChCwrB,EAAIxrB,GAAKqD,EAAIrD,GAAGgqB,UAAY3mB,EAAIrD,GAElC,OAAOwrB,CACR,CA3DGC,CAAgBF,GAAcG,EAAWH,EAAYA,EAAW1rB,OACnE,CAmBD,SAAS8rB,EAAc/iB,GACrB,IAAIyhB,EAASnpB,KAAKyoB,QAElB,QAAenK,IAAX6K,EAAsB,CACxB,IAAIkB,EAAalB,EAAOzhB,GAExB,GAA0B,mBAAf2iB,EACT,OAAO,EACF,QAAmB/L,IAAf+L,EACT,OAAOA,EAAW1rB,MAErB,CAED,OAAO,CACR,CAMD,SAAS6rB,EAAWroB,EAAKuoB,GAEvB,IADA,IAAIC,EAAO,IAAIznB,MAAMwnB,GACZ5rB,EAAI,EAAGA,EAAI4rB,IAAK5rB,EACvB6rB,EAAK7rB,GAAKqD,EAAIrD,GAChB,OAAO6rB,CACR,CA2CD,SAAStC,EAA+BrC,EAAS/lB,EAAM6oB,EAAUR,GAC/D,GAA0B,mBAAftC,EAAQuC,GACbD,EAAMP,KACR/B,EAAQ+B,KAAK9nB,EAAM6oB,GAEnB9C,EAAQuC,GAAGtoB,EAAM6oB,OAEd,IAAwC,mBAA7B9C,EAAQ4E,iBAYxB,MAAM,IAAIvrB,UAAU,6EAA+E2mB,GATnGA,EAAQ4E,iBAAiB3qB,EAAM,SAAS4qB,EAAaC,GAG/CxC,EAAMP,MACR/B,EAAQ+E,oBAAoB9qB,EAAM4qB,GAEpC/B,EAASgC,EACf,EAGG,CACH,QAraAjoB,OAAOgT,eAAe+R,EAAc,sBAAuB,CACzDjO,YAAY,EACZxR,IAAK,WACH,OAAOygB,CACR,EACD5pB,IAAK,SAAS8rB,GACZ,GAAmB,iBAARA,GAAoBA,EAAM,GAAKnD,EAAYmD,GACpD,MAAM,IAAIE,WAAW,kGAAoGF,EAAM,KAEjIlC,EAAsBkC,CACvB,IAGHlD,EAAazF,KAAO,gBAEG7D,IAAjBte,KAAKyoB,SACLzoB,KAAKyoB,UAAY5lB,OAAOG,eAAehD,MAAMyoB,UAC/CzoB,KAAKyoB,QAAU5lB,OAAOymB,OAAO,MAC7BtpB,KAAK0oB,aAAe,GAGtB1oB,KAAK2oB,cAAgB3oB,KAAK2oB,oBAAiBrK,CAC7C,EAIAsJ,EAAa5lB,UAAUipB,gBAAkB,SAAyBP,GAChE,GAAiB,iBAANA,GAAkBA,EAAI,GAAK/C,EAAY+C,GAChD,MAAM,IAAIM,WAAW,gFAAkFN,EAAI,KAG7G,OADA1qB,KAAK2oB,cAAgB+B,EACd1qB,IACT,EAQA4nB,EAAa5lB,UAAUkpB,gBAAkB,WACvC,OAAOnC,EAAiB/oB,KAC1B,EAEA4nB,EAAa5lB,UAAUwkB,KAAO,SAAc9e,GAE1C,IADA,IAAIoY,EAAO,GACFhhB,EAAI,EAAGA,EAAIspB,UAAUzpB,OAAQG,IAAKghB,EAAK1d,KAAKgmB,UAAUtpB,IAC/D,IAAIqsB,EAAoB,UAATzjB,EAEXyhB,EAASnpB,KAAKyoB,QAClB,QAAenK,IAAX6K,EACFgC,EAAWA,QAA4B7M,IAAjB6K,EAAO5T,WAC1B,IAAK4V,EACR,OAAO,EAGT,GAAIA,EAAS,CACX,IAAIC,EAGJ,GAFItL,EAAKnhB,OAAS,IAChBysB,EAAKtL,EAAK,IACRsL,aAAc1rB,MAGhB,MAAM0rB,EAGR,IAAIpS,EAAM,IAAItZ,MAAM,oBAAsB0rB,EAAK,KAAOA,EAAGvrB,QAAU,IAAM,KAEzE,MADAmZ,EAAIqS,QAAUD,EACRpS,CACP,CAED,IAAIwD,EAAU2M,EAAOzhB,GAErB,QAAgB4W,IAAZ9B,EACF,OAAO,EAET,GAAuB,mBAAZA,EACT4K,EAAa5K,EAASxc,KAAM8f,OAE5B,KAAIwL,EAAM9O,EAAQ7d,OACd4sB,EAAYf,EAAWhO,EAAS8O,GACpC,IAASxsB,EAAI,EAAGA,EAAIwsB,IAAOxsB,EACzBsoB,EAAamE,EAAUzsB,GAAIkB,KAAM8f,EAHX,CAM1B,OAAO,CACT,EAgEA8H,EAAa5lB,UAAUwpB,YAAc,SAAqB9jB,EAAMohB,GAC9D,OAAOG,EAAajpB,KAAM0H,EAAMohB,GAAU,EAC5C,EAEAlB,EAAa5lB,UAAUumB,GAAKX,EAAa5lB,UAAUwpB,YAEnD5D,EAAa5lB,UAAUypB,gBACnB,SAAyB/jB,EAAMohB,GAC7B,OAAOG,EAAajpB,KAAM0H,EAAMohB,GAAU,EAChD,EAoBAlB,EAAa5lB,UAAU+lB,KAAO,SAAcrgB,EAAMohB,GAGhD,OAFAD,EAAcC,GACd9oB,KAAKuoB,GAAG7gB,EAAMsiB,EAAUhqB,KAAM0H,EAAMohB,IAC7B9oB,IACT,EAEA4nB,EAAa5lB,UAAU0pB,oBACnB,SAA6BhkB,EAAMohB,GAGjC,OAFAD,EAAcC,GACd9oB,KAAKyrB,gBAAgB/jB,EAAMsiB,EAAUhqB,KAAM0H,EAAMohB,IAC1C9oB,IACb,EAGA4nB,EAAa5lB,UAAUkmB,eACnB,SAAwBxgB,EAAMohB,GAC5B,IAAI6C,EAAMxC,EAAQyC,EAAU9sB,EAAG+sB,EAK/B,GAHAhD,EAAcC,QAGCxK,KADf6K,EAASnpB,KAAKyoB,SAEZ,OAAOzoB,KAGT,QAAase,KADbqN,EAAOxC,EAAOzhB,IAEZ,OAAO1H,KAET,GAAI2rB,IAAS7C,GAAY6C,EAAK7C,WAAaA,EACb,MAAtB9oB,KAAK0oB,aACT1oB,KAAKyoB,QAAU5lB,OAAOymB,OAAO,cAEtBH,EAAOzhB,GACVyhB,EAAOjB,gBACTloB,KAAKwmB,KAAK,iBAAkB9e,EAAMikB,EAAK7C,UAAYA,SAElD,GAAoB,mBAAT6C,EAAqB,CAGrC,IAFAC,GAAY,EAEP9sB,EAAI6sB,EAAKhtB,OAAS,EAAGG,GAAK,EAAGA,IAChC,GAAI6sB,EAAK7sB,KAAOgqB,GAAY6C,EAAK7sB,GAAGgqB,WAAaA,EAAU,CACzD+C,EAAmBF,EAAK7sB,GAAGgqB,SAC3B8C,EAAW9sB,EACX,KACD,CAGH,GAAI8sB,EAAW,EACb,OAAO5rB,KAEQ,IAAb4rB,EACFD,EAAKG,QAiIf,SAAmBH,EAAMxV,GACvB,KAAOA,EAAQ,EAAIwV,EAAKhtB,OAAQwX,IAC9BwV,EAAKxV,GAASwV,EAAKxV,EAAQ,GAC7BwV,EAAKjiB,KACN,CAnISqiB,CAAUJ,EAAMC,GAGE,IAAhBD,EAAKhtB,SACPwqB,EAAOzhB,GAAQikB,EAAK,SAEQrN,IAA1B6K,EAAOjB,gBACTloB,KAAKwmB,KAAK,iBAAkB9e,EAAMmkB,GAAoB/C,EACzD,CAED,OAAO9oB,IACb,EAEA4nB,EAAa5lB,UAAUgqB,IAAMpE,EAAa5lB,UAAUkmB,eAEpDN,EAAa5lB,UAAUiqB,mBACnB,SAA4BvkB,GAC1B,IAAI6jB,EAAWpC,EAAQrqB,EAGvB,QAAewf,KADf6K,EAASnpB,KAAKyoB,SAEZ,OAAOzoB,KAGT,QAA8Bse,IAA1B6K,EAAOjB,eAUT,OATyB,IAArBE,UAAUzpB,QACZqB,KAAKyoB,QAAU5lB,OAAOymB,OAAO,MAC7BtpB,KAAK0oB,aAAe,QACMpK,IAAjB6K,EAAOzhB,KACY,MAAtB1H,KAAK0oB,aACT1oB,KAAKyoB,QAAU5lB,OAAOymB,OAAO,aAEtBH,EAAOzhB,IAEX1H,KAIT,GAAyB,IAArBooB,UAAUzpB,OAAc,CAC1B,IACImH,EADA1C,EAAOP,OAAOO,KAAK+lB,GAEvB,IAAKrqB,EAAI,EAAGA,EAAIsE,EAAKzE,SAAUG,EAEjB,oBADZgH,EAAM1C,EAAKtE,KAEXkB,KAAKisB,mBAAmBnmB,GAK1B,OAHA9F,KAAKisB,mBAAmB,kBACxBjsB,KAAKyoB,QAAU5lB,OAAOymB,OAAO,MAC7BtpB,KAAK0oB,aAAe,EACb1oB,IACR,CAID,GAAyB,mBAFzBurB,EAAYpC,EAAOzhB,IAGjB1H,KAAKkoB,eAAexgB,EAAM6jB,QACrB,QAAkBjN,IAAdiN,EAET,IAAKzsB,EAAIysB,EAAU5sB,OAAS,EAAGG,GAAK,EAAGA,IACrCkB,KAAKkoB,eAAexgB,EAAM6jB,EAAUzsB,IAIxC,OAAOkB,IACb,EAmBA4nB,EAAa5lB,UAAUupB,UAAY,SAAmB7jB,GACpD,OAAOyiB,EAAWnqB,KAAM0H,GAAM,EAChC,EAEAkgB,EAAa5lB,UAAUkqB,aAAe,SAAsBxkB,GAC1D,OAAOyiB,EAAWnqB,KAAM0H,GAAM,EAChC,EAEAkgB,EAAa6C,cAAgB,SAASzE,EAASte,GAC7C,MAAqC,mBAA1Bse,EAAQyE,cACVzE,EAAQyE,cAAc/iB,GAEtB+iB,EAAc1nB,KAAKijB,EAASte,EAEvC,EAEAkgB,EAAa5lB,UAAUyoB,cAAgBA,EAiBvC7C,EAAa5lB,UAAUmqB,WAAa,WAClC,OAAOnsB,KAAK0oB,aAAe,EAAIzB,EAAejnB,KAAKyoB,SAAW,EAChE,0BCnYqB,MAAA2D,WAA8BhJ,GACjD,WAAAxjB,CAAYyjB,EAAyBC,GACnCvjB,MAAMsjB,EAAeC,EACtB,ECzCI,MAAM+I,WAA0B3sB,OAYvC,SAAS4sB,GAAgBlc,GACrB,IAAImc,EAASnc,EAAIxO,QAAQ,KAAM,KAAKA,QAAQ,KAAM,KAClD,OAAQ2qB,EAAO5tB,OAAS,GACpB,KAAK,EACD,MACJ,KAAK,EACD4tB,GAAU,KACV,MACJ,KAAK,EACDA,GAAU,IACV,MACJ,QACI,MAAM,IAAI7sB,MAAM,8CAExB,IACI,OAxBR,SAA0B0Q,GACtB,OAAOoc,mBAAmB1qB,KAAKsO,GAAKxO,QAAQ,OAAQ,CAACgO,EAAG6c,KACpD,IAAIltB,EAAOktB,EAAEjtB,WAAW,GAAGsD,SAAS,IAAIgiB,cAIxC,OAHIvlB,EAAKZ,OAAS,IACdY,EAAO,IAAMA,GAEV,IAAMA,IAErB,CAgBemtB,CAAiBH,EAC3B,CACD,MAAOvT,GACH,OAAOlX,KAAKyqB,EACf,CACL,CA9BAF,GAAkBrqB,UAAU/B,KAAO,oBCDnC,IAMI0sB,GACAC,GASFC,GAhBEC,GAAY,CACdC,MAAO,OACPC,KAAM,OACNpD,KAAM,OACNrU,MAAO,QAIL0X,GAAsB,CAAEJ,IAC1BA,EAAKA,EAAW,KAAI,GAAK,OACzBA,EAAKA,EAAY,MAAI,GAAK,QAC1BA,EAAKA,EAAW,KAAI,GAAK,OACzBA,EAAKA,EAAW,KAAI,GAAK,OACzBA,EAAKA,EAAY,MAAI,GAAK,QACnBA,GANiB,CAOvBI,IAAO,CAAA,IACRJ,GAiBCI,KAAQA,GAAM,CAAE,IAZZC,MAJL,WACEP,GAAQ,EACRC,GAASE,EACV,EAQDD,GAAKM,SANL,SAAkBnpB,GAChB,KAAM,GAAgBA,GAASA,GAAS,GACtC,MAAM,IAAItE,MAAM,qBAElBitB,GAAQ3oB,CACT,EAKD6oB,GAAKO,UAHL,SAAmBppB,GACjB4oB,GAAS5oB,CACV,EAGH,IAAIqpB,GAAS,MAAMC,EACjB,WAAA1tB,CAAY2tB,GACVvtB,KAAKutB,MAAQA,CACd,CAED,KAAAR,IAASjN,GACH6M,IAAS,GACXC,GAAOG,MAAMO,EAAQE,QAAQxtB,KAAKutB,MAAOvtB,KAAKytB,YAAa3N,EAE9D,CACD,IAAAkN,IAAQlN,GACF6M,IAAS,GACXC,GAAOI,KAAKM,EAAQE,QAAQxtB,KAAKutB,MAAOvtB,KAAKytB,YAAa3N,EAE7D,CACD,IAAA8J,IAAQ9J,GACF6M,IAAS,GACXC,GAAOhD,KAAK0D,EAAQE,QAAQxtB,KAAKutB,MAAOvtB,KAAKytB,YAAa3N,EAE7D,CACD,KAAAvK,IAASuK,GACH6M,IAAS,GACXC,GAAOrX,MAAM+X,EAAQE,QAAQxtB,KAAKutB,MAAOvtB,KAAKytB,YAAa3N,EAE9D,CAED,MAAM9G,GAEJ,MADAhZ,KAAKuV,MAAMyD,GACLA,CACP,CACD,MAAAsQ,CAAOxQ,GACL,MAAM4U,EAAe7qB,OAAOymB,OAAOtpB,MAGnC,OAFA0tB,EAAaD,QAAU3U,EACvB4U,EAAaX,MAAM,SACZW,CACR,CACD,mBAAOC,CAAa1tB,EAAM2tB,GACxB,MAAMC,EAAe,IAAIP,EAAQ,GAAGrtB,KAAQ2tB,KAE5C,OADAC,EAAad,MAAM,SACZc,CACR,CACD,cAAOL,CAAQvtB,EAAM6Y,GACnB,MAAMgV,EAAS,IAAI7tB,KACnB,OAAO6Y,EAAS,GAAGgV,KAAUhV,KAAYgV,CAC1C,CAGD,YAAOf,CAAM9sB,KAAS6f,GAChB6M,IAAS,GACXC,GAAOG,MAAMO,EAAQE,QAAQvtB,MAAU6f,EAE1C,CACD,WAAOkN,CAAK/sB,KAAS6f,GACf6M,IAAS,GACXC,GAAOI,KAAKM,EAAQE,QAAQvtB,MAAU6f,EAEzC,CACD,WAAO8J,CAAK3pB,KAAS6f,GACf6M,IAAS,GACXC,GAAOhD,KAAK0D,EAAQE,QAAQvtB,MAAU6f,EAEzC,CACD,YAAOvK,CAAMtV,KAAS6f,GAChB6M,IAAS,GACXC,GAAOrX,MAAM+X,EAAQE,QAAQvtB,MAAU6f,EAE1C,GAGHmN,GAAIC,QAIJ,IAAIa,GAAW,MAEb,aAAO1sB,CAAOyU,GACZ,IACE,OD/EC,SAAmBA,EAAOhW,GAC7B,GAAqB,iBAAVgW,EACP,MAAM,IAAIuW,GAAkB,6CAEhCvsB,IAAYA,EAAU,CAAA,GACtB,MAAMkuB,GAAyB,IAAnBluB,EAAQ6D,OAAkB,EAAI,EACpCsqB,EAAOnY,EAAM5C,MAAM,KAAK8a,GAC9B,GAAoB,iBAATC,EACP,MAAM,IAAI5B,GAAkB,0CAA0C2B,EAAM,KAEhF,IAAIE,EACJ,IACIA,EAAU5B,GAAgB2B,EAC7B,CACD,MAAO/Q,GACH,MAAM,IAAImP,GAAkB,qDAAqD2B,EAAM,MAAM9Q,EAAErd,WAClG,CACD,IACI,OAAO4F,KAAKE,MAAMuoB,EACrB,CACD,MAAOhR,GACH,MAAM,IAAImP,GAAkB,mDAAmD2B,EAAM,MAAM9Q,EAAErd,WAChG,CACL,CCwDasuB,CAAUrY,EAClB,CAAC,MAAOkD,GAEP,MADAqU,GAAO9X,MAAM,kBAAmByD,GAC1BA,CACP,CACF,CACD,8BAAaoV,CAAkBzqB,EAAQrD,EAAS0kB,GAC9C,MAEMqJ,EAAe,GAFCC,GAAYC,iBAAgB,IAAItwB,aAAciB,OAAOuG,KAAKC,UAAU/B,QACnE2qB,GAAYC,iBAAgB,IAAItwB,aAAciB,OAAOuG,KAAKC,UAAUpF,OAErFyO,QAAkByf,OAAOlkB,OAAOzB,OAAO8K,KAC3C,CACE1T,KAAM,QACNgK,KAAM,CAAEhK,KAAM,YAEhB+kB,GACA,IAAI/mB,aAAciB,OAAOmvB,IAG3B,MAAO,GAAGA,KADeC,GAAYC,gBAAgB,IAAI1vB,WAAWkQ,KAErE,CACD,sCAAa0f,CAA0B9qB,EAAQrD,EAASouB,