@jeffusion/bungee-core 5.26.0 → 6.0.1

package/dist/plugins/{local-accounts → user-auth}/control.js.map

@@ -1,11 +1,14 @@
 {
   "version": 3,
-  "sources": ["../../../../../plugins/local-accounts/server/control.ts", "../../../src/plugin-logger.ts", "../../../src/hooks/impl.ts", "../../../src/plugin-extensions.ts", "../../../src/plugin-durable-state.ts", "../../../src/plugin-services/host-rpc.ts", "../../../src/plugin-services/wire-contract.ts", "../../../src/plugin-services/rpc-runtime.ts", "../../../src/plugin-services/peer-channel-protocol.ts", "../../../src/plugin-services/peer-channel-hub.ts", "../../../src/plugin-services/snapshot-store.ts", "../../../src/plugin-services.ts", "../../../src/gateway/retry-action.ts", "../../../src/token-stats-window.ts"],
+  "sources": ["../../../../../node_modules/oauth4webapi/build/index.js", "../../../../../node_modules/openid-client/build/index.js", "../../../../../plugins/user-auth/server/control.ts", "../../../../../plugins/user-auth/server/errors.ts", "../../../src/plugin-logger.ts", "../../../src/hooks/impl.ts", "../../../src/plugin-extensions.ts", "../../../src/plugin-durable-state.ts", "../../../src/plugin-services/host-rpc.ts", "../../../src/plugin-services/wire-contract.ts", "../../../src/plugin-services/rpc-runtime.ts", "../../../src/plugin-services/peer-channel-protocol.ts", "../../../src/plugin-services/peer-channel-hub.ts", "../../../src/plugin-services/snapshot-store.ts", "../../../src/plugin-services.ts", "../../../src/gateway/retry-action.ts", "../../../src/token-stats-window.ts"],
   "sourcesContent": [
-    "import { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';\nimport type { ControlHostContext, ControlApiHandlerContext, PluginControl, ControlPlugin } from '@jeffusion/bungee-core/plugin';\nimport type { ManagementProvider, ManagementSubject } from '@jeffusion/bungee-core/plugin';\nimport { isDurableStateConflictError, type DurableJson, type PluginDurableState, type DurableMutation, type DurableRecord } from '@jeffusion/bungee-core/plugin';\n\ninterface Administrator { id: string; username: string; disabled: boolean; passwordHash: string; temporary: boolean; generation: number; failureEpoch: number }\ninterface SessionPolicy { idleTimeoutMinutes: number; absoluteTimeoutMinutes: number }\ninterface Session { digest: string; administratorId: string; generation: number; created: number; touched: number; transport: 'cookie' | 'bearer'; policy?: SessionPolicy }\ninterface Failure { key: string; count: number; until: number; epoch: number }\ninterface Slot<T> { key: string; version: number; value: T | null }\nexport interface Dependencies { now?: () => number; trustedSource?: (request: Request) => string }\nconst PROVIDER = 'local-accounts';\nconst COOKIE = 'bungee_local_session';\nconst DEFAULT_SESSION_POLICY: Readonly<SessionPolicy> = Object.freeze({ idleTimeoutMinutes: 30, absoluteTimeoutMinutes: 480 });\n// Chromium caps persistent cookies at 400 days. Verification renews this browser lease,\n// never the server-side absolute deadline. Browser/user cleanup remains outside our control.\nconst COOKIE_LEASE_SECONDS = 400 * 24 * 60 * 60;\nconst MAX_TIMEOUT_MINUTES = Math.floor(Number.MAX_SAFE_INTEGER / 60_000);\nconst ALL = ['config.read', 'config.write', 'logs.read', 'logs.body', 'keys.read', 'keys.write', 'plugins.read', 'plugins.toggle', 'plugins.code', 'auth.mode', 'self.password', 'self.logout'];\nclass AccountError extends Error { constructor(readonly code: string, readonly status = 400) { super(code); } }\nfunction fail(code: string, status = 400): never { throw new AccountError(code, status); }\nfunction object(v: unknown): Record<string, unknown> { if (!v || typeof v !== 'object' || Array.isArray(v)) fail('invalid_input'); return v as Record<string, unknown>; }\nfunction exact(v: Record<string, unknown>, fields: string[]) { if (Object.keys(v).some(k => !fields.includes(k))) fail('invalid_input'); }\nfunction username(v: unknown): string { if (typeof v !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_.@-]{0,63}$/.test(v)) fail('invalid_input'); return v.toLowerCase(); }\nfunction password(v: unknown): string { if (typeof v !== 'string' || [...v].length < 6 || [...v].length > 64) fail('invalid_password'); return v; }\nfunction digest(v: string): string { return createHash('sha256').update(v).digest('hex'); }\nfunction csrf(token: string): string { return createHmac('sha256', token).update('local-accounts/csrf/v1').digest('base64url'); }\nfunction constant(a: string, b: string): boolean { const aa = Buffer.from(a), bb = Buffer.from(b); return aa.length === bb.length && timingSafeEqual(aa, bb); }\nfunction dto(m: Administrator) { return { id: m.id, username: m.username, requiresPasswordChange: m.temporary }; }\nfunction json(v: unknown, status = 200, headers: Record<string, string> = {}): Response { return Response.json(v, { status, headers: { 'cache-control': 'no-store', ...headers } }); }\nfunction safe(error: unknown): Response { return error instanceof AccountError ? json({ error: error.code }, error.status) : json({ error: 'provider_unavailable' }, 503); }\nasync function body(request: Request): Promise<Record<string, unknown>> {\n  const reader = request.body?.getReader(); if (!reader) fail('invalid_input');\n  let size = 0; const chunks: Uint8Array[] = [];\n  try { for (;;) { const r = await reader.read(); if (r.done) break; size += r.value.length; if (size > 8192) { await reader.cancel(); fail('body_limit', 413); } chunks.push(r.value); } }\n  finally { reader.releaseLock(); }\n  try { return object(JSON.parse(Buffer.concat(chunks).toString('utf8'))); } catch (e) { if (e instanceof AccountError) throw e; return fail('invalid_input'); }\n}\nfunction credentials(request: Request): { token: string; transport: Session['transport'] } | null {\n  const auth = request.headers.get('authorization');\n  if (auth !== null) { const m = /^Bearer ([A-Za-z0-9_-]{43})$/.exec(auth); return m ? { token: m[1]!, transport: 'bearer' } : null; }\n  const tokens = (request.headers.get('cookie') ?? '').split(';').map(x => x.trim()).filter(x => x.startsWith(COOKIE + '='));\n  if (tokens.length !== 1) return null; const token = tokens[0]!.slice(COOKIE.length + 1);\n  return /^[A-Za-z0-9_-]{43}$/.test(token) ? { token, transport: 'cookie' } : null;\n}\nfunction origin(request: Request, expected?: string) { if (request.headers.get('origin') !== (expected ?? new URL(request.url).origin)) fail('invalid_origin', 403); }\nfunction cookie(request: Request, token: string, maxAge: number, managementOrigin?: string) { return `${COOKIE}=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${new URL(managementOrigin ?? request.url).protocol === 'https:' ? '; Secure' : ''}`; }\n\nfunction validateSessionPolicy(value: unknown, code = 'invalid_session_policy', status = 400): SessionPolicy {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) fail(code, status);\n  const p = value as SessionPolicy;\n  if (Object.keys(p).some(key => !['idleTimeoutMinutes', 'absoluteTimeoutMinutes'].includes(key))\n    || ![p.idleTimeoutMinutes, p.absoluteTimeoutMinutes].every(n => Number.isSafeInteger(n) && n >= 0 && n <= MAX_TIMEOUT_MINUTES)) fail(code, status);\n  return { idleTimeoutMinutes: p.idleTimeoutMinutes, absoluteTimeoutMinutes: p.absoluteTimeoutMinutes };\n}\n\n// Fixed slots keep expired sessions, logout markers and throttles bounded. Reuse always\n// compares the previous version; a stale touch cannot restore a replaced session.\nexport const ACCOUNT_RECORD_SCHEMA = 3;\nexport const MAX_SESSIONS = 512, MAX_FAILURES = 1024;\nconst asJson = (value: unknown) => value as DurableJson;\nfunction validateAdministrator(m: unknown): asserts m is Administrator {\n  const a = m as Administrator;\n  if (!a || typeof a.id !== 'string' || !a.id || typeof a.username !== 'string' || !/^[a-z0-9][a-z0-9_.@-]{0,63}$/.test(a.username) || typeof a.disabled !== 'boolean' || typeof a.temporary !== 'boolean' || typeof a.passwordHash !== 'string' || !a.passwordHash.startsWith('$argon2id$') || !Number.isSafeInteger(a.generation) || a.generation < 1 || !Number.isSafeInteger(a.failureEpoch) || a.failureEpoch < 1) fail('corrupt_state', 503);\n}\nfunction envelope(value: unknown, field: string): unknown {\n  if (!value || typeof value !== 'object' || Array.isArray(value)) fail('corrupt_state', 503);\n  const v = value as Record<string, unknown>;\n  if (v.schema !== ACCOUNT_RECORD_SCHEMA || !Object.hasOwn(v, field) || Object.keys(v).some(k => k !== 'schema' && k !== field)) fail('corrupt_state', 503);\n  return v[field];\n}\nfunction administratorValue(record: DurableRecord | null): Administrator | null {\n  if (!record) return null;\n  const a = envelope(record.value, 'administrator'); if (a !== null) validateAdministrator(a);\n  return a as Administrator | null;\n}\nfunction validateSession(value: unknown): Session | null {\n  if (value === null) return null;\n  const s = value as Session;\n  if (!s || !/^[a-f0-9]{64}$/.test(s.digest) || typeof s.administratorId !== 'string' || !s.administratorId || !Number.isSafeInteger(s.generation) || s.generation < 1 || !Number.isFinite(s.created) || !Number.isFinite(s.touched) || s.touched < s.created || !['cookie', 'bearer'].includes(s.transport)) fail('corrupt_state', 503);\n  if (s.policy !== undefined) validateSessionPolicy(s.policy, 'corrupt_state', 503);\n  return s;\n}\nfunction validateFailure(value: unknown): Failure | null {\n  if (value === null) return null;\n  const f = value as Failure;\n  if (!f || typeof f.key !== 'string' || !/^(account|source):[a-f0-9]{64}$/.test(f.key) || !Number.isSafeInteger(f.count) || f.count < 0 || !Number.isFinite(f.until) || !Number.isSafeInteger(f.epoch) || f.epoch < 1) fail('corrupt_state', 503);\n  return f;\n}\nfunction slots<T extends Session | Failure>(records: readonly DurableRecord[], kind: string, limit: number, validate: (v: unknown) => T | null): Slot<T>[] {\n  const result: Slot<T>[] = Array.from({length: limit}, (_, i) => ({key: `${kind}:${i}`, version: 0, value: null}));\n  const seen = new Set<string>();\n  for (const r of records.filter(r => r.key.startsWith(kind + ':'))) {\n    const index = Number(r.key.slice(kind.length + 1));\n    if (!Number.isInteger(index) || index < 0 || index >= limit || r.key !== `${kind}:${index}`) fail('corrupt_state', 503);\n    const value = validate(envelope(r.value, kind));\n    const identity = value && (kind === 'session' ? (value as Session).digest : (value as Failure).key);\n    if (identity && seen.has(identity)) fail('corrupt_state', 503); if (identity) seen.add(identity);\n    result[index] = {key: r.key, version: r.version, value};\n  }\n  return result;\n}\nconst mutation = <T>(slot: Slot<T>, field: string, value: T | null): DurableMutation => ({key: slot.key, expectedVersion: slot.version, value: asJson({schema: ACCOUNT_RECORD_SCHEMA, [field]: value})});\nfunction next(value: number): number { if (!Number.isSafeInteger(value + 1)) fail('generation_overflow'); return value + 1; }\n\nexport class LocalAccountsControl implements PluginControl, ManagementProvider {\n  readonly management = this;\n  readonly rpc = [];\n  readonly api;\n  private readonly state: PluginDurableState;\n  private readonly now: () => number;\n  private readonly subjects = new WeakMap<ManagementSubject, {generation: number; digest: string}>();\n  // Positive lookups only; bounded by the fixed session slots, never by attacker tokens.\n  private readonly sessionSlots = new Map<string, string>();\n  private dummy = '';\n  private disposed = false;\n  constructor(private readonly host: ControlHostContext, private readonly dependencies: Dependencies = {}) {\n    if (!host.durableState) fail('durable_state_required', 503);\n    this.state = host.durableState; this.now = dependencies.now ?? Date.now;\n    const invoke = (fn: (c: ControlApiHandlerContext) => Promise<Response>) => async (c: ControlApiHandlerContext) => {\n      try { this.alive(); if (c.requestSignal.aborted) fail('cancelled'); return await fn(c); } catch (e) { return safe(e); }\n    };\n    this.api = [\n      {path: '/password', methods: ['POST'], handler: 'changePassword', invoke: invoke(async c => {\n        await this.requireCapability(c, 'self.password', true); const b = await body(c.request); exact(b, ['currentPassword', 'password', 'passwordConfirmation']);\n        await this.changePassword(c, b); return json({ok: true}, 200, {'set-cookie': cookie(c.request, '', 0, this.host.managementOrigin)});\n      })},\n      {path: '/logout', methods: ['POST'], handler: 'logout', invoke: invoke(async c => { await this.requireCapability(c, 'self.logout', true); return this.logout(c.request); })},\n      {path: '/self', methods: ['GET'], handler: 'self', invoke: invoke(async c => {\n        await this.requireCapability(c, 'self.password'); const m = (await this.readAdministrator()).value!; const creds = credentials(c.request);\n        return json({administrator: dto(m), ...(creds?.transport === 'cookie' ? {csrfToken: csrf(creds.token)} : {})});\n      })},\n      {path: '/session-policy', methods: ['GET', 'PUT'], handler: 'sessionPolicy', invoke: invoke(async c => {\n        await this.requireCapability(c, 'config.write', c.request.method === 'PUT');\n        if (c.request.method === 'GET') return json(await this.readSessionPolicy());\n        const b = await body(c.request); exact(b, ['version', 'policy']); if (!Number.isSafeInteger(b.version) || (b.version as number) < 0) fail('invalid_session_policy');\n        const policy = validateSessionPolicy(b.policy); await this.requireCapability(c, 'config.write', true);\n        try { await this.state.transact([{key: 'session-policy', expectedVersion: b.version as number, value: asJson(policy)}]); }\n        catch (e) { if (isDurableStateConflictError(e)) fail('version_conflict', 409); throw e; }\n        return json(await this.readSessionPolicy());\n      })},\n    ];\n  }\n  private alive() { if (this.disposed || this.host.signal.aborted) fail('provider_unavailable', 503); }\n  private async readAdministrator(): Promise<Slot<Administrator>> {\n    this.alive(); const record = await this.state.get('administrator'); return {key: 'administrator', version: record?.version ?? 0, value: administratorValue(record)};\n  }\n  private async records() {\n    this.alive(); const records = await this.state.list();\n    // No legacy runtime reader. A non-current namespace requires the offline converter.\n    for (const r of records) if (!['administrator', 'session-policy', 'recovery-summary'].includes(r.key) && !r.key.startsWith('session:') && !r.key.startsWith('failure:')) fail('account_migration_required', 503);\n    return records;\n  }\n  private async retry<T>(plan: () => Promise<{mutations: DurableMutation[]; result: T}>): Promise<T> {\n    for (let i = 0; i < 64; i++) {\n      const {mutations, result} = await plan(); if (!mutations.length) return result;\n      this.alive(); try { await this.state.transact(mutations); return result; } catch (e) { if (!isDurableStateConflictError(e)) throw e; }\n    }\n    return fail('version_conflict', 409);\n  }\n  private async readSessionPolicy(): Promise<{version: number; policy: SessionPolicy}> {\n    this.alive(); const record = await this.state.get('session-policy');\n    return {version: record?.version ?? 0, policy: record ? validateSessionPolicy(record.value, 'corrupt_state', 503) : {...DEFAULT_SESSION_POLICY}};\n  }\n  async start() {\n    await this.readAdministrator(); await this.readSessionPolicy(); const records = await this.records();\n    slots(records, 'session', MAX_SESSIONS, validateSession); slots(records, 'failure', MAX_FAILURES, validateFailure);\n    this.dummy = await this.hash(randomBytes(32).toString('base64url'));\n  }\n  dispose() { this.disposed = true; }\n  private hash(p: string) { return Bun.password.hash(p, {algorithm: 'argon2id', memoryCost: 65536, timeCost: 3}); }\n  async hasIdentity() { const a = (await this.readAdministrator()).value; return !!a && !a.disabled; }\n  async revokeSessions() { await this.retry(async () => { const a = await this.readAdministrator(); return {mutations: a.value ? [mutation(a, 'administrator', {...a.value, generation: next(a.value.generation)})] : [], result: undefined}; }); }\n  async bootstrap(input: unknown) {\n    const b = object(input); exact(b, ['username', 'password', 'passwordConfirmation']); const name = username(b.username), p = password(b.password);\n    if (b.passwordConfirmation !== p) fail('password_confirmation'); await this.records();\n    const prior = (await this.readAdministrator()).value;\n    if (prior) {\n      if (prior.username !== name || prior.disabled || !await Bun.password.verify(p, prior.passwordHash)) fail('invalid_credentials', 401);\n      const latest = (await this.readAdministrator()).value; if (!latest || latest.generation !== prior.generation || latest.disabled) fail('invalid_credentials', 401); return;\n    }\n    const hashed = await this.hash(p);\n    await this.retry(async () => { const a = await this.readAdministrator(); if (a.value) fail('bootstrap_conflict', 409);\n      return {mutations: [mutation(a, 'administrator', {id: randomUUID(), username: name, disabled: false, temporary: false, passwordHash: hashed, generation: 1, failureEpoch: 1})], result: undefined}; });\n  }\n  private live(m: Administrator | null, session: Session): Administrator | undefined {\n    const now = this.now(), policy = session.policy ?? DEFAULT_SESSION_POLICY;\n    if (now < session.touched || now < session.created || (policy.idleTimeoutMinutes > 0 && now - session.touched >= policy.idleTimeoutMinutes * 60_000) || (policy.absoluteTimeoutMinutes > 0 && now - session.created >= policy.absoluteTimeoutMinutes * 60_000)) return;\n    return m && m.id === session.administratorId && !m.disabled && m.generation === session.generation ? m : undefined;\n  }\n  private async findSession(d: string): Promise<Slot<Session> | undefined> {\n    this.alive(); const key = this.sessionSlots.get(d);\n    if (key) {\n      const record = await this.state.get(key), value = record && validateSession(envelope(record.value, 'session'));\n      if (record && value?.digest === d) return {key, version: record.version, value};\n      this.sessionSlots.delete(d);\n    }\n    const found = slots(await this.records(), 'session', MAX_SESSIONS, validateSession).find(x => x.value?.digest === d);\n    if (found) { if (this.sessionSlots.size >= MAX_SESSIONS) this.sessionSlots.clear(); this.sessionSlots.set(d, found.key); }\n    return found;\n  }\n  private cookieAge(policy: SessionPolicy, elapsedMs = 0): number { return policy.absoluteTimeoutMinutes === 0 ? COOKIE_LEASE_SECONDS : Math.max(0, Math.min(COOKIE_LEASE_SECONDS, Math.floor((policy.absoluteTimeoutMinutes * 60_000 - elapsedMs) / 1000))); }\n  async sessionCookie(request: Request): Promise<string | undefined> {\n    this.alive(); const creds = credentials(request); if (creds?.transport !== 'cookie') return;\n    const slot = await this.findSession(digest(creds.token)), m = (await this.readAdministrator()).value, session = slot?.value;\n    if (!session || session.transport !== 'cookie' || !this.live(m, session)) return;\n    return cookie(request, creds.token, this.cookieAge(session.policy ?? DEFAULT_SESSION_POLICY, this.now() - session.created), this.host.managementOrigin);\n  }\n  async authenticate(request: Request): Promise<ManagementSubject | null> {\n    this.alive(); const c = credentials(request); if (!c) return null;\n    const authenticated = await this.retry(async () => {\n      const slot = await this.findSession(digest(c.token)), m = (await this.readAdministrator()).value, session = slot?.value;\n      const administrator = session && session.transport === c.transport && this.live(m, session);\n      if (!slot || !session || !administrator) return {mutations: [], result: null};\n      return {mutations: [mutation(slot, 'session', {...session, touched: this.now()})], result: {administrator, digest: session.digest}};\n    });\n    if (!authenticated) return null;\n    // A concurrent generation change can invalidate the session while its own CAS succeeds.\n    const m = (await this.readAdministrator()).value;\n    if (!m || m.disabled || m.generation !== authenticated.administrator.generation || m.id !== authenticated.administrator.id) return null;\n    const subject = Object.freeze({id: m.id, provider: PROVIDER, capabilities: Object.freeze([...ALL]), requiresPasswordChange: m.temporary});\n    this.subjects.set(subject, {generation: m.generation, digest: authenticated.digest}); return subject;\n  }\n  async authorize(subject: ManagementSubject, _capability: string): Promise<boolean> {\n    this.alive(); const issued = this.subjects.get(subject); if (!issued || subject.provider !== PROVIDER) return false;\n    const slot = await this.findSession(issued.digest), session = slot?.value, m = session && this.live((await this.readAdministrator()).value, session);\n    return !!m && m.id === subject.id && m.generation === issued.generation;\n  }\n  private async requireCapability(c: ControlApiHandlerContext, capability: string, write = false) { if (!c.subject || !await this.authorize(c.subject, capability)) fail('forbidden', 403); if (write) this.checkWrite(c.request); }\n  validateWrite(request: Request) { this.checkWrite(request); }\n  csrfToken(request: Request): string | undefined { const c = credentials(request); return c?.transport === 'cookie' ? csrf(c.token) : undefined; }\n  private checkWrite(request: Request) { const c = credentials(request); if (!c) fail('unauthorized', 401); if (c.transport === 'cookie') { origin(request, this.host.managementOrigin); if (!constant(request.headers.get('x-csrf-token') ?? '', csrf(c.token))) fail('invalid_csrf', 403); } }\n  async login(request: Request): Promise<Response> {\n    try {\n      this.alive(); if (request.method !== 'POST') fail('method_not_allowed', 405);\n      const b = await body(request); exact(b, ['username', 'password', 'transport']); const name = username(b.username), p = typeof b.password === 'string' ? b.password : '';\n      const transport = b.transport ?? 'cookie'; if (transport !== 'cookie' && transport !== 'bearer') fail('invalid_input');\n      if (transport === 'cookie' || request.headers.has('origin')) origin(request, this.host.managementOrigin);\n      const source = (this.dependencies.trustedSource ?? this.host.trustedSource)?.(request) ?? 'unknown'; const keys = ['account:' + digest(name), 'source:' + digest(source)];\n      // Reserve both independent buckets atomically before password work.\n      const reservation = await this.retry(async () => {\n        const a = (await this.readAdministrator()).value, epoch = a?.failureEpoch ?? 1, now = this.now();\n        const failures = slots(await this.records(), 'failure', MAX_FAILURES, validateFailure), selected: Slot<Failure>[] = [];\n        for (const key of keys) {\n          let slot = failures.find(x => !selected.includes(x) && x.value?.key === key);\n          const active = slot?.value && slot.value.epoch === epoch && slot.value.until > now;\n          if (active && slot!.value!.count >= 10) fail('login_limited', 429);\n          slot ??= failures.find(x => !selected.includes(x) && (!x.value || x.value.epoch !== epoch || x.value.until <= now));\n          if (!slot) fail('login_limited', 429); selected.push(slot);\n        }\n        return {mutations: selected.map((slot, i) => { const prior = slot.value; return mutation(slot, 'failure', {key: keys[i]!, count: prior && prior.key === keys[i] && prior.epoch === epoch && prior.until > now ? prior.count + 1 : 1, until: prior && prior.key === keys[i] && prior.epoch === epoch && prior.until > now ? prior.until : now + 15 * 60_000, epoch}); }), result: epoch};\n      });\n      const candidate = (await this.readAdministrator()).value, administrator = candidate?.username === name ? candidate : null;\n      const valid = await Bun.password.verify(p, administrator?.passwordHash ?? (this.dummy || await this.hash('dummy-invalid-password')));\n      if (!valid || !administrator || administrator.disabled) fail('invalid_credentials', 401);\n      const token = randomBytes(32).toString('base64url'), policy = (await this.readSessionPolicy()).policy, created = this.now();\n      await this.retry(async () => {\n        const m = (await this.readAdministrator()).value;\n        if (!m || m.id !== administrator.id || m.disabled || m.generation !== administrator.generation || m.failureEpoch !== reservation) fail('invalid_credentials', 401);\n        const records = await this.records(), sessions = slots(records, 'session', MAX_SESSIONS, validateSession), slot = sessions.find(x => !x.value || !this.live(m, x.value));\n        if (!slot) fail('session_limit', 429);\n        const changes = [mutation(slot, 'session', {digest: digest(token), administratorId: m.id, generation: m.generation, created, touched: created, transport, policy})];\n        const failures = slots(records, 'failure', MAX_FAILURES, validateFailure);\n        const account = failures.find(x => x.value?.key === keys[0] && x.value.epoch === reservation); if (account) changes.push(mutation(account, 'failure', null));\n        const source = failures.find(x => x.value?.key === keys[1] && x.value.epoch === reservation); if (source) changes.push(mutation(source, 'failure', {...source.value!, count: Math.max(0, source.value!.count - 1)}));\n        return {mutations: changes, result: undefined};\n      });\n      const latest = (await this.readAdministrator()).value;\n      if (!latest || latest.disabled || latest.generation !== administrator.generation || latest.id !== administrator.id) fail('invalid_credentials', 401);\n      return transport === 'cookie' ? json({administrator: dto(administrator), csrfToken: csrf(token)}, 200, {'set-cookie': cookie(request, token, this.cookieAge(policy, this.now() - created), this.host.managementOrigin)}) : json({administrator: dto(administrator), token, expiresIn: policy.absoluteTimeoutMinutes === 0 ? null : policy.absoluteTimeoutMinutes * 60});\n    } catch (e) { return safe(e); }\n  }\n  async logout(request: Request): Promise<Response> {\n    try { this.alive(); if (request.method !== 'POST') fail('method_not_allowed', 405); this.checkWrite(request); const c = credentials(request)!;\n      await this.retry(async () => { const slot = await this.findSession(digest(c.token)); return {mutations: slot?.value ? [mutation(slot, 'session', null)] : [], result: undefined}; });\n      return json({ok: true}, 200, {'set-cookie': cookie(request, '', 0, this.host.managementOrigin)});\n    } catch (e) { return safe(e); }\n  }\n  private async changePassword(c: ControlApiHandlerContext, b: Record<string, unknown>) {\n    const p = password(b.password); if (b.passwordConfirmation !== p) fail('password_confirmation');\n    const m = (await this.readAdministrator()).value, id = c.subject!.id;\n    if (!m || m.id !== id || typeof b.currentPassword !== 'string' || !await Bun.password.verify(b.currentPassword, m.passwordHash)) fail('invalid_credentials', 401);\n    if (constant(p, b.currentPassword)) fail('password_unchanged'); const hashed = await this.hash(p);\n    await this.retry(async () => {\n      await this.requireCapability(c, 'self.password', true); const a = await this.readAdministrator(), current = a.value;\n      if (!current || current.id !== id || current.disabled || current.generation !== m.generation) fail('version_conflict', 409);\n      const issued = this.subjects.get(c.subject!)!, slot = await this.findSession(issued.digest);\n      if (!slot?.value || !this.live(current, slot.value)) fail('forbidden', 403);\n      return {mutations: [mutation(a, 'administrator', {...current, passwordHash: hashed, temporary: false, generation: next(current.generation)}), mutation(slot, 'session', null)], result: undefined};\n    });\n  }\n}\nexport function createControl(host: ControlHostContext, dependencies: Dependencies = {}): LocalAccountsControl { return new LocalAccountsControl(host, dependencies); }\nexport const api = [\n  {path: '/password', methods: ['POST'], handler: 'changePassword'},\n  {path: '/logout', methods: ['POST'], handler: 'logout'},\n  {path: '/self', methods: ['GET'], handler: 'self'},\n  {path: '/session-policy', methods: ['GET', 'PUT'], handler: 'sessionPolicy'},\n] as const;\nexport const rpc = [], controlApi = api, controlRpc = rpc;\nexport async function recoverIdentity(input: unknown, context: {durableState: PluginDurableState}) {\n  const b = object(input); exact(b, ['username', 'newUsername', 'password', 'reason']);\n  const name = b.username === undefined ? undefined : username(b.username), p = password(b.password), newName = b.newUsername === undefined ? undefined : username(b.newUsername);\n  if (typeof b.reason !== 'string' || !b.reason.trim() || b.reason.length > 512) fail('invalid_reason');\n  const state = context.durableState; await readManagementSetup(state);\n  const record = await state.get('administrator'), prior = administratorValue(record);\n  if (prior && name !== undefined && prior.username !== name) fail('recovery_requires_existing_administrator');\n  const passwordHash = await Bun.password.hash(p, {algorithm: 'argon2id', memoryCost: 65536, timeCost: 3});\n  const administrator: Administrator = prior ? {...prior, username: newName ?? prior.username, passwordHash, disabled: false, temporary: false, generation: next(prior.generation), failureEpoch: next(prior.failureEpoch)} : {id: randomUUID(), username: newName ?? name ?? fail('invalid_input'), disabled: false, temporary: false, passwordHash, generation: 1, failureEpoch: 1};\n  const summary = await state.get('recovery-summary');\n  await state.transact([\n    {key: 'administrator', expectedVersion: record?.version ?? 0, value: asJson({schema: ACCOUNT_RECORD_SCHEMA, administrator})},\n    {key: 'recovery-summary', expectedVersion: summary?.version ?? 0, value: {schema: ACCOUNT_RECORD_SCHEMA, administratorId: administrator.id, reason: b.reason, at: Date.now()}},\n  ]);\n  return dto(administrator);\n}\nexport async function readManagementSetup(state: Pick<PluginDurableState, 'get' | 'list'>) {\n  for (const r of await state.list()) if (!['administrator', 'session-policy', 'recovery-summary'].includes(r.key) && !r.key.startsWith('session:') && !r.key.startsWith('failure:')) fail('account_migration_required', 503);\n  return {initialized: !!administratorValue(await state.get('administrator'))};\n}\nexport default {createControl, readManagementSetup, offlineRecovery: {kind: 'identity', recover: recoverIdentity}} satisfies ControlPlugin;\n",
+    "let USER_AGENT;\nif (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {\n    const NAME = 'oauth4webapi';\n    const VERSION = 'v3.8.8';\n    USER_AGENT = `${NAME}/${VERSION}`;\n}\nfunction looseInstanceOf(input, expected) {\n    if (input == null) {\n        return false;\n    }\n    try {\n        return (input instanceof expected ||\n            Object.getPrototypeOf(input)[Symbol.toStringTag] === expected.prototype[Symbol.toStringTag]);\n    }\n    catch {\n        return false;\n    }\n}\nconst ERR_INVALID_ARG_VALUE = 'ERR_INVALID_ARG_VALUE';\nconst ERR_INVALID_ARG_TYPE = 'ERR_INVALID_ARG_TYPE';\nfunction CodedTypeError(message, code, cause) {\n    const err = new TypeError(message, { cause });\n    Object.assign(err, { code });\n    return err;\n}\nexport const allowInsecureRequests = Symbol();\nexport const clockSkew = Symbol();\nexport const clockTolerance = Symbol();\nexport const customFetch = Symbol();\nexport const modifyAssertion = Symbol();\nexport const jweDecrypt = Symbol();\nexport const jwksCache = Symbol();\nconst encoder = new TextEncoder();\nconst decoder = new TextDecoder();\nfunction buf(input) {\n    if (typeof input === 'string') {\n        return encoder.encode(input);\n    }\n    return decoder.decode(input);\n}\nlet encodeBase64Url;\nif (Uint8Array.prototype.toBase64) {\n    encodeBase64Url = (input) => {\n        if (input instanceof ArrayBuffer) {\n            input = new Uint8Array(input);\n        }\n        return input.toBase64({ alphabet: 'base64url', omitPadding: true });\n    };\n}\nelse {\n    const CHUNK_SIZE = 0x8000;\n    encodeBase64Url = (input) => {\n        if (input instanceof ArrayBuffer) {\n            input = new Uint8Array(input);\n        }\n        const arr = [];\n        for (let i = 0; i < input.byteLength; i += CHUNK_SIZE) {\n            arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));\n        }\n        return btoa(arr.join('')).replace(/=/g, '').replace(/\\+/g, '-').replace(/\\//g, '_');\n    };\n}\nlet decodeBase64Url;\nif (Uint8Array.fromBase64) {\n    decodeBase64Url = (input) => {\n        try {\n            return Uint8Array.fromBase64(input, { alphabet: 'base64url' });\n        }\n        catch (cause) {\n            throw CodedTypeError('The input to be decoded is not correctly encoded.', ERR_INVALID_ARG_VALUE, cause);\n        }\n    };\n}\nelse {\n    decodeBase64Url = (input) => {\n        try {\n            const binary = atob(input.replace(/-/g, '+').replace(/_/g, '/').replace(/\\s/g, ''));\n            const bytes = new Uint8Array(binary.length);\n            for (let i = 0; i < binary.length; i++) {\n                bytes[i] = binary.charCodeAt(i);\n            }\n            return bytes;\n        }\n        catch (cause) {\n            throw CodedTypeError('The input to be decoded is not correctly encoded.', ERR_INVALID_ARG_VALUE, cause);\n        }\n    };\n}\nfunction b64u(input) {\n    if (typeof input === 'string') {\n        return decodeBase64Url(input);\n    }\n    return encodeBase64Url(input);\n}\nexport class UnsupportedOperationError extends Error {\n    code;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        this.code = UNSUPPORTED_OPERATION;\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class OperationProcessingError extends Error {\n    code;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        if (options?.code) {\n            this.code = options?.code;\n        }\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nfunction OPE(message, code, cause) {\n    return new OperationProcessingError(message, { code, cause });\n}\nasync function calculateJwkThumbprint(jwk) {\n    let components;\n    switch (jwk.kty) {\n        case 'EC':\n            components = {\n                crv: jwk.crv,\n                kty: jwk.kty,\n                x: jwk.x,\n                y: jwk.y,\n            };\n            break;\n        case 'OKP':\n            components = {\n                crv: jwk.crv,\n                kty: jwk.kty,\n                x: jwk.x,\n            };\n            break;\n        case 'AKP':\n            components = {\n                alg: jwk.alg,\n                kty: jwk.kty,\n                pub: jwk.pub,\n            };\n            break;\n        case 'RSA':\n            components = {\n                e: jwk.e,\n                kty: jwk.kty,\n                n: jwk.n,\n            };\n            break;\n        default:\n            throw new UnsupportedOperationError('unsupported JWK key type', { cause: jwk });\n    }\n    return b64u(await crypto.subtle.digest('SHA-256', buf(JSON.stringify(components))));\n}\nfunction assertCryptoKey(key, it) {\n    if (!(key instanceof CryptoKey)) {\n        throw CodedTypeError(`${it} must be a CryptoKey`, ERR_INVALID_ARG_TYPE);\n    }\n}\nfunction assertPrivateKey(key, it) {\n    assertCryptoKey(key, it);\n    if (key.type !== 'private') {\n        throw CodedTypeError(`${it} must be a private CryptoKey`, ERR_INVALID_ARG_VALUE);\n    }\n}\nfunction assertPublicKey(key, it) {\n    assertCryptoKey(key, it);\n    if (key.type !== 'public') {\n        throw CodedTypeError(`${it} must be a public CryptoKey`, ERR_INVALID_ARG_VALUE);\n    }\n}\nfunction normalizeTyp(value) {\n    return value.toLowerCase().replace(/^application\\//, '');\n}\nfunction isJsonObject(input) {\n    if (input === null || typeof input !== 'object' || Array.isArray(input)) {\n        return false;\n    }\n    return true;\n}\nfunction prepareHeaders(input) {\n    if (looseInstanceOf(input, Headers)) {\n        input = Object.fromEntries(input.entries());\n    }\n    const headers = new Headers(input ?? {});\n    if (USER_AGENT && !headers.has('user-agent')) {\n        headers.set('user-agent', USER_AGENT);\n    }\n    if (headers.has('authorization')) {\n        throw CodedTypeError('\"options.headers\" must not include the \"authorization\" header name', ERR_INVALID_ARG_VALUE);\n    }\n    return headers;\n}\nfunction signal(url, value) {\n    if (value !== undefined) {\n        if (typeof value === 'function') {\n            value = value(url.href);\n        }\n        if (!(value instanceof AbortSignal)) {\n            throw CodedTypeError('\"options.signal\" must return or be an instance of AbortSignal', ERR_INVALID_ARG_TYPE);\n        }\n        return value;\n    }\n    return undefined;\n}\nfunction replaceDoubleSlash(pathname) {\n    if (pathname.includes('//')) {\n        return pathname.replace('//', '/');\n    }\n    return pathname;\n}\nfunction prependWellKnown(url, wellKnown, allowTerminatingSlash = false) {\n    if (url.pathname === '/') {\n        url.pathname = wellKnown;\n    }\n    else {\n        url.pathname = replaceDoubleSlash(`${wellKnown}/${allowTerminatingSlash ? url.pathname : url.pathname.replace(/(\\/)$/, '')}`);\n    }\n    return url;\n}\nfunction appendWellKnown(url, wellKnown) {\n    url.pathname = replaceDoubleSlash(`${url.pathname}/${wellKnown}`);\n    return url;\n}\nasync function performDiscovery(input, urlName, transform, options) {\n    if (!(input instanceof URL)) {\n        throw CodedTypeError(`\"${urlName}\" must be an instance of URL`, ERR_INVALID_ARG_TYPE);\n    }\n    checkProtocol(input, options?.[allowInsecureRequests] !== true);\n    const url = transform(new URL(input.href));\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    return (options?.[customFetch] || fetch)(url.href, {\n        body: undefined,\n        headers: Object.fromEntries(headers.entries()),\n        method: 'GET',\n        redirect: 'manual',\n        signal: signal(url, options?.signal),\n    });\n}\nexport async function discoveryRequest(issuerIdentifier, options) {\n    return performDiscovery(issuerIdentifier, 'issuerIdentifier', (url) => {\n        switch (options?.algorithm) {\n            case undefined:\n            case 'oidc':\n                appendWellKnown(url, '.well-known/openid-configuration');\n                break;\n            case 'oauth2':\n                prependWellKnown(url, '.well-known/oauth-authorization-server');\n                break;\n            default:\n                throw CodedTypeError('\"options.algorithm\" must be \"oidc\" (default), or \"oauth2\"', ERR_INVALID_ARG_VALUE);\n        }\n        return url;\n    }, options);\n}\nfunction assertNumber(input, allow0, it, code, cause) {\n    try {\n        if (typeof input !== 'number' || !Number.isFinite(input)) {\n            throw CodedTypeError(`${it} must be a number`, ERR_INVALID_ARG_TYPE, cause);\n        }\n        if (input > 0)\n            return;\n        if (allow0) {\n            if (input !== 0) {\n                throw CodedTypeError(`${it} must be a non-negative number`, ERR_INVALID_ARG_VALUE, cause);\n            }\n            return;\n        }\n        throw CodedTypeError(`${it} must be a positive number`, ERR_INVALID_ARG_VALUE, cause);\n    }\n    catch (err) {\n        if (code) {\n            throw OPE(err.message, code, cause);\n        }\n        throw err;\n    }\n}\nfunction assertString(input, it, code, cause) {\n    try {\n        if (typeof input !== 'string') {\n            throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE, cause);\n        }\n        if (input.length === 0) {\n            throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE, cause);\n        }\n    }\n    catch (err) {\n        if (code) {\n            throw OPE(err.message, code, cause);\n        }\n        throw err;\n    }\n}\nexport async function processDiscoveryResponse(expectedIssuerIdentifier, response) {\n    const expected = expectedIssuerIdentifier;\n    if (!(expected instanceof URL) && expected !== _nodiscoverycheck) {\n        throw CodedTypeError('\"expectedIssuerIdentifier\" must be an instance of URL', ERR_INVALID_ARG_TYPE);\n    }\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    if (response.status !== 200) {\n        throw OPE('\"response\" is not a conform Authorization Server Metadata response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);\n    }\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.issuer, '\"response\" body \"issuer\" property', INVALID_RESPONSE, { body: json });\n    if (expected !== _nodiscoverycheck && new URL(json.issuer).href !== expected.href) {\n        throw OPE('\"response\" body \"issuer\" property does not match the expected value', JSON_ATTRIBUTE_COMPARISON, { expected: expected.href, body: json, attribute: 'issuer' });\n    }\n    return json;\n}\nfunction assertApplicationJson(response) {\n    assertContentType(response, 'application/json');\n}\nfunction notJson(response, ...types) {\n    let msg = '\"response\" content-type must be ';\n    if (types.length > 2) {\n        const last = types.pop();\n        msg += `${types.join(', ')}, or ${last}`;\n    }\n    else if (types.length === 2) {\n        msg += `${types[0]} or ${types[1]}`;\n    }\n    else {\n        msg += types[0];\n    }\n    return OPE(msg, RESPONSE_IS_NOT_JSON, response);\n}\nfunction assertContentTypes(response, ...types) {\n    if (!types.includes(getContentType(response))) {\n        throw notJson(response, ...types);\n    }\n}\nfunction assertContentType(response, contentType) {\n    if (getContentType(response) !== contentType) {\n        throw notJson(response, contentType);\n    }\n}\nfunction randomBytes() {\n    return b64u(crypto.getRandomValues(new Uint8Array(32)));\n}\nexport function generateRandomCodeVerifier() {\n    return randomBytes();\n}\nexport function generateRandomState() {\n    return randomBytes();\n}\nexport function generateRandomNonce() {\n    return randomBytes();\n}\nexport async function calculatePKCECodeChallenge(codeVerifier) {\n    assertString(codeVerifier, 'codeVerifier');\n    return b64u(await crypto.subtle.digest('SHA-256', buf(codeVerifier)));\n}\nfunction getKeyAndKid(input) {\n    if (input instanceof CryptoKey) {\n        return { key: input };\n    }\n    if (!(input?.key instanceof CryptoKey)) {\n        return {};\n    }\n    if (input.kid !== undefined) {\n        assertString(input.kid, '\"kid\"');\n    }\n    return {\n        key: input.key,\n        kid: input.kid,\n    };\n}\nfunction psAlg(key) {\n    switch (key.algorithm.hash.name) {\n        case 'SHA-256':\n            return 'PS256';\n        case 'SHA-384':\n            return 'PS384';\n        case 'SHA-512':\n            return 'PS512';\n        default:\n            throw new UnsupportedOperationError('unsupported RsaHashedKeyAlgorithm hash name', {\n                cause: key,\n            });\n    }\n}\nfunction rsAlg(key) {\n    switch (key.algorithm.hash.name) {\n        case 'SHA-256':\n            return 'RS256';\n        case 'SHA-384':\n            return 'RS384';\n        case 'SHA-512':\n            return 'RS512';\n        default:\n            throw new UnsupportedOperationError('unsupported RsaHashedKeyAlgorithm hash name', {\n                cause: key,\n            });\n    }\n}\nfunction esAlg(key) {\n    switch (key.algorithm.namedCurve) {\n        case 'P-256':\n            return 'ES256';\n        case 'P-384':\n            return 'ES384';\n        case 'P-521':\n            return 'ES512';\n        default:\n            throw new UnsupportedOperationError('unsupported EcKeyAlgorithm namedCurve', { cause: key });\n    }\n}\nfunction keyToJws(key) {\n    switch (key.algorithm.name) {\n        case 'RSA-PSS':\n            return psAlg(key);\n        case 'RSASSA-PKCS1-v1_5':\n            return rsAlg(key);\n        case 'ECDSA':\n            return esAlg(key);\n        case 'Ed25519':\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            return key.algorithm.name;\n        case 'EdDSA':\n            return 'Ed25519';\n        default:\n            throw new UnsupportedOperationError('unsupported CryptoKey algorithm name', { cause: key });\n    }\n}\nfunction getClockSkew(client) {\n    const skew = client?.[clockSkew];\n    return typeof skew === 'number' && Number.isFinite(skew) ? skew : 0;\n}\nfunction getClockTolerance(client) {\n    const tolerance = client?.[clockTolerance];\n    return typeof tolerance === 'number' && Number.isFinite(tolerance) && Math.sign(tolerance) !== -1\n        ? tolerance\n        : 30;\n}\nfunction epochTime() {\n    return Math.floor(Date.now() / 1000);\n}\nfunction assertAs(as) {\n    if (typeof as !== 'object' || as === null) {\n        throw CodedTypeError('\"as\" must be an object', ERR_INVALID_ARG_TYPE);\n    }\n    assertString(as.issuer, '\"as.issuer\"');\n}\nfunction assertClient(client) {\n    if (typeof client !== 'object' || client === null) {\n        throw CodedTypeError('\"client\" must be an object', ERR_INVALID_ARG_TYPE);\n    }\n    assertString(client.client_id, '\"client.client_id\"');\n}\nfunction formUrlEncode(token) {\n    return encodeURIComponent(token).replace(/(?:[-_.!~*'()]|%20)/g, (substring) => {\n        switch (substring) {\n            case '-':\n            case '_':\n            case '.':\n            case '!':\n            case '~':\n            case '*':\n            case \"'\":\n            case '(':\n            case ')':\n                return `%${substring.charCodeAt(0).toString(16).toUpperCase()}`;\n            case '%20':\n                return '+';\n            default:\n                throw new Error();\n        }\n    });\n}\nexport function ClientSecretPost(clientSecret) {\n    assertString(clientSecret, '\"clientSecret\"');\n    return (_as, client, body, _headers) => {\n        body.set('client_id', client.client_id);\n        body.set('client_secret', clientSecret);\n    };\n}\nexport function ClientSecretBasic(clientSecret) {\n    assertString(clientSecret, '\"clientSecret\"');\n    return (_as, client, _body, headers) => {\n        const username = formUrlEncode(client.client_id);\n        const password = formUrlEncode(clientSecret);\n        const credentials = btoa(`${username}:${password}`);\n        headers.set('authorization', `Basic ${credentials}`);\n    };\n}\nfunction clientAssertionPayload(as, client) {\n    const now = epochTime() + getClockSkew(client);\n    return {\n        jti: randomBytes(),\n        aud: as.issuer,\n        exp: now + 60,\n        iat: now,\n        nbf: now,\n        iss: client.client_id,\n        sub: client.client_id,\n    };\n}\nexport function PrivateKeyJwt(clientPrivateKey, options) {\n    const { key, kid } = getKeyAndKid(clientPrivateKey);\n    assertPrivateKey(key, '\"clientPrivateKey.key\"');\n    return async (as, client, body, _headers) => {\n        const header = { alg: keyToJws(key), kid };\n        const payload = clientAssertionPayload(as, client);\n        options?.[modifyAssertion]?.(header, payload);\n        body.set('client_id', client.client_id);\n        body.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');\n        body.set('client_assertion', await signJwt(header, payload, key));\n    };\n}\nexport function ClientSecretJwt(clientSecret, options) {\n    assertString(clientSecret, '\"clientSecret\"');\n    const modify = options?.[modifyAssertion];\n    let key;\n    return async (as, client, body, _headers) => {\n        key ||= await crypto.subtle.importKey('raw', buf(clientSecret), { hash: 'SHA-256', name: 'HMAC' }, false, ['sign']);\n        const header = { alg: 'HS256' };\n        const payload = clientAssertionPayload(as, client);\n        modify?.(header, payload);\n        const data = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(payload)))}`;\n        const hmac = await crypto.subtle.sign(key.algorithm, key, buf(data));\n        body.set('client_id', client.client_id);\n        body.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');\n        body.set('client_assertion', `${data}.${b64u(new Uint8Array(hmac))}`);\n    };\n}\nexport function None() {\n    return (_as, client, body, _headers) => {\n        body.set('client_id', client.client_id);\n    };\n}\nexport function TlsClientAuth() {\n    return None();\n}\nasync function signJwt(header, payload, key) {\n    if (!key.usages.includes('sign')) {\n        throw CodedTypeError('CryptoKey instances used for signing assertions must include \"sign\" in their \"usages\"', ERR_INVALID_ARG_VALUE);\n    }\n    const input = `${b64u(buf(JSON.stringify(header)))}.${b64u(buf(JSON.stringify(payload)))}`;\n    const signature = b64u(await crypto.subtle.sign(keyToSubtle(key), key, buf(input)));\n    return `${input}.${signature}`;\n}\nexport async function issueRequestObject(as, client, parameters, privateKey, options) {\n    assertAs(as);\n    assertClient(client);\n    parameters = new URLSearchParams(parameters);\n    const { key, kid } = getKeyAndKid(privateKey);\n    assertPrivateKey(key, '\"privateKey.key\"');\n    parameters.set('client_id', client.client_id);\n    const now = epochTime() + getClockSkew(client);\n    const claims = {\n        ...Object.fromEntries(parameters.entries()),\n        jti: randomBytes(),\n        aud: as.issuer,\n        exp: now + 60,\n        iat: now,\n        nbf: now,\n        iss: client.client_id,\n    };\n    let resource;\n    if (parameters.has('resource') &&\n        (resource = parameters.getAll('resource')) &&\n        resource.length > 1) {\n        claims.resource = resource;\n    }\n    {\n        let value = parameters.get('max_age');\n        if (value !== null) {\n            claims.max_age = parseInt(value, 10);\n            assertNumber(claims.max_age, true, '\"max_age\" parameter');\n        }\n    }\n    {\n        let value = parameters.get('claims');\n        if (value !== null) {\n            try {\n                claims.claims = JSON.parse(value);\n            }\n            catch (cause) {\n                throw OPE('failed to parse the \"claims\" parameter as JSON', PARSE_ERROR, cause);\n            }\n            if (!isJsonObject(claims.claims)) {\n                throw CodedTypeError('\"claims\" parameter must be a JSON with a top level object', ERR_INVALID_ARG_VALUE);\n            }\n        }\n    }\n    {\n        let value = parameters.get('authorization_details');\n        if (value !== null) {\n            try {\n                claims.authorization_details = JSON.parse(value);\n            }\n            catch (cause) {\n                throw OPE('failed to parse the \"authorization_details\" parameter as JSON', PARSE_ERROR, cause);\n            }\n            if (!Array.isArray(claims.authorization_details)) {\n                throw CodedTypeError('\"authorization_details\" parameter must be a JSON with a top level array', ERR_INVALID_ARG_VALUE);\n            }\n        }\n    }\n    const header = {\n        alg: keyToJws(key),\n        typ: 'oauth-authz-req+jwt',\n        kid,\n    };\n    options?.[modifyAssertion]?.(header, claims);\n    return signJwt(header, claims, key);\n}\nlet jwkCache;\nasync function getSetPublicJwkCache(key, alg) {\n    const { kty, e, n, x, y, crv, pub } = await crypto.subtle.exportKey('jwk', key);\n    const jwk = { kty, e, n, x, y, crv, pub };\n    if (kty === 'AKP')\n        jwk.alg = alg;\n    jwkCache.set(key, jwk);\n    return jwk;\n}\nasync function publicJwk(key, alg) {\n    jwkCache ||= new WeakMap();\n    return jwkCache.get(key) || getSetPublicJwkCache(key, alg);\n}\nconst URLParse = URL.parse\n    ?\n        (url, base) => URL.parse(url, base)\n    : (url, base) => {\n        try {\n            return new URL(url, base);\n        }\n        catch {\n            return null;\n        }\n    };\nexport function checkProtocol(url, enforceHttps) {\n    if (enforceHttps && url.protocol !== 'https:') {\n        throw OPE('only requests to HTTPS are allowed', HTTP_REQUEST_FORBIDDEN, url);\n    }\n    if (url.protocol !== 'https:' && url.protocol !== 'http:') {\n        throw OPE('only HTTP and HTTPS requests are allowed', REQUEST_PROTOCOL_FORBIDDEN, url);\n    }\n}\nfunction validateEndpoint(value, endpoint, useMtlsAlias, enforceHttps) {\n    let url;\n    if (typeof value !== 'string' || !(url = URLParse(value))) {\n        throw OPE(`authorization server metadata does not contain a valid ${useMtlsAlias ? `\"as.mtls_endpoint_aliases.${endpoint}\"` : `\"as.${endpoint}\"`}`, value === undefined ? MISSING_SERVER_METADATA : INVALID_SERVER_METADATA, { attribute: useMtlsAlias ? `mtls_endpoint_aliases.${endpoint}` : endpoint });\n    }\n    checkProtocol(url, enforceHttps);\n    return url;\n}\nexport function resolveEndpoint(as, endpoint, useMtlsAlias, enforceHttps) {\n    if (useMtlsAlias && as.mtls_endpoint_aliases && endpoint in as.mtls_endpoint_aliases) {\n        return validateEndpoint(as.mtls_endpoint_aliases[endpoint], endpoint, useMtlsAlias, enforceHttps);\n    }\n    return validateEndpoint(as[endpoint], endpoint, useMtlsAlias, enforceHttps);\n}\nexport async function pushedAuthorizationRequest(as, client, clientAuthentication, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'pushed_authorization_request_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(parameters);\n    body.set('client_id', client.client_id);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    if (options?.DPoP !== undefined) {\n        assertDPoP(options.DPoP);\n        await options.DPoP.addProof(url, headers, 'POST');\n    }\n    const response = await authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n    options?.DPoP?.cacheNonce(response, url);\n    return response;\n}\nclass DPoPHandler {\n    #header;\n    #privateKey;\n    #publicKey;\n    #clockSkew;\n    #modifyAssertion;\n    #map;\n    #jkt;\n    constructor(client, keyPair, options) {\n        assertPrivateKey(keyPair?.privateKey, '\"DPoP.privateKey\"');\n        assertPublicKey(keyPair?.publicKey, '\"DPoP.publicKey\"');\n        if (!keyPair.publicKey.extractable) {\n            throw CodedTypeError('\"DPoP.publicKey.extractable\" must be true', ERR_INVALID_ARG_VALUE);\n        }\n        this.#modifyAssertion = options?.[modifyAssertion];\n        this.#clockSkew = getClockSkew(client);\n        this.#privateKey = keyPair.privateKey;\n        this.#publicKey = keyPair.publicKey;\n        branded.add(this);\n    }\n    #get(key) {\n        this.#map ||= new Map();\n        let item = this.#map.get(key);\n        if (item) {\n            this.#map.delete(key);\n            this.#map.set(key, item);\n        }\n        return item;\n    }\n    #set(key, val) {\n        this.#map ||= new Map();\n        this.#map.delete(key);\n        if (this.#map.size === 100) {\n            this.#map.delete(this.#map.keys().next().value);\n        }\n        this.#map.set(key, val);\n    }\n    async calculateThumbprint() {\n        if (!this.#jkt) {\n            const jwk = await crypto.subtle.exportKey('jwk', this.#publicKey);\n            this.#jkt ||= await calculateJwkThumbprint(jwk);\n        }\n        return this.#jkt;\n    }\n    async addProof(url, headers, htm, accessToken) {\n        const alg = keyToJws(this.#privateKey);\n        this.#header ||= {\n            alg,\n            typ: 'dpop+jwt',\n            jwk: await publicJwk(this.#publicKey, alg),\n        };\n        const nonce = this.#get(url.origin);\n        const now = epochTime() + this.#clockSkew;\n        const payload = {\n            iat: now,\n            jti: randomBytes(),\n            htm,\n            nonce,\n            htu: `${url.origin}${url.pathname}`,\n            ath: accessToken\n                ? b64u(await crypto.subtle.digest('SHA-256', buf(accessToken)))\n                : undefined,\n        };\n        this.#modifyAssertion?.(this.#header, payload);\n        headers.set('dpop', await signJwt(this.#header, payload, this.#privateKey));\n    }\n    cacheNonce(response, url) {\n        try {\n            const nonce = response.headers.get('dpop-nonce');\n            if (nonce) {\n                this.#set(url.origin, nonce);\n            }\n        }\n        catch { }\n    }\n}\nexport function isDPoPNonceError(err) {\n    if (err instanceof WWWAuthenticateChallengeError) {\n        return err.cause.some((challenge) => challenge.scheme === 'dpop' && challenge.parameters.error === 'use_dpop_nonce');\n    }\n    if (err instanceof ResponseBodyError) {\n        return err.error === 'use_dpop_nonce';\n    }\n    return false;\n}\nexport function DPoP(client, keyPair, options) {\n    return new DPoPHandler(client, keyPair, options);\n}\nexport class ResponseBodyError extends Error {\n    cause;\n    code;\n    error;\n    status;\n    error_description;\n    response;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        this.code = RESPONSE_BODY_ERROR;\n        this.cause = options.cause;\n        this.error = options.cause.error;\n        this.status = options.response.status;\n        this.error_description = options.cause.error_description;\n        Object.defineProperty(this, 'response', { enumerable: false, value: options.response });\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class AuthorizationResponseError extends Error {\n    cause;\n    code;\n    error;\n    error_description;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        this.code = AUTHORIZATION_RESPONSE_ERROR;\n        this.cause = options.cause;\n        this.error = options.cause.get('error');\n        this.error_description = options.cause.get('error_description') ?? undefined;\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nexport class WWWAuthenticateChallengeError extends Error {\n    cause;\n    code;\n    response;\n    status;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        this.code = WWW_AUTHENTICATE_CHALLENGE;\n        this.cause = options.cause;\n        this.status = options.response.status;\n        this.response = options.response;\n        Object.defineProperty(this, 'response', { enumerable: false });\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nconst tokenMatch = \"[a-zA-Z0-9!