GACtD,MAEML,EAAe,GAFCC,GAAYC,iBAAgB,IAAItwB,aAAciB,OAAOuG,KAAKC,UAAU/B,QACnE2qB,GAAYC,iBAAgB,IAAItwB,aAAciB,OAAOuG,KAAKC,UAAUpF,OAErFyO,QAAkByf,OAAOlkB,OAAOzB,OAAO8K,KAC3C,OACA+a,GACA,IAAIzwB,aAAciB,OAAOmvB,IAG3B,MAAO,GAAGA,KADeC,GAAYC,gBAAgB,IAAI1vB,WAAWkQ,KAErE,GAKC9M,GAAY0sB,GAAQlsB,KAAK,IAAI,IAAI5D,WAAW8vB,IAAM/Y,IAAKgZ,GAAQvsB,OAAOC,aAAassB,IAAMlsB,KAAK,KAC9FmsB,GAAe,MAAMA,EACvB,kBAAOC,GACL,MAAM3sB,EAAM,IAAI4sB,YAAY,GAE5B,OADAzkB,OAAOwQ,gBAAgB3Y,GAChBA,EAAI,EACZ,CAID,qBAAO6sB,GAKL,MAhBmB,uCAYWptB,QAC5B,SACCqtB,KAAQA,EAAIJ,EAAaC,cAAgB,KAAOG,EAAI,GAAGnsB,SAAS,KAEvDlB,QAAQ,KAAM,GAC3B,CAID,2BAAOstB,GACL,OAAOL,EAAaG,iBAAmBH,EAAaG,iBAAmBH,EAAaG,gBACrF,CAID,kCAAaG,CAAsBC,GACjC,IAAK9kB,OAAOzB,OACV,MAAM,IAAInJ,MAAM,+DAElB,IACE,MACMikB,GADU,IAAI1lB,aACCiB,OAAOkwB,GACtBC,QAAe/kB,OAAOzB,OAAOymB,OAAO,UAAW3L,GACrD,OAAO1hB,GAASotB,GAAQztB,QAAQ,MAAO,KAAKA,QAAQ,MAAO,KAAKA,QAAQ,MAAO,GAChF,CAAC,MAAOoX,GAEP,MADAqU,GAAO9X,MAAM,oCAAqCyD,GAC5CA,CACP,CACF,CAID,wBAAOuW,CAAkBC,EAAWC,GAClC,MACM9L,GADU,IAAI1lB,aACCiB,OAAO,CAACswB,EAAWC,GAAe/sB,KAAK,MAC5D,OAAOT,GAAS0hB,EACjB,CAMD,iBAAa1Z,CAAKjE,EAAKnG,GACrB,MAAM6vB,GAAW,IAAIzxB,aAAciB,OAAOW,GACpC8vB,QAAmBrlB,OAAOzB,OAAOymB,OAAOtpB,EAAK0pB,GACnD,OAAO,IAAI7wB,WAAW8wB,EACvB,CAKD,yCAAaC,CAA6BvpB,GACxC,IAAIwpB,EACJ,OAAQxpB,EAAIO,KACV,IAAK,MACHipB,EAAa,CACX3S,EAAK7W,EAAI6W,EACTtW,IAAOP,EAAIO,IACX8jB,EAAKrkB,EAAIqkB,GAEX,MACF,IAAK,KACHmF,EAAa,CACXvnB,IAAOjC,EAAIiC,IACX1B,IAAOP,EAAIO,IACXkpB,EAAKzpB,EAAIypB,EACT/f,EAAK1J,EAAI0J,GAEX,MACF,IAAK,MACH8f,EAAa,CACXvnB,IAAOjC,EAAIiC,IACX1B,IAAOP,EAAIO,IACXkpB,EAAKzpB,EAAIypB,GAEX,MACF,IAAK,MACHD,EAAa,CACXvnB,IAAOjC,EAAIS,EACXF,IAAOP,EAAIO,KAEb,MACF,QACE,MAAM,IAAIlH,MAAM,oBAEpB,MAAMqwB,QAA6BlB,EAAa5kB,KAAK,UAAWxE,KAAKC,UAAUmqB,IAC/E,OAAOhB,EAAaN,gBAAgBwB,EACrC,CACD,8BAAaC,EAAkBxuB,IAC7BA,EAAG8jB,YACHA,EAAW2K,WACXA,EAAUC,QACVA,EAAOC,MACPA,IAEA,IAAIC,EACAC,EACJ,MAAM/vB,EAAU,CACd8T,IAAOoa,OAAOlkB,OAAOoQ,aACrBmK,IAAqB,MAAdoL,EAAqBA,EAAa,MACzCrL,IAAOpjB,EACPiR,IAAOjD,KAAKC,MAAMuB,KAAKwB,MAAQ,MAE7B8S,IACF8K,QAAoBvB,EAAa5kB,KAAK,UAAWqb,GACjD+K,EAAcxB,EAAaN,gBAAgB6B,GAC3C9vB,EAAQgwB,IAAMD,GAEZF,IACF7vB,EAAQ6vB,MAAQA,GAElB,IACE,MAAMI,QAAkBjmB,OAAOzB,OAAOqM,UAAU,MAAOgb,EAAQnL,WACzDphB,EAAS,CACbqC,IAAO,QACPwL,IAAO,WACPnL,IAAO,CACLiC,IAAOioB,EAAUjoB,IACjB1B,IAAO2pB,EAAU3pB,IACjBkpB,EAAKS,EAAUT,EACf/f,EAAKwgB,EAAUxgB,IAGnB,aAAage,GAASK,kBAAkBzqB,EAAQrD,EAAS4vB,EAAQlL,WAClE,CAAC,MAAOhM,GACP,MAAIA,aAAe3Z,UACX,IAAIK,MAAM,oCAAoCsZ,EAAInZ,WAElDmZ,CAET,CACF,CACD,4BAAawX,CAAgBN,GAC3B,IACE,MAAMK,QAAkBjmB,OAAOzB,OAAOqM,UAAU,MAAOgb,EAAQnL,WAC/D,aAAa8J,EAAae,6BAA6BW,EACxD,CAAC,MAAOvX,GACP,MAAIA,aAAe3Z,UACX,IAAIK,MAAM,8CAA8CsZ,EAAInZ,WAE5DmZ,CAET,CACF,CACD,6BAAayX,GACX,aAAajC,OAAOlkB,OAAOzB,OAAOuR,YAChC,CACEna,KAAM,QACNwI,WAAY,UAEd,EACA,CAAC,OAAQ,UAEZ,CAQD,uCAAaioB,CAA2BlB,EAAWC,EAAe7d,EAAU7H,EAAY,SACtF,MAAMyI,EAAMhD,KAAKC,MAAMuB,KAAKwB,MAAQ,KAC9B7O,EAAS,CACbqC,IAAO+D,EACPyH,IAAO,OAEHlR,EAAU,CACd4R,IAAOsd,EACPrd,IAAOqd,EACPpd,IAAOR,EACPwC,IAAOya,EAAaG,iBACpBrc,IAAOH,EAAM,IAEbC,IAAOD,GAOHme,EALU,CACd1jB,MAAS,UACTC,MAAS,UACTC,MAAS,WAEkBpD,GAC7B,IAAK4mB,EACH,MAAM,IAAIjxB,MAAM,0BAA0BqK,oDAE5C,MAAM/L,EAAU,IAAIC,YACdywB,QAAkBpkB,OAAOzB,OAAO0B,UACpC,MACAvM,EAAQkB,OAAOuwB,GACf,CAAExvB,KAAM,OAAQgK,KAAM0mB,IACtB,EACA,CAAC,SAEH,aAAa5C,GAASU,0BAA0B9qB,EAAQrD,EAASouB,EAClE,GAKHG,GAAaN,gBAAmBjtB,GACvBW,GAASX,GAAOM,QAAQ,KAAM,IAAIA,QAAQ,MAAO,KAAKA,QAAQ,MAAO,KAE9E,IAAI0sB,GAAcO,GAGd+B,GAAQ,MACV,WAAAhxB,CAAY2tB,GACVvtB,KAAKutB,MAAQA,EACbvtB,KAAK6wB,WAAa,GAClB7wB,KAAK8wB,QAAU,IAAIzD,GAAO,UAAUrtB,KAAKutB,UAC1C,CACD,UAAAwD,CAAWC,GAET,OADAhxB,KAAK6wB,WAAWzuB,KAAK4uB,GACd,IAAMhxB,KAAKixB,cAAcD,EACjC,CACD,aAAAC,CAAcD,GACZ,MAAME,EAAMlxB,KAAK6wB,WAAWM,YAAYH,GACpCE,GAAO,GACTlxB,KAAK6wB,WAAWO,OAAOF,EAAK,EAE/B,CACD,WAAMG,IAASC,GACbtxB,KAAK8wB,QAAQ/D,MAAM,YAAauE,GAChC,IAAK,MAAMN,KAAMhxB,KAAK6wB,iBACdG,KAAMM,EAEf,GAyBCC,GAAQ,MAAMC,UAAeZ,GAC/B,WAAAhxB,GACEG,SAASqoB,WACTpoB,KAAK8wB,QAAU,IAAIzD,GAAO,UAAUrtB,KAAKutB,WACzCvtB,KAAKyxB,aAAe,KACpBzxB,KAAK0xB,YAAc,EACnB1xB,KAAK2xB,UAAY,KACf,MAAMC,EAAO5xB,KAAK0xB,YAAcF,EAAOK,eACvC7xB,KAAK8wB,QAAQ/D,MAAM,qBAAsB6E,GACrC5xB,KAAK0xB,aAAeF,EAAOK,iBAC7B7xB,KAAK8xB,SACA/xB,MAAMsxB,SAGhB,CAED,mBAAOQ,GACL,OAAOriB,KAAKC,MAAMuB,KAAKwB,MAAQ,IAChC,CACD,IAAA2P,CAAK4P,GACH,MAAMC,EAAUhyB,KAAK8wB,QAAQxH,OAAO,QACpCyI,EAAoBviB,KAAKyiB,IAAIziB,KAAKC,MAAMsiB,GAAoB,GAC5D,MAAMG,EAAaV,EAAOK,eAAiBE,EAC3C,GAAI/xB,KAAKkyB,aAAeA,GAAclyB,KAAKyxB,aAEzC,YADAO,EAAQjF,MAAM,uDAAwD/sB,KAAKkyB,YAG7ElyB,KAAK8xB,SACLE,EAAQjF,MAAM,iBAAkBgF,GAChC/xB,KAAK0xB,YAAcQ,EACnB,MAAMC,EAAyB3iB,KAAK4iB,IAAIL,EAAmB,GAC3D/xB,KAAKyxB,aAAeY,YAAYryB,KAAK2xB,UAAoC,IAAzBQ,EACjD,CACD,cAAID,GACF,OAAOlyB,KAAK0xB,WACb,CACD,MAAAI,GACE9xB,KAAK8wB,QAAQxH,OAAO,UAChBtpB,KAAKyxB,eACPa,cAActyB,KAAKyxB,cACnBzxB,KAAKyxB,aAAe,KAEvB,GAICc,GAAW,MACb,iBAAOC,CAAWhxB,EAAKixB,EAAe,SACpC,IAAKjxB,EAAK,MAAM,IAAInC,UAAU,eAC9B,MACMqJ,EADY,IAAI4O,IAAI9V,EAAK,oBACW,aAAjBixB,EAA8B,OAAS,UAChE,OAAO,IAAIC,gBAAgBhqB,EAAO4R,MAAM,GACzC,GAECqY,GAAsB,IAGtBC,GAAgB,cAAclzB,MAChC,WAAAE,CAAYkgB,EAAM+S,GAChB,IAAIC,EAAIC,EAAIC,EAKZ,GAJAjzB,MAAM+f,EAAKmT,mBAAqBnT,EAAKvK,OAAS,IAC9CvV,KAAK6yB,KAAOA,EAEZ7yB,KAAKC,KAAO,iBACP6f,EAAKvK,MAER,MADA8X,GAAO9X,MAAM,gBAAiB,mBACxB,IAAI7V,MAAM,mBAElBM,KAAKuV,MAAQuK,EAAKvK,MAClBvV,KAAKizB,kBAAqD,OAAhCH,EAAKhT,EAAKmT,mBAA6BH,EAAK,KACtE9yB,KAAKkzB,UAAqC,OAAxBH,EAAKjT,EAAKoT,WAAqBH,EAAK,KACtD/yB,KAAK0e,MAAQoB,EAAKqT,UAClBnzB,KAAKozB,cAA6C,OAA5BJ,EAAKlT,EAAKsT,eAAyBJ,EAAK,KAC9DhzB,KAAKqzB,UAAYvT,EAAKuT,SACvB,GAICC,GAAe,cAAc5zB,MAC/B,WAAAE,CAAYC,GACVE,MAAMF,GAENG,KAAKC,KAAO,cACb,GA2ICszB,GAAqB,MACvB,WAAA3zB,GACEI,KAAK8wB,QAAU,IAAIzD,GAAO,sBAC1BrtB,KAAKwzB,MAAQ,EACd,CACD,KAAAlU,GACEtf,KAAK8wB,QAAQxH,OAAO,SACpBtpB,KAAKwzB,MAAQ,EACd,CACD,OAAAC,CAAQ3tB,GAEN,OADA9F,KAAK8wB,QAAQxH,OAAO,YAAYxjB,OACzB9F,KAAKwzB,MAAM1tB,EACnB,CACD,OAAA4tB,CAAQ5tB,EAAK9B,GACXhE,KAAK8wB,QAAQxH,OAAO,YAAYxjB,OAChC9F,KAAKwzB,MAAM1tB,GAAO9B,CACnB,CACD,UAAA2vB,CAAW7tB,GACT9F,KAAK8wB,QAAQxH,OAAO,eAAexjB,cAC5B9F,KAAKwzB,MAAM1tB,EACnB,CACD,UAAInH,GACF,OAAOkE,OAAO6kB,oBAAoB1nB,KAAKwzB,OAAO70B,MAC/C,CACD,GAAAmH,CAAIqQ,GACF,OAAOtT,OAAO6kB,oBAAoB1nB,KAAKwzB,OAAOrd,EAC/C,GAICyd,GAAiB,cAAcl0B,MACjC,WAAAE,CAAYuwB,EAAOtwB,GACjBE,MAAMF,GAENG,KAAKC,KAAO,iBACZD,KAAKmwB,MAAQA,CACd,GAIC0D,GAAc,MAChB,WAAAj0B,CAAYk0B,EAAyB,GAAIC,EAAc,KAAMC,EAAgB,IAC3Eh0B,KAAK+zB,YAAcA,EACnB/zB,KAAKg0B,cAAgBA,EACrBh0B,KAAK8wB,QAAU,IAAIzD,GAAO,eAC1BrtB,KAAKi0B,cAAgB,GACrBj0B,KAAKi0B,cAAc7xB,QAAQ0xB,EAAwB,oBAC/CC,GACF/zB,KAAKi0B,cAAc7xB,KAAK,kBAE3B,CACD,sBAAM8xB,CAAiB5yB,EAAO6gB,EAAO,IACnC,MAAMgS,iBAAEA,KAAqBC,GAAcjS,EAC3C,IAAKgS,EACH,aAAavb,MAAMtX,EAAO8yB,GAE5B,MAAMC,EAAa,IAAIC,gBACjBC,EAAY5N,WAAW,IAAM0N,EAAWG,QAA4B,IAAnBL,GACvD,IAKE,aAJuBvb,MAAMtX,EAAO,IAC/B6gB,EACHxJ,OAAQ0b,EAAW1b,QAGtB,CAAC,MAAOK,GACP,GAAIA,aAAeyb,cAA6B,eAAbzb,EAAI/Y,KACrC,MAAM,IAAIqzB,GAAa,qBAEzB,MAAMta,CACZ,CAAc,QACR0N,aAAa6N,EACd,CACF,CACD,aAAMG,CAAQlzB,GAAKsU,MACjBA,EAAK6e,YACLA,EAAWR,iBACXA,GACE,IACF,MAAMnC,EAAUhyB,KAAK8wB,QAAQxH,OAAO,WAC9B9lB,EAAU,CACdoxB,OAAU50B,KAAKi0B,cAAcvxB,KAAK,OAOpC,IAAImW,EALA/C,IACFkc,EAAQjF,MAAM,8CACdvpB,EAAuB,cAAI,UAAYsS,GAEzC9V,KAAK60B,oBAAoBrxB,GAEzB,IACEwuB,EAAQjF,MAAM,OAAQvrB,GACtBqX,QAAiB7Y,KAAKk0B,iBAAiB1yB,EAAK,CAAEsX,OAAQ,MAAOtV,UAAS2wB,mBAAkBQ,eACzF,CAAC,MAAO3b,GAEP,MADAgZ,EAAQzc,MAAM,iBACRyD,CACP,CACDgZ,EAAQjF,MAAM,iCAAkClU,EAASI,QACzD,MAAM6b,EAAcjc,EAASrV,QAAQ2E,IAAI,gBAIzC,GAHI2sB,IAAgB90B,KAAKi0B,cAAcc,KAAMC,GAASF,EAAYle,WAAWoe,KAC3EhD,EAAQiD,MAAM,IAAIv1B,MAAM,kCAAiD,MAAfo1B,EAAsBA,EAAc,0BAA0BtzB,MAEtHqX,EAASkO,IAAM/mB,KAAK+zB,cAA+B,MAAfe,OAA2B,EAAIA,EAAYle,WAAW,oBAC5F,aAAa5W,KAAK+zB,kBAAkBlb,EAASqc,QAE/C,IAAIhc,EACJ,IACEA,QAAaL,EAASK,MACvB,CAAC,MAAOF,GAEP,GADAgZ,EAAQzc,MAAM,8BAA+ByD,GACzCH,EAASkO,GAAI,MAAM/N,EACvB,MAAM,IAAItZ,MAAM,GAAGmZ,EAASsc,eAAetc,EAASI,UACrD,CACD,IAAKJ,EAASkO,GAAI,CAEhB,GADAiL,EAAQzc,MAAM,qBAAsB2D,GAChCA,EAAK3D,MACP,MAAM,IAAIqd,GAAc1Z,GAE1B,MAAM,IAAIxZ,MAAM,GAAGmZ,EAASsc,eAAetc,EAASI,YAAYxT,KAAKC,UAAUwT,KAChF,CACD,OAAOA,CACR,CACD,cAAMkc,CAAS5zB,GAAK6zB,KAClBA,EAAIC,UACJA,EAASnB,iBACTA,EAAgBoB,gBAChBA,EAAeC,aACfA,IAEA,MAAMxD,EAAUhyB,KAAK8wB,QAAQxH,OAAO,YAC9B9lB,EAAU,CACdoxB,OAAU50B,KAAKi0B,cAAcvxB,KAAK,MAClC,eAAgB,uCACb8yB,GAML,IAAI3c,OAJmB,IAAnByc,IACF9xB,EAAuB,cAAI,SAAW8xB,GAExCt1B,KAAK60B,oBAAoBrxB,GAEzB,IACEwuB,EAAQjF,MAAM,OAAQvrB,GACtBqX,QAAiB7Y,KAAKk0B,iBAAiB1yB,EAAK,CAAEsX,OAAQ,OAAQtV,UAAS6xB,OAAMlB,mBAAkBQ,YAAaY,GAC7G,CAAC,MAAOvc,GAEP,MADAgZ,EAAQzc,MAAM,iBACRyD,CACP,CACDgZ,EAAQjF,MAAM,iCAAkClU,EAASI,QACzD,MAAM6b,EAAcjc,EAASrV,QAAQ2E,IAAI,gBACzC,GAAI2sB,IAAgB90B,KAAKi0B,cAAcc,KAAMC,GAASF,EAAYle,WAAWoe,IAC3E,MAAM,IAAIt1B,MAAM,kCAAiD,MAAfo1B,EAAsBA,EAAc,0BAA0BtzB,KAElH,MAAMi0B,QAAqB5c,EAASqc,OACpC,IAAIhc,EAAO,CAAA,EACX,GAAIuc,EACF,IACEvc,EAAOzT,KAAKE,MAAM8vB,EACnB,CAAC,MAAOzc,GAEP,GADAgZ,EAAQzc,MAAM,8BAA+ByD,GACzCH,EAASkO,GAAI,MAAM/N,EACvB,MAAM,IAAItZ,MAAM,GAAGmZ,EAASsc,eAAetc,EAASI,UACrD,CAEH,IAAKJ,EAASkO,GAAI,CAEhB,GADAiL,EAAQzc,MAAM,qBAAsB2D,GAChCL,EAASrV,QAAQK,IAAI,cAAe,CACtC,MAAMssB,EAAQtX,EAASrV,QAAQ2E,IAAI,cACnC,MAAM,IAAIyrB,GAAezD,EAAO,GAAG1qB,KAAKC,UAAUwT,KACnD,CACD,GAAIA,EAAK3D,MACP,MAAM,IAAIqd,GAAc1Z,EAAMmc,GAEhC,MAAM,IAAI31B,MAAM,GAAGmZ,EAASsc,eAAetc,EAASI,YAAYxT,KAAKC,UAAUwT,KAChF,CACD,OAAOA,CACR,CACD,mBAAA2b,CAAoBrxB,GAClB,MAAMwuB,EAAUhyB,KAAK8wB,QAAQxH,OAAO,sBAC9BoM,EAAa7yB,OAAOO,KAAKpD,KAAKg0B,eAC9B2B,EAAmB,CACvB,SACA,gBAEIC,EAAkB,CACtB,iBAEwB,IAAtBF,EAAW/2B,QAGf+2B,EAAWG,QAASC,IAClB,GAAIH,EAAiBh0B,SAASm0B,EAAWC,qBAEvC,YADA/D,EAAQpI,KAAK,oCAAqCkM,EAAYH,GAGhE,GAAIC,EAAgBj0B,SAASm0B,EAAWC,sBAAwBlzB,OAAOO,KAAKI,GAAS7B,SAASm0B,GAE5F,YADA9D,EAAQpI,KAAK,iCAAkCkM,EAAYF,GAG7D,MAAMI,EAAoD,mBAAnCh2B,KAAKg0B,cAAc8B,GAA6B91B,KAAKg0B,cAAc8B,KAAgB91B,KAAKg0B,cAAc8B,GACzHE,GAAuB,KAAZA,IACbxyB,EAAQsyB,GAAcE,IAG3B,GAICC,GAAkB,MACpB,WAAAr2B,CAAYs2B,GACVl2B,KAAKk2B,UAAYA,EACjBl2B,KAAK8wB,QAAU,IAAIzD,GAAO,mBAC1BrtB,KAAKm2B,aAAe,KACpBn2B,KAAKo2B,UAAY,KACjBp2B,KAAKq2B,aAAer2B,KAAKk2B,UAAUI,YACnCt2B,KAAKu2B,aAAe,IAAI1C,GACtB,CAAC,4BACD,KACA7zB,KAAKk2B,UAAUV,cAEbx1B,KAAKk2B,UAAUM,cACjBx2B,KAAK8wB,QAAQ/D,MAAM,mCACnB/sB,KAAKm2B,aAAen2B,KAAKk2B,UAAUM,aAEjCx2B,KAAKk2B,UAAUvgB,WACjB3V,KAAK8wB,QAAQ/D,MAAM,gCACnB/sB,KAAKo2B,UAAYp2B,KAAKk2B,UAAUvgB,UAE9B3V,KAAKk2B,UAAUO,0BACjBz2B,KAAK8wB,QAAQ/D,MAAM,+CACnB/sB,KAAK02B,yBAA2B12B,KAAKk2B,UAAUO,wBAElD,CACD,gBAAAE,GACE32B,KAAKm2B,aAAe,IACrB,CACD,iBAAMS,GACJ,MAAM5E,EAAUhyB,KAAK8wB,QAAQxH,OAAO,eACpC,GAAItpB,KAAKo2B,UAEP,OADApE,EAAQjF,MAAM,uBACP/sB,KAAKo2B,UAEd,IAAKp2B,KAAKq2B,aAER,MADArE,EAAQiD,MAAM,IAAIv1B,MAAM,uDAClB,KAERsyB,EAAQjF,MAAM,wBAAyB/sB,KAAKq2B,cAC5C,MAAM1gB,QAAiB3V,KAAKu2B,aAAa7B,QAAQ10B,KAAKq2B,aAAc,CAAE1B,YAAa30B,KAAK02B,yBAA0BvC,iBAAkBn0B,KAAKk2B,UAAUW,0BAGnJ,OAFA7E,EAAQjF,MAAM,0CACd/sB,KAAKo2B,UAAYvzB,OAAOi0B,OAAO,CAAA,EAAInhB,EAAU3V,KAAKk2B,UAAUa,cACrD/2B,KAAKo2B,SACb,CACD,SAAAY,GACE,OAAOh3B,KAAKi3B,qBAAqB,SAClC,CACD,wBAAAC,GACE,OAAOl3B,KAAKi3B,qBAAqB,yBAClC,CACD,mBAAAE,GACE,OAAOn3B,KAAKi3B,qBAAqB,oBAClC,CACD,gBAAAG,CAAiBC,GAAW,GAC1B,OAAOr3B,KAAKi3B,qBAAqB,iBAAkBI,EACpD,CACD,qBAAAC,GACE,OAAOt3B,KAAKi3B,qBAAqB,wBAAwB,EAC1D,CACD,qBAAAM,GACE,OAAOv3B,KAAKi3B,qBAAqB,wBAAwB,EAC1D,CACD,qBAAAO,CAAsBH,GAAW,GAC/B,OAAOr3B,KAAKi3B,qBAAqB,sBAAuBI,EACzD,CACD,eAAAI,CAAgBJ,GAAW,GACzB,OAAOr3B,KAAKi3B,qBAAqB,WAAYI,EAC9C,CACD,0BAAMJ,CAAqBh3B,EAAMo3B,GAAW,GAC1C,MAAMrF,EAAUhyB,KAAK8wB,QAAQxH,OAAO,yBAAyBrpB,OACvD0V,QAAiB3V,KAAK42B,cAE5B,GADA5E,EAAQjF,MAAM,iBACc,IAAxBpX,EAAS1V,GAAkB,CAC7B,IAAiB,IAAbo3B,EAEF,YADArF,EAAQpI,KAAK,+CAGfoI,EAAQiD,MAAM,IAAIv1B,MAAM,sCAAwCO,GACjE,CACD,OAAO0V,EAAS1V,EACjB,CACD,oBAAMy3B,GACJ,MAAM1F,EAAUhyB,KAAK8wB,QAAQxH,OAAO,kBACpC,GAAItpB,KAAKm2B,aAEP,OADAnE,EAAQjF,MAAM,oCACP/sB,KAAKm2B,aAEd,MAAMwB,QAAiB33B,KAAKy3B,iBAAgB,GAC5CzF,EAAQjF,MAAM,eAAgB4K,GAC9B,MAAMC,QAAe53B,KAAKu2B,aAAa7B,QAAQiD,EAAU,CAAExD,iBAAkBn0B,KAAKk2B,UAAUW,0BAE5F,GADA7E,EAAQjF,MAAM,cAAe6K,IACxB10B,MAAMC,QAAQy0B,EAAOx0B,MAExB,MADA4uB,EAAQiD,MAAM,IAAIv1B,MAAM,2BAClB,KAGR,OADAM,KAAKm2B,aAAeyB,EAAOx0B,KACpBpD,KAAKm2B,YACb,GAIC0B,GAAuB,MACzB,WAAAj4B,EAAYkuB,OACVA,EAAS,QAAOgK,MAChBA,EAAQC,cACN,IACF/3B,KAAK8wB,QAAU,IAAIzD,GAAO,wBAC1BrtB,KAAKg4B,OAASF,EACd93B,KAAKi4B,QAAUnK,CAChB,CACD,SAAM9uB,CAAI8G,EAAK9B,GACbhE,KAAK8wB,QAAQxH,OAAO,QAAQxjB,OAC5BA,EAAM9F,KAAKi4B,QAAUnyB,QACf9F,KAAKg4B,OAAOtE,QAAQ5tB,EAAK9B,EAChC,CACD,SAAMmE,CAAIrC,GACR9F,KAAK8wB,QAAQxH,OAAO,QAAQxjB,OAC5BA,EAAM9F,KAAKi4B,QAAUnyB,EAErB,aADmB9F,KAAKg4B,OAAOvE,QAAQ3tB,EAExC,CACD,YAAMoyB,CAAOpyB,GACX9F,KAAK8wB,QAAQxH,OAAO,WAAWxjB,OAC/BA,EAAM9F,KAAKi4B,QAAUnyB,EACrB,MAAMkvB,QAAah1B,KAAKg4B,OAAOvE,QAAQ3tB,GAEvC,aADM9F,KAAKg4B,OAAOrE,WAAW7tB,GACtBkvB,CACR,CACD,gBAAMmD,GACJn4B,KAAK8wB,QAAQxH,OAAO,cACpB,MAAMgC,QAAYtrB,KAAKg4B,OAAOr5B,OACxByE,EAAO,GACb,IAAK,IAAI+S,EAAQ,EAAGA,EAAQmV,EAAKnV,IAAS,CACxC,MAAMrQ,QAAY9F,KAAKg4B,OAAOlyB,IAAIqQ,GAC9BrQ,GAAqC,IAA9BA,EAAIwQ,QAAQtW,KAAKi4B,UAC1B70B,EAAKhB,KAAK0D,EAAIsyB,OAAOp4B,KAAKi4B,QAAQt5B,QAErC,CACD,OAAOyE,CACR,GAQCi1B,GAA0B,MAC5B,WAAAz4B,EAAY04B,UAEVA,EAAShC,YACTA,EAAW3gB,SACXA,EAAQ6gB,YACRA,EAAWO,aACXA,EAAYvH,UAEZA,EAASC,cACTA,EAAa8I,cACbA,EAfsB,OAeaC,MACnCA,EAfe,SAeKC,aACpBA,EAAYC,yBACZA,EAAwBC,sBACxBA,EAjB8B,qBAiBqBC,gCACnDA,EAAkC,QAAOC,OAEzCA,EAAMC,QACNA,EAAOC,QACPA,EAAOC,WACPA,EAAUC,WACVA,EAAUC,SACVA,EAAQC,cACRA,EAAaC,qBAEbA,GAAuB,EAAIC,aAC3BA,GAAe,EAAKxC,wBACpBA,EAAuByC,uBACvBA,EA9BgC,IA8BsBC,oBACtDA,EAAsB,CAAEC,MAAO,WAAWC,YAC1CA,GAAc,EAAKC,WAEnBA,EAAUC,kCACVA,EAAiClD,wBACjCA,EAAuBmD,yBACvBA,EAAwBC,iBAExBA,EAAmB,CAAE,EAAAC,iBACrBA,EAAmB,CAAE,EAAAtE,aACrBA,EAAe,CAAE,EAAAzW,KACjBA,EAAIgb,wBACJA,GAA0B,IAE1B,IAAIjH,EAwCJ,GAvCA9yB,KAAKs4B,UAAYA,EACbhC,EACFt2B,KAAKs2B,YAAcA,GAEnBt2B,KAAKs2B,YAAcgC,EACfA,IACGt4B,KAAKs2B,YAAY0D,SAAS,OAC7Bh6B,KAAKs2B,aAAe,KAEtBt2B,KAAKs2B,aAAe,qCAGxBt2B,KAAK2V,SAAWA,EAChB3V,KAAK+2B,aAAeA,EACpB/2B,KAAKw2B,YAAcA,EACnBx2B,KAAKwvB,UAAYA,EACjBxvB,KAAKyvB,cAAgBA,EACrBzvB,KAAKu4B,cAAgBA,EACrBv4B,KAAKw4B,MAAQA,EACbx4B,KAAKy4B,aAAeA,EACpBz4B,KAAK04B,yBAA2BA,EAChC14B,KAAK24B,sBAAwBA,EAC7B34B,KAAK44B,gCAAkCA,EACvC54B,KAAK64B,OAASA,EACd74B,KAAK84B,QAAUA,EACf94B,KAAK+4B,QAAUA,EACf/4B,KAAKg5B,WAAaA,EAClBh5B,KAAKi5B,WAAaA,EAClBj5B,KAAKk5B,SAAWA,EAChBl5B,KAAKm5B,cAAgBA,EACrBn5B,KAAKo5B,qBAA+C,MAAxBA,GAA+BA,EAC3Dp5B,KAAKq5B,eAAiBA,EACtBr5B,KAAKs5B,uBAAyBA,EAC9Bt5B,KAAKu5B,oBAAsBA,EAC3Bv5B,KAAK+5B,wBAA0BA,EAC/B/5B,KAAKy5B,cAAgBA,EACrBz5B,KAAK25B,kCAAoCA,EACzC35B,KAAKy2B,wBAA0BA,GAAoD,cACnFz2B,KAAK62B,wBAA0BA,EAC3B6C,EACF15B,KAAK05B,WAAaA,MACb,CACL,MAAM5B,EAA0B,oBAAXtJ,OAAyBA,OAAOuJ,aAAe,IAAIxE,GACxEvzB,KAAK05B,WAAa,IAAI7B,GAAqB,CAAEC,SAC9C,CAMD,GALA93B,KAAK45B,yBAA2BA,EAChC55B,KAAK65B,iBAAmBA,EACxB75B,KAAK85B,iBAAmBA,EACxB95B,KAAKw1B,aAAeA,EACpBx1B,KAAK+e,KAAOA,EACR/e,KAAK+e,QAA8B,OAAnB+T,EAAK9yB,KAAK+e,WAAqB,EAAI+T,EAAGgF,OACxD,MAAM,IAAIp4B,MAAM,+CAEnB,GAICu6B,GAAkB,MACpB,WAAAr6B,CAAYs2B,EAAWgE,GACrBl6B,KAAKk2B,UAAYA,EACjBl2B,KAAKk6B,iBAAmBA,EACxBl6B,KAAK8wB,QAAU,IAAIzD,GAAO,mBAC1BrtB,KAAKm6B,kBAAoBj5B,MAAOu0B,IAC9B,MAAMzD,EAAUhyB,KAAK8wB,QAAQxH,OAAO,qBACpC,IACE,MAAMhpB,EAAUytB,GAAS1sB,OAAOo0B,GAEhC,OADAzD,EAAQjF,MAAM,2BACPzsB,CACR,CAAC,MAAO0Y,GAEP,MADAgZ,EAAQzc,MAAM,8BACRyD,CACP,GAEHhZ,KAAKu2B,aAAe,IAAI1C,QACjB,EACL7zB,KAAKm6B,kBACLn6B,KAAKk2B,UAAUV,aAElB,CACD,eAAM4E,CAAUtkB,GACd,MAAMkc,EAAUhyB,KAAK8wB,QAAQxH,OAAO,aAC/BxT,GACH9V,KAAK8wB,QAAQmE,MAAM,IAAIv1B,MAAM,oBAE/B,MAAM8B,QAAYxB,KAAKk6B,iBAAiB/C,sBACxCnF,EAAQjF,MAAM,mBAAoBvrB,GAClC,MAAM64B,QAAer6B,KAAKu2B,aAAa7B,QAAQlzB,EAAK,CAClDsU,QACA6e,YAAa30B,KAAKk2B,UAAUO,wBAC5BtC,iBAAkBn0B,KAAKk2B,UAAUW,0BAGnC,OADA7E,EAAQjF,MAAM,aAAcsN,GACrBA,CACR,GAICC,GAAc,MAChB,WAAA16B,CAAYs2B,EAAWgE,GACrBl6B,KAAKk2B,UAAYA,EACjBl2B,KAAKk6B,iBAAmBA,EACxBl6B,KAAK8wB,QAAU,IAAIzD,GAAO,eAC1BrtB,KAAKu2B,aAAe,IAAI1C,GACtB7zB,KAAKk2B,UAAUyD,kCACf,KACA35B,KAAKk2B,UAAUV,aAElB,CAMD,kBAAM+E,EAAaC,WACjBA,EAAa,qBAAoB/B,aACjCA,EAAez4B,KAAKk2B,UAAUuC,aAAYjJ,UAC1CA,EAAYxvB,KAAKk2B,UAAU1G,UAASC,cACpCA,EAAgBzvB,KAAKk2B,UAAUzG,cAAa+F,aAC5CA,KACG1V,IAEH,MAAMkS,EAAUhyB,KAAK8wB,QAAQxH,OAAO,gBAC/BkG,GACHwC,EAAQiD,MAAM,IAAIv1B,MAAM,4BAErB+4B,GACHzG,EAAQiD,MAAM,IAAIv1B,MAAM,+BAErBogB,EAAKvgB,MACRyyB,EAAQiD,MAAM,IAAIv1B,MAAM,uBAE1B,MAAMgJ,EAAS,IAAIgqB,gBAAgB,CAAE8H,aAAY/B,iBACjD,IAAK,MAAO3yB,EAAK9B,KAAUnB,OAAO6H,QAAQoV,GAC3B,MAAT9b,GACF0E,EAAO1J,IAAI8G,EAAK9B,GAGpB,IAA8C,wBAAzChE,KAAKk2B,UAAUyC,uBAA4F,sBAAzC34B,KAAKk2B,UAAUyC,wBAAmD,MAAAlJ,EAEvI,MADAuC,EAAQiD,MAAM,IAAIv1B,MAAM,gCAClB,KAER,IAAI41B,EACJ,MAAM9zB,QAAYxB,KAAKk6B,iBAAiB9C,kBAAiB,GACzD,OAAQp3B,KAAKk2B,UAAUyC,uBACrB,IAAK,sBACHrD,EAAYhH,GAAYiB,kBAAkBC,EAAWC,GACrD,MACF,IAAK,qBACH/mB,EAAOwY,OAAO,YAAasO,GACvBC,GACF/mB,EAAOwY,OAAO,gBAAiBuO,GAEjC,MACF,IAAK,oBAAqB,CACxB,MAAMgL,QAAwBnM,GAAYoC,2BAA2BlB,EAAWC,EAAejuB,EAAKxB,KAAKk2B,UAAU0C,iCACnHlwB,EAAOwY,OAAO,YAAasO,GAC3B9mB,EAAOwY,OAAO,wBAAyB,0DACvCxY,EAAOwY,OAAO,mBAAoBuZ,GAClC,KACD,EAEHzI,EAAQjF,MAAM,sBACd,MAAMlU,QAAiB7Y,KAAKu2B,aAAanB,SAAS5zB,EAAK,CACrD6zB,KAAM3sB,EACN4sB,YACAnB,iBAAkBn0B,KAAKk2B,UAAUW,wBACjCtB,gBAAiBv1B,KAAKk2B,UAAUO,wBAChCjB,iBAGF,OADAxD,EAAQjF,MAAM,gBACPlU,CACR,CAMD,yBAAM6hB,EAAoBF,WACxBA,EAAa,WAAUhL,UACvBA,EAAYxvB,KAAKk2B,UAAU1G,UAASC,cACpCA,EAAgBzvB,KAAKk2B,UAAUzG,cAAa+I,MAC5CA,EAAQx4B,KAAKk2B,UAAUsC,SACpB1Y,IAEH,MAAMkS,EAAUhyB,KAAK8wB,QAAQxH,OAAO,uBAC/BkG,GACHwC,EAAQiD,MAAM,IAAIv1B,MAAM,4BAE1B,MAAMgJ,EAAS,IAAIgqB,gBAAgB,CAAE8H,eAChCx6B,KAAKk2B,UAAU6D,yBAClBrxB,EAAO1J,IAAI,QAASw5B,GAEtB,IAAK,MAAO1yB,EAAK9B,KAAUnB,OAAO6H,QAAQoV,GAC3B,MAAT9b,GACF0E,EAAO1J,IAAI8G,EAAK9B,GAGpB,IAA8C,wBAAzChE,KAAKk2B,UAAUyC,uBAA4F,sBAAzC34B,KAAKk2B,UAAUyC,wBAAmD,MAAAlJ,EAEvI,MADAuC,EAAQiD,MAAM,IAAIv1B,MAAM,gCAClB,KAER,IAAI41B,EACJ,MAAM9zB,QAAYxB,KAAKk6B,iBAAiB9C,kBAAiB,GACzD,OAAQp3B,KAAKk2B,UAAUyC,uBACrB,IAAK,sBACHrD,EAAYhH,GAAYiB,kBAAkBC,EAAWC,GACrD,MACF,IAAK,qBACH/mB,EAAOwY,OAAO,YAAasO,GACvBC,GACF/mB,EAAOwY,OAAO,gBAAiBuO,GAEjC,MACF,IAAK,oBAAqB,CACxB,MAAMgL,QAAwBnM,GAAYoC,2BAA2BlB,EAAWC,EAAejuB,EAAKxB,KAAKk2B,UAAU0C,iCACnHlwB,EAAOwY,OAAO,YAAasO,GAC3B9mB,EAAOwY,OAAO,wBAAyB,0DACvCxY,EAAOwY,OAAO,mBAAoBuZ,GAClC,KACD,EAEHzI,EAAQjF,MAAM,sBACd,MAAMlU,QAAiB7Y,KAAKu2B,aAAanB,SAAS5zB,EAAK,CAAE6zB,KAAM3sB,EAAQ4sB,YAAWnB,iBAAkBn0B,KAAKk2B,UAAUW,wBAAyBtB,gBAAiBv1B,KAAKk2B,UAAUO,0BAE5K,OADAzE,EAAQjF,MAAM,gBACPlU,CACR,CAMD,0BAAM8hB,EAAqBH,WACzBA,EAAa,gBAAehL,UAC5BA,EAAYxvB,KAAKk2B,UAAU1G,UAASC,cACpCA,EAAgBzvB,KAAKk2B,UAAUzG,cAAa0E,iBAC5CA,EAAgBqB,aAChBA,KACG1V,IAEH,MAAMkS,EAAUhyB,KAAK8wB,QAAQxH,OAAO,wBAC/BkG,GACHwC,EAAQiD,MAAM,IAAIv1B,MAAM,4BAErBogB,EAAK8a,eACR5I,EAAQiD,MAAM,IAAIv1B,MAAM,gCAE1B,MAAMgJ,EAAS,IAAIgqB,gBAAgB,CAAE8H,eACrC,IAAK,MAAO10B,EAAK9B,KAAUnB,OAAO6H,QAAQoV,GACpC5c,MAAMC,QAAQa,GAChBA,EAAM6xB,QAASpZ,GAAU/T,EAAOwY,OAAOpb,EAAK2W,IAC1B,MAATzY,GACT0E,EAAO1J,IAAI8G,EAAK9B,GAGpB,IAA8C,wBAAzChE,KAAKk2B,UAAUyC,uBAA4F,sBAAzC34B,KAAKk2B,UAAUyC,wBAAmD,MAAAlJ,EAEvI,MADAuC,EAAQiD,MAAM,IAAIv1B,MAAM,gCAClB,KAER,IAAI41B,EACJ,MAAM9zB,QAAYxB,KAAKk6B,iBAAiB9C,kBAAiB,GACzD,OAAQp3B,KAAKk2B,UAAUyC,uBACrB,IAAK,sBACHrD,EAAYhH,GAAYiB,kBAAkBC,EAAWC,GACrD,MACF,IAAK,qBACH/mB,EAAOwY,OAAO,YAAasO,GACvBC,GACF/mB,EAAOwY,OAAO,gBAAiBuO,GAEjC,MACF,IAAK,oBAAqB,CACxB,MAAMgL,QAAwBnM,GAAYoC,2BAA2BlB,EAAWC,EAAejuB,EAAKxB,KAAKk2B,UAAU0C,iCACnHlwB,EAAOwY,OAAO,YAAasO,GAC3B9mB,EAAOwY,OAAO,wBAAyB,0DACvCxY,EAAOwY,OAAO,mBAAoBuZ,GAClC,KACD,EAEHzI,EAAQjF,MAAM,sBACd,MAAMlU,QAAiB7Y,KAAKu2B,aAAanB,SAAS5zB,EAAK,CAAE6zB,KAAM3sB,EAAQ4sB,YAAWnB,mBAAkBoB,gBAAiBv1B,KAAKk2B,UAAUO,wBAAyBjB,iBAE7J,OADAxD,EAAQjF,MAAM,gBACPlU,CACR,CAMD,YAAMgiB,CAAO/a,GACX,IAAIgT,EACJ,MAAMd,EAAUhyB,KAAK8wB,QAAQxH,OAAO,UAC/BxJ,EAAKhK,OACRkc,EAAQiD,MAAM,IAAIv1B,MAAM,wBAE1B,MAAM8B,QAAYxB,KAAKk6B,iBAAiB1C,uBAAsB,GAC9DxF,EAAQjF,MAAM,qCAAoE,OAA9B+F,EAAKhT,EAAKgb,iBAA2BhI,EAAK,wBAC9F,MAAMpqB,EAAS,IAAIgqB,gBACnB,IAAK,MAAO5sB,EAAK9B,KAAUnB,OAAO6H,QAAQoV,GAC3B,MAAT9b,GACF0E,EAAO1J,IAAI8G,EAAK9B,GAGpB0E,EAAO1J,IAAI,YAAagB,KAAKk2B,UAAU1G,WACnCxvB,KAAKk2B,UAAUzG,eACjB/mB,EAAO1J,IAAI,gBAAiBgB,KAAKk2B,UAAUzG,qBAEvCzvB,KAAKu2B,aAAanB,SAAS5zB,EAAK,CAAE6zB,KAAM3sB,EAAQyrB,iBAAkBn0B,KAAKk2B,UAAUW,0BACvF7E,EAAQjF,MAAM,eACf,GAICgO,GAAoB,MACtB,WAAAn7B,CAAYs2B,EAAWgE,EAAkBc,GACvCh7B,KAAKk2B,UAAYA,EACjBl2B,KAAKk6B,iBAAmBA,EACxBl6B,KAAKg7B,eAAiBA,EACtBh7B,KAAK8wB,QAAU,IAAIzD,GAAO,qBAC1BrtB,KAAKi7B,iBAAmB,IAAIhB,GAAgBj6B,KAAKk2B,UAAWl2B,KAAKk6B,kBACjEl6B,KAAKk7B,aAAe,IAAIZ,GAAYt6B,KAAKk2B,UAAWl2B,KAAKk6B,iBAC1D,CACD,4BAAMiB,CAAuBtiB,EAAU6F,EAAO8W,GAC5C,MAAMxD,EAAUhyB,KAAK8wB,QAAQxH,OAAO,0BACpCtpB,KAAKo7B,oBAAoBviB,EAAU6F,GACnCsT,EAAQjF,MAAM,yBACR/sB,KAAKq7B,aAAaxiB,EAAU6F,EAAO8W,GACzCxD,EAAQjF,MAAM,kBACVlU,EAASyiB,UACXt7B,KAAKu7B,2BAA2B1iB,EAAU,GAAI6F,EAAMyR,OAEtD6B,EAAQjF,MAAM,0BACR/sB,KAAKw7B,eAAe3iB,EAAmB,MAAT6F,OAAqB,EAAIA,EAAM+c,aAAc5iB,EAASyiB,UAC1FtJ,EAAQjF,MAAM,mBACf,CACD,iCAAM2O,CAA4B7iB,EAAU4iB,GAC1C,MAAMzJ,EAAUhyB,KAAK8wB,QAAQxH,OAAO,+BAC9BqS,EAAyB9iB,EAASyiB,YAAcziB,EAAS+iB,SAC3DD,GACF37B,KAAKu7B,2BAA2B1iB,GAElCmZ,EAAQjF,MAAM,0BACR/sB,KAAKw7B,eAAe3iB,EAAU4iB,EAAcE,GAClD3J,EAAQjF,MAAM,mBACf,CACD,6BAAM8O,CAAwBhjB,EAAU6F,GAEtC,MAAMsT,EAAUhyB,KAAK8wB,QAAQxH,OAAO,2BACpCzQ,EAASsa,UAAYzU,EAAMiF,KACM,MAA3B9K,EAASua,gBAA8Bva,EAASua,cAAgB1U,EAAM0U,eACnD,MAAnBva,EAAS2f,QAAsB3f,EAAS2f,MAAQ9Z,EAAM8Z,OACxD3f,EAASyiB,UAAcziB,EAAS+iB,WAClC57B,KAAKu7B,2BAA2B1iB,EAAU6F,EAAMkd,UAChD5J,EAAQjF,MAAM,uBAEXlU,EAAS+iB,WACZ/iB,EAAS+iB,SAAWld,EAAMkd,SAC1B/iB,EAASijB,QAAUpd,EAAMod,SAE3B,MAAMC,EAAaljB,EAASyiB,YAAcziB,EAAS+iB,eAC7C57B,KAAKw7B,eAAe3iB,GAAU,EAAOkjB,GAC3C/J,EAAQjF,MAAM,mBACf,CACD,uBAAAiP,CAAwBnjB,EAAU6F,GAChC,MAAMsT,EAAUhyB,KAAK8wB,QAAQxH,OAAO,2BAMpC,GALI5K,EAAMud,KAAOpjB,EAAS6F,OACxBsT,EAAQiD,MAAM,IAAIv1B,MAAM,yBAE1BsyB,EAAQjF,MAAM,mBACdlU,EAASsa,UAAYzU,EAAMiF,KACvB9K,EAAStD,MAEX,MADAyc,EAAQpI,KAAK,qBAAsB/Q,EAAStD,OACtC,IAAIqd,GAAc/Z,EAE3B,CACD,mBAAAuiB,CAAoBviB,EAAU6F,GAE5B,MAAMsT,EAAUhyB,KAAK8wB,QAAQxH,OAAO,uBAoBpC,GAnBI5K,EAAMud,KAAOpjB,EAAS6F,OACxBsT,EAAQiD,MAAM,IAAIv1B,MAAM,yBAErBgf,EAAM8Q,WACTwC,EAAQiD,MAAM,IAAIv1B,MAAM,0BAErBgf,EAAM4Z,WACTtG,EAAQiD,MAAM,IAAIv1B,MAAM,0BAEtBM,KAAKk2B,UAAUoC,YAAc5Z,EAAM4Z,WACrCtG,EAAQiD,MAAM,IAAIv1B,MAAM,oDAEtBM,KAAKk2B,UAAU1G,WAAaxvB,KAAKk2B,UAAU1G,YAAc9Q,EAAM8Q,WACjEwC,EAAQiD,MAAM,IAAIv1B,MAAM,oDAE1BsyB,EAAQjF,MAAM,mBACdlU,EAASsa,UAAYzU,EAAMiF,KAC3B9K,EAASwa,UAAY3U,EAAM2U,UACF,MAAnBxa,EAAS2f,QAAsB3f,EAAS2f,MAAQ9Z,EAAM8Z,OACxD3f,EAAStD,MAEX,MADAyc,EAAQpI,KAAK,qBAAsB/Q,EAAStD,OACtC,IAAIqd,GAAc/Z,GAEtB6F,EAAM0Q,gBAAkBvW,EAAStZ,MACnCyyB,EAAQiD,MAAM,IAAIv1B,MAAM,6BAE3B,CACD,oBAAM87B,CAAe3iB,EAAU4iB,GAAe,EAAOS,GAAc,GACjE,MAAMlK,EAAUhyB,KAAK8wB,QAAQxH,OAAO,kBAEpC,GADAzQ,EAASijB,QAAU97B,KAAKg7B,eAAe5B,qBAAqBvgB,EAASijB,SACjEL,IAAiBz7B,KAAKk2B,UAAUmD,eAAiBxgB,EAASsjB,aAE5D,YADAnK,EAAQjF,MAAM,yBAGhBiF,EAAQjF,MAAM,qBACd,MAAMsN,QAAer6B,KAAKi7B,iBAAiBb,UAAUvhB,EAASsjB,cAC9DnK,EAAQjF,MAAM,qDACVmP,GAAe7B,EAAOloB,MAAQ0G,EAASijB,QAAQ3pB,KACjD6f,EAAQiD,MAAM,IAAIv1B,MAAM,sEAE1BmZ,EAASijB,QAAU97B,KAAKg7B,eAAeoB,YAAYvjB,EAASijB,QAAS97B,KAAKg7B,eAAe5B,qBAAqBiB,IAC9GrI,EAAQjF,MAAM,8CAA+ClU,EAASijB,QACvE,CACD,kBAAMT,CAAaxiB,EAAU6F,EAAO8W,GAClC,MAAMxD,EAAUhyB,KAAK8wB,QAAQxH,OAAO,gBACpC,GAAIzQ,EAAStZ,KAAM,CACjByyB,EAAQjF,MAAM,mBACd,MAAMsP,QAAsBr8B,KAAKk7B,aAAaX,aAAa,CACzD/K,UAAW9Q,EAAM8Q,UACjBC,cAAe/Q,EAAM+Q,cACrBlwB,KAAMsZ,EAAStZ,KACfk5B,aAAc/Z,EAAM+Z,aACpBrJ,cAAe1Q,EAAM0Q,cACrBoG,kBACG9W,EAAMob,mBAEXj3B,OAAOi0B,OAAOje,EAAUwjB,EAC9B,MACMrK,EAAQjF,MAAM,qBAEjB,CACD,0BAAAwO,CAA2B1iB,EAAUyjB,EAAenM,GAClD,IAAI2C,EACJ,MAAMd,EAAUhyB,KAAK8wB,QAAQxH,OAAO,8BACpC0I,EAAQjF,MAAM,yBACd,MAAMwP,EAAWxO,GAAS1sB,OAAmC,OAA3ByxB,EAAKja,EAAS+iB,UAAoB9I,EAAK,IAOzE,GANKyJ,EAASpqB,KACZ6f,EAAQiD,MAAM,IAAIv1B,MAAM,wCAEtBywB,GAASoM,EAASpM,QAAUA,GAC9B6B,EAAQiD,MAAM,IAAIv1B,MAAM,6DAEtB48B,EAAe,CACjB,MAAMlT,EAAW2E,GAAS1sB,OAAOi7B,GAC7BC,EAASpqB,MAAQiX,EAASjX,KAC5B6f,EAAQiD,MAAM,IAAIv1B,MAAM,+CAEtB68B,EAASC,WAAaD,EAASC,YAAcpT,EAASoT,WACxDxK,EAAQiD,MAAM,IAAIv1B,MAAM,4DAEtB68B,EAASnf,KAAOmf,EAASnf,MAAQgM,EAAShM,KAC5C4U,EAAQiD,MAAM,IAAIv1B,MAAM,iDAErB68B,EAASnf,KAAOgM,EAAShM,KAC5B4U,EAAQiD,MAAM,IAAIv1B,MAAM,yDAE3B,CACDmZ,EAASijB,QAAUS,CACpB,GAICE,GAAQ,MAAMC,EAChB,WAAA98B,CAAYkgB,GACV9f,KAAKi8B,GAAKnc,EAAKmc,IAAM3N,GAAYU,iBACjChvB,KAAK2jB,KAAO7D,EAAK6D,KACb7D,EAAK6c,SAAW7c,EAAK6c,QAAU,EACjC38B,KAAK28B,QAAU7c,EAAK6c,QAEpB38B,KAAK28B,QAAUpL,GAAMM,eAEvB7xB,KAAK48B,aAAe9c,EAAK8c,aACzB58B,KAAKqzB,UAAYvT,EAAKuT,SACvB,CACD,eAAAwJ,GAEE,OADA,IAAIxP,GAAO,SAAS/D,OAAO,mBACpB7jB,KAAKC,UAAU,CACpBu2B,GAAIj8B,KAAKi8B,GACTtY,KAAM3jB,KAAK2jB,KACXgZ,QAAS38B,KAAK28B,QACdC,aAAc58B,KAAK48B,aACnBvJ,UAAWrzB,KAAKqzB,WAEnB,CACD,wBAAOyJ,CAAkBC,GAEvB,OADA1P,GAAOM,aAAa,QAAS,qBACtBxR,QAAQxT,QAAQ,IAAI+zB,EAAOj3B,KAAKE,MAAMo3B,IAC9C,CACD,4BAAaC,CAAgBjd,EAASnN,GACpC,MAAMof,EAAU3E,GAAOM,aAAa,QAAS,mBACvCsP,EAAS1L,GAAMM,eAAiBjf,EAChCxP,QAAa2c,EAAQoY,aAC3BnG,EAAQjF,MAAM,WAAY3pB,GAC1B,IAAK,IAAItE,EAAI,EAAGA,EAAIsE,EAAKzE,OAAQG,IAAK,CACpC,MAAMgH,EAAM1C,EAAKtE,GACXk2