#$%&\\\\'\\\\*\\\\+\\\\-\\\\.\\\\^_`\\\\|~]+\";\nconst token68Match = '[a-zA-Z0-9\\\\-\\\\._\\\\~\\\\+\\\\/]+={0,2}';\nconst quotedMatch = '\"((?:[^\"\\\\\\\\]|\\\\\\\\[\\\\s\\\\S])*)\"';\nconst quotedParamMatcher = '(' + tokenMatch + ')\\\\s*=\\\\s*' + quotedMatch;\nconst paramMatcher = '(' + tokenMatch + ')\\\\s*=\\\\s*(' + tokenMatch + ')';\nconst schemeRE = new RegExp('^[,\\\\s]*(' + tokenMatch + ')');\nconst quotedParamRE = new RegExp('^[,\\\\s]*' + quotedParamMatcher + '[,\\\\s]*(.*)');\nconst unquotedParamRE = new RegExp('^[,\\\\s]*' + paramMatcher + '[,\\\\s]*(.*)');\nconst token68ParamRE = new RegExp('^(' + token68Match + ')(?:$|[,\\\\s])(.*)');\nfunction parseWwwAuthenticateChallenges(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    const header = response.headers.get('www-authenticate');\n    if (header === null) {\n        return undefined;\n    }\n    const challenges = [];\n    let rest = header;\n    while (rest) {\n        let match = rest.match(schemeRE);\n        const scheme = match?.['1'].toLowerCase();\n        if (!scheme) {\n            return undefined;\n        }\n        const afterScheme = rest.substring(match[0].length);\n        if (afterScheme && !afterScheme.match(/^[\\s,]/)) {\n            return undefined;\n        }\n        const spaceMatch = afterScheme.match(/^\\s+(.*)$/);\n        const hasParameters = !!spaceMatch;\n        rest = spaceMatch ? spaceMatch[1] : undefined;\n        const parameters = {};\n        let token68;\n        if (hasParameters) {\n            while (rest) {\n                let key;\n                let value;\n                if ((match = rest.match(quotedParamRE))) {\n                    ;\n                    [, key, value, rest] = match;\n                    if (value.includes('\\\\')) {\n                        value = value.replace(/\\\\([\\s\\S])/g, '$1');\n                    }\n                    parameters[key.toLowerCase()] = value;\n                    continue;\n                }\n                if ((match = rest.match(unquotedParamRE))) {\n                    ;\n                    [, key, value, rest] = match;\n                    parameters[key.toLowerCase()] = value;\n                    continue;\n                }\n                if ((match = rest.match(token68ParamRE))) {\n                    if (Object.keys(parameters).length) {\n                        break;\n                    }\n                    ;\n                    [, token68, rest] = match;\n                    break;\n                }\n                return undefined;\n            }\n        }\n        else {\n            rest = afterScheme || undefined;\n        }\n        const challenge = { scheme, parameters };\n        if (token68) {\n            challenge.token68 = token68;\n        }\n        challenges.push(challenge);\n    }\n    if (!challenges.length) {\n        return undefined;\n    }\n    return challenges;\n}\nexport async function processPushedAuthorizationResponse(as, client, response) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 201, 'Pushed Authorization Request Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.request_uri, '\"response\" body \"request_uri\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    let expiresIn = typeof json.expires_in !== 'number' ? parseFloat(json.expires_in) : json.expires_in;\n    assertNumber(expiresIn, true, '\"response\" body \"expires_in\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    json.expires_in = expiresIn;\n    return json;\n}\nasync function parseOAuthResponseErrorBody(response) {\n    if (response.status > 399 && response.status < 500) {\n        assertReadableResponse(response);\n        assertApplicationJson(response);\n        try {\n            const json = await response.clone().json();\n            if (isJsonObject(json) && typeof json.error === 'string' && json.error.length) {\n                return json;\n            }\n        }\n        catch { }\n    }\n    return undefined;\n}\nasync function checkOAuthBodyError(response, expected, label) {\n    if (response.status !== expected) {\n        checkAuthenticationChallenges(response);\n        let err;\n        if ((err = await parseOAuthResponseErrorBody(response))) {\n            await response.body?.cancel();\n            throw new ResponseBodyError('server responded with an error in the response body', {\n                cause: err,\n                response,\n            });\n        }\n        throw OPE(`\"response\" is not a conform ${label} response (unexpected HTTP status code)`, RESPONSE_IS_NOT_CONFORM, response);\n    }\n}\nfunction assertDPoP(option) {\n    if (!branded.has(option)) {\n        throw CodedTypeError('\"options.DPoP\" is not a valid DPoPHandle', ERR_INVALID_ARG_VALUE);\n    }\n}\nasync function resourceRequest(accessToken, method, url, headers, body, options) {\n    assertString(accessToken, '\"accessToken\"');\n    if (!(url instanceof URL)) {\n        throw CodedTypeError('\"url\" must be an instance of URL', ERR_INVALID_ARG_TYPE);\n    }\n    checkProtocol(url, options?.[allowInsecureRequests] !== true);\n    headers = prepareHeaders(headers);\n    if (options?.DPoP) {\n        assertDPoP(options.DPoP);\n        await options.DPoP.addProof(url, headers, method.toUpperCase(), accessToken);\n    }\n    headers.set('authorization', `${headers.has('dpop') ? 'DPoP' : 'Bearer'} ${accessToken}`);\n    const response = await (options?.[customFetch] || fetch)(url.href, {\n        duplex: looseInstanceOf(body, ReadableStream) ? 'half' : undefined,\n        body,\n        headers: Object.fromEntries(headers.entries()),\n        method,\n        redirect: 'manual',\n        signal: signal(url, options?.signal),\n    });\n    options?.DPoP?.cacheNonce(response, url);\n    return response;\n}\nexport async function protectedResourceRequest(accessToken, method, url, headers, body, options) {\n    const response = await resourceRequest(accessToken, method, url, headers, body, options);\n    checkAuthenticationChallenges(response);\n    return response;\n}\nexport async function userInfoRequest(as, client, accessToken, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'userinfo_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const headers = prepareHeaders(options?.headers);\n    if (client.userinfo_signed_response_alg) {\n        headers.set('accept', 'application/jwt');\n    }\n    else {\n        headers.set('accept', 'application/json');\n        headers.append('accept', 'application/jwt');\n    }\n    return resourceRequest(accessToken, 'GET', url, headers, null, {\n        ...options,\n        [clockSkew]: getClockSkew(client),\n    });\n}\nlet jwksMap;\nlet jwksRequests;\nlet jwksKeys;\nfunction setJwksCache(as, jwks, uat, cache) {\n    jwksMap ||= new WeakMap();\n    jwksMap.set(as, {\n        jwks,\n        uat,\n        get age() {\n            return epochTime() - this.uat;\n        },\n    });\n    if (cache) {\n        Object.assign(cache, { jwks: structuredClone(jwks), uat });\n    }\n}\nfunction isFreshJwksCache(input) {\n    if (typeof input !== 'object' || input === null) {\n        return false;\n    }\n    if (!('uat' in input) || typeof input.uat !== 'number' || epochTime() - input.uat >= 300) {\n        return false;\n    }\n    if (!('jwks' in input) ||\n        !isJsonObject(input.jwks) ||\n        !Array.isArray(input.jwks.keys) ||\n        !Array.prototype.every.call(input.jwks.keys, isJsonObject)) {\n        return false;\n    }\n    return true;\n}\nfunction clearJwksCache(as, cache) {\n    jwksMap?.delete(as);\n    delete cache?.jwks;\n    delete cache?.uat;\n}\nasync function getPublicSigKeyFromIssuerJwksUri(as, options, header) {\n    const { alg, kid } = header;\n    checkSupportedJwsAlg(header);\n    if (!jwksMap?.has(as) && isFreshJwksCache(options?.[jwksCache])) {\n        setJwksCache(as, options?.[jwksCache].jwks, options?.[jwksCache].uat);\n    }\n    let jwks;\n    let age;\n    if (jwksMap?.has(as)) {\n        ;\n        ({ jwks, age } = jwksMap.get(as));\n        if (age >= 300) {\n            clearJwksCache(as, options?.[jwksCache]);\n            return getPublicSigKeyFromIssuerJwksUri(as, options, header);\n        }\n    }\n    else {\n        const downloaded = await jwksRequest(as, options);\n        jwks = downloaded.jwks;\n        age = epochTime() - downloaded.uat;\n        setJwksCache(as, jwks, downloaded.uat, options?.[jwksCache]);\n    }\n    let kty;\n    switch (alg.slice(0, 2)) {\n        case 'RS':\n        case 'PS':\n            kty = 'RSA';\n            break;\n        case 'ES':\n            kty = 'EC';\n            break;\n        case 'Ed':\n            kty = 'OKP';\n            break;\n        case 'ML':\n            kty = 'AKP';\n            break;\n        default:\n            throw new UnsupportedOperationError('unsupported JWS algorithm', { cause: { alg } });\n    }\n    const candidates = jwks.keys.filter((jwk) => {\n        if (jwk.kty !== kty) {\n            return false;\n        }\n        if (kid !== undefined && kid !== jwk.kid) {\n            return false;\n        }\n        if (jwk.alg !== undefined && alg !== jwk.alg) {\n            return false;\n        }\n        if (jwk.use !== undefined && jwk.use !== 'sig') {\n            return false;\n        }\n        if (jwk.key_ops?.includes('verify') === false) {\n            return false;\n        }\n        switch (true) {\n            case alg === 'ES256' && jwk.crv !== 'P-256':\n            case alg === 'ES384' && jwk.crv !== 'P-384':\n            case alg === 'ES512' && jwk.crv !== 'P-521':\n            case alg === 'Ed25519' && jwk.crv !== 'Ed25519':\n            case alg === 'EdDSA' && jwk.crv !== 'Ed25519':\n                return false;\n        }\n        return true;\n    });\n    const { 0: jwk, length } = candidates;\n    if (!length) {\n        if (age >= 60) {\n            clearJwksCache(as, options?.[jwksCache]);\n            return getPublicSigKeyFromIssuerJwksUri(as, options, header);\n        }\n        throw OPE('error when selecting a JWT verification key, no applicable keys found', KEY_SELECTION, { header, candidates, jwks_uri: new URL(as.jwks_uri) });\n    }\n    if (length !== 1) {\n        throw OPE('error when selecting a JWT verification key, multiple applicable keys found, a \"kid\" JWT Header Parameter is required', KEY_SELECTION, { header, candidates, jwks_uri: new URL(as.jwks_uri) });\n    }\n    jwksKeys ||= new WeakMap();\n    let keys = jwksKeys.get(jwk);\n    if (!keys) {\n        keys = new Map();\n        jwksKeys.set(jwk, keys);\n    }\n    let key = keys.get(alg);\n    if (!key) {\n        key = importJwk(alg, jwk).catch((cause) => {\n            keys.delete(alg);\n            throw cause;\n        });\n        keys.set(alg, key);\n    }\n    return key;\n}\nexport const skipSubjectCheck = Symbol();\nexport function getContentType(input) {\n    return input.headers.get('content-type')?.split(';')[0];\n}\nexport async function processUserInfoResponse(as, client, expectedSubject, response, options) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    checkAuthenticationChallenges(response);\n    if (response.status !== 200) {\n        throw OPE('\"response\" is not a conform UserInfo Endpoint response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);\n    }\n    assertReadableResponse(response);\n    let json;\n    if (getContentType(response) === 'application/jwt') {\n        const { claims, jwt } = await validateJwt(await response.text(), checkSigningAlgorithm.bind(undefined, client.userinfo_signed_response_alg, as.userinfo_signing_alg_values_supported, undefined), getClockSkew(client), getClockTolerance(client), options?.[jweDecrypt])\n            .then(validateOptionalAudience.bind(undefined, client.client_id))\n            .then(validateOptionalIssuer.bind(undefined, as));\n        jwtRefs.set(response, jwt);\n        json = claims;\n    }\n    else {\n        if (client.userinfo_signed_response_alg) {\n            throw OPE('JWT UserInfo Response expected', JWT_USERINFO_EXPECTED, response);\n        }\n        json = await getResponseJsonBody(response);\n    }\n    assertString(json.sub, '\"response\" body \"sub\" property', INVALID_RESPONSE, { body: json });\n    switch (expectedSubject) {\n        case skipSubjectCheck:\n            break;\n        default:\n            assertString(expectedSubject, '\"expectedSubject\"');\n            if (json.sub !== expectedSubject) {\n                throw OPE('unexpected \"response\" body \"sub\" property value', JSON_ATTRIBUTE_COMPARISON, {\n                    expected: expectedSubject,\n                    body: json,\n                    attribute: 'sub',\n                });\n            }\n    }\n    return json;\n}\nasync function authenticatedRequest(as, client, clientAuthentication, url, body, headers, options) {\n    await clientAuthentication(as, client, body, headers);\n    headers.set('content-type', 'application/x-www-form-urlencoded;charset=UTF-8');\n    return (options?.[customFetch] || fetch)(url.href, {\n        body,\n        headers: Object.fromEntries(headers.entries()),\n        method: 'POST',\n        redirect: 'manual',\n        signal: signal(url, options?.signal),\n    });\n}\nasync function tokenEndpointRequest(as, client, clientAuthentication, grantType, parameters, options) {\n    const url = resolveEndpoint(as, 'token_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    parameters.set('grant_type', grantType);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    if (options?.DPoP !== undefined) {\n        assertDPoP(options.DPoP);\n        await options.DPoP.addProof(url, headers, 'POST');\n    }\n    const response = await authenticatedRequest(as, client, clientAuthentication, url, parameters, headers, options);\n    options?.DPoP?.cacheNonce(response, url);\n    return response;\n}\nexport async function refreshTokenGrantRequest(as, client, clientAuthentication, refreshToken, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(refreshToken, '\"refreshToken\"');\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('refresh_token', refreshToken);\n    return tokenEndpointRequest(as, client, clientAuthentication, 'refresh_token', parameters, options);\n}\nconst idTokenClaims = new WeakMap();\nconst jwtRefs = new WeakMap();\nexport function getValidatedIdTokenClaims(ref) {\n    if (!ref.id_token) {\n        return undefined;\n    }\n    const claims = idTokenClaims.get(ref);\n    if (!claims) {\n        throw CodedTypeError('\"ref\" was already garbage collected or did not resolve from the proper sources', ERR_INVALID_ARG_VALUE);\n    }\n    return claims;\n}\nexport async function validateApplicationLevelSignature(as, ref, options) {\n    assertAs(as);\n    if (!jwtRefs.has(ref)) {\n        throw CodedTypeError('\"ref\" does not contain a processed JWT Response to verify the signature of', ERR_INVALID_ARG_VALUE);\n    }\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = jwtRefs.get(ref).split('.');\n    const header = JSON.parse(buf(b64u(protectedHeader)));\n    if (header.alg.startsWith('HS')) {\n        throw new UnsupportedOperationError('unsupported JWS algorithm', { cause: { alg: header.alg } });\n    }\n    let key;\n    key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);\n    await validateJwsSignature(protectedHeader, payload, key, b64u(encodedSignature));\n}\nasync function processGenericAccessTokenResponse(as, client, response, additionalRequiredIdTokenClaims, decryptFn, recognizedTokenTypes) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Token Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.access_token, '\"response\" body \"access_token\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    assertString(json.token_type, '\"response\" body \"token_type\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    json.token_type = json.token_type.toLowerCase();\n    if (json.expires_in !== undefined) {\n        let expiresIn = typeof json.expires_in !== 'number' ? parseFloat(json.expires_in) : json.expires_in;\n        assertNumber(expiresIn, true, '\"response\" body \"expires_in\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n        json.expires_in = expiresIn;\n    }\n    if (json.refresh_token !== undefined) {\n        assertString(json.refresh_token, '\"response\" body \"refresh_token\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    if (json.scope !== undefined && typeof json.scope !== 'string') {\n        throw OPE('\"response\" body \"scope\" property must be a string', INVALID_RESPONSE, { body: json });\n    }\n    if (json.id_token !== undefined) {\n        assertString(json.id_token, '\"response\" body \"id_token\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n        const requiredClaims = [];\n        if (client.require_auth_time === true) {\n            requiredClaims.push('auth_time');\n        }\n        if (client.default_max_age !== undefined) {\n            assertNumber(client.default_max_age, true, '\"client.default_max_age\"');\n            requiredClaims.push('auth_time');\n        }\n        if (additionalRequiredIdTokenClaims?.length) {\n            requiredClaims.push(...additionalRequiredIdTokenClaims);\n        }\n        const { claims, jwt } = await validateIdTokenClaims(as, client, json.id_token, requiredClaims, decryptFn);\n        validateIdTokenAuthorizedParty(client, claims);\n        validateIdTokenAuthTimeClaim(claims);\n        jwtRefs.set(response, jwt);\n        idTokenClaims.set(json, claims);\n    }\n    if (recognizedTokenTypes?.[json.token_type] !== undefined) {\n        recognizedTokenTypes[json.token_type](response, json);\n    }\n    else if (json.token_type !== 'dpop' && json.token_type !== 'bearer') {\n        throw new UnsupportedOperationError('unsupported `token_type` value', { cause: { body: json } });\n    }\n    return json;\n}\nfunction checkAuthenticationChallenges(response) {\n    let challenges;\n    if ((challenges = parseWwwAuthenticateChallenges(response))) {\n        throw new WWWAuthenticateChallengeError('server responded with a challenge in the WWW-Authenticate HTTP Header', { cause: challenges, response });\n    }\n}\nexport async function processRefreshTokenResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nfunction validateOptionalAudience(expected, result) {\n    if (result.claims.aud !== undefined) {\n        return validateAudience(expected, result);\n    }\n    return result;\n}\nfunction validateAudience(expected, result) {\n    if (Array.isArray(result.claims.aud)) {\n        if (!result.claims.aud.includes(expected)) {\n            throw OPE('unexpected JWT \"aud\" (audience) claim value', JWT_CLAIM_COMPARISON, {\n                expected,\n                claims: result.claims,\n                claim: 'aud',\n            });\n        }\n    }\n    else if (result.claims.aud !== expected) {\n        throw OPE('unexpected JWT \"aud\" (audience) claim value', JWT_CLAIM_COMPARISON, {\n            expected,\n            claims: result.claims,\n            claim: 'aud',\n        });\n    }\n    return result;\n}\nfunction validateOptionalIssuer(as, result) {\n    if (result.claims.iss !== undefined) {\n        return validateIssuer(as, result);\n    }\n    return result;\n}\nfunction validateIssuer(as, result) {\n    const expected = as[_expectedIssuer]?.(result) ?? as.issuer;\n    if (result.claims.iss !== expected) {\n        throw OPE('unexpected JWT \"iss\" (issuer) claim value', JWT_CLAIM_COMPARISON, {\n            expected,\n            claims: result.claims,\n            claim: 'iss',\n        });\n    }\n    return result;\n}\nconst branded = new WeakSet();\nfunction brand(searchParams) {\n    branded.add(searchParams);\n    return searchParams;\n}\nexport const nopkce = Symbol();\nexport async function authorizationCodeGrantRequest(as, client, clientAuthentication, callbackParameters, redirectUri, codeVerifier, options) {\n    assertAs(as);\n    assertClient(client);\n    if (!branded.has(callbackParameters)) {\n        throw CodedTypeError('\"callbackParameters\" must be an instance of URLSearchParams obtained from \"validateAuthResponse()\", or \"validateJwtAuthResponse()', ERR_INVALID_ARG_VALUE);\n    }\n    assertString(redirectUri, '\"redirectUri\"');\n    const code = getURLSearchParameter(callbackParameters, 'code');\n    if (!code) {\n        throw OPE('no authorization code in \"callbackParameters\"', INVALID_RESPONSE);\n    }\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('redirect_uri', redirectUri);\n    parameters.set('code', code);\n    if (codeVerifier !== nopkce) {\n        assertString(codeVerifier, '\"codeVerifier\"');\n        parameters.set('code_verifier', codeVerifier);\n    }\n    return tokenEndpointRequest(as, client, clientAuthentication, 'authorization_code', parameters, options);\n}\nconst jwtClaimNames = {\n    aud: 'audience',\n    c_hash: 'code hash',\n    client_id: 'client id',\n    exp: 'expiration time',\n    iat: 'issued at',\n    iss: 'issuer',\n    jti: 'jwt id',\n    nonce: 'nonce',\n    s_hash: 'state hash',\n    sub: 'subject',\n    ath: 'access token hash',\n    htm: 'http method',\n    htu: 'http uri',\n    cnf: 'confirmation',\n    auth_time: 'authentication time',\n};\nfunction validatePresence(required, result) {\n    for (const claim of required) {\n        if (result.claims[claim] === undefined) {\n            throw OPE(`JWT \"${claim}\" (${jwtClaimNames[claim]}) claim missing`, INVALID_RESPONSE, {\n                claims: result.claims,\n            });\n        }\n    }\n    return result;\n}\nfunction validateStringClaim(claim, result) {\n    if (typeof result.claims[claim] !== 'string') {\n        throw OPE(`unexpected JWT \"${claim}\" (${jwtClaimNames[claim]}) claim type`, INVALID_RESPONSE, {\n            claims: result.claims,\n        });\n    }\n    return result;\n}\nfunction validateIdTokenClaims(as, client, idToken, requiredClaims, decryptFn) {\n    return validateJwt(idToken, checkSigningAlgorithm.bind(undefined, client.id_token_signed_response_alg, as.id_token_signing_alg_values_supported, 'RS256'), getClockSkew(client), getClockTolerance(client), decryptFn)\n        .then(validatePresence.bind(undefined, ['aud', 'exp', 'iat', 'iss', 'sub', ...requiredClaims]))\n        .then(validateIssuer.bind(undefined, as))\n        .then(validateAudience.bind(undefined, client.client_id))\n        .then(validateStringClaim.bind(undefined, 'sub'));\n}\nfunction resolveIdTokenMaxAge(client, maxAge) {\n    if (maxAge === skipAuthTimeCheck) {\n        return maxAge;\n    }\n    const fromClient = maxAge === undefined;\n    if (fromClient) {\n        maxAge = client.default_max_age;\n    }\n    if (maxAge === undefined) {\n        return skipAuthTimeCheck;\n    }\n    assertNumber(maxAge, true, fromClient ? '\"client.default_max_age\"' : '\"maxAge\" argument');\n    return maxAge;\n}\nfunction validateIdTokenAuthTimeClaim(claims) {\n    if (claims.auth_time !== undefined) {\n        assertNumber(claims.auth_time, true, 'ID Token \"auth_time\" (authentication time)', INVALID_RESPONSE, { claims });\n    }\n}\nfunction validateIdTokenAuthTime(client, claims, maxAge) {\n    if (maxAge === skipAuthTimeCheck) {\n        return;\n    }\n    const now = epochTime() + getClockSkew(client);\n    const tolerance = getClockTolerance(client);\n    if (claims.auth_time + maxAge < now - tolerance) {\n        throw OPE('too much time has elapsed since the last End-User authentication', JWT_TIMESTAMP_CHECK, { claims, now, tolerance, claim: 'auth_time' });\n    }\n}\nfunction validateIdTokenNonce(claims, expectedNonce) {\n    const expected = expectedNonce === expectNoNonce ? undefined : expectedNonce;\n    if (claims.nonce !== expected) {\n        throw OPE('unexpected ID Token \"nonce\" claim value', JWT_CLAIM_COMPARISON, {\n            expected,\n            claims,\n            claim: 'nonce',\n        });\n    }\n}\nfunction validateIdTokenAuthorizedParty(client, claims) {\n    if (Array.isArray(claims.aud) && claims.aud.length !== 1) {\n        if (claims.azp === undefined) {\n            throw OPE('ID Token \"aud\" (audience) claim includes additional untrusted audiences', JWT_CLAIM_COMPARISON, { claims, claim: 'aud' });\n        }\n        if (claims.azp !== client.client_id) {\n            throw OPE('unexpected ID Token \"azp\" (authorized party) claim value', JWT_CLAIM_COMPARISON, {\n                expected: client.client_id,\n                claims,\n                claim: 'azp',\n            });\n        }\n    }\n}\nexport const expectNoNonce = Symbol();\nexport const skipAuthTimeCheck = Symbol();\nexport async function processAuthorizationCodeResponse(as, client, response, options) {\n    if (typeof options?.expectedNonce === 'string' ||\n        typeof options?.maxAge === 'number' ||\n        options?.requireIdToken) {\n        return processAuthorizationCodeOpenIDResponse(as, client, response, options.expectedNonce, options.maxAge, options[jweDecrypt], options.recognizedTokenTypes);\n    }\n    return processAuthorizationCodeOAuth2Response(as, client, response, options?.maxAge, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nasync function processAuthorizationCodeOpenIDResponse(as, client, response, expectedNonce, maxAge, decryptFn, recognizedTokenTypes) {\n    const additionalRequiredClaims = [];\n    switch (expectedNonce) {\n        case undefined:\n            expectedNonce = expectNoNonce;\n            break;\n        case expectNoNonce:\n            break;\n        default:\n            assertString(expectedNonce, '\"expectedNonce\" argument');\n            additionalRequiredClaims.push('nonce');\n    }\n    maxAge = resolveIdTokenMaxAge(client, maxAge);\n    if (maxAge !== skipAuthTimeCheck) {\n        additionalRequiredClaims.push('auth_time');\n    }\n    const result = await processGenericAccessTokenResponse(as, client, response, additionalRequiredClaims, decryptFn, recognizedTokenTypes);\n    assertString(result.id_token, '\"response\" body \"id_token\" property', INVALID_RESPONSE, {\n        body: result,\n    });\n    const claims = getValidatedIdTokenClaims(result);\n    validateIdTokenAuthTime(client, claims, maxAge);\n    validateIdTokenNonce(claims, expectedNonce);\n    return result;\n}\nasync function processAuthorizationCodeOAuth2Response(as, client, response, maxAge, decryptFn, recognizedTokenTypes) {\n    const result = await processGenericAccessTokenResponse(as, client, response, undefined, decryptFn, recognizedTokenTypes);\n    const claims = getValidatedIdTokenClaims(result);\n    if (claims) {\n        validateIdTokenAuthTime(client, claims, resolveIdTokenMaxAge(client, maxAge));\n        validateIdTokenNonce(claims, expectNoNonce);\n    }\n    return result;\n}\nexport const WWW_AUTHENTICATE_CHALLENGE = 'OAUTH_WWW_AUTHENTICATE_CHALLENGE';\nexport const RESPONSE_BODY_ERROR = 'OAUTH_RESPONSE_BODY_ERROR';\nexport const UNSUPPORTED_OPERATION = 'OAUTH_UNSUPPORTED_OPERATION';\nexport const AUTHORIZATION_RESPONSE_ERROR = 'OAUTH_AUTHORIZATION_RESPONSE_ERROR';\nexport const JWT_USERINFO_EXPECTED = 'OAUTH_JWT_USERINFO_EXPECTED';\nexport const PARSE_ERROR = 'OAUTH_PARSE_ERROR';\nexport const INVALID_RESPONSE = 'OAUTH_INVALID_RESPONSE';\nexport const INVALID_REQUEST = 'OAUTH_INVALID_REQUEST';\nexport const RESPONSE_IS_NOT_JSON = 'OAUTH_RESPONSE_IS_NOT_JSON';\nexport const RESPONSE_IS_NOT_CONFORM = 'OAUTH_RESPONSE_IS_NOT_CONFORM';\nexport const HTTP_REQUEST_FORBIDDEN = 'OAUTH_HTTP_REQUEST_FORBIDDEN';\nexport const REQUEST_PROTOCOL_FORBIDDEN = 'OAUTH_REQUEST_PROTOCOL_FORBIDDEN';\nexport const JWT_TIMESTAMP_CHECK = 'OAUTH_JWT_TIMESTAMP_CHECK_FAILED';\nexport const JWT_CLAIM_COMPARISON = 'OAUTH_JWT_CLAIM_COMPARISON_FAILED';\nexport const JSON_ATTRIBUTE_COMPARISON = 'OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED';\nexport const KEY_SELECTION = 'OAUTH_KEY_SELECTION_FAILED';\nexport const MISSING_SERVER_METADATA = 'OAUTH_MISSING_SERVER_METADATA';\nexport const INVALID_SERVER_METADATA = 'OAUTH_INVALID_SERVER_METADATA';\nfunction checkJwtType(expected, result) {\n    if (typeof result.header.typ !== 'string' || normalizeTyp(result.header.typ) !== expected) {\n        throw OPE('unexpected JWT \"typ\" header parameter value', INVALID_RESPONSE, {\n            header: result.header,\n        });\n    }\n    return result;\n}\nexport async function clientCredentialsGrantRequest(as, client, clientAuthentication, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    return tokenEndpointRequest(as, client, clientAuthentication, 'client_credentials', new URLSearchParams(parameters), options);\n}\nexport async function genericTokenEndpointRequest(as, client, clientAuthentication, grantType, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(grantType, '\"grantType\"');\n    return tokenEndpointRequest(as, client, clientAuthentication, grantType, new URLSearchParams(parameters), options);\n}\nexport async function processGenericTokenEndpointResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nexport async function processClientCredentialsResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nexport async function revocationRequest(as, client, clientAuthentication, token, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(token, '\"token\"');\n    const url = resolveEndpoint(as, 'revocation_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(options?.additionalParameters);\n    body.set('token', token);\n    const headers = prepareHeaders(options?.headers);\n    headers.delete('accept');\n    return authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n}\nexport async function processRevocationResponse(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Revocation Endpoint');\n    return undefined;\n}\nfunction assertReadableResponse(response) {\n    if (response.bodyUsed) {\n        throw CodedTypeError('\"response\" body has been used already', ERR_INVALID_ARG_VALUE);\n    }\n}\nexport async function introspectionRequest(as, client, clientAuthentication, token, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(token, '\"token\"');\n    const url = resolveEndpoint(as, 'introspection_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(options?.additionalParameters);\n    body.set('token', token);\n    const headers = prepareHeaders(options?.headers);\n    if (options?.requestJwtResponse ?? client.introspection_signed_response_alg) {\n        headers.set('accept', 'application/token-introspection+jwt');\n    }\n    else {\n        headers.set('accept', 'application/json');\n    }\n    return authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n}\nexport async function processIntrospectionResponse(as, client, response, options) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Introspection Endpoint');\n    let json;\n    if (getContentType(response) === 'application/token-introspection+jwt') {\n        assertReadableResponse(response);\n        const { claims, jwt } = await validateJwt(await response.text(), checkSigningAlgorithm.bind(undefined, client.introspection_signed_response_alg, as.introspection_signing_alg_values_supported, 'RS256'), getClockSkew(client), getClockTolerance(client), options?.[jweDecrypt])\n            .then(checkJwtType.bind(undefined, 'token-introspection+jwt'))\n            .then(validatePresence.bind(undefined, ['aud', 'iat', 'iss']))\n            .then(validateIssuer.bind(undefined, as))\n            .then(validateAudience.bind(undefined, client.client_id));\n        jwtRefs.set(response, jwt);\n        if (!isJsonObject(claims.token_introspection)) {\n            throw OPE('JWT \"token_introspection\" claim must be a JSON object', INVALID_RESPONSE, {\n                claims,\n            });\n        }\n        json = claims.token_introspection;\n    }\n    else {\n        assertReadableResponse(response);\n        json = await getResponseJsonBody(response);\n    }\n    if (typeof json.active !== 'boolean') {\n        throw OPE('\"response\" body \"active\" property must be a boolean', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    return json;\n}\nasync function jwksRequest(as, options) {\n    assertAs(as);\n    const url = resolveEndpoint(as, 'jwks_uri', false, options?.[allowInsecureRequests] !== true);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    headers.append('accept', 'application/jwk-set+json');\n    const requestHeaders = Object.fromEntries(headers.entries());\n    const headersKey = JSON.stringify(requestHeaders);\n    const fetcher = options?.[customFetch] || fetch;\n    const requestSignal = signal(url, options?.signal);\n    jwksRequests ||= new WeakMap();\n    const requests = jwksRequests.get(as) ?? new Set();\n    for (const pending of requests) {\n        if (pending.url === url.href &&\n            pending.headers === headersKey &&\n            pending.fetch === fetcher &&\n            pending.signal === requestSignal) {\n            return pending.promise;\n        }\n    }\n    const pending = {\n        url: url.href,\n        headers: headersKey,\n        fetch: fetcher,\n        signal: requestSignal,\n        promise: Promise.resolve()\n            .then(() => fetcher(url.href, {\n            body: undefined,\n            headers: requestHeaders,\n            method: 'GET',\n            redirect: 'manual',\n            signal: requestSignal,\n        }))\n            .then(processJwksResponse)\n            .then((jwks) => {\n            const uat = epochTime();\n            setJwksCache(as, jwks, uat);\n            return { jwks, uat };\n        })\n            .finally(() => {\n            requests.delete(pending);\n            if (!requests.size) {\n                jwksRequests.delete(as);\n            }\n        }),\n    };\n    requests.add(pending);\n    jwksRequests.set(as, requests);\n    return pending.promise;\n}\nasync function processJwksResponse(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    if (response.status !== 200) {\n        throw OPE('\"response\" is not a conform JSON Web Key Set response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);\n    }\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response, (response) => assertContentTypes(response, 'application/json', 'application/jwk-set+json'));\n    if (!Array.isArray(json.keys)) {\n        throw OPE('\"response\" body \"keys\" property must be an array', INVALID_RESPONSE, { body: json });\n    }\n    if (!Array.prototype.every.call(json.keys, isJsonObject)) {\n        throw OPE('\"response\" body \"keys\" property members must be JWK formatted objects', INVALID_RESPONSE, { body: json });\n    }\n    return json;\n}\nfunction supported(alg) {\n    switch (alg) {\n        case 'PS256':\n        case 'ES256':\n        case 'RS256':\n        case 'PS384':\n        case 'ES384':\n        case 'RS384':\n        case 'PS512':\n        case 'ES512':\n        case 'RS512':\n        case 'Ed25519':\n        case 'EdDSA':\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            return true;\n        default:\n            return false;\n    }\n}\nfunction checkSupportedJwsAlg(header) {\n    if (!supported(header.alg)) {\n        throw new UnsupportedOperationError('unsupported JWS \"alg\" identifier', {\n            cause: { alg: header.alg },\n        });\n    }\n}\nfunction checkRsaKeyAlgorithm(key) {\n    const { algorithm } = key;\n    if (typeof algorithm.modulusLength !== 'number' || algorithm.modulusLength < 2048) {\n        throw new UnsupportedOperationError(`unsupported ${algorithm.name} modulusLength`, {\n            cause: key,\n        });\n    }\n}\nfunction ecdsaHashName(key) {\n    const { algorithm } = key;\n    switch (algorithm.namedCurve) {\n        case 'P-256':\n            return 'SHA-256';\n        case 'P-384':\n            return 'SHA-384';\n        case 'P-521':\n            return 'SHA-512';\n        default:\n            throw new UnsupportedOperationError('unsupported ECDSA namedCurve', { cause: key });\n    }\n}\nfunction keyToSubtle(key) {\n    switch (key.algorithm.name) {\n        case 'ECDSA':\n            return {\n                name: key.algorithm.name,\n                hash: ecdsaHashName(key),\n            };\n        case 'RSA-PSS': {\n            checkRsaKeyAlgorithm(key);\n            switch (key.algorithm.hash.name) {\n                case 'SHA-256':\n                case 'SHA-384':\n                case 'SHA-512':\n                    return {\n                        name: key.algorithm.name,\n                        saltLength: parseInt(key.algorithm.hash.name.slice(-3), 10) >> 3,\n                    };\n                default:\n                    throw new UnsupportedOperationError('unsupported RSA-PSS hash name', { cause: key });\n            }\n        }\n        case 'RSASSA-PKCS1-v1_5':\n            checkRsaKeyAlgorithm(key);\n            return key.algorithm.name;\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n        case 'Ed25519':\n            return key.algorithm.name;\n    }\n    throw new UnsupportedOperationError('unsupported CryptoKey algorithm name', { cause: key });\n}\nasync function validateJwsSignature(protectedHeader, payload, key, signature) {\n    const data = buf(`${protectedHeader}.${payload}`);\n    const algorithm = keyToSubtle(key);\n    const verified = await crypto.subtle.verify(algorithm, key, signature, data);\n    if (!verified) {\n        throw OPE('JWT signature verification failed', INVALID_RESPONSE, {\n            key,\n            data,\n            signature,\n            algorithm,\n        });\n    }\n}\nasync function validateJwt(jws, checkAlg, clockSkew, clockTolerance, decryptJwt) {\n    let { 0: protectedHeader, 1: payload, length } = jws.split('.');\n    if (length === 5) {\n        if (decryptJwt !== undefined) {\n            jws = await decryptJwt(jws);\n            ({ 0: protectedHeader, 1: payload, length } = jws.split('.'));\n        }\n        else {\n            throw new UnsupportedOperationError('JWE decryption is not configured', { cause: jws });\n        }\n    }\n    if (length !== 3) {\n        throw OPE('Invalid JWT', INVALID_RESPONSE, jws);\n    }\n    let header;\n    try {\n        header = JSON.parse(buf(b64u(protectedHeader)));\n    }\n    catch (cause) {\n        throw OPE('failed to parse JWT Header body as base64url encoded JSON', PARSE_ERROR, cause);\n    }\n    if (!isJsonObject(header)) {\n        throw OPE('JWT Header must be a top level object', INVALID_RESPONSE, jws);\n    }\n    checkAlg(header);\n    if (header.crit !== undefined) {\n        throw new UnsupportedOperationError('no JWT \"crit\" header parameter extensions are supported', {\n            cause: { header },\n        });\n    }\n    let claims;\n    try {\n        claims = JSON.parse(buf(b64u(payload)));\n    }\n    catch (cause) {\n        throw OPE('failed to parse JWT Payload body as base64url encoded JSON', PARSE_ERROR, cause);\n    }\n    if (!isJsonObject(claims)) {\n        throw OPE('JWT Payload must be a top level object', INVALID_RESPONSE, jws);\n    }\n    const now = epochTime() + clockSkew;\n    if (claims.exp !== undefined) {\n        if (typeof claims.exp !== 'number') {\n            throw OPE('unexpected JWT \"exp\" (expiration time) claim type', INVALID_RESPONSE, { claims });\n        }\n        if (claims.exp <= now - clockTolerance) {\n            throw OPE('unexpected JWT \"exp\" (expiration time) claim value, expiration is past current timestamp', JWT_TIMESTAMP_CHECK, { claims, now, tolerance: clockTolerance, claim: 'exp' });\n        }\n    }\n    if (claims.iat !== undefined) {\n        if (typeof claims.iat !== 'number') {\n            throw OPE('unexpected JWT \"iat\" (issued at) claim type', INVALID_RESPONSE, { claims });\n        }\n    }\n    if (claims.iss !== undefined) {\n        if (typeof claims.iss !== 'string') {\n            throw OPE('unexpected JWT \"iss\" (issuer) claim type', INVALID_RESPONSE, { claims });\n        }\n    }\n    if (claims.nbf !== undefined) {\n        if (typeof claims.nbf !== 'number') {\n            throw OPE('unexpected JWT \"nbf\" (not before) claim type', INVALID_RESPONSE, { claims });\n        }\n        if (claims.nbf > now + clockTolerance) {\n            throw OPE('unexpected JWT \"nbf\" (not before) claim value', JWT_TIMESTAMP_CHECK, {\n                claims,\n                now,\n                tolerance: clockTolerance,\n                claim: 'nbf',\n            });\n        }\n    }\n    if (claims.aud !== undefined) {\n        if (typeof claims.aud !== 'string' && !Array.isArray(claims.aud)) {\n            throw OPE('unexpected JWT \"aud\" (audience) claim type', INVALID_RESPONSE, { claims });\n        }\n    }\n    return { header, claims, jwt: jws };\n}\nexport async function validateJwtAuthResponse(as, client, parameters, expectedState, options) {\n    assertAs(as);\n    assertClient(client);\n    if (parameters instanceof URL) {\n        parameters = parameters.searchParams;\n    }\n    if (!(parameters instanceof URLSearchParams)) {\n        throw CodedTypeError('\"parameters\" must be an instance of URLSearchParams, or URL', ERR_INVALID_ARG_TYPE);\n    }\n    const response = getURLSearchParameter(parameters, 'response');\n    if (!response) {\n        throw OPE('\"parameters\" does not contain a JARM response', INVALID_RESPONSE);\n    }\n    const { claims, header, jwt } = await validateJwt(response, checkSigningAlgorithm.bind(undefined, client.authorization_signed_response_alg, as.authorization_signing_alg_values_supported, 'RS256'), getClockSkew(client), getClockTolerance(client), options?.[jweDecrypt])\n        .then(validatePresence.bind(undefined, ['aud', 'exp', 'iss']))\n        .then(validateIssuer.bind(undefined, as))\n        .then(validateAudience.bind(undefined, client.client_id));\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = jwt.split('.');\n    const signature = b64u(encodedSignature);\n    const key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);\n    await validateJwsSignature(protectedHeader, payload, key, signature);\n    const result = new URLSearchParams();\n    for (const [key, value] of Object.entries(claims)) {\n        if (typeof value === 'string' && key !== 'aud') {\n            result.set(key, value);\n        }\n    }\n    return validateAuthResponse(as, client, result, expectedState);\n}\nasync function idTokenHash(data, header, claimName) {\n    let algorithm;\n    switch (header.alg) {\n        case 'RS256':\n        case 'PS256':\n        case 'ES256':\n            algorithm = 'SHA-256';\n            break;\n        case 'RS384':\n        case 'PS384':\n        case 'ES384':\n            algorithm = 'SHA-384';\n            break;\n        case 'RS512':\n        case 'PS512':\n        case 'ES512':\n        case 'Ed25519':\n        case 'EdDSA':\n            algorithm = 'SHA-512';\n            break;\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            algorithm = { name: 'cSHAKE256', length: 512, outputLength: 512 };\n            break;\n        default:\n            throw new UnsupportedOperationError(`unsupported JWS algorithm for ${claimName} calculation`, { cause: { alg: header.alg } });\n    }\n    const digest = await crypto.subtle.digest(algorithm, buf(data));\n    return b64u(digest.slice(0, digest.byteLength / 2));\n}\nasync function idTokenHashMatches(data, actual, header, claimName) {\n    const expected = await idTokenHash(data, header, claimName);\n    return actual === expected;\n}\nexport async function validateDetachedSignatureResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options) {\n    return validateHybridResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options, true);\n}\nexport async function validateCodeIdTokenResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options) {\n    return validateHybridResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options, false);\n}\nasync function consumeStream(request) {\n    if (request.bodyUsed) {\n        throw CodedTypeError('form_post Request instances must contain a readable body', ERR_INVALID_ARG_VALUE, { cause: request });\n    }\n    return request.text();\n}\nexport async function formPostResponse(request) {\n    if (request.method !== 'POST') {\n        throw CodedTypeError('form_post responses are expected to use the POST method', ERR_INVALID_ARG_VALUE, { cause: request });\n    }\n    if (getContentType(request) !== 'application/x-www-form-urlencoded') {\n        throw CodedTypeError('form_post responses are expected to use the application/x-www-form-urlencoded content-type', ERR_INVALID_ARG_VALUE, { cause: request });\n    }\n    return consumeStream(request);\n}\nasync function validateHybridResponse(as, client, parameters, expectedNonce, expectedState, maxAge, options, fapi) {\n    assertAs(as);\n    assertClient(client);\n    if (parameters instanceof URL) {\n        if (!parameters.hash.length) {\n            throw CodedTypeError('\"parameters\" as an instance of URL must contain a hash (fragment) with the Authorization Response parameters', ERR_INVALID_ARG_VALUE);\n        }\n        parameters = new URLSearchParams(parameters.hash.slice(1));\n    }\n    else if (looseInstanceOf(parameters, Request)) {\n        parameters = new URLSearchParams(await formPostResponse(parameters));\n    }\n    else if (parameters instanceof URLSearchParams) {\n        parameters = new URLSearchParams(parameters);\n    }\n    else {\n        throw CodedTypeError('\"parameters\" must be an instance of URLSearchParams, URL, or Response', ERR_INVALID_ARG_TYPE);\n    }\n    const id_token = getURLSearchParameter(parameters, 'id_token');\n    parameters.delete('id_token');\n    switch (expectedState) {\n        case undefined:\n        case expectNoState:\n            break;\n        default:\n            assertString(expectedState, '\"expectedState\" argument');\n    }\n    const result = validateAuthResponse({\n        ...as,\n        authorization_response_iss_parameter_supported: false,\n    }, client, parameters, expectedState);\n    if (!id_token) {\n        throw OPE('\"parameters\" does not contain an ID Token', INVALID_RESPONSE);\n    }\n    const code = getURLSearchParameter(parameters, 'code');\n    if (!code) {\n        throw OPE('\"parameters\" does not contain an Authorization Code', INVALID_RESPONSE);\n    }\n    const requiredClaims = ['nonce', 'c_hash'];\n    const state = parameters.get('state');\n    if (fapi && (typeof expectedState === 'string' || state !== null)) {\n        requiredClaims.push('s_hash');\n    }\n    maxAge = resolveIdTokenMaxAge(client, maxAge);\n    if (client.require_auth_time || maxAge !== skipAuthTimeCheck) {\n        requiredClaims.push('auth_time');\n    }\n    const { claims, header, jwt } = await validateIdTokenClaims(as, client, id_token, requiredClaims, options?.[jweDecrypt]);\n    const clockSkew = getClockSkew(client);\n    const now = epochTime() + clockSkew;\n    if (claims.iat < now - 3600) {\n        throw OPE('unexpected JWT \"iat\" (issued at) claim value, it is too far in the past', JWT_TIMESTAMP_CHECK, { now, claims, claim: 'iat' });\n    }\n    assertString(claims.c_hash, 'ID Token \"c_hash\" (code hash) claim value', INVALID_RESPONSE, {\n        claims,\n    });\n    validateIdTokenAuthTimeClaim(claims);\n    validateIdTokenAuthTime(client, claims, maxAge);\n    assertString(expectedNonce, '\"expectedNonce\" argument');\n    validateIdTokenNonce(claims, expectedNonce);\n    validateIdTokenAuthorizedParty(client, claims);\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = jwt.split('.');\n    const signature = b64u(encodedSignature);\n    const key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);\n    await validateJwsSignature(protectedHeader, payload, key, signature);\n    if ((await idTokenHashMatches(code, claims.c_hash, header, 'c_hash')) !== true) {\n        throw OPE('invalid ID Token \"c_hash\" (code hash) claim value', JWT_CLAIM_COMPARISON, {\n            code,\n            alg: header.alg,\n            claim: 'c_hash',\n            claims,\n        });\n    }\n    if ((fapi && state !== null) || claims.s_hash !== undefined) {\n        assertString(claims.s_hash, 'ID Token \"s_hash\" (state hash) claim value', INVALID_RESPONSE, {\n            claims,\n        });\n        assertString(state, '\"state\" response parameter', INVALID_RESPONSE, { parameters });\n        if ((await idTokenHashMatches(state, claims.s_hash, header, 's_hash')) !== true) {\n            throw OPE('invalid ID Token \"s_hash\" (state hash) claim value', JWT_CLAIM_COMPARISON, {\n                state,\n                alg: header.alg,\n                claim: 's_hash',\n                claims,\n            });\n        }\n    }\n    return result;\n}\nfunction checkSigningAlgorithm(client, issuer, fallback, header) {\n    if (client !== undefined) {\n        if (typeof client === 'string' ? header.alg !== client : !client.includes(header.alg)) {\n            throw OPE('unexpected JWT \"alg\" header parameter', INVALID_RESPONSE, {\n                header,\n                expected: client,\n                reason: 'client configuration',\n            });\n        }\n        return;\n    }\n    if (Array.isArray(issuer)) {\n        if (!issuer.includes(header.alg)) {\n            throw OPE('unexpected JWT \"alg\" header parameter', INVALID_RESPONSE, {\n                header,\n                expected: issuer,\n                reason: 'authorization server metadata',\n            });\n        }\n        return;\n    }\n    if (fallback !== undefined) {\n        if (typeof fallback === 'string'\n            ? header.alg !== fallback\n            : typeof fallback === 'function'\n                ? !fallback(header.alg)\n                : !fallback.includes(header.alg)) {\n            throw OPE('unexpected JWT \"alg\" header parameter', INVALID_RESPONSE, {\n                header,\n                expected: fallback,\n                reason: 'default value',\n            });\n        }\n        return;\n    }\n    throw OPE('missing client or server configuration to verify used JWT \"alg\" header parameter', undefined, { client, issuer, fallback });\n}\nfunction getURLSearchParameter(parameters, name) {\n    const { 0: value, length } = parameters.getAll(name);\n    if (length > 1) {\n        throw OPE(`\"${name}\" parameter must be provided only once`, INVALID_RESPONSE);\n    }\n    return value;\n}\nexport const skipStateCheck = Symbol();\nexport const expectNoState = Symbol();\nexport function validateAuthResponse(as, client, parameters, expectedState) {\n    assertAs(as);\n    assertClient(client);\n    if (parameters instanceof URL) {\n        parameters = parameters.searchParams;\n    }\n    if (!(parameters instanceof URLSearchParams)) {\n        throw CodedTypeError('\"parameters\" must be an instance of URLSearchParams, or URL', ERR_INVALID_ARG_TYPE);\n    }\n    if (getURLSearchParameter(parameters, 'response')) {\n        throw OPE('\"parameters\" contains a JARM response, use validateJwtAuthResponse() instead of validateAuthResponse()', INVALID_RESPONSE, { parameters });\n    }\n    const iss = getURLSearchParameter(parameters, 'iss');\n    const state = getURLSearchParameter(parameters, 'state');\n    if (!iss && as.authorization_response_iss_parameter_supported) {\n        throw OPE('response parameter \"iss\" (issuer) missing', INVALID_RESPONSE, { parameters });\n    }\n    if (iss && iss !== as.issuer) {\n        throw OPE('unexpected \"iss\" (issuer) response parameter value', INVALID_RESPONSE, {\n            expected: as.issuer,\n            parameters,\n        });\n    }\n    switch (expectedState) {\n        case undefined:\n        case expectNoState:\n            if (state !== undefined) {\n                throw OPE('unexpected \"state\" response parameter encountered', INVALID_RESPONSE, {\n                    expected: undefined,\n                    parameters,\n                });\n            }\n            break;\n        case skipStateCheck:\n            break;\n        default:\n            assertString(expectedState, '\"expectedState\" argument');\n            if (state !== expectedState) {\n                throw OPE(state === undefined\n                    ? 'response parameter \"state\" missing'\n                    : 'unexpected \"state\" response parameter value', INVALID_RESPONSE, { expected: expectedState, parameters });\n            }\n    }\n    const error = getURLSearchParameter(parameters, 'error');\n    if (error) {\n        throw new AuthorizationResponseError('authorization response from the server is an error', {\n            cause: parameters,\n        });\n    }\n    const id_token = getURLSearchParameter(parameters, 'id_token');\n    const token = getURLSearchParameter(parameters, 'token');\n    if (id_token !== undefined || token !== undefined) {\n        throw new UnsupportedOperationError('implicit and hybrid flows are not supported');\n    }\n    return brand(new URLSearchParams(parameters));\n}\nfunction algToSubtle(alg) {\n    switch (alg) {\n        case 'PS256':\n        case 'PS384':\n        case 'PS512':\n            return { name: 'RSA-PSS', hash: `SHA-${alg.slice(-3)}` };\n        case 'RS256':\n        case 'RS384':\n        case 'RS512':\n            return { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${alg.slice(-3)}` };\n        case 'ES256':\n        case 'ES384':\n            return { name: 'ECDSA', namedCurve: `P-${alg.slice(-3)}` };\n        case 'ES512':\n            return { name: 'ECDSA', namedCurve: 'P-521' };\n        case 'EdDSA':\n            return 'Ed25519';\n        case 'Ed25519':\n        case 'ML-DSA-44':\n        case 'ML-DSA-65':\n        case 'ML-DSA-87':\n            return alg;\n        default:\n            throw new UnsupportedOperationError('unsupported JWS algorithm', { cause: { alg } });\n    }\n}\nasync function importJwk(alg, jwk) {\n    const { ext, key_ops, use, ...key } = jwk;\n    return crypto.subtle.importKey('jwk', key, algToSubtle(alg), true, ['verify']);\n}\nexport async function deviceAuthorizationRequest(as, client, clientAuthentication, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'device_authorization_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(parameters);\n    body.set('client_id', client.client_id);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    return authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n}\nexport async function processDeviceAuthorizationResponse(as, client, response) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Device Authorization Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.device_code, '\"response\" body \"device_code\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    assertString(json.user_code, '\"response\" body \"user_code\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    assertString(json.verification_uri, '\"response\" body \"verification_uri\" property', INVALID_RESPONSE, { body: json });\n    let expiresIn = typeof json.expires_in !== 'number' ? parseFloat(json.expires_in) : json.expires_in;\n    assertNumber(expiresIn, true, '\"response\" body \"expires_in\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    json.expires_in = expiresIn;\n    if (json.verification_uri_complete !== undefined) {\n        assertString(json.verification_uri_complete, '\"response\" body \"verification_uri_complete\" property', INVALID_RESPONSE, { body: json });\n    }\n    if (json.interval !== undefined) {\n        assertNumber(json.interval, false, '\"response\" body \"interval\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    return json;\n}\nexport async function deviceCodeGrantRequest(as, client, clientAuthentication, deviceCode, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(deviceCode, '\"deviceCode\"');\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('device_code', deviceCode);\n    return tokenEndpointRequest(as, client, clientAuthentication, 'urn:ietf:params:oauth:grant-type:device_code', parameters, options);\n}\nexport async function processDeviceCodeResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nexport async function generateKeyPair(alg, options) {\n    assertString(alg, '\"alg\"');\n    const algorithm = algToSubtle(alg);\n    if (alg.startsWith('PS') || alg.startsWith('RS')) {\n        Object.assign(algorithm, {\n            modulusLength: options?.modulusLength ?? 2048,\n            publicExponent: new Uint8Array([0x01, 0x00, 0x01]),\n        });\n    }\n    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, [\n        'sign',\n        'verify',\n    ]);\n}\nfunction normalizeHtu(htu) {\n    const url = new URL(htu);\n    url.search = '';\n    url.hash = '';\n    return url.href;\n}\nasync function validateDPoP(request, accessToken, accessTokenClaims, options) {\n    const headerValue = request.headers.get('dpop');\n    if (headerValue === null) {\n        throw OPE('operation indicated DPoP use but the request has no DPoP HTTP Header', INVALID_REQUEST, { headers: request.headers });\n    }\n    if (request.headers.get('authorization')?.toLowerCase().startsWith('dpop ') === false) {\n        throw OPE(`operation indicated DPoP use but the request's Authorization HTTP Header scheme is not DPoP`, INVALID_REQUEST, { headers: request.headers });\n    }\n    if (typeof accessTokenClaims.cnf?.jkt !== 'string') {\n        throw OPE('operation indicated DPoP use but the JWT Access Token has no jkt confirmation claim', INVALID_REQUEST, { claims: accessTokenClaims });\n    }\n    const clockSkew = getClockSkew(options);\n    const proof = await validateJwt(headerValue, checkSigningAlgorithm.bind(undefined, options?.signingAlgorithms, undefined, supported), clockSkew, getClockTolerance(options), undefined)\n        .then(checkJwtType.bind(undefined, 'dpop+jwt'))\n        .then(validatePresence.bind(undefined, ['iat', 'jti', 'ath', 'htm', 'htu']))\n        .then(validateStringClaim.bind(undefined, 'jti'));\n    const now = epochTime() + clockSkew;\n    const diff = Math.abs(now - proof.claims.iat);\n    if (diff > 300) {\n        throw OPE('DPoP Proof iat is not recent enough', JWT_TIMESTAMP_CHECK, {\n            now,\n            claims: proof.claims,\n            claim: 'iat',\n        });\n    }\n    if (proof.claims.htm !== request.method) {\n        throw OPE('DPoP Proof htm mismatch', JWT_CLAIM_COMPARISON, {\n            expected: request.method,\n            claims: proof.claims,\n            claim: 'htm',\n        });\n    }\n    if (typeof proof.claims.htu !== 'string' ||\n        normalizeHtu(proof.claims.htu) !== normalizeHtu(request.url)) {\n        throw OPE('DPoP Proof htu mismatch', JWT_CLAIM_COMPARISON, {\n            expected: normalizeHtu(request.url),\n            claims: proof.claims,\n            claim: 'htu',\n        });\n    }\n    {\n        const expected = b64u(await crypto.subtle.digest('SHA-256', buf(accessToken)));\n        if (proof.claims.ath !== expected) {\n            throw OPE('DPoP Proof ath mismatch', JWT_CLAIM_COMPARISON, {\n                expected,\n                claims: proof.claims,\n                claim: 'ath',\n            });\n        }\n    }\n    const { jwk, alg } = proof.header;\n    if (!isJsonObject(jwk)) {\n        throw OPE('DPoP Proof jwk header parameter must be a JSON object', INVALID_REQUEST, {\n            header: proof.header,\n        });\n    }\n    {\n        const expected = await calculateJwkThumbprint(jwk);\n        if (accessTokenClaims.cnf.jkt !== expected) {\n            throw OPE('JWT Access Token confirmation mismatch', JWT_CLAIM_COMPARISON, {\n                expected,\n                claims: accessTokenClaims,\n                claim: 'cnf.jkt',\n            });\n        }\n    }\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = headerValue.split('.');\n    const signature = b64u(encodedSignature);\n    const key = await importJwk(alg, jwk);\n    if (key.type !== 'public') {\n        throw OPE('DPoP Proof jwk header parameter must contain a public key', INVALID_REQUEST, {\n            header: proof.header,\n        });\n    }\n    await validateJwsSignature(protectedHeader, payload, key, signature);\n}\nexport async function validateJwtAccessToken(as, request, expectedAudience, options) {\n    assertAs(as);\n    if (!looseInstanceOf(request, Request)) {\n        throw CodedTypeError('\"request\" must be an instance of Request', ERR_INVALID_ARG_TYPE);\n    }\n    assertString(expectedAudience, '\"expectedAudience\"');\n    const authorization = request.headers.get('authorization');\n    if (authorization === null) {\n        throw OPE('\"request\" is missing an Authorization HTTP Header', INVALID_REQUEST, {\n            headers: request.headers,\n        });\n    }\n    let { 0: scheme, 1: accessToken, length } = authorization.split(/ +/);\n    scheme = scheme.toLowerCase();\n    switch (scheme) {\n        case 'dpop':\n        case 'bearer':\n            break;\n        default:\n            throw new UnsupportedOperationError('unsupported Authorization HTTP Header scheme', {\n                cause: { headers: request.headers },\n            });\n    }\n    if (length !== 2) {\n        throw OPE('invalid Authorization HTTP Header format', INVALID_REQUEST, {\n            headers: request.headers,\n        });\n    }\n    const requiredClaims = [\n        'iss',\n        'exp',\n        'aud',\n        'sub',\n        'iat',\n        'jti',\n        'client_id',\n    ];\n    if (options?.requireDPoP || scheme === 'dpop' || request.headers.has('dpop')) {\n        requiredClaims.push('cnf');\n    }\n    const { claims, header } = await validateJwt(accessToken, checkSigningAlgorithm.bind(undefined, options?.signingAlgorithms, undefined, supported), getClockSkew(options), getClockTolerance(options), undefined)\n        .then(checkJwtType.bind(undefined, 'at+jwt'))\n        .then(validatePresence.bind(undefined, requiredClaims))\n        .then(validateIssuer.bind(undefined, as))\n        .then(validateAudience.bind(undefined, expectedAudience))\n        .catch(reassignRSCode);\n    for (const claim of ['client_id', 'jti', 'sub']) {\n        if (typeof claims[claim] !== 'string') {\n            throw OPE(`unexpected JWT \"${claim}\" claim type`, INVALID_REQUEST, { claims });\n        }\n    }\n    if ('cnf' in claims) {\n        if (!isJsonObject(claims.cnf)) {\n            throw OPE('unexpected JWT \"cnf\" (confirmation) claim value', INVALID_REQUEST, { claims });\n        }\n        const { 0: cnf, length } = Object.keys(claims.cnf);\n        if (length) {\n            if (length !== 1) {\n                throw new UnsupportedOperationError('multiple confirmation claims are not supported', {\n                    cause: { claims },\n                });\n            }\n            if (cnf !== 'jkt') {\n                throw new UnsupportedOperationError('unsupported JWT Confirmation method', {\n                    cause: { claims },\n                });\n            }\n        }\n    }\n    const { 0: protectedHeader, 1: payload, 2: encodedSignature } = accessToken.split('.');\n    const signature = b64u(encodedSignature);\n    const key = await getPublicSigKeyFromIssuerJwksUri(as, options, header);\n    await validateJwsSignature(protectedHeader, payload, key, signature);\n    if (options?.requireDPoP ||\n        scheme === 'dpop' ||\n        claims.cnf?.jkt !== undefined ||\n        request.headers.has('dpop')) {\n        await validateDPoP(request, accessToken, claims, options).catch(reassignRSCode);\n    }\n    return claims;\n}\nfunction reassignRSCode(err) {\n    if (err instanceof OperationProcessingError && err?.code === INVALID_REQUEST) {\n        err.code = INVALID_RESPONSE;\n    }\n    throw err;\n}\nexport async function backchannelAuthenticationRequest(as, client, clientAuthentication, parameters, options) {\n    assertAs(as);\n    assertClient(client);\n    const url = resolveEndpoint(as, 'backchannel_authentication_endpoint', client.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const body = new URLSearchParams(parameters);\n    body.set('client_id', client.client_id);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    return authenticatedRequest(as, client, clientAuthentication, url, body, headers, options);\n}\nexport async function processBackchannelAuthenticationResponse(as, client, response) {\n    assertAs(as);\n    assertClient(client);\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 200, 'Backchannel Authentication Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.auth_req_id, '\"response\" body \"auth_req_id\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    let expiresIn = typeof json.expires_in !== 'number' ? parseFloat(json.expires_in) : json.expires_in;\n    assertNumber(expiresIn, true, '\"response\" body \"expires_in\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    json.expires_in = expiresIn;\n    if (json.interval !== undefined) {\n        assertNumber(json.interval, false, '\"response\" body \"interval\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    return json;\n}\nexport async function backchannelAuthenticationGrantRequest(as, client, clientAuthentication, authReqId, options) {\n    assertAs(as);\n    assertClient(client);\n    assertString(authReqId, '\"authReqId\"');\n    const parameters = new URLSearchParams(options?.additionalParameters);\n    parameters.set('auth_req_id', authReqId);\n    return tokenEndpointRequest(as, client, clientAuthentication, 'urn:openid:params:grant-type:ciba', parameters, options);\n}\nexport async function processBackchannelAuthenticationGrantResponse(as, client, response, options) {\n    return processGenericAccessTokenResponse(as, client, response, undefined, options?.[jweDecrypt], options?.recognizedTokenTypes);\n}\nexport async function dynamicClientRegistrationRequest(as, metadata, options) {\n    assertAs(as);\n    const url = resolveEndpoint(as, 'registration_endpoint', metadata.use_mtls_endpoint_aliases, options?.[allowInsecureRequests] !== true);\n    const headers = prepareHeaders(options?.headers);\n    headers.set('accept', 'application/json');\n    headers.set('content-type', 'application/json');\n    const method = 'POST';\n    if (options?.DPoP) {\n        assertDPoP(options.DPoP);\n        await options.DPoP.addProof(url, headers, method, options.initialAccessToken);\n    }\n    if (options?.initialAccessToken) {\n        headers.set('authorization', `${headers.has('dpop') ? 'DPoP' : 'Bearer'} ${options.initialAccessToken}`);\n    }\n    const response = await (options?.[customFetch] || fetch)(url.href, {\n        body: JSON.stringify(metadata),\n        headers: Object.fromEntries(headers.entries()),\n        method,\n        redirect: 'manual',\n        signal: signal(url, options?.signal),\n    });\n    options?.DPoP?.cacheNonce(response, url);\n    return response;\n}\nexport async function processDynamicClientRegistrationResponse(response) {\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    await checkOAuthBodyError(response, 201, 'Dynamic Client Registration Endpoint');\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.client_id, '\"response\" body \"client_id\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    if (json.client_secret !== undefined) {\n        assertString(json.client_secret, '\"response\" body \"client_secret\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    if (json.client_secret) {\n        assertNumber(json.client_secret_expires_at, true, '\"response\" body \"client_secret_expires_at\" property', INVALID_RESPONSE, {\n            body: json,\n        });\n    }\n    return json;\n}\nexport async function resourceDiscoveryRequest(resourceIdentifier, options) {\n    return performDiscovery(resourceIdentifier, 'resourceIdentifier', (url) => {\n        prependWellKnown(url, '.well-known/oauth-protected-resource', true);\n        return url;\n    }, options);\n}\nexport async function processResourceDiscoveryResponse(expectedResourceIdentifier, response) {\n    const expected = expectedResourceIdentifier;\n    if (!(expected instanceof URL) && expected !== _nodiscoverycheck) {\n        throw CodedTypeError('\"expectedResourceIdentifier\" must be an instance of URL', ERR_INVALID_ARG_TYPE);\n    }\n    if (!looseInstanceOf(response, Response)) {\n        throw CodedTypeError('\"response\" must be an instance of Response', ERR_INVALID_ARG_TYPE);\n    }\n    if (response.status !== 200) {\n        throw OPE('\"response\" is not a conform Resource Server Metadata response (unexpected HTTP status code)', RESPONSE_IS_NOT_CONFORM, response);\n    }\n    assertReadableResponse(response);\n    const json = await getResponseJsonBody(response);\n    assertString(json.resource, '\"response\" body \"resource\" property', INVALID_RESPONSE, {\n        body: json,\n    });\n    if (expected !== _nodiscoverycheck && new URL(json.resource).href !== expected.href) {\n        throw OPE('\"response\" body \"resource\" property does not match the expected value', JSON_ATTRIBUTE_COMPARISON, { expected: expected.href, body: json, attribute: 'resource' });\n    }\n    return json;\n}\nasync function getResponseJsonBody(response, check = assertApplicationJson) {\n    let json;\n    try {\n        json = await response.json();\n    }\n    catch (cause) {\n        check(response);\n        throw OPE('failed to parse \"response\" body as JSON', PARSE_ERROR, cause);\n    }\n    if (!isJsonObject(json)) {\n        throw OPE('\"response\" body must be a top level object', INVALID_RESPONSE, { body: json });\n    }\n    return json;\n}\nexport const _nopkce = nopkce;\nexport const _nodiscoverycheck = Symbol();\nexport const _expectedIssuer = Symbol();\n//# sourceMappingURL=index.js.map",
+    "import * as oauth from 'oauth4webapi';\nimport { compactDecrypt } from 'jose/jwe/compact/decrypt';\nimport { JOSEError } from 'jose/errors';\nlet headers;\nlet USER_AGENT;\nif (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {\n    const NAME = 'openid-client';\n    const VERSION = 'v6.8.4';\n    USER_AGENT = `${NAME}/${VERSION}`;\n    headers = { 'user-agent': USER_AGENT };\n}\nconst int = (config) => {\n    return props.get(config);\n};\nlet props;\nexport { AuthorizationResponseError, ResponseBodyError, WWWAuthenticateChallengeError, } from 'oauth4webapi';\nlet tbi;\nexport function ClientSecretPost(clientSecret) {\n    if (clientSecret !== undefined) {\n        return oauth.ClientSecretPost(clientSecret);\n    }\n    tbi ||= new WeakMap();\n    return (as, client, body, headers) => {\n        let auth;\n        if (!(auth = tbi.get(client))) {\n            assertString(client.client_secret, '\"metadata.client_secret\"');\n            auth = oauth.ClientSecretPost(client.client_secret);\n            tbi.set(client, auth);\n        }\n        return auth(as, client, body, headers);\n    };\n}\nfunction assertString(input, it) {\n    if (typeof input !== 'string') {\n        throw CodedTypeError(`${it} must be a string`, ERR_INVALID_ARG_TYPE);\n    }\n    if (input.length === 0) {\n        throw CodedTypeError(`${it} must not be empty`, ERR_INVALID_ARG_VALUE);\n    }\n}\nexport function ClientSecretBasic(clientSecret) {\n    if (clientSecret !== undefined) {\n        return oauth.ClientSecretBasic(clientSecret);\n    }\n    tbi ||= new WeakMap();\n    return (as, client, body, headers) => {\n        let auth;\n        if (!(auth = tbi.get(client))) {\n            assertString(client.client_secret, '\"metadata.client_secret\"');\n            auth = oauth.ClientSecretBasic(client.client_secret);\n            tbi.set(client, auth);\n        }\n        return auth(as, client, body, headers);\n    };\n}\nexport function ClientSecretJwt(clientSecret, options) {\n    if (clientSecret !== undefined) {\n        return oauth.ClientSecretJwt(clientSecret, options);\n    }\n    tbi ||= new WeakMap();\n    return (as, client, body, headers) => {\n        let auth;\n        if (!(auth = tbi.get(client))) {\n            assertString(client.client_secret, '\"metadata.client_secret\"');\n            auth = oauth.ClientSecretJwt(client.client_secret, options);\n            tbi.set(client, auth);\n        }\n        return auth(as, client, body, headers);\n    };\n}\nexport function None() {\n    return oauth.None();\n}\nexport function PrivateKeyJwt(clientPrivateKey, options) {\n    return oauth.PrivateKeyJwt(clientPrivateKey, options);\n}\nexport function TlsClientAuth() {\n    return oauth.TlsClientAuth();\n}\nexport const skipStateCheck = oauth.skipStateCheck;\nexport const skipSubjectCheck = oauth.skipSubjectCheck;\nexport const customFetch = oauth.customFetch;\nexport const modifyAssertion = oauth.modifyAssertion;\nexport const clockSkew = oauth.clockSkew;\nexport const clockTolerance = oauth.clockTolerance;\nconst ERR_INVALID_ARG_VALUE = 'ERR_INVALID_ARG_VALUE';\nconst ERR_INVALID_ARG_TYPE = 'ERR_INVALID_ARG_TYPE';\nfunction CodedTypeError(message, code, cause) {\n    const err = new TypeError(message, { cause });\n    Object.assign(err, { code });\n    return err;\n}\nexport function calculatePKCECodeChallenge(codeVerifier) {\n    return oauth.calculatePKCECodeChallenge(codeVerifier);\n}\nexport function randomPKCECodeVerifier() {\n    return oauth.generateRandomCodeVerifier();\n}\nexport function randomNonce() {\n    return oauth.generateRandomNonce();\n}\nexport function randomState() {\n    return oauth.generateRandomState();\n}\nexport class ClientError extends Error {\n    code;\n    constructor(message, options) {\n        super(message, options);\n        this.name = this.constructor.name;\n        this.code = options?.code;\n        Error.captureStackTrace?.(this, this.constructor);\n    }\n}\nconst decoder = new TextDecoder();\nfunction e(msg, cause, code) {\n    return new ClientError(msg, { cause, code });\n}\nfunction errorHandler(err) {\n    if (err instanceof TypeError ||\n        err instanceof ClientError ||\n        err instanceof oauth.ResponseBodyError ||\n        err instanceof oauth.AuthorizationResponseError ||\n        err instanceof oauth.WWWAuthenticateChallengeError) {\n        throw err;\n    }\n    if (err instanceof oauth.OperationProcessingError) {\n        switch (err.code) {\n            case oauth.HTTP_REQUEST_FORBIDDEN:\n                throw e('only requests to HTTPS are allowed', err, err.code);\n            case oauth.REQUEST_PROTOCOL_FORBIDDEN:\n                throw e('only requests to HTTP or HTTPS are allowed', err, err.code);\n            case oauth.RESPONSE_IS_NOT_CONFORM:\n                throw e('unexpected HTTP response status code', err.cause, err.code);\n            case oauth.RESPONSE_IS_NOT_JSON:\n                throw e('unexpected response content-type', err.cause, err.code);\n            case oauth.PARSE_ERROR:\n                throw e('parsing error occured', err, err.code);\n            case oauth.INVALID_RESPONSE:\n                throw e('invalid response encountered', err, err.code);\n            case oauth.JWT_CLAIM_COMPARISON:\n                throw e('unexpected JWT claim value encountered', err, err.code);\n            case oauth.JSON_ATTRIBUTE_COMPARISON:\n                throw e('unexpected JSON attribute value encountered', err, err.code);\n            case oauth.JWT_TIMESTAMP_CHECK:\n                throw e('JWT timestamp claim value failed validation', err, err.code);\n            default:\n                throw e(err.message, err, err.code);\n        }\n    }\n    if (err instanceof oauth.UnsupportedOperationError) {\n        throw e('unsupported operation', err, err.code);\n    }\n    if (err instanceof DOMException) {\n        switch (err.name) {\n            case 'OperationError':\n                throw e('runtime operation error', err, oauth.UNSUPPORTED_OPERATION);\n            case 'NotSupportedError':\n                throw e('runtime unsupported operation', err, oauth.UNSUPPORTED_OPERATION);\n            case 'TimeoutError':\n                throw e('operation timed out', err, 'OAUTH_TIMEOUT');\n            case 'AbortError':\n                throw e('operation aborted', err, 'OAUTH_ABORT');\n        }\n    }\n    throw new ClientError('something went wrong', { cause: err });\n}\nexport function randomDPoPKeyPair(alg, options) {\n    return oauth\n        .generateKeyPair(alg ?? 'ES256', {\n        extractable: options?.extractable,\n    })\n        .catch(errorHandler);\n}\nfunction handleEntraId(server, as, options) {\n    if (server.origin === 'https://login.microsoftonline.com' &&\n        (!options?.algorithm || options.algorithm === 'oidc')) {\n        as[kEntraId] = true;\n        return true;\n    }\n    return false;\n}\nfunction handleB2Clogin(server, options) {\n    if (server.hostname.endsWith('.b2clogin.com') &&\n        (!options?.algorithm || options.algorithm === 'oidc')) {\n        return true;\n    }\n    return false;\n}\nexport async function dynamicClientRegistration(server, metadata, clientAuthentication, options) {\n    let as;\n    if (options?.flag === retry) {\n        as = options.as;\n    }\n    else {\n        as = await performDiscovery(server, options);\n    }\n    const clockSkew = metadata[oauth.clockSkew] ?? 0;\n    const clockTolerance = metadata[oauth.clockTolerance] ?? 30;\n    metadata = structuredClone(metadata);\n    const timeout = options?.timeout ?? 30;\n    const signal = AbortSignal.timeout(timeout * 1000);\n    let registered;\n    try {\n        registered = await oauth\n            .dynamicClientRegistrationRequest(as, metadata, {\n            initialAccessToken: options?.initialAccessToken,\n            DPoP: options?.DPoP,\n            headers: new Headers(headers),\n            [oauth.customFetch]: options?.[customFetch],\n            [oauth.allowInsecureRequests]: options?.execute?.includes(allowInsecureRequests),\n            signal,\n        })\n            .then(oauth.processDynamicClientRegistrationResponse);\n    }\n    catch (err) {\n        if (retryable(err, options)) {\n            return dynamicClientRegistration(server, metadata, clientAuthentication, {\n                ...options,\n                flag: retry,\n                as,\n            });\n        }\n        errorHandler(err);\n    }\n    registered[oauth.clockSkew] = clockSkew;\n    registered[oauth.clockTolerance] = clockTolerance;\n    const instance = new Configuration(as, registered.client_id, registered, clientAuthentication);\n    let internals = int(instance);\n    if (options?.[customFetch]) {\n        internals.fetch = options[customFetch];\n    }\n    if (options?.timeout) {\n        internals.timeout = options.timeout;\n    }\n    if (options?.execute) {\n        for (const extension of options.execute) {\n            extension(instance);\n        }\n    }\n    return instance;\n}\nexport async function discovery(server, clientId, metadata, clientAuthentication, options) {\n    const as = await performDiscovery(server, options);\n    const instance = new Configuration(as, clientId, metadata, clientAuthentication);\n    let internals = int(instance);\n    if (options?.[customFetch]) {\n        internals.fetch = options[customFetch];\n    }\n    if (options?.timeout) {\n        internals.timeout = options.timeout;\n    }\n    if (options?.execute) {\n        for (const extension of options.execute) {\n            extension(instance);\n        }\n    }\n    return instance;\n}\nasync function performDiscovery(server, options) {\n    if (!(server instanceof URL)) {\n        throw CodedTypeError('\"server\" must be an instance of URL', ERR_INVALID_ARG_TYPE);\n    }\n    const resolve = !server.href.includes('/.well-known/');\n    const timeout = options?.timeout ?? 30;\n    const signal = AbortSignal.timeout(timeout * 1000);\n    const as = await (resolve\n        ? oauth.discoveryRequest(server, {\n            algorithm: options?.algorithm,\n            [oauth.customFetch]: options?.[customFetch],\n            [oauth.allowInsecureRequests]: options?.execute?.includes(allowInsecureRequests),\n            signal,\n            headers: new Headers(headers),\n        })\n        : (options?.[customFetch] || fetch)((() => {\n            oauth.checkProtocol(server, options?.execute?.includes(allowInsecureRequests) ? false : true);\n            return server.href;\n        })(), {\n            headers: Object.fromEntries(new Headers({ accept: 'application/json', ...headers }).entries()),\n            body: undefined,\n            method: 'GET',\n            redirect: 'manual',\n            signal,\n        }))\n        .then((response) => oauth.processDiscoveryResponse(oauth._nodiscoverycheck, response))\n        .catch(errorHandler);\n    if (resolve && new URL(as.issuer).href !== server.href) {\n        handleEntraId(server, as, options) ||\n            handleB2Clogin(server, options) ||\n            (() => {\n                throw new ClientError('discovered metadata issuer does not match the expected issuer', {\n                    code: oauth.JSON_ATTRIBUTE_COMPARISON,\n                    cause: {\n                        expected: server.href,\n                        body: as,\n                        attribute: 'issuer',\n                    },\n                });\n            })();\n    }\n    return as;\n}\nfunction isRsaOaep(input) {\n    return input.name === 'RSA-OAEP';\n}\nfunction isEcdh(input) {\n    return input.name === 'ECDH';\n}\nconst ecdhEs = 'ECDH-ES';\nconst ecdhEsA128Kw = 'ECDH-ES+A128KW';\nconst ecdhEsA192Kw = 'ECDH-ES+A192KW';\nconst ecdhEsA256Kw = 'ECDH-ES+A256KW';\nfunction checkEcdhAlg(algs, alg, pk) {\n    switch (alg) {\n        case undefined:\n            algs.add(ecdhEs);\n            algs.add(ecdhEsA128Kw);\n            algs.add(ecdhEsA192Kw);\n            algs.add(ecdhEsA256Kw);\n            break;\n        case ecdhEs:\n        case ecdhEsA128Kw:\n        case ecdhEsA192Kw:\n        case ecdhEsA256Kw:\n            algs.add(alg);\n            break;\n        default:\n            throw CodedTypeError('invalid key alg', ERR_INVALID_ARG_VALUE, { pk });\n    }\n}\nexport function enableDecryptingResponses(config, contentEncryptionAlgorithms = [\n    'A128GCM',\n    'A192GCM',\n    'A256GCM',\n    'A128CBC-HS256',\n    'A192CBC-HS384',\n    'A256CBC-HS512',\n], ...keys) {\n    if (int(config).decrypt !== undefined) {\n        throw new TypeError('enableDecryptingResponses can only be called on a given Configuration instance once');\n    }\n    if (keys.length === 0) {\n        throw CodedTypeError('no keys were provided', ERR_INVALID_ARG_VALUE);\n    }\n    const algs = new Set();\n    const normalized = [];\n    for (const pk of keys) {\n        let key;\n        if ('key' in pk) {\n            key = { key: pk.key };\n            if (typeof pk.alg === 'string')\n                key.alg = pk.alg;\n            if (typeof pk.kid === 'string')\n                key.kid = pk.kid;\n        }\n        else {\n            key = { key: pk };\n        }\n        if (key.key.type !== 'private') {\n            throw CodedTypeError('only private keys must be provided', ERR_INVALID_ARG_VALUE);\n        }\n        if (isRsaOaep(key.key.algorithm)) {\n            switch (key.key.algorithm.hash.name) {\n                case 'SHA-1':\n                case 'SHA-256':\n                case 'SHA-384':\n                case 'SHA-512': {\n                    let alg = 'RSA-OAEP';\n                    let sha;\n                    if ((sha = parseInt(key.key.algorithm.hash.name.slice(-3), 10))) {\n                        alg = `${alg}-${sha}`;\n                    }\n                    key.alg ||= alg;\n                    if (alg !== key.alg)\n                        throw CodedTypeError('invalid key alg', ERR_INVALID_ARG_VALUE, {\n                            pk,\n                        });\n                    algs.add(key.alg);\n                    break;\n                }\n                default:\n                    throw CodedTypeError('only SHA-512, SHA-384, SHA-256, and SHA-1 RSA-OAEP keys are supported', ERR_INVALID_ARG_VALUE);\n            }\n        }\n        else if (isEcdh(key.key.algorithm)) {\n            if (key.key.algorithm.namedCurve !== 'P-256') {\n                throw CodedTypeError('Only P-256 ECDH keys are supported', ERR_INVALID_ARG_VALUE);\n            }\n            checkEcdhAlg(algs, key.alg, pk);\n        }\n        else if (key.key.algorithm.name === 'X25519') {\n            checkEcdhAlg(algs, key.alg, pk);\n        }\n        else {\n            throw CodedTypeError('only RSA-OAEP, ECDH, or X25519 keys are supported', ERR_INVALID_ARG_VALUE);\n        }\n        normalized.push(key);\n    }\n    int(config).decrypt = async (jwe) => decrypt(normalized, jwe, contentEncryptionAlgorithms, [...algs]).catch(errorHandler);\n}\nfunction checkCryptoKey(key, alg, epk) {\n    if (alg.startsWith('RSA-OAEP')) {\n        return key.algorithm.name === 'RSA-OAEP';\n    }\n    if (alg.startsWith('ECDH-ES')) {\n        if (key.algorithm.name !== 'ECDH' && key.algorithm.name !== 'X25519') {\n            return false;\n        }\n        if (key.algorithm.name === 'ECDH') {\n            return epk?.crv === key.algorithm.namedCurve;\n        }\n        if (key.algorithm.name === 'X25519') {\n            return epk?.crv === 'X25519';\n        }\n    }\n    return false;\n}\nfunction selectCryptoKeyForDecryption(keys, alg, kid, epk) {\n    const { 0: key, length } = keys.filter((key) => {\n        if (kid !== key.kid) {\n            return false;\n        }\n        if (key.alg && alg !== key.alg) {\n            return false;\n        }\n        return checkCryptoKey(key.key, alg, epk);\n    });\n    if (!key) {\n        throw e('no applicable decryption key selected', undefined, 'OAUTH_DECRYPTION_FAILED');\n    }\n    if (length !== 1) {\n        throw e('multiple applicable decryption keys selected', undefined, 'OAUTH_DECRYPTION_FAILED');\n    }\n    return key.key;\n}\nasync function decrypt(keys, jwe, contentEncryptionAlgorithms, keyManagementAlgorithms) {\n    return decoder.decode((await compactDecrypt(jwe, (header) => {\n        const { kid, alg, epk } = header;\n        return selectCryptoKeyForDecryption(keys, alg, kid, epk);\n    }, { keyManagementAlgorithms, contentEncryptionAlgorithms }).catch((err) => {\n        if (err instanceof JOSEError) {\n            throw e('decryption failed', err, 'OAUTH_DECRYPTION_FAILED');\n        }\n        errorHandler(err);\n    })).plaintext);\n}\nfunction getServerHelpers(metadata) {\n    return {\n        supportsPKCE: {\n            __proto__: null,\n            value(method = 'S256') {\n                return (metadata.code_challenge_methods_supported?.includes(method) === true);\n            },\n        },\n    };\n}\nfunction addServerHelpers(metadata) {\n    Object.defineProperties(metadata, getServerHelpers(metadata));\n}\nconst kEntraId = Symbol();\nexport class Configuration {\n    constructor(server, clientId, metadata, clientAuthentication) {\n        if (typeof clientId !== 'string' || !clientId.length) {\n            throw CodedTypeError('\"clientId\" must be a non-empty string', ERR_INVALID_ARG_TYPE);\n        }\n        if (typeof metadata === 'string') {\n            metadata = { client_secret: metadata };\n        }\n        if (metadata?.client_id !== undefined && clientId !== metadata.client_id) {\n            throw CodedTypeError('\"clientId\" and \"metadata.client_id\" must be the same', ERR_INVALID_ARG_VALUE);\n        }\n        const client = {\n            ...structuredClone(metadata),\n            client_id: clientId,\n        };\n        client[oauth.clockSkew] = metadata?.[oauth.clockSkew] ?? 0;\n        client[oauth.clockTolerance] = metadata?.[oauth.clockTolerance] ?? 30;\n        let auth;\n        if (clientAuthentication) {\n            auth = clientAuthentication;\n        }\n        else {\n            if (typeof client.client_secret === 'string' &&\n                client.client_secret.length) {\n                auth = ClientSecretPost(client.client_secret);\n            }\n            else {\n                auth = None();\n            }\n        }\n        let c = Object.freeze(client);\n        const clone = structuredClone(server);\n        if (kEntraId in server) {\n            clone[oauth._expectedIssuer] = ({ claims: { tid } }) => server.issuer.replace('{tenantid}', tid);\n        }\n        let as = Object.freeze(clone);\n        props ||= new WeakMap();\n        props.set(this, {\n            __proto__: null,\n            as,\n            c,\n            auth,\n            tlsOnly: true,\n            jwksCache: {},\n        });\n    }\n    serverMetadata() {\n        const metadata = structuredClone(int(this).as);\n        addServerHelpers(metadata);\n        return metadata;\n    }\n    clientMetadata() {\n        const metadata = structuredClone(int(this).c);\n        return metadata;\n    }\n    get timeout() {\n        return int(this).timeout;\n    }\n    set timeout(value) {\n        int(this).timeout = value;\n    }\n    get [customFetch]() {\n        return int(this).fetch;\n    }\n    set [customFetch](value) {\n        int(this).fetch = value;\n    }\n}\nObject.freeze(Configuration.prototype);\nfunction getHelpers(response) {\n    let exp = undefined;\n    if (response.expires_in !== undefined) {\n        const now = new Date();\n        now.setSeconds(now.getSeconds() + response.expires_in);\n        exp = now.getTime();\n    }\n    return {\n        expiresIn: {\n            __proto__: null,\n            value() {\n                if (exp) {\n                    const now = Date.now();\n                    if (exp > now) {\n                        return Math.floor((exp - now) / 1000);\n                    }\n                    return 0;\n                }\n                return undefined;\n            },\n        },\n        claims: {\n            __proto__: null,\n            value() {\n                try {\n                    return oauth.getValidatedIdTokenClaims(this);\n                }\n                catch {\n                    return undefined;\n                }\n            },\n        },\n    };\n}\nfunction addHelpers(response) {\n    Object.defineProperties(response, getHelpers(response));\n}\nexport function getDPoPHandle(config, keyPair, options) {\n    checkConfig(config);\n    return oauth.DPoP(int(config).c, keyPair, options);\n}\nasync function handleRetryAfter(response, currentInterval, signal, throwIfInvalid = false) {\n    const retryAfter = response.headers.get('retry-after')?.trim();\n    if (retryAfter === undefined)\n        return;\n    let delaySeconds;\n    if (/^\\d+$/.test(retryAfter)) {\n        delaySeconds = parseInt(retryAfter, 10);\n    }\n    else {\n        const retryDate = new Date(retryAfter);\n        if (Number.isFinite(retryDate.getTime())) {\n            const now = new Date();\n            const delayMs = retryDate.getTime() - now.getTime();\n            if (delayMs > 0) {\n                delaySeconds = Math.ceil(delayMs / 1000);\n            }\n        }\n    }\n    if (throwIfInvalid && !Number.isFinite(delaySeconds)) {\n        throw new oauth.OperationProcessingError('invalid Retry-After header value', { cause: response });\n    }\n    if (delaySeconds > currentInterval) {\n        await wait(delaySeconds - currentInterval, signal);\n    }\n}\nfunction wait(duration, signal) {\n    return new Promise((resolve, reject) => {\n        const waitStep = (remaining) => {\n            try {\n                signal.throwIfAborted();\n            }\n            catch (err) {\n                reject(err);\n                return;\n            }\n            if (remaining <= 0) {\n                resolve();\n                return;\n            }\n            const currentWait = Math.min(remaining, 5);\n            setTimeout(() => waitStep(remaining - currentWait), currentWait * 1000);\n        };\n        waitStep(duration);\n    });\n}\nfunction pollRequestSignal(pollingSignal, timeout) {\n    const timeoutSignal = signal(timeout);\n    if (!timeoutSignal) {\n        return {\n            signal: pollingSignal,\n            cleanup() { },\n        };\n    }\n    const controller = new AbortController();\n    const abort = (event) => {\n        const source = event.target;\n        controller.abort(source.reason);\n    };\n    if (pollingSignal.aborted) {\n        controller.abort(pollingSignal.reason);\n    }\n    else if (timeoutSignal.aborted) {\n        controller.abort(timeoutSignal.reason);\n    }\n    else {\n        pollingSignal.addEventListener('abort', abort, { once: true });\n        timeoutSignal.addEventListener('abort', abort, { once: true });\n    }\n    return {\n        signal: controller.signal,\n        cleanup() {\n            pollingSignal.removeEventListener('abort', abort);\n            timeoutSignal.removeEventListener('abort', abort);\n        },\n    };\n}\nexport async function pollDeviceAuthorizationGrant(config, deviceAuthorizationResponse, parameters, options) {\n    checkConfig(config);\n    parameters = new URLSearchParams(parameters);\n    let interval = deviceAuthorizationResponse.interval ?? 5;\n    const pollingSignal = options?.signal ??\n        AbortSignal.timeout(deviceAuthorizationResponse.expires_in * 1000);\n    try {\n        await wait(interval, pollingSignal);\n    }\n    catch (err) {\n        errorHandler(err);\n    }\n    const { as, c, auth, fetch, tlsOnly, nonRepudiation, timeout, decrypt } = int(config);\n    const retryPoll = (updatedInterval, flag) => pollDeviceAuthorizationGrant(config, {\n        ...deviceAuthorizationResponse,\n        interval: updatedInterval,\n    }, parameters, {\n        ...options,\n        signal: pollingSignal,\n        flag,\n    });\n    const requestSignal = pollRequestSignal(pollingSignal, timeout);\n    const response = await oauth\n        .deviceCodeGrantRequest(as, c, auth, deviceAuthorizationResponse.device_code, {\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        additionalParameters: parameters,\n        DPoP: options?.DPoP,\n        headers: new Headers(headers),\n        signal: requestSignal.signal,\n    })\n        .catch(errorHandler)\n        .finally(requestSignal.cleanup);\n    if (response.status === 503 && response.headers.has('retry-after')) {\n        await handleRetryAfter(response, interval, pollingSignal, true);\n        await response.body?.cancel();\n        return retryPoll(interval);\n    }\n    const p = oauth.processDeviceCodeResponse(as, c, response, {\n        [oauth.jweDecrypt]: decrypt,\n    });\n    let result;\n    try {\n        result = await p;\n    }\n    catch (err) {\n        if (retryable(err, options)) {\n            return retryPoll(interval, retry);\n        }\n        if (err instanceof oauth.ResponseBodyError) {\n            switch (err.error) {\n                case 'slow_down':\n                    interval += 5;\n                case 'authorization_pending':\n                    await handleRetryAfter(err.response, interval, pollingSignal);\n                    return retryPoll(interval);\n            }\n        }\n        errorHandler(err);\n    }\n    result.id_token && (await nonRepudiation?.(response));\n    addHelpers(result);\n    return result;\n}\nexport async function initiateDeviceAuthorization(config, parameters) {\n    checkConfig(config);\n    const { as, c, auth, fetch, tlsOnly, timeout } = int(config);\n    return oauth\n        .deviceAuthorizationRequest(as, c, auth, parameters, {\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        headers: new Headers(headers),\n        signal: signal(timeout),\n    })\n        .then((response) => oauth.processDeviceAuthorizationResponse(as, c, response))\n        .catch(errorHandler);\n}\nexport async function initiateBackchannelAuthentication(config, parameters) {\n    checkConfig(config);\n    const { as, c, auth, fetch, tlsOnly, timeout } = int(config);\n    return oauth\n        .backchannelAuthenticationRequest(as, c, auth, parameters, {\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        headers: new Headers(headers),\n        signal: signal(timeout),\n    })\n        .then((response) => oauth.processBackchannelAuthenticationResponse(as, c, response))\n        .catch(errorHandler);\n}\nexport async function pollBackchannelAuthenticationGrant(config, backchannelAuthenticationResponse, parameters, options) {\n    checkConfig(config);\n    parameters = new URLSearchParams(parameters);\n    let interval = backchannelAuthenticationResponse.interval ?? 5;\n    const pollingSignal = options?.signal ??\n        AbortSignal.timeout(backchannelAuthenticationResponse.expires_in * 1000);\n    try {\n        await wait(interval, pollingSignal);\n    }\n    catch (err) {\n        errorHandler(err);\n    }\n    const { as, c, auth, fetch, tlsOnly, nonRepudiation, timeout, decrypt } = int(config);\n    const retryPoll = (updatedInterval, flag) => pollBackchannelAuthenticationGrant(config, {\n        ...backchannelAuthenticationResponse,\n        interval: updatedInterval,\n    }, parameters, {\n        ...options,\n        signal: pollingSignal,\n        flag,\n    });\n    const requestSignal = pollRequestSignal(pollingSignal, timeout);\n    const response = await oauth\n        .backchannelAuthenticationGrantRequest(as, c, auth, backchannelAuthenticationResponse.auth_req_id, {\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        additionalParameters: parameters,\n        DPoP: options?.DPoP,\n        headers: new Headers(headers),\n        signal: requestSignal.signal,\n    })\n        .catch(errorHandler)\n        .finally(requestSignal.cleanup);\n    if (response.status === 503 && response.headers.has('retry-after')) {\n        await handleRetryAfter(response, interval, pollingSignal, true);\n        await response.body?.cancel();\n        return retryPoll(interval);\n    }\n    const p = oauth.processBackchannelAuthenticationGrantResponse(as, c, response, {\n        [oauth.jweDecrypt]: decrypt,\n    });\n    let result;\n    try {\n        result = await p;\n    }\n    catch (err) {\n        if (retryable(err, options)) {\n            return retryPoll(interval, retry);\n        }\n        if (err instanceof oauth.ResponseBodyError) {\n            switch (err.error) {\n                case 'slow_down':\n                    interval += 5;\n                case 'authorization_pending':\n                    await handleRetryAfter(err.response, interval, pollingSignal);\n                    return retryPoll(interval);\n            }\n        }\n        errorHandler(err);\n    }\n    result.id_token && (await nonRepudiation?.(response));\n    addHelpers(result);\n    return result;\n}\nexport function allowInsecureRequests(config) {\n    int(config).tlsOnly = false;\n}\nexport function setJwksCache(config, jwksCache) {\n    int(config).jwksCache = structuredClone(jwksCache);\n}\nexport function getJwksCache(config) {\n    const cache = int(config).jwksCache;\n    if (cache.uat) {\n        return cache;\n    }\n    return undefined;\n}\nexport function enableNonRepudiationChecks(config) {\n    checkConfig(config);\n    int(config).nonRepudiation = (response) => {\n        const { as, fetch, tlsOnly, timeout, jwksCache } = int(config);\n        return oauth\n            .validateApplicationLevelSignature(as, response, {\n            [oauth.customFetch]: fetch,\n            [oauth.allowInsecureRequests]: !tlsOnly,\n            headers: new Headers(headers),\n            signal: signal(timeout),\n            [oauth.jwksCache]: jwksCache,\n        })\n            .catch(errorHandler);\n    };\n}\nexport function useJwtResponseMode(config) {\n    checkConfig(config);\n    const { hybrid, implicit } = int(config);\n    if (hybrid || implicit) {\n        throw e('JARM cannot be combined with a hybrid or implicit response types', undefined, oauth.UNSUPPORTED_OPERATION);\n    }\n    int(config).jarm = (authorizationResponse, expectedState) => validateJARMResponse(config, authorizationResponse, expectedState);\n}\nexport function enableDetachedSignatureResponseChecks(config) {\n    if (!int(config).hybrid) {\n        throw e('\"code id_token\" response type must be configured to be used first', undefined, oauth.UNSUPPORTED_OPERATION);\n    }\n    int(config).hybrid = (authorizationResponse, expectedNonce, expectedState, maxAge) => validateCodeIdTokenResponse(config, authorizationResponse, expectedNonce, expectedState, maxAge, true);\n}\nexport async function implicitAuthentication(config, currentUrl, expectedNonce, checks) {\n    checkConfig(config);\n    if (!(currentUrl instanceof URL) &&\n        !webInstanceOf(currentUrl, 'Request')) {\n        throw CodedTypeError('\"currentUrl\" must be an instance of URL, or Request', ERR_INVALID_ARG_TYPE);\n    }\n    if (typeof expectedNonce !== 'string') {\n        throw CodedTypeError('\"expectedNonce\" must be a string', ERR_INVALID_ARG_TYPE);\n    }\n    const { as, c, fetch, tlsOnly, timeout, decrypt, implicit, jwksCache } = int(config);\n    if (!implicit) {\n        throw new TypeError('implicitAuthentication() cannot be used by clients using flows other than response_type=id_token');\n    }\n    let params;\n    if (!(currentUrl instanceof URL)) {\n        const request = currentUrl;\n        switch (request.method) {\n            case 'GET':\n                params = new URLSearchParams(new URL(request.url).hash.slice(1));\n                break;\n            case 'POST':\n                params = new URLSearchParams(await oauth.formPostResponse(request));\n                break;\n            default:\n                throw CodedTypeError('unexpected Request HTTP method', ERR_INVALID_ARG_VALUE);\n        }\n    }\n    else {\n        params = new URLSearchParams(currentUrl.hash.slice(1));\n    }\n    try {\n        {\n            const decoy = new URLSearchParams(params);\n            decoy.delete('id_token');\n            oauth.validateAuthResponse({\n                ...as,\n                authorization_response_iss_parameter_supported: undefined,\n            }, c, decoy, checks?.expectedState);\n        }\n        {\n            const decoy = new Response(JSON.stringify({\n                access_token: 'decoy',\n                token_type: 'bearer',\n                id_token: params.get('id_token'),\n            }), {\n                headers: new Headers({ 'content-type': 'application/json' }),\n            });\n            const ref = await oauth.processAuthorizationCodeResponse(as, c, decoy, {\n                expectedNonce,\n                maxAge: checks?.maxAge,\n                [oauth.jweDecrypt]: decrypt,\n            });\n            await oauth.validateApplicationLevelSignature(as, decoy, {\n                [oauth.customFetch]: fetch,\n                [oauth.allowInsecureRequests]: !tlsOnly,\n                headers: new Headers(headers),\n                signal: signal(timeout),\n                [oauth.jwksCache]: jwksCache,\n            });\n            return oauth.getValidatedIdTokenClaims(ref);\n        }\n    }\n    catch (err) {\n        errorHandler(err);\n    }\n}\nexport function useCodeIdTokenResponseType(config) {\n    checkConfig(config);\n    const { jarm, implicit } = int(config);\n    if (jarm || implicit) {\n        throw e('\"code id_token\" response type cannot be combined with JARM or implicit response type', undefined, oauth.UNSUPPORTED_OPERATION);\n    }\n    int(config).hybrid = (authorizationResponse, expectedNonce, expectedState, maxAge) => validateCodeIdTokenResponse(config, authorizationResponse, expectedNonce, expectedState, maxAge, false);\n}\nexport function useIdTokenResponseType(config) {\n    checkConfig(config);\n    const { jarm, hybrid } = int(config);\n    if (jarm || hybrid) {\n        throw e('\"id_token\" response type cannot be combined with JARM or hybrid response type', undefined, oauth.UNSUPPORTED_OPERATION);\n    }\n    int(config).implicit = true;\n}\nfunction stripParams(url) {\n    url = new URL(url);\n    url.search = '';\n    url.hash = '';\n    return url.href;\n}\nfunction webInstanceOf(input, toStringTag) {\n    try {\n        return Object.getPrototypeOf(input)[Symbol.toStringTag] === toStringTag;\n    }\n    catch {\n        return false;\n    }\n}\nexport async function authorizationCodeGrant(config, currentUrl, checks, tokenEndpointParameters, options) {\n    checkConfig(config);\n    if (options?.flag !== retry &&\n        !(currentUrl instanceof URL) &&\n        !webInstanceOf(currentUrl, 'Request')) {\n        throw CodedTypeError('\"currentUrl\" must be an instance of URL, or Request', ERR_INVALID_ARG_TYPE);\n    }\n    let authResponse;\n    let redirectUri;\n    const { as, c, auth, fetch, tlsOnly, jarm, hybrid, nonRepudiation, timeout, decrypt, implicit } = int(config);\n    if (options?.flag === retry) {\n        authResponse = options.authResponse;\n        redirectUri = options.redirectUri;\n    }\n    else {\n        if (!(currentUrl instanceof URL)) {\n            const request = currentUrl;\n            currentUrl = new URL(currentUrl.url);\n            switch (request.method) {\n                case 'GET':\n                    break;\n                case 'POST':\n                    const params = new URLSearchParams(await oauth.formPostResponse(request));\n                    if (hybrid) {\n                        currentUrl.hash = params.toString();\n                    }\n                    else {\n                        for (const [k, v] of params.entries()) {\n                            currentUrl.searchParams.append(k, v);\n                        }\n                    }\n                    break;\n                default:\n                    throw CodedTypeError('unexpected Request HTTP method', ERR_INVALID_ARG_VALUE);\n            }\n        }\n        redirectUri = stripParams(currentUrl);\n        switch (true) {\n            case !!jarm:\n                authResponse = await jarm(currentUrl, checks?.expectedState);\n                break;\n            case !!hybrid:\n                authResponse = await hybrid(currentUrl, checks?.expectedNonce, checks?.expectedState, checks?.maxAge);\n                break;\n            case !!implicit:\n                throw new TypeError('authorizationCodeGrant() cannot be used by response_type=id_token clients');\n            default:\n                try {\n                    authResponse = oauth.validateAuthResponse(as, c, currentUrl.searchParams, checks?.expectedState);\n                }\n                catch (err) {\n                    errorHandler(err);\n                }\n        }\n    }\n    const response = await oauth\n        .authorizationCodeGrantRequest(as, c, auth, authResponse, redirectUri, checks?.pkceCodeVerifier || oauth.nopkce, {\n        additionalParameters: tokenEndpointParameters,\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        DPoP: options?.DPoP,\n        headers: new Headers(headers),\n        signal: signal(timeout),\n    })\n        .catch(errorHandler);\n    if (typeof checks?.expectedNonce === 'string' ||\n        typeof checks?.maxAge === 'number') {\n        checks.idTokenExpected = true;\n    }\n    const p = oauth.processAuthorizationCodeResponse(as, c, response, {\n        expectedNonce: checks?.expectedNonce,\n        maxAge: checks?.maxAge,\n        requireIdToken: checks?.idTokenExpected,\n        [oauth.jweDecrypt]: decrypt,\n    });\n    let result;\n    try {\n        result = await p;\n    }\n    catch (err) {\n        if (retryable(err, options)) {\n            return authorizationCodeGrant(config, undefined, checks, tokenEndpointParameters, {\n                ...options,\n                flag: retry,\n                authResponse: authResponse,\n                redirectUri: redirectUri,\n            });\n        }\n        errorHandler(err);\n    }\n    result.id_token && (await nonRepudiation?.(response));\n    addHelpers(result);\n    return result;\n}\nasync function validateJARMResponse(config, authorizationResponse, expectedState) {\n    const { as, c, fetch, tlsOnly, timeout, decrypt, jwksCache } = int(config);\n    return oauth\n        .validateJwtAuthResponse(as, c, authorizationResponse, expectedState, {\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        headers: new Headers(headers),\n        signal: signal(timeout),\n        [oauth.jweDecrypt]: decrypt,\n        [oauth.jwksCache]: jwksCache,\n    })\n        .catch(errorHandler);\n}\nasync function validateCodeIdTokenResponse(config, authorizationResponse, expectedNonce, expectedState, maxAge, fapi) {\n    if (typeof expectedNonce !== 'string') {\n        throw CodedTypeError('\"expectedNonce\" must be a string', ERR_INVALID_ARG_TYPE);\n    }\n    if (expectedState !== undefined && typeof expectedState !== 'string') {\n        throw CodedTypeError('\"expectedState\" must be a string', ERR_INVALID_ARG_TYPE);\n    }\n    const { as, c, fetch, tlsOnly, timeout, decrypt, jwksCache } = int(config);\n    return (fapi\n        ? oauth.validateDetachedSignatureResponse\n        : oauth.validateCodeIdTokenResponse)(as, c, authorizationResponse, expectedNonce, expectedState, maxAge, {\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        headers: new Headers(headers),\n        signal: signal(timeout),\n        [oauth.jweDecrypt]: decrypt,\n        [oauth.jwksCache]: jwksCache,\n    }).catch(errorHandler);\n}\nexport async function refreshTokenGrant(config, refreshToken, parameters, options) {\n    checkConfig(config);\n    parameters = new URLSearchParams(parameters);\n    const { as, c, auth, fetch, tlsOnly, nonRepudiation, timeout, decrypt } = int(config);\n    const response = await oauth\n        .refreshTokenGrantRequest(as, c, auth, refreshToken, {\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        additionalParameters: parameters,\n        DPoP: options?.DPoP,\n        headers: new Headers(headers),\n        signal: signal(timeout),\n    })\n        .catch(errorHandler);\n    const p = oauth.processRefreshTokenResponse(as, c, response, {\n        [oauth.jweDecrypt]: decrypt,\n    });\n    let result;\n    try {\n        result = await p;\n    }\n    catch (err) {\n        if (retryable(err, options)) {\n            return refreshTokenGrant(config, refreshToken, parameters, {\n                ...options,\n                flag: retry,\n            });\n        }\n        errorHandler(err);\n    }\n    result.id_token && (await nonRepudiation?.(response));\n    addHelpers(result);\n    return result;\n}\nexport async function clientCredentialsGrant(config, parameters, options) {\n    checkConfig(config);\n    parameters = new URLSearchParams(parameters);\n    const { as, c, auth, fetch, tlsOnly, timeout } = int(config);\n    const response = await oauth\n        .clientCredentialsGrantRequest(as, c, auth, parameters, {\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        DPoP: options?.DPoP,\n        headers: new Headers(headers),\n        signal: signal(timeout),\n    })\n        .catch(errorHandler);\n    const p = oauth.processClientCredentialsResponse(as, c, response);\n    let result;\n    try {\n        result = await p;\n    }\n    catch (err) {\n        if (retryable(err, options)) {\n            return clientCredentialsGrant(config, parameters, {\n                ...options,\n                flag: retry,\n            });\n        }\n        errorHandler(err);\n    }\n    addHelpers(result);\n    return result;\n}\nexport function buildAuthorizationUrl(config, parameters) {\n    checkConfig(config);\n    const { as, c, tlsOnly, hybrid, jarm, implicit } = int(config);\n    const authorizationEndpoint = oauth.resolveEndpoint(as, 'authorization_endpoint', false, tlsOnly);\n    parameters = new URLSearchParams(parameters);\n    if (!parameters.has('client_id')) {\n        parameters.set('client_id', c.client_id);\n    }\n    if (!parameters.has('request_uri') && !parameters.has('request')) {\n        if (!parameters.has('response_type')) {\n            parameters.set('response_type', hybrid ? 'code id_token' : implicit ? 'id_token' : 'code');\n        }\n        if (implicit && !parameters.has('nonce')) {\n            throw CodedTypeError('response_type=id_token clients must provide a nonce parameter in their authorization request parameters', ERR_INVALID_ARG_VALUE);\n        }\n        if (jarm) {\n            parameters.set('response_mode', 'jwt');\n        }\n    }\n    for (const [k, v] of parameters.entries()) {\n        authorizationEndpoint.searchParams.append(k, v);\n    }\n    return authorizationEndpoint;\n}\nexport async function buildAuthorizationUrlWithJAR(config, parameters, signingKey, options) {\n    checkConfig(config);\n    const authorizationEndpoint = buildAuthorizationUrl(config, parameters);\n    parameters = authorizationEndpoint.searchParams;\n    if (!signingKey) {\n        throw CodedTypeError('\"signingKey\" must be provided', ERR_INVALID_ARG_VALUE);\n    }\n    const { as, c } = int(config);\n    const request = await oauth\n        .issueRequestObject(as, c, parameters, signingKey, options)\n        .catch(errorHandler);\n    return buildAuthorizationUrl(config, { request });\n}\nexport async function buildAuthorizationUrlWithPAR(config, parameters, options) {\n    checkConfig(config);\n    const authorizationEndpoint = buildAuthorizationUrl(config, parameters);\n    const { as, c, auth, fetch, tlsOnly, timeout } = int(config);\n    const response = await oauth\n        .pushedAuthorizationRequest(as, c, auth, authorizationEndpoint.searchParams, {\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        DPoP: options?.DPoP,\n        headers: new Headers(headers),\n        signal: signal(timeout),\n    })\n        .catch(errorHandler);\n    const p = oauth.processPushedAuthorizationResponse(as, c, response);\n    let result;\n    try {\n        result = await p;\n    }\n    catch (err) {\n        if (retryable(err, options)) {\n            return buildAuthorizationUrlWithPAR(config, parameters, {\n                ...options,\n                flag: retry,\n            });\n        }\n        errorHandler(err);\n    }\n    return buildAuthorizationUrl(config, { request_uri: result.request_uri });\n}\nexport function buildEndSessionUrl(config, parameters) {\n    checkConfig(config);\n    const { as, c, tlsOnly } = int(config);\n    const endSessionEndpoint = oauth.resolveEndpoint(as, 'end_session_endpoint', false, tlsOnly);\n    parameters = new URLSearchParams(parameters);\n    if (!parameters.has('client_id')) {\n        parameters.set('client_id', c.client_id);\n    }\n    for (const [k, v] of parameters.entries()) {\n        endSessionEndpoint.searchParams.append(k, v);\n    }\n    return endSessionEndpoint;\n}\nfunction checkConfig(input) {\n    if (!(input instanceof Configuration)) {\n        throw CodedTypeError('\"config\" must be an instance of Configuration', ERR_INVALID_ARG_TYPE);\n    }\n    if (Object.getPrototypeOf(input) !== Configuration.prototype) {\n        throw CodedTypeError('subclassing Configuration is not allowed', ERR_INVALID_ARG_VALUE);\n    }\n}\nfunction signal(timeout) {\n    return timeout ? AbortSignal.timeout(timeout * 1000) : undefined;\n}\nexport async function fetchUserInfo(config, accessToken, expectedSubject, options) {\n    checkConfig(config);\n    const { as, c, fetch, tlsOnly, nonRepudiation, timeout, decrypt } = int(config);\n    const response = await oauth\n        .userInfoRequest(as, c, accessToken, {\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        DPoP: options?.DPoP,\n        headers: new Headers(headers),\n        signal: signal(timeout),\n    })\n        .catch(errorHandler);\n    let exec = oauth.processUserInfoResponse(as, c, expectedSubject, response, {\n        [oauth.jweDecrypt]: decrypt,\n    });\n    let result;\n    try {\n        result = await exec;\n    }\n    catch (err) {\n        if (retryable(err, options)) {\n            return fetchUserInfo(config, accessToken, expectedSubject, {\n                ...options,\n                flag: retry,\n            });\n        }\n        errorHandler(err);\n    }\n    oauth.getContentType(response) === 'application/jwt' &&\n        (await nonRepudiation?.(response));\n    return result;\n}\nfunction retryable(err, options) {\n    if (options?.DPoP && options.flag !== retry) {\n        return oauth.isDPoPNonceError(err);\n    }\n    return false;\n}\nexport async function tokenIntrospection(config, token, parameters) {\n    checkConfig(config);\n    const { as, c, auth, fetch, tlsOnly, nonRepudiation, timeout, decrypt } = int(config);\n    const response = await oauth\n        .introspectionRequest(as, c, auth, token, {\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        additionalParameters: new URLSearchParams(parameters),\n        headers: new Headers(headers),\n        signal: signal(timeout),\n    })\n        .catch(errorHandler);\n    const result = await oauth\n        .processIntrospectionResponse(as, c, response, {\n        [oauth.jweDecrypt]: decrypt,\n    })\n        .catch(errorHandler);\n    oauth.getContentType(response) === 'application/token-introspection+jwt' &&\n        (await nonRepudiation?.(response));\n    return result;\n}\nconst retry = Symbol();\nexport async function genericGrantRequest(config, grantType, parameters, options) {\n    checkConfig(config);\n    const { as, c, auth, fetch, tlsOnly, timeout, decrypt, nonRepudiation } = int(config);\n    const response = await oauth\n        .genericTokenEndpointRequest(as, c, auth, grantType, new URLSearchParams(parameters), {\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        DPoP: options?.DPoP,\n        headers: new Headers(headers),\n        signal: signal(timeout),\n    })\n        .catch(errorHandler);\n    let recognizedTokenTypes;\n    if (grantType === 'urn:ietf:params:oauth:grant-type:token-exchange') {\n        recognizedTokenTypes = { n_a: () => { } };\n    }\n    const p = oauth.processGenericTokenEndpointResponse(as, c, response, {\n        [oauth.jweDecrypt]: decrypt,\n        recognizedTokenTypes,\n    });\n    let result;\n    try {\n        result = await p;\n    }\n    catch (err) {\n        if (retryable(err, options)) {\n            return genericGrantRequest(config, grantType, parameters, {\n                ...options,\n                flag: retry,\n            });\n        }\n        errorHandler(err);\n    }\n    result.id_token && (await nonRepudiation?.(response));\n    addHelpers(result);\n    return result;\n}\nexport async function tokenRevocation(config, token, parameters) {\n    checkConfig(config);\n    const { as, c, auth, fetch, tlsOnly, timeout } = int(config);\n    return oauth\n        .revocationRequest(as, c, auth, token, {\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        additionalParameters: new URLSearchParams(parameters),\n        headers: new Headers(headers),\n        signal: signal(timeout),\n    })\n        .then(oauth.processRevocationResponse)\n        .catch(errorHandler);\n}\nexport async function fetchProtectedResource(config, accessToken, url, method, body, headers, options) {\n    checkConfig(config);\n    headers ||= new Headers();\n    if (!headers.has('user-agent')) {\n        headers.set('user-agent', USER_AGENT);\n    }\n    const { fetch, tlsOnly, timeout } = int(config);\n    const exec = oauth.protectedResourceRequest(accessToken, method, url, headers, body, {\n        [oauth.customFetch]: fetch,\n        [oauth.allowInsecureRequests]: !tlsOnly,\n        DPoP: options?.DPoP,\n        signal: signal(timeout),\n    });\n    let result;\n    try {\n        result = await exec;\n    }\n    catch (err) {\n        if (retryable(err, options)) {\n            return fetchProtectedResource(config, accessToken, url, method, body, headers, {\n                ...options,\n                flag: retry,\n            });\n        }\n        errorHandler(err);\n    }\n    return result;\n}\n//# sourceMappingURL=index.js.map",