B,QAAajV,EAAQ5X,IAAIrC,GAC/B,IAAIoyB,GAAS,EACb,GAAIlD,EACF,IACE,MAAMtW,QAAcge,EAAOI,kBAAkB9H,GAC7ChD,EAAQjF,MAAM,qBAAsBjnB,EAAK4Y,EAAMie,SAC3Cje,EAAMie,SAAWM,IACnB/E,GAAS,EAEZ,CAAC,MAAOlf,GACPgZ,EAAQzc,MAAM,+BAAgCzP,EAAKkT,GACnDkf,GAAS,CACV,MAEDlG,EAAQjF,MAAM,8BAA+BjnB,GAC7CoyB,GAAS,EAEPA,IACFlG,EAAQjF,MAAM,wBAAyBjnB,GAClCia,EAAQmY,OAAOpyB,GAEvB,CACF,GAICo3B,GAAc,MAAMC,UAAqBV,GAC3C,WAAA78B,CAAYkgB,GACV/f,MAAM+f,GACN9f,KAAKovB,cAAgBtP,EAAKsP,cAC1BpvB,KAAKo9B,eAAiBtd,EAAKsd,eAC3Bp9B,KAAKs4B,UAAYxY,EAAKwY,UACtBt4B,KAAKwvB,UAAY1P,EAAK0P,UACtBxvB,KAAKy4B,aAAe3Y,EAAK2Y,aACzBz4B,KAAKw4B,MAAQ1Y,EAAK0Y,MAClBx4B,KAAKyvB,cAAgB3P,EAAK2P,cAC1BzvB,KAAK85B,iBAAmBha,EAAKga,iBAC7B95B,KAAKm5B,cAAgBrZ,EAAKqZ,cAC1Bn5B,KAAKy7B,aAAe3b,EAAK2b,aACzBz7B,KAAKmwB,MAAQrQ,EAAKqQ,KACnB,CACD,mBAAa7G,CAAOxJ,GAClB,MAAMsP,GAAuC,IAAvBtP,EAAKsP,cAAyBd,GAAYY,uBAAyBpP,EAAKsP,oBAAsB,EAC9GgO,EAAiBhO,QAAsBd,GAAYa,sBAAsBC,QAAsB,EACrG,OAAO,IAAI+N,EAAa,IACnBrd,EACHsP,gBACAgO,kBAEH,CACD,eAAAP,GAEE,OADA,IAAIxP,GAAO,eAAe/D,OAAO,mBAC1B7jB,KAAKC,UAAU,CACpBu2B,GAAIj8B,KAAKi8B,GACTtY,KAAM3jB,KAAK2jB,KACXgZ,QAAS38B,KAAK28B,QACdC,aAAc58B,KAAK48B,aACnBvJ,UAAWrzB,KAAKqzB,UAChBjE,cAAepvB,KAAKovB,cACpBkJ,UAAWt4B,KAAKs4B,UAChB9I,UAAWxvB,KAAKwvB,UAChBiJ,aAAcz4B,KAAKy4B,aACnBD,MAAOx4B,KAAKw4B,MACZ/I,cAAezvB,KAAKyvB,cACpBqK,iBAAkB95B,KAAK85B,iBACvBX,cAAen5B,KAAKm5B,cACpBsC,aAAcz7B,KAAKy7B,aACnBtL,MAAOnwB,KAAKmwB,OAEf,CACD,wBAAO2M,CAAkBC,GACvB1P,GAAOM,aAAa,cAAe,qBACnC,MAAMhK,EAAOle,KAAKE,MAAMo3B,GACxB,OAAOI,EAAa7T,OAAO3F,EAC5B,GAIC0Z,GAAiB,MAAMA,EACzB,WAAAz9B,CAAYkgB,GACV9f,KAAKwB,IAAMse,EAAKte,IAChBxB,KAAK0e,MAAQoB,EAAKpB,KACnB,CACD,mBAAa4K,EAAO9nB,IAElBA,EAAG82B,UACHA,EAAS9I,UACTA,EAASiJ,aACTA,EAAYF,cACZA,EAAaC,MACbA,EAAK8E,WAELA,EAAUnE,cACVA,EAAayD,aACbA,EAAYnN,cACZA,EAAaU,MACbA,EAAKkD,UACLA,EAAS6F,SACTA,EAAQuC,aACRA,EAAY5B,iBACZA,EAAgBC,iBAChBA,EAAgBL,YAChBA,EAAW8D,QACXA,EAAOxD,wBACPA,KACGyD,IAEH,IAAKh8B,EAEH,MADAxB,KAAK8wB,QAAQvb,MAAM,yBACb,IAAI7V,MAAM,OAElB,IAAK8vB,EAEH,MADAxvB,KAAK8wB,QAAQvb,MAAM,+BACb,IAAI7V,MAAM,aAElB,IAAK+4B,EAEH,MADAz4B,KAAK8wB,QAAQvb,MAAM,kCACb,IAAI7V,MAAM,gBAElB,IAAK64B,EAEH,MADAv4B,KAAK8wB,QAAQvb,MAAM,mCACb,IAAI7V,MAAM,iBAElB,IAAK84B,EAEH,MADAx4B,KAAK8wB,QAAQvb,MAAM,2BACb,IAAI7V,MAAM,SAElB,IAAK44B,EAEH,MADAt4B,KAAK8wB,QAAQvb,MAAM,+BACb,IAAI7V,MAAM,aAElB,MAAMgf,QAAcwe,GAAY5T,OAAO,CACrC3F,KAAM2Z,EACNV,eACAvJ,YACAjE,eAAgBqK,EAChBjK,YACA8I,YACAG,eACAU,gBACA1J,gBACA+I,QACAsB,mBACA2B,eACAtL,UAEIsN,EAAY,IAAInmB,IAAI9V,GAC1Bi8B,EAAU9f,aAAauD,OAAO,YAAasO,GAC3CiO,EAAU9f,aAAauD,OAAO,eAAgBuX,GAC9CgF,EAAU9f,aAAauD,OAAO,gBAAiBqX,GAC1CwB,GACH0D,EAAU9f,aAAauD,OAAO,QAASsX,GAErCrI,GACFsN,EAAU9f,aAAauD,OAAO,QAASiP,GAErCoN,GACFE,EAAU9f,aAAauD,OAAO,WAAYqc,GAE5C,IAAIG,EAAahf,EAAMud,GASvB,GARI5I,IACFqK,EAAa,GAAGA,IAAa/K,KAAsBU,KAErDoK,EAAU9f,aAAauD,OAAO,QAASwc,GACnChf,EAAM0e,iBACRK,EAAU9f,aAAauD,OAAO,iBAAkBxC,EAAM0e,gBACtDK,EAAU9f,aAAauD,OAAO,wBAAyB,SAErDgY,EAAU,EACMh2B,MAAMC,QAAQ+1B,GAAYA,EAAW,CAACA,IAC9CrD,QAAS8H,GAAMF,EAAU9f,aAAauD,OAAO,WAAYyc,GACpE,CACD,IAAK,MAAO73B,EAAK9B,KAAUnB,OAAO6H,QAAQ,CAAEyuB,mBAAkBqE,KAAmB3D,IAClE,MAAT71B,GACFy5B,EAAU9f,aAAauD,OAAOpb,EAAK9B,EAAMlB,YAG7C,OAAO,IAAIu6B,EAAe,CACxB77B,IAAKi8B,EAAUlmB,KACfmH,SAEH,GAEH2e,GAAevM,QAAU,IAAIzD,GAAO,iBACpC,IAAIuQ,GAAgBP,GAIhBQ,GAAiB,MACnB,WAAAj+B,CAAY8I,GASV,GAPA1I,KAAKm8B,aAAe,GAEpBn8B,KAAK89B,WAAa,GAElB99B,KAAK87B,QAAU,GACf97B,KAAK0e,MAAQhW,EAAOP,IAAI,SACxBnI,KAAKozB,cAAgB1qB,EAAOP,IAAI,iBAC5BnI,KAAK0e,MAAO,CACd,MAAMqf,EAAavR,mBAAmBxsB,KAAK0e,OAAOxL,MAAMyf,IACxD3yB,KAAK0e,MAAQqf,EAAW,GACpBA,EAAWp/B,OAAS,IACtBqB,KAAKqzB,UAAY0K,EAAWzjB,MAAM,GAAG5X,KAAKiwB,IAE7C,CACD3yB,KAAKuV,MAAQ7M,EAAOP,IAAI,SACxBnI,KAAKizB,kBAAoBvqB,EAAOP,IAAI,qBACpCnI,KAAKkzB,UAAYxqB,EAAOP,IAAI,aAC5BnI,KAAKT,KAAOmJ,EAAOP,IAAI,OACxB,CACD,cAAI61B,GACF,QAA6B,IAAzBh+B,KAAKi+B,WAGT,OAAOj+B,KAAKi+B,WAAa1M,GAAMM,cAChC,CACD,cAAImM,CAAWh6B,GACQ,iBAAVA,IAAoBA,EAAQ2M,OAAO3M,SAC3B,IAAfA,GAAoBA,GAAS,IAC/BhE,KAAKi+B,WAAazuB,KAAKC,MAAMzL,GAASutB,GAAMM,eAE/C,CACD,YAAIyJ,GACF,IAAIxI,EACJ,OAA6B,OAApBA,EAAK9yB,KAAKw4B,YAAsB,EAAI1F,EAAG5f,MAAM,KAAKvR,SArC/C,cAqCyE3B,KAAK47B,QAC3F,GAICsC,GAAiB,MACnB,WAAAt+B,EAAY4B,IACVA,EAAG87B,WACHA,EAAUa,cACVA,EAAazF,yBACbA,EAAwBmB,iBACxBA,EAAgB+C,aAChBA,EAAYpN,UACZA,EAAS6D,UACTA,IAGA,GADArzB,KAAK8wB,QAAU,IAAIzD,GAAO,mBACrB7rB,EAEH,MADAxB,KAAK8wB,QAAQvb,MAAM,uBACb,IAAI7V,MAAM,OAElB,MAAM+9B,EAAY,IAAInmB,IAAI9V,GAO1B,GANI28B,GACFV,EAAU9f,aAAauD,OAAO,gBAAiBid,GAE7C3O,GACFiO,EAAU9f,aAAauD,OAAO,YAAasO,GAEzCkJ,IACF+E,EAAU9f,aAAauD,OAAO,2BAA4BwX,GACtD4E,GAAcjK,GAAW,CAC3BrzB,KAAK0e,MAAQ,IAAI+d,GAAM,CAAE9Y,KAAM2Z,EAAYV,eAAcvJ,cACzD,IAAIqK,EAAa19B,KAAK0e,MAAMud,GACxB5I,IACFqK,EAAa,GAAGA,IAAa/K,KAAsBU,KAErDoK,EAAU9f,aAAauD,OAAO,QAASwc,EACxC,CAEH,IAAK,MAAO53B,EAAK9B,KAAUnB,OAAO6H,QAAQ,IAAKmvB,IAChC,MAAT71B,GACFy5B,EAAU9f,aAAauD,OAAOpb,EAAK9B,EAAMlB,YAG7C9C,KAAKwB,IAAMi8B,EAAUlmB,IACtB,GAIC6mB,GAAkB,MACpB,WAAAx+B,CAAY8I,GAEV,GADA1I,KAAK0e,MAAQhW,EAAOP,IAAI,SACpBnI,KAAK0e,MAAO,CACd,MAAMqf,EAAavR,mBAAmBxsB,KAAK0e,OAAOxL,MAAMyf,IACxD3yB,KAAK0e,MAAQqf,EAAW,GACpBA,EAAWp/B,OAAS,IACtBqB,KAAKqzB,UAAY0K,EAAWzjB,MAAM,GAAG5X,KAAKiwB,IAE7C,CACD3yB,KAAKuV,MAAQ7M,EAAOP,IAAI,SACxBnI,KAAKizB,kBAAoBvqB,EAAOP,IAAI,qBACpCnI,KAAKkzB,UAAYxqB,EAAOP,IAAI,YAC7B,GAICk2B,GAAwB,CAC1B,MACA,MACA,YACA,QACA,MACA,MACA,MACA,WAGEC,GAAiC,CAAC,MAAO,MAAO,MAAO,MAAO,OAC9DC,GAAgB,MAClB,WAAA3+B,CAAYs2B,GACVl2B,KAAKk2B,UAAYA,EACjBl2B,KAAK8wB,QAAU,IAAIzD,GAAO,gBAC3B,CACD,oBAAA+L,CAAqBiB,GACnB,MAAMjrB,EAAS,IAAKirB,GACpB,GAAIr6B,KAAKk2B,UAAUkD,qBAAsB,CACvC,IAAIoF,EAEFA,EADEt7B,MAAMC,QAAQnD,KAAKk2B,UAAUkD,sBACdp5B,KAAKk2B,UAAUkD,qBAEfiF,GAEnB,IAAK,MAAMj+B,KAASo+B,EACbF,GAA+B38B,SAASvB,WACpCgP,EAAOhP,EAGnB,CACD,OAAOgP,CACR,CACD,WAAAgtB,CAAYqC,EAASC,GACnB,MAAMtvB,EAAS,IAAKqvB,GACpB,IAAK,MAAOr+B,EAAOyjB,KAAWhhB,OAAO6H,QAAQg0B,GAC3C,GAAItvB,EAAOhP,KAAWyjB,EACpB,GAAI3gB,MAAMC,QAAQiM,EAAOhP,KAAW8C,MAAMC,QAAQ0gB,GAChD,GAAgD,WAA5C7jB,KAAKk2B,UAAUqD,oBAAoBC,MACrCpqB,EAAOhP,GAASyjB,MACX,CACL,MAAM8a,EAAez7B,MAAMC,QAAQiM,EAAOhP,IAAUgP,EAAOhP,GAAS,CAACgP,EAAOhP,IAC5E,IAAK,MAAM4D,KAASd,MAAMC,QAAQ0gB,GAAUA,EAAS,CAACA,GAC/C8a,EAAah9B,SAASqC,IACzB26B,EAAav8B,KAAK4B,GAGtBoL,EAAOhP,GAASu+B,CACjB,KACiC,iBAAlBvvB,EAAOhP,IAAyC,iBAAXyjB,EACrDzU,EAAOhP,GAASJ,KAAKo8B,YAAYhtB,EAAOhP,GAAQyjB,GAEhDzU,EAAOhP,GAASyjB,EAItB,OAAOzU,CACR,GAICwvB,GAAY,MACd,WAAAh/B,CAAYwD,EAAM+sB,GAChBnwB,KAAKoD,KAAOA,EACZpD,KAAKmwB,MAAQA,CACd,GAIC0O,GAAa,MACf,WAAAj/B,CAAYk/B,EAAUC,GACpB/+B,KAAK8wB,QAAU,IAAIzD,GAAO,cAC1BrtB,KAAK8+B,SAAWA,aAAoBzG,GAA0ByG,EAAW,IAAIzG,GAAwByG,GACrG9+B,KAAK++B,gBAAqC,MAAnBA,EAA0BA,EAAkB,IAAI9I,GAAgBj2B,KAAK8+B,UAC5F9+B,KAAKg7B,eAAiB,IAAIuD,GAAcv+B,KAAK8+B,UAC7C9+B,KAAKg/B,WAAa,IAAIjE,GAAkB/6B,KAAK8+B,SAAU9+B,KAAK++B,gBAAiB/+B,KAAKg7B,gBAClFh7B,KAAKk7B,aAAe,IAAIZ,GAAYt6B,KAAK8+B,SAAU9+B,KAAK++B,gBACzD,CACD,yBAAME,EAAoBvgB,MACxBA,EAAKwD,QACLA,EAAOgd,YACPA,EAAWtC,aACXA,EAAYuB,cACZA,EAAagB,WACbA,EAAU1D,aACVA,EAAYtL,MACZA,EAAKkD,UACLA,EAASkF,cACTA,EAAgBv4B,KAAK8+B,SAASvG,cAAaC,MAC3CA,EAAQx4B,KAAK8+B,SAAStG,MAAKC,aAC3BA,EAAez4B,KAAK8+B,SAASrG,aAAYI,OACzCA,EAAS74B,KAAK8+B,SAASjG,OAAMC,QAC7BA,EAAU94B,KAAK8+B,SAAShG,QAAOC,QAC/BA,EAAU/4B,KAAK8+B,SAAS/F,QAAOC,WAC/BA,EAAah5B,KAAK8+B,SAAS9F,WAAUC,WACrCA,EAAaj5B,KAAK8+B,SAAS7F,WAAUC,SACrCA,EAAWl5B,KAAK8+B,SAAS5F,SAAQC,cACjCA,EAAgBn5B,KAAK8+B,SAAS3F,cAAaU,iBAC3CA,EAAmB75B,KAAK8+B,SAASjF,iBAAgBC,iBACjDA,EAAmB95B,KAAK8+B,SAAShF,iBAAgByD,QACjDA,EAAOxD,wBACPA,EAA0B/5B,KAAK8+B,SAAS/E,0BAExC,MAAM/H,EAAUhyB,KAAK8wB,QAAQxH,OAAO,uBACpC,GAAsB,SAAlBiP,EACF,MAAM,IAAI74B,MAAM,6DAElB,MAAM8B,QAAYxB,KAAK++B,gBAAgB7H,2BACvClF,EAAQjF,MAAM,kCAAmCvrB,GACjD,MAAM49B,QAAsBxB,GAActU,OAAO,CAC/C9nB,MACA82B,UAAWt4B,KAAK8+B,SAASxG,UACzB9I,UAAWxvB,KAAK8+B,SAAStP,UACzBiJ,eACAF,gBACAC,QACA8E,WAAY5e,EACZ2U,YACAwF,SACAC,UACAC,UACAC,aACAmF,gBACAgB,aACAlG,aACAsE,UACArE,WACAhX,UACAgd,cACArF,mBACAC,mBACA8C,eACAzD,gBACA1J,cAAezvB,KAAK8+B,SAASrP,cAC7BgM,eACAtL,QACAsJ,YAAaz5B,KAAK8+B,SAASrF,YAC3BM,kCAEI/5B,KAAKg9B,kBACX,MAAMqC,EAAcD,EAAc1gB,MAElC,aADM1e,KAAK8+B,SAASpF,WAAW16B,IAAIqgC,EAAYpD,GAAIoD,EAAYxC,mBACxDuC,CACR,CACD,6BAAME,CAAwB99B,EAAK+9B,GAAc,GAC/C,MAAMvN,EAAUhyB,KAAK8wB,QAAQxH,OAAO,2BAC9BzQ,EAAW,IAAIglB,GAAetL,GAASC,WAAWhxB,EAAKxB,KAAK8+B,SAAS3F,gBAC3E,IAAKtgB,EAAS6F,MAEZ,MADAsT,EAAQiD,MAAM,IAAIv1B,MAAM,yBAClB,KAER,MAAM8/B,QAA0Bx/B,KAAK8+B,SAASpF,WAAW6F,EAAc,SAAW,OAAO1mB,EAAS6F,OAClG,IAAK8gB,EAEH,MADAxN,EAAQiD,MAAM,IAAIv1B,MAAM,uCAClB,KAGR,MAAO,CAAEgf,YADWwe,GAAYJ,kBAAkB0C,GAClC3mB,WACjB,CACD,2BAAM4mB,CAAsBj+B,EAAKg0B,EAAc+J,GAAc,GAC3D,MAAMvN,EAAUhyB,KAAK8wB,QAAQxH,OAAO,0BAC9B5K,MAAEA,EAAK7F,SAAEA,SAAmB7Y,KAAKs/B,wBAAwB99B,EAAK+9B,GAEpE,GADAvN,EAAQjF,MAAM,oDACV/sB,KAAK8+B,SAAS/f,MAAQ/e,KAAK8+B,SAAS/f,KAAK+Y,MAAO,CAClD,MAAM4H,QAAkB1/B,KAAK2/B,aAAa3/B,KAAK8+B,SAAS/f,KAAK+Y,OAC7DtC,EAAe,IAAKA,EAAcoK,KAAQF,EAC3C,CACD,UACQ1/B,KAAKg/B,WAAW7D,uBAAuBtiB,EAAU6F,EAAO8W,EAC/D,CAAC,MAAOxc,GACP,KAAIA,aAAe4a,IAAkB5zB,KAAK8+B,SAAS/f,MAKjD,MAAM/F,EALiD,CACvD,MAAM0mB,QAAkB1/B,KAAK2/B,aAAa3/B,KAAK8+B,SAAS/f,KAAK+Y,MAAO9e,EAAImX,OACxEqF,EAAmB,KAAIkK,QACjB1/B,KAAKg/B,WAAW7D,uBAAuBtiB,EAAU6F,EAAO8W,EACtE,CAGK,CACD,OAAO3c,CACR,CACD,kBAAM8mB,CAAaE,EAAW1P,GAC5B,IAAID,EACA4P,EAYJ,aAXYD,EAAU1H,cAAcx2B,SAAS3B,KAAK8+B,SAAStP,YAKzDsQ,QAAkBD,EAAU13B,IAAInI,KAAK8+B,SAAStP,WAC1CsQ,EAAU3P,QAAUA,GAASA,IAC/B2P,EAAU3P,MAAQA,QACZ0P,EAAU7gC,IAAIgB,KAAK8+B,SAAStP,UAAWsQ,MAP/C5P,QAAgB5B,GAAYmC,mBAC5BqP,EAAY,IAAIlB,GAAU1O,EAASC,SAC7B0P,EAAU7gC,IAAIgB,KAAK8+B,SAAStP,UAAWsQ,UAQlCxR,GAAY0B,kBAAkB,CACzCxuB,UAAWxB,KAAK++B,gBAAgB3H,kBAAiB,GACjDnH,WAAY,OACZC,QAAS4P,EAAU18B,KACnB+sB,MAAO2P,EAAU3P,OAEpB,CACD,6CAAM4P,EAAwCC,SAC5CA,EAAQC,SACRA,EAAQxE,aACRA,GAAe,EAAK3B,iBACpBA,EAAmB,CAAE,IAErB,MAAMuC,QAAsBr8B,KAAKk7B,aAAaR,oBAAoB,CAAEsF,WAAUC,cAAanG,IACrFoG,EAAiB,IAAIrC,GAAe,IAAInL,iBAG9C,OAFA7vB,OAAOi0B,OAAOoJ,EAAgB7D,SACxBr8B,KAAKg/B,WAAWtD,4BAA4BwE,EAAgBzE,GAC3DyE,CACR,CACD,qBAAMC,EAAgBzhB,MACpBA,EAAK+Z,aACLA,EAAYS,SACZA,EAAQ/E,iBACRA,EAAgBqB,aAChBA,EAAYsE,iBACZA,IAEA,IAAIhH,EACJ,MAAMd,EAAUhyB,KAAK8wB,QAAQxH,OAAO,mBACpC,IAAIkP,EAYAppB,EAXJ,QAAoD,IAAhDpP,KAAK8+B,SAASlF,yBAChBpB,EAAQ9Z,EAAM8Z,UACT,CACL,MAAM4H,EAAkBpgC,KAAK8+B,SAASlF,yBAAyB1mB,MAAM,KAErEslB,IAD8C,OAArB1F,EAAKpU,EAAM8Z,YAAsB,EAAI1F,EAAG5f,MAAM,OAAS,IACzD+C,OAAQvR,GAAM07B,EAAgBz+B,SAAS+C,IAAIhC,KAAK,IACxE,CACD,GAAI1C,KAAK8+B,SAAS/f,MAAQ/e,KAAK8+B,SAAS/f,KAAK+Y,MAAO,CAClD,MAAM4H,QAAkB1/B,KAAK2/B,aAAa3/B,KAAK8+B,SAAS/f,KAAK+Y,OAC7DtC,EAAe,IAAKA,EAAcoK,KAAQF,EAC3C,CAED,IACEtwB,QAAepP,KAAKk7B,aAAaP,qBAAqB,CACpDC,cAAelc,EAAMkc,cAErBpC,QACAC,eACAS,WACA/E,mBACAqB,kBACGsE,GAEN,CAAC,MAAO9gB,GACP,KAAIA,aAAe4a,IAAkB5zB,KAAK8+B,SAAS/f,MAajD,MAAM/F,EAZNwc,EAAmB,WAAUx1B,KAAK2/B,aAAa3/B,KAAK8+B,SAAS/f,KAAK+Y,MAAO9e,EAAImX,OAC7E/gB,QAAepP,KAAKk7B,aAAaP,qBAAqB,CACpDC,cAAelc,EAAMkc,cAErBpC,QACAC,eACAS,WACA/E,mBACAqB,kBACGsE,GAKR,CACD,MAAMjhB,EAAW,IAAIglB,GAAe,IAAInL,iBASxC,OARA7vB,OAAOi0B,OAAOje,EAAUzJ,GACxB4iB,EAAQjF,MAAM,sBAAuBlU,SAC/B7Y,KAAKg/B,WAAWnD,wBAAwBhjB,EAAU,IACnD6F,EAGH8Z,UAEK3f,CACR,CACD,0BAAMwnB,EAAqB3hB,MACzBA,EAAKyf,cACLA,EAAa3O,UACbA,EAASoN,aACTA,EAAYvJ,UACZA,EAASqF,yBACTA,EAA2B14B,KAAK8+B,SAASpG,yBAAwBmB,iBACjEA,EAAmB75B,KAAK8+B,SAASjF,kBAC/B,IACF,MAAM7H,EAAUhyB,KAAK8wB,QAAQxH,OAAO,wBAC9B9nB,QAAYxB,KAAK++B,gBAAgBxH,wBACvC,IAAK/1B,EAEH,MADAwwB,EAAQiD,MAAM,IAAIv1B,MAAM,4BAClB,KAERsyB,EAAQjF,MAAM,gCAAiCvrB,GAC1CguB,IAAakJ,GAA6ByF,IAC7C3O,EAAYxvB,KAAK8+B,SAAStP,WAE5B,MAAMtN,EAAU,IAAIgc,GAAe,CACjC18B,MACA28B,gBACA3O,YACAkJ,2BACA4E,WAAY5e,EACZmb,mBACA+C,eACAvJ,oBAEIrzB,KAAKg9B,kBACX,MAAMsD,EAAepe,EAAQxD,MAK7B,OAJI4hB,IACFtO,EAAQjF,MAAM,8CACR/sB,KAAK8+B,SAASpF,WAAW16B,IAAIshC,EAAarE,GAAIqE,EAAazD,oBAE5D3a,CACR,CACD,8BAAMqe,CAAyB/+B,EAAK+9B,GAAc,GAChD,MAAMvN,EAAUhyB,KAAK8wB,QAAQxH,OAAO,4BAC9BzQ,EAAW,IAAIulB,GAAgB7L,GAASC,WAAWhxB,EAAKxB,KAAK8+B,SAAS3F,gBAC5E,IAAKtgB,EAAS6F,MAAO,CAEnB,GADAsT,EAAQjF,MAAM,wBACVlU,EAAStD,MAEX,MADAyc,EAAQpI,KAAK,sBAAuB/Q,EAAStD,OACvC,IAAIqd,GAAc/Z,GAE1B,MAAO,CAAE6F,WAAY,EAAG7F,WACzB,CACD,MAAM2mB,QAA0Bx/B,KAAK8+B,SAASpF,WAAW6F,EAAc,SAAW,OAAO1mB,EAAS6F,OAClG,IAAK8gB,EAEH,MADAxN,EAAQiD,MAAM,IAAIv1B,MAAM,uCAClB,KAGR,MAAO,CAAEgf,YADW+d,GAAMK,kBAAkB0C,GAC5B3mB,WACjB,CACD,4BAAM2nB,CAAuBh/B,GAC3B,MAAMwwB,EAAUhyB,KAAK8wB,QAAQxH,OAAO,2BAC9B5K,MAAEA,EAAK7F,SAAEA,SAAmB7Y,KAAKugC,yBAAyB/+B,GAAK,GAOrE,OANIkd,GACFsT,EAAQjF,MAAM,oDACd/sB,KAAKg/B,WAAWhD,wBAAwBnjB,EAAU6F,IAElDsT,EAAQjF,MAAM,uDAETlU,CACR,CACD,eAAAmkB,GAEE,OADAh9B,KAAK8wB,QAAQxH,OAAO,mBACbmT,GAAMO,gBAAgBh9B,KAAK8+B,SAASpF,WAAY15B,KAAK8+B,SAASxF,uBACtE,CACD,iBAAMmH,CAAY3qB,EAAOpO,GAEvB,OADA1H,KAAK8wB,QAAQxH,OAAO,qBACPtpB,KAAKk7B,aAAaL,OAAO,CACpC/kB,QACAglB,gBAAiBpzB,GAEpB,GC/kEH,SAASg5B,GAA6BC,EAAc7gC,GAChD,GAPiC,iBAOhB6gC,EAPEnR,UAQf,MAAM,IAAI9vB,MAAM,sEAAsE+F,KAAKC,UAAUi7B,MAEzG,GAAI7gC,EAAQ0d,aARhB,SAAwB6X,GACpB,OAAQnyB,MAAMC,QAAQkyB,EAAKuL,gBACvBvL,EAAKuL,cAAct9B,MAAOu9B,GAAuB,iBAARA,EACjD,CAMQC,CAAeH,IACfA,EAAaC,cAAc,KAAO9gC,EAAQ0d,YAAY1a,WACtD,MAAM,IAAIpD,MAAM,kEAAkE+F,KAAKC,UAAUi7B,EAAaC,2CAA2Cn7B,KAAKC,UAAU,CACpK5F,EAAQ0d,YAAY1a,gBAG5B,OAAO,CACX,CACA5B,eAAe6/B,GAAejhC,EAASwhB,GACnC,IAAKA,EAAa0f,qBACd,MAAM,IAAIthC,MAAM,gGAEpB,IAAKwD,MAAMC,QAAQme,EAAa2f,kCAC5B,MAAM,IAAIvhC,MAAM,uHAEpB,MAAMwhC,GR6oBmBC,EQ7oBc7f,EAAa2f,iCAAkC/lB,GR8oBpE6Z,KAAMmM,GACbC,EAAUx/B,SAASu/B,KACxB,MAHV,IAA6BC,EQ5oBzB,MAAMC,EAAS,CACXC,YAAavhC,EAAQ6hB,WACrB2f,iBAAkB,MAClBV,cAAe,CAAC9gC,EAAQ0d,aAAa1a,YACrCy+B,aAAc,SACdC,2BAA4B,sBAC5BC,6BAA8BP,EAC9BQ,YAAa,CAAC,qBAAsB,kBAKlCC,QAAyB/oB,MAAM0I,EAAa0f,qBAAqBl+B,WAAY,CAC/EgW,OAAQ,OACRtV,QALY,CACZ,eAAgB,oBAKhB6xB,KAAM5vB,KAAKC,UAAU07B,KAEzB,GAAIO,EAAiB5a,GAAI,CACrB,MAAM4Z,QAAqBgB,EAAiBzoB,OAE5C,OADAwnB,GAA6BC,EAAc7gC,GACpC,CACHid,SAAU4jB,EAAanR,UACvBzN,aAAc4e,EAAalR,cAC3BmS,UAAWjB,EAAakB,yBACxBC,yBAA0BnB,EAAac,6BACvC7f,WAAY,UAEnB,CAID,MAHgC,MAA5B+f,EAAiB1oB,QAxEzB,SAGA0nB,EAAc7gC,GAGV,GAA2B,yBAAvB6gC,EAAaprB,MACb,MAAM,IAAI7V,MAAM,kEAAkEI,EAAQ0d,aAAa1a,4BAA4B69B,EAAa1N,mBAAqB,MAEzK,GAA2B,4BAAvB0N,EAAaprB,MACb,MAAM,IAAI7V,MAAM,oEAAoE+F,KAAKC,UAAU5F,mBAAyB6gC,EAAa1N,mBAAqB,MAIlK,MAAM,IAAIvzB,MAAM,uCAAuCihC,EAAaprB,WAAWorB,EAAa1N,mBAAqB,KACrH,CA0DQ8O,OAA2BJ,EAAiBzoB,OAAQpZ,GAElD,IAAIJ,MAAM,2DAA2DiiC,EAAiB1oB,UAAU0oB,EAAiBxM,sBAAsBwM,EAAiBzM,SAClK,CA0BA,SAAS8M,GAAoBh+B,GACzB,YAAoCsa,IAA5Bta,EAAMivB,mBACyB,iBAA5BjvB,EAAMivB,iBACrB,CA6BA,SAASgP,GAA8B5F,EAAetd,GAClD,QAnCuBT,KADTta,EAoCDq4B,GAnCA9mB,OAA8C,iBAAhBvR,EAAMuR,MAoC7C,MAAM,IAAI6O,GAAkB,kCAAkCiY,EAAc9mB,SAASysB,GAAoB3F,GACnG,KAAKA,EAAcpJ,oBACnB,KAhCd,SAAqBjvB,GACjB,YAA2Bsa,IAApBta,EAAMkvB,WAAsD,iBAApBlvB,EAAMkvB,SACzD,CA8BmBgP,CAAY7F,GAAiB,SAASA,EAAcnJ,aAAe,KAAMmJ,EAAc9mB,MAAOysB,GAAoB3F,GACvHA,EAAcpJ,uBACd3U,GAzCd,IAAkBta,EA2Cd,IAjCJ,SAAwBA,GACpB,YAA+Bsa,IAAvBta,EAAMm4B,cAA4D,iBAAvBn4B,EAAMm4B,YAC7D,CA+BSgG,CAAe9F,GAChB,MAAM,IAAInY,GAAqB,CAAC,iBAEpC,IAjCJ,SAAoBlgB,GAChB,YAA0Bsa,IAAnBta,EAAM43B,UAAoD,iBAAnB53B,EAAM43B,QACxD,CA+BSG,CAAWM,GACZ,MAAM,IAAInY,GAAqB,CAAC,aAEpC,IA9BJ,SAAsBlgB,GAClB,YAA4Bsa,IAArBta,EAAM85B,YAAwD,iBAArB95B,EAAM85B,UAC1D,CA4BSsE,CAAa/F,GACd,MAAM,IAAInY,GAAqB,CAAC,eAEpC,IA9BJ,SAAsBlgB,GAClB,YAA4Bsa,IAArBta,EAAMg6B,YAAwD,iBAArBh6B,EAAMg6B,UAC1D,CA4BSqE,CAAahG,GACd,MAAM,IAAInY,GAAqB,CAAC,eAWpC,IAAKnF,GAAmD,WAA3Csd,EAAcyB,WAAWptB,cAClC,MAAM,IAAIhR,MAAM,iGAAiG28B,EAAcyB,gBAEnI,OAAOzB,CACX,CACAn7B,eAAeohC,GAAU5wB,EAAQ6wB,EAAQ5e,EAAM5E,IA5C/C,SAA+BrN,EAAQiS,GACnC,GAAIA,EAAK6e,aACH9wB,EAAO8M,sBACJ9M,EAAO8M,oBAAoB7c,SAASgiB,EAAK6e,YAC9C,MAAM,IAAI9iC,MAAM,eAAegS,EAAOA,iCAAiCiS,EAAK6e,oBAEhF,IAAK9wB,EAAO+wB,cACR,MAAM,IAAI/iC,MAAM,gBAAgBgS,EAAOA,yCAE/C,CAoCIgxB,CAAsBhxB,EAAQiS,GAC9B,MAAMngB,EAAU,CACZ,eAAgB,qCAEpB,IAAImhB,EACA5F,IACA4F,QR0jCRzjB,eAAmCiJ,GAAc,GAC7C,MAAM6a,WAAEA,EAAUD,UAAEA,SAAoBhL,GAAgBmB,GAAsB,GAAI,CAAE/Q,gBAC9Ew4B,EAAc,CAChB3d,aACAD,gBAAiB/P,GAAU+P,IAI/B,OADC4d,EAAY5d,UAAU/e,KAAOkV,GACvBynB,CACX,CQnkCwBC,EAAoB,GACpCp/B,EAAQo8B,WAAalb,GAAiBhT,EAAO+wB,cAAe,OAAQ9d,IAKpE4d,EAAOxgB,eACPve,EAAQq/B,cAAgB,SAASpgC,KAAK,GAAG8/B,EAAOxlB,YAAYwlB,EAAOxgB,mBAEvE,MAAM+gB,EAAc,CAChBtI,WAAY7W,EAAK6e,UACjB/J,aAAc9U,EAAKnG,YACnBje,KAAMokB,EAAKpkB,KACX6vB,cAAezL,EAAKhF,aACpB6Q,UAAW+S,EAAOxlB,UAEhBgmB,EAAmB,CACrBjqB,OAAQ,OACRtV,UACA6xB,KAAM,IAAI3C,gBAAgBoQ,GAAahgC,YAErCkgC,QAAyBpqB,MAAMlH,EAAO+wB,cAAeM,GAErD1G,EAAgB4F,SADWe,EAAiB9pB,OACqB6F,IACjEzB,MAAEA,EAAKP,SAAEA,SAAmBJ,GAAyB0f,EAAcT,SAAUlqB,EAAOuxB,QAASvxB,EAAOA,OAAQ6wB,EAAOxlB,UACzH,MAAO,CACHuI,YAAa+W,EAAcF,aAC3Bvf,QAASyf,EAAcT,SACvBxV,cAxFiBpiB,EAwFaq4B,OAvFF/d,IAAxBta,EAAM42B,eAA8D,iBAAxB52B,EAAM42B,cAwFhDyB,EAAczB,mBACdtc,GACNhB,QACAP,WACA4H,UACAe,UAAW2W,EAAc2B,YA9FjC,IAAyBh6B,CAgGzB,CAiCA9C,eAAeqlB,GAAQH,EAAc1U,EAAQ6wB,EAAQ5d,GACjD,QAAwBrG,IAApBikB,EAAOxlB,SACP,MAAM,IAAIrd,MAAM,mEAEpB,MAAMojC,EAAc,CAChBtI,WAAY,gBACZI,cAAexU,GAEnB,IAAI8c,EAAa,CAAA,OACD5kB,IAAZqG,IACAue,EAAa,CACTtD,WAAYlb,GAAiBhT,EAAO+wB,cAAe,OAAQ9d,KAGnE,IAAIwe,EAAa,CAAA,OACW7kB,IAAxBikB,EAAOxgB,aACPohB,EAAa,CAGTN,cAAe,SAASpgC,KAAK,GAAG8/B,EAAOxlB,YAAYwlB,EAAOxgB,mBA/BnD,CAACvgB,IAChB,IAII,OADA,IAAI8V,IAAI9V,IACD,CACV,CACD,MACI,OAAO,CACV,GAyBQ4f,CAAWmhB,EAAOxlB,YAIvB+lB,EAAYtT,UAAY+S,EAAOxlB,UAEnC,MAAMqmB,QAAoBxqB,MAAMlH,EAAO+wB,cAAe,CAClD3pB,OAAQ,OACRuc,KAAM,IAAI3C,gBAAgBoQ,GAAahgC,WACvCU,QAAS,IACF0/B,KACAC,EACH,eAAgB,uCAGxB,IAAItqB,EACJ,IACIA,QAAiBuqB,EAAYlqB,MAChC,CACD,MAAO2E,GAEH,MAAM,IAAIne,MAAM,gCAAgCgS,EAAOA,wCAC1D,CACD,MAAM2xB,EAAoBpB,GAA8BppB,OAAsByF,IAAZqG,IAC5DrH,MAAEA,SAAgBX,GAAyB0mB,EAAkBzH,SAAUlqB,EAAOuxB,QAASvxB,EAAOA,OAAQ6wB,EAAOxlB,UACnH,MAAO,CACHuI,YAAa+d,EAAkBlH,aAC/Bvf,QAASymB,EAAkBzH,SAC3BxV,aAAyD,iBAApCid,EAAkBzI,cACjCyI,EAAkBzI,mBAClBtc,EACNhB,QACAqH,UACAe,UAAW2d,EAAkBrF,WAErC,CC9QqB,MAAAsF,WAA6BC,GAGhDC,MAAQtiC,MACNpB,EACAmmB,KAKuB,SAAnBnmB,EAAQ+4B,cACJ74B,KAAKof,mBAAmBE,MAAMxf,EAAQgf,WAS9C,MAAMtB,EACJ1d,EAAQ0d,aDoRd,SAA8BA,GAC1B,MAAMimB,EAAa3lB,GAAmBN,GAKtC,OAFAimB,EAAWx5B,KAAO,GAIlBuT,EAAY7b,SAAS,GAAG8hC,EAAWhf,WACxBgf,EAAWlsB,KAIf,GAAGksB,EAAWhf,SAASgf,EAAWlsB,KAAKmsB,UAE9CD,EAAWhf,OAAO9lB,OAAS,IAC/B,CCpS6BglC,CAAqBnV,OAAOoV,SAASrsB,MAC9D,IAAKgG,GAAmBC,GACtB,MAAM,IAAI9d,MACR,GAAG8d,kJAGDxd,KAAKqiB,aAAa9F,OAAO,IAC1Bzc,EACH0d,cAEAmE,WAAY7hB,EAAQ6hB,YAAc7hB,EAAQid,SAC1CkJ,kBAQJ4d,uBAAyB3iC,MACvB4iC,IAEA,MAAMC,QAAoB/jC,KAAKof,mBAAmBjX,IAAI27B,GACtD,YACkBxlB,IAAhBylB,QAC4BzlB,IAA5BylB,EAAYC,kBACW1lB,IAAvBylB,EAAYryB,QA7DlB,SAAyBqyB,GAEvB,YACkCzlB,IAAhCylB,EAAYE,iBACoB,IAAhCF,EAAYE,iBAIPF,EAAYE,gBAAkBz0B,KAAKC,MAAMuB,KAAKwB,MAAQ,IAC/D,CAqDM0xB,CAAgBH,GAET,KAEFA,GAGTI,uBAAyBjjC,MACvBM,EACAykB,KAEA,IACE,MAAMme,QAAqBpkC,KAAKsiB,gBAAgB/F,OAC9C/a,EACAykB,OACA3H,GAYF,OANAte,KAAK4Y,MAAQwrB,EAAaxrB,MAAMsR,KAAKsE,QACrCxuB,KAAKyiB,YAAc2hB,EAAaC,mBAG1BrkC,KAAKskC,sBAAsB9iC,GAE1B,CACLqe,WAAYukB,EAAavkB,WACzBvC,MAAO8mB,EAAa9mB,MACpBwB,UAAWslB,EAAatlB,UACxBylB,eAAgBH,EAAaG,eAC7BP,YAAaI,EAAaJ,YAE7B,CAAC,MAAOhrB,GAWP,aATMhZ,KAAKskC,sBAAsB9iC,QAOjCykB,EAAaO,KAAKrL,GAAOC,MAAO,WAAYpC,EAG7C,GAGK,2BAAMsrB,CAAsB9iC,GAClC,MAAMuc,EAAeD,GAAmBtc,GAAK+V,KAQ7C,IADAiX,OAAOgW,QAAQC,aAAa,KAAM,GAAI1mB,GAC/ByQ,OAAOoV,SAASrsB,OAASwG,SAOxB,IAAI5B,QAAexT,IACvBge,WAAW,IAAMhe,IAAW,IAGjC,EC/HH,SAAS+7B,GACP5kC,GAEA,MAAqC,iBAAvBA,EAAQ6kC,UACxB,CAEA,SAASC,GACP9kC,GAEA,MAAsC,iBAAxBA,EAAQ0d,WACxB,CAKc,MAAOqnB,GAET3mB,eACA4mB,YACAtiB,oBACAjB,gBAJV,WAAA3hB,CACUse,EACA4mB,EACAtiB,EACAjB,GAHAvhB,KAAcke,eAAdA,EACAle,KAAW8kC,YAAXA,EACA9kC,KAAmBwiB,oBAAnBA,EACAxiB,KAAeuhB,gBAAfA,EAERvhB,KAAKke,eAAiBA,EACtBle,KAAK8kC,YAAcA,EACnB9kC,KAAKwiB,oBAAsBA,EAC3BxiB,KAAKuhB,gBAAkBA,CACxB,CAED,eAAMjF,CAAUxc,GACd,OAAO4kC,GAAU5kC,IAAY8kC,GAAe9kC,EAC7C,CAED,YAAMyc,CAAOzc,GACX,IAAK4kC,GAAU5kC,GACb,MAAM,IAAIikB,GACR,8EAA8Ete,KAAKC,UACjF5F,MAIN,IAAK8kC,GAAe9kC,GAClB,MAAM,IAAIikB,GACR,+EAA+Ete,KAAKC,UAClF5F,MAMN,MAAMwhB,QACEthB,KAAKwiB,oBAAoBW,YAAYrjB,EAAQ6kC,YAE/CI,QAA2B1jB,GAC/BvhB,EACAwhB,EACAthB,KAAKke,eACLle,KAAKuhB,iBAIDyjB,EAA4B,CAMhCtzB,OAAQ4P,EAAa5P,OAErBqN,KAA0C,SAApCjf,EAAQmlC,UAAUv0B,iBACrB5Q,EACHye,oBAAqB+C,EACrBihB,OAAQwC,EACRG,QV6GmBA,EU7GKplC,EAAQqlC,aV8G7BjiC,MAAMC,QAAQ+hC,GAGZhiC,MAAMG,KAEb,IAAIK,IAAI,IACDoY,MACAopB,EAAOjvB,OAETuiB,GAA2B,iBAAVA,IAAuBA,EAAM72B,SAAS,SARjDma,KAFf,IAAyBopB,EUzGrB,OAAOllC,KAAK8kC,YAAYvoB,OAAOyoB,EAChC,EC/EkB,MAAAI,WACXnnB,GAGR,YAAM1B,CAAO8B,GACX,MAAMgnB,EAAchnB,EAAiBb,aAAe,GAC9C8nB,EAAc,CAClBhN,UAAWja,EAAiB3M,OAAO5O,WACnC0sB,UAAWnR,EAAiBkkB,OAAOxlB,SACnC0S,cAAepR,EAAiBkkB,OAAOxgB,aACvC0W,aAAc4M,EACd9M,cAAe,OACfC,MAAOna,EAAiB6mB,OAAOxiC,KAAK,KACpC02B,sBAAsB,EAItBC,cAAc,EACdR,OAAQxa,EAAiBwa,QAAU,WAG/B0M,EAAoB,IAAI1G,GAAWyG,GAEzC,IACE,MAAME,QAAuBD,EAAkBtG,oBAAoB,CAAE,GAErE,aAAaj/B,KAAKye,qBAAqB,CACrCJ,mBAEAK,MAAO8mB,EAAe9mB,MAAMud,GAE5Btd,aAAc6mB,EAAe9mB,MAAM0Q,eAAiB,GACpDxQ,UAAW4mB,EAAehkC,IAAIsB,YAEjC,CAAC,MAAOkW,GACP2Q,QAAQpU,MAAMyD,EACf,CAIF,EC9CI,MAEDysB,GAGF,CACF/zB,OAAQ,CACNg0B,MAAO,SACPC,cAAc,GAEhBC,uBAAwB,CACtBF,MAAO,wBACPC,cAAc,GAEhBE,eAAgB,CACdH,MAAO,gBACPC,cAAc,GAEhBG,kBAAmB,CACjBJ,MAAO,mBACPC,cAAc,GAEhBhO,SAAU,CACR+N,MAAO,UACPC,cAAc,GAEhBI,sBAAuB,CACrBL,MAAO,uBACPC,cAAc,GAEhBK,qBAAsB,CACpBN,MAAO,qBACPC,cAAc,GAEhBM,iBAAkB,CAAEP,MAAO,mBAC3BQ,yBAA0B,CAAER,MAAO,0BACnCS,yBAA0B,CAAET,MAAO,0BACnCU,sBAAuB,CAAEV,MAAO,uBAChCW,qBAAsB,CAAEX,MAAO,sBAC/BY,wBAAyB,CAAEZ,MAAO,yBAClCa,sCAAuC,CACrCb,MAAO,oCAETc,yCAA0C,CACxCd,MAAO,uCAETe,yCAA0C,CACxCf,MAAO,uCAETgB,sCAAuC,CACrChB,MAAO,qCAETiB,yCAA0C,CACxCjB,MAAO,wCAETkB,yCAA0C,CACxClB,MAAO,wCAETmB,4CAA6C,CAC3CnB,MAAO,0CAEToB,+CAAgD,CAC9CpB,MAAO,6CAETqB,+CAAgD,CAC9CrB,MAAO,6CAETsB,sCAAuC,CACrCtB,MAAO,qCAETuB,iDAAkD,CAChDvB,MAAO,8CAETwB,yBAA0B,CAAExB,MAAO,0BACnCyB,sBAAuB,CAAEzB,MAAO,uBAChC0B,iBAAkB,CAAE1B,MAAO,mBAC3B2B,sBAAuB,CAAE3B,MAAO,wBAChC4B,yBAA0B,CAAE5B,MAAO,0BACnC6B,qBAAsB,CAAE7B,MAAO,sBAC/B8B,2BAA4B,CAAE9B,MAAO,4BACrC+B,4BAA6B,CAAE/B,MAAO,6BACtCgC,gCAAiC,CAAEhC,MAAO,gCAC1CiC,iCAAkC,CAAEjC,MAAO,iCAC3CkC,cAAe,CACblC,MAAO,cACPC,cAAc,GAEhBkC,WAAY,CACVnC,MAAO,WACPC,cAAc,IA0BJ,MAAOmC,GACC5pB,eAApB,WAAAte,CAAoBse,GAAAle,KAAcke,eAAdA,EAClBle,KAAKke,eAAiBA,CACvB,CAIM,yBAAO6pB,CAAmBr2B,GAC/B,MAAO,gBAAgBA,GACxB,CAED,iBAAMyR,CAAYzR,GAChB,IAAI4P,EAEJ,MAAM0mB,EAAkB,IAAI1wB,IAjIQ,mCAqIlC5F,EAAOsoB,SAAS,KAAOtoB,EAAS,GAAGA,MACnC6F,KACI0wB,QAAgCrvB,MAAMovB,GAE5C,IACE1mB,EA7CN,SACE8f,GAEA,MAAM8G,EAAkD,CAAA,EAaxD,OAZArlC,OAAOO,KAAKg+B,GAAQvL,QAAS/vB,IACvB2/B,GAAmB3/B,KAKrBoiC,EAAazC,GAAmB3/B,GAAK4/B,OAAStE,EAAOt7B,MAGpD5C,MAAMC,QAAQ+kC,EAAazmB,mBAC9BymB,EAAazmB,gBAAkB,CAAC,WAE3BymB,CACT,CA4BqBC,OAAoBF,EAAwB/uB,OAC5D,CAAC,MAAOF,GACP,MAAM,IAAI+K,GACR,IAAIrS,EAAO5O,6CACRkW,EAA4BnZ,UAGlC,CAQD,aALMG,KAAKke,eAAelf,IACxB8oC,GAAoBC,mBAAmBr2B,GACvCjM,KAAKC,UAAU4b,IAGVA,CACR,EClJIpgB,eAAeoe,GACpBR,EACAiB,SAEMqoB,GAAUtpB,EAAWiB,SLmU7B7e,iBACI,MAAM42B,EAAQ,IAAID,GAAqB,CAAA,SACjC4E,GAAMO,gBAAgBlF,EAAO,KACnC,MAAMuQ,EAAY7Z,OAAOuJ,aACnBuQ,EAAgB,GACtB,IAAK,IAAIxpC,EAAI,EAAGA,GAAKupC,EAAU1pC,OAAQG,GAAK,EAAG,CAC3C,MAAMgH,EAAMuiC,EAAUviC,IAAIhH,GACtBgH,IACCA,EAAIyiC,MAAM,eACPziC,EAAIyiC,MAAM,wCACdD,EAAclmC,KAAK0D,EAE1B,CACDwiC,EAAczS,QAAS/vB,GAAQuiC,EAAU1U,WAAW7tB,GACxD,CKhVQ0iC,EACR,CAKM,MAAOC,WACHvoB,GAGR,SAAM/X,CACJ2W,GAEA,MACEe,EACAvC,EACAP,EACAgF,EACAvE,EACA4I,EACA1U,EACAuzB,EACArD,SACQzlB,QAAQC,IAAI,CACpBpc,KAAKke,eAAe8E,WAAWlE,EAAW,aAAc,CACtDmB,QAAQ,IAEVjgB,KAAKke,eAAe8E,WAAWlE,EAAW,QAAS,CACjDmB,QAAQ,IAEVjgB,KAAKke,eAAe8E,WAAWlE,EAAW,WAAY,CACpDmB,QAAQ,IAEVjgB,KAAKke,eAAe8E,WAAWlE,EAAW,eAAgB,CACxDmB,QAAQ,IAEVjgB,KAAKke,eAAe8E,WAAWlE,EAAW,cAAe,CACvDmB,QAAQ,IAEVjgB,KAAKke,eAAe8E,WAAWlE,EAAW,eAAgB,CACxDmB,QAAQ,IAEVjgB,KAAKke,eAAe8E,WAAWlE,EAAW,SAAU,CAClDmB,QAAQ,IAEVjgB,KAAKke,eAAe8E,WAAWlE,EAAW,YAAa,CACrDmB,QAAQ,IAEVjgB,KAAKke,eAAe8E,WAAWlE,EAAW,YAAa,CACrDmB,QAAQ,MAIZ,GAA2B,iBAAhBzC,GAA6BD,GAAmBC,GAA3D,CAWA,QAAkBc,IAAd2mB,IbwiBoB,iBADEnvB,EaviB2BmvB,KbwiBjB,CAAC,OAAQ,UAAUtjC,SAASmU,IaviB9D,MAAM,IAAIpW,MAAM,mBAAmBulC,yBbsiBzC,IAA8BnvB,EaniB1B,QACewI,IAAbvB,QACeuB,IAAfuB,QACUvB,IAAVhB,QACiBgB,IAAjB8H,EAKF,MAAO,CACLtH,YACAxB,QACAuC,WAA2B,SAAfA,EACZrC,cACA4I,eACA1U,SACAsyB,YAAajnB,EACb2rB,gBAAiB3mB,EAEjBkjB,UAAWA,GAAa,OACxBhB,qBACgB3lB,IAAdsjB,EAA0BjxB,OAAOg4B,SAAS/G,EAAW,SAAMtjB,EA3B9D,YALOnC,QAAQC,IAAI,CAChBpc,KAAKke,eAAe8B,kBAAkBlB,EAAW,CAAEmB,QAAQ,IAC3DjgB,KAAKke,eAAe8B,kBAAkBlB,EAAW,CAAEmB,QAAQ,KAgChE,CAQD,WAAMX,CAAMR,GACV,OAAOQ,GAAMR,EAAW9e,KAAKke,eAC9B,QClHU0qB,GACX,eAAMtsB,CAAUkB,GACd,IAIE,OADA,IAAIlG,IAAIkG,IACD,CACR,CAAC,MAAON,GACP,MAAM,IAAIxd,MACR,IAAI8d,gEAA0EN,IAEjF,CACF,CAED,YAAMX,CAEJssB,GAEA,OAAOjpB,IACR,QCVUkpB,GAED5qB,eACAkB,mBACAoD,oBACAjB,gBACAwnB,eALV,WAAAnpC,CACUse,EACAkB,EACAoD,EACAjB,EACAwnB,GAJA/oC,KAAcke,eAAdA,EACAle,KAAkBof,mBAAlBA,EACApf,KAAmBwiB,oBAAnBA,EACAxiB,KAAeuhB,gBAAfA,EACAvhB,KAAc+oC,eAAdA,EAER/oC,KAAKke,eAAiBA,EACtBle,KAAKof,mBAAqBA,EAC1Bpf,KAAKwiB,oBAAsBA,EAC3BxiB,KAAKuhB,gBAAkBA,EACvBvhB,KAAK+oC,eAAiBA,CACvB,CAED,eAAMzsB,CAAUkB,GACd,IACE,MAAMwrB,EAAQ,IAAI1xB,IAAIkG,GACtB,OACqC,OAAnCwrB,EAAMrrB,aAAaxV,IAAI,SACa,OAApC6gC,EAAMrrB,aAAaxV,IAAI,QAE1B,CAAC,MAAO+U,GACP,MAAM,IAAIxd,MACR,IAAI8d,gEAA0EN,IAEjF,CACF,CAED,YAAMX,CACJiB,EACAyI,GAEA,UAAYjmB,KAAKsc,UAAUkB,GACzB,MAAM,IAAI9d,MACR,0CAA0C8d,2CAI9C,MAAMhc,EAAM,IAAI8V,IAAIkG,GACdyrB,EAAaznC,EAAImc,aAAaxV,IAAI,SAElC+gC,QAAyBlpC,KAAKke,eAAe8E,WACjDimB,EACA,YACA,CACEhmB,aAAa,KAIX3B,aACJA,EAAY3C,aACZA,EACAnB,YAAauF,EACbhE,KAAMoqB,SACEtmB,GACRqmB,EACAlpC,KAAKke,eACLle,KAAKwiB,qBAGDtQ,EAAM1Q,EAAImc,aAAaxV,IAAI,OAEjC,GAAmB,iBAAR+J,GAAoBA,IAAQoP,EAAa5P,OAClD,MAAM,IAAIhS,MACR,mCAAmCwS,wEAA0EoP,EAAa5P,yFAI9H,QAAqB4M,IAAjBK,EACF,MAAM,IAAIjf,MACR,iCAAiCwpC,8BAIrC,QAA0B5qB,IAAtByE,EACF,MAAM,IAAIrjB,MACR,gCAAgCwpC,8BAIpC,MAAM3G,QAAwBviC,KAAKuhB,gBAAgBO,UACjD,CAAEhD,UAAWoqB,GACb5nB,GAGI8nB,EAAiBp4B,KAAKwB,MACtB62B,QAAe/G,GACnBhhB,EACAihB,EACA,CACEC,UAAW,qBAGXjjC,KAAMiC,EAAImc,aAAaxV,IAAI,QAC3BwW,eACAnB,YAAauF,GAEfomB,GAOF,IAAIpjB,EAFJyI,OAAOuJ,aAAapE,WAAW,QAAQsV,UAGX3qB,IAAxB+qB,EAAOjjB,eACTL,EAAiB,CACfjH,UAAWoqB,EACX9iB,aAAcijB,EAAOjjB,aACrBE,eAAgBtmB,KAAK+oC,iBAIzB,MAAMO,EAAY3jB,GAAwB0jB,EAAO/jB,YAAa,CAC5DX,QAAS0kB,EAAO1kB,QAChBoB,iBACAE,eACAP,UAAW2jB,EAAO3jB,kBfgwBxBxkB,eAAwCgd,EAAgBY,EAAWxB,EAAOP,EAAU8C,EAAYuG,EAAcnG,QAK5F3B,IAAVhB,SACMY,EAAeW,WAAWC,EAAW,CAAExB,SAAS,CAAE2C,gBAE3C3B,IAAbvB,SACMmB,EAAeW,WAAWC,EAAW,CAAE/B,YAAY,CAAEkD,iBAGrD/B,EAAeW,WAAWC,EAAW,CAAEe,cAAc,CAAEI,UAQrE,CejxBUspB,CACJvpC,KAAKke,eACLgrB,EACAG,EAAO/rB,MACP+rB,EAAOtsB,SACP,OACAuB,GACA,GAGF,MAAMylB,QAAoB/jC,KAAKof,mBAAmBjX,IAAI+gC,GACtD,IAAKnF,EACH,MAAM,IAAIrkC,MAAM,gCAAgCwpC,OAGlD,OAAOrmC,OAAOi0B,OAAOiN,EAAa,CAChCnrB,MAAO0wB,EACPjF,aAAcxjB,GAA4B,CACxCE,YAAasoB,EAAOzsB,QACpBkE,mBAAoBQ,EAAaR,qBAEnCyjB,eAC8B,iBAArB8E,EAAO3jB,UACV0jB,EAAoC,IAAnBC,EAAO3jB,eACxBpH,GAET,EC5JkB,MAAAkrB,WACXztB,GAGR,WAAAnc,CAAY6pC,GACV1pC,MAAM0pC,EACP,ECdW,MAAOC,GACnB,WAAI3pB,GACF,OAAOyO,OAAOuJ,YACf,CAED,SAAM5vB,CAAIrC,GACR,OAAO9F,KAAK+f,QAAQ0T,QAAQ3tB,SAAQwY,CACrC,CAED,SAAMtf,CAAI8G,EAAa9B,GACrBhE,KAAK+f,QAAQ2T,QAAQ5tB,EAAK9B,EAC3B,CAED,YAAM,CAAO8B,GACX9F,KAAK+f,QAAQ4T,WAAW7tB,EACzB,ECZW,MAAO6jC,GACnB,QAAA5wB,CAASyE,EAAqB1d,GACxBA,GAAWA,EAAQof,eACrBpf,EAAQof,eAAe1B,GACd1d,GAAWA,EAAQ8pC,yBAC5Bpb,OAAOgW,QAAQC,aAAa,CAAE,EAAE,GAAIjnB,GAEpCgR,OAAOoV,SAASrsB,KAAOiG,CAE1B,ECJW,MAAOqsB,GACC3rB,eAApB,WAAAte,CAAoBse,GAAAle,KAAcke,eAAdA,EAClBle,KAAKke,eAAiBA,CACvB,CAED,eAAM4D,CACJhiB,EACAwhB,GAGA,MACEwoB,EACAC,EACAnI,EACAoI,EACAC,SACQ9tB,QAAQC,IAAI,CACpBpc,KAAKke,eAAe8E,WAAWljB,EAAQgf,UAAW,WAAY,CAC5DmB,QAAQ,IAEVjgB,KAAKke,eAAe8E,WAAWljB,EAAQgf,UAAW,eAAgB,CAChEmB,QAAQ,IAEVjgB,KAAKke,eAAe8E,WAAWljB,EAAQgf,UAAW,YAAa,CAC7DmB,QAAQ,IAEVjgB,KAAKke,eAAe8E,WAAWljB,EAAQgf,UAAW,aAAc,CAC9DmB,QAAQ,IAEVjgB,KAAKke,eAAe8E,WAAWljB,EAAQgf,UAAW,aAAc,CAC9DmB,QAAQ,MAKNskB,OACUjmB,IAAdsjB,EAA0BjxB,OAAOg4B,SAAS/G,EAAW,KAAO,EAIxDsI,OACmB5rB,IAAvByrB,GACmB,IAAnBxF,GACA/0B,KAAKC,MAAMuB,KAAKwB,MAAQ,KAAQ+xB,EAClC,GAAIuF,InB6oB0B,iBADPloB,EmB5oBiBqoB,InB8oBpC,CAAC,UAAW,SAAU,cAActoC,SAASigB,MmB9oBasoB,EAC5D,YAA8B5rB,IAAvByrB,EACH,CACEhtB,SAAU+sB,EACV/nB,aAAcgoB,EACdpoB,WAAYqoB,EAEZpoB,WAAY,UACZggB,UAAW2C,GAEZ,CACCxnB,SAAU+sB,EACVnoB,WAAYqoB,EAEZpoB,WAAYqoB,GnB8nBxB,IAA2BroB,EmBznBvB,IACE,MAAMuoB,QAAyBpJ,GAAejhC,EAASwhB,GAEjDU,EAAqC,CACzCjF,SAAUotB,EAAiBptB,SAC3B6E,WAAY,WAgBd,YAdsCtD,IAAlC6rB,EAAiBpoB,eACnBC,EAAWD,aAAeooB,EAAiBpoB,aAC3CC,EAAW4f,UAAYv/B,OAAO8nC,EAAiBvI,YAE7CuI,EAAiBrI,2BACnB9f,EAAW8f,yBACTqI,EAAiBrI,gCAEf9hC,KAAKke,eAAeW,WAAW/e,EAAQgf,UAAWkD,EAAY,CAIlE/B,QAAQ,IAEHkqB,CACR,CAAC,MAAO50B,GACP,MAAM,IAAI7V,MAAM,8BAA+B,CAAEa,MAAOgV,GACzD,CACF,QCtFU60B,GACX,eAAM9tB,CAAUkB,GACd,IACE,OAAO,IAAIlG,IAAIkG,GAAaG,aAAa9Z,IAAI,QAC9C,CAAC,MAAOqZ,GACP,MAAM,IAAIxd,MACR,IAAI8d,gEAA0EN,IAEjF,CACF,CAED,YAAMX,CACJiB,EACAyI,GAEA,QAAqB3H,IAAjB2H,EAA4B,CAC9B,MAAMzkB,EAAM,IAAI8V,IAAIkG,GACd6sB,EAAW7oC,EAAImc,aAAaxV,IAAI,SAChCmiC,EAAsB9oC,EAAImc,aAAaxV,IAAI,qBACjD8d,EAAaO,KAAKrL,GAAOC,MAAOivB,EAAUC,EAC3C,CACD,OAAO1qB,IACR,ECfW,MAAO2qB,GAETrsB,eACAsE,oBACAjB,gBAHV,WAAA3hB,CACUse,EACAsE,EACAjB,GAFAvhB,KAAcke,eAAdA,EACAle,KAAmBwiB,oBAAnBA,EACAxiB,KAAeuhB,gBAAfA,EAERvhB,KAAKke,eAAiBA,EACtBle,KAAKwiB,oBAAsBA,EAC3BxiB,KAAKuhB,gBAAkBA,CACxB,CAED,aAAMgF,CACJzH,EACAsH,EACAzB,EACAsB,GAEA,MAAMukB,QAAoB3nB,GACxB/D,EACA9e,KAAKke,eACLle,KAAKwiB,qBAGDhB,QAA4BxhB,KAAKuhB,gBAAgBO,UACrD,CAAEhD,aACF0rB,EAAYlpB,cAGd,QAAqBhD,IAAjB8H,EAEF,MAAM,IAAI1mB,MACR,YAAYof,oEAIhB,GAAI0rB,EAAYzrB,WAAoBT,IAAZqG,EACtB,MAAM,IAAIjlB,MACR,gBAAgBof,6FAIpB,MAAMuH,QAAiBE,GACrBH,EACAokB,EAAYlpB,aACZE,EACAmD,GAMF,YAH8BrG,IAA1B+H,EAASD,cACXH,GAAcO,KAAKrL,GAAOI,kBAAmB8K,EAASD,cAEjDC,CACR,EC/CG,SAAUokB,GAAwCC,GAItD,MAAMC,EAAkB,IAAI7mB,GACtBT,EAAgBqnB,EAAarnB,eAAiBsnB,EAC9CrnB,EAAkBonB,EAAapnB,iBAAmB,IAAIomB,GAEtDxrB,EAAiB,IAAIkO,GACzB/I,EACAC,GAGId,EAAsB,IAAIslB,GAAoB5pB,GAC9CqD,EAAkB,IAAIsoB,GAAgB3rB,GAEtCkB,EAAqB,IAAIqpB,GAAmBvqB,GAE5CoI,EAAiB,IAAIikB,GACzBrsB,EACAsE,EACAjB,GAGIpD,EAAa,IAAIwrB,GAGjBtnB,EAAe,IAAIwiB,GACvB3mB,EACA,IAAIknB,GAAqClnB,EAAgBC,GACzDqE,EACAjB,GAGIe,EAAkB,IAAIknB,GAAyB,CACnD,IAAIY,GACJ,IAAItB,GACF5qB,EACAkB,EACAoD,EACAjB,EACA+E,GAIF,IAAIsiB,KAGN,OAAO,IAAItF,GACTjhB,EACAC,EACA,IAAI5C,GAAwBN,EAAoBjB,GAChDiB,EACAoD,EAEJ,CCrFO,MAAMooB,GAAsB,GAAG3vB,mBAEzB4vB,GAAkB,GAAG5vB,qBC8FrB6vB,GAIK9d,KAOA7D,OAER4hB,qBAEAC,wBAAyB,EAiBjC,WAAAprC,CACEqrC,EAA2C,GAC3CnsB,OAAgCR,GAEhCte,KAAKmpB,OAAS,IAAIvB,GACdqjB,EAAeF,qBACjB/qC,KAAK+qC,qBAAuBE,EAAeF,qBAClCE,EAAe5nB,eAAiB4nB,EAAe3nB,gBACxDtjB,KAAK+qC,qBAAuBN,GAAwC,CAClEpnB,cAAe4nB,EAAe5nB,cAC9BC,gBAAiB2nB,EAAe3nB,kBAGlCtjB,KAAK+qC,qBAAuBN,GAAwC,CAAA,GAGlEQ,EAAelH,YACjB/jC,KAAKgtB,KAAO,CACVlO,UAAWmsB,EAAelH,YAAYjlB,UACtCe,YAAY,EACZvC,MAAO2tB,EAAelH,YAAYzmB,MAClC0mB,YAAaiH,EAAelH,YAAYC,aAG1ChkC,KAAKgtB,KAAO,CACVlO,UAAWA,GAAatE,KACxBqF,YAAY,GAQhB7f,KAAKmpB,OAAOZ,GAAGpN,GAAOE,MAAO,IAC3BmT,OAAOuJ,aAAarE,QAAQkX,GAAqB5qC,KAAKgtB,KAAKlO,YAG7D9e,KAAKmpB,OAAOZ,GAAGpN,GAAOO,gBAAiB,IAAM1b,KAAKkrC,gBAAe,IAEjElrC,KAAKmpB,OAAOZ,GAAGpN,GAAOC,MAAO,IAAMpb,KAAKkrC,gBAAe,GACxD,CAUD1H,MAAQtiC,MAAOpB,UACPE,KAAK+qC,qBAAqBvH,MAC9B,CACE1kB,UAAW9e,KAAKgtB,KAAKlO,aAClBhf,EAEHmlC,UAAWnlC,EAAQmlC,WAAa,QAElCjlC,KAAKmpB,QAMA,IAAIhN,QAAQ,SASrBvD,MAAsB,CAACpX,EAAK2gB,IAC1BniB,KAAK+qC,qBAAqBnyB,MAAMpX,EAAK2gB,GAS/B+oB,eAAiBhqC,MACvBiqC,EACArrC,KAKA0uB,OAAOuJ,aAAapE,WAAWiX,UACzB5qC,KAAK+qC,qBAAqBroB,OAAO1iB,KAAKgtB,KAAKlO,UAAWhf,GAC5DE,KAAKgtB,KAAKnN,YAAa,EACnBsrB,GACDnrC,KAAKmpB,OAAwB3C,KAAKrL,GAAOG,SAyC9CoH,OAASxhB,MAAOpB,GACdE,KAAKkrC,gBAAe,EAAMprC,GAQ5BqkC,uBAAyBjjC,MACvBkqC,EAAwD,MAExD,GAAIprC,KAAKgtB,KAAKnN,WACZ,OAAO7f,KAAKgtB,KAGd,GAAIhtB,KAAKgrC,uBACP,OAEF,MAAMlrC,EACoB,iBAAjBsrC,EAA4B,CAAE5pC,IAAK4pC,GAAiBA,EACvD5pC,EAAM1B,EAAQ0B,KAAOgtB,OAAOoV,SAASrsB,KAE3CvX,KAAKgrC,wBAAyB,EAC9B,MAAMjH,QAAoB/jC,KAAK+qC,qBAAqB5G,uBAClD3iC,EACAxB,KAAKmpB,QAEP,GA7MJ,SACE4a,GAEA,QAASA,GAAalkB,UACxB,CAyMQA,CAAWkkB,GAAc,CAC3B/jC,KAAKqrC,eAAetH,GACpB,MAAMuH,EAAa9c,OAAOuJ,aAAatE,QAAQoX,IAC5B,OAAfS,EAGDtrC,KAAKmpB,OAAwB3C,KAAKrL,GAAOE,QAK1CmT,OAAOuJ,aAAapE,WAAWkX,IAC9B7qC,KAAKmpB,OAAwB3C,KAAKrL,GAAOS,iBAAkB0vB,GAE/D,MAAM,IAAuC,IAAnCxrC,EAAQyrC,uBAAiC,CAMlD,MAAMrC,EAAkB1a,OAAOuJ,aAAatE,QAAQmX,IAGpD,GAAwB,OAApB1B,EAA0B,CAU5B,SA3QDhoC,eACL4d,EACA0sB,EACAC,GAEA,MAAMC,QAA0BF,EAAY3H,uBAAuB/kB,GACnE,OAA0B,OAAtB4sB,IAKFld,OAAOuJ,aAAarE,QAAQmX,GAAiBrc,OAAOoV,SAASrsB,YACvDi0B,EAAYhI,MAChB,CACE1kB,YACA+Z,OAAQ,OACR8L,WAAY+G,EAAkBh6B,OAC9B8L,YAAakuB,EAAkBluB,YAC/BT,SAAU2uB,EAAkB1H,YAC5BjiB,aAAc2pB,EAAkBhD,gBAChCzD,UAAWyG,EAAkBzG,WAAa,QAE5CwG,EAAQtiB,SAEH,EAGX,CAuOoDwiB,CAC1CzC,EACAlpC,KAAK+qC,qBACL/qC,MAOA,OAAO,IAAImc,QAAQ,OAEtB,CACF,CAED,OADAnc,KAAKgrC,wBAAyB,EACvBjH,GAGD,cAAAsH,CACNtH,GAEA/jC,KAAKgtB,KAAKnN,WAAakkB,EAAYlkB,WACnC7f,KAAKgtB,KAAK1P,MAAQymB,EAAYzmB,MAC9Btd,KAAKgtB,KAAKlO,UAAYilB,EAAYjlB,UAClC9e,KAAKgtB,KAAKgX,YAAcD,EAAYC,YACpChkC,KAAKgtB,KAAKuX,eAAiBR,EAAYQ,eACvCvkC,KAAKmpB,OAAOZ,GAAGpN,GAAOQ,iBAAmB+J,IACvC1lB,KAAKgtB,KAAKuX,eAAiBvzB,KAAKwB,MAAoB,IAAZkT,GAE3C,ECzVH,IAAIkmB,YAYYC,KAId,YAH8B,IAAnBD,KACTA,GAAiB,IAAId,IAEhBc,EACT,2HAmEE,OAAOC,KAAoB1iB,MAC7B,UAzDgB,YACXrJ,GAGH,OADgB+rB,KACDjzB,SAASkH,EAC1B,kDAsCgB,YACXA,GAGH,OADgB+rB,KACD1H,0BAA0BrkB,EAC3C,UAlCgB,YACXA,GAGH,OADgB+rB,KACDrI,SAAS1jB,EAC1B,WAWgB,YACXA,GAGH,OADgB+rB,KACDnpB,UAAU5C,EAC3B","x_google_ignoreList":[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,27,28,29]}