+    "import * as oidc from 'openid-client';\nimport { isDeepStrictEqual } from 'node:util';\nimport { AccountError, fail } from './errors';\nimport type { LoginConfiguration, LoginProvider, MicrosoftConfiguration, OidcConfiguration, VerifiedIdentity } from '../shared/login-connections';\nimport { createHash, createHmac, randomBytes, randomUUID, timingSafeEqual } from 'node:crypto';\nimport type { ControlHostContext, ControlApiHandlerContext, PluginControl, ControlPlugin } from '@jeffusion/bungee-core/plugin';\nimport type { ManagementProvider, ManagementSubject } from '@jeffusion/bungee-core/plugin';\nimport { isDurableStateConflictError, type DurableJson, type PluginDurableState, type DurableMutation, type DurableRecord } from '@jeffusion/bungee-core/plugin';\nexport interface ProviderConnection { provider: LoginProvider; issuer: string; configuration: LoginConfiguration; clientId: string; scopes: string[] }\nconst GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst MICROSOFT = 'https://login.microsoftonline.com/';\nconst CONSUMERS = '9188040d-6c67-4c5b-b112-36a304b66dad';\nconst ISSUER_TEMPLATE = MICROSOFT + '{tenantid}/v2.0';\nconst LIMIT = 1024 * 1024;\ntype Fetcher = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;\nfunction providerFields(value: Record<string, unknown>, fields: string[]) { if (Object.keys(value).some(key => !fields.includes(key))) fail('invalid_input'); }\nfunction providerRecord(value: unknown): Record<string, unknown> { if (!value || typeof value !== 'object' || Array.isArray(value)) fail('invalid_input'); return value as Record<string, unknown>; }\nexport function providerUrl(value: unknown): URL {\n    let url: URL;\n    try { if (typeof value !== 'string' || !value || value.length > 2048) fail('invalid_oidc_url'); url = new URL(value); } catch { return fail('invalid_oidc_url'); }\n    if (url.username || url.password || url.hash || (typeof value === 'string' && (value.includes('#') || /^https?:\\/\\/[^/?#]*@/i.test(value))) || (url.protocol !== 'https:' && !(url.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname)))) fail('invalid_oidc_url');\n    return url;\n}\nexport function parseProvider(provider: unknown, input: unknown, scopesInput?: unknown): Pick<ProviderConnection, 'provider' | 'issuer' | 'configuration' | 'scopes'> {\n    if (!['google', 'microsoft', 'github', 'oidc'].includes(provider as string)) fail('invalid_provider');\n    const p = provider as LoginProvider, c = providerRecord(input);\n    let issuer: string, configuration: LoginConfiguration;\n    if (p === 'google' || p === 'github') { providerFields(c, []); issuer = p === 'google' ? 'https://accounts.google.com' : 'https://github.com'; configuration = {}; }\n    else if (p === 'microsoft') {\n        providerFields(c, ['accountType', 'tenantId']);\n        if (!['tenant', 'organizations', 'consumers', 'common'].includes(c.accountType as string)) fail('invalid_microsoft_configuration');\n        if (c.accountType === 'tenant' ? typeof c.tenantId !== 'string' || !GUID.test(c.tenantId) : Object.hasOwn(c, 'tenantId')) fail('invalid_microsoft_configuration');\n        configuration = { accountType: c.accountType as MicrosoftConfiguration['accountType'], ...(c.accountType === 'tenant' ? { tenantId: (c.tenantId as string).toLowerCase() } : {}) };\n        issuer = MICROSOFT + (configuration.tenantId ?? configuration.accountType) + '/v2.0';\n    } else {\n        if (!['issuer', 'discovery', 'manual'].includes(c.mode as string)) fail('invalid_oidc_configuration');\n        const fields = c.mode === 'issuer' ? ['mode', 'issuer'] : c.mode === 'discovery' ? ['mode', 'issuer', 'discoveryUrl'] : ['mode', 'issuer', 'authorizationEndpoint', 'tokenEndpoint', 'jwksUri', 'tokenEndpointAuthMethod', 'idTokenSigningAlg'];\n        providerFields(c, fields); providerUrl(c.issuer); issuer = c.issuer as string;\n        if (new URL(issuer).search) fail('invalid_oidc_url');\n        if (c.mode === 'discovery') providerUrl(c.discoveryUrl);\n        if (c.mode === 'manual') {\n            for (const field of ['authorizationEndpoint', 'tokenEndpoint', 'jwksUri']) providerUrl(c[field]);\n            if (c.tokenEndpointAuthMethod !== undefined && !['client_secret_basic', 'client_secret_post'].includes(c.tokenEndpointAuthMethod as string)) fail('oidc_auth_method_unsupported');\n            if (c.idTokenSigningAlg !== undefined && !['RS256', 'PS256', 'ES256'].includes(c.idTokenSigningAlg as string)) fail('oidc_signing_alg_unsupported');\n        }\n        configuration = { ...c } as OidcConfiguration;\n    }\n    if (p !== 'oidc' && scopesInput !== undefined) fail('preset_scopes_fixed');\n    const scopes = p === 'github' ? ['read:user'] : scopesInput ?? ['openid', 'profile', 'email'];\n    if (!Array.isArray(scopes) || !scopes.length || scopes.length > 16 || scopes.some(s => typeof s !== 'string' || !s || s.length > 128 || /\\s/.test(s)) || (p !== 'github' && !scopes.includes('openid'))) fail('invalid_input');\n    return { provider: p, issuer, configuration, scopes };\n}\nasync function boundedResponse(response: Response): Promise<Response> {\n    if (!response.body) return response;\n    const reader = response.body.getReader();\n    const chunks: Uint8Array[] = []; let size = 0;\n    try {\n        for (;;) {\n            const chunk = await reader.read();\n            if (chunk.done) break;\n            size += chunk.value.length;\n            if (size > LIMIT) { await reader.cancel(); fail('oidc_metadata_limit'); }\n            chunks.push(chunk.value);\n        }\n    } finally { reader.releaseLock(); }\n    const headers = new Headers(response.headers);\n    headers.delete('content-encoding'); headers.delete('content-length');\n    return new Response(Buffer.concat(chunks), {status: response.status, statusText: response.statusText, headers});\n}\nasync function limitedJson(response: Response): Promise<unknown> {\n    if (!response.ok) fail('oidc_metadata_failed', 502);\n    const reader = response.body?.getReader(); if (!reader) fail('oidc_metadata_invalid');\n    let size = 0; const chunks: Uint8Array[] = [];\n    try { for (;;) { const r = await reader.read(); if (r.done) break; size += r.value.length; if (size > LIMIT) { await reader.cancel(); fail('oidc_metadata_limit'); } chunks.push(r.value); } }\n    catch (error) { if (error instanceof AccountError) throw error; fail('oidc_network_failed', 502); }\n    finally { reader.releaseLock(); }\n    try { return JSON.parse(Buffer.concat(chunks).toString('utf8')); } catch { return fail('oidc_metadata_invalid'); }\n}\nexport interface DiscoveryResult { issuer: string; discoveryUrl: string; authorizationEndpoint: string; tokenEndpoint: string; jwksUri: string; tokenEndpointAuthMethods: string[]; idTokenSigningAlgs: string[] }\nfunction discoveryUrl(issuer: string) { const url = providerUrl(issuer); url.pathname = url.pathname.replace(/\\/$/, '') + '/.well-known/openid-configuration'; return url.href; }\nfunction metadataCheck(value: unknown, expected?: string): oidc.ServerMetadata {\n    const m = providerRecord(value);\n    if (typeof m.issuer !== 'string') fail('oidc_metadata_invalid');\n    if (providerUrl(m.issuer).search) fail('invalid_oidc_url');\n    if (expected !== undefined && m.issuer !== expected) fail('oidc_issuer_mismatch');\n    for (const key of ['authorization_endpoint', 'token_endpoint', 'jwks_uri']) providerUrl(m[key]);\n    for (const key of ['token_endpoint_auth_methods_supported', 'id_token_signing_alg_values_supported']) if (m[key] !== undefined && (!Array.isArray(m[key]) || (m[key] as unknown[]).some(v => typeof v !== 'string'))) fail('oidc_metadata_invalid');\n    const methods = m.token_endpoint_auth_methods_supported as string[] | undefined;\n    if (methods && !methods.some(m => ['client_secret_basic', 'client_secret_post'].includes(m))) fail('oidc_auth_method_unsupported');\n    const algs = m.id_token_signing_alg_values_supported as string[] | undefined;\n    if (!algs?.some(a => ['RS256', 'PS256', 'ES256'].includes(a))) fail('oidc_signing_alg_unsupported');\n    if (m.code_challenge_methods_supported !== undefined && (!Array.isArray(m.code_challenge_methods_supported) || !m.code_challenge_methods_supported.includes('S256'))) fail('oidc_pkce_unsupported');\n    return m as oidc.ServerMetadata;\n}\nexport class LoginProviders {\n    constructor(private readonly fetcher: Fetcher, private readonly signal: AbortSignal) {}\n    private async network(input: string | URL | Request, init: RequestInit = {}) {\n        providerUrl(input instanceof Request ? input.url : String(input));\n        try { return await boundedResponse(await this.fetcher(input, { ...init, redirect: 'error', signal: AbortSignal.any([this.signal, AbortSignal.timeout(5000), ...(init.signal ? [init.signal] : [])]) })); }\n        catch (error) { if (error instanceof AccountError) throw error; fail('oidc_network_failed', 502); }\n    }\n    async discover(mode: unknown, value: unknown): Promise<DiscoveryResult> {\n        if (mode !== 'issuer' && mode !== 'discovery') fail('invalid_input');\n        const url = providerUrl(value); if (mode === 'issuer' && url.search) fail('invalid_oidc_url');\n        const endpoint = mode === 'issuer' ? discoveryUrl(value as string) : url.href;\n        const m = metadataCheck(await limitedJson(await this.network(endpoint)), mode === 'issuer' ? value as string : undefined);\n        return { issuer: m.issuer, discoveryUrl: endpoint, authorizationEndpoint: m.authorization_endpoint!, tokenEndpoint: m.token_endpoint!, jwksUri: m.jwks_uri!, tokenEndpointAuthMethods: m.token_endpoint_auth_methods_supported ?? ['client_secret_basic'], idTokenSigningAlgs: m.id_token_signing_alg_values_supported! };\n    }\n    private async metadata(c: ProviderConnection): Promise<oidc.ServerMetadata> {\n        // The authorization server issuer is distinct from the GitHub identity namespace.\n        if (c.provider === 'github') return { issuer: 'https://github.com/login/oauth', authorization_response_iss_parameter_supported: true, authorization_endpoint: 'https://github.com/login/oauth/authorize', token_endpoint: 'https://github.com/login/oauth/access_token', token_endpoint_auth_methods_supported: ['client_secret_post'] };\n        const configuration = c.configuration as OidcConfiguration;\n        if (c.provider === 'oidc' && configuration.mode === 'manual') return metadataCheck({ issuer: c.issuer, authorization_endpoint: configuration.authorizationEndpoint, token_endpoint: configuration.tokenEndpoint, jwks_uri: configuration.jwksUri, token_endpoint_auth_methods_supported: [configuration.tokenEndpointAuthMethod ?? 'client_secret_basic'], id_token_signing_alg_values_supported: [configuration.idTokenSigningAlg ?? 'RS256'] }, c.issuer);\n        const endpoint = c.provider === 'oidc' && configuration.mode === 'discovery' ? configuration.discoveryUrl! : discoveryUrl(c.issuer);\n        const raw = await limitedJson(await this.network(endpoint));\n        const ms = c.configuration as MicrosoftConfiguration;\n        const expected = c.provider === 'microsoft' && ms.accountType !== 'tenant' ? (ms.accountType === 'consumers' ? MICROSOFT + CONSUMERS + '/v2.0' : ISSUER_TEMPLATE) : c.issuer;\n        return metadataCheck(raw, expected);\n    }\n    async validate(c: ProviderConnection) { await this.metadata(c); }\n    private microsoftIssuer(connection: ProviderConnection, claims: Record<string, unknown>): string {\n        const c = connection.configuration as MicrosoftConfiguration, tid = claims.tid;\n        if (typeof tid !== 'string' || !GUID.test(tid)) fail('invalid_microsoft_tenant', 401);\n        const normalized = tid.toLowerCase();\n        if (claims.iss !== MICROSOFT + tid + '/v2.0' || (c.accountType === 'tenant' && normalized !== c.tenantId) || (c.accountType === 'organizations' && normalized === CONSUMERS) || (c.accountType === 'consumers' && normalized !== CONSUMERS)) fail('microsoft_account_scope', 401);\n        return claims.iss as string;\n    }\n    async configuration(c: ProviderConnection, secret: string): Promise<oidc.Configuration> {\n        const metadata = await this.metadata(c);\n        const custom = c.configuration as OidcConfiguration;\n        const methods = metadata.token_endpoint_auth_methods_supported ?? ['client_secret_basic'];\n        const method = c.provider === 'oidc' && custom.mode === 'manual' ? custom.tokenEndpointAuthMethod ?? 'client_secret_basic' : methods.includes('client_secret_post') ? 'client_secret_post' : 'client_secret_basic';\n        const auth = method === 'client_secret_post' ? oidc.ClientSecretPost(secret) : oidc.ClientSecretBasic(secret);\n        let actualIssuer: string | undefined;\n        const customFetch: oidc.CustomFetch = async (input, init) => {\n            const { body, ...options } = init;\n            const response = await this.network(input, { ...options, body: body instanceof Uint8Array ? new Uint8Array(body).buffer : body });\n            if (c.provider === 'github' && String(input) === metadata.token_endpoint) {\n                // GitHub returns OAuth errors in JSON even with HTTP 200.\n                // Interpret only documented error codes; never expose descriptions or URLs.\n                let value: unknown;\n                try { value = await response.clone().json(); } catch { fail('oauth_token_failed', 502); }\n                if (value && typeof value === 'object' && 'error' in value) {\n                    switch (value.error) {\n                        case 'incorrect_client_credentials': fail('oauth_client_rejected', 502);\n                        case 'redirect_uri_mismatch': fail('oauth_callback_mismatch', 502);\n                        case 'bad_verification_code': fail('oauth_code_rejected', 401);\n                        case 'unverified_user_email': fail('oauth_email_unverified', 401);\n                        default: fail('oauth_token_failed', 502);\n                    }\n                }\n            }\n            if (c.provider !== 'microsoft') return response;\n            if (String(input) === metadata.token_endpoint && response.ok) {\n                // Unverified claims only narrow the candidate key set. openid-client\n                // must still verify the original token signature, issuer, audience,\n                // nonce and lifetime before exchange() returns any identity.\n                const value = await limitedJson(response.clone()) as {id_token?: unknown};\n                try { if (typeof value.id_token !== 'string') fail('invalid_oidc_identity', 401); const claims = providerRecord(JSON.parse(Buffer.from(value.id_token.split('.')[1]!, 'base64url').toString())); actualIssuer = this.microsoftIssuer(c, claims); }\n                catch (error) { if (error instanceof AccountError) throw error; fail('invalid_oidc_identity', 401); }\n            }\n            if (String(input) === metadata.jwks_uri) {\n                if (!actualIssuer) fail('invalid_oidc_identity', 401);\n                const value = providerRecord(await limitedJson(response));\n                if (!Array.isArray(value.keys)) fail('oidc_metadata_invalid');\n                const keys = value.keys.filter(key => key && typeof key === 'object' && typeof key.issuer === 'string' && key.issuer.replace('{tenantid}', actualIssuer!.slice(MICROSOFT.length, -'/v2.0'.length)) === actualIssuer);\n                if (!keys.length) fail('microsoft_signing_key_issuer', 401);\n                return Response.json({ keys });\n            }\n            return response;\n        };\n        const signingAlg = metadata.id_token_signing_alg_values_supported?.includes('RS256') ? 'RS256' : metadata.id_token_signing_alg_values_supported?.find(alg => ['PS256', 'ES256'].includes(alg));\n        let config: oidc.Configuration;\n        if (c.provider === 'microsoft') {\n            // Discovery installs openid-client's Entra issuer-template validator. Feed\n            // the metadata already checked above without a second network request.\n            config = await oidc.discovery(new URL(c.issuer), c.clientId, {client_secret: secret, id_token_signed_response_alg: 'RS256'}, auth, { timeout: 5, [oidc.customFetch]: async () => Response.json(metadata) });\n        } else config = new oidc.Configuration(metadata, c.clientId, { client_secret: secret, ...(c.provider !== 'github' ? {id_token_signed_response_alg: signingAlg} : {}) }, auth);\n        config[oidc.customFetch] = customFetch; config.timeout = 5;\n        if ([c.issuer, metadata.token_endpoint, metadata.jwks_uri].some(url => url?.startsWith('http:'))) oidc.allowInsecureRequests(config);\n        if (c.provider !== 'github') oidc.enableNonRepudiationChecks(config);\n        return config;\n    }\n    async exchange(c: ProviderConnection, config: oidc.Configuration, callback: URL, checks: {pkceCodeVerifier: string; expectedState: string; expectedNonce: string}): Promise<VerifiedIdentity> {\n        const tokens = await oidc.authorizationCodeGrant(config, callback, c.provider === 'github' ? {pkceCodeVerifier: checks.pkceCodeVerifier, expectedState: checks.expectedState} : {...checks, idTokenExpected: true}).catch(error => {\n            if (error instanceof AccountError) throw error;\n            if (error instanceof oidc.ClientError && error.cause instanceof AccountError) throw error.cause;\n            if (c.provider !== 'github') throw error;\n            fail('oauth_token_failed', 502);\n        });\n        if (c.provider === 'github') {\n            const response = await oidc.fetchProtectedResource(config, tokens.access_token, new URL('https://api.github.com/user'), 'GET', undefined, new Headers({'accept': 'application/vnd.github+json', 'x-github-api-version': '2022-11-28', 'user-agent': 'Bungee'}));\n            const user = providerRecord(await limitedJson(response));\n            if (!Number.isSafeInteger(user.id) || (user.id as number) <= 0) fail('invalid_oauth_identity', 401);\n            return {protocol: 'oauth2', issuer: 'https://github.com', subject: String(user.id), displayName: typeof user.name === 'string' ? [...user.name].slice(0,128).join('') : 'GitHub user'};\n        }\n        const claims = tokens.claims();\n        if (!claims || typeof claims.sub !== 'string' || !claims.sub || claims.sub.length > 255 || typeof claims.iss !== 'string') fail('invalid_oidc_identity', 401);\n        if (c.provider === 'microsoft') this.microsoftIssuer(c, claims);\n        return {protocol: 'oidc', issuer: claims.iss, subject: claims.sub, displayName: typeof claims.name === 'string' ? [...claims.name].slice(0,128).join('') : 'SSO user'};\n    }\n}\n\ninterface User {\n    id: string;\n    username: string;\n    displayName: string;\n    disabled: boolean;\n    generation: number;\n}\ninterface LocalCredential {\n    passwordHash: string;\n    temporary: boolean;\n}\ninterface Administrator extends User {\n    passwordHash: string;\n    temporary: boolean;\n}\ninterface Connection extends ProviderConnection {\n    id: string;\n    label: string;\n    enabled: boolean;\n    issuer: string;\n    clientId: string;\n    secretRef: string;\n    scopes: string[];\n    generation: number;\n    deleting?: { secretRefs: string[] };\n}\ninterface Identity {\n    id: string;\n    userId: string;\n    connectionId: string;\n    issuer: string;\n    subject: string;\n    protocol: VerifiedIdentity['protocol'];\n}\ninterface LoginSettings {\n    autoCreateUsers: boolean;\n    sessionEpoch: number;\n    failureEpoch: number;\n}\ninterface Turnstile {\n    enabled: boolean;\n    siteKey: string;\n    secretRef: string;\n    hostnames: string[];\n}\ninterface AuthFlow {\n    id: string;\n    state: string;\n    nonce: string;\n    verifierRef: string;\n    connectionId: string;\n    generation: number;\n    created: number;\n    expiresAt: number;\n    epoch: number;\n    returnTo: string;\n    status: 'pending' | 'exchanging' | 'verified' | 'consumed';\n    initiator?: {\n        userId: string;\n        generation: number;\n        sessionDigest: string;\n    };\n    subject?: string;\n    issuer?: string;\n    protocol?: VerifiedIdentity['protocol'];\n}\nconst MAX_USERS = 128, MAX_CONNECTIONS = 32, MAX_IDENTITIES = 512, MAX_FLOWS = 128, MAX_AUDIT = 128;\nconst MAX_SECRETS = 512;\nconst FLOW_COOKIE = 'bungee_user_flow';\nconst EMPTY_SETTINGS: LoginSettings = { autoCreateUsers: false, sessionEpoch: 1, failureEpoch: 1 };\nconst EMPTY_TURNSTILE: Turnstile = { enabled: false, siteKey: '', secretRef: '', hostnames: [] };\ninterface SessionPolicy {\n    idleTimeoutMinutes: number;\n    absoluteTimeoutMinutes: number;\n}\ninterface Session {\n    digest: string;\n    administratorId: string;\n    generation: number;\n    created: number;\n    touched: number;\n    pendingTouch?: number;\n    transport: 'cookie' | 'bearer';\n    policy: SessionPolicy;\n    epoch: number;\n    connectionId?: string;\n    connectionGeneration?: number;\n}\ninterface Failure {\n    key: string;\n    count: number;\n    until: number;\n    epoch: number;\n}\ninterface Slot<T> {\n    key: string;\n    version: number;\n    value: T | null;\n}\nexport interface Dependencies {\n    now?: () => number;\n    trustedSource?: (request: Request) => string;\n    fetch?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;\n}\nconst PROVIDER = 'user-auth';\nconst COOKIE = 'bungee_user_session';\nconst DEFAULT_SESSION_POLICY: Readonly<SessionPolicy> = Object.freeze({ idleTimeoutMinutes: 30, absoluteTimeoutMinutes: 480 });\n// Chromium caps persistent cookies at 400 days. Verification renews this browser lease,\n// never the server-side absolute deadline. Browser/user cleanup remains outside our control.\nconst COOKIE_LEASE_SECONDS = 400 * 24 * 60 * 60;\nconst MAX_TIMEOUT_MINUTES = 43200;\nconst ALL = ['config.read', 'config.write', 'logs.read', 'logs.body', 'keys.read', 'keys.write', 'plugins.read', 'plugins.toggle', 'plugins.code', 'auth.mode', 'self.password', 'self.logout'];\nfunction object(v: unknown): Record<string, unknown> { if (!v || typeof v !== 'object' || Array.isArray(v))\n    fail('invalid_input'); return v as Record<string, unknown>; }\nfunction exact(v: Record<string, unknown>, fields: string[]) { if (Object.keys(v).some(k => !fields.includes(k)))\n    fail('invalid_input'); }\nfunction username(v: unknown): string { if (typeof v !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9_.@-]{0,63}$/.test(v))\n    fail('invalid_input'); return v.toLowerCase(); }\nfunction password(v: unknown): string { if (typeof v !== 'string' || [...v].length < 5 || [...v].length > 32)\n    fail('invalid_password'); return v; }\nfunction digest(v: string): string { return createHash('sha256').update(v).digest('hex'); }\nfunction csrf(token: string): string { return createHmac('sha256', token).update('user-auth/csrf/v1').digest('base64url'); }\nfunction constant(a: string, b: string): boolean { const aa = Buffer.from(a), bb = Buffer.from(b); return aa.length === bb.length && timingSafeEqual(aa, bb); }\nfunction dto(m: Administrator) { return { id: m.id, username: m.username, displayName: m.displayName, disabled: m.disabled, hasLocalPassword: !!m.passwordHash, requiresPasswordChange: m.temporary }; }\nfunction json(v: unknown, status = 200, headers: Record<string, string> = {}): Response { return Response.json(v, { status, headers: { 'cache-control': 'no-store', ...headers } }); }\nfunction safe(error: unknown): Response { return error instanceof AccountError ? json({ error: error.code }, error.status) : json({ error: 'provider_unavailable' }, 503); }\nasync function body(request: Request): Promise<Record<string, unknown>> {\n    const reader = request.body?.getReader();\n    if (!reader)\n        fail('invalid_input');\n    let size = 0;\n    const chunks: Uint8Array[] = [];\n    try {\n        for (;;) {\n            const r = await reader.read();\n            if (r.done)\n                break;\n            size += r.value.length;\n            if (size > 8192) {\n                await reader.cancel();\n                fail('body_limit', 413);\n            }\n            chunks.push(r.value);\n        }\n    }\n    finally {\n        reader.releaseLock();\n    }\n    try {\n        return object(JSON.parse(Buffer.concat(chunks).toString('utf8')));\n    }\n    catch (e) {\n        if (e instanceof AccountError)\n            throw e;\n        return fail('invalid_input');\n    }\n}\nfunction credentials(request: Request): {\n    token: string;\n    transport: Session['transport'];\n} | null {\n    const auth = request.headers.get('authorization');\n    if (auth !== null) {\n        const m = /^Bearer ([A-Za-z0-9_-]{43})$/.exec(auth);\n        return m ? { token: m[1]!, transport: 'bearer' } : null;\n    }\n    const tokens = (request.headers.get('cookie') ?? '').split(';').map(x => x.trim()).filter(x => x.startsWith(COOKIE + '='));\n    if (tokens.length !== 1)\n        return null;\n    const token = tokens[0]!.slice(COOKIE.length + 1);\n    return /^[A-Za-z0-9_-]{43}$/.test(token) ? { token, transport: 'cookie' } : null;\n}\nfunction origin(request: Request, expected?: string) { if (request.headers.get('origin') !== (expected ?? new URL(request.url).origin))\n    fail('invalid_origin', 403); }\nfunction cookie(request: Request, token: string, maxAge: number, managementOrigin?: string) { return `${COOKIE}=${token}; Path=/; HttpOnly; SameSite=Strict; Max-Age=${maxAge}${new URL(managementOrigin ?? request.url).protocol === 'https:' ? '; Secure' : ''}`; }\nfunction validateSessionPolicy(value: unknown, code = 'invalid_session_policy', status = 400): SessionPolicy {\n    if (!value || typeof value !== 'object' || Array.isArray(value))\n        fail(code, status);\n    const p = value as SessionPolicy;\n    if (Object.keys(p).some(key => !['idleTimeoutMinutes', 'absoluteTimeoutMinutes'].includes(key))\n        || ![p.idleTimeoutMinutes, p.absoluteTimeoutMinutes].every(n => Number.isSafeInteger(n) && n >= 0 && n <= MAX_TIMEOUT_MINUTES) || p.absoluteTimeoutMinutes === 0)\n        fail(code, status);\n    return { idleTimeoutMinutes: p.idleTimeoutMinutes, absoluteTimeoutMinutes: p.absoluteTimeoutMinutes };\n}\n// Fixed slots keep expired sessions, logout markers and throttles bounded. Reuse always\n// compares the previous version; a stale touch cannot restore a replaced session.\nexport const ACCOUNT_RECORD_SCHEMA = 3;\nexport const MAX_SESSIONS = 512, MAX_FAILURES = 1024;\nconst asJson = (value: unknown) => value as DurableJson;\nfunction validateUser(value: unknown): User {\n    const u = value as User;\n    if (!u || Object.keys(u).some(k => !['id', 'username', 'displayName', 'disabled', 'generation'].includes(k)) || typeof u.id !== 'string' || !/^[a-f0-9-]{36}$/.test(u.id) || typeof u.username !== 'string' || !/^[a-z0-9][a-z0-9_.@-]{0,63}$/.test(u.username) || typeof u.displayName !== 'string' || [...u.displayName].length > 128 || typeof u.disabled !== 'boolean' || !Number.isSafeInteger(u.generation) || u.generation < 1)\n        fail('corrupt_state', 503);\n    return u;\n}\nfunction localValue(record: DurableRecord | null | undefined): LocalCredential | null {\n    if (!record)\n        return null;\n    const c = envelope(record.value, 'credential') as LocalCredential;\n    if (!c || Object.keys(c).some(k => !['passwordHash', 'temporary'].includes(k)) || typeof c.passwordHash !== 'string' || !c.passwordHash.startsWith('$argon2id$') || typeof c.temporary !== 'boolean')\n        fail('corrupt_state', 503);\n    return c;\n}\nfunction entry<T>(records: readonly DurableRecord[], key: string, field: string, fallback: T): Slot<T> {\n    const r = records.find(r => r.key === key);\n    return { key, version: r?.version ?? 0, value: r ? envelope(r.value, field) as T : fallback };\n}\nfunction users(records: readonly DurableRecord[]): Administrator[] {\n    const result = records.filter(r => r.key.startsWith('user:')).map(r => { const u = validateUser(envelope(r.value, 'user')); if (r.key !== 'user:' + u.id)\n        fail('corrupt_state', 503); const c = localValue(records.find(r => r.key === 'credential:' + u.id)); return { ...u, passwordHash: c?.passwordHash ?? '', temporary: c?.temporary ?? false }; });\n    if (result.length > MAX_USERS || new Set(result.map(u => u.username)).size !== result.length)\n        fail('corrupt_state', 503);\n    return result;\n}\nfunction settings(records: readonly DurableRecord[]): Slot<LoginSettings> {\n    const s = entry(records, 'login-settings', 'settings', EMPTY_SETTINGS), v = s.value!;\n    requireReadyRecord(records, s.version);\n    if (!v || Object.keys(v).some(k => !['autoCreateUsers', 'sessionEpoch', 'failureEpoch'].includes(k)) || typeof v.autoCreateUsers !== 'boolean' || ![v.sessionEpoch, v.failureEpoch].every(n => Number.isSafeInteger(n) && n > 0))\n        fail('corrupt_state', 503);\n    return s;\n}\nfunction turnstile(records: readonly DurableRecord[]): Slot<Turnstile> {\n    const s = entry(records, 'turnstile', 'turnstile', EMPTY_TURNSTILE), v = s.value!;\n    requireReadyRecord(records, s.version);\n    if (!v || Object.keys(v).some(k => !['enabled', 'siteKey', 'secretRef', 'hostnames'].includes(k)) || typeof v.enabled !== 'boolean' || typeof v.siteKey !== 'string' || typeof v.secretRef !== 'string' || !Array.isArray(v.hostnames) || v.hostnames.some(h => typeof h !== 'string') || (v.enabled && (!v.siteKey || !v.secretRef || !v.hostnames.length)))\n        fail('corrupt_state', 503);\n    return s;\n}\nfunction requireReadyRecord(records: readonly DurableRecord[], version: number) {\n    const setup = records.find(r => r.key === 'setup');\n    if (!version && setup && (envelope(setup.value, 'setup') as Setup).phase === 'ready') fail('corrupt_state', 503);\n}\nfunction connectionSlots(records: readonly DurableRecord[]): Slot<Connection>[] {\n    const ids = new Set<string>();\n    const result = records.filter(r => r.key.startsWith('connection:')).map(r => {\n        const c = envelope(r.value, 'connection') as Connection | null;\n        if (c === null) return { key: r.key, version: r.version, value: null };\n        if (!c || (c.deleting !== undefined && (!c.deleting || c.enabled || Object.keys(c.deleting).some(k => k !== 'secretRefs') || !Array.isArray(c.deleting.secretRefs) || c.deleting.secretRefs.length > MAX_FLOWS + 1 || c.deleting.secretRefs.some(ref => typeof ref !== 'string' || !/^auth-secret:(\\d+):([1-9]\\d*)$/.test(ref)))) || Object.keys(c).some(k => !['id', 'label', 'enabled', 'issuer', 'provider', 'configuration', 'clientId', 'secretRef', 'scopes', 'generation', 'deleting'].includes(k)) || typeof c.id !== 'string' || !/^[a-f0-9-]{36}$/.test(c.id) || ids.has(c.id) || typeof c.label !== 'string' || typeof c.enabled !== 'boolean' || typeof c.issuer !== 'string' || typeof c.clientId !== 'string' || typeof c.secretRef !== 'string' || !Array.isArray(c.scopes) || (c.provider !== 'github' && !c.scopes.includes('openid')) || c.scopes.some(s => typeof s !== 'string') || !Number.isSafeInteger(c.generation) || c.generation < 1)\n            fail('corrupt_state', 503);\n        try { const parsed = parseProvider(c.provider, c.configuration, c.provider === 'oidc' ? c.scopes : undefined); if (JSON.stringify(parsed) !== JSON.stringify({provider: c.provider, issuer: c.issuer, configuration: c.configuration, scopes: c.scopes})) fail('corrupt_state', 503); } catch { fail('corrupt_state', 503); }\n        ids.add(c.id);\n        return { key: r.key, version: r.version, value: c };\n    });\n    if (result.length > MAX_CONNECTIONS)\n        fail('corrupt_state', 503);\n    return result;\n}\nfunction connections(records: readonly DurableRecord[]): Connection[] { return connectionSlots(records).flatMap(slot => slot.value && !slot.value.deleting ? [slot.value] : []); }\nfunction identities(records: readonly DurableRecord[]): Identity[] {\n    const result = records.filter(r => r.key.startsWith('identity:')).flatMap(r => { const i = envelope(r.value, 'identity') as Identity | null; if (i === null)\n        return []; if (!i || Object.keys(i).some(k => !['id', 'userId', 'connectionId', 'issuer', 'subject', 'protocol'].includes(k)) || typeof i.userId !== 'string' || typeof i.connectionId !== 'string' || typeof i.issuer !== 'string' || !['oidc', 'oauth2'].includes(i.protocol) || typeof i.subject !== 'string' || !i.subject || r.key !== 'identity:' + i.id || i.id !== digest(i.issuer + '\\0' + i.subject))\n        fail('corrupt_state', 503); return [i]; });\n    if (result.length > MAX_IDENTITIES)\n        fail('corrupt_state', 503);\n    return result;\n}\nfunction envelope(value: unknown, field: string): unknown {\n    if (!value || typeof value !== 'object' || Array.isArray(value))\n        fail('corrupt_state', 503);\n    const v = value as Record<string, unknown>;\n    if (v.schema !== ACCOUNT_RECORD_SCHEMA || !Object.hasOwn(v, field) || Object.keys(v).some(k => k !== 'schema' && k !== field))\n        fail('corrupt_state', 503);\n    return v[field];\n}\nfunction validateSession(value: unknown): Session | null {\n    if (value === null)\n        return null;\n    const s = value as Session;\n    if (!s || Object.keys(s).some(k => !['digest', 'administratorId', 'generation', 'created', 'touched', 'pendingTouch', 'transport', 'policy', 'epoch', 'connectionId', 'connectionGeneration'].includes(k)) || !/^[a-f0-9]{64}$/.test(s.digest) || typeof s.administratorId !== 'string' || !s.administratorId || !Number.isSafeInteger(s.generation) || s.generation < 1 || !Number.isSafeInteger(s.created) || s.created < 0 || !Number.isSafeInteger(s.touched) || s.touched < s.created || (s.pendingTouch !== undefined && (!Number.isSafeInteger(s.pendingTouch) || s.pendingTouch < s.touched)) || !Number.isSafeInteger(s.epoch) || s.epoch < 1 || (s.connectionId !== undefined && (typeof s.connectionId !== 'string' || !Number.isSafeInteger(s.connectionGeneration))) || !['cookie', 'bearer'].includes(s.transport))\n        fail('corrupt_state', 503);\n    validateSessionPolicy(s.policy, 'corrupt_state', 503);\n    return s;\n}\nfunction validateFailure(value: unknown): Failure | null {\n    if (value === null)\n        return null;\n    const f = value as Failure;\n    if (!f || Object.keys(f).some(k => !['key', 'count', 'until', 'epoch'].includes(k)) || typeof f.key !== 'string' || !/^(account|source|challenge):[a-f0-9]{64}$/.test(f.key) || !Number.isSafeInteger(f.count) || f.count < 0 || !Number.isSafeInteger(f.until) || f.until < 0 || !Number.isSafeInteger(f.epoch) || f.epoch < 1)\n        fail('corrupt_state', 503);\n    return f;\n}\nfunction slots<T extends Session | Failure | AuthFlow>(records: readonly DurableRecord[], kind: string, limit: number, validate: (v: unknown) => T | null): Slot<T>[] {\n    const result: Slot<T>[] = Array.from({ length: limit }, (_, i) => ({ key: `${kind}:${i}`, version: 0, value: null }));\n    const seen = new Set<string>();\n    for (const r of records.filter(r => r.key.startsWith(kind + ':'))) {\n        const index = Number(r.key.slice(kind.length + 1));\n        if (!Number.isInteger(index) || index < 0 || index >= limit || r.key !== `${kind}:${index}`)\n            fail('corrupt_state', 503);\n        const value = validate(envelope(r.value, kind));\n        const identity = value && (kind === 'session' ? (value as Session).digest : kind === 'failure' ? (value as Failure).key : (value as AuthFlow).id);\n        if (identity && seen.has(identity))\n            fail('corrupt_state', 503);\n        if (identity)\n            seen.add(identity);\n        result[index] = { key: r.key, version: r.version, value };\n    }\n    return result;\n}\nconst mutation = <T>(slot: Slot<T>, field: string, value: T | null): DurableMutation => ({ key: slot.key, expectedVersion: slot.version, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, [field]: value }) });\nfunction next(value: number): number { if (!Number.isSafeInteger(value + 1))\n    fail('generation_overflow'); return value + 1; }\ninterface Setup {\n    phase: 'uninitialized' | 'ready';\n    code?: {\n        digest: string;\n        expiresAt: number;\n    };\n}\ninterface Clock {\n    version: number;\n    value: number;\n    readVersion?: number;\n}\ntype StateReader = Pick<PluginDurableState, 'get' | 'list'>;\ntype RecoveryContext = {\n    durableState: PluginDurableState;\n    now?: () => number;\n};\nfunction validateKeys(records: readonly DurableRecord[]) {\n    for (const r of records)\n        if (!['setup', 'clock', 'session-policy', 'recovery-summary', 'recovery-anchor', 'login-settings', 'turnstile'].includes(r.key) && !['session:', 'failure:', 'user:', 'credential:', 'identity:', 'connection:', 'flow:', 'audit:'].some(p => r.key.startsWith(p)))\n            fail('corrupt_state', 503);\n}\nfunction validateAudit(records:readonly DurableRecord[]){\n    for(const record of records.filter(r=>r.key.startsWith('audit:'))){\n        const index=Number(record.key.slice(6));\n        const value=envelope(record.value,'audit') as {actor:string;action:string;result:string;at:number};\n        if(!Number.isInteger(index)||index<0||index>=MAX_AUDIT||record.key!=='audit:'+index||!value||Object.keys(value).some(k=>!['actor','action','result','at'].includes(k))||[value.actor,value.action,value.result].some(v=>typeof v!=='string'||!v||v.length>128)||!Number.isSafeInteger(value.at)||value.at<0)fail('corrupt_state',503);\n    }\n}\nfunction clockValue(record: DurableRecord | undefined | null): number {\n    if (!record)\n        fail('corrupt_state', 503);\n    const value = envelope(record.value, 'observedThrough');\n    if (!Number.isSafeInteger(value) || (value as number) < 0)\n        fail('corrupt_state', 503);\n    return value as number;\n}\nfunction wallTime(now: () => number): number { const value = now(); if (!Number.isSafeInteger(value) || value < 0)\n    fail('invalid_clock', 503); return value; }\nfunction clockMutation(clock: Clock): DurableMutation { return { key: 'clock', expectedVersion: clock.version, value: { schema: ACCOUNT_RECORD_SCHEMA, observedThrough: clock.value } }; }\nasync function observeClock(state: PluginDurableState, now: () => number): Promise<Clock> {\n    for (let i = 0; i < 64; i++) {\n        const record = await state.get('clock'), prior = clockValue(record), value = Math.max(prior, wallTime(now));\n        if (value === prior)\n            return { version: record!.version, value, readVersion: record!.version };\n        try {\n            const [saved] = await state.transact([clockMutation({ version: record!.version, value })]);\n            return { version: saved!.version, value, readVersion: record!.version };\n        }\n        catch (e) {\n            if (!isDurableStateConflictError(e))\n                throw e;\n        }\n    }\n    return fail('version_conflict', 409);\n}\nfunction setupRecord(records: readonly DurableRecord[]): {\n    key: string;\n    version: number;\n    value: Setup;\n} {\n    validateKeys(records);\n    const record = records.find(r => r.key === 'setup');\n    if (!record)\n        fail('corrupt_state', 503);\n    const value = envelope(record.value, 'setup') as Setup;\n    if (!value || !['uninitialized', 'ready'].includes(value.phase) || Object.keys(value).some(k => !['phase', 'code'].includes(k)))\n        fail('corrupt_state', 503);\n    if (value.code !== undefined && (!value.code || !/^[a-f0-9]{64}$/.test(value.code.digest) || !Number.isSafeInteger(value.code.expiresAt) || value.code.expiresAt < 0 || Object.keys(value.code).some(k => !['digest', 'expiresAt'].includes(k))))\n        fail('corrupt_state', 503);\n    if (value.phase === 'ready' && value.code !== undefined)\n        fail('corrupt_state', 503);\n    const all = users(records), anchor = records.find(r => r.key === 'recovery-anchor');\n    if ((value.phase === 'ready') !== !!all.length || (value.phase === 'ready' && (!anchor || typeof envelope(anchor.value, 'userId') !== 'string')))\n        fail('corrupt_state', 503);\n    validateAudit(records);\n    settings(records);\n    turnstile(records);\n    connections(records);\n    identities(records);\n    clockValue(records.find(r => r.key === 'clock'));\n    return { key: 'setup', version: record.version, value };\n}\nexport class UserAuthControl implements PluginControl, ManagementProvider {\n    readonly management = this;\n    readonly rpc = [];\n    readonly api;\n    private readonly state: PluginDurableState;\n    private readonly now: () => number;\n    private readonly subjects = new WeakMap<ManagementSubject, {\n        generation: number;\n        digest: string;\n    }>();\n    // Positive lookups only; bounded by the fixed session slots, never by attacker tokens.\n    private readonly sessionSlots = new Map<string, string>();\n    private dummy = '';\n    private disposed = false;\n    private stateTail: Promise<void> = Promise.resolve();\n    private pendingStateOperations = 0;\n    constructor(private readonly host: ControlHostContext, private readonly dependencies: Dependencies = {}) {\n        if (!host.durableState)\n            fail('durable_state_required', 503);\n        this.state = host.durableState;\n        this.now = dependencies.now ?? Date.now;\n        const invoke = (fn: (c: ControlApiHandlerContext) => Promise<Response>) => async (c: ControlApiHandlerContext) => {\n            try {\n                this.alive();\n                if (c.requestSignal.aborted)\n                    fail('cancelled');\n                return await fn(c);\n            }\n            catch (e) {\n                return safe(e);\n            }\n        };\n        this.api = [\n            { path: '/password', methods: ['POST'], handler: 'changePassword', invoke: invoke(async (c) => {\n                    await this.requireCapability(c, 'self.password', true);\n                    const b = await body(c.request);\n                    exact(b, ['currentPassword', 'password', 'passwordConfirmation']);\n                    await this.changePassword(c, b);\n                    return json({ ok: true }, 200, { 'set-cookie': cookie(c.request, '', 0, this.host.managementOrigin) });\n                }) },\n            { path: '/logout', methods: ['POST'], handler: 'logout', invoke: invoke(async (c) => { await this.requireCapability(c, 'self.logout', true); return this.logout(c.request); }) },\n            { path: '/self', methods: ['GET'], handler: 'self', invoke: invoke(async (c) => {\n                    await this.requireCapability(c, 'self.password');\n                    return this.retry(async (time) => { const { user } = await this.guard(c, time), creds = credentials(c.request); return { mutations: [], result: json({ administrator: dto(user), ...(creds?.transport === 'cookie' ? { csrfToken: csrf(creds.token) } : {}) }) }; });\n                }) },\n            { path: '/session-policy', methods: ['GET', 'PUT'], handler: 'sessionPolicy', invoke: invoke(async (c) => {\n                    await this.requireCapability(c, 'config.write', c.request.method === 'PUT');\n                    if (c.request.method === 'GET')\n                        return this.retry(async (time) => { const policy = await this.readSessionPolicy(); await this.guard(c, time); return { mutations: [], result: json(policy) }; });\n                    const b = await body(c.request);\n                    exact(b, ['version', 'policy']);\n                    if (!Number.isSafeInteger(b.version) || (b.version as number) < 0)\n                        fail('invalid_session_policy');\n                    const policy = validateSessionPolicy(b.policy);\n                    await this.requireCapability(c, 'config.write', true);\n                    try {\n                        await this.retry(async (time) => { await this.guard(c, time); return { mutations: [{ key: 'session-policy', expectedVersion: b.version as number, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, policy }) }], result: undefined }; });\n                    }\n                    catch (e) {\n                        if (isDurableStateConflictError(e))\n                            fail('version_conflict', 409);\n                        throw e;\n                    }\n                    return json(await this.readSessionPolicy());\n                }) },\n            ...this.featureApi(invoke),\n        ];\n    }\n    private alive() { if (this.disposed || this.host.signal.aborted)\n        fail('provider_unavailable', 503); }\n    private async readAdministrator(id?: string): Promise<Slot<Administrator>> {\n        this.alive();\n        if (!id) {\n            const all = users(await this.records());\n            id = all[0]?.id;\n        }\n        if (!id)\n            return { key: 'user:missing', version: 0, value: null };\n        const record = await this.state.get('user:' + id);\n        if (!record)\n            return { key: 'user:' + id, version: 0, value: null };\n        const user = validateUser(envelope(record.value, 'user')), credential = localValue(await this.state.get('credential:' + id));\n        if (user.id !== id)\n            fail('corrupt_state', 503);\n        return { key: record.key, version: record.version, value: { ...user, passwordHash: credential?.passwordHash ?? '', temporary: credential?.temporary ?? false } };\n    }\n    private userMutation(slot: Slot<Administrator>, value: Administrator): DurableMutation { const { passwordHash, temporary, ...user } = value; return mutation(slot, 'user', user); }\n    private credentialMutation(records: readonly DurableRecord[], id: string, hash: string): DurableMutation { const r = records.find(r => r.key === 'credential:' + id); return { key: 'credential:' + id, expectedVersion: r?.version ?? 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, credential: { passwordHash: hash, temporary: false } }) }; }\n    private async records() {\n        this.alive();\n        const records = await this.state.list();\n        setupRecord(records);\n        return records;\n    }\n    private async retry<T>(plan: (time: () => Promise<number>) => Promise<{\n        mutations: DurableMutation[];\n        result: T;\n    }>): Promise<T> {\n        // Serialize this instance's planners: parallel requests must not continually\n        // invalidate each other's clock fences. Cross-instance changes still use CAS.\n        if (this.pendingStateOperations >= 256)\n            fail('provider_busy', 503);\n        this.pendingStateOperations++;\n        const task = this.stateTail.then(async () => {\n            await this.cleanupDeletedConnections();\n            const result = await this.retryState(plan);\n            await this.cleanupDeletedConnections();\n            return result;\n        });\n        this.stateTail = task.then(() => { }, () => { });\n        try {\n            return await task;\n        }\n        finally {\n            this.pendingStateOperations--;\n        }\n    }\n    private async retryState<T>(plan: (time: () => Promise<number>) => Promise<{\n        mutations: DurableMutation[];\n        result: T;\n    }>): Promise<T> {\n        for (let i = 0; i < 64; i++) {\n            const before = await this.state.get('clock');\n            clockValue(before);\n            let clock: Clock | undefined;\n            // Each planner reads its business records first and observes time last.\n            // This prevents delayed reads from renewing an already expired session.\n            const time = async () => { const prior = clock, observed = await observeClock(this.state, this.now); clock = prior && observed.readVersion === prior.version ? { ...observed, readVersion: prior.readVersion } : observed; return clock.value; };\n            let planned: {\n                mutations: DurableMutation[];\n                result: T;\n            };\n            try {\n                planned = await plan(time);\n            }\n            catch (error) {\n                await time();\n                throw error;\n            }\n            if (!clock)\n                await time();\n            // A different control may change identity or touch a slot while we read.\n            // Its clock fence invalidates the entire read set, including read-only authorization.\n            if (clock!.readVersion !== before!.version)\n                continue;\n            if (!planned.mutations.length)\n                return planned.result;\n            this.alive();\n            try {\n                await this.state.transact([...planned.mutations, clockMutation(clock!)]);\n                return planned.result;\n            }\n            catch (e) {\n                if (!isDurableStateConflictError(e))\n                    throw e;\n            }\n        }\n        return fail('version_conflict', 409);\n    }\n    private async cleanupDeletedConnections(): Promise<void> {\n        // Ordinary authentication must not add clock transactions for an absent job.\n        // A concurrent deletion still invalidates the caller's business read via CAS;\n        // its durable marker is resumed by the next cleanup check.\n        if (!connectionSlots(await this.state.list()).some(slot => slot.value?.deleting)) return;\n        // The deletion fence and user revocations commit together. The connection\n        // retains all secret references until cleanup is confirmed, including after\n        // a process exit or lost ACK. Cleanup does not depend on the deleting session.\n        for (;;) {\n            const pending = await this.retryState(async () => {\n                const records = await this.records();\n                const slot = connectionSlots(records).find(s => s.value?.deleting);\n                if (!slot) return { mutations: [], result: { done: true, connection: null as Connection | null } };\n                const id = slot.value!.id;\n                const bindings = identities(records).filter(i => i.connectionId === id);\n                const flows = this.flows(records).filter(f => f.value?.connectionId === id);\n                const changes = [\n                    ...bindings.map(i => mutation(entry(records, 'identity:' + i.id, 'identity', null), 'identity', null)),\n                    ...flows.map(f => mutation(f, 'flow', null)),\n                ];\n                // Reserve the last mutation for the clock fence.\n                return { mutations: changes.slice(0, 255), result: { done: false, connection: changes.length ? null : slot.value } };\n            });\n            if (pending.done) return;\n            if (!pending.connection) continue;\n            for (const ref of pending.connection.deleting!.secretRefs) {\n                const match = /^auth-secret:(\\d+):([1-9]\\d*)$/.exec(ref)!;\n                const key = 'auth-secret:' + match[1], version = Number(match[2]);\n                const saved = await this.host.secretStore.get(key);\n                // Another control may already have removed or reused the secret slot.\n                if (saved?.version === version) await this.host.secretStore.delete(key, version);\n            }\n            await this.retryState(async () => {\n                const records = await this.records();\n                const slot = connectionSlots(records).find(s => s.value?.id === pending.connection!.id && s.value.deleting);\n                return { mutations: slot ? [mutation(slot, 'connection', null)] : [], result: undefined };\n            });\n        }\n    }\n    private async readSessionPolicy(): Promise<{\n        version: number;\n        policy: SessionPolicy;\n    }> {\n        this.alive();\n        const record = await this.state.get('session-policy');\n        return { version: record?.version ?? 0, policy: record ? validateSessionPolicy(envelope(record.value, 'policy'), 'corrupt_state', 503) : { ...DEFAULT_SESSION_POLICY } };\n    }\n    async start() {\n        await readManagementSetup(this.state);\n        await observeClock(this.state, this.now);\n        await this.readSessionPolicy();\n        const records = await this.records();\n        slots(records, 'session', MAX_SESSIONS, validateSession);\n        slots(records, 'failure', MAX_FAILURES, validateFailure);\n        this.flows(records);\n        for (const r of records.filter(r => r.key.startsWith('credential:'))) {\n            localValue(r);\n            if (!users(records).some(u => r.key === 'credential:' + u.id))\n                fail('corrupt_state', 503);\n        }\n        await this.cleanupDeletedConnections();\n        this.dummy = await this.hash(randomBytes(32).toString('base64url'));\n    }\n    dispose() { this.disposed = true; }\n    private hash(p: string) { return Bun.password.hash(p, { algorithm: 'argon2id', memoryCost: 65536, timeCost: 3 }); }\n    async setupStatus(): Promise<'uninitialized' | 'ready'> { return (await readManagementSetup(this.state)).initialized ? 'ready' : 'uninitialized'; }\n    async hasIdentity() { return await this.setupStatus() === 'ready' && users(await this.records()).some(u => !u.disabled); }\n    async revokeSessions() { await this.retry(async () => { const s = settings(await this.records()); return { mutations: [mutation(s, 'settings', { ...s.value!, sessionEpoch: next(s.value!.sessionEpoch) })], result: undefined }; }); }\n    async bootstrap(input: unknown) {\n        const b = object(input);\n        exact(b, ['username', 'password']);\n        const name = username(b.username), p = password(b.password);\n        if (await this.setupStatus() !== 'ready')\n            fail('initialization_required', 409);\n        const prior = users(await this.records()).find(u => u.username === name);\n        if (!prior?.passwordHash)\n            fail('invalid_credentials', 401);\n        if (prior.username !== name || prior.disabled || !await Bun.password.verify(p, prior.passwordHash))\n            fail('invalid_credentials', 401);\n        const latest = (await this.readAdministrator(prior.id)).value;\n        if (!latest || latest.id !== prior.id || latest.generation !== prior.generation || latest.username !== prior.username || latest.disabled)\n            fail('invalid_credentials', 401);\n    }\n    private source(request: Request): string { return (this.dependencies.trustedSource ?? this.host.trustedSource)?.(request) ?? 'unknown'; }\n    private async reserve(keys: string[]): Promise<number> {\n        return this.retry(async (time) => {\n            const epoch = settings(await this.records()).value!.failureEpoch;\n            const failures = slots(await this.records(), 'failure', MAX_FAILURES, validateFailure), selected: Slot<Failure>[] = [], now = await time();\n            for (const key of keys) {\n                let slot = failures.find(x => !selected.includes(x) && x.value?.key === key);\n                const active = slot?.value && slot.value.epoch === epoch && slot.value.until > now;\n                if (active && slot!.value!.count >= 10)\n                    fail('login_limited', 429);\n                slot ??= failures.find(x => !selected.includes(x) && (!x.value || x.value.epoch !== epoch || x.value.until <= now));\n                if (!slot)\n                    fail('login_limited', 429);\n                selected.push(slot);\n            }\n            return { mutations: selected.map((slot, i) => { const prior = slot.value; return mutation(slot, 'failure', { key: keys[i]!, count: prior && prior.key === keys[i] && prior.epoch === epoch && prior.until > now ? prior.count + 1 : 1, until: prior && prior.key === keys[i] && prior.epoch === epoch && prior.until > now ? prior.until : now + 15 * 60000, epoch }); }), result: epoch };\n        });\n    }\n    async initialize(request: Request): Promise<Response> {\n        try {\n            this.alive();\n            if (request.method !== 'POST')\n                fail('method_not_allowed', 405);\n            origin(request, this.host.managementOrigin);\n            const b = await body(request);\n            exact(b, ['setupCode', 'username', 'password', 'passwordConfirmation']);\n            await this.reserve(['source:' + digest(this.source(request))]);\n            const check = async (time: () => Promise<number>) => {\n                const records = await this.records(), setup = setupRecord(records), now = await time();\n                if (setup.value.phase !== 'uninitialized')\n                    fail('already_initialized', 409);\n                if (!setup.value.code || now >= setup.value.code.expiresAt || typeof b.setupCode !== 'string' || !constant(digest(b.setupCode), setup.value.code.digest))\n                    fail('invalid_setup_code', 401);\n                return { setup, records };\n            };\n            const initial = await this.retry(async (time) => ({ mutations: [], result: await check(time) }));\n            const name = username(b.username), p = password(b.password);\n            if (b.passwordConfirmation !== p)\n                fail('password_confirmation');\n            const passwordHash = await this.hash(p);\n            await this.retry(async (time) => {\n                const { setup, records } = await check(time);\n                if (setup.version !== initial.setup.version)\n                    fail('invalid_setup_code', 401);\n                const account: User = { id: randomUUID(), username: name, displayName: name, disabled: false, generation: 1 };\n                return { mutations: [mutation(setup, 'setup', { phase: 'ready' } as Setup), mutation(settings(records), 'settings', EMPTY_SETTINGS), mutation(turnstile(records), 'turnstile', EMPTY_TURNSTILE), { key: 'user:' + account.id, expectedVersion: 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, user: account }) }, this.credentialMutation(records, account.id, passwordHash), { key: 'recovery-anchor', expectedVersion: 0, value: { schema: ACCOUNT_RECORD_SCHEMA, userId: account.id } }], result: undefined };\n            });\n            return json({ initialized: true });\n        }\n        catch (e) {\n            return safe(e);\n        }\n    }\n    private live(m: Administrator | null, session: Session, now: number, records: readonly DurableRecord[]): Administrator | undefined {\n        if (session.epoch !== settings(records).value!.sessionEpoch)\n            return;\n        if (session.connectionId) {\n            const c = connections(records).find(c => c.id === session.connectionId);\n            if (!c?.enabled || c.generation !== session.connectionGeneration)\n                return;\n        }\n        const policy = session.policy;\n        if (now < session.touched || now < session.created || (policy.idleTimeoutMinutes > 0 && now - session.touched >= policy.idleTimeoutMinutes * 60000) || now - session.created >= policy.absoluteTimeoutMinutes * 60000)\n            return;\n        return m && m.id === session.administratorId && !m.disabled && m.generation === session.generation ? m : undefined;\n    }\n    private async findSession(d: string): Promise<Slot<Session> | undefined> {\n        this.alive();\n        const key = this.sessionSlots.get(d);\n        if (key) {\n            const record = await this.state.get(key), value = record && validateSession(envelope(record.value, 'session'));\n            if (record && value?.digest === d)\n                return { key, version: record.version, value };\n            this.sessionSlots.delete(d);\n        }\n        const found = slots(await this.records(), 'session', MAX_SESSIONS, validateSession).find(x => x.value?.digest === d);\n        if (found) {\n            if (this.sessionSlots.size >= MAX_SESSIONS)\n                this.sessionSlots.clear();\n            this.sessionSlots.set(d, found.key);\n        }\n        return found;\n    }\n    private cookieAge(policy: SessionPolicy, elapsedMs = 0): number { return Math.max(0, Math.min(COOKIE_LEASE_SECONDS, Math.floor((policy.absoluteTimeoutMinutes * 60000 - elapsedMs) / 1000))); }\n    async sessionCookie(request: Request): Promise<string | undefined> {\n        this.alive();\n        const creds = credentials(request);\n        if (creds?.transport !== 'cookie')\n            return;\n        return this.retry(async (time) => {\n            const slot = await this.findSession(digest(creds.token)), session = slot?.value, m = (await this.readAdministrator(session?.administratorId)).value, records = await this.records(), now = await time();\n            return { mutations: [], result: session && session.transport === 'cookie' && this.live(m, session, now, records) ? cookie(request, creds.token, this.cookieAge(session.policy, now - session.created), this.host.managementOrigin) : undefined };\n        });\n    }\n    async authenticate(request: Request): Promise<ManagementSubject | null> {\n        this.alive();\n        const c = credentials(request);\n        if (!c)\n            return null;\n        const d = digest(c.token);\n        // A queued write or a lost ACK must never publish an unchecked extension.\n        // Pending activity shares the fixed slot but live() only trusts touched.\n        const prepared = await this.retry(async (time) => {\n            const slot = await this.findSession(d), session = slot?.value, m = (await this.readAdministrator(session?.administratorId)).value, records = await this.records(), now = await time();\n            const administrator = session && session.transport === c.transport && this.live(m, session, now, records);\n            if (!slot || !session || !administrator)\n                return { mutations: [], result: false };\n            return { mutations: session.pendingTouch === undefined ? [mutation(slot, 'session', { ...session, pendingTouch: now })] : [], result: true };\n        }).catch(async (error) => {\n            // A failed/unknown prepare still observes the error-return time when\n            // storage is reachable. Preserve the original failure if the clock also\n            // cannot be persisted; pending itself never extends the session.\n            try {\n                await observeClock(this.state, this.now);\n            }\n            catch { }\n            throw error;\n        });\n        if (!prepared)\n            return null;\n        const authenticated = await this.retry(async (time) => {\n            const slot = await this.findSession(d), session = slot?.value, m = (await this.readAdministrator(session?.administratorId)).value, records = await this.records(), now = await time();\n            const administrator = session && session.transport === c.transport && this.live(m, session, now, records);\n            if (!slot || !session || !administrator)\n                return { mutations: [], result: null };\n            // Observing committed pending activity before the old deadline qualifies\n            // its renewal. Slot + clock CAS bind this observation to the exact session\n            // and identity generation. Another reader may already have confirmed it.\n            const { pendingTouch, ...confirmed } = session;\n            // A pending marker may outlive a lost ACK; successful activity renews from\n            // this confirmation observation, not from the earlier preparation time.\n            return { mutations: pendingTouch === undefined ? [] : [mutation(slot, 'session', { ...confirmed, touched: now })], result: administrator };\n        });\n        if (!authenticated)\n            return null;\n        const subject = Object.freeze({ id: authenticated.id, provider: PROVIDER, capabilities: Object.freeze([...ALL]), requiresPasswordChange: authenticated.temporary });\n        this.subjects.set(subject, { generation: authenticated.generation, digest: d });\n        return await this.authorize(subject, 'config.read') ? subject : null;\n    }\n    async authorize(subject: ManagementSubject, _capability: string): Promise<boolean> {\n        this.alive();\n        const issued = this.subjects.get(subject);\n        if (!issued || subject.provider !== PROVIDER)\n            return false;\n        return this.retry(async (time) => {\n            const slot = await this.findSession(issued.digest), session = slot?.value, account = (await this.readAdministrator(session?.administratorId)).value, records = await this.records(), now = await time(), m = session && this.live(account, session, now, records);\n            return { mutations: [], result: !!m && m.id === subject.id && m.generation === issued.generation };\n        });\n    }\n    private async requireCapability(c: ControlApiHandlerContext, capability: string, write = false) { if (!c.subject || !credentials(c.request) || this.subjects.get(c.subject)?.digest !== digest(credentials(c.request)!.token) || !await this.authorize(c.subject, capability))\n        fail('forbidden', 403); if (write)\n        this.checkWrite(c.request); }\n    validateWrite(request: Request) { this.checkWrite(request); }\n    csrfToken(request: Request): string | undefined { const c = credentials(request); return c?.transport === 'cookie' ? csrf(c.token) : undefined; }\n    private checkWrite(request: Request) { const c = credentials(request); if (!c)\n        fail('unauthorized', 401); if (c.transport === 'cookie') {\n        origin(request, this.host.managementOrigin);\n        if (!constant(request.headers.get('x-csrf-token') ?? '', csrf(c.token)))\n            fail('invalid_csrf', 403);\n    } }\n    async login(request: Request): Promise<Response> {\n        try {\n            this.alive();\n            if (request.method !== 'POST')\n                fail('method_not_allowed', 405);\n            const b = await body(request);\n            exact(b, ['username', 'password', 'transport', 'turnstileToken']);\n            const name = username(b.username), p = typeof b.password === 'string' ? b.password : '';\n            const transport = b.transport ?? 'cookie';\n            if (transport !== 'cookie' && transport !== 'bearer')\n                fail('invalid_input');\n            if (transport === 'cookie' || request.headers.has('origin'))\n                origin(request, this.host.managementOrigin);\n            const keys = ['account:' + digest(name), 'source:' + digest(this.source(request))];\n            const reservation = await this.reserve(keys);\n            if (await this.setupStatus() !== 'ready')\n                fail('invalid_credentials', 401);\n            const turn = turnstile(await this.records());\n            await this.verifyTurnstile(b.turnstileToken, turn.value!, request);\n            const administrator = users(await this.records()).find(u => u.username === name);\n            const valid = await Bun.password.verify(p, administrator?.passwordHash || this.dummy || await this.hash('dummy-invalid-password'));\n            if (!valid || !administrator || !administrator.passwordHash || administrator.disabled)\n                fail('invalid_credentials', 401);\n            const token = randomBytes(32).toString('base64url');\n            let policy: SessionPolicy = { ...DEFAULT_SESSION_POLICY };\n            const created = await this.retry(async (time) => {\n                const m = (await this.readAdministrator(administrator.id)).value;\n                if (!m || m.id !== administrator.id || m.username !== administrator.username || m.disabled || m.generation !== administrator.generation)\n                    fail('invalid_credentials', 401);\n                const records = await this.records();\n                policy = (await this.readSessionPolicy()).policy;\n                if (settings(records).value!.failureEpoch !== reservation || turnstile(records).version !== turn.version)\n                    fail('version_conflict', 409);\n                const now = await time(), sessions = slots(records, 'session', MAX_SESSIONS, validateSession), slot = sessions.find(x => !x.value || !this.live(users(records).find(u => u.id === x.value!.administratorId) ?? null, x.value, now, records));\n                if (!slot)\n                    fail('session_limit', 429);\n                const changes = [mutation(slot, 'session', { digest: digest(token), administratorId: m.id, generation: m.generation, created: now, touched: now, transport, policy, epoch: settings(records).value!.sessionEpoch }), this.audit(records, m.id, 'local.login', now)];\n                const failures = slots(records, 'failure', MAX_FAILURES, validateFailure);\n                const account = failures.find(x => x.value?.key === keys[0] && x.value.epoch === reservation);\n                if (account)\n                    changes.push(mutation(account, 'failure', null));\n                const source = failures.find(x => x.value?.key === keys[1] && x.value.epoch === reservation);\n                if (source)\n                    changes.push(mutation(source, 'failure', { ...source.value!, count: Math.max(0, source.value!.count - 1) }));\n                return { mutations: changes, result: now };\n            });\n            const latest = (await this.readAdministrator(administrator.id)).value;\n            if (!latest || latest.disabled || latest.generation !== administrator.generation || latest.id !== administrator.id)\n                fail('invalid_credentials', 401);\n            return transport === 'cookie' ? json({ administrator: dto(administrator), csrfToken: csrf(token) }, 200, { 'set-cookie': cookie(request, token, this.cookieAge(policy, (await observeClock(this.state, this.now)).value - created), this.host.managementOrigin) }) : json({ administrator: dto(administrator), token, expiresIn: policy.absoluteTimeoutMinutes * 60 });\n        }\n        catch (e) {\n            await this.recordFailure('local.login',e);\n            return safe(e);\n        }\n    }\n    async logout(request: Request): Promise<Response> {\n        try {\n            this.alive();\n            if (request.method !== 'POST')\n                fail('method_not_allowed', 405);\n            this.checkWrite(request);\n            const c = credentials(request)!;\n            await this.retry(async () => { const slot = await this.findSession(digest(c.token)); return { mutations: slot?.value ? [mutation(slot, 'session', null)] : [], result: undefined }; });\n            return json({ ok: true }, 200, { 'set-cookie': cookie(request, '', 0, this.host.managementOrigin) });\n        }\n        catch (e) {\n            return safe(e);\n        }\n    }\n    private async changePassword(c: ControlApiHandlerContext, b: Record<string, unknown>) {\n        const p = password(b.password);\n        if (b.passwordConfirmation !== p)\n            fail('password_confirmation');\n        const id = c.subject!.id, m = (await this.readAdministrator(id)).value;\n        if (!m || !m.passwordHash || m.id !== id || typeof b.currentPassword !== 'string' || !await Bun.password.verify(b.currentPassword, m.passwordHash))\n            fail('invalid_credentials', 401);\n        if (constant(p, b.currentPassword))\n            fail('password_unchanged');\n        const hashed = await this.hash(p);\n        await this.retry(async (time) => {\n            this.checkWrite(c.request);\n            const a = await this.readAdministrator(id), current = a.value, records = await this.records();\n            if (!current || current.id !== id || current.disabled || current.generation !== m.generation)\n                fail('version_conflict', 409);\n            const issued = this.subjects.get(c.subject!)!, slot = await this.findSession(issued.digest), now = await time();\n            if (!slot?.value || !this.live(current, slot.value, now, records))\n                fail('forbidden', 403);\n            return { mutations: [this.userMutation(a, { ...current, generation: next(current.generation) }), this.credentialMutation(records, id, hashed), mutation(slot, 'session', null), this.audit(records, id, 'user.password.change', now)], result: undefined };\n        });\n    }\n    private async guard(c: ControlApiHandlerContext, time: () => Promise<number>): Promise<{\n        user: Administrator;\n        records: readonly DurableRecord[];\n    }> {\n        this.checkWriteIfNeeded(c.request);\n        const issued = c.subject && this.subjects.get(c.subject), creds = credentials(c.request);\n        if (!issued || !creds || issued.digest !== digest(creds.token))\n            fail('forbidden', 403);\n        const slot = await this.findSession(issued.digest), records = await this.records(), user = users(records).find(u => u.id === c.subject!.id), now = await time();\n        if (!slot?.value || slot.value.transport !== creds.transport || !user || user.generation !== issued.generation || !this.live(user, slot.value, now, records))\n            fail('forbidden', 403);\n        return { user, records };\n    }\n    private checkWriteIfNeeded(request: Request) { if (!['GET', 'HEAD'].includes(request.method))\n        this.checkWrite(request); }\n    private audit(records: readonly DurableRecord[], actor: string, action: string, at: number,result='success'): DurableMutation {\n        const recordsBySlot = Array.from({ length: MAX_AUDIT }, (_, i) => records.find(r => r.key === 'audit:' + i));\n        const index = recordsBySlot.findIndex(r => !r);\n        const slot = index >= 0 ? index : recordsBySlot.reduce((best, r, i) => ((envelope(r!.value, 'audit') as {\n            at: number;\n        }).at < (envelope(recordsBySlot[best]!.value, 'audit') as {\n            at: number;\n        }).at ? i : best), 0);\n        return { key: 'audit:' + slot, expectedVersion: recordsBySlot[slot]?.version ?? 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, audit: { actor, action, result, at } }) };\n    }\n    private async recordFailure(action:string,error:unknown){try{await this.retry(async time=>{const records=await this.records(),at=await time();return {mutations:[this.audit(records,'anonymous',action,at,error instanceof AccountError?error.code:'provider_unavailable')],result:undefined};});}catch{/* Audit failures cannot make a rejected authentication succeed. */}}\n    private featureApi(invoke: (fn: (c: ControlApiHandlerContext) => Promise<Response>) => (c: ControlApiHandlerContext) => Promise<Response>) {\n        const route = (path: string, methods: string[], handler: string, fn: (c: ControlApiHandlerContext) => Promise<Response>) => ({ path, methods, handler, invoke: invoke(fn) });\n        return [\n            route('/users', ['GET', 'POST'], 'users', async (c) => {\n                await this.requireCapability(c, 'config.write', c.request.method === 'POST');\n                if (c.request.method === 'GET')\n                    return this.retry(async (time) => { const { records } = await this.guard(c, time); return { mutations: [], result: json({ users: users(records).map(dto) }) }; });\n                const b = await body(c.request);\n                exact(b, ['username', 'displayName', 'password', 'passwordConfirmation']);\n                const name = username(b.username), displayName = this.displayName(b.displayName ?? name);\n                const hash = b.password === undefined ? '' : await this.hash(this.confirmPassword(b)), id = randomUUID();\n                return this.retry(async (time) => {\n                    const { records, user } = await this.guard(c, time), all = users(records);\n                    if (all.length >= MAX_USERS)\n                        fail('user_limit', 409);\n                    if (all.some(u => u.username === name))\n                        fail('username_exists', 409);\n                    const u: Administrator = { id, username: name, displayName, disabled: false, generation: 1, passwordHash: hash, temporary: false };\n                    return { mutations: [this.userMutation({ key: 'user:' + id, version: 0, value: null }, u), ...(hash ? [this.credentialMutation(records, id, hash)] : []), this.audit(records, user.id, 'user.create', await time())], result: json({ user: dto(u) }, 201) };\n                });\n            }),\n            route('/users/update', ['PUT'], 'updateUser', async (c) => {\n                await this.requireCapability(c, 'config.write', true);\n                const b = await body(c.request);\n                exact(b, ['id', 'username', 'displayName', 'disabled']);\n                const id = this.text(b.id, 64), name = username(b.username), displayName = this.displayName(b.displayName);\n                if (typeof b.disabled !== 'boolean')\n                    fail('invalid_input');\n                return this.retry(async (time) => {\n                    const { records, user } = await this.guard(c, time), all = users(records), u = all.find(u => u.id === id);\n                    if (!u)\n                        fail('not_found', 404);\n                    if (all.some(u => u.id !== id && u.username === name))\n                        fail('username_exists', 409);\n                    if (b.disabled && !u.disabled && u.passwordHash && !all.some(x => x.id !== id && !x.disabled && x.passwordHash))\n                        fail('last_local_user', 409);\n                    const updated = { ...u, username: name, displayName, disabled: b.disabled as boolean, generation: b.disabled !== u.disabled ? next(u.generation) : u.generation };\n                    const r = records.find(r => r.key === 'user:' + id)!;\n                    return { mutations: [this.userMutation({ key: r.key, version: r.version, value: u }, updated), this.audit(records, user.id, 'user.update', await time())], result: json({ user: dto(updated) }) };\n                });\n            }),\n            route('/users/password', ['POST'], 'resetUserPassword', async (c) => {\n                await this.requireCapability(c, 'config.write', true);\n                const b = await body(c.request);\n                exact(b, ['id', 'password', 'passwordConfirmation']);\n                const id = this.text(b.id, 64), hash = await this.hash(this.confirmPassword(b));\n                return this.retry(async (time) => {\n                    const { records, user } = await this.guard(c, time), u = users(records).find(u => u.id === id);\n                    if (!u)\n                        fail('not_found', 404);\n                    const r = records.find(r => r.key === 'user:' + id)!;\n                    return { mutations: [this.userMutation({ key: r.key, version: r.version, value: u }, { ...u, generation: next(u.generation) }), this.credentialMutation(records, id, hash), this.audit(records, user.id, 'user.password.reset', await time())], result: json({ ok: true }) };\n                });\n            }),\n            route('/identities', ['GET', 'POST', 'DELETE'], 'identities', async (c) => {\n                await this.requireCapability(c, 'config.write', c.request.method !== 'GET');\n                const b = c.request.method === 'GET' ? {} : await body(c.request);\n                exact(b, c.request.method === 'POST' ? ['userId', 'connectionId', 'subject'] : ['id']);\n                return this.retry(async (time) => {\n                    const { records, user } = await this.guard(c, time), all = identities(records);\n                    if (c.request.method === 'GET') {\n                        const id = new URL(c.request.url).searchParams.get('userId');\n                        return { mutations: [], result: json({ identities: all.filter(i => !id || i.userId === id) }) };\n                    }\n                    let identity: Identity;\n                    if (c.request.method === 'POST') {\n                        const connection = connections(records).find(x => x.id === b.connectionId);\n                        if (!connection)\n                            fail('not_found', 404);\n                        const ms = connection.configuration as MicrosoftConfiguration;\n                        if (connection.provider === 'microsoft' && ['common', 'organizations'].includes(ms.accountType)) fail('verified_identity_required');\n                        const identityIssuer = connection.provider === 'microsoft' && ms.accountType === 'consumers' ? 'https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0' : connection.issuer;\n                        const sub = this.text(b.subject, 255), id = digest(identityIssuer + '\\0' + sub);\n                        if (connection.provider === 'github' && (!/^[1-9][0-9]*$/.test(sub) || !Number.isSafeInteger(Number(sub)))) fail('invalid_oauth_identity');\n                        if (all.some(x => x.id === id))\n                            fail('identity_exists', 409);\n                        if (all.length >= MAX_IDENTITIES)\n                            fail('identity_limit', 409);\n                        identity = { id, userId: this.text(b.userId, 64), connectionId: connection.id, issuer: identityIssuer, subject: sub, protocol: connection.provider === 'github' ? 'oauth2' : 'oidc' };\n                    }\n                    else {\n                        const found = all.find(i => i.id === b.id);\n                        if (!found)\n                            fail('not_found', 404);\n                        identity = found;\n                    }\n                    const target = users(records).find(u => u.id === identity.userId);\n                    if (!target)\n                        fail('not_found', 404);\n                    const r = records.find(r => r.key === 'user:' + target.id)!, prior = entry(records, 'identity:' + identity.id, 'identity', null);\n                    return { mutations: [mutation(prior, 'identity', c.request.method === 'POST' ? identity : null), this.userMutation({ key: r.key, version: r.version, value: target }, { ...target, generation: next(target.generation) }), this.audit(records, user.id, c.request.method === 'POST' ? 'identity.bind' : 'identity.unbind', await time())], result: json({ ok: true }) };\n                });\n            }),\n            route('/login-connections', ['GET', 'POST', 'PUT', 'DELETE'], 'loginConnections', async (c) => {\n                await this.requireCapability(c, 'config.write', c.request.method !== 'GET');\n                if (c.request.method === 'GET')\n                    return this.retry(async (time) => { const { records } = await this.guard(c, time); return { mutations: [], result: json({ publicOrigin: this.host.managementOrigin ? this.publicOrigin() : null, connections: connectionSlots(records).flatMap(slot => slot.value && !slot.value.deleting ? [{ ...this.connectionDto(slot.value), version: slot.version }] : []) }) }; });\n                const b = await body(c.request);\n                if (c.request.method === 'DELETE') {\n                    exact(b, ['id', 'version']);\n                    const id = this.text(b.id, 64);\n                    if (!Number.isSafeInteger(b.version) || (b.version as number) < 1) fail('invalid_input');\n                    return this.retry(async (time) => {\n                        const { records, user } = await this.guard(c, time);\n                        const slot = connectionSlots(records).find(s => s.value?.id === id && !s.value.deleting);\n                        if (!slot || slot.version !== b.version) fail('version_conflict', 409);\n                        const affectedIds = new Set(identities(records).filter(i => i.connectionId === id).map(i => i.userId));\n                        const affected = users(records).filter(u => affectedIds.has(u.id));\n                        const issued = this.subjects.get(c.subject!)!, session = await this.findSession(issued.digest);\n                        return {\n                            mutations: [\n                                mutation(slot, 'connection', { ...slot.value!, enabled: false, deleting: { secretRefs: [...new Set([slot.value!.secretRef, ...this.flows(records).filter(f => f.value?.connectionId === id).map(f => f.value!.verifierRef)])].filter(Boolean) } }),\n                                ...affected.map(u => {\n                                    const r = records.find(r => r.key === 'user:' + u.id)!;\n                                    return this.userMutation({ key: r.key, version: r.version, value: u }, { ...u, generation: next(u.generation) });\n                                }),\n                                this.audit(records, user.id, 'login.delete', await time()),\n                            ],\n                            result: json({ ok: true, sessionRevoked: affectedIds.has(user.id) || session?.value?.connectionId === id }),\n                        };\n                    });\n                }\n                exact(b, ['id', 'version', 'label', 'enabled', 'provider', 'configuration', 'clientId', 'clientSecret', 'scopes']);\n                const id = this.text(b.id, 36), label = this.text(b.label, 128), clientId = this.text(b.clientId, 512);\n                if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(id) || (b.enabled !== undefined && typeof b.enabled !== 'boolean') || (c.request.method === 'POST' && b.version !== undefined) || (c.request.method === 'PUT' && (!Number.isSafeInteger(b.version) || (b.version as number) < 1))) fail('invalid_input');\n                const parsed = parseProvider(b.provider, b.configuration, b.scopes);\n                const previous = c.request.method === 'PUT' ? await this.retry(async time => {\n                    const {records} = await this.guard(c, time);\n                    const slot = connectionSlots(records).find(slot => slot.value?.id === id && !slot.value.deleting);\n                    if (!slot?.value || slot.version !== b.version) fail('version_conflict', 409);\n                    if (slot.value.provider !== parsed.provider) fail('invalid_input');\n                    return {mutations: [], result: slot.value};\n                }) : undefined;\n                // Revocation must remain available while the identity provider is down.\n                const disableOnly = previous && b.enabled === false && b.clientSecret === undefined\n                    && previous.clientId === clientId && previous.issuer === parsed.issuer\n                    && isDeepStrictEqual(previous.configuration, parsed.configuration)\n                    && isDeepStrictEqual(previous.scopes, parsed.scopes);\n                if (!disableOnly) await this.loginProviders().validate({...parsed, clientId});\n                const secretRef = b.clientSecret === undefined ? undefined : await this.storeSecret(this.text(b.clientSecret, 8192));\n                let replacedRef: string | undefined;\n                try {\n                    return await this.retry(async (time) => {\n                        const { records, user } = await this.guard(c, time), slots = connectionSlots(records), record = c.request.method === 'POST' ? slots.find(s => s.value?.id === id) ?? slots.find(s => s.key === 'connection:' + id) ?? slots.find(s => s.value === null) : slots.find(s => s.value?.id === id && !s.value.deleting), old = record?.value;\n                        if (c.request.method === 'PUT' && (!old || record?.version !== b.version))\n                            fail('version_conflict', 409);\n                        if (old && old.provider !== parsed.provider) fail('invalid_input');\n                        if (c.request.method === 'POST' && old) fail('version_conflict', 409);\n                        if (c.request.method === 'POST' && slots.filter(s => s.value !== null).length >= MAX_CONNECTIONS)\n                            fail('connection_limit', 409);\n                        replacedRef = old?.secretRef;\n                        const connection: Connection = { id, label, enabled: b.enabled as boolean ?? false, ...parsed, clientId, secretRef: secretRef ?? old?.secretRef ?? '', generation: next(old?.generation ?? 0) };\n                        if (connection.enabled && !connection.secretRef)\n                            fail('oidc_secret_required');\n                        return { mutations: [{ key: record?.key ?? 'connection:' + id, expectedVersion: record?.version ?? 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, connection }) }, this.audit(records, user.id, 'login.configure', await time())], result: json({ connection: { ...this.connectionDto(connection), version: (record?.version ?? 0) + 1 } }, c.request.method === 'POST' ? 201 : 200) };\n                    });\n                }\n                finally {\n                    if (secretRef)\n                        await this.discardUnpublishedSecret(secretRef);\n                    if (replacedRef)\n                        await this.discardUnpublishedSecret(replacedRef);\n                }\n            }),\n            route('/login-connections/discover', ['POST'], 'discoverLoginConnection', async c => {\n                await this.requireCapability(c, 'config.write', true);\n                const b = await body(c.request); exact(b, ['mode', 'url']);\n                const metadata = await this.loginProviders().discover(b.mode, b.url);\n                return this.retry(async time => { await this.guard(c, time); return {mutations: [], result: json(metadata)}; });\n            }),\n            route('/login-settings', ['GET', 'PUT'], 'loginSettings', async (c) => {\n                await this.requireCapability(c, 'config.write', c.request.method === 'PUT');\n                const b = c.request.method === 'PUT' ? await body(c.request) : {};\n                exact(b, ['version', 'autoCreateUsers']);\n                return this.retry(async (time) => {\n                    const { records, user } = await this.guard(c, time), s = settings(records);\n                    if (c.request.method === 'GET')\n                        return { mutations: [], result: json({ version: s.version, autoCreateUsers: s.value!.autoCreateUsers }) };\n                    if (typeof b.autoCreateUsers !== 'boolean')\n                        fail('invalid_input');\n                    if (b.version !== s.version)\n                        fail('version_conflict', 409);\n                    return { mutations: [mutation(s, 'settings', { ...s.value!, autoCreateUsers: b.autoCreateUsers }), this.audit(records, user.id, 'login.configure', await time())], result: json({ version: s.version + 1, autoCreateUsers: b.autoCreateUsers }) };\n                });\n            }),\n            route('/turnstile', ['GET', 'PUT'], 'turnstile', async (c) => {\n                await this.requireCapability(c, 'config.write', c.request.method === 'PUT');\n                if (c.request.method === 'GET')\n                    return this.retry(async (time) => { const { records } = await this.guard(c, time), s = turnstile(records); return { mutations: [], result: json(this.turnstileDto(s)) }; });\n                const b = await body(c.request);\n                exact(b, ['version', 'enabled', 'siteKey', 'secret', 'hostnames']);\n                if (typeof b.enabled !== 'boolean' || typeof b.siteKey !== 'string' || b.siteKey.length > 256 || !Array.isArray(b.hostnames) || b.hostnames.length > 32 || b.hostnames.some(h => typeof h !== 'string' || !h || h.length > 253 || !/^([a-z0-9-]+\\.)*[a-z0-9-]+$/i.test(h)))\n                    fail('invalid_input');\n                const ref = b.secret === undefined ? undefined : await this.storeSecret(this.text(b.secret, 8192));\n                let replacedRef: string | undefined;\n                try {\n                    return await this.retry(async (time) => {\n                        const { records, user } = await this.guard(c, time), s = turnstile(records);\n                        replacedRef = s.value!.secretRef;\n                        if (s.version !== b.version)\n                            fail('version_conflict', 409);\n                        const v: Turnstile = { enabled: b.enabled as boolean, siteKey: b.siteKey as string, secretRef: ref ?? s.value!.secretRef, hostnames: b.hostnames as string[] };\n                        if (v.enabled && (!v.siteKey || !v.secretRef || !v.hostnames.length))\n                            fail('turnstile_incomplete');\n                        return { mutations: [mutation(s, 'turnstile', v), this.audit(records, user.id, 'turnstile.configure', await time())], result: json(this.turnstileDto({ key: s.key, version: s.version + 1, value: v })) };\n                    });\n                }\n                finally {\n                    if (ref)\n                        await this.discardUnpublishedSecret(ref);\n                    if (replacedRef)\n                        await this.discardUnpublishedSecret(replacedRef);\n                }\n            }),\n            route('/identities/link/start', ['POST'], 'beginIdentityLink', async (c) => { await this.requireCapability(c, 'config.write', true); const b = await body(c.request); exact(b, ['connectionId']); return this.startFlow(c.request, this.text(b.connectionId, 64), '/#/extensions/user-auth/profile', c); }),\n            route('/identities/link/finish', ['POST'], 'finishIdentityLink', async (c) => { await this.requireCapability(c, 'config.write', true); const b = await body(c.request); exact(b, ['flowId']); return this.finishLink(c, this.text(b.flowId, 64)); }),\n        ];\n    }\n    private displayName(v: unknown): string { if (typeof v !== 'string' || [...v].length > 128)\n        fail('invalid_input'); return v; }\n    private text(v: unknown, max: number): string { if (typeof v !== 'string' || !v || v.length > max)\n        fail('invalid_input'); return v; }\n    private confirmPassword(b: Record<string, unknown>): string { const p = password(b.password); if (p !== b.passwordConfirmation)\n        fail('password_confirmation'); return p; }\n    private connectionDto(v: Connection) { return { id: v.id, label: v.label, enabled: v.enabled, provider: v.provider, configuration: v.configuration, issuer: v.issuer, clientId: v.clientId, scopes: v.scopes, hasSecret: !!v.secretRef }; }\n    private turnstileDto(s: Slot<Turnstile>) { return { version: s.version, enabled: s.value!.enabled, siteKey: s.value!.siteKey, hostnames: s.value!.hostnames, hasSecret: !!s.value!.secretRef }; }\n    private async storeSecret(secret: string): Promise<string> {\n        const encoded = JSON.stringify({owner: randomUUID(), value: secret});\n        for (let index = 0; index < MAX_SECRETS; index++) {\n            const key = 'auth-secret:' + index;\n            if (await this.host.secretStore.get(key)) continue;\n            try {\n                const version = await this.host.secretStore.compareAndSet(key, null, encoded);\n                return key + ':' + version;\n            }\n            catch (error) {\n                const saved = await this.host.secretStore.get(key);\n                if (saved && constant(saved.value, encoded)) return key + ':' + saved.version;\n                if (error && typeof error === 'object' && 'code' in error && error.code === 'version_conflict') continue;\n                throw error;\n            }\n        }\n        return fail('secret_limit', 503);\n    }\n    private async readSecret(ref: string) {\n        const match = /^auth-secret:(\\d+):([1-9]\\d*)$/.exec(ref);\n        if (!match || Number(match[1]) >= MAX_SECRETS) return null;\n        const key = 'auth-secret:' + match[1], saved = await this.host.secretStore.get(key);\n        if (saved?.version !== Number(match[2])) return null;\n        try {\n            const value = JSON.parse(saved.value) as {owner?: unknown; value?: unknown};\n            return typeof value?.owner === 'string' && typeof value.value === 'string' ? {version:saved.version, value:value.value, key} : null;\n        } catch { return null; }\n    }\n    private async deleteSecret(ref: string) {\n        const saved = await this.readSecret(ref);\n        if (saved) await this.host.secretStore.delete(saved.key, saved.version);\n    }\n    private async discardUnpublishedSecret(ref: string) {\n        try {\n            const records = await this.records();\n            if (records.some(r => JSON.stringify(r.value).includes(ref)))\n                return;\n            await this.deleteSecret(ref);\n        }\n        catch { /* Unknown publication must retain the reference until a later bounded-slot cleanup. */ }\n    }\n    private async verifyTurnstile(token: unknown, config: Turnstile, request: Request) {\n        if (!config.enabled)\n            return;\n        if (typeof token !== 'string' || !token || token.length > 2048)\n            fail('turnstile_required', 401);\n        await this.retry(async (time) => {\n            const records = await this.records(), s = settings(records).value!, all = slots(records, 'failure', MAX_FAILURES, validateFailure), key = 'challenge:' + digest(token), now = await time();\n            if (all.some(f => f.value?.key === key && f.value.until > now))\n                fail('turnstile_failed', 401);\n            const slot = all.find(f => !f.value || f.value.until <= now);\n            if (!slot)\n                fail('login_limited', 429);\n            return { mutations: [mutation(slot, 'failure', { key, count: 1, until: now + 5 * 60000, epoch: s.failureEpoch })], result: undefined };\n        });\n        const secret = await this.readSecret(config.secretRef);\n        if (!secret)\n            fail('turnstile_failed', 401);\n        try {\n            const response = await (this.dependencies.fetch ?? fetch)('https://challenges.cloudflare.com/turnstile/v0/siteverify', { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ secret: secret.value, response: token }), signal: AbortSignal.any([request.signal, this.host.signal, AbortSignal.timeout(5000)]), redirect: 'error' });\n            const result = await response.json() as {\n                success?: unknown;\n                hostname?: unknown;\n                action?: unknown;\n            };\n            if (!response.ok || result.success !== true || typeof result.hostname !== 'string' || !config.hostnames.includes(result.hostname) || result.action !== 'local-login')\n                fail('turnstile_failed', 401);\n        }\n        catch (e) {\n            if (e instanceof AccountError)\n                throw e;\n            fail('turnstile_failed', 401);\n        }\n    }\n    private publicOrigin(): string {\n        const configured = this.host.managementOrigin;\n        if (!configured) fail('management_origin_required', 503);\n        let url: URL;\n        try { url = new URL(configured); }\n        catch { fail('management_origin_required', 503); }\n        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.pathname !== '/' || url.search || url.hash || url.origin !== configured)\n            fail('management_origin_required', 503);\n        return url.origin;\n    }\n    private returnPath(value: unknown): string { if (value === undefined)\n        return '/#/'; if (typeof value !== 'string' || !value.startsWith('/') || value.startsWith('//') || value.includes('\\\\') || /[\\x00-\\x20]/.test(value) || value.length > 2048)\n        fail('invalid_return_to'); const u = new URL(value, this.publicOrigin()); if (u.origin !== this.publicOrigin())\n        fail('invalid_return_to'); return u.pathname + u.search + u.hash; }\n    private flowCookie(token: string, maxAge = 600) { return `${FLOW_COOKIE}=${token}; Path=/api/auth/login/callback/; HttpOnly; SameSite=Lax; Max-Age=${maxAge}${this.publicOrigin().startsWith('https:') ? '; Secure' : ''}`; }\n    private flows(records: readonly DurableRecord[]): Slot<AuthFlow>[] {\n        return slots(records, 'flow', MAX_FLOWS, v => { if (v === null)\n            return null; const f = v as AuthFlow; if (!f || Object.keys(f).some(k => !['id', 'state', 'nonce', 'verifierRef', 'connectionId', 'generation', 'created', 'expiresAt', 'epoch', 'returnTo', 'status', 'initiator', 'subject', 'issuer', 'protocol'].includes(k)) || typeof f.id !== 'string' || typeof f.state !== 'string' || typeof f.nonce !== 'string' || typeof f.verifierRef !== 'string' || typeof f.connectionId !== 'string' || !Number.isSafeInteger(f.generation) || !Number.isSafeInteger(f.created) || !Number.isSafeInteger(f.expiresAt) || !Number.isSafeInteger(f.epoch) || !['pending', 'exchanging', 'verified', 'consumed'].includes(f.status) || typeof f.returnTo !== 'string' || (f.subject !== undefined && typeof f.subject !== 'string') || (f.issuer !== undefined && typeof f.issuer !== 'string') || (f.protocol !== undefined && !['oidc', 'oauth2'].includes(f.protocol)) || (f.status === 'verified' && (!f.subject || !f.issuer || !f.protocol)) || (f.initiator !== undefined && (!f.initiator || typeof f.initiator.userId !== 'string' || typeof f.initiator.sessionDigest !== 'string' || !Number.isSafeInteger(f.initiator.generation))))\n            fail('corrupt_state', 503); return f; });\n    }\n    private loginProviders() { return new LoginProviders(this.dependencies.fetch ?? fetch, this.host.signal); }\n    private async oidcConfig(connection: Connection): Promise<oidc.Configuration> {\n        const secret = await this.readSecret(connection.secretRef);\n        if (!secret) fail('oidc_unavailable', 503);\n        return this.loginProviders().configuration(connection, secret.value);\n    }\n    async loginOptions(_request: Request): Promise<Response> { try {\n        this.alive();\n        const records = await this.records(), t = turnstile(records).value!;\n        return json({ local: { enabled: true, turnstile: { enabled: t.enabled, ...(t.enabled ? { siteKey: t.siteKey } : {}) } }, methods: connections(records).filter(c => c.enabled).map(c => ({ id: c.id, label: c.label, provider: c.provider })) });\n    }\n    catch (e) {\n        return safe(e);\n    } }\n    async beginLogin(request: Request): Promise<Response> { try {\n        this.alive();\n        origin(request, this.host.managementOrigin);\n        const b = await body(request);\n        exact(b, ['methodId', 'returnTo']);\n        return await this.startFlow(request, this.text(b.methodId, 64), this.returnPath(b.returnTo));\n    }\n    catch (e) {\n        return safe(e);\n    } }\n    private async startFlow(request: Request, methodId: string, returnTo: string, c?: ControlApiHandlerContext): Promise<Response> {\n        const publicOrigin = this.publicOrigin();\n        await this.reserve(['source:' + digest(this.source(request))]);\n        const connection = connections(await this.records()).find(c => c.id === methodId && c.enabled);\n        if (!connection)\n            fail('oidc_unavailable', 401);\n        const config = await this.oidcConfig(connection), state = oidc.randomState(), nonce = oidc.randomNonce(), verifier = oidc.randomPKCECodeVerifier(), challenge = await oidc.calculatePKCECodeChallenge(verifier), verifierRef = await this.storeSecret(verifier), id = randomUUID();\n        let replacedRef: string | undefined;\n        try {\n            await this.retry(async (time) => {\n                const guarded = c ? await this.guard(c, time) : undefined, records = guarded?.records ?? await this.records(), current = connections(records).find(x => x.id === methodId), now = await time();\n                if (!current?.enabled || current.generation !== connection.generation)\n                    fail('version_conflict', 409);\n                const slot = this.flows(records).find(s => !s.value || s.value.expiresAt <= now || s.value.status === 'consumed');\n                if (!slot)\n                    fail('flow_limit', 429);\n                replacedRef = slot.value?.verifierRef;\n                const flow: AuthFlow = { id, state, nonce, verifierRef, connectionId: methodId, generation: current.generation, created: now, expiresAt: now + 10 * 60000, epoch: settings(records).value!.sessionEpoch, returnTo, status: 'pending', ...(guarded ? { initiator: { userId: guarded.user.id, generation: guarded.user.generation, sessionDigest: this.subjects.get(c!.subject!)!.digest } } : {}) };\n                return { mutations: [mutation(slot, 'flow', flow)], result: undefined };\n            });\n            const authorizationUrl = oidc.buildAuthorizationUrl(config, { redirect_uri: publicOrigin + '/api/auth/login/callback/' + methodId, scope: connection.scopes.join(' '), response_type: 'code', code_challenge: challenge, code_challenge_method: 'S256', state, ...(connection.provider === 'github' ? {} : { nonce }) }).href;\n            return json({ authorizationUrl, flowId: id }, 200, { 'set-cookie': this.flowCookie(state) });\n        }\n        finally {\n            await this.discardUnpublishedSecret(verifierRef);\n            if (replacedRef)\n                await this.discardUnpublishedSecret(replacedRef);\n        }\n    }\n    async completeLogin(request: Request): Promise<Response> {\n        let verifierRef: string | undefined;\n        try {\n            this.alive();\n            const publicOrigin = this.publicOrigin(), incoming = new URL(request.url), methodId = incoming.pathname.split('/').at(-1)!, state = incoming.searchParams.get('state');\n            const cookies = (request.headers.get('cookie') ?? '').split(';').map(c => c.trim()).filter(c => c.startsWith(FLOW_COOKIE + '='));\n            if (!state || cookies.length !== 1 || !constant(cookies[0]!.slice(FLOW_COOKIE.length + 1), state))\n                fail('invalid_oidc_state', 401);\n            const flow = await this.retry(async (time) => {\n                const records = await this.records(), slot = this.flows(records).find(s => s.value?.state === state), connection = connections(records).find(c => c.id === methodId), now = await time(), f = slot?.value;\n                if (!slot || !f || f.connectionId !== methodId || f.status !== 'pending' || f.epoch !== settings(records).value!.sessionEpoch || f.expiresAt <= now || !connection?.enabled || connection.generation !== f.generation)\n                    fail('invalid_oidc_flow', 401);\n                return { mutations: [mutation(slot, 'flow', { ...f, status: 'exchanging' })], result: { flow: f, connection } };\n            });\n            verifierRef = flow.flow.verifierRef;\n            const verifier = await this.readSecret(verifierRef);\n            if (!verifier)\n                fail('invalid_oidc_flow', 401);\n            const config = await this.oidcConfig(flow.connection);\n            const canonical = new URL(publicOrigin + '/api/auth/login/callback/' + methodId);\n            canonical.search = incoming.search;\n            const identityResult = await this.loginProviders().exchange(flow.connection, config, canonical, {pkceCodeVerifier: verifier.value, expectedState: state, expectedNonce: flow.flow.nonce});\n            const token = randomBytes(32).toString('base64url');\n            const result = await this.retry<{\n                link: boolean;\n                returnTo: string;\n                policy?: SessionPolicy;\n            }>(async (time) => {\n                const records = await this.records(), slot = this.flows(records).find(s => s.value?.id === flow.flow.id), f = slot?.value, current = connections(records).find(c => c.id === methodId), policy = (await this.readSessionPolicy()).policy, initiatingSession = f?.initiator ? await this.findSession(f.initiator.sessionDigest) : undefined, now = await time();\n                if (!slot || !f || f.status !== 'exchanging' || f.epoch !== settings(records).value!.sessionEpoch || f.expiresAt <= now || !current?.enabled || current.generation !== f.generation)\n                    fail('invalid_oidc_flow', 401);\n                if (f.initiator) {\n                    const u = users(records).find(u => u.id === f.initiator!.userId), session = initiatingSession;\n                    if (!u || u.generation !== f.initiator.generation || !session?.value || !this.live(u, session.value, now, records))\n                        fail('forbidden', 403);\n                    return { mutations: [mutation(slot, 'flow', { ...f, status: 'verified', subject: identityResult.subject, issuer: identityResult.issuer, protocol: identityResult.protocol })], result: { link: true, returnTo: '/#/extensions/user-auth/profile?oidcLink=' + f.id } };\n                }\n                const id = digest(identityResult.issuer + '\\0' + identityResult.subject), binding = identities(records).find(i => i.id === id), all = users(records);\n                let u = binding && all.find(u => u.id === binding.userId);\n                const changes: DurableMutation[] = [];\n                if (binding && !u)\n                    fail('corrupt_state', 503);\n                if (binding && (binding.connectionId !== current.id || binding.protocol !== identityResult.protocol))\n                    fail('identity_connection_mismatch', 401);\n                if (!u) {\n                    if (!settings(records).value!.autoCreateUsers)\n                        fail('unknown_identity', 401);\n                    if (all.length >= MAX_USERS || identities(records).length >= MAX_IDENTITIES)\n                        fail('user_limit', 409);\n                    const userId = randomUUID();\n                    u = { id: userId, username: 'sso-' + userId, displayName: identityResult.displayName, disabled: false, generation: 1, passwordHash: '', temporary: false };\n                    changes.push(this.userMutation({ key: 'user:' + userId, version: 0, value: null }, u));\n                    const identity: Identity = { id, userId, connectionId: current.id, issuer: identityResult.issuer, subject: identityResult.subject, protocol: identityResult.protocol };\n                    changes.push(mutation(entry(records, 'identity:' + id, 'identity', null), 'identity', identity));\n                }\n                if (u.disabled)\n                    fail('disabled_user', 401);\n                const sessions = slots(records, 'session', MAX_SESSIONS, validateSession), session = sessions.find(s => !s.value || !this.live(all.find(u => u.id === s.value!.administratorId) ?? null, s.value, now, records));\n                if (!session)\n                    fail('session_limit', 429);\n                changes.push(mutation(session, 'session', { digest: digest(token), administratorId: u.id, generation: u.generation, created: now, touched: now, transport: 'cookie', policy, epoch: settings(records).value!.sessionEpoch, connectionId: current.id, connectionGeneration: current.generation }), mutation(slot, 'flow', { ...f, status: 'consumed' }), this.audit(records, u.id, 'oidc.login', now));\n                return { mutations: changes, result: { link: false, returnTo: f.returnTo, policy } };\n            });\n            const headers = new Headers({ 'location': new URL(result.returnTo, publicOrigin).href, 'cache-control': 'no-store' });\n            headers.append('set-cookie', this.flowCookie('', 0));\n            if (!result.link && result.policy)\n                headers.append('set-cookie', cookie(request, token, this.cookieAge(result.policy), publicOrigin));\n            return new Response(null, { status: 302, headers });\n        }\n        catch (error) {\n            const code=error instanceof AccountError?error.code:'oidc_failed';\n            await this.recordFailure('oidc.login',error);\n            try {\n                return new Response(null, { status: 302, headers: { location: this.publicOrigin() + '/#/login?oidcError=' + encodeURIComponent(code), 'cache-control': 'no-store', 'set-cookie': this.flowCookie('', 0) } });\n            }\n            catch {\n                return safe(error);\n            }\n        }\n        finally {\n            if (verifierRef) {\n                try {\n                    await this.deleteSecret(verifierRef);\n                }\n                catch { }\n            }\n        }\n    }\n    private async finishLink(c: ControlApiHandlerContext, id: string): Promise<Response> {\n        return this.retry(async (time) => {\n            const { records, user } = await this.guard(c, time), slot = this.flows(records).find(s => s.value?.id === id), f = slot?.value, now = await time(), connection = f && connections(records).find(x => x.id === f.connectionId), issued = this.subjects.get(c.subject!)!;\n            if (!slot || !f || f.status !== 'verified' || f.epoch !== settings(records).value!.sessionEpoch || f.expiresAt <= now || !f.subject || !f.issuer || !f.protocol || !f.initiator || f.initiator.userId !== user.id || f.initiator.generation !== user.generation || f.initiator.sessionDigest !== issued.digest || !connection?.enabled || connection.generation !== f.generation)\n                fail('invalid_oidc_flow', 401);\n            const identity: Identity = { id: digest(f.issuer + '\\0' + f.subject), userId: user.id, connectionId: connection.id, issuer: f.issuer, subject: f.subject, protocol: f.protocol };\n            if (identities(records).some(i => i.id === identity.id))\n                fail('identity_exists', 409);\n            if (identities(records).length >= MAX_IDENTITIES)\n                fail('identity_limit', 409);\n            const u = records.find(r => r.key === 'user:' + user.id)!;\n            return { mutations: [mutation(entry(records, 'identity:' + identity.id, 'identity', null), 'identity', identity), this.userMutation({ key: u.key, version: u.version, value: user }, { ...user, generation: next(user.generation) }), mutation(slot, 'flow', { ...f, status: 'consumed' }), this.audit(records, user.id, 'identity.link', now)], result: json({ ok: true }) };\n        });\n    }\n}\nexport function createControl(host: ControlHostContext, dependencies: Dependencies = {}): UserAuthControl { return new UserAuthControl(host, dependencies); }\nexport const api = [\n    { path: '/password', methods: ['POST'], handler: 'changePassword' },\n    { path: '/logout', methods: ['POST'], handler: 'logout' },\n    { path: '/self', methods: ['GET'], handler: 'self' },\n    { path: '/session-policy', methods: ['GET', 'PUT'], handler: 'sessionPolicy' },\n    ...[['/users', ['GET', 'POST'], 'users'], ['/users/update', ['PUT'], 'updateUser'], ['/users/password', ['POST'], 'resetUserPassword'], ['/identities', ['GET', 'POST', 'DELETE'], 'identities'], ['/login-connections', ['GET', 'POST', 'PUT', 'DELETE'], 'loginConnections'], ['/login-connections/discover', ['POST'], 'discoverLoginConnection'], ['/login-settings', ['GET', 'PUT'], 'loginSettings'], ['/turnstile', ['GET', 'PUT'], 'turnstile'], ['/identities/link/start', ['POST'], 'beginIdentityLink'], ['/identities/link/finish', ['POST'], 'finishIdentityLink']].map(([path, methods, handler]) => ({ path, methods, handler })),\n] as const;\nexport const rpc = [], controlApi = api, controlRpc = rpc;\nexport async function readManagementSetup(state: StateReader): Promise<{\n    initialized: boolean;\n}> {\n    const records = await state.list(), setup = setupRecord(records);\n    slots(records, 'session', MAX_SESSIONS, validateSession);\n    slots(records, 'failure', MAX_FAILURES, validateFailure);\n    const policy = records.find(r => r.key === 'session-policy');\n    if (policy)\n        validateSessionPolicy(envelope(policy.value, 'policy'), 'corrupt_state', 503);\n    return { initialized: setup.value.phase === 'ready' };\n}\n/** Only the stopped-instance host may create the namespace or rotate its code. */\nexport async function prepareInitialization(context: RecoveryContext): Promise<{\n    code: string;\n    expiresAt: number;\n}> {\n    const state = context.durableState, now = context.now ?? Date.now;\n    for (let i = 0; i < 64; i++) {\n        const records = await state.list(), fresh = !records.length;\n        if (!fresh)\n            await readManagementSetup(state);\n        const setup = fresh ? undefined : setupRecord(records);\n        if (setup?.value.phase === 'ready')\n            fail('already_initialized', 409);\n        const clock = fresh ? { version: 0, value: wallTime(now) } : await observeClock(state, now), code = randomBytes(32).toString('base64url'), expiresAt = clock.value + 30 * 60000;\n        try {\n            await state.transact([{ key: 'setup', expectedVersion: setup?.version ?? 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, setup: { phase: 'uninitialized', code: { digest: digest(code), expiresAt } } }) }, clockMutation(clock)]);\n            return { code, expiresAt };\n        }\n        catch (e) {\n            if (!isDurableStateConflictError(e))\n                throw e;\n        }\n    }\n    return fail('version_conflict', 409);\n}\n/** An explicit offline reset restores only the stable recovery anchor. */\nexport async function recoverIdentity(input: unknown, context: RecoveryContext) {\n    const b = object(input);\n    exact(b, ['operation', 'username', 'password', 'passwordConfirmation', 'reason', 'disableTurnstile']);\n    if (b.operation !== 'reset' || (b.disableTurnstile !== undefined && !['', 'yes', 'no'].includes(b.disableTurnstile as string)))\n        fail('invalid_input');\n    const name = username(b.username), p = password(b.password);\n    if (b.passwordConfirmation !== p)\n        fail('password_confirmation');\n    if (typeof b.reason !== 'string' || !b.reason.trim() || b.reason.length > 512)\n        fail('invalid_reason');\n    const state = context.durableState, now = context.now ?? Date.now, hash = await Bun.password.hash(p, { algorithm: 'argon2id', memoryCost: 65536, timeCost: 3 });\n    for (let i = 0; i < 64; i++) {\n        const records = await state.list();\n        validateKeys(records);\n        const anchor = records.find(r => r.key === 'recovery-anchor');\n        let anchorId: string | undefined;\n        if (anchor) {\n            const id = envelope(anchor.value, 'userId');\n            if (typeof id !== 'string' || !/^[a-f0-9-]{36}$/.test(id))\n                fail('corrupt_state', 503);\n            anchorId = id;\n        }\n        // Recovery deliberately does not accept a previous record schema or infer an anchor from a username.\n        for (const r of records)\n            if ((r.value as {\n                schema?: unknown;\n            })?.schema !== ACCOUNT_RECORD_SCHEMA)\n                fail('corrupt_state', 503);\n        const id = anchorId ?? randomUUID(), record = records.find(r => r.key === 'user:' + id);\n        let prior: User | undefined;\n        if (record) {\n            try {\n                prior = validateUser(envelope(record.value, 'user'));\n            }\n            catch (error) {\n                if (!(error instanceof AccountError))\n                    throw error;\n            }\n        }\n        const other = records.filter(r => r.key.startsWith('user:') && r.key !== 'user:' + id).map(r => validateUser(envelope(r.value, 'user')));\n        if (other.some(u => u.username === name))\n            fail('username_exists', 409);\n        const s = settings(records), turn = turnstile(records), clockRecord = records.find(r => r.key === 'clock');\n        let observed = 0;\n        try {\n            observed = clockValue(clockRecord);\n        }\n        catch (error) {\n            if (!(error instanceof AccountError))\n                throw error;\n        }\n        const at = Math.max(observed, wallTime(now)), user: User = { id, username: name, displayName: prior?.displayName ?? name, disabled: false, generation: next(prior?.generation ?? 0) }, credential = records.find(r => r.key === 'credential:' + id);\n        const failures = slots(records, 'failure', MAX_FAILURES, validateFailure);\n        slots(records, 'session', MAX_SESSIONS, validateSession);\n        connections(records);\n        identities(records);\n        const changes: DurableMutation[] = [\n            { key: 'user:' + id, expectedVersion: record?.version ?? 0, value: asJson({ schema: ACCOUNT_RECORD_SCHEMA, user }) },\n            { key: 'credential:' + id, expectedVersion: credential?.version ?? 0, value: { schema: ACCOUNT_RECORD_SCHEMA, credential: { passwordHash: hash, temporary: false } } },\n            { key: 'recovery-anchor', expectedVersion: anchor?.version ?? 0, value: { schema: ACCOUNT_RECORD_SCHEMA, userId: id } },\n            { key: 'setup', expectedVersion: records.find(r => r.key === 'setup')?.version ?? 0, value: { schema: ACCOUNT_RECORD_SCHEMA, setup: { phase: 'ready' } } },\n            { key: 'clock', expectedVersion: clockRecord?.version ?? 0, value: { schema: ACCOUNT_RECORD_SCHEMA, observedThrough: at } },\n            mutation(s, 'settings', { ...s.value!, sessionEpoch: next(s.value!.sessionEpoch), failureEpoch: next(Math.max(s.value!.failureEpoch, ...failures.map(f => f.value?.epoch ?? 0))) }),\n            { key: 'recovery-summary', expectedVersion: records.find(r => r.key === 'recovery-summary')?.version ?? 0, value: { schema: ACCOUNT_RECORD_SCHEMA, userId: id, reason: b.reason, at } },\n            mutation(turn, 'turnstile', { ...turn.value!, ...(b.disableTurnstile === 'yes' ? {enabled: false} : {}) }),\n        ];\n        try {\n            await state.transact(changes);\n            return dto({ ...user, passwordHash: hash, temporary: false });\n        }\n        catch (e) {\n            if (!isDurableStateConflictError(e))\n                throw e;\n        }\n    }\n    return fail('version_conflict', 409);\n}\nexport default { createControl, readManagementSetup, offlineRecovery: { kind: 'identity', prepareInitialization,\n        prompts: [{ name: 'username', label: 'Recovery username', secret: false }, { name: 'password', label: 'New password', secret: true }, { name: 'passwordConfirmation', label: 'Confirm password', secret: true }, { name: 'reason', label: 'Recovery reason', secret: false }, { name: 'disableTurnstile', label: 'Disable Turnstile? Type yes to disable; default no', secret: false }], recover: recoverIdentity } } satisfies ControlPlugin;\n",
+    "export class AccountError extends Error {\n    constructor(readonly code: string, readonly status = 400) { super(code); }\n}\nexport function fail(code: string, status = 400): never { throw new AccountError(code, status); }\n",
     "/** Shared process sink; the public SDK must not bundle file transports into plugins. */\ntype Context = Readonly<Record<string, unknown>>;\ntype LogMethod = { (context: Context, message?: string): void; (message: string): void };\nexport interface PluginLogSink {\n  info: LogMethod; warn: LogMethod; error: LogMethod; debug: LogMethod; fatal: LogMethod;\n  child(bindings: Context): PluginLogSink;\n}\nconst sinkKey = Symbol.for('@jeffusion/bungee/plugin-log-sink');\nexport function installPluginLogSink(sink: PluginLogSink): void {\n  (globalThis as Record<symbol, unknown>)[sinkKey] = sink;\n}\nfunction createLogger(bindings: Context = {}): PluginLogSink {\n  const method = (level: 'info' | 'warn' | 'error' | 'debug' | 'fatal'): LogMethod =>\n    (value: Context | string, message?: string) => {\n      const sink = (globalThis as Record<symbol, unknown>)[sinkKey] as PluginLogSink | undefined;\n      if (sink) {\n        if (typeof value === 'string') sink[level](bindings, value);\n        else sink[level]({...bindings, ...value}, message);\n      } else if (level !== 'debug' || process.env.LOG_LEVEL === 'debug') {\n        const write = level === 'fatal' ? console.error : console[level];\n        write(message ?? (typeof value === 'string' ? value : ''), typeof value === 'string' ? bindings : {...bindings, ...value});\n      }\n    };\n  return {info: method('info'), warn: method('warn'), error: method('error'), debug: method('debug'),\n    fatal: method('fatal'), child: extra => createLogger({...bindings, ...extra})};\n}\nexport const logger = createLogger();\n",
     "/**\n * Hook 实现类\n *\n * 提供 4 种 Hook 类型的实现：\n * - AsyncParallelHook: 异步并行执行\n * - AsyncSeriesHook: 异步串行执行\n * - AsyncSeriesBailHook: 异步串行可中断\n * - AsyncSeriesWaterfallHook: 异步串行瀑布\n */\n\nimport { logger } from '../plugin-logger';\n/** Host-supplied view refresh, run between every waterfall tap. */\nexport const WATERFALL_VIEW_TRANSFORM = Symbol('waterfall-view-transform');\nimport type {\n  TapInfo,\n  Tap,\n  IAsyncParallelHook,\n  IAsyncSeriesHook,\n  IAsyncSeriesBailHook,\n  IAsyncSeriesWaterfallHook,\n  IAsyncSeriesMapHook,\n  HookStats,\n} from './types';\n\n/**\n * 标准化 TapInfo\n */\nfunction normalizeTapInfo(info: TapInfo | string): TapInfo {\n  if (typeof info === 'string') {\n    return { name: info, stage: 0 };\n  }\n  return { ...info, stage: info.stage ?? 0 };\n}\n\n/**\n * 基础 Hook 类\n */\nabstract class BaseHook<T extends any[]> {\n  protected taps: Tap<T, any>[] = [];\n  protected name: string;\n  protected callCount = 0;\n  protected totalTimeMs = 0;\n\n  constructor(name?: string) {\n    this.name = name ?? 'anonymous';\n  }\n\n  /**\n   * 同步注册\n   */\n  tap(info: TapInfo | string, fn: (...args: T) => any): void {\n    const tapInfo = normalizeTapInfo(info);\n    this.taps.push({ info: tapInfo, type: 'sync', fn });\n    this.sortTaps();\n  }\n\n  /**\n   * 异步回调风格注册\n   */\n  tapAsync(info: TapInfo | string, fn: (...args: any[]) => void): void {\n    const tapInfo = normalizeTapInfo(info);\n    this.taps.push({ info: tapInfo, type: 'async', fn });\n    this.sortTaps();\n  }\n\n  /**\n   * Promise 风格注册\n   */\n  tapPromise(info: TapInfo | string, fn: (...args: T) => Promise<any>): void {\n    const tapInfo = normalizeTapInfo(info);\n    this.taps.push({ info: tapInfo, type: 'promise', fn });\n    this.sortTaps();\n  }\n\n  /**\n   * 检查是否有注册的回调\n   */\n  hasCallbacks(): boolean {\n    return this.taps.length > 0;\n  }\n\n  /**\n   * 获取统计信息\n   */\n  getStats(): HookStats {\n    return {\n      name: this.name,\n      tapCount: this.taps.length,\n      callCount: this.callCount,\n      totalTimeMs: this.totalTimeMs,\n      avgTimeMs: this.callCount > 0 ? this.totalTimeMs / this.callCount : 0,\n    };\n  }\n\n  /**\n   * 重置统计信息\n   */\n  resetStats(): void {\n    this.callCount = 0;\n    this.totalTimeMs = 0;\n  }\n\n  /**\n   * 清空所有注册的回调\n   */\n  clear(): void {\n    this.taps = [];\n  }\n\n  /**\n   * 按 stage 排序（稳定排序）\n   */\n  private sortTaps(): void {\n    this.taps.sort((a, b) => (a.info.stage ?? 0) - (b.info.stage ?? 0));\n  }\n\n  /**\n   * 执行单个 tap\n   */\n  protected async executeTap<R>(\n    tap: Tap<T, R>,\n    args: T\n  ): Promise<R | undefined> {\n    try {\n      if (tap.type === 'sync') {\n        return tap.fn(...args);\n      } else if (tap.type === 'promise') {\n        return await tap.fn(...args);\n      } else {\n        // async (callback style)\n        return await new Promise<R | undefined>((resolve, reject) => {\n          const done = (err?: Error, result?: R) => {\n            if (err) reject(err);\n            else resolve(result);\n          };\n          tap.fn(...args, done);\n        });\n      }\n    } catch (error) {\n      logger.error(\n        { error, hookName: this.name, pluginName: tap.info.name },\n        'Error in hook callback'\n      );\n      throw error;\n    }\n  }\n}\n\n/** Synchronous providers use the same registration, ordering and statistics as async hooks. */\nexport class SyncBailHook<T extends any[] = [], R = unknown> extends BaseHook<T> {\n  override tapAsync(): never { throw new Error('synchronous provider requires tap'); }\n  override tapPromise(): never { throw new Error('synchronous provider requires tap'); }\n  call(...args: T): R | undefined {\n    const started = performance.now();\n    this.callCount++;\n    try {\n      for (const tap of this.taps) {\n        const result = tap.fn(...args);\n        if (result && typeof result.then === 'function') throw new Error('synchronous provider returned a Promise');\n        if (result !== undefined) return result as R;\n      }\n      return undefined;\n    } finally { this.totalTimeMs += performance.now() - started; }\n  }\n}\n\n/**\n * 异步并行 Hook\n * 所有回调并行执行，全部完成后返回\n */\nexport class AsyncParallelHook<T extends any[] = []>\n  extends BaseHook<T>\n  implements IAsyncParallelHook<T>\n{\n  async promise(...args: T): Promise<void> {\n    if (this.taps.length === 0) return;\n\n    const startTime = performance.now();\n    this.callCount++;\n\n    try {\n      // 并行执行所有回调，错误独立处理不影响其他\n      await Promise.all(\n        this.taps.map(async (tap) => {\n          try {\n            await this.executeTap(tap, args);\n          } catch (error) {\n            // 并行 Hook 中单个回调的错误不应影响其他回调\n            logger.error(\n              { error, hookName: this.name, pluginName: tap.info.name },\n              'Error in parallel hook callback (ignored)'\n            );\n          }\n        })\n      );\n    } finally {\n      this.totalTimeMs += performance.now() - startTime;\n    }\n  }\n}\n\n/**\n * 异步串行 Hook\n * 所有回调按顺序串行执行\n */\nexport class AsyncSeriesHook<T extends any[] = []>\n  extends BaseHook<T>\n  implements IAsyncSeriesHook<T>\n{\n  async promise(...args: T): Promise<void> {\n    if (this.taps.length === 0) return;\n\n    const startTime = performance.now();\n    this.callCount++;\n\n    try {\n      for (const tap of this.taps) {\n        await this.executeTap(tap, args);\n      }\n    } finally {\n      this.totalTimeMs += performance.now() - startTime;\n    }\n  }\n}\n\n/**\n * 异步串行可中断 Hook\n * 任意回调返回非 undefined 值则停止执行并返回该值\n */\nexport class AsyncSeriesBailHook<T extends any[] = [], R = any>\n  extends BaseHook<T>\n  implements IAsyncSeriesBailHook<T, R>\n{\n  async promise(...args: T): Promise<R | undefined> {\n    if (this.taps.length === 0) return undefined;\n\n    const startTime = performance.now();\n    this.callCount++;\n\n    try {\n      for (const tap of this.taps) {\n        const result = await this.executeTap<R>(tap, args);\n        if (result !== undefined) {\n          logger.debug(\n            { hookName: this.name, pluginName: tap.info.name },\n            'Hook bailed with result'\n          );\n          return result;\n        }\n      }\n      return undefined;\n    } finally {\n      this.totalTimeMs += performance.now() - startTime;\n    }\n  }\n}\n\n/**\n * 异步串行瀑布 Hook\n * 每个回调的返回值作为下一个回调的第一个参数\n */\nexport class AsyncSeriesWaterfallHook<T, A extends any[] = []>\n  extends BaseHook<[T, ...A]>\n  implements IAsyncSeriesWaterfallHook<T, A>\n{\n  async promise(value: T, ...args: A): Promise<T> {\n    if (this.taps.length === 0) return value;\n\n    const startTime = performance.now();\n    this.callCount++;\n\n    try {\n      let current = value;\n      for (const tap of this.taps) {\n        const result = await this.executeTap<T>(tap, [current, ...args] as [T, ...A]);\n        // 只有返回非 undefined 时才更新值\n        if (result !== undefined) {\n          const transform = args[0]?.[WATERFALL_VIEW_TRANSFORM];\n          current = typeof transform === 'function' ? await transform(result,current) : result;\n        }\n      }\n      return current;\n    } finally {\n      this.totalTimeMs += performance.now() - startTime;\n    }\n  }\n}\n\n/**\n * 异步串行映射 Hook\n * 支持 N:M 转换：每个回调处理输入，可以返回 0 到多个输出\n *\n * 执行流程：\n * 1. 初始输入：单个 chunk\n * 2. 每个插件处理当前的所有 chunks，返回新的 chunks 数组\n * 3. 下一个插件处理上一步的所有输出\n *\n * 返回值约定：\n * - null/undefined: 不处理，原样输出当前 chunk\n * - []: 缓冲当前 chunk，不输出（N:0）\n * - [chunk]: 1:1 转换\n * - [chunk1, chunk2, ...]: 1:M 拆分\n *\n * 性能优化：\n * - 同步优先执行：sync tap 直接同步调用，跳过 Promise 开销\n * - 适用于流式响应处理等高频调用场景\n */\nexport class AsyncSeriesMapHook<T, A extends any[] = []>\n  extends BaseHook<[T, ...A]>\n  implements IAsyncSeriesMapHook<T, A>\n{\n  /**\n   * 同步执行单个 tap（跳过 Promise 开销）\n   */\n  private executeTapSync<R>(tap: Tap<[T, ...A], R>, args: [T, ...A]): R | undefined {\n    try {\n      return tap.fn(...args);\n    } catch (error) {\n      logger.error(\n        { error, hookName: this.name, pluginName: tap.info.name },\n        'Error in hook callback'\n      );\n      throw error;\n    }\n  }\n\n  async promise(value: T, ...args: A): Promise<T[]> {\n    // 如果没有注册任何回调，直接返回原始值\n    if (this.taps.length === 0) return [value];\n\n    const startTime = performance.now();\n    this.callCount++;\n\n    try {\n      // 初始输入为单个 chunk\n      let chunks: T[] = [value];\n\n      // 依次应用每个插件的转换\n      for (const tap of this.taps) {\n        const newChunks: T[] = [];\n\n        // 对当前的每个 chunk 应用转换\n        for (const chunk of chunks) {\n          try {\n            // 同步优先执行：sync tap 直接同步调用，跳过 Promise 开销\n            const result = tap.type === 'sync'\n              ? this.executeTapSync<T[] | null | undefined>(tap, [chunk, ...args] as [T, ...A])\n              : await this.executeTap<T[] | null | undefined>(tap, [chunk, ...args] as [T, ...A]);\n\n            if (result === null || result === undefined) {\n              // 不处理，原样输出\n              newChunks.push(chunk);\n            } else if (Array.isArray(result)) {\n              // N:M 转换\n              // [] = 缓冲（不输出）\n              // [item] = 1:1 转换\n              // [item1, item2, ...] = 1:M 拆分\n              newChunks.push(...result);\n            } else {\n              // 非法返回值，警告并原样输出\n              logger.warn(\n                { hookName: this.name, pluginName: tap.info.name, result },\n                'AsyncSeriesMapHook callback must return an array or null'\n              );\n              newChunks.push(chunk);\n            }\n          } catch (error) {\n            // 单个 chunk 处理失败，记录错误并原样输出\n            logger.error(\n              { error, hookName: this.name, pluginName: tap.info.name },\n              'Error in AsyncSeriesMapHook callback'\n            );\n            if ((args[0] as { strict?: boolean } | undefined)?.strict) {\n              throw error;\n            }\n            newChunks.push(chunk);\n          }\n        }\n\n        chunks = newChunks;\n      }\n\n      return chunks;\n    } finally {\n      this.totalTimeMs += performance.now() - startTime;\n    }\n  }\n}\n",
-    "import type { PluginDurableState, DurableJson } from './plugin-durable-state';\n\n/** Anonymous is an explicit, signed data identity; it carries no key authority. */\nexport type DataPrincipal = { readonly domain: string; readonly keyId: string; readonly credentialVersion: number };\nexport const ANONYMOUS_PRINCIPAL: DataPrincipal = Object.freeze({domain: 'anonymous', keyId: '', credentialVersion: 0});\nexport interface AdmissionRequirement { readonly plugin: string; readonly routeIds: readonly string[] }\n/** Public contracts. Business rules belong to the implementing plugin. */\nexport interface ManagementSubject {\n  readonly id: string;\n  readonly provider: string;\n  readonly capabilities: readonly string[];\n  readonly requiresPasswordChange?: boolean;\n}\nexport interface ManagementProvider {\n  authenticate(request: Request): Promise<ManagementSubject | null>;\n  authorize(subject: ManagementSubject, capability: string): Promise<boolean>;\n  login(request: Request): Promise<Response>;\n  logout(request: Request): Promise<Response>;\n  bootstrap(input: unknown): Promise<void>;\n  hasIdentity(): Promise<boolean>;\n  revokeSessions(): Promise<void>;\n  validateWrite?(request: Request): void;\n  csrfToken?(request: Request): string | undefined;\n  /** Optional browser cookie renewal after successful session verification. Must not extend the server-side absolute deadline. */\n  sessionCookie?(request: Request): Promise<string | undefined>;\n}\nexport interface AdmissionTarget {\n  /** Host-pinned entry scope for one internal handoff. */\n  readonly entryRouteId?: string;\n  readonly requestId: string;\n  readonly attemptId: string;\n  readonly principal: DataPrincipal;\n  readonly routeId: string;\n  readonly serviceId: string | null;\n  readonly upstreamId: string;\n  readonly url: string;\n  readonly model: string | null;\n  readonly now: number;\n}\nexport interface AdmissionDenial {\n  readonly error: string;\n  readonly status: 401 | 403 | 429 | 503 | 422;\n  readonly retryAfter?: number;\n}\nexport interface AdmissionPlan {\n  /** A complete JSON state replacement, staged by Host before the common decision. */\n  readonly state?: DurableJson;\n  /** Immutable policy snapshot retained by the grant for subsequent attempts. */\n  readonly snapshot?: DurableJson;\n  readonly denial?: AdmissionDenial;\n}\nexport interface IngressPlugin {\n  /** Effective policy demand; no policy means no content decoding. */\n  bodyRequirements(target: AdmissionTarget, policy: DurableJson): { readonly request: 'none' | 'json-read' };\n  /** Optional per-principal state. Policies are frozen; plans receive only this key's clones.\n   * Expiry must mean absence is behaviorally equivalent to retaining the state. */\n  keyedState?: {\n    readonly capacity: number;\n    policyForKey(policy: DurableJson, keyId: string): DurableJson;\n    expiresAt(state: DurableJson): number;\n    reconcile(state: DurableJson, policy: DurableJson, now: number): DurableJson;\n  };\n  authenticate?(request: Request, policy: DurableJson, now: number): DataPrincipal | null;\n  resolveIdentity?(target: AdmissionTarget, policy: DurableJson): DataPrincipal;\n  /** Pure access decision before preparation/cache reuse; never plans or debits state. */\n  authorize?(target: AdmissionTarget, policy: DurableJson): AdmissionDenial | null;\n  plan(target: AdmissionTarget, policy: DurableJson, state: DurableJson): AdmissionPlan;\n  beforeAttempt?(target: AdmissionTarget, snapshot: DurableJson): AdmissionDenial | null;\n}\nexport interface IngressPluginModule { createIngress(): IngressPlugin }\nexport interface PluginStateRpcContext {\n  readonly state: PluginDurableState;\n  readonly requestId: string;\n  readonly attemptId: string;\n  readonly principal: DataPrincipal;\n}\nexport interface PluginPolicyPublication {\n  readonly version: number;\n  readonly value: DurableJson;\n}\n",
+    "import type { PluginDurableState, DurableJson } from './plugin-durable-state';\n\n/** Anonymous is an explicit, signed data identity; it carries no key authority. */\nexport type DataPrincipal = { readonly domain: string; readonly keyId: string; readonly credentialVersion: number };\nexport const ANONYMOUS_PRINCIPAL: DataPrincipal = Object.freeze({domain: 'anonymous', keyId: '', credentialVersion: 0});\nexport interface AdmissionRequirement { readonly plugin: string; readonly routeIds: readonly string[] }\n/** Public contracts. Business rules belong to the implementing plugin. */\nexport interface ManagementSubject {\n  readonly id: string;\n  readonly provider: string;\n  readonly capabilities: readonly string[];\n  readonly requiresPasswordChange?: boolean;\n}\nexport interface ManagementProvider {\n  setupStatus(): Promise<'uninitialized' | 'ready'>;\n  initialize(request: Request): Promise<Response>;\n  authenticate(request: Request): Promise<ManagementSubject | null>;\n  authorize(subject: ManagementSubject, capability: string): Promise<boolean>;\n  login(request: Request): Promise<Response>;\n  /** Public login interactions are dispatched only to the selected provider. */\n  loginOptions?(request: Request): Promise<Response>;\n  beginLogin?(request: Request): Promise<Response>;\n  completeLogin?(request: Request): Promise<Response>;\n  logout(request: Request): Promise<Response>;\n  bootstrap(input: unknown): Promise<void>;\n  hasIdentity(): Promise<boolean>;\n  revokeSessions(): Promise<void>;\n  validateWrite?(request: Request): void;\n  csrfToken?(request: Request): string | undefined;\n  /** Optional browser cookie renewal after successful session verification. Must not extend the server-side absolute deadline. */\n  sessionCookie?(request: Request): Promise<string | undefined>;\n}\nexport interface AdmissionTarget {\n  /** Host-pinned entry scope for one internal handoff. */\n  readonly entryRouteId?: string;\n  readonly requestId: string;\n  readonly attemptId: string;\n  readonly principal: DataPrincipal;\n  readonly routeId: string;\n  readonly serviceId: string | null;\n  readonly upstreamId: string;\n  readonly url: string;\n  readonly model: string | null;\n  readonly now: number;\n}\nexport interface AdmissionDenial {\n  readonly error: string;\n  readonly status: 401 | 403 | 429 | 503 | 422;\n  readonly retryAfter?: number;\n}\nexport interface AdmissionPlan {\n  /** A complete JSON state replacement, staged by Host before the common decision. */\n  readonly state?: DurableJson;\n  /** Immutable policy snapshot retained by the grant for subsequent attempts. */\n  readonly snapshot?: DurableJson;\n  readonly denial?: AdmissionDenial;\n}\nexport interface IngressPlugin {\n  /** Effective policy demand; no policy means no content decoding. */\n  bodyRequirements(target: AdmissionTarget, policy: DurableJson): { readonly request: 'none' | 'json-read' };\n  /** Optional per-principal state. Policies are frozen; plans receive only this key's clones.\n   * Expiry must mean absence is behaviorally equivalent to retaining the state. */\n  keyedState?: {\n    readonly capacity: number;\n    policyForKey(policy: DurableJson, keyId: string): DurableJson;\n    expiresAt(state: DurableJson): number;\n    reconcile(state: DurableJson, policy: DurableJson, now: number): DurableJson;\n  };\n  authenticate?(request: Request, policy: DurableJson, now: number): DataPrincipal | null;\n  resolveIdentity?(target: AdmissionTarget, policy: DurableJson): DataPrincipal;\n  /** Pure access decision before preparation/cache reuse; never plans or debits state. */\n  authorize?(target: AdmissionTarget, policy: DurableJson): AdmissionDenial | null;\n  plan(target: AdmissionTarget, policy: DurableJson, state: DurableJson): AdmissionPlan;\n  beforeAttempt?(target: AdmissionTarget, snapshot: DurableJson): AdmissionDenial | null;\n}\nexport interface IngressPluginModule { createIngress(): IngressPlugin }\nexport interface PluginStateRpcContext {\n  readonly state: PluginDurableState;\n  readonly requestId: string;\n  readonly attemptId: string;\n  readonly principal: DataPrincipal;\n}\nexport interface PluginPolicyPublication {\n  readonly version: number;\n  readonly value: DurableJson;\n}\n",
     "import type { Database } from 'bun:sqlite';\n\n/** Plugin state initialization owns this DDL; constructors never modify schema. */\nexport const PLUGIN_DURABLE_STATE_SCHEMA_SQL = `\nCREATE TABLE IF NOT EXISTS plugin_durable_records (\n  namespace TEXT NOT NULL, key TEXT NOT NULL, version INTEGER NOT NULL CHECK(version > 0),\n  value_json TEXT NOT NULL, PRIMARY KEY(namespace, key)\n) STRICT;\n`;\nexport type DurableJson = null | boolean | number | string | DurableJson[] | { [key: string]: DurableJson };\nexport interface DurableRecord { readonly key: string; readonly version: number; readonly value: DurableJson }\nexport interface DurableMutation { key: string; expectedVersion: number; value: DurableJson }\n/** Pure data outbox request; callbacks and command identifiers are never accepted. */\nexport interface DurableTransactionOptions {\n  readonly outbox: { readonly topic: string; readonly major: number;\n    readonly maxEvents: number; readonly payload: Uint8Array };\n}\nexport interface PluginDurableState {\n  get(key: string): Promise<DurableRecord | null>;\n  list(): Promise<readonly DurableRecord[]>;\n  transact(mutations: readonly DurableMutation[], options?: DurableTransactionOptions): Promise<readonly DurableRecord[]>;\n}\n/** Synchronous leaf, usable only by storage workers and offline tooling. */\nexport interface StorageDurableState {\n  get(key: string): DurableRecord | null;\n  list(): readonly DurableRecord[];\n  transact(mutations: readonly DurableMutation[], extend?: () => void): readonly DurableRecord[];\n}\nexport class DurableStateConflictError extends Error {\n  readonly code = 'durable_state_conflict';\n  constructor() { super('Durable state version conflict'); this.name = 'DurableStateConflictError'; }\n}\n/** Plugins load as independent bundles, so the host's error has a different constructor. */\nexport function isDurableStateConflictError(error: unknown): error is DurableStateConflictError {\n  return error instanceof Error && 'code' in error && error.code === 'durable_state_conflict';\n}\nconst MAX_BYTES = 1024 * 1024;\nfunction identifier(value: unknown): asserts value is string {\n  if (typeof value !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,127}$/.test(value)) throw new Error('Invalid durable state identifier');\n}\n/** Reject objects with behavior, lossy JSON values and cycles before JSON.stringify. */\nfunction encode(value: unknown): string {\n  const ancestors = new Set<object>();\n  function check(current: unknown, depth: number): void {\n    if (depth > 64) throw new Error('Durable state nesting limit exceeded');\n    if (current === null || typeof current === 'string' || typeof current === 'boolean') return;\n    if (typeof current === 'number' && Number.isFinite(current)) return;\n    if (typeof current !== 'object' || current === null || ancestors.has(current)) throw new Error('Durable state must be pure JSON');\n    const array = Array.isArray(current);\n    if (!array && Object.getPrototypeOf(current) !== Object.prototype && Object.getPrototypeOf(current) !== null) throw new Error('Durable state must be pure JSON');\n    ancestors.add(current);\n    const descriptors = Object.getOwnPropertyDescriptors(current);\n    if (Reflect.ownKeys(current).some(key => typeof key === 'symbol')) throw new Error('Durable state must be pure JSON');\n    if (array) {\n      const length = (current as unknown[]).length;\n      const indices = Object.keys(descriptors).filter(key => key !== 'length');\n      if (indices.length !== length || indices.some((key, index) => key !== String(index))) throw new Error('Durable state must be pure JSON');\n    }\n    for (const [key, descriptor] of Object.entries(descriptors)) {\n      if (array && key === 'length') continue;\n      if (!descriptor.enumerable || !('value' in descriptor)) throw new Error('Durable state must be pure JSON');\n      check(descriptor.value, depth + 1);\n    }\n    ancestors.delete(current);\n  }\n  check(value, 0);\n  const json = JSON.stringify(value);\n  if (Buffer.byteLength(json) > MAX_BYTES) throw new Error('Durable state size limit exceeded');\n  return json;\n}\n/** Validate data before IPC structured cloning can erase prototypes or evaluate getters. */\nexport function validateDurableJson(value: unknown): void { encode(value); }\ntype Row = { key: string; version: number; value_json: string };\nfunction record(row: Row): DurableRecord {\n  return Object.freeze({ key: row.key, version: row.version, value: JSON.parse(row.value_json) as DurableJson });\n}\n\n/** Host-only factory. Inject only the returned namespace capability into trusted plugins.\n * Consumers validate their own record schema. expectedVersion=0 requires absence.\n * Null values are retained records, so versions never reset.\n */\nexport class PluginDurableStateStore {\n  constructor(private readonly db: Database) {}\n  /**\n   * Host-only: the shared database this store's records live in, so a host-owned\n   * durable journal can run its own atomic planner/reader against exactly the\n   * same `plugin_durable_records` rows the plugin sees. Never exposed through\n   * `PluginServices` and never handed to a plugin.\n   */\n  get database(): Database { return this.db; }\n  /** Async SDK shape for offline tools and leaf fixtures; production uses PluginStateClient. */\n  forNamespace(namespace: string): PluginDurableState {\n    const leaf = this.forStorageNamespace(namespace);\n    return Object.freeze({get: async (key: string) => leaf.get(key), list: async () => leaf.list(),\n      transact: async (mutations: readonly DurableMutation[], options?: DurableTransactionOptions) => {\n        if (options !== undefined) throw new Error('Outbox requires the storage worker');\n        return leaf.transact(mutations);\n      }});\n  }\n  forStorageNamespace(namespace: string): StorageDurableState {\n    identifier(namespace);\n    const db = this.db;\n    const get = (key: string): DurableRecord | null => {\n      identifier(key);\n      const row = db.query<Row, [string, string]>('SELECT key,version,value_json FROM plugin_durable_records WHERE namespace = ? AND key = ?').get(namespace, key);\n      return row ? record(row) : null;\n    };\n    return Object.freeze({\n      get,\n      list: () => Object.freeze(db.query<Row, [string]>('SELECT key,version,value_json FROM plugin_durable_records WHERE namespace = ? ORDER BY key').all(namespace).map(record)),\n      transact: (input: readonly DurableMutation[], extend?: () => void): readonly DurableRecord[] => {\n        if (!Array.isArray(input) || input.length === 0 || input.length > 256) throw new Error('Invalid durable state command');\n        const keys = new Set<string>();\n        const mutations = input.map(mutation => {\n          identifier(mutation.key);\n          if (keys.has(mutation.key) || !Number.isSafeInteger(mutation.expectedVersion) || mutation.expectedVersion < 0 || mutation.expectedVersion >= Number.MAX_SAFE_INTEGER) throw new Error('Invalid durable state mutation');\n          keys.add(mutation.key);\n          return { key: mutation.key, expectedVersion: mutation.expectedVersion, json: encode(mutation.value) };\n        });\n        const commandJson = JSON.stringify(mutations);\n        if (Buffer.byteLength(commandJson) > MAX_BYTES) throw new Error('Durable state command size limit exceeded');\n        return db.transaction(() => {\n          const results: DurableRecord[] = [];\n          for (const mutation of mutations) {\n            const current = get(mutation.key);\n            if ((current?.version ?? 0) !== mutation.expectedVersion) throw new DurableStateConflictError();\n            const version = mutation.expectedVersion + 1;\n            db.query(`INSERT INTO plugin_durable_records(namespace,key,version,value_json) VALUES (?,?,?,?)\n              ON CONFLICT(namespace,key) DO UPDATE SET version=excluded.version,value_json=excluded.value_json`).run(namespace, mutation.key, version, mutation.json);\n            results.push(record({ key: mutation.key, version, value_json: mutation.json }));\n          }\n          extend?.();\n          return Object.freeze(results);\n        }).immediate();\n      },\n    });\n  }\n}\n",
     "import { logger } from '../logger';\nimport type { AtomicReadSetResolver } from '../plugin-state/client';\n/**\n * Same-process host RPC adapter (P4): lets the canonical `PluginServiceHost`\n * lifecycle own RPC publications/consumption without a second plugin framework\n * and without faking a wire transport.\n *\n * The parent injects the trusted owner token, endpoint identity, required\n * placement/callee/journal callbacks, and the real host lease callback. Real\n * cross-process transport is NOT implemented: the required placement resolver\n * returns an exact endpoint registered in the exposed runtime, `ambiguous`, or\n * `null` meaning \"use the explicit local channel\". Commands run only through the\n * accepted runtime kernel. Journal-backed policies require `CommandJournal`;\n * application-owned `none` commands may execute without a journal and expose no\n * journal result/reconciliation capability. Caller identity, purpose, scope,\n * leases, and deadlines are host decisions; plugin call options may only carry\n * `signal`/`timeoutMs`/`operationId`, snapshotted without invoking accessors.\n *\n * Command binding errors are mapped once by the kernel to its fixed-code\n * `RpcInvocationError` (own `code`, no cause/message/raw operation id); the\n * client rebuilds a fresh public `RpcServiceError` from that code and the\n * validated operation id of the current call. No error instance is reused.\n */\nimport { assertSupportedServiceDeclarations, isCrossProcessSelfService } from './contracts';\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { isProxy } from 'node:util/types';\nimport type {\n  PluginServiceConsumption,\n  PluginServiceDeclarations,\n  PluginServiceProcess,\n  PluginServicePublication,\n  PluginServiceScope,\n} from './contracts';\nimport {\n  RpcServiceRuntime,\n  type RpcAdmissionGrant,\n  type RpcAdmissionRequest,\n  type RpcCaller,\n  type RpcCommandAction,\n  type RpcCommandExecution,\n  type RpcCommandExecutor,\n  type RpcDrainResult,\n  type RpcEndpointBinding,\n  type RpcEndpointHandle,\n  type RpcHandlerContext,\n  type RpcHandlerMap,\n  type RpcInvocationErrorCode,\n  type RpcInvokeRequest,\n  type RpcRuntimeLimits,\n  type RpcRuntimeStatus,\n} from './rpc-runtime';\nimport {\n  type CommandAtomicPlanner,\n  type CommandExternalExecutor,\n  type CommandJournal,\n} from './command-journal';\nimport type { AsyncCommandJournal } from '../plugin-state/client';\nimport {\n  defineRpcService,\n  assertRpcData,\n  encodeRpcJson,\n  decodeRpcJson,\n  RPC_JSON_MAX_BYTES,\n  type RpcCallPurpose,\n  type InferRpcData,\n  type RpcCommandPolicy,\n  type RpcJson,\n  type RpcMethodDefinition,\n} from './wire-contract';\n\n/* -------------------------------------------------------------------------- */\n/* Fixed-code public errors                                                    */\n/* -------------------------------------------------------------------------- */\n\nexport type RpcServiceErrorCode =\n  | RpcInvocationErrorCode\n  | 'undeclared'\n  | 'unavailable'\n  | 'ambiguous_placement'\n  | 'invalid_registration';\n\nconst SERVICE_ERROR_MESSAGES: Record<RpcServiceErrorCode, string> = {\n  unauthorized: 'RPC call is not authorized',\n  not_ready: 'RPC endpoint is not ready',\n  retired: 'RPC endpoint is retiring',\n  revoked: 'RPC endpoint generation was revoked',\n  unsupported_method: 'RPC method is not published',\n  wrong_purpose: 'RPC method is not published for this purpose',\n  invalid_input: 'RPC input is not valid',\n  invalid_output: 'RPC output is not valid',\n  invalid_operation_id: 'RPC command operation id is invalid',\n  overloaded: 'RPC runtime is at capacity',\n  cancelled: 'RPC call was cancelled',\n  timeout: 'RPC call deadline exceeded',\n  unknown: 'RPC command outcome is unknown',\n  capability_unavailable: 'RPC command execution is unavailable',\n  closed: 'RPC runtime is closed',\n  failed: 'RPC call failed',\n  conflict: 'RPC command identity conflicts with an existing record',\n  expired: 'RPC command result has expired',\n  pending: 'RPC command is still pending',\n  rejected: 'RPC command was rejected',\n  missing: 'RPC command has no stored result',\n  storage_failure: 'RPC command storage failed',\n  deadlock: 'RPC call chain would deadlock',\n  call_depth_exceeded: 'RPC call depth exceeded',\n  undeclared: 'RPC service is not declared by the manifest',\n  unavailable: 'RPC service is unavailable',\n  ambiguous_placement: 'RPC service placement is ambiguous',\n  invalid_registration: 'RPC registration is invalid',\n};\n\nconst SERVICE_ERROR_CODES = new Set<RpcServiceErrorCode>(Object.keys(SERVICE_ERROR_MESSAGES) as RpcServiceErrorCode[]);\n\n/** Fixed-code error. It never carries a provider cause, message, or payload. */\nexport class RpcServiceError extends Error {\n  readonly name = 'RpcServiceError';\n  readonly code: RpcServiceErrorCode;\n  readonly operationId: string | null;\n\n  constructor(code: RpcServiceErrorCode, operationId: string | null = null) {\n    super(SERVICE_ERROR_MESSAGES[code]);\n    this.code = code;\n    this.operationId = operationId;\n  }\n}\n\nfunction ownStringProperty(target: unknown, name: string): string | null {\n  if (target === null || (typeof target !== 'object' && typeof target !== 'function')) return null;\n  let descriptor: PropertyDescriptor | undefined;\n  try { descriptor = Object.getOwnPropertyDescriptor(target, name); } catch { return null; }\n  if (descriptor === undefined || !('value' in descriptor) || typeof descriptor.value !== 'string') return null;\n  return descriptor.value;\n}\n\n/**\n * Rebuilds a fresh public error from the kernel's fixed code and the validated\n * operation id of THIS call. It never reuses the incoming instance, never reads\n * its operation id, and never reads a cause or message.\n */\nexport function toRpcServiceError(error: unknown, operationId: string | null): RpcServiceError {\n  const raw = ownStringProperty(error, 'code');\n  const code = raw !== null && SERVICE_ERROR_CODES.has(raw as RpcServiceErrorCode)\n    ? raw as RpcServiceErrorCode\n    : 'failed';\n  return new RpcServiceError(code, operationId);\n}\n\n/* -------------------------------------------------------------------------- */\n/* Public types                                                                */\n/* -------------------------------------------------------------------------- */\n\nexport interface RpcCallOptions {\n  readonly signal?: AbortSignal;\n  readonly timeoutMs?: number;\n  readonly operationId?: string;\n}\n\nexport type RpcCommandClientExtras<D extends RpcMethodDefinition> = D extends { readonly command: RpcCommandPolicy }\n  ? {\n      /** Durable committed result query; runs through the same runtime lease/deadline as execute. */\n      queryResult(operationId: string): Promise<InferRpcData<D['output']>>;\n      /** Explicit host-authorized reconciliation for an unknown command outcome. */\n      reconcile(operationId: string, input: InferRpcData<D['input']>): Promise<InferRpcData<D['output']>>;\n    }\n  : Record<never, never>;\n\nexport type RpcMethodClient<D extends RpcMethodDefinition> =\n  ((input: InferRpcData<D['input']>, options?: RpcCallOptions) => Promise<InferRpcData<D['output']>>)\n  & RpcCommandClientExtras<D>;\n\n/** Public plugin-facing RPC client derived from a literal contract. */\nexport type AsyncRpcClient<M extends Record<string, RpcMethodDefinition>> = {\n  readonly [K in keyof M]: RpcMethodClient<M[K]>;\n};\n\n/** Logical placement identity, independent of any physical address or generation. */\nexport interface HostRpcServiceDescriptor {\n  readonly provider: string;\n  readonly service: string;\n  readonly major: number;\n  readonly kind: 'rpc';\n  readonly process: PluginServiceProcess;\n  readonly scope: PluginServiceScope;\n}\n\n/** Physical endpoint identity supplied by the trusted host for one owner instance. */\nexport interface HostRpcLifecycleIdentity {\n  readonly endpoint: string;\n  readonly instance: string;\n  readonly generation: number;\n  readonly catalog: string;\n  /** Trusted callee subject; never derived from plugin input. */\n  readonly subject: string;\n}\n\n/** Canonical owner lifecycle view; the adapter never keeps a second copy. */\nexport interface HostRpcLifecycleState {\n  readonly ready: boolean;\n  readonly retiring: boolean;\n  readonly revoked: boolean;\n}\n\n/** Host-minted invocation frame; the real principal lives in the host callee frame. */\nexport interface HostRpcInvocationContext {\n  readonly purpose: RpcCallPurpose;\n  /** Opaque host correlation token; the leaf only trusts the required resolver. */\n  readonly token: object;\n  readonly signal?: AbortSignal;\n  readonly deadlineAt?: number;\n}\n\nexport interface HostRpcLeaseRequest {\n  readonly role: 'caller' | 'callee';\n  readonly plugin: string;\n  readonly scope: string;\n  readonly state: HostRpcLifecycleState;\n  readonly purpose: RpcCallPurpose;\n  readonly operationId: string | null;\n  /** Logical target provider. */\n  readonly provider: string;\n}\n\nexport interface HostRpcLeaseGrant {\n  readonly release: () => void;\n  /** Host-verified existing request lease; only honored for request/attempt. */\n  readonly allowRetired?: boolean;\n}\n\nexport type HostRpcAcquireLease = (request: HostRpcLeaseRequest) => HostRpcLeaseGrant;\n\nexport interface HostRpcMethodCapability {\n  /** Synchronous private-state CAS planner for a `local-transaction` command. */\n  readonly atomic?: CommandAtomicPlanner;\n  /** Explicit bounded read set for the production storage Worker. */\n  readonly atomicReadSet?: AtomicReadSetResolver;\n  /** Reconcile capability for an `external-contract` command. */\n  readonly external?: CommandExternalExecutor;\n}\n\nexport type HostRpcCommandCapabilities<M extends Record<string, RpcMethodDefinition>> = {\n  readonly [K in keyof M]?: HostRpcMethodCapability;\n};\n\n/** Everything the canonical host exposes for one owner to use RPC services. */\nexport interface HostRpcOwnerInput {\n  readonly token: object;\n  readonly plugin: string;\n  /** Canonical owner scope: `'global'` or a trusted binding scope key. */\n  readonly scope: string;\n  readonly declarations: PluginServiceDeclarations;\n  readonly dependencies: Readonly<Record<string, string>>;\n  readonly lifecycle: HostRpcLifecycleIdentity;\n  /** Canonical lifecycle source of truth; the adapter copies nothing. */\n  readonly getLifecycleState: () => HostRpcLifecycleState;\n  readonly acquireLease: HostRpcAcquireLease;\n  readonly registerPublication?: (publication: PluginServicePublication) => void;\n  readonly registerConsumption?: (consumption: PluginServiceConsumption, localProviderToken?: object) => void;\n  readonly onDispose?: (cleanup: () => void) => void;\n  readonly canCall?: (target: { readonly provider: string; readonly service: string; readonly major: number; readonly method: string }) => boolean;\n  /** Required host invocation-frame resolver; null for plain plugin background calls. */\n  readonly resolveInvocationContext: () => HostRpcInvocationContext | null;\n}\n\n/** Trusted peer broker input. This capability is never part of PluginServices. */\nexport interface HostRpcRemoteCallerInput extends HostRpcOwnerInput {\n  readonly process: PluginServiceProcess;\n  /** Must verify the current authenticated peer frame and logical caller authority. */\n  readonly authorizeIncoming: (request: RpcAdmissionRequest, endpoint: NonNullable<ReturnType<RpcServiceRuntime['endpointInfo']>>) => boolean;\n}\n\nexport interface HostRpcRemoteCallerHandle {\n  invokeTracked(request: Omit<RpcInvokeRequest, 'caller' | 'callerToken'>): ReturnType<RpcServiceRuntime['invokeTracked']>;\n  dispose(): Promise<RpcDrainResult>;\n}\n\n/** Exact placement delegated to the host. `null` means \"use the explicit local channel\". */\nexport type HostRpcPlacementResolution =\n  | { readonly kind: 'endpoint'; readonly endpoint: RpcEndpointHandle }\n  | { readonly kind: 'ambiguous' }\n  | null\n  | undefined;\n\nexport interface HostRpcPlacementRequest {\n  readonly provider: string;\n  readonly service: string;\n  readonly major: number;\n  readonly method: string;\n  readonly scope: PluginServiceScope;\n  readonly bindingScope?: string;\n  readonly caller: RpcCaller;\n  readonly purpose?: RpcCallPurpose;\n}\n\nexport type HostRpcPlacementResolver = (request: HostRpcPlacementRequest) => HostRpcPlacementResolution;\n\nexport interface HostRpcJournalRequest {\n  readonly provider: string;\n  readonly service: string;\n  readonly major: number;\n  readonly method: string;\n  readonly scope: PluginServiceScope;\n  /** Binding scope key when `scope` is `binding`; keeps two bindings apart. */\n  readonly bindingScope?: string;\n  readonly policy: RpcCommandPolicy;\n  readonly atomic?: CommandAtomicPlanner;\n  /** Explicit bounded read set for the production storage Worker. */\n  readonly atomicReadSet?: AtomicReadSetResolver;\n  readonly external?: CommandExternalExecutor;\n}\n\n/** Host-owned durable journal factory; `null` refuses commands for this key. */\nexport type HostRpcJournalResolver = (request: HostRpcJournalRequest) => AsyncCommandJournal | CommandJournal | null;\n\n/** Trusted opaque callee context resolver. */\nexport type HostRpcCalleeResolver = (request: RpcAdmissionRequest, publication: HostRpcServiceDescriptor) => unknown;\n\n/**\n * Host-provided frame for one admitted native RPC handler. It lets the SAME\n * `PluginServiceHost` invocation store the real purpose/deadline/cancellation\n * for the duration of the handler, bound to the exact published owner, so a\n * channel operation started inside a native handler is authorized by the real\n * frame (never downgraded to `background`, never given a forged purpose).\n */\nexport interface HostRpcHandlerFrame {\n  readonly purpose: RpcCallPurpose;\n  readonly deadlineAt?: number;\n  readonly signal?: AbortSignal;\n  /** Exact published owner the call targets; `null` for a remote (peer) route. */\n  readonly ownerToken: object | null;\n  readonly operationId: string | null;\n}\n\nexport interface HostRpcJournalCleanupFailure {\n  readonly operationId: string;\n  readonly code: string;\n}\nexport interface HostRpcAdapterOptions {\n  /** Resource cleanup reports separately and never replaces a business outcome. */\n  readonly onJournalCleanupFailure?: (failure:HostRpcJournalCleanupFailure)=>void;\n  readonly process: PluginServiceProcess;\n  readonly limits?: RpcRuntimeLimits;\n  readonly hostLifetime?: AbortSignal;\n  readonly maxCallDepth?: number;\n  /** Required host placement authority. */\n  readonly resolvePlacement: HostRpcPlacementResolver;\n  /** Required host journal authority. */\n  readonly resolveJournal: HostRpcJournalResolver;\n  /** Required trusted opaque callee frame authority. */\n  readonly resolveCallee: HostRpcCalleeResolver;\n  /**\n   * Host callback that enters the exact published owner's trusted invocation\n   * frame for one native handler call. The canonical `PluginServiceHost` wires\n   * it to its OWN invocation store, so a native RPC handler shares one\n   * purpose/deadline/cancel resolver with local dispatch and channel work.\n   */\n  readonly enterHostHandlerFrame?: (frame: HostRpcHandlerFrame, run: () => unknown) => unknown;\n}\n\nexport interface HostRpcPublication {\n  readonly descriptor: HostRpcServiceDescriptor;\n}\n\n/** Host-only readonly directory entry for one real registered publication. */\nexport interface HostRpcPublicationView {\n  readonly provider: string;\n  readonly service: string;\n  readonly major: number;\n  readonly scope: PluginServiceScope;\n  readonly scopeKey: string;\n  readonly ready: boolean;\n  readonly lifecycle: HostRpcLifecycleIdentity;\n  /** The kernel-selected binding of the exact endpoint handle; never re-derived. */\n  readonly binding: RpcEndpointBinding;\n}\n\nexport interface HostRpcOwnerHandle {\n  readonly owner: HostRpcOwnerInput;\n  publish<const M extends Record<string, RpcMethodDefinition>>(\n    contract: { readonly id: string; readonly version: number; readonly methods: M },\n    handlers: RpcHandlerMap<M, unknown>,\n    capabilities?: HostRpcCommandCapabilities<M>,\n  ): HostRpcPublication;\n  consume<const M extends Record<string, RpcMethodDefinition>>(\n    provider: string,\n    contract: { readonly id: string; readonly version: number; readonly methods: M },\n  ): AsyncRpcClient<M>;\n  /** Canonical host hook: ready maps to kernel `markReady`. */\n  markReady(): void;\n  /** Canonical host hook: retirement maps to kernel `retire`. */\n  retire(): void;\n  /**\n   * Canonical host hook: disposal maps to kernel `revoke` + bounded `drain`.\n   * Returns the REAL drain verdict; `drained: false` is reported, never hidden.\n   */\n  dispose(): Promise<RpcDrainResult>;\n}\n\n/* -------------------------------------------------------------------------- */\n/* Internal helpers                                                            */\n/* -------------------------------------------------------------------------- */\n\nconst SEP = '\\0';\nconst DEFAULT_MAX_CALL_DEPTH = 32;\nconst CALL_OPTION_KEYS = ['signal', 'timeoutMs', 'operationId'] as const;\nconst EMPTY_OPTIONS: RpcCallOptions = Object.freeze({});\n\ninterface ActiveFrame {\n  readonly purpose: RpcCallPurpose;\n  readonly depth: number;\n  readonly chain: readonly string[];\n  readonly deadlineAt: number;\n  readonly signal: AbortSignal;\n}\n\n/** Host frame inheritance only: purpose, call chain, deadline, and cancellation. */\nconst FRAME_STORE = new AsyncLocalStorage<ActiveFrame>();\n\ninterface RegisteredPublication {\n  readonly key: string;\n  readonly handle: RpcEndpointHandle;\n  readonly provider: string;\n  readonly scopeKey: string;\n  readonly scope: PluginServiceScope;\n  readonly contractId: string;\n  readonly contractVersion: number;\n  readonly ownerState: OwnerState;\n}\n\ninterface OwnerState {\n  readonly owner: HostRpcOwnerInput;\n  readonly plugin: string;\n  readonly scope: string;\n  readonly scopeKind: PluginServiceScope;\n  readonly callerSubject: string;\n  readonly lifecycle: HostRpcLifecycleIdentity;\n  readonly publications: Set<RegisteredPublication>;\n  readonly process: PluginServiceProcess;\n  readonly local: boolean;\n  readonly authorizeIncoming?: HostRpcRemoteCallerInput['authorizeIncoming'];\n  /** RPC capability revocation, independent of eventual resource reclamation. */\n  revoked: boolean;\n  released: boolean;\n}\n\ninterface CalleeInfo {\n  readonly provider: string;\n  readonly scopeKey: string;\n  readonly scope: PluginServiceScope;\n  readonly frame: unknown;\n  /** Exact published owner token, or `null` for a remote (peer) route. */\n  readonly ownerToken: object | null;\n}\n\ntype Handler = (input: unknown, context: RpcHandlerContext<unknown>) => unknown;\n\ntype RouteResolution =\n  | { readonly kind: 'publication'; readonly publication: RegisteredPublication }\n  | { readonly kind: 'remote'; readonly handle: RpcEndpointHandle }\n  | { readonly kind: 'ambiguous' }\n  | { readonly kind: 'missing' };\n\nconst CALLEE_INFO = new WeakMap<object, CalleeInfo>();\n\n/** Reads the trusted opaque callee frame the host resolver produced for an admitted call. */\nexport function readHostRpcCalleeFrame(callee: unknown): unknown {\n  if (callee === null || typeof callee !== 'object') return null;\n  return CALLEE_INFO.get(callee as object)?.frame ?? null;\n}\n\nfunction publicationKey(provider: string, scopeKey: string, service: string, major: number): string {\n  return `${provider}${SEP}${scopeKey}${SEP}${service}${SEP}${major}`;\n}\n\nfunction scopeKindOf(scope: string): PluginServiceScope {\n  return scope === 'global' ? 'global' : 'binding';\n}\n\nfunction callerSubjectFor(plugin: string, scope: string): string {\n  return scope === 'global' ? plugin : `${plugin}@${scope}`;\n}\n\nfunction normalizeOperationId(operationId: unknown): string {\n  if (typeof operationId !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(operationId)) {\n    throw new RpcServiceError('invalid_operation_id');\n  }\n  return operationId;\n}\n\n/** Combines cancellation signals without depending on `AbortSignal.any` being present. */\nfunction anySignal(signals: readonly AbortSignal[]): AbortSignal {\n  if (signals.length === 1) return signals[0];\n  const native = (AbortSignal as unknown as { any?: (values: AbortSignal[]) => AbortSignal }).any;\n  if (typeof native === 'function') return native.call(AbortSignal, [...signals]);\n  const controller = new AbortController();\n  const abort = (): void => controller.abort();\n  for (const signal of signals) {\n    if (signal.aborted) { abort(); break; }\n    signal.addEventListener('abort', abort, { once: true });\n  }\n  return controller.signal;\n}\n\nfunction requirePurpose(definition: RpcMethodDefinition, purpose: RpcCallPurpose): RpcCallPurpose {\n  if (!definition.purposes.includes(purpose)) throw new RpcServiceError('wrong_purpose');\n  return purpose;\n}\n\n/** Own-descriptor snapshot of the trusted lifecycle identity; no accessor ever runs. */\nfunction snapshotLifecycle(value: unknown): HostRpcLifecycleIdentity {\n  if (value === null || typeof value !== 'object' || isProxy(value)) throw new RpcServiceError('invalid_registration');\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== Object.prototype && prototype !== null) throw new RpcServiceError('invalid_registration');\n  const read = (name: string): unknown => {\n    const descriptor = Object.getOwnPropertyDescriptor(value, name);\n    if (descriptor === undefined || !descriptor.enumerable || !('value' in descriptor)) {\n      throw new RpcServiceError('invalid_registration');\n    }\n    return descriptor.value;\n  };\n  const allowed = new Set(['endpoint', 'instance', 'generation', 'catalog', 'subject']);\n  for (const key of Reflect.ownKeys(value)) {\n    if (typeof key !== 'string' || !allowed.has(key)) throw new RpcServiceError('invalid_registration');\n  }\n  const endpoint = read('endpoint');\n  const instance = read('instance');\n  const generation = read('generation');\n  const catalog = read('catalog');\n  const subject = read('subject');\n  if (typeof endpoint !== 'string' || !endpoint || typeof instance !== 'string' || !instance\n    || !Number.isSafeInteger(generation) || (generation as number) < 1\n    || typeof catalog !== 'string' || typeof subject !== 'string' || !subject) {\n    throw new RpcServiceError('invalid_registration');\n  }\n  return Object.freeze({ endpoint, instance, generation: generation as number, catalog, subject });\n}\n\n/** Own-descriptor snapshot of a dependencies record; accessors are rejected, never invoked. */\nfunction snapshotDependencies(value: unknown): Readonly<Record<string, string>> {\n  if (value === undefined) return Object.freeze({});\n  if (value === null || typeof value !== 'object' || isProxy(value)) throw new RpcServiceError('invalid_registration');\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== Object.prototype && prototype !== null) throw new RpcServiceError('invalid_registration');\n  const result: Record<string, string> = {};\n  for (const key of Reflect.ownKeys(value)) {\n    if (typeof key !== 'string') throw new RpcServiceError('invalid_registration');\n    const descriptor = Object.getOwnPropertyDescriptor(value, key);\n    if (descriptor === undefined || !descriptor.enumerable || !('value' in descriptor) || typeof descriptor.value !== 'string') {\n      throw new RpcServiceError('invalid_registration');\n    }\n    result[key] = descriptor.value;\n  }\n  return Object.freeze(result);\n}\n\n/**\n * Copies own enumerable data-function properties only. Accessors, proxies,\n * prototype methods, symbol keys, and unknown keys are rejected before any value\n * is read, so no plugin getter ever runs.\n */\nfunction snapshotHandlers(methods: Record<string, RpcMethodDefinition>, handler: unknown): Map<string, Handler> {\n  if (handler === null || typeof handler !== 'object' || isProxy(handler)) throw new RpcServiceError('invalid_registration');\n  const prototype = Object.getPrototypeOf(handler);\n  if (prototype !== Object.prototype && prototype !== null) throw new RpcServiceError('invalid_registration');\n  const allowed = new Set(Object.keys(methods));\n  const collected = new Map<string, Handler>();\n  for (const key of Reflect.ownKeys(handler)) {\n    if (typeof key !== 'string' || !allowed.has(key)) throw new RpcServiceError('invalid_registration');\n    const descriptor = Object.getOwnPropertyDescriptor(handler, key);\n    if (descriptor === undefined || !descriptor.enumerable || !('value' in descriptor) || typeof descriptor.value !== 'function') {\n      throw new RpcServiceError('invalid_registration');\n    }\n    collected.set(key, descriptor.value as Handler);\n  }\n  for (const name of allowed) if (!collected.has(name)) throw new RpcServiceError('invalid_registration');\n  return collected;\n}\n\n/**\n * Snapshots one command capability through own descriptors only. Proxies, accessors,\n * unknown keys, and non-function planner/reconcile values are rejected before any\n * value is read, so no plugin getter ever runs and no mutable capability object is\n * retained.\n */\nfunction snapshotCapability(value: unknown): HostRpcMethodCapability {\n  if (value === null || typeof value !== 'object' || isProxy(value)) throw new RpcServiceError('invalid_registration');\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== Object.prototype && prototype !== null) throw new RpcServiceError('invalid_registration');\n  let atomic: CommandAtomicPlanner | undefined;\n  let atomicReadSet: AtomicReadSetResolver | undefined;\n  let external: CommandExternalExecutor | undefined;\n  for (const key of Reflect.ownKeys(value)) {\n    if (typeof key !== 'string' || (key !== 'atomic' && key !== 'atomicReadSet' && key !== 'external')) throw new RpcServiceError('invalid_registration');\n    const descriptor = Object.getOwnPropertyDescriptor(value, key);\n    if (descriptor === undefined || !descriptor.enumerable || !('value' in descriptor)) {\n      throw new RpcServiceError('invalid_registration');\n    }\n    if (key === 'atomicReadSet') {\n      if (typeof descriptor.value !== 'function') throw new RpcServiceError('invalid_registration');\n      atomicReadSet = descriptor.value as AtomicReadSetResolver;\n    } else if (key === 'atomic') {\n      if (typeof descriptor.value !== 'function') throw new RpcServiceError('invalid_registration');\n      atomic = descriptor.value as CommandAtomicPlanner;\n    } else {\n      external = snapshotExternal(descriptor.value);\n    }\n  }\n  const record: { atomic?: CommandAtomicPlanner; atomicReadSet?: AtomicReadSetResolver; external?: CommandExternalExecutor } = {};\n  if (atomic !== undefined) record.atomic = atomic;\n  if (atomicReadSet !== undefined) record.atomicReadSet = atomicReadSet;\n  if (external !== undefined) record.external = external;\n  return Object.freeze(record);\n}\n\n/** Snapshots the `external.reconcile` function without retaining the plugin's object. */\nfunction snapshotExternal(value: unknown): CommandExternalExecutor {\n  if (value === null || typeof value !== 'object' || isProxy(value)) throw new RpcServiceError('invalid_registration');\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== Object.prototype && prototype !== null) throw new RpcServiceError('invalid_registration');\n  for (const key of Reflect.ownKeys(value)) {\n    if (key !== 'reconcile') throw new RpcServiceError('invalid_registration');\n  }\n  const descriptor = Object.getOwnPropertyDescriptor(value, 'reconcile');\n  if (descriptor === undefined || !descriptor.enumerable || !('value' in descriptor) || typeof descriptor.value !== 'function') {\n    throw new RpcServiceError('invalid_registration');\n  }\n  return Object.freeze({ reconcile: descriptor.value as CommandExternalExecutor['reconcile'] });\n}\n\n/**\n * Descriptor-safe snapshot of the command capabilities record. Every key must name a\n * declared command method; accessors, proxies, symbol keys, unknown/non-command\n * methods, and unknown capability fields are rejected before `register`, so a failed\n * snapshot can never leave a ghost endpoint. The snapshot is frozen and independent\n * of the plugin's mutable objects.\n */\nfunction snapshotCapabilities(\n  methodTable: Record<string, RpcMethodDefinition>,\n  value: unknown,\n): Readonly<Record<string, HostRpcMethodCapability>> | null {\n  if (value === undefined) return null;\n  if (value === null || typeof value !== 'object' || isProxy(value)) throw new RpcServiceError('invalid_registration');\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== Object.prototype && prototype !== null) throw new RpcServiceError('invalid_registration');\n  const record: Record<string, HostRpcMethodCapability> = {};\n  for (const key of Reflect.ownKeys(value)) {\n    if (typeof key !== 'string' || !Object.hasOwn(methodTable, key)) throw new RpcServiceError('invalid_registration');\n    const definition = methodTable[key];\n    if (definition === undefined || definition.kind !== 'command') throw new RpcServiceError('invalid_registration');\n    const descriptor = Object.getOwnPropertyDescriptor(value, key);\n    if (descriptor === undefined || !descriptor.enumerable || !('value' in descriptor)) {\n      throw new RpcServiceError('invalid_registration');\n    }\n    if (descriptor.value === undefined) continue;\n    record[key] = snapshotCapability(descriptor.value);\n  }\n  return Object.freeze(record);\n}\n\n/** Snapshots plugin call options without invoking accessors or accepting unknown keys. */\nfunction snapshotCallOptions(options: RpcCallOptions | undefined): RpcCallOptions {\n  if (options === undefined) return EMPTY_OPTIONS;\n  if (options === null || typeof options !== 'object' || isProxy(options)) throw new RpcServiceError('invalid_input');\n  const prototype = Object.getPrototypeOf(options);\n  if (prototype !== Object.prototype && prototype !== null) throw new RpcServiceError('invalid_input');\n  const result: { signal?: AbortSignal; timeoutMs?: number; operationId?: string } = {};\n  for (const key of Reflect.ownKeys(options)) {\n    if (typeof key !== 'string' || !(CALL_OPTION_KEYS as readonly string[]).includes(key)) {\n      throw new RpcServiceError('invalid_input');\n    }\n    const descriptor = Object.getOwnPropertyDescriptor(options, key);\n    if (descriptor === undefined || !descriptor.enumerable || !('value' in descriptor)) {\n      throw new RpcServiceError('invalid_input');\n    }\n    (result as Record<string, unknown>)[key] = descriptor.value;\n  }\n  if (result.signal !== undefined && !(result.signal instanceof AbortSignal)) throw new RpcServiceError('invalid_input');\n  if (result.timeoutMs !== undefined\n    && (typeof result.timeoutMs !== 'number' || !Number.isSafeInteger(result.timeoutMs) || result.timeoutMs < 0)) {\n    throw new RpcServiceError('invalid_input');\n  }\n  if (result.operationId !== undefined && typeof result.operationId !== 'string') throw new RpcServiceError('invalid_input');\n  return Object.freeze(result);\n}\n\nfunction defineContract<const M extends Record<string, RpcMethodDefinition>>(\n  contract: { readonly id: string; readonly version: number; readonly methods: M },\n): { readonly id: string; readonly version: number; readonly methods: M } {\n  try {\n    return defineRpcService(contract) as unknown as { readonly id: string; readonly version: number; readonly methods: M };\n  } catch {\n    throw new RpcServiceError('invalid_registration');\n  }\n}\n\n/* -------------------------------------------------------------------------- */\n/* Adapter                                                                     */\n/* -------------------------------------------------------------------------- */\n\nexport class HostRpcAdapter {\n  readonly runtime: RpcServiceRuntime<unknown>;\n  readonly #options: HostRpcAdapterOptions;\n  readonly #process: PluginServiceProcess;\n  readonly #maxCallDepth: number;\n  readonly #ownersByToken = new WeakMap<object, OwnerState>();\n  readonly #ownersByCaller = new Map<string, OwnerState>();\n  readonly #publications = new Map<string, RegisteredPublication>();\n  readonly #capabilities = new Map<string, Readonly<Record<string, HostRpcMethodCapability>>>();\n  #closed = false;\n\n  constructor(options: HostRpcAdapterOptions) {\n    if (options === null || typeof options !== 'object' || typeof options.process !== 'string') {\n      throw new RpcServiceError('invalid_registration');\n    }\n    if (typeof options.resolvePlacement !== 'function' || typeof options.resolveJournal !== 'function'\n      || typeof options.resolveCallee !== 'function') {\n      throw new RpcServiceError('invalid_registration');\n    }\n    this.#options = options;\n    this.#process = options.process;\n    this.#maxCallDepth = Number.isSafeInteger(options.maxCallDepth) && (options.maxCallDepth as number) > 0\n      ? options.maxCallDepth as number : DEFAULT_MAX_CALL_DEPTH;\n    this.runtime = new RpcServiceRuntime<unknown>({\n      admit: (request) => this.#admit(request),\n      commandExecutor: this.#commandExecutor(),\n      hostLifetime: options.hostLifetime,\n      limits: options.limits,\n    });\n  }\n\n  status(): RpcRuntimeStatus {\n    return this.runtime.status();\n  }\n\n  /**\n   * Host-only readonly directory of this adapter's *real* registered\n   * publications: the kernel-selected binding (endpoint/process/instance/\n   * generation/catalog/scope/subject) of the exact endpoint handle, its owner\n   * lifecycle identity and its current readiness. It is a plain snapshot for\n   * host decision making (peer routing/validation); it grants nothing, exposes\n   * no SDK surface and is never exposed through `PluginServices`.\n   */\n  publicationView(): readonly HostRpcPublicationView[] {\n    const view: HostRpcPublicationView[] = [];\n    for (const publication of this.#publications.values()) {\n      const info = this.runtime.endpointInfo(publication.handle);\n      if (info === null) continue;\n      const lifecycle = publication.ownerState.lifecycle;\n      const state = publication.ownerState.owner.getLifecycleState();\n      view.push(Object.freeze({\n        provider: publication.provider,\n        service: publication.contractId,\n        major: publication.contractVersion,\n        scope: publication.scope,\n        scopeKey: publication.scopeKey,\n        ready: state.ready && !state.retiring && !state.revoked,\n        lifecycle: Object.freeze({\n          endpoint: lifecycle.endpoint, instance: lifecycle.instance,\n          generation: lifecycle.generation, catalog: lifecycle.catalog, subject: lifecycle.subject,\n        }),\n        binding: info.binding,\n      }));\n    }\n    return Object.freeze(view);\n  }\n\n  /** Closes the process runtime; the parent awaits this in the canonical shutdown. */\n  async dispose(options: { readonly timeoutMs?: number } = {}) {\n    this.#closed = true;\n    return this.runtime.dispose(options);\n  }\n\n  /* ------------------------------ owners ---------------------------------- */\n\n  createOwner(input: HostRpcOwnerInput): HostRpcOwnerHandle {\n    return this.#ownerHandle(this.#createOwnerState(input, this.#process, true));\n  }\n\n  /** Imports an authenticated concrete caller, not a plugin instance or SDK facade. */\n  createRemoteCaller(input: HostRpcRemoteCallerInput): HostRpcRemoteCallerHandle {\n    if (!['control', 'worker', 'ingress'].includes(input?.process) || typeof input?.authorizeIncoming !== 'function') {\n      throw new RpcServiceError('invalid_registration');\n    }\n    const authorize = input.authorizeIncoming;\n    const state = this.#createOwnerState(input, input.process, false, authorize);\n    return Object.freeze({\n      invokeTracked: (request: Omit<RpcInvokeRequest, 'caller' | 'callerToken'>) => this.runtime.invokeTracked({\n        ...request, caller: Object.freeze({ subject: state.callerSubject, scope: state.scopeKind }), callerToken: state.owner.token,\n      }),\n      dispose: () => this.#disposeOwner(state),\n    });\n  }\n\n  #createOwnerState(input: HostRpcOwnerInput, process: PluginServiceProcess, local: boolean,\n    authorizeIncoming?: HostRpcRemoteCallerInput['authorizeIncoming']): OwnerState {\n    if (this.#closed) throw new RpcServiceError('closed');\n    if (input === null || typeof input !== 'object' || input.token === null || typeof input.token !== 'object') {\n      throw new RpcServiceError('invalid_registration');\n    }\n    if (typeof input.plugin !== 'string' || !input.plugin || typeof input.scope !== 'string' || !input.scope) {\n      throw new RpcServiceError('invalid_registration');\n    }\n    if (typeof input.getLifecycleState !== 'function' || typeof input.acquireLease !== 'function'\n      || typeof input.resolveInvocationContext !== 'function') {\n      throw new RpcServiceError('invalid_registration');\n    }\n    if (this.#ownersByToken.has(input.token)) throw new RpcServiceError('invalid_registration');\n    const callerSubject = callerSubjectFor(input.plugin, input.scope);\n    if (local && this.#ownersByCaller.has(callerSubject)) throw new RpcServiceError('invalid_registration');\n    const state: OwnerState = {\n      owner: input,\n      plugin: input.plugin,\n      scope: input.scope,\n      scopeKind: scopeKindOf(input.scope),\n      callerSubject,\n      lifecycle: snapshotLifecycle(input.lifecycle),\n      publications: new Set(),\n      process, local, authorizeIncoming,\n      revoked: false,\n      released: false,\n    };\n    // Fail closed before any publication: dependency records must be snapshot-clean.\n    snapshotDependencies(input.dependencies);\n    if (Object.hasOwn(input, 'optionalDependencies')) throw new RpcServiceError('invalid_registration');\n    try { assertSupportedServiceDeclarations(input.declarations); } catch { throw new RpcServiceError('invalid_registration'); }\n    this.#ownersByToken.set(input.token, state);\n    if (local) this.#ownersByCaller.set(callerSubject, state);\n    return state;\n  }\n\n  #ownerHandle(state: OwnerState): HostRpcOwnerHandle {\n    return Object.freeze({\n      owner: state.owner,\n      publish: <const M extends Record<string, RpcMethodDefinition>>(\n        contract: { readonly id: string; readonly version: number; readonly methods: M },\n        handlers: RpcHandlerMap<M, unknown>,\n        capabilities?: HostRpcCommandCapabilities<M>,\n      ) => this.#publish(state, contract, handlers, capabilities),\n      consume: <const M extends Record<string, RpcMethodDefinition>>(\n        provider: string,\n        contract: { readonly id: string; readonly version: number; readonly methods: M },\n      ) => this.#consume(state, provider, contract),\n      markReady: () => { this.#markReady(state); },\n      retire: () => { this.#retire(state); },\n      dispose: () => this.#disposeOwner(state),\n    });\n  }\n\n  #markReady(state: OwnerState): void {\n    if (state.revoked || state.released || this.#closed) throw new RpcServiceError('closed');\n    for (const publication of state.publications) this.runtime.markReady(publication.handle);\n  }\n\n  #retire(state: OwnerState): void {\n    if (state.released) return;\n    for (const publication of state.publications) this.runtime.retire(publication.handle);\n  }\n\n  /** Revoke + REAL bounded drain. Resources are dropped only after a drained verdict. */\n  async #disposeOwner(state: OwnerState): Promise<RpcDrainResult> {\n    if (state.released) return Object.freeze({ drained: true, active: 0 });\n    state.revoked = true;\n    this.runtime.revokeCaller(state.callerSubject, state.owner.token);\n    for (const publication of state.publications) this.runtime.revoke(publication.handle);\n    const result = await this.runtime.drainOwner(state.callerSubject, [...state.publications].map(publication => publication.handle), { callerToken: state.owner.token });\n    if (result.drained) this.#releaseOwner(state);\n    return result;\n  }\n\n  /** Drops publication/capability/owner mapping so the same logical owner can be recreated. */\n  #releaseOwner(state: OwnerState): void {\n    for (const publication of state.publications) {\n      this.#publications.delete(publication.key);\n      this.#capabilities.delete(publication.key);\n    }\n    state.publications.clear();\n    state.released = true;\n    if (this.#ownersByCaller.get(state.callerSubject) === state) this.#ownersByCaller.delete(state.callerSubject);\n  }\n\n  /* ---------------------------- publications ------------------------------ */\n\n  #publish<const M extends Record<string, RpcMethodDefinition>>(\n    state: OwnerState,\n    contractInput: { readonly id: string; readonly version: number; readonly methods: M },\n    handlers: RpcHandlerMap<M, unknown>,\n    capabilities?: HostRpcCommandCapabilities<M>,\n  ): HostRpcPublication {\n    const lifecycleState = state.owner.getLifecycleState();\n    if (state.revoked || state.released || this.#closed || lifecycleState.revoked || lifecycleState.retiring) {\n      throw new RpcServiceError('closed');\n    }\n    const contract = defineContract(contractInput);\n    if (this.#matchPublication(state, contract.id, contract.version) === null) throw new RpcServiceError('undeclared');\n    const key = publicationKey(state.plugin, state.scope, contract.id, contract.version);\n    // Duplicate detection happens BEFORE register so no ghost endpoint is created.\n    if (this.#publications.has(key)) throw new RpcServiceError('invalid_registration');\n    const methodTable = contract.methods as Record<string, RpcMethodDefinition>;\n    const collected = snapshotHandlers(methodTable, handlers);\n    // Snapshot capabilities BEFORE `register`: a hostile accessor must fail closed with\n    // zero endpoints and no parent publication callback, never leave a ghost endpoint.\n    const capabilityRecord = snapshotCapabilities(methodTable, capabilities);\n    const wrapped: Record<string, Handler> = {};\n    for (const [name, definition] of Object.entries(methodTable)) {\n      const chainKey = `${state.plugin}${SEP}${state.scope}${SEP}${contract.id}${SEP}${contract.version}${SEP}${name}`;\n      wrapped[name] = this.#wrapHandler(collected.get(name) as Handler, definition, chainKey);\n    }\n    const binding: RpcEndpointBinding = {\n      endpoint: state.lifecycle.endpoint,\n      process: this.#process,\n      instance: state.lifecycle.instance,\n      generation: state.lifecycle.generation,\n      catalog: state.lifecycle.catalog,\n      scope: state.scopeKind,\n      subject: state.lifecycle.subject,\n    };\n    let handle: RpcEndpointHandle;\n    try {\n      handle = this.runtime.register({\n        provider: state.plugin,\n        binding,\n        contract,\n        handler: wrapped as unknown as RpcHandlerMap<M, unknown>,\n      });\n    } catch {\n      throw new RpcServiceError('invalid_registration');\n    }\n    const descriptor: HostRpcServiceDescriptor = Object.freeze({\n      provider: state.plugin, service: contract.id, major: contract.version, kind: 'rpc',\n      process: this.#process, scope: state.scopeKind,\n    });\n    const publication: RegisteredPublication = {\n      key, handle, provider: state.plugin, scopeKey: state.scope, scope: state.scopeKind,\n      contractId: contract.id, contractVersion: contract.version, ownerState: state,\n    };\n    this.#publications.set(key, publication);\n    state.publications.add(publication);\n    if (capabilityRecord !== null && Object.keys(capabilityRecord).length > 0) {\n      this.#capabilities.set(key, capabilityRecord);\n    }\n    try {\n      state.owner.registerPublication?.({\n        id: contract.id, version: contract.version, kind: 'rpc', process: this.#process, scope: 'global',\n      });\n    } catch {\n      // Roll back completely: no ghost endpoint, no reservation, no capability.\n      this.runtime.revoke(handle);\n      this.#publications.delete(key);\n      this.#capabilities.delete(key);\n      state.publications.delete(publication);\n      throw new RpcServiceError('invalid_registration');\n    }\n    return Object.freeze({ descriptor });\n  }\n\n  #wrapHandler(original: Handler, definition: RpcMethodDefinition, chainKey: string): Handler {\n    // Commands are framed once by `#commandExecutor` for the whole journal capability\n    // (execute/query/reconcile); framing the business handler again here would inflate\n    // depth and could manufacture false same-method cycles.\n    if (definition.kind === 'command') return original;\n    return (input, context) => this.#runInFrame(context, chainKey, () => original(input, context));\n  }\n\n  /** Runs `run` inside one inherited host frame: purpose, chain, deadline, cancellation. */\n  #runInFrame(context: RpcHandlerContext<unknown>, chainKey: string, run: () => unknown): unknown {\n    const parent = FRAME_STORE.getStore() ?? null;\n    const depth = (parent?.depth ?? 0) + 1;\n    if (depth > this.#maxCallDepth) throw new RpcServiceError('call_depth_exceeded', context.operationId);\n    const actualDeadline = typeof context.deadlineAt === 'number' ? context.deadlineAt : Number.POSITIVE_INFINITY;\n    const frame: ActiveFrame = Object.freeze({\n      purpose: context.purpose,\n      depth,\n      chain: Object.freeze([...(parent?.chain ?? []), chainKey]),\n      deadlineAt: parent === null ? actualDeadline : Math.min(parent.deadlineAt, actualDeadline),\n      // A nested call must also abort when the parent call is cancelled.\n      signal: parent === null ? context.signal : anySignal([parent.signal, context.signal]),\n    });\n    const enter = this.#options.enterHostHandlerFrame;\n    if (enter === undefined) return FRAME_STORE.run(frame, run);\n    // The canonical host enters its OWN live invocation frame for the exact\n    // published owner, so channel work and nested local dispatch inside this\n    // handler inherit the real purpose/deadline/cancel and the exact owner\n    // authority instead of being re-interpreted as an unauthenticated background\n    // task. `ownerToken` is host-private (`CALLEE_INFO`), never a payload field.\n    const info = context.callee !== null && typeof context.callee === 'object'\n      ? CALLEE_INFO.get(context.callee as object)\n      : undefined;\n    const hostFrame: HostRpcHandlerFrame = {\n      purpose: frame.purpose,\n      ...(Number.isFinite(frame.deadlineAt) ? { deadlineAt: frame.deadlineAt } : {}),\n      signal: frame.signal,\n      ownerToken: info?.ownerToken ?? null,\n      operationId: context.operationId ?? null,\n    };\n    return FRAME_STORE.run(frame, () => enter(hostFrame, run));\n  }\n\n  /* ----------------------------- consumption ------------------------------ */\n\n  #consume<const M extends Record<string, RpcMethodDefinition>>(\n    state: OwnerState,\n    provider: string,\n    contractInput: { readonly id: string; readonly version: number; readonly methods: M },\n  ): AsyncRpcClient<M> {\n    if (state.released || this.#closed) throw new RpcServiceError('closed');\n    if (typeof provider !== 'string' || !provider) throw new RpcServiceError('invalid_registration');\n    const contract = defineContract(contractInput);\n    const declaration = this.#matchConsumption(state, provider, contract.id, contract.version);\n    if (declaration === null) throw new RpcServiceError('undeclared');\n    if (!isCrossProcessSelfService(state.plugin, declaration, state.owner.declarations) && (provider === state.plugin || !Object.hasOwn(state.owner.dependencies, provider))) throw new RpcServiceError('undeclared');\n    const scopeKey = 'global';\n    const firstMethod = Object.keys(contract.methods as Record<string, RpcMethodDefinition>)[0];\n    const route = this.#resolveRoute(state, { provider, service: contract.id, major: contract.version, method: firstMethod }, scopeKey);\n    if (route.kind === 'ambiguous') throw new RpcServiceError('ambiguous_placement');\n    if (route.kind === 'missing') {\n      throw new RpcServiceError('unavailable');\n    }\n    state.owner.registerConsumption?.(declaration, route.kind === 'publication' ? route.publication.ownerState.owner.token : undefined);\n    const methodTable = contract.methods as Record<string, RpcMethodDefinition>;\n    const client: Record<string, unknown> = {};\n    for (const [method, definition] of Object.entries(methodTable)) {\n      client[method] = this.#makeMethodClient(state, provider, contract, method, definition);\n    }\n    return Object.freeze(client) as AsyncRpcClient<M>;\n  }\n\n  #makeMethodClient<const M extends Record<string, RpcMethodDefinition>>(\n    state: OwnerState,\n    provider: string,\n    contract: { readonly id: string; readonly version: number; readonly methods: M },\n    method: string,\n    definition: RpcMethodDefinition,\n  ): unknown {\n    const target = { provider, service: contract.id, major: contract.version, method };\n    const invoke = (action: RpcCommandAction | undefined, input: unknown, operationId: string | null, options: RpcCallOptions) =>\n      this.#invokeAction(state, target, definition, action, input, operationId, options);\n    const call = async (input: unknown, options?: RpcCallOptions): Promise<unknown> => {\n      const snapshot = snapshotCallOptions(options);\n      const operationId = this.#operationId(definition, snapshot);\n      return invoke(definition.kind === 'command' ? 'execute' : undefined, input, operationId, snapshot);\n    };\n    if (definition.kind !== 'command') return call;\n    const queryResult = (operationId: string): Promise<unknown> =>\n      invoke('query-result', null, normalizeOperationId(operationId), EMPTY_OPTIONS);\n    const reconcile = (operationId: string, input: unknown): Promise<unknown> =>\n      invoke('reconcile', input, normalizeOperationId(operationId), EMPTY_OPTIONS);\n    return Object.assign(call, { queryResult, reconcile });\n  }\n\n  #operationId(definition: RpcMethodDefinition, options: RpcCallOptions): string | null {\n    const raw = options.operationId;\n    if (definition.kind === 'query') {\n      if (raw !== undefined) throw new RpcServiceError('invalid_operation_id');\n      return null;\n    }\n    if (raw === undefined) throw new RpcServiceError('invalid_operation_id');\n    return normalizeOperationId(raw);\n  }\n\n  async #invokeAction(\n    state: OwnerState,\n    target: { readonly provider: string; readonly service: string; readonly major: number; readonly method: string },\n    definition: RpcMethodDefinition,\n    action: RpcCommandAction | undefined,\n    input: unknown,\n    operationId: string | null,\n    options: RpcCallOptions,\n  ): Promise<RpcJson> {\n    if (state.revoked || state.released || this.#closed) throw new RpcServiceError('closed', operationId);\n    // The manifest consumption and its canonical dependency record are re-validated on\n    // every call: a removed declaration or dependency is refused.\n    const scopeKey = this.#targetScope(state, target);\n    if (scopeKey === null) throw new RpcServiceError('undeclared', operationId);\n    const parent = FRAME_STORE.getStore() ?? null;\n    if (parent !== null && parent.chain.includes(`${target.provider}${SEP}${scopeKey}${SEP}${target.service}${SEP}${target.major}${SEP}${target.method}`)) {\n      throw new RpcServiceError('deadlock');\n    }\n    // Enforce the consumer contract's own input schema/byte bound before the provider\n    // sees the call. `query-result` carries only the null control DTO, never business input.\n    if (action !== 'query-result') {\n      try {\n        const limit = definition.maxInputBytes ?? RPC_JSON_MAX_BYTES;\n        input = decodeRpcJson(encodeRpcJson(input, limit), limit);\n        assertRpcData(definition.input, input, limit);\n      } catch {\n        throw new RpcServiceError('invalid_input', operationId);\n      }\n    }\n    const caller = Object.freeze({ subject: state.callerSubject, scope: state.scopeKind });\n    // Resolve the host invocation frame exactly once; purpose and request share that snapshot.\n    const invocation = state.owner.resolveInvocationContext();\n    const purpose = this.#selectPurpose(state, definition, invocation);\n    const route = this.#resolveRoute(state, target, scopeKey, purpose);\n    if (route.kind === 'ambiguous') throw new RpcServiceError('ambiguous_placement');\n    if (route.kind === 'missing') throw new RpcServiceError('unavailable');\n    const request = this.#buildRequest(target, caller, purpose, input, operationId, action, options, parent, invocation, state.owner.token);\n    try {\n      const result = await this.runtime.invoke(request);\n      try { assertRpcData(definition.output, result, definition.maxOutputBytes); }\n      catch { throw new RpcServiceError('invalid_output', operationId); }\n      return result;\n    } catch (error) {\n      throw toRpcServiceError(error, operationId);\n    }\n  }\n\n  /** Purpose is inherited, never rank-converted; the method must explicitly allow it. */\n  #selectPurpose(state: OwnerState, definition: RpcMethodDefinition, invocation: HostRpcInvocationContext | null): RpcCallPurpose {\n    const parent = FRAME_STORE.getStore() ?? null;\n    if (parent !== null) return requirePurpose(definition, parent.purpose);\n    if (invocation !== null) return requirePurpose(definition, invocation.purpose);\n    const ready = state.owner.getLifecycleState().ready;\n    return requirePurpose(definition, ready ? 'background' : 'bootstrap');\n  }\n\n  #buildRequest(\n    target: { readonly provider: string; readonly service: string; readonly major: number; readonly method: string },\n    caller: RpcCaller,\n    purpose: RpcCallPurpose,\n    input: unknown,\n    operationId: string | null,\n    action: RpcCommandAction | undefined,\n    options: RpcCallOptions,\n    parent: ActiveFrame | null,\n    invocation: HostRpcInvocationContext | null,\n    callerToken: object,\n  ) {\n    let timeoutMs = options.timeoutMs;\n    const deadlineAt = Math.min(parent?.deadlineAt ?? Infinity, invocation?.deadlineAt ?? Infinity);\n    if (parent !== null && Number.isFinite(parent.deadlineAt)) {\n      const remaining = Math.floor(parent.deadlineAt - Date.now());\n      timeoutMs = timeoutMs === undefined ? remaining : Math.min(timeoutMs, remaining);\n    }\n    if (invocation?.deadlineAt !== undefined) {\n      const remaining = Math.floor(invocation.deadlineAt - Date.now());\n      timeoutMs = timeoutMs === undefined ? remaining : Math.min(timeoutMs, remaining);\n    }\n    if (timeoutMs !== undefined && (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0)) {\n      throw new RpcServiceError('timeout', operationId);\n    }\n    const explicitSignal = options.signal;\n    const parentSignal = parent?.signal;\n    let signal = explicitSignal === undefined\n      ? parentSignal\n      : parentSignal === undefined ? explicitSignal : anySignal([explicitSignal, parentSignal]);\n    if (invocation?.signal !== undefined) signal = signal === undefined ? invocation.signal : anySignal([signal, invocation.signal]);\n    const request: {\n      target: { provider: string; service: string; major: number; method: string };\n      caller: RpcCaller;\n      callerToken: object;\n      purpose: RpcCallPurpose;\n      input: unknown;\n      operationId?: string;\n      commandAction?: RpcCommandAction;\n      signal?: AbortSignal;\n      timeoutMs?: number;\n      deadlineAt?: number;\n    } = {\n      target: { provider: target.provider, service: target.service, major: target.major, method: target.method },\n      caller,\n      callerToken,\n      purpose,\n      input,\n    };\n    if (operationId !== null) request.operationId = operationId;\n    if (action !== undefined) request.commandAction = action;\n    if (signal !== undefined) request.signal = signal;\n    if (timeoutMs !== undefined) request.timeoutMs = timeoutMs;\n    if (Number.isFinite(deadlineAt)) request.deadlineAt = deadlineAt;\n    return request;\n  }\n\n  /* ------------------------------- routing -------------------------------- */\n\n  #matchPublication(state: OwnerState, id: string, version: number): PluginServicePublication | null {\n    return state.owner.declarations.provides?.find((value) =>\n      value.id === id && value.version === version\n      && (value.kind ?? 'local') === 'rpc'\n      && value.process === this.#process\n      && (value.scope ?? 'global') === 'global' && state.scope === 'global') ?? null;\n  }\n\n  #matchConsumption(state: OwnerState, provider: string, id: string, version: number): PluginServiceConsumption | null {\n    return state.owner.declarations.consumes?.find((value) =>\n      value.plugin === provider && value.id === id && value.version === version\n      && (value.kind ?? 'local') === 'rpc'\n      && value.process === state.process) ?? null;\n  }\n\n  #targetScope(\n    state: OwnerState,\n    target: { readonly provider: string; readonly service: string; readonly major: number },\n  ): string | null {\n    const consumption = state.owner.declarations.consumes?.find((value) =>\n      value.plugin === target.provider && value.id === target.service && value.version === target.major\n      && (value.kind ?? 'local') === 'rpc' && value.process === state.process) ?? null;\n    if (consumption === null) return null;\n    if (!isCrossProcessSelfService(state.plugin, consumption, state.owner.declarations) && (target.provider === state.plugin || !Object.hasOwn(state.owner.dependencies, target.provider))) return null;\n    return 'global';\n  }\n\n  /** Host placement authority runs first; `null` opts into the explicit local channel. */\n  #resolveRoute(\n    state: OwnerState,\n    target: { readonly provider: string; readonly service: string; readonly major: number; readonly method: string },\n    scopeKey: string,\n    purpose?: RpcCallPurpose,\n  ): RouteResolution {\n    let placement: HostRpcPlacementResolution;\n    try {\n      placement = this.#options.resolvePlacement({\n        provider: target.provider,\n        service: target.service,\n        major: target.major,\n        method: target.method,\n        scope: scopeKey === 'global' ? 'global' : 'binding',\n        ...(scopeKey === 'global' ? {} : { bindingScope: scopeKey }),\n        caller: Object.freeze({ subject: state.callerSubject, scope: state.scopeKind }),\n        purpose,\n      });\n    } catch {\n      return { kind: 'missing' };\n    }\n    if (placement !== null && placement !== undefined) {\n      if (placement.kind === 'ambiguous') return { kind: 'ambiguous' };\n      return { kind: 'remote', handle: placement.endpoint };\n    }\n    const publication = this.#publications.get(publicationKey(target.provider, scopeKey, target.service, target.major));\n    return publication === undefined ? { kind: 'missing' } : { kind: 'publication', publication };\n  }\n\n  /* ----------------------------- admission -------------------------------- */\n\n  #admit(request: RpcAdmissionRequest): RpcAdmissionGrant<unknown> | null {\n    if (this.#closed) return null;\n    const state = request.callerToken === undefined ? this.#ownersByCaller.get(request.caller.subject)\n      : this.#ownersByToken.get(request.callerToken);\n    if (state === undefined || state.revoked || state.released) return null;\n    if (state.callerSubject !== request.caller.subject\n      || (request.caller.scope !== undefined && state.scopeKind !== request.caller.scope)) return null;\n    const callerState = state.owner.getLifecycleState();\n    if (callerState.revoked) return null;\n    if (state.owner.canCall !== undefined && !state.owner.canCall({ ...request.target })) return null;\n    if (!callerState.ready && request.purpose !== 'bootstrap') return null;\n    const target = { ...request.target };\n    const scopeKey = this.#targetScope(state, target);\n    if (scopeKey === null) return null;\n    const route = this.#resolveRoute(state, target, scopeKey, request.purpose);\n    if (route.kind === 'ambiguous' || route.kind === 'missing') return null;\n    const publication = route.kind === 'publication' ? route.publication : null;\n    const endpoint = route.kind === 'publication' ? route.publication.handle : route.handle;\n    // The callee publication is built from the REAL kernel-bound endpoint identity, never\n    // from the adapter process or a plugin-supplied location. A foreign/unconfirmable\n    // endpoint, or one whose provider/service/major/scope disagrees with the requested\n    // target, is refused before any lease or callee frame is produced.\n    const info = this.runtime.endpointInfo(endpoint);\n    if (info === null) return null;\n    if (info.provider !== target.provider || info.contract.id !== target.service || info.contract.version !== target.major) {\n      return null;\n    }\n    const scope = info.binding.scope;\n    if ((scopeKey === 'global') !== (scope === 'global')) return null;\n    if (!state.local) {\n      try { if (state.authorizeIncoming?.(request, info) !== true) return null; }\n      catch { return null; }\n      if (state.revoked || state.released || this.#closed) return null;\n    }\n    const provider = info.provider;\n    // Logical clients can be relocated without retaining an unrelated local provider.\n    const consumption = this.#matchConsumption(state, target.provider, target.service, target.major)!;\n    state.owner.registerConsumption?.(consumption, publication?.ownerState.owner.token);\n    // Resolve the trusted callee frame before any lease so a throwing host\n    // resolver cannot leak leases.\n    const hostFrame = this.#options.resolveCallee(\n      request,\n      Object.freeze({ provider, service: target.service, major: target.major, kind: 'rpc', process: info.binding.process, scope }),\n    );\n    // Caller lease holds the issuing owner for the whole call lifespan.\n    let callerRelease: () => void = () => undefined;\n    try {\n      const lease = state.owner.acquireLease({\n        role: 'caller', plugin: state.plugin, scope: state.scope, state: callerState,\n        purpose: request.purpose, operationId: request.operationId, provider: target.provider,\n      });\n      if (lease === null || typeof lease !== 'object' || typeof lease.release !== 'function') return null;\n      callerRelease = once(() => { try { lease.release(); } catch { /* host-owned */ } });\n    } catch { return null; }\n    // Callee lease holds the provider (local only). A callee the kernel will refuse\n    // (revoked / retiring without an existing-lease proof / unready non-bootstrap)\n    // is NOT leased here, so the kernel reports the exact state instead of a lease error.\n    let calleeRelease: (() => void) | null = null;\n    let allowRetired = false;\n    if (publication !== null) {\n      const calleeState = publication.ownerState.owner.getLifecycleState();\n      const runnable = calleeState.revoked ? false\n        : calleeState.retiring ? (request.purpose === 'request' || request.purpose === 'attempt')\n          : (calleeState.ready || request.purpose === 'bootstrap');\n      if (runnable) {\n        try {\n          const lease = publication.ownerState.owner.acquireLease({\n            role: 'callee', plugin: publication.provider, scope: publication.scopeKey, state: calleeState,\n            purpose: request.purpose, operationId: request.operationId, provider: target.provider,\n          });\n          if (lease === null || typeof lease !== 'object' || typeof lease.release !== 'function') {\n            callerRelease();\n            return null;\n          }\n          calleeRelease = once(() => { try { lease.release(); } catch { /* host-owned */ } });\n          allowRetired = lease.allowRetired === true\n            && (request.purpose === 'request' || request.purpose === 'attempt');\n        } catch { callerRelease(); return null; }\n      }\n    }\n    const callee = Object.freeze({});\n    CALLEE_INFO.set(callee, { provider, scopeKey, scope, frame: hostFrame, ownerToken: publication?.ownerState.owner.token ?? null });\n    const release = once(() => {\n      try { calleeRelease?.(); } catch { /* host-owned */ }\n      try { callerRelease(); } catch { /* host-owned */ }\n    });\n    // A host callback can synchronously dispose this capability before a task exists.\n    // Recheck after every admission callback has returned, before handing the kernel a grant.\n    if (state.revoked || state.released || this.#closed) { release(); return null; }\n    return {\n      endpoint, callee, release, callerToken: state.owner.token,\n      allowUnready: request.purpose === 'bootstrap',\n      allowRetired,\n    };\n  }\n\n  /* ------------------------------ commands -------------------------------- */\n\n  #commandExecutor(): RpcCommandExecutor<unknown> {\n    const run = async (\n      execution: Omit<RpcCommandExecution<unknown>, 'executeBusiness'>,\n      action: RpcCommandAction,\n    ): Promise<unknown> => {\n      const callee = execution.context.callee;\n      const info = callee !== null && typeof callee === 'object' ? CALLEE_INFO.get(callee as object) : undefined;\n      if (info === undefined) throw new RpcServiceError('capability_unavailable', execution.operationId);\n      const chainKey = `${info.provider}${SEP}${info.scopeKey}${SEP}${execution.contract.id}${SEP}${execution.contract.version}${SEP}${execution.method}`;\n      const journal = this.#journalFor(info, execution);\n      // Application-owned CAS/idempotency (e.g. a budget ledger or credential\n      // version fence) has one transaction authority. No parallel journal is\n      // created for an explicitly non-deduplicated command.\n      if (journal === null && execution.definition.command?.deduplication === 'none') {\n        if (action !== 'execute') throw new RpcServiceError('capability_unavailable', execution.operationId);\n        return this.#runInFrame(execution.context, chainKey, () => (execution as RpcCommandExecution<unknown>).executeBusiness());\n      }\n      if (journal === null) throw new RpcServiceError('capability_unavailable', execution.operationId);\n      // Every journal action (execute/query/reconcile) runs inside the real RPC frame so\n      // the business handler and any nested external-reconcile RPC inherit purpose,\n      // chain, deadline, and cancellation. Commands are framed once here, not in #wrapHandler.\n      try {\n        return await this.#runInFrame(execution.context, chainKey, () => {\n          if (action === 'execute') return journal.execute(execution as RpcCommandExecution<unknown>);\n          if (action === 'query-result') return journal.query(execution.operationId, execution.context.caller);\n          return journal.reconcile(execution);\n        });\n      } finally {\n        if ('close' in journal) {\n          // Capability release is resource cleanup, separate from the acknowledged command.\n          // A stuck or failed cleanup must not replace success, unknown, or its operation ID.\n          void Promise.resolve().then(()=>journal.close()).catch(error=>{\n            const rawCode=ownStringProperty(error,'code');\n            const code=rawCode!==null&&['worker_failed','request_timeout','request_failed','close_unconfirmed','cleanup_overloaded','queue_full','result_unknown','storage_failure'].includes(rawCode)?rawCode:'failed';\n            const failure=Object.freeze({operationId:execution.operationId,code});\n            try{logger.error(failure,'Host RPC journal cleanup failed');}catch{/* Reporting cannot change the command outcome. */}\n            try{this.#options.onJournalCleanupFailure?.(failure);}catch{/* Host reporting is independent of business completion. */}\n          });\n        }\n      }\n\n    };\n    return {\n      execute: (execution) => run(execution, 'execute'),\n      queryResult: (execution) => run(execution, 'query-result'),\n      reconcile: (execution) => run(execution, 'reconcile'),\n    };\n  }\n\n  #journalFor(\n    info: CalleeInfo,\n    execution: Omit<RpcCommandExecution<unknown>, 'executeBusiness'>,\n  ): AsyncCommandJournal | CommandJournal | null {\n    const policy = execution.definition.command;\n    if (policy === undefined) throw new RpcServiceError('capability_unavailable', execution.operationId);\n    const capability = this.#capabilities.get(\n      publicationKey(info.provider, info.scopeKey, execution.contract.id, execution.contract.version),\n    )?.[execution.method];\n    try {\n      return this.#options.resolveJournal({\n        provider: info.provider,\n        service: execution.contract.id,\n        major: execution.contract.version,\n        method: execution.method,\n        scope: info.scope,\n        ...(info.scope === 'binding' ? { bindingScope: info.scopeKey } : {}),\n        policy,\n        ...(capability?.atomic === undefined ? {} : { atomic: capability.atomic }),\n        ...(capability?.atomicReadSet === undefined ? {} : { atomicReadSet: capability.atomicReadSet }),\n        ...(capability?.external === undefined ? {} : { external: capability.external }),\n      }) ?? null;\n    } catch {\n      throw new RpcServiceError('capability_unavailable', execution.operationId);\n    }\n  }\n}\n\nfunction once(action: () => void): () => void {\n  let done = false;\n  return () => { if (done) return; done = true; action(); };\n}\n",
     "/**\n * Plugin service RPC data contract (P1/P4): a dependency-free schema DSL, a\n * bounded strict-JSON codec, and service/method contract validation.\n *\n * Scope boundary: this module validates *data shapes only*. It deliberately\n * grants no wire authorization — host identity, generation, scope/lease, call\n * context, and permissions must be enforced by the host RPC adapter, never by a\n * schema check here. In particular `command.deduplication` is a declared intent;\n * real local transactions and any cross-system exactly-once behavior belong to\n * the host and to the external contract, not to this file.\n *\n * Everything that reaches validation is first cloned from own property\n * descriptors into bounded pure JSON, so no getter, proxy trap, or `toJSON` is\n * ever invoked and no non-JSON shape is silently accepted.\n */\nimport { isProxy } from 'node:util/types';\n\nexport type RpcCallKind = 'query' | 'command';\nexport type RpcCallPurpose = 'bootstrap' | 'background' | 'management' | 'request' | 'attempt';\nexport type RpcCommandDeduplication = 'local-transaction' | 'external-contract' | 'none';\n\n/** Declared intent only; the host owns the actual transaction and retention. */\nexport interface RpcCommandPolicy {\n  readonly deduplication: RpcCommandDeduplication;\n  /**\n   * `null` means the result is retained permanently and durably: it survives a\n   * restart and is never recomputed. A positive number is a retention window in\n   * milliseconds. Retention is a host/storage concern; this is declaration only.\n   */\n  readonly resultRetentionMs: number | null;\n  readonly quotaBytes: number;\n  readonly maxResultBytes: number;\n}\n\n/** Pure JSON: null, boolean, finite number, string, arrays, and plain records. */\nexport type RpcJson =\n  | null\n  | boolean\n  | number\n  | string\n  | readonly RpcJson[]\n  | { readonly [key: string]: RpcJson };\n\n/**\n * Data schema DSL. `object` rejects unknown fields, `optional` lists real\n * optional keys, and `json` carries an optional explicit byte bound (default:\n * the RPC envelope).\n */\nexport type RpcDataSchema =\n  | { readonly type: 'string'; readonly minLength?: number; readonly maxLength?: number }\n  | { readonly type: 'number'; readonly integer?: boolean; readonly minimum?: number; readonly maximum?: number }\n  | { readonly type: 'boolean' }\n  | { readonly type: 'null' }\n  | { readonly type: 'literal'; readonly value: RpcJson }\n  | { readonly type: 'array'; readonly items: RpcDataSchema; readonly maxItems?: number }\n  | {\n      readonly type: 'object';\n      readonly properties: { readonly [key: string]: RpcDataSchema };\n      readonly optional?: readonly string[];\n    }\n  | { readonly type: 'record'; readonly values: RpcDataSchema; readonly maxEntries?: number }\n  | { readonly type: 'union'; readonly variants: readonly RpcDataSchema[] }\n  | { readonly type: 'json'; readonly maxBytes?: number };\n\n/** Flattens intersections so optional modifiers survive as real optional keys. */\ntype Simplify<T> = { [K in keyof T]: T[K] };\n\ntype OptionalNames<S> = S extends { readonly optional: readonly (infer K extends string)[] } ? K : never;\n\ntype InferObject<P extends Record<string, RpcDataSchema>, O extends string> = Simplify<\n  { [K in keyof P as K extends O ? never : K]: InferRpcData<P[K]> } &\n  { [K in Extract<keyof P, O>]?: InferRpcData<P[K]> }\n>;\n\n/** Derives the TypeScript type described by a `RpcDataSchema`. */\nexport type InferRpcData<S> =\n  RpcDataSchema extends S ? RpcJson : S extends { readonly type: 'string' }\n    ? string\n    : S extends { readonly type: 'number' }\n      ? number\n      : S extends { readonly type: 'boolean' }\n        ? boolean\n        : S extends { readonly type: 'null' }\n          ? null\n          : S extends { readonly type: 'literal'; readonly value: infer V extends RpcJson }\n            ? V\n            : S extends { readonly type: 'json' }\n              ? RpcJson\n              : S extends { readonly type: 'array'; readonly items: infer I extends RpcDataSchema }\n                ? InferRpcData<I>[]\n                : S extends { readonly type: 'record'; readonly values: infer V extends RpcDataSchema }\n                  ? { [key: string]: InferRpcData<V> }\n                  : S extends { readonly type: 'union'; readonly variants: infer VS }\n                    ? VS extends readonly (infer V extends RpcDataSchema)[]\n                      ? InferRpcData<V>\n                      : never\n                    : S extends { readonly type: 'object'; readonly properties: infer P extends Record<string, RpcDataSchema> }\n                      ? InferObject<P, OptionalNames<S>>\n                      : never;\n\nexport interface RpcMethodDefinition {\n  readonly kind: RpcCallKind;\n  readonly input: RpcDataSchema;\n  readonly output: RpcDataSchema;\n  readonly purposes: readonly RpcCallPurpose[];\n  readonly timeoutMs?: number;\n  readonly maxInputBytes?: number;\n  readonly maxOutputBytes?: number;\n  readonly command?: RpcCommandPolicy;\n}\n\nexport interface RpcServiceContract<\n  M extends Record<string, RpcMethodDefinition> = Record<string, RpcMethodDefinition>,\n> {\n  readonly id: string;\n  readonly version: number;\n  readonly methods: M;\n}\n\nexport const RPC_JSON_MAX_BYTES = 64 * 1024;\n/** Metadata contract/schema inputs are pure JSON and bounded well below the envelope. */\nexport const RPC_CONTRACT_MAX_BYTES = 256 * 1024;\n\nconst JSON_MAX_DEPTH = 64;\nconst SCHEMA_MAX_DEPTH = 64;\nconst RPC_MAX_TIMEOUT_MS = 300_000;\nconst RPC_MAX_METHODS = 128;\nconst RPC_SERVICE_ID = /^[a-z][a-z0-9.-]{0,127}$/;\nconst RPC_METHOD_NAME = /^[A-Za-z_][A-Za-z0-9_.-]{0,127}$/;\nconst RPC_CALL_PURPOSES = new Set<RpcCallPurpose>(['bootstrap', 'background', 'management', 'request', 'attempt']);\nconst RPC_COMMAND_DEDUPLICATION = new Set<RpcCommandDeduplication>(['local-transaction', 'external-contract', 'none']);\nconst RPC_COMMAND_POLICY_KEYS = new Set(['deduplication', 'resultRetentionMs', 'quotaBytes', 'maxResultBytes']);\nconst CONTRACT_KEYS = ['id', 'version', 'methods'] as const;\nconst METHOD_KEYS = [\n  'kind',\n  'input',\n  'output',\n  'purposes',\n  'timeoutMs',\n  'maxInputBytes',\n  'maxOutputBytes',\n  'command',\n] as const;\n\nexport type RpcProtocolErrorCode = 'invalid_data' | 'size_limit' | 'invalid_contract';\n\n/** Fixed-code error. It never carries payload, secrets, keys, or arbitrary objects. */\nexport class RpcProtocolError extends Error {\n  readonly name = 'RpcProtocolError';\n\n  constructor(\n    readonly code: RpcProtocolErrorCode,\n    message: string,\n  ) {\n    super(message);\n  }\n}\n\n/** Reports a fixed schema category only — never a user property name or value. */\nfunction failData(category: string): never {\n  throw new RpcProtocolError('invalid_data', `invalid_data in ${category}`);\n}\n\nfunction failSize(): never {\n  throw new RpcProtocolError('size_limit', 'size_limit: JSON value exceeds the byte limit');\n}\n\nfunction failContract(reason: string): never {\n  throw new RpcProtocolError('invalid_contract', `invalid_contract: ${reason}`);\n}\n\nfunction isPlainObject(value: unknown): value is Record<string, unknown> {\n  if (typeof value !== 'object' || value === null || Array.isArray(value)) return false;\n  if (isProxy(value)) return false;\n  const prototype = Object.getPrototypeOf(value);\n  return prototype === Object.prototype || prototype === null;\n}\n\nfunction isPositiveSafeInteger(value: unknown): value is number {\n  return typeof value === 'number' && Number.isSafeInteger(value) && value > 0;\n}\n\nfunction isNonNegativeSafeInteger(value: unknown): value is number {\n  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;\n}\n\nfunction hasLoneSurrogate(value: string): boolean {\n  for (let index = 0; index < value.length; index += 1) {\n    const code = value.charCodeAt(index);\n    if (code >= 0xd800 && code <= 0xdbff) {\n      if (index + 1 >= value.length) return true;\n      const next = value.charCodeAt(index + 1);\n      if (next < 0xdc00 || next > 0xdfff) return true;\n      index += 1;\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      return true;\n    }\n  }\n  return false;\n}\n\nfunction isArrayIndex(key: string, length: number): boolean {\n  if (!/^(?:0|[1-9]\\d*)$/.test(key)) return false;\n  const index = Number(key);\n  return Number.isSafeInteger(index) && index >= 0 && index < length;\n}\n\nfunction assertKnownKeys(input: Record<string, unknown>, allowed: readonly string[], category: string): void {\n  for (const key of Object.keys(input)) {\n    if (!allowed.includes(key)) failContract(`unknown ${category} field`);\n  }\n}\n\n/**\n * Running lower bound of the JSON byte size, used to reject oversized input\n * before it is fully cloned or stringified. Every accounting term is an\n * underestimate (escapes only ever add bytes), so a positive budget never\n * rejects a value that would actually fit.\n */\ninterface SnapshotBudget {\n  left: number;\n}\n\nfunction spend(budget: SnapshotBudget, bytes: number): void {\n  budget.left -= bytes;\n  if (budget.left < 0) failSize();\n}\n\n/**\n * Validates and deep-clones a value into a plain pure-JSON graph. Object\n * descriptors are inspected before any value is read, so accessors and `toJSON`\n * are never invoked. Cycles, holes, non-plain objects, non-enumerable or symbol\n * keys, non-finite numbers, lone surrogates, and over-deep nesting are rejected;\n * the budget rejects oversized values early.\n */\nfunction snapshot(value: unknown, depth: number, ancestors: Set<object>, budget: SnapshotBudget): RpcJson {\n  if (value === null) {\n    spend(budget, 4);\n    return null;\n  }\n  if (typeof value === 'boolean') {\n    spend(budget, value ? 4 : 5);\n    return value;\n  }\n  if (typeof value === 'string') {\n    if (hasLoneSurrogate(value)) failData('string');\n    spend(budget, Buffer.byteLength(value, 'utf8') + 2);\n    return value;\n  }\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) failData('number');\n    spend(budget, 1);\n    return value;\n  }\n  if (typeof value !== 'object') failData('json');\n  const object = value as object;\n  if (isProxy(object)) failData('json');\n  if (ancestors.has(object)) failData('json');\n  const nextDepth = depth + 1;\n  if (nextDepth > JSON_MAX_DEPTH) failData('json');\n  if (Array.isArray(object)) {\n    if (Object.getPrototypeOf(object) !== Array.prototype) failData('array');\n    const lengthDescriptor = Object.getOwnPropertyDescriptor(object, 'length');\n    if (!lengthDescriptor || !('value' in lengthDescriptor) || typeof lengthDescriptor.value !== 'number') {\n      failData('array');\n    }\n    const length = lengthDescriptor.value;\n    if (!Number.isSafeInteger(length) || length < 0) failData('array');\n    if (length > budget.left) failSize();\n    spend(budget, 2);\n    if (length > 1) spend(budget, length - 1);\n    ancestors.add(object);\n    const items: RpcJson[] = new Array(length);\n    let count = 0;\n    for (const key of Reflect.ownKeys(object)) {\n      if (key === 'length') continue;\n      if (typeof key !== 'string' || !isArrayIndex(key, length)) failData('array');\n      const descriptor = Object.getOwnPropertyDescriptor(object, key);\n      if (!descriptor || !descriptor.enumerable || !('value' in descriptor)) failData('array');\n      items[Number(key)] = snapshot(descriptor.value, nextDepth, ancestors, budget);\n      count += 1;\n    }\n    if (count !== length) failData('array');\n    ancestors.delete(object);\n    return items;\n  }\n  const prototype = Object.getPrototypeOf(object);\n  if (prototype !== Object.prototype && prototype !== null) failData('object');\n  const keys = Reflect.ownKeys(object);\n  if (keys.length > budget.left) failSize();\n  spend(budget, 2);\n  if (keys.length > 1) spend(budget, keys.length - 1);\n  ancestors.add(object);\n  const result: Record<string, RpcJson> = {};\n  for (const key of keys) {\n    if (typeof key !== 'string') failData('object');\n    if (hasLoneSurrogate(key)) failData('object');\n    const descriptor = Object.getOwnPropertyDescriptor(object, key);\n    if (!descriptor || !descriptor.enumerable || !('value' in descriptor)) failData('object');\n    spend(budget, Buffer.byteLength(key, 'utf8') + 3);\n    // defineProperty keeps a literal `__proto__` key an own data property instead of polluting the prototype.\n    Object.defineProperty(result, key, {\n      value: snapshot(descriptor.value, nextDepth, ancestors, budget),\n      enumerable: true,\n      writable: true,\n      configurable: true,\n    });\n  }\n  ancestors.delete(object);\n  return result;\n}\n\n/** Clones a contract/schema input as bounded pure JSON, mapping pure-JSON errors to invalid_contract. */\nfunction snapshotPureInput(input: unknown): RpcJson {\n  try {\n    const pure = snapshot(input, 0, new Set(), { left: RPC_CONTRACT_MAX_BYTES });\n    if (Buffer.byteLength(JSON.stringify(pure), 'utf8') > RPC_CONTRACT_MAX_BYTES) failContract('input must be bounded pure JSON data');\n    return pure;\n  } catch (error) {\n    if (error instanceof RpcProtocolError && (error.code === 'invalid_data' || error.code === 'size_limit')) {\n      failContract('input must be bounded pure JSON data');\n    }\n    throw error;\n  }\n}\n\n/** Strict scanner: rejects duplicate keys, trailing content, and deep nesting. */\nfunction scanJson(text: string): void {\n  let index = 0;\n  const numberPattern = /-?(?:0|[1-9]\\d*)(?:\\.\\d+)?(?:[eE][+-]?\\d+)?/y;\n  const fail = (): never => {\n    throw new RpcProtocolError('invalid_data', 'invalid JSON text');\n  };\n  const whitespace = (): void => {\n    while (index < text.length) {\n      const character = text[index];\n      if (character === ' ' || character === '\\t' || character === '\\n' || character === '\\r') index += 1;\n      else break;\n    }\n  };\n  const string = (): string => {\n    if (text[index] !== '\"') return fail();\n    const start = index;\n    index += 1;\n    while (index < text.length) {\n      const character = text[index];\n      if (character === '\"') {\n        index += 1;\n        try {\n          const value: unknown = JSON.parse(text.slice(start, index));\n          if (typeof value !== 'string') return fail();\n          return value;\n        } catch (error) {\n          if (error instanceof RpcProtocolError) throw error;\n          return fail();\n        }\n      }\n      if (character === undefined) return fail();\n      if (character.charCodeAt(0) < 0x20) return fail();\n      if (character === '\\\\') {\n        index += 1;\n        const escape = text[index];\n        if (escape === 'u') {\n          if (!/^[0-9a-fA-F]{4}$/.test(text.slice(index + 1, index + 5))) return fail();\n          index += 5;\n          continue;\n        }\n        if (escape === undefined || !'\"\\\\/bfnrt'.includes(escape)) return fail();\n        index += 1;\n        continue;\n      }\n      index += 1;\n    }\n    return fail();\n  };\n  const value = (depth: number): void => {\n    whitespace();\n    const character = text[index];\n    if (character === '{') {\n      if (depth >= JSON_MAX_DEPTH) return fail();\n      index += 1;\n      whitespace();\n      const keys = new Set<string>();\n      if (text[index] === '}') {\n        index += 1;\n        return;\n      }\n      while (true) {\n        whitespace();\n        const key = string();\n        if (keys.has(key)) return fail();\n        keys.add(key);\n        whitespace();\n        if (text[index] !== ':') return fail();\n        index += 1;\n        value(depth + 1);\n        whitespace();\n        if (text[index] === '}') {\n          index += 1;\n          return;\n        }\n        if (text[index] !== ',') return fail();\n        index += 1;\n      }\n    }\n    if (character === '[') {\n      if (depth >= JSON_MAX_DEPTH) return fail();\n      index += 1;\n      whitespace();\n      if (text[index] === ']') {\n        index += 1;\n        return;\n      }\n      while (true) {\n        value(depth + 1);\n        whitespace();\n        if (text[index] === ']') {\n          index += 1;\n          return;\n        }\n        if (text[index] !== ',') return fail();\n        index += 1;\n      }\n    }\n    if (character === '\"') {\n      string();\n      return;\n    }\n    if (text.startsWith('true', index)) {\n      index += 4;\n      return;\n    }\n    if (text.startsWith('false', index)) {\n      index += 5;\n      return;\n    }\n    if (text.startsWith('null', index)) {\n      index += 4;\n      return;\n    }\n    numberPattern.lastIndex = index;\n    const match = numberPattern.exec(text);\n    if (match === null) return fail();\n    index = numberPattern.lastIndex;\n  };\n  value(0);\n  whitespace();\n  if (index !== text.length) fail();\n}\n\n/** Rejects numbers that overflowed to Infinity and lone surrogates after parsing. */\nfunction assertJsonGraph(value: unknown): void {\n  const stack: unknown[] = [value];\n  while (stack.length > 0) {\n    const current = stack.pop();\n    if (typeof current === 'number') {\n      if (!Number.isFinite(current)) failData('json');\n      continue;\n    }\n    if (typeof current === 'string') {\n      if (hasLoneSurrogate(current)) failData('string');\n      continue;\n    }\n    if (Array.isArray(current)) {\n      for (const item of current) stack.push(item);\n      continue;\n    }\n    if (current !== null && typeof current === 'object') {\n      for (const key of Object.keys(current)) {\n        if (hasLoneSurrogate(key)) failData('object');\n        stack.push((current as Record<string, unknown>)[key]);\n      }\n    }\n  }\n}\n\n/**\n * Serializes a pure-JSON value under a UTF-8 byte bound. Oversized values are\n * rejected by the running budget before a large clone is built. `maxBytes` may\n * be raised for independent, larger data channels; the default stays the control\n * envelope limit.\n */\nexport function encodeRpcJson(value: unknown, maxBytes: number = RPC_JSON_MAX_BYTES): string {\n  assertByteLimit(maxBytes);\n  const clone = snapshot(value, 0, new Set(), { left: maxBytes });\n  const text = JSON.stringify(clone);\n  if (typeof text !== 'string') failData('json');\n  if (Buffer.byteLength(text, 'utf8') > maxBytes) failSize();\n  return text;\n}\n\n/** Deterministic encoding for signed RPC metadata, retaining every legal JSON key. */\nexport function encodeCanonicalRpcJson(value: unknown, maxBytes: number = RPC_JSON_MAX_BYTES): string {\n  assertByteLimit(maxBytes);\n  const clone = snapshot(value, 0, new Set(), { left: maxBytes });\n  const canonical = (item: RpcJson): string => {\n    if (item === null || typeof item !== 'object') return JSON.stringify(item);\n    if (Array.isArray(item)) return `[${item.map(canonical).join(',')}]`;\n    const record = item as Readonly<Record<string, RpcJson>>;\n    return `{${Object.keys(record).sort().map(key => `${JSON.stringify(key)}:${canonical(record[key])}`).join(',')}}`;\n  };\n  const text = canonical(clone);\n  if (Buffer.byteLength(text, 'utf8') > maxBytes) failSize();\n  return text;\n}\n\n/** Parses strict, bounded pure JSON. Non-finite numbers and lone surrogates are rejected. */\nexport function decodeRpcJson(text: string, maxBytes: number = RPC_JSON_MAX_BYTES): RpcJson {\n  assertByteLimit(maxBytes);\n  if (typeof text !== 'string') failData('json');\n  if (Buffer.byteLength(text, 'utf8') > maxBytes) failSize();\n  scanJson(text);\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(text);\n  } catch {\n    throw new RpcProtocolError('invalid_data', 'invalid JSON text');\n  }\n  assertJsonGraph(parsed);\n  return parsed as RpcJson;\n}\n\nfunction jsonEquals(left: RpcJson, right: RpcJson): boolean {\n  if (left === right) return true;\n  if (typeof left !== typeof right) return false;\n  if (Array.isArray(left) !== Array.isArray(right)) return false;\n  if (Array.isArray(left)) {\n    if (!Array.isArray(right) || left.length !== right.length) return false;\n    for (let index = 0; index < left.length; index += 1) {\n      if (!jsonEquals(left[index], right[index])) return false;\n    }\n    return true;\n  }\n  if (typeof left === 'object' && left !== null && right !== null && typeof right === 'object') {\n    const leftRecord = left as Record<string, RpcJson>;\n    const rightRecord = right as Record<string, RpcJson>;\n    const keys = Object.keys(leftRecord);\n    if (keys.length !== Object.keys(rightRecord).length) return false;\n    for (const key of keys) {\n      if (!Object.prototype.hasOwnProperty.call(rightRecord, key)) return false;\n      if (!jsonEquals(leftRecord[key], rightRecord[key])) return false;\n    }\n    return true;\n  }\n  return false;\n}\n\nfunction checkOptionalNonNegative(value: unknown, field: string): number | undefined {\n  if (value === undefined) return undefined;\n  if (!isNonNegativeSafeInteger(value)) failContract(`${field} must be a non-negative safe integer`);\n  return value;\n}\n\nfunction checkOptionalFinite(value: unknown, field: string): number | undefined {\n  if (value === undefined) return undefined;\n  if (typeof value !== 'number' || !Number.isFinite(value)) failContract(`${field} must be a finite number`);\n  return value;\n}\n\nfunction checkSchema(input: unknown, depth: number, seen: Set<object>): void {\n  if (depth > SCHEMA_MAX_DEPTH) failContract('schema nesting exceeds the limit');\n  if (!isPlainObject(input)) failContract('schema must be a plain object');\n  if (seen.has(input)) failContract('schema must not contain cycles');\n  seen.add(input);\n  const type = input.type;\n  if (type === 'string') {\n    assertKnownKeys(input, ['type', 'minLength', 'maxLength'], 'schema');\n    const min = checkOptionalNonNegative(input.minLength, 'minLength');\n    const max = checkOptionalNonNegative(input.maxLength, 'maxLength');\n    if (min !== undefined && max !== undefined && min > max) failContract('string minLength must not exceed maxLength');\n  } else if (type === 'number') {\n    assertKnownKeys(input, ['type', 'integer', 'minimum', 'maximum'], 'schema');\n    if (input.integer !== undefined && typeof input.integer !== 'boolean') failContract('number integer flag must be boolean');\n    const min = checkOptionalFinite(input.minimum, 'minimum');\n    const max = checkOptionalFinite(input.maximum, 'maximum');\n    if (min !== undefined && max !== undefined && min > max) failContract('number minimum must not exceed maximum');\n  } else if (type === 'boolean') {\n    assertKnownKeys(input, ['type'], 'schema');\n  } else if (type === 'null') {\n    assertKnownKeys(input, ['type'], 'schema');\n  } else if (type === 'literal') {\n    assertKnownKeys(input, ['type', 'value'], 'schema');\n    if (!Object.prototype.hasOwnProperty.call(input, 'value')) failContract('literal schema requires a value');\n    try {\n      snapshot(input.value, 0, new Set(), { left: Infinity });\n    } catch (error) {\n      if (error instanceof RpcProtocolError && error.code === 'invalid_data') {\n        failContract('literal value must be pure JSON');\n      }\n      throw error;\n    }\n  } else if (type === 'array') {\n    assertKnownKeys(input, ['type', 'items', 'maxItems'], 'schema');\n    if (!Object.prototype.hasOwnProperty.call(input, 'items')) failContract('array schema requires items');\n    checkSchema(input.items, depth + 1, seen);\n    checkOptionalNonNegative(input.maxItems, 'maxItems');\n  } else if (type === 'object') {\n    assertKnownKeys(input, ['type', 'properties', 'optional'], 'schema');\n    const properties = input.properties;\n    if (!isPlainObject(properties)) failContract('object schema requires a properties record');\n    for (const key of Object.keys(properties)) checkSchema(properties[key], depth + 1, seen);\n    const optional = input.optional;\n    if (optional !== undefined) {\n      if (!Array.isArray(optional)) failContract('object optional must be an array of field names');\n      const names = new Set<string>();\n      for (const name of optional) {\n        if (typeof name !== 'string') failContract('object optional entries must be strings');\n        if (names.has(name)) failContract('object optional entries must be unique');\n        names.add(name);\n        if (!Object.prototype.hasOwnProperty.call(properties, name)) {\n          failContract('object optional names must exist in properties');\n        }\n      }\n    }\n  } else if (type === 'record') {\n    assertKnownKeys(input, ['type', 'values', 'maxEntries'], 'schema');\n    if (!Object.prototype.hasOwnProperty.call(input, 'values')) failContract('record schema requires values');\n    checkSchema(input.values, depth + 1, seen);\n    checkOptionalNonNegative(input.maxEntries, 'maxEntries');\n  } else if (type === 'union') {\n    assertKnownKeys(input, ['type', 'variants'], 'schema');\n    const variants = input.variants;\n    if (!Array.isArray(variants) || variants.length === 0) {\n      failContract('union schema requires a non-empty variants array');\n    }\n    for (const variant of variants) checkSchema(variant, depth + 1, seen);\n  } else if (type === 'json') {\n    assertKnownKeys(input, ['type', 'maxBytes'], 'schema');\n    if (input.maxBytes !== undefined && !isPositiveSafeInteger(input.maxBytes)) {\n      failContract('json schema maxBytes must be a positive safe integer');\n    }\n  } else {\n    failContract('unknown schema type');\n  }\n  seen.delete(input);\n}\n\nfunction validateValue(schema: RpcDataSchema, value: unknown): void {\n  switch (schema.type) {\n    case 'string': {\n      if (typeof value !== 'string') failData('string');\n      if (schema.minLength !== undefined && value.length < schema.minLength) failData('string');\n      if (schema.maxLength !== undefined && value.length > schema.maxLength) failData('string');\n      return;\n    }\n    case 'number': {\n      if (typeof value !== 'number' || !Number.isFinite(value)) failData('number');\n      if (schema.integer === true && !Number.isInteger(value)) failData('number');\n      if (schema.minimum !== undefined && value < schema.minimum) failData('number');\n      if (schema.maximum !== undefined && value > schema.maximum) failData('number');\n      return;\n    }\n    case 'boolean': {\n      if (typeof value !== 'boolean') failData('boolean');\n      return;\n    }\n    case 'null': {\n      if (value !== null) failData('null');\n      return;\n    }\n    case 'literal': {\n      if (!jsonEquals(schema.value, value as RpcJson)) failData('literal');\n      return;\n    }\n    case 'array': {\n      if (!Array.isArray(value)) failData('array');\n      if (schema.maxItems !== undefined && value.length > schema.maxItems) failData('array');\n      for (const item of value) validateValue(schema.items, item);\n      return;\n    }\n    case 'object': {\n      if (!isPlainObject(value)) failData('object');\n      const optional = new Set(schema.optional ?? []);\n      for (const key of Object.keys(value)) {\n        if (!Object.prototype.hasOwnProperty.call(schema.properties, key)) failData('object');\n      }\n      for (const key of Object.keys(schema.properties)) {\n        if (!Object.prototype.hasOwnProperty.call(value, key)) {\n          if (!optional.has(key)) failData('object');\n          continue;\n        }\n        validateValue(schema.properties[key], value[key]);\n      }\n      return;\n    }\n    case 'record': {\n      if (!isPlainObject(value)) failData('record');\n      const keys = Object.keys(value);\n      if (schema.maxEntries !== undefined && keys.length > schema.maxEntries) failData('record');\n      for (const key of keys) validateValue(schema.values, value[key]);\n      return;\n    }\n    case 'union': {\n      for (const variant of schema.variants) {\n        try {\n          validateValue(variant, value);\n          return;\n        } catch (error) {\n          if (!(error instanceof RpcProtocolError) || error.code !== 'invalid_data') throw error;\n        }\n      }\n      failData('union');\n    }\n    case 'json': {\n      const maxBytes = schema.maxBytes ?? RPC_JSON_MAX_BYTES;\n      const text = JSON.stringify(value);\n      if (typeof text !== 'string' || Buffer.byteLength(text, 'utf8') > maxBytes) failData('json');\n      return;\n    }\n  }\n}\n\n/**\n * Asserts a runtime value matches the schema. The whole value is first cloned\n * into bounded pure JSON without invoking accessors, then validated. Throws\n * `RpcProtocolError` with `invalid_data` (value) or `invalid_contract` (malformed\n * schema).\n */\n/** Validates a standalone data schema (lane contract registration) without a value. */\nexport function assertRpcDataSchema(schema: RpcDataSchema): void {\n  const pure = snapshotPureInput(schema);\n  checkSchema(pure, 0, new Set());\n}\n\nexport function assertRpcData<S extends RpcDataSchema>(\n  schema: S,\n  value: unknown,\n  maxBytes?: number,\n): asserts value is InferRpcData<S> {  const pureSchema = snapshotPureInput(schema);\n  checkSchema(pureSchema, 0, new Set());\n  const checkedSchema = pureSchema as unknown as RpcDataSchema;\n  const limit = maxBytes ?? (checkedSchema.type === 'json' ? checkedSchema.maxBytes ?? RPC_JSON_MAX_BYTES : RPC_JSON_MAX_BYTES);\n  assertByteLimit(limit);\n  let pureValue: RpcJson;\n  try { pureValue = snapshot(value, 0, new Set(), { left: limit }); }\n  catch (error) {\n    if (error instanceof RpcProtocolError && error.code === 'size_limit') failData('json');\n    throw error;\n  }\n  if (Buffer.byteLength(JSON.stringify(pureValue), 'utf8') > limit) failData('json');\n  validateValue(checkedSchema, pureValue);\n}\n\nfunction assertByteLimit(maxBytes: number): void {\n  if (!isPositiveSafeInteger(maxBytes)) failContract('maxBytes must be a positive safe integer');\n}\n\nfunction checkByteLimit(value: unknown, field: string): number | undefined {\n  if (value === undefined) return undefined;\n  if (!isPositiveSafeInteger(value) || value > RPC_JSON_MAX_BYTES) {\n    failContract(`${field} must be a positive integer no larger than the RPC envelope`);\n  }\n  return value;\n}\n\nfunction checkCommandPolicy(policy: Record<string, unknown>, maxOutputBytes: number): void {\n  const keys = Object.keys(policy);\n  if (keys.length !== RPC_COMMAND_POLICY_KEYS.size || keys.some((key) => !RPC_COMMAND_POLICY_KEYS.has(key))) {\n    failContract('command policy fields are fixed');\n  }\n  const deduplication = policy.deduplication;\n  if (typeof deduplication !== 'string' || !RPC_COMMAND_DEDUPLICATION.has(deduplication as RpcCommandDeduplication)) {\n    failContract('invalid command deduplication');\n  }\n  const retention = policy.resultRetentionMs;\n  if (retention !== null && !isPositiveSafeInteger(retention)) {\n    failContract('resultRetentionMs must be a positive integer or null');\n  }\n  const maxResultBytes = policy.maxResultBytes;\n  if (!isPositiveSafeInteger(maxResultBytes)) failContract('maxResultBytes must be a positive safe integer');\n  if (maxResultBytes > maxOutputBytes) failContract('maxResultBytes must not exceed maxOutputBytes');\n  const quotaBytes = policy.quotaBytes;\n  if (!isPositiveSafeInteger(quotaBytes)) failContract('quotaBytes must be a positive safe integer');\n  if (quotaBytes < maxResultBytes) failContract('quotaBytes must be able to hold maxResultBytes');\n}\n\nfunction checkMethod(definition: Record<string, unknown>): void {\n  assertKnownKeys(definition, METHOD_KEYS, 'method');\n  const kind = definition.kind;\n  if (kind !== 'query' && kind !== 'command') failContract('method kind must be query or command');\n  checkSchema(definition.input, 0, new Set());\n  checkSchema(definition.output, 0, new Set());\n  const purposes = definition.purposes;\n  if (!Array.isArray(purposes) || purposes.length === 0) failContract('purposes must be a non-empty array');\n  const seenPurposes = new Set<string>();\n  for (const purpose of purposes) {\n    if (typeof purpose !== 'string' || !RPC_CALL_PURPOSES.has(purpose as RpcCallPurpose)) failContract('invalid purpose');\n    if (seenPurposes.has(purpose)) failContract('purposes must be unique');\n    seenPurposes.add(purpose);\n  }\n  if (definition.timeoutMs !== undefined) {\n    if (!isPositiveSafeInteger(definition.timeoutMs) || definition.timeoutMs > RPC_MAX_TIMEOUT_MS) {\n      failContract('timeoutMs must be a positive integer no larger than the timeout bound');\n    }\n  }\n  checkByteLimit(definition.maxInputBytes, 'maxInputBytes');\n  const maxOutputBytes = checkByteLimit(definition.maxOutputBytes, 'maxOutputBytes');\n  const command = definition.command;\n  if (kind === 'command') {\n    if (!isPlainObject(command)) failContract('command methods require an explicit command policy');\n    checkCommandPolicy(command, maxOutputBytes ?? RPC_JSON_MAX_BYTES);\n  } else if (command !== undefined) {\n    failContract('query methods must not declare a command policy');\n  }\n}\n\nfunction checkContract(contract: unknown): void {\n  if (!isPlainObject(contract)) failContract('contract must be a plain object');\n  assertKnownKeys(contract, CONTRACT_KEYS, 'contract');\n  if (typeof contract.id !== 'string' || !RPC_SERVICE_ID.test(contract.id)) failContract('invalid service id');\n  if (!isPositiveSafeInteger(contract.version)) failContract('service version must be a positive safe integer');\n  const methods = contract.methods;\n  if (!isPlainObject(methods)) failContract('methods must be a plain object');\n  const names = Object.keys(methods);\n  if (names.length === 0) failContract('service must declare at least one method');\n  if (names.length > RPC_MAX_METHODS) failContract('service declares too many methods');\n  for (const name of names) {\n    if (!RPC_METHOD_NAME.test(name)) failContract('invalid method name');\n    const definition = methods[name];\n    if (!isPlainObject(definition)) failContract('method definition must be a plain object');\n    checkMethod(definition);\n  }\n}\n\nfunction deepFreeze(value: unknown): unknown {\n  if (Array.isArray(value)) {\n    for (const item of value) deepFreeze(item);\n    return Object.freeze(value);\n  }\n  if (isPlainObject(value)) {\n    for (const key of Object.keys(value)) deepFreeze(value[key]);\n    return Object.freeze(value);\n  }\n  return value;\n}\n\n/**\n * Validates a service contract and returns a deep-frozen pure clone. The caller's\n * objects are never read through accessors, never frozen, and never modified;\n * `methods` keeps its literal types so clients can derive call signatures.\n */\nexport function defineRpcService<const M extends Record<string, RpcMethodDefinition>>(contract: {\n  readonly id: string;\n  readonly version: number;\n  readonly methods: M;\n}): RpcServiceContract<M> {\n  const pure = snapshotPureInput(contract);\n  checkContract(pure);\n  return deepFreeze(pure) as unknown as RpcServiceContract<M>;\n}\n",
@@ -17,7 +20,7 @@
     "/** Declarative repair request; the host owns the next upstream attempt. */\nconst retryActionBrand=Symbol.for('@jeffusion/bungee/request-retry-action');\nexport class RequestRetryAction extends Error {\n  readonly body:unknown;\n  constructor(body: unknown, readonly reason: string) {\n    super('gateway request repair retry');\n    this.name = 'RequestRetryAction';\n    Object.defineProperty(this,retryActionBrand,{value:true});\n    Object.defineProperty(this,'body',{value:body,enumerable:false});\n  }\n  /** Plugins and host may bundle the SDK independently in the same process. */\n  static [Symbol.hasInstance](value:unknown):boolean {\n    return value instanceof Error && (value as unknown as Record<symbol,unknown>)[retryActionBrand]===true;\n  }\n}\n",
     "import type { TokenStatsRange } from './plugin.types';\n\nconst HOUR = 3_600_000;\nexport const TOKEN_STATS_RETENTION_MS = 31 * 24 * HOUR;\nexport const TOKEN_STATS_RANGES = ['1h', '12h', '24h', '1d', '7d', '30d', 'day', 'week', 'month'] as const;\n\n/** Recent page ranges are consecutive elapsed hours; calendar ranges use local dates. */\nexport function tokenStatsWindow(range: TokenStatsRange, asOfMs: number, timeZone = 'UTC') {\n  if (range === '1h' || range === '12h' || range === '24h') {\n    const duration = { '1h': HOUR, '12h': 12 * HOUR, '24h': 24 * HOUR };\n    const bucketMs = { '1h': 300_000, '12h': HOUR, '24h': 2 * HOUR }[range];\n    return { startMs: asOfMs - duration[range], endMs: asOfMs, bucketMs };\n  }\n  if (range === '1d' || range === '7d' || range === '30d') {\n    const days = { '1d': 1, '7d': 7, '30d': 30 }[range];\n    const bucketMs = range === '1d' ? HOUR : 24 * HOUR;\n    const startMs = asOfMs - days * 24 * HOUR;\n    const bucketStarts = Array.from({ length: range === '1d' ? 24 : days }, (_, i) => startMs + i * bucketMs);\n    return { startMs, endMs: asOfMs, bucketMs, bucketStarts };\n  }\n  const format = new Intl.DateTimeFormat('en-US', {\n    timeZone, year: 'numeric', month: 'numeric', day: 'numeric',\n    hour: 'numeric', minute: 'numeric', second: 'numeric', hourCycle: 'h23',\n  });\n  const parts = (ms: number) => Object.fromEntries(format.formatToParts(ms)\n    .filter(part => part.type !== 'literal').map(part => [part.type, Number(part.value)]));\n  const today = parts(asOfMs);\n  const day = Date.UTC(today.year!, today.month! - 1, today.day!);\n  // Resolve each local midnight separately so DST days can contain 23 or 25 hours.\n  const midnight = (date: number) => {\n    let candidate = date;\n    for (let i = 0; i < 4; i++) {\n      const p = parts(candidate);\n      const local = Date.UTC(p.year!, p.month! - 1, p.day!, p.hour!, p.minute!, p.second!);\n      const next = candidate + date - local;\n      if (next === candidate) return candidate;\n      candidate = next;\n    }\n    return candidate;\n  };\n  if (range === 'day') {\n    const startMs = midnight(day);\n    const bucketEndMs = midnight(day + 24 * HOUR);\n    const bucketStarts = Array.from({ length: Math.ceil((bucketEndMs - startMs) / HOUR) }, (_, i) => startMs + i * HOUR);\n    return { startMs, endMs: asOfMs, bucketMs: HOUR, bucketStarts, bucketEndMs };\n  }\n  const firstDay = range === 'month' ? Date.UTC(today.year!, today.month! - 1, 1)\n    : day - ((new Date(day).getUTCDay() + 6) % 7) * 24 * HOUR;\n  const nextPeriod = range === 'month' ? Date.UTC(today.year!, today.month!, 1) : firstDay + 7 * 24 * HOUR;\n  const days = (nextPeriod - firstDay) / (24 * HOUR);\n  const bucketStarts = Array.from({ length: days }, (_, i) => midnight(firstDay + i * 24 * HOUR));\n  return { startMs: bucketStarts[0]!, endMs: asOfMs, bucketMs: 24 * HOUR, bucketStarts, bucketEndMs: midnight(nextPeriod) };\n}\n"
   ],
-  "mappings": ";;AAAA;;;ACOA,IAAM,UAAU,OAAO,IAAI,mCAAmC;AAI9D,SAAS,YAAY,CAAC,WAAoB,CAAC,GAAkB;AAAA,EAC3D,MAAM,SAAS,CAAC,UACd,CAAC,OAAyB,YAAqB;AAAA,IAC7C,MAAM,OAAQ,WAAuC;AAAA,IACrD,IAAI,MAAM;AAAA,MACR,IAAI,OAAO,UAAU;AAAA,QAAU,KAAK,OAAO,UAAU,KAAK;AAAA,MACrD;AAAA,aAAK,OAAO,KAAI,aAAa,MAAK,GAAG,OAAO;AAAA,IACnD,EAAO,SAAI,UAAU,WAAW,QAAQ,IAAI,cAAc,SAAS;AAAA,MACjE,MAAM,QAAQ,UAAU,UAAU,QAAQ,QAAQ,QAAQ;AAAA,MAC1D,MAAM,YAAY,OAAO,UAAU,WAAW,QAAQ,KAAK,OAAO,UAAU,WAAW,WAAW,KAAI,aAAa,MAAK,CAAC;AAAA,IAC3H;AAAA;AAAA,EAEJ,OAAO;AAAA,IAAC,MAAM,OAAO,MAAM;AAAA,IAAG,MAAM,OAAO,MAAM;AAAA,IAAG,OAAO,OAAO,OAAO;AAAA,IAAG,OAAO,OAAO,OAAO;AAAA,IAC/F,OAAO,OAAO,OAAO;AAAA,IAAG,OAAO,WAAS,aAAa,KAAI,aAAa,MAAK,CAAC;AAAA,EAAC;AAAA;AAE1E,IAAM,SAAS,aAAa;;;ACd5B,IAAM,2BAA2B,OAAO,0BAA0B;;ACRlE,IAAM,sBAAqC,OAAO,OAAO,EAAC,QAAQ,aAAa,OAAO,IAAI,mBAAmB,EAAC,CAAC;;AC6B/G,SAAS,2BAA2B,CAAC,OAAoD;AAAA,EAC9F,OAAO,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS;AAAA;AAErE,IAAM,YAAY,OAAO;;ACZzB;;;AC+FO,IAAM,qBAAqB,KAAK;AAEhC,IAAM,yBAAyB,MAAM;AAQ5C,IAAM,oBAAoB,IAAI,IAAoB,CAAC,aAAa,cAAc,cAAc,WAAW,SAAS,CAAC;AACjH,IAAM,4BAA4B,IAAI,IAA6B,CAAC,qBAAqB,qBAAqB,MAAM,CAAC;AACrH,IAAM,0BAA0B,IAAI,IAAI,CAAC,iBAAiB,qBAAqB,cAAc,gBAAgB,CAAC;;;ACxF9G,IAAM,YAAY,IAAI,IAAY,CAAC,WAAW,UAAU,SAAS,CAAC;AAClE,IAAM,SAAS,IAAI,IAAY,CAAC,UAAU,SAAS,CAAC;AACpD,IAAM,WAAW,IAAI,IAAY,CAAC,aAAa,cAAc,cAAc,WAAW,SAAS,CAAC;AAqQhG,IAAM,YAAY,IAAI;AAEtB,IAAM,UAAU,IAAI;;;AFnOpB,IAAM,yBAA8D;AAAA,EAClE,cAAc;AAAA,EACd,WAAW;AAAA,EACX,SAAS;AAAA,EACT,SAAS;AAAA,EACT,oBAAoB;AAAA,EACpB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,SAAS;AAAA,EACT,SAAS;AAAA,EACT,wBAAwB;AAAA,EACxB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,SAAS;AAAA,EACT,SAAS;AAAA,EACT,UAAU;AAAA,EACV,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,UAAU;AAAA,EACV,qBAAqB;AAAA,EACrB,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,qBAAqB;AAAA,EACrB,sBAAsB;AACxB;AAEA,IAAM,sBAAsB,IAAI,IAAyB,OAAO,KAAK,sBAAsB,CAA0B;AAqSrH,IAAM,gBAAgC,OAAO,OAAO,CAAC,CAAC;AAWtD,IAAM,cAAc,IAAI;AA8CxB,IAAM,cAAc,IAAI;;AGhbjB,IAAM,4BAA4B,IAAI;AAEtC,IAAM,2BAA2B,KAAK;AAEtC,IAAM,0BAA0B,KAAK;AAiDrC,IAAM,uBAAqD,OAAO,OAAO,CAAC,SAAS,YAAY,QAAQ,CAAC;AA4F/G,IAAM,cAAc,IAAI,IAA4B;AAAA,EAClD;AAAA,EAAe;AAAA,EAAa;AAAA,EAAgB;AAAA,EAAW;AAAA,EAAc;AAAA,EACrE;AAAA,EAAY;AAAA,EAAO;AAAA,EAAa;AAAA,EAAY;AAAA,EAAa;AAAA,EAAU;AAAA,EAAW;AAChF,CAAC;AAuCD,IAAM,qBAAoB,IAAI,IAAoB,CAAC,aAAa,cAAc,cAAc,WAAW,SAAS,CAAC;;;ACtI1G,IAAM,oCAAoC,IAAI;AAE9C,IAAM,iCAAiC,KAAK;AAE5C,IAAM,iCAAiC,KAAK,OAAO;AAEnD,IAAM,kCAAkC,IAAI;AAG5C,IAAM,sCAAsC,IAAI;AAchD,IAAM,6BAA6B,KAAK,OAAO;AAQ/C,IAAM,kCAAkC,KAAK;AAGpD,IAAM,QAAQ,IAAI,WAAW,CAAC;AAqgB9B,IAAM,uBAAuB,IAAI;;;AC1lBjC,IAAM,sBAAsB,KAAK;AAQjC,IAAM,uBAAuB,IAAI;;;AClBjC,IAAM,gBAAgB,IAAI,IAAI,CAAC,UAAU,YAAY,QAAQ,CAAC;;ACrB9D,IAAM,mBAAiB,OAAO,IAAI,wCAAwC;;ACC1E,IAAM,OAAO;AACN,IAAM,2BAA2B,KAAK,KAAK;;AbQlD,IAAM,WAAW;AACjB,IAAM,SAAS;AACf,IAAM,yBAAkD,OAAO,OAAO,EAAE,oBAAoB,IAAI,wBAAwB,IAAI,CAAC;AAG7H,IAAM,uBAAuB,MAAM,KAAK,KAAK;AAC7C,IAAM,sBAAsB,KAAK,MAAM,OAAO,mBAAmB,KAAM;AACvE,IAAM,MAAM,CAAC,eAAe,gBAAgB,aAAa,aAAa,aAAa,cAAc,gBAAgB,kBAAkB,gBAAgB,aAAa,iBAAiB,aAAa;AAAA;AAC9L,MAAM,qBAAqB,MAAM;AAAA,EAAuB;AAAA,EAAuB;AAAA,EAA5C,WAAW,CAAU,MAAuB,SAAS,KAAK;AAAA,IAAE,MAAM,IAAI;AAAA,IAAjD;AAAA,IAAuB;AAAA;AAA+B;AAC9G,SAAS,IAAI,CAAC,MAAc,SAAS,KAAY;AAAA,EAAE,MAAM,IAAI,aAAa,MAAM,MAAM;AAAA;AACtF,SAAS,MAAM,CAAC,GAAqC;AAAA,EAAE,IAAI,CAAC,KAAK,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC;AAAA,IAAG,KAAK,eAAe;AAAA,EAAG,OAAO;AAAA;AAC1I,SAAS,KAAK,CAAC,GAA4B,QAAkB;AAAA,EAAE,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,OAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAAA,IAAG,KAAK,eAAe;AAAA;AACtI,SAAS,QAAQ,CAAC,GAAoB;AAAA,EAAE,IAAI,OAAO,MAAM,YAAY,CAAC,qCAAqC,KAAK,CAAC;AAAA,IAAG,KAAK,eAAe;AAAA,EAAG,OAAO,EAAE,YAAY;AAAA;AAChK,SAAS,QAAQ,CAAC,GAAoB;AAAA,EAAE,IAAI,OAAO,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS;AAAA,IAAI,KAAK,kBAAkB;AAAA,EAAG,OAAO;AAAA;AAC/I,SAAS,MAAM,CAAC,GAAmB;AAAA,EAAE,OAAO,WAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK;AAAA;AACvF,SAAS,IAAI,CAAC,OAAuB;AAAA,EAAE,OAAO,WAAW,UAAU,KAAK,EAAE,OAAO,wBAAwB,EAAE,OAAO,WAAW;AAAA;AAC7H,SAAS,QAAQ,CAAC,GAAW,GAAoB;AAAA,EAAE,MAAM,KAAK,OAAO,KAAK,CAAC,GAAG,KAAK,OAAO,KAAK,CAAC;AAAA,EAAG,OAAO,GAAG,WAAW,GAAG,UAAU,gBAAgB,IAAI,EAAE;AAAA;AAC3J,SAAS,GAAG,CAAC,GAAkB;AAAA,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,UAAU,wBAAwB,EAAE,UAAU;AAAA;AAC9G,SAAS,IAAI,CAAC,GAAY,SAAS,KAAK,UAAkC,CAAC,GAAa;AAAA,EAAE,OAAO,SAAS,KAAK,GAAG,EAAE,QAAQ,SAAS,EAAE,iBAAiB,eAAe,QAAQ,EAAE,CAAC;AAAA;AAClL,SAAS,IAAI,CAAC,OAA0B;AAAA,EAAE,OAAO,iBAAiB,eAAe,KAAK,EAAE,OAAO,MAAM,KAAK,GAAG,MAAM,MAAM,IAAI,KAAK,EAAE,OAAO,uBAAuB,GAAG,GAAG;AAAA;AACxK,eAAe,IAAI,CAAC,SAAoD;AAAA,EACtE,MAAM,SAAS,QAAQ,MAAM,UAAU;AAAA,EAAG,IAAI,CAAC;AAAA,IAAQ,KAAK,eAAe;AAAA,EAC3E,IAAI,OAAO;AAAA,EAAG,MAAM,SAAuB,CAAC;AAAA,EAC5C,IAAI;AAAA,IAAE,UAAS;AAAA,MAAE,MAAM,IAAI,MAAM,OAAO,KAAK;AAAA,MAAG,IAAI,EAAE;AAAA,QAAM;AAAA,MAAO,QAAQ,EAAE,MAAM;AAAA,MAAQ,IAAI,OAAO,MAAM;AAAA,QAAE,MAAM,OAAO,OAAO;AAAA,QAAG,KAAK,cAAc,GAAG;AAAA,MAAG;AAAA,MAAE,OAAO,KAAK,EAAE,KAAK;AAAA,IAAG;AAAA,YACtL;AAAA,IAAU,OAAO,YAAY;AAAA;AAAA,EAC7B,IAAI;AAAA,IAAE,OAAO,OAAO,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC,CAAC;AAAA,IAAK,OAAO,GAAG;AAAA,IAAE,IAAI,aAAa;AAAA,MAAc,MAAM;AAAA,IAAG,OAAO,KAAK,eAAe;AAAA;AAAA;AAE5J,SAAS,WAAW,CAAC,SAA6E;AAAA,EAChG,MAAM,OAAO,QAAQ,QAAQ,IAAI,eAAe;AAAA,EAChD,IAAI,SAAS,MAAM;AAAA,IAAE,MAAM,IAAI,+BAA+B,KAAK,IAAI;AAAA,IAAG,OAAO,IAAI,EAAE,OAAO,EAAE,IAAK,WAAW,SAAS,IAAI;AAAA,EAAM;AAAA,EACnI,MAAM,UAAU,QAAQ,QAAQ,IAAI,QAAQ,KAAK,IAAI,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,OAAO,OAAK,EAAE,WAAW,SAAS,GAAG,CAAC;AAAA,EACzH,IAAI,OAAO,WAAW;AAAA,IAAG,OAAO;AAAA,EAAM,MAAM,QAAQ,OAAO,GAAI,MAAM,OAAO,SAAS,CAAC;AAAA,EACtF,OAAO,sBAAsB,KAAK,KAAK,IAAI,EAAE,OAAO,WAAW,SAAS,IAAI;AAAA;AAE9E,SAAS,MAAM,CAAC,SAAkB,UAAmB;AAAA,EAAE,IAAI,QAAQ,QAAQ,IAAI,QAAQ,OAAO,YAAY,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,IAAS,KAAK,kBAAkB,GAAG;AAAA;AAClK,SAAS,MAAM,CAAC,SAAkB,OAAe,QAAgB,kBAA2B;AAAA,EAAE,OAAO,GAAG,UAAU,qDAAqD,SAAS,IAAI,IAAI,oBAAoB,QAAQ,GAAG,EAAE,aAAa,WAAW,aAAa;AAAA;AAE9P,SAAS,qBAAqB,CAAC,OAAgB,OAAO,0BAA0B,SAAS,KAAoB;AAAA,EAC3G,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK;AAAA,IAAG,KAAK,MAAM,MAAM;AAAA,EAClF,MAAM,IAAI;AAAA,EACV,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,SAAO,CAAC,CAAC,sBAAsB,wBAAwB,EAAE,SAAS,GAAG,CAAC,KACzF,CAAC,CAAC,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,OAAK,OAAO,cAAc,CAAC,KAAK,KAAK,KAAK,KAAK,mBAAmB;AAAA,IAAG,KAAK,MAAM,MAAM;AAAA,EACnJ,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,wBAAwB,EAAE,uBAAuB;AAAA;AAK/F,IAAM,wBAAwB;AAC9B,IAAM,eAAe;AAArB,IAA0B,eAAe;AAChD,IAAM,SAAS,CAAC,UAAmB;AACnC,SAAS,qBAAqB,CAAC,GAAwC;AAAA,EACrE,MAAM,IAAI;AAAA,EACV,IAAI,CAAC,KAAK,OAAO,EAAE,OAAO,YAAY,CAAC,EAAE,MAAM,OAAO,EAAE,aAAa,YAAY,CAAC,+BAA+B,KAAK,EAAE,QAAQ,KAAK,OAAO,EAAE,aAAa,aAAa,OAAO,EAAE,cAAc,aAAa,OAAO,EAAE,iBAAiB,YAAY,CAAC,EAAE,aAAa,WAAW,YAAY,KAAK,CAAC,OAAO,cAAc,EAAE,UAAU,KAAK,EAAE,aAAa,KAAK,CAAC,OAAO,cAAc,EAAE,YAAY,KAAK,EAAE,eAAe;AAAA,IAAG,KAAK,iBAAiB,GAAG;AAAA;AAEjb,SAAS,QAAQ,CAAC,OAAgB,OAAwB;AAAA,EACxD,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK;AAAA,IAAG,KAAK,iBAAiB,GAAG;AAAA,EAC1F,MAAM,IAAI;AAAA,EACV,IAAI,EAAE,WAAW,yBAAyB,CAAC,OAAO,OAAO,GAAG,KAAK,KAAK,OAAO,KAAK,CAAC,EAAE,KAAK,OAAK,MAAM,YAAY,MAAM,KAAK;AAAA,IAAG,KAAK,iBAAiB,GAAG;AAAA,EACxJ,OAAO,EAAE;AAAA;AAEX,SAAS,kBAAkB,CAAC,QAAoD;AAAA,EAC9E,IAAI,CAAC;AAAA,IAAQ,OAAO;AAAA,EACpB,MAAM,IAAI,SAAS,OAAO,OAAO,eAAe;AAAA,EAAG,IAAI,MAAM;AAAA,IAAM,sBAAsB,CAAC;AAAA,EAC1F,OAAO;AAAA;AAET,SAAS,eAAe,CAAC,OAAgC;AAAA,EACvD,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,MAAM,IAAI;AAAA,EACV,IAAI,CAAC,KAAK,CAAC,iBAAiB,KAAK,EAAE,MAAM,KAAK,OAAO,EAAE,oBAAoB,YAAY,CAAC,EAAE,mBAAmB,CAAC,OAAO,cAAc,EAAE,UAAU,KAAK,EAAE,aAAa,KAAK,CAAC,OAAO,SAAS,EAAE,OAAO,KAAK,CAAC,OAAO,SAAS,EAAE,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC,UAAU,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,IAAG,KAAK,iBAAiB,GAAG;AAAA,EACrU,IAAI,EAAE,WAAW;AAAA,IAAW,sBAAsB,EAAE,QAAQ,iBAAiB,GAAG;AAAA,EAChF,OAAO;AAAA;AAET,SAAS,eAAe,CAAC,OAAgC;AAAA,EACvD,IAAI,UAAU;AAAA,IAAM,OAAO;AAAA,EAC3B,MAAM,IAAI;AAAA,EACV,IAAI,CAAC,KAAK,OAAO,EAAE,QAAQ,YAAY,CAAC,kCAAkC,KAAK,EAAE,GAAG,KAAK,CAAC,OAAO,cAAc,EAAE,KAAK,KAAK,EAAE,QAAQ,KAAK,CAAC,OAAO,SAAS,EAAE,KAAK,KAAK,CAAC,OAAO,cAAc,EAAE,KAAK,KAAK,EAAE,QAAQ;AAAA,IAAG,KAAK,iBAAiB,GAAG;AAAA,EAC/O,OAAO;AAAA;AAET,SAAS,KAAkC,CAAC,SAAmC,MAAc,OAAe,UAA+C;AAAA,EACzJ,MAAM,SAAoB,MAAM,KAAK,EAAC,QAAQ,MAAK,GAAG,CAAC,GAAG,OAAO,EAAC,KAAK,GAAG,QAAQ,KAAK,SAAS,GAAG,OAAO,KAAI,EAAE;AAAA,EAChH,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,KAAK,QAAQ,OAAO,OAAK,EAAE,IAAI,WAAW,OAAO,GAAG,CAAC,GAAG;AAAA,IACjE,MAAM,QAAQ,OAAO,EAAE,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC;AAAA,IACjD,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,SAAS,SAAS,EAAE,QAAQ,GAAG,QAAQ;AAAA,MAAS,KAAK,iBAAiB,GAAG;AAAA,IACtH,MAAM,QAAQ,SAAS,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC9C,MAAM,WAAW,UAAU,SAAS,YAAa,MAAkB,SAAU,MAAkB;AAAA,IAC/F,IAAI,YAAY,KAAK,IAAI,QAAQ;AAAA,MAAG,KAAK,iBAAiB,GAAG;AAAA,IAAG,IAAI;AAAA,MAAU,KAAK,IAAI,QAAQ;AAAA,IAC/F,OAAO,SAAS,EAAC,KAAK,EAAE,KAAK,SAAS,EAAE,SAAS,MAAK;AAAA,EACxD;AAAA,EACA,OAAO;AAAA;AAET,IAAM,WAAW,CAAI,MAAe,OAAe,WAAsC,EAAC,KAAK,KAAK,KAAK,iBAAiB,KAAK,SAAS,OAAO,OAAO,EAAC,QAAQ,wBAAwB,QAAQ,MAAK,CAAC,EAAC;AACtM,SAAS,IAAI,CAAC,OAAuB;AAAA,EAAE,IAAI,CAAC,OAAO,cAAc,QAAQ,CAAC;AAAA,IAAG,KAAK,qBAAqB;AAAA,EAAG,OAAO,QAAQ;AAAA;AAAA;AAElH,MAAM,qBAAkE;AAAA,EAWhD;AAAA,EAA2C;AAAA,EAV/D,aAAa;AAAA,EACb,MAAM,CAAC;AAAA,EACP;AAAA,EACQ;AAAA,EACA;AAAA,EACA,WAAW,IAAI;AAAA,EAEf,eAAe,IAAI;AAAA,EAC5B,QAAQ;AAAA,EACR,WAAW;AAAA,EACnB,WAAW,CAAkB,MAA2C,eAA6B,CAAC,GAAG;AAAA,IAA5E;AAAA,IAA2C;AAAA,IACtE,IAAI,CAAC,KAAK;AAAA,MAAc,KAAK,0BAA0B,GAAG;AAAA,IAC1D,KAAK,QAAQ,KAAK;AAAA,IAAc,KAAK,MAAM,aAAa,OAAO,KAAK;AAAA,IACpE,MAAM,SAAS,CAAC,OAA2D,OAAO,MAAgC;AAAA,MAChH,IAAI;AAAA,QAAE,KAAK,MAAM;AAAA,QAAG,IAAI,EAAE,cAAc;AAAA,UAAS,KAAK,WAAW;AAAA,QAAG,OAAO,MAAM,GAAG,CAAC;AAAA,QAAK,OAAO,GAAG;AAAA,QAAE,OAAO,KAAK,CAAC;AAAA;AAAA;AAAA,IAErH,KAAK,MAAM;AAAA,MACT,EAAC,MAAM,aAAa,SAAS,CAAC,MAAM,GAAG,SAAS,kBAAkB,QAAQ,OAAO,OAAM,MAAK;AAAA,QAC1F,MAAM,KAAK,kBAAkB,GAAG,iBAAiB,IAAI;AAAA,QAAG,MAAM,IAAI,MAAM,KAAK,EAAE,OAAO;AAAA,QAAG,MAAM,GAAG,CAAC,mBAAmB,YAAY,sBAAsB,CAAC;AAAA,QACzJ,MAAM,KAAK,eAAe,GAAG,CAAC;AAAA,QAAG,OAAO,KAAK,EAAC,IAAI,KAAI,GAAG,KAAK,EAAC,cAAc,OAAO,EAAE,SAAS,IAAI,GAAG,KAAK,KAAK,gBAAgB,EAAC,CAAC;AAAA,OACnI,EAAC;AAAA,MACF,EAAC,MAAM,WAAW,SAAS,CAAC,MAAM,GAAG,SAAS,UAAU,QAAQ,OAAO,OAAM,MAAK;AAAA,QAAE,MAAM,KAAK,kBAAkB,GAAG,eAAe,IAAI;AAAA,QAAG,OAAO,KAAK,OAAO,EAAE,OAAO;AAAA,OAAI,EAAC;AAAA,MAC3K,EAAC,MAAM,SAAS,SAAS,CAAC,KAAK,GAAG,SAAS,QAAQ,QAAQ,OAAO,OAAM,MAAK;AAAA,QAC3E,MAAM,KAAK,kBAAkB,GAAG,eAAe;AAAA,QAAG,MAAM,KAAK,MAAM,KAAK,kBAAkB,GAAG;AAAA,QAAQ,MAAM,QAAQ,YAAY,EAAE,OAAO;AAAA,QACxI,OAAO,KAAK,EAAC,eAAe,IAAI,CAAC,MAAO,OAAO,cAAc,WAAW,EAAC,WAAW,KAAK,MAAM,KAAK,EAAC,IAAI,CAAC,EAAE,CAAC;AAAA,OAC9G,EAAC;AAAA,MACF,EAAC,MAAM,mBAAmB,SAAS,CAAC,OAAO,KAAK,GAAG,SAAS,iBAAiB,QAAQ,OAAO,OAAM,MAAK;AAAA,QACrG,MAAM,KAAK,kBAAkB,GAAG,gBAAgB,EAAE,QAAQ,WAAW,KAAK;AAAA,QAC1E,IAAI,EAAE,QAAQ,WAAW;AAAA,UAAO,OAAO,KAAK,MAAM,KAAK,kBAAkB,CAAC;AAAA,QAC1E,MAAM,IAAI,MAAM,KAAK,EAAE,OAAO;AAAA,QAAG,MAAM,GAAG,CAAC,WAAW,QAAQ,CAAC;AAAA,QAAG,IAAI,CAAC,OAAO,cAAc,EAAE,OAAO,KAAM,EAAE,UAAqB;AAAA,UAAG,KAAK,wBAAwB;AAAA,QAClK,MAAM,SAAS,sBAAsB,EAAE,MAAM;AAAA,QAAG,MAAM,KAAK,kBAAkB,GAAG,gBAAgB,IAAI;AAAA,QACpG,IAAI;AAAA,UAAE,MAAM,KAAK,MAAM,SAAS,CAAC,EAAC,KAAK,kBAAkB,iBAAiB,EAAE,SAAmB,OAAO,OAAO,MAAM,EAAC,CAAC,CAAC;AAAA,UACtH,OAAO,GAAG;AAAA,UAAE,IAAI,4BAA4B,CAAC;AAAA,YAAG,KAAK,oBAAoB,GAAG;AAAA,UAAG,MAAM;AAAA;AAAA,QACrF,OAAO,KAAK,MAAM,KAAK,kBAAkB,CAAC;AAAA,OAC3C,EAAC;AAAA,IACJ;AAAA;AAAA,EAEM,KAAK,GAAG;AAAA,IAAE,IAAI,KAAK,YAAY,KAAK,KAAK,OAAO;AAAA,MAAS,KAAK,wBAAwB,GAAG;AAAA;AAAA,OACnF,kBAAiB,GAAiC;AAAA,IAC9D,KAAK,MAAM;AAAA,IAAG,MAAM,SAAS,MAAM,KAAK,MAAM,IAAI,eAAe;AAAA,IAAG,OAAO,EAAC,KAAK,iBAAiB,SAAS,QAAQ,WAAW,GAAG,OAAO,mBAAmB,MAAM,EAAC;AAAA;AAAA,OAEtJ,QAAO,GAAG;AAAA,IACtB,KAAK,MAAM;AAAA,IAAG,MAAM,UAAU,MAAM,KAAK,MAAM,KAAK;AAAA,IAEpD,WAAW,KAAK;AAAA,MAAS,IAAI,CAAC,CAAC,iBAAiB,kBAAkB,kBAAkB,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,WAAW,UAAU,KAAK,CAAC,EAAE,IAAI,WAAW,UAAU;AAAA,QAAG,KAAK,8BAA8B,GAAG;AAAA,IAC/M,OAAO;AAAA;AAAA,OAEK,MAAQ,CAAC,MAA4E;AAAA,IACjG,SAAS,IAAI,EAAG,IAAI,IAAI,KAAK;AAAA,MAC3B,QAAO,WAAW,WAAU,MAAM,KAAK;AAAA,MAAG,IAAI,CAAC,UAAU;AAAA,QAAQ,OAAO;AAAA,MACxE,KAAK,MAAM;AAAA,MAAG,IAAI;AAAA,QAAE,MAAM,KAAK,MAAM,SAAS,SAAS;AAAA,QAAG,OAAO;AAAA,QAAU,OAAO,GAAG;AAAA,QAAE,IAAI,CAAC,4BAA4B,CAAC;AAAA,UAAG,MAAM;AAAA;AAAA,IACpI;AAAA,IACA,OAAO,KAAK,oBAAoB,GAAG;AAAA;AAAA,OAEvB,kBAAiB,GAAsD;AAAA,IACnF,KAAK,MAAM;AAAA,IAAG,MAAM,SAAS,MAAM,KAAK,MAAM,IAAI,gBAAgB;AAAA,IAClE,OAAO,EAAC,SAAS,QAAQ,WAAW,GAAG,QAAQ,SAAS,sBAAsB,OAAO,OAAO,iBAAiB,GAAG,IAAI,KAAI,uBAAsB,EAAC;AAAA;AAAA,OAE3I,MAAK,GAAG;AAAA,IACZ,MAAM,KAAK,kBAAkB;AAAA,IAAG,MAAM,KAAK,kBAAkB;AAAA,IAAG,MAAM,UAAU,MAAM,KAAK,QAAQ;AAAA,IACnG,MAAM,SAAS,WAAW,cAAc,eAAe;AAAA,IAAG,MAAM,SAAS,WAAW,cAAc,eAAe;AAAA,IACjH,KAAK,QAAQ,MAAM,KAAK,KAAK,YAAY,EAAE,EAAE,SAAS,WAAW,CAAC;AAAA;AAAA,EAEpE,OAAO,GAAG;AAAA,IAAE,KAAK,WAAW;AAAA;AAAA,EACpB,IAAI,CAAC,GAAW;AAAA,IAAE,OAAO,IAAI,SAAS,KAAK,GAAG,EAAC,WAAW,YAAY,YAAY,OAAO,UAAU,EAAC,CAAC;AAAA;AAAA,OACvG,YAAW,GAAG;AAAA,IAAE,MAAM,KAAK,MAAM,KAAK,kBAAkB,GAAG;AAAA,IAAO,OAAO,CAAC,CAAC,KAAK,CAAC,EAAE;AAAA;AAAA,OACnF,eAAc,GAAG;AAAA,IAAE,MAAM,KAAK,MAAM,YAAY;AAAA,MAAE,MAAM,IAAI,MAAM,KAAK,kBAAkB;AAAA,MAAG,OAAO,EAAC,WAAW,EAAE,QAAQ,CAAC,SAAS,GAAG,iBAAiB,KAAI,EAAE,OAAO,YAAY,KAAK,EAAE,MAAM,UAAU,EAAC,CAAC,CAAC,IAAI,CAAC,GAAG,QAAQ,UAAS;AAAA,KAAI;AAAA;AAAA,OACvO,UAAS,CAAC,OAAgB;AAAA,IAC9B,MAAM,IAAI,OAAO,KAAK;AAAA,IAAG,MAAM,GAAG,CAAC,YAAY,YAAY,sBAAsB,CAAC;AAAA,IAAG,MAAM,OAAO,SAAS,EAAE,QAAQ,GAAG,IAAI,SAAS,EAAE,QAAQ;AAAA,IAC/I,IAAI,EAAE,yBAAyB;AAAA,MAAG,KAAK,uBAAuB;AAAA,IAAG,MAAM,KAAK,QAAQ;AAAA,IACpF,MAAM,SAAS,MAAM,KAAK,kBAAkB,GAAG;AAAA,IAC/C,IAAI,OAAO;AAAA,MACT,IAAI,MAAM,aAAa,QAAQ,MAAM,YAAY,CAAC,MAAM,IAAI,SAAS,OAAO,GAAG,MAAM,YAAY;AAAA,QAAG,KAAK,uBAAuB,GAAG;AAAA,MACnI,MAAM,UAAU,MAAM,KAAK,kBAAkB,GAAG;AAAA,MAAO,IAAI,CAAC,UAAU,OAAO,eAAe,MAAM,cAAc,OAAO;AAAA,QAAU,KAAK,uBAAuB,GAAG;AAAA,MAAG;AAAA,IACrK;AAAA,IACA,MAAM,SAAS,MAAM,KAAK,KAAK,CAAC;AAAA,IAChC,MAAM,KAAK,MAAM,YAAY;AAAA,MAAE,MAAM,IAAI,MAAM,KAAK,kBAAkB;AAAA,MAAG,IAAI,EAAE;AAAA,QAAO,KAAK,sBAAsB,GAAG;AAAA,MAClH,OAAO,EAAC,WAAW,CAAC,SAAS,GAAG,iBAAiB,EAAC,IAAI,WAAW,GAAG,UAAU,MAAM,UAAU,OAAO,WAAW,OAAO,cAAc,QAAQ,YAAY,GAAG,cAAc,EAAC,CAAC,CAAC,GAAG,QAAQ,UAAS;AAAA,KAAI;AAAA;AAAA,EAEjM,IAAI,CAAC,GAAyB,SAA6C;AAAA,IACjF,MAAM,MAAM,KAAK,IAAI,GAAG,SAAS,QAAQ,UAAU;AAAA,IACnD,IAAI,MAAM,QAAQ,WAAW,MAAM,QAAQ,WAAY,OAAO,qBAAqB,KAAK,MAAM,QAAQ,WAAW,OAAO,qBAAqB,SAAY,OAAO,yBAAyB,KAAK,MAAM,QAAQ,WAAW,OAAO,yBAAyB;AAAA,MAAS;AAAA,IAChQ,OAAO,KAAK,EAAE,OAAO,QAAQ,mBAAmB,CAAC,EAAE,YAAY,EAAE,eAAe,QAAQ,aAAa,IAAI;AAAA;AAAA,OAE7F,YAAW,CAAC,GAA+C;AAAA,IACvE,KAAK,MAAM;AAAA,IAAG,MAAM,MAAM,KAAK,aAAa,IAAI,CAAC;AAAA,IACjD,IAAI,KAAK;AAAA,MACP,MAAM,SAAS,MAAM,KAAK,MAAM,IAAI,GAAG,GAAG,QAAQ,UAAU,gBAAgB,SAAS,OAAO,OAAO,SAAS,CAAC;AAAA,MAC7G,IAAI,UAAU,OAAO,WAAW;AAAA,QAAG,OAAO,EAAC,KAAK,SAAS,OAAO,SAAS,MAAK;AAAA,MAC9E,KAAK,aAAa,OAAO,CAAC;AAAA,IAC5B;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,KAAK,QAAQ,GAAG,WAAW,cAAc,eAAe,EAAE,KAAK,OAAK,EAAE,OAAO,WAAW,CAAC;AAAA,IACnH,IAAI,OAAO;AAAA,MAAE,IAAI,KAAK,aAAa,QAAQ;AAAA,QAAc,KAAK,aAAa,MAAM;AAAA,MAAG,KAAK,aAAa,IAAI,GAAG,MAAM,GAAG;AAAA,IAAG;AAAA,IACzH,OAAO;AAAA;AAAA,EAED,SAAS,CAAC,QAAuB,YAAY,GAAW;AAAA,IAAE,OAAO,OAAO,2BAA2B,IAAI,uBAAuB,KAAK,IAAI,GAAG,KAAK,IAAI,sBAAsB,KAAK,OAAO,OAAO,yBAAyB,QAAS,aAAa,IAAI,CAAC,CAAC;AAAA;AAAA,OACnP,cAAa,CAAC,SAA+C;AAAA,IACjE,KAAK,MAAM;AAAA,IAAG,MAAM,QAAQ,YAAY,OAAO;AAAA,IAAG,IAAI,OAAO,cAAc;AAAA,MAAU;AAAA,IACrF,MAAM,OAAO,MAAM,KAAK,YAAY,OAAO,MAAM,KAAK,CAAC,GAAG,KAAK,MAAM,KAAK,kBAAkB,GAAG,OAAO,UAAU,MAAM;AAAA,IACtH,IAAI,CAAC,WAAW,QAAQ,cAAc,YAAY,CAAC,KAAK,KAAK,GAAG,OAAO;AAAA,MAAG;AAAA,IAC1E,OAAO,OAAO,SAAS,MAAM,OAAO,KAAK,UAAU,QAAQ,UAAU,wBAAwB,KAAK,IAAI,IAAI,QAAQ,OAAO,GAAG,KAAK,KAAK,gBAAgB;AAAA;AAAA,OAElJ,aAAY,CAAC,SAAqD;AAAA,IACtE,KAAK,MAAM;AAAA,IAAG,MAAM,IAAI,YAAY,OAAO;AAAA,IAAG,IAAI,CAAC;AAAA,MAAG,OAAO;AAAA,IAC7D,MAAM,gBAAgB,MAAM,KAAK,MAAM,YAAY;AAAA,MACjD,MAAM,OAAO,MAAM,KAAK,YAAY,OAAO,EAAE,KAAK,CAAC,GAAG,KAAK,MAAM,KAAK,kBAAkB,GAAG,OAAO,UAAU,MAAM;AAAA,MAClH,MAAM,gBAAgB,WAAW,QAAQ,cAAc,EAAE,aAAa,KAAK,KAAK,GAAG,OAAO;AAAA,MAC1F,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;AAAA,QAAe,OAAO,EAAC,WAAW,CAAC,GAAG,QAAQ,KAAI;AAAA,MAC5E,OAAO,EAAC,WAAW,CAAC,SAAS,MAAM,WAAW,KAAI,SAAS,SAAS,KAAK,IAAI,EAAC,CAAC,CAAC,GAAG,QAAQ,EAAC,eAAe,QAAQ,QAAQ,OAAM,EAAC;AAAA,KACnI;AAAA,IACD,IAAI,CAAC;AAAA,MAAe,OAAO;AAAA,IAE3B,MAAM,KAAK,MAAM,KAAK,kBAAkB,GAAG;AAAA,IAC3C,IAAI,CAAC,KAAK,EAAE,YAAY,EAAE,eAAe,cAAc,cAAc,cAAc,EAAE,OAAO,cAAc,cAAc;AAAA,MAAI,OAAO;AAAA,IACnI,MAAM,UAAU,OAAO,OAAO,EAAC,IAAI,EAAE,IAAI,UAAU,UAAU,cAAc,OAAO,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,wBAAwB,EAAE,UAAS,CAAC;AAAA,IACxI,KAAK,SAAS,IAAI,SAAS,EAAC,YAAY,EAAE,YAAY,QAAQ,cAAc,OAAM,CAAC;AAAA,IAAG,OAAO;AAAA;AAAA,OAEzF,UAAS,CAAC,SAA4B,aAAuC;AAAA,IACjF,KAAK,MAAM;AAAA,IAAG,MAAM,SAAS,KAAK,SAAS,IAAI,OAAO;AAAA,IAAG,IAAI,CAAC,UAAU,QAAQ,aAAa;AAAA,MAAU,OAAO;AAAA,IAC9G,MAAM,OAAO,MAAM,KAAK,YAAY,OAAO,MAAM,GAAG,UAAU,MAAM,OAAO,IAAI,WAAW,KAAK,MAAM,MAAM,KAAK,kBAAkB,GAAG,OAAO,OAAO;AAAA,IACnJ,OAAO,CAAC,CAAC,KAAK,EAAE,OAAO,QAAQ,MAAM,EAAE,eAAe,OAAO;AAAA;AAAA,OAEjD,kBAAiB,CAAC,GAA6B,YAAoB,QAAQ,OAAO;AAAA,IAAE,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,SAAS,UAAU;AAAA,MAAG,KAAK,aAAa,GAAG;AAAA,IAAG,IAAI;AAAA,MAAO,KAAK,WAAW,EAAE,OAAO;AAAA;AAAA,EAC9N,aAAa,CAAC,SAAkB;AAAA,IAAE,KAAK,WAAW,OAAO;AAAA;AAAA,EACzD,SAAS,CAAC,SAAsC;AAAA,IAAE,MAAM,IAAI,YAAY,OAAO;AAAA,IAAG,OAAO,GAAG,cAAc,WAAW,KAAK,EAAE,KAAK,IAAI;AAAA;AAAA,EAC7H,UAAU,CAAC,SAAkB;AAAA,IAAE,MAAM,IAAI,YAAY,OAAO;AAAA,IAAG,IAAI,CAAC;AAAA,MAAG,KAAK,gBAAgB,GAAG;AAAA,IAAG,IAAI,EAAE,cAAc,UAAU;AAAA,MAAE,OAAO,SAAS,KAAK,KAAK,gBAAgB;AAAA,MAAG,IAAI,CAAC,SAAS,QAAQ,QAAQ,IAAI,cAAc,KAAK,IAAI,KAAK,EAAE,KAAK,CAAC;AAAA,QAAG,KAAK,gBAAgB,GAAG;AAAA,IAAG;AAAA;AAAA,OACrR,MAAK,CAAC,SAAqC;AAAA,IAC/C,IAAI;AAAA,MACF,KAAK,MAAM;AAAA,MAAG,IAAI,QAAQ,WAAW;AAAA,QAAQ,KAAK,sBAAsB,GAAG;AAAA,MAC3E,MAAM,IAAI,MAAM,KAAK,OAAO;AAAA,MAAG,MAAM,GAAG,CAAC,YAAY,YAAY,WAAW,CAAC;AAAA,MAAG,MAAM,OAAO,SAAS,EAAE,QAAQ,GAAG,IAAI,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW;AAAA,MACrK,MAAM,YAAY,EAAE,aAAa;AAAA,MAAU,IAAI,cAAc,YAAY,cAAc;AAAA,QAAU,KAAK,eAAe;AAAA,MACrH,IAAI,cAAc,YAAY,QAAQ,QAAQ,IAAI,QAAQ;AAAA,QAAG,OAAO,SAAS,KAAK,KAAK,gBAAgB;AAAA,MACvG,MAAM,UAAU,KAAK,aAAa,iBAAiB,KAAK,KAAK,iBAAiB,OAAO,KAAK;AAAA,MAAW,MAAM,OAAO,CAAC,aAAa,OAAO,IAAI,GAAG,YAAY,OAAO,MAAM,CAAC;AAAA,MAExK,MAAM,cAAc,MAAM,KAAK,MAAM,YAAY;AAAA,QAC/C,MAAM,KAAK,MAAM,KAAK,kBAAkB,GAAG,OAAO,QAAQ,GAAG,gBAAgB,GAAG,MAAM,KAAK,IAAI;AAAA,QAC/F,MAAM,WAAW,MAAM,MAAM,KAAK,QAAQ,GAAG,WAAW,cAAc,eAAe,GAAG,WAA4B,CAAC;AAAA,QACrH,WAAW,OAAO,MAAM;AAAA,UACtB,IAAI,OAAO,SAAS,KAAK,OAAK,CAAC,SAAS,SAAS,CAAC,KAAK,EAAE,OAAO,QAAQ,GAAG;AAAA,UAC3E,MAAM,SAAS,MAAM,SAAS,KAAK,MAAM,UAAU,SAAS,KAAK,MAAM,QAAQ;AAAA,UAC/E,IAAI,UAAU,KAAM,MAAO,SAAS;AAAA,YAAI,KAAK,iBAAiB,GAAG;AAAA,UACjE,SAAS,SAAS,KAAK,OAAK,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,UAAU,SAAS,EAAE,MAAM,SAAS,IAAI;AAAA,UAClH,IAAI,CAAC;AAAA,YAAM,KAAK,iBAAiB,GAAG;AAAA,UAAG,SAAS,KAAK,IAAI;AAAA,QAC3D;AAAA,QACA,OAAO,EAAC,WAAW,SAAS,IAAI,CAAC,MAAM,MAAM;AAAA,UAAE,MAAM,QAAQ,KAAK;AAAA,UAAO,OAAO,SAAS,MAAM,WAAW,EAAC,KAAK,KAAK,IAAK,OAAO,SAAS,MAAM,QAAQ,KAAK,MAAM,MAAM,UAAU,SAAS,MAAM,QAAQ,MAAM,MAAM,QAAQ,IAAI,GAAG,OAAO,SAAS,MAAM,QAAQ,KAAK,MAAM,MAAM,UAAU,SAAS,MAAM,QAAQ,MAAM,MAAM,QAAQ,MAAM,KAAK,OAAQ,MAAK,CAAC;AAAA,SAAI,GAAG,QAAQ,MAAK;AAAA,OACvX;AAAA,MACD,MAAM,aAAa,MAAM,KAAK,kBAAkB,GAAG,OAAO,gBAAgB,WAAW,aAAa,OAAO,YAAY;AAAA,MACrH,MAAM,QAAQ,MAAM,IAAI,SAAS,OAAO,GAAG,eAAe,iBAAiB,KAAK,SAAS,MAAM,KAAK,KAAK,wBAAwB,EAAE;AAAA,MACnI,IAAI,CAAC,SAAS,CAAC,iBAAiB,cAAc;AAAA,QAAU,KAAK,uBAAuB,GAAG;AAAA,MACvF,MAAM,QAAQ,YAAY,EAAE,EAAE,SAAS,WAAW,GAAG,UAAU,MAAM,KAAK,kBAAkB,GAAG,QAAQ,UAAU,KAAK,IAAI;AAAA,MAC1H,MAAM,KAAK,MAAM,YAAY;AAAA,QAC3B,MAAM,KAAK,MAAM,KAAK,kBAAkB,GAAG;AAAA,QAC3C,IAAI,CAAC,KAAK,EAAE,OAAO,cAAc,MAAM,EAAE,YAAY,EAAE,eAAe,cAAc,cAAc,EAAE,iBAAiB;AAAA,UAAa,KAAK,uBAAuB,GAAG;AAAA,QACjK,MAAM,UAAU,MAAM,KAAK,QAAQ,GAAG,WAAW,MAAM,SAAS,WAAW,cAAc,eAAe,GAAG,OAAO,SAAS,KAAK,OAAK,CAAC,EAAE,SAAS,CAAC,KAAK,KAAK,GAAG,EAAE,KAAK,CAAC;AAAA,QACvK,IAAI,CAAC;AAAA,UAAM,KAAK,iBAAiB,GAAG;AAAA,QACpC,MAAM,UAAU,CAAC,SAAS,MAAM,WAAW,EAAC,QAAQ,OAAO,KAAK,GAAG,iBAAiB,EAAE,IAAI,YAAY,EAAE,YAAY,SAAS,SAAS,SAAS,WAAW,OAAM,CAAC,CAAC;AAAA,QAClK,MAAM,WAAW,MAAM,SAAS,WAAW,cAAc,eAAe;AAAA,QACxE,MAAM,UAAU,SAAS,KAAK,OAAK,EAAE,OAAO,QAAQ,KAAK,MAAM,EAAE,MAAM,UAAU,WAAW;AAAA,QAAG,IAAI;AAAA,UAAS,QAAQ,KAAK,SAAS,SAAS,WAAW,IAAI,CAAC;AAAA,QAC3J,MAAM,SAAS,SAAS,KAAK,OAAK,EAAE,OAAO,QAAQ,KAAK,MAAM,EAAE,MAAM,UAAU,WAAW;AAAA,QAAG,IAAI;AAAA,UAAQ,QAAQ,KAAK,SAAS,QAAQ,WAAW,KAAI,OAAO,OAAQ,OAAO,KAAK,IAAI,GAAG,OAAO,MAAO,QAAQ,CAAC,EAAC,CAAC,CAAC;AAAA,QACnN,OAAO,EAAC,WAAW,SAAS,QAAQ,UAAS;AAAA,OAC9C;AAAA,MACD,MAAM,UAAU,MAAM,KAAK,kBAAkB,GAAG;AAAA,MAChD,IAAI,CAAC,UAAU,OAAO,YAAY,OAAO,eAAe,cAAc,cAAc,OAAO,OAAO,cAAc;AAAA,QAAI,KAAK,uBAAuB,GAAG;AAAA,MACnJ,OAAO,cAAc,WAAW,KAAK,EAAC,eAAe,IAAI,aAAa,GAAG,WAAW,KAAK,KAAK,EAAC,GAAG,KAAK,EAAC,cAAc,OAAO,SAAS,OAAO,KAAK,UAAU,QAAQ,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,KAAK,gBAAgB,EAAC,CAAC,IAAI,KAAK,EAAC,eAAe,IAAI,aAAa,GAAG,OAAO,WAAW,OAAO,2BAA2B,IAAI,OAAO,OAAO,yBAAyB,GAAE,CAAC;AAAA,MACtW,OAAO,GAAG;AAAA,MAAE,OAAO,KAAK,CAAC;AAAA;AAAA;AAAA,OAEvB,OAAM,CAAC,SAAqC;AAAA,IAChD,IAAI;AAAA,MAAE,KAAK,MAAM;AAAA,MAAG,IAAI,QAAQ,WAAW;AAAA,QAAQ,KAAK,sBAAsB,GAAG;AAAA,MAAG,KAAK,WAAW,OAAO;AAAA,MAAG,MAAM,IAAI,YAAY,OAAO;AAAA,MACzI,MAAM,KAAK,MAAM,YAAY;AAAA,QAAE,MAAM,OAAO,MAAM,KAAK,YAAY,OAAO,EAAE,KAAK,CAAC;AAAA,QAAG,OAAO,EAAC,WAAW,MAAM,QAAQ,CAAC,SAAS,MAAM,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,UAAS;AAAA,OAAI;AAAA,MACnL,OAAO,KAAK,EAAC,IAAI,KAAI,GAAG,KAAK,EAAC,cAAc,OAAO,SAAS,IAAI,GAAG,KAAK,KAAK,gBAAgB,EAAC,CAAC;AAAA,MAC/F,OAAO,GAAG;AAAA,MAAE,OAAO,KAAK,CAAC;AAAA;AAAA;AAAA,OAEf,eAAc,CAAC,GAA6B,GAA4B;AAAA,IACpF,MAAM,IAAI,SAAS,EAAE,QAAQ;AAAA,IAAG,IAAI,EAAE,yBAAyB;AAAA,MAAG,KAAK,uBAAuB;AAAA,IAC9F,MAAM,KAAK,MAAM,KAAK,kBAAkB,GAAG,OAAO,KAAK,EAAE,QAAS;AAAA,IAClE,IAAI,CAAC,KAAK,EAAE,OAAO,MAAM,OAAO,EAAE,oBAAoB,YAAY,CAAC,MAAM,IAAI,SAAS,OAAO,EAAE,iBAAiB,EAAE,YAAY;AAAA,MAAG,KAAK,uBAAuB,GAAG;AAAA,IAChK,IAAI,SAAS,GAAG,EAAE,eAAe;AAAA,MAAG,KAAK,oBAAoB;AAAA,IAAG,MAAM,SAAS,MAAM,KAAK,KAAK,CAAC;AAAA,IAChG,MAAM,KAAK,MAAM,YAAY;AAAA,MAC3B,MAAM,KAAK,kBAAkB,GAAG,iBAAiB,IAAI;AAAA,MAAG,MAAM,IAAI,MAAM,KAAK,kBAAkB,GAAG,UAAU,EAAE;AAAA,MAC9G,IAAI,CAAC,WAAW,QAAQ,OAAO,MAAM,QAAQ,YAAY,QAAQ,eAAe,EAAE;AAAA,QAAY,KAAK,oBAAoB,GAAG;AAAA,MAC1H,MAAM,SAAS,KAAK,SAAS,IAAI,EAAE,OAAQ,GAAI,OAAO,MAAM,KAAK,YAAY,OAAO,MAAM;AAAA,MAC1F,IAAI,CAAC,MAAM,SAAS,CAAC,KAAK,KAAK,SAAS,KAAK,KAAK;AAAA,QAAG,KAAK,aAAa,GAAG;AAAA,MAC1E,OAAO,EAAC,WAAW,CAAC,SAAS,GAAG,iBAAiB,KAAI,SAAS,cAAc,QAAQ,WAAW,OAAO,YAAY,KAAK,QAAQ,UAAU,EAAC,CAAC,GAAG,SAAS,MAAM,WAAW,IAAI,CAAC,GAAG,QAAQ,UAAS;AAAA,KAClM;AAAA;AAEL;AACO,SAAS,aAAa,CAAC,MAA0B,eAA6B,CAAC,GAAyB;AAAA,EAAE,OAAO,IAAI,qBAAqB,MAAM,YAAY;AAAA;AAC5J,IAAM,MAAM;AAAA,EACjB,EAAC,MAAM,aAAa,SAAS,CAAC,MAAM,GAAG,SAAS,iBAAgB;AAAA,EAChE,EAAC,MAAM,WAAW,SAAS,CAAC,MAAM,GAAG,SAAS,SAAQ;AAAA,EACtD,EAAC,MAAM,SAAS,SAAS,CAAC,KAAK,GAAG,SAAS,OAAM;AAAA,EACjD,EAAC,MAAM,mBAAmB,SAAS,CAAC,OAAO,KAAK,GAAG,SAAS,gBAAe;AAC7E;AACO,IAAM,MAAM,CAAC;AAAb,IAAgB,aAAa;AAA7B,IAAkC,aAAa;AACtD,eAAsB,eAAe,CAAC,OAAgB,SAA6C;AAAA,EACjG,MAAM,IAAI,OAAO,KAAK;AAAA,EAAG,MAAM,GAAG,CAAC,YAAY,eAAe,YAAY,QAAQ,CAAC;AAAA,EACnF,MAAM,OAAO,EAAE,aAAa,YAAY,YAAY,SAAS,EAAE,QAAQ,GAAG,IAAI,SAAS,EAAE,QAAQ,GAAG,UAAU,EAAE,gBAAgB,YAAY,YAAY,SAAS,EAAE,WAAW;AAAA,EAC9K,IAAI,OAAO,EAAE,WAAW,YAAY,CAAC,EAAE,OAAO,KAAK,KAAK,EAAE,OAAO,SAAS;AAAA,IAAK,KAAK,gBAAgB;AAAA,EACpG,MAAM,QAAQ,QAAQ;AAAA,EAAc,MAAM,oBAAoB,KAAK;AAAA,EACnE,MAAM,SAAS,MAAM,MAAM,IAAI,eAAe,GAAG,QAAQ,mBAAmB,MAAM;AAAA,EAClF,IAAI,SAAS,SAAS,aAAa,MAAM,aAAa;AAAA,IAAM,KAAK,0CAA0C;AAAA,EAC3G,MAAM,eAAe,MAAM,IAAI,SAAS,KAAK,GAAG,EAAC,WAAW,YAAY,YAAY,OAAO,UAAU,EAAC,CAAC;AAAA,EACvG,MAAM,gBAA+B,QAAQ,KAAI,OAAO,UAAU,WAAW,MAAM,UAAU,cAAc,UAAU,OAAO,WAAW,OAAO,YAAY,KAAK,MAAM,UAAU,GAAG,cAAc,KAAK,MAAM,YAAY,EAAC,IAAI,EAAC,IAAI,WAAW,GAAG,UAAU,WAAW,QAAQ,KAAK,eAAe,GAAG,UAAU,OAAO,WAAW,OAAO,cAAc,YAAY,GAAG,cAAc,EAAC;AAAA,EAClX,MAAM,UAAU,MAAM,MAAM,IAAI,kBAAkB;AAAA,EAClD,MAAM,MAAM,SAAS;AAAA,IACnB,EAAC,KAAK,iBAAiB,iBAAiB,QAAQ,WAAW,GAAG,OAAO,OAAO,EAAC,QAAQ,uBAAuB,cAAa,CAAC,EAAC;AAAA,IAC3H,EAAC,KAAK,oBAAoB,iBAAiB,SAAS,WAAW,GAAG,OAAO,EAAC,QAAQ,uBAAuB,iBAAiB,cAAc,IAAI,QAAQ,EAAE,QAAQ,IAAI,KAAK,IAAI,EAAC,EAAC;AAAA,EAC/K,CAAC;AAAA,EACD,OAAO,IAAI,aAAa;AAAA;AAE1B,eAAsB,mBAAmB,CAAC,OAAiD;AAAA,EACzF,WAAW,KAAK,MAAM,MAAM,KAAK;AAAA,IAAG,IAAI,CAAC,CAAC,iBAAiB,kBAAkB,kBAAkB,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,WAAW,UAAU,KAAK,CAAC,EAAE,IAAI,WAAW,UAAU;AAAA,MAAG,KAAK,8BAA8B,GAAG;AAAA,EAC1N,OAAO,EAAC,aAAa,CAAC,CAAC,mBAAmB,MAAM,MAAM,IAAI,eAAe,CAAC,EAAC;AAAA;AAE7E,IAAe,oBAAC,eAAe,qBAAqB,iBAAiB,EAAC,MAAM,YAAY,SAAS,gBAAe,EAAC;",
-  "debugId": "C01750CC9993B9E264756E2164756E21",
+  "mappings": ";;AAAA,IAAI;AACJ,IAAI,OAAO,cAAc,eAAe,CAAC,UAAU,WAAW,aAAa,cAAc,GAAG;AAAA,EACxF,MAAM,OAAO;AAAA,EACb,MAAM,UAAU;AAAA,EAChB,aAAa,GAAG,QAAQ;AAC5B;AACA,SAAS,eAAe,CAAC,OAAO,UAAU;AAAA,EACtC,IAAI,SAAS,MAAM;AAAA,IACf,OAAO;AAAA,EACX;AAAA,EACA,IAAI;AAAA,IACA,OAAQ,iBAAiB,YACrB,OAAO,eAAe,KAAK,EAAE,OAAO,iBAAiB,SAAS,UAAU,OAAO;AAAA,IAEvF,MAAM;AAAA,IACF,OAAO;AAAA;AAAA;AAGf,IAAM,wBAAwB;AAC9B,IAAM,uBAAuB;AAC7B,SAAS,cAAc,CAAC,SAAS,MAAM,OAAO;AAAA,EAC1C,MAAM,MAAM,IAAI,UAAU,SAAS,EAAE,MAAM,CAAC;AAAA,EAC5C,OAAO,OAAO,KAAK,EAAE,KAAK,CAAC;AAAA,EAC3B,OAAO;AAAA;AAEJ,IAAM,wBAAwB,OAAO;AACrC,IAAM,YAAY,OAAO;AACzB,IAAM,iBAAiB,OAAO;AAC9B,IAAM,cAAc,OAAO;AAC3B,IAAM,kBAAkB,OAAO;AAC/B,IAAM,aAAa,OAAO;AAC1B,IAAM,YAAY,OAAO;AAChC,IAAM,UAAU,IAAI;AACpB,IAAM,UAAU,IAAI;AACpB,SAAS,GAAG,CAAC,OAAO;AAAA,EAChB,IAAI,OAAO,UAAU,UAAU;AAAA,IAC3B,OAAO,QAAQ,OAAO,KAAK;AAAA,EAC/B;AAAA,EACA,OAAO,QAAQ,OAAO,KAAK;AAAA;AAE/B,IAAI;AACJ,IAAI,WAAW,UAAU,UAAU;AAAA,EAC/B,kBAAkB,CAAC,UAAU;AAAA,IACzB,IAAI,iBAAiB,aAAa;AAAA,MAC9B,QAAQ,IAAI,WAAW,KAAK;AAAA,IAChC;AAAA,IACA,OAAO,MAAM,SAAS,EAAE,UAAU,aAAa,aAAa,KAAK,CAAC;AAAA;AAE1E,EACK;AAAA,EACD,MAAM,aAAa;AAAA,EACnB,kBAAkB,CAAC,UAAU;AAAA,IACzB,IAAI,iBAAiB,aAAa;AAAA,MAC9B,QAAQ,IAAI,WAAW,KAAK;AAAA,IAChC;AAAA,IACA,MAAM,MAAM,CAAC;AAAA,IACb,SAAS,IAAI,EAAG,IAAI,MAAM,YAAY,KAAK,YAAY;AAAA,MACnD,IAAI,KAAK,OAAO,aAAa,MAAM,MAAM,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,CAAC;AAAA,IAC/E;AAAA,IACA,OAAO,KAAK,IAAI,KAAK,EAAE,CAAC,EAAE,QAAQ,MAAM,EAAE,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG;AAAA;AAAA;AAG1F,IAAI;AACJ,IAAI,WAAW,YAAY;AAAA,EACvB,kBAAkB,CAAC,UAAU;AAAA,IACzB,IAAI;AAAA,MACA,OAAO,WAAW,WAAW,OAAO,EAAE,UAAU,YAAY,CAAC;AAAA,MAEjE,OAAO,OAAO;AAAA,MACV,MAAM,eAAe,qDAAqD,uBAAuB,KAAK;AAAA;AAAA;AAGlH,EACK;AAAA,EACD,kBAAkB,CAAC,UAAU;AAAA,IACzB,IAAI;AAAA,MACA,MAAM,SAAS,KAAK,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,OAAO,EAAE,CAAC;AAAA,MAClF,MAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAAA,MAC1C,SAAS,IAAI,EAAG,IAAI,OAAO,QAAQ,KAAK;AAAA,QACpC,MAAM,KAAK,OAAO,WAAW,CAAC;AAAA,MAClC;AAAA,MACA,OAAO;AAAA,MAEX,OAAO,OAAO;AAAA,MACV,MAAM,eAAe,qDAAqD,uBAAuB,KAAK;AAAA;AAAA;AAAA;AAIlH,SAAS,IAAI,CAAC,OAAO;AAAA,EACjB,IAAI,OAAO,UAAU,UAAU;AAAA,IAC3B,OAAO,gBAAgB,KAAK;AAAA,EAChC;AAAA,EACA,OAAO,gBAAgB,KAAK;AAAA;AAAA;AAEzB,MAAM,kCAAkC,MAAM;AAAA,EACjD;AAAA,EACA,WAAW,CAAC,SAAS,SAAS;AAAA,IAC1B,MAAM,SAAS,OAAO;AAAA,IACtB,KAAK,OAAO,KAAK,YAAY;AAAA,IAC7B,KAAK,OAAO;AAAA,IACZ,MAAM,oBAAoB,MAAM,KAAK,WAAW;AAAA;AAExD;AAAA;AACO,MAAM,iCAAiC,MAAM;AAAA,EAChD;AAAA,EACA,WAAW,CAAC,SAAS,SAAS;AAAA,IAC1B,MAAM,SAAS,OAAO;AAAA,IACtB,KAAK,OAAO,KAAK,YAAY;AAAA,IAC7B,IAAI,SAAS,MAAM;AAAA,MACf,KAAK,OAAO,SAAS;AAAA,IACzB;AAAA,IACA,MAAM,oBAAoB,MAAM,KAAK,WAAW;AAAA;AAExD;AACA,SAAS,GAAG,CAAC,SAAS,MAAM,OAAO;AAAA,EAC/B,OAAO,IAAI,yBAAyB,SAAS,EAAE,MAAM,MAAM,CAAC;AAAA;AA2DhE,SAAS,YAAY,CAAC,OAAO;AAAA,EACzB,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GAAG;AAAA,IACrE,OAAO;AAAA,EACX;AAAA,EACA,OAAO;AAAA;AAEX,SAAS,cAAc,CAAC,OAAO;AAAA,EAC3B,IAAI,gBAAgB,OAAO,OAAO,GAAG;AAAA,IACjC,QAAQ,OAAO,YAAY,MAAM,QAAQ,CAAC;AAAA,EAC9C;AAAA,EACA,MAAM,UAAU,IAAI,QAAQ,SAAS,CAAC,CAAC;AAAA,EACvC,IAAI,cAAc,CAAC,QAAQ,IAAI,YAAY,GAAG;AAAA,IAC1C,QAAQ,IAAI,cAAc,UAAU;AAAA,EACxC;AAAA,EACA,IAAI,QAAQ,IAAI,eAAe,GAAG;AAAA,IAC9B,MAAM,eAAe,sEAAsE,qBAAqB;AAAA,EACpH;AAAA,EACA,OAAO;AAAA;AAEX,SAAS,MAAM,CAAC,KAAK,OAAO;AAAA,EACxB,IAAI,UAAU,WAAW;AAAA,IACrB,IAAI,OAAO,UAAU,YAAY;AAAA,MAC7B,QAAQ,MAAM,IAAI,IAAI;AAAA,IAC1B;AAAA,IACA,IAAI,EAAE,iBAAiB,cAAc;AAAA,MACjC,MAAM,eAAe,iEAAiE,oBAAoB;AAAA,IAC9G;AAAA,IACA,OAAO;AAAA,EACX;AAAA,EACA;AAAA;AAEJ,SAAS,kBAAkB,CAAC,UAAU;AAAA,EAClC,IAAI,SAAS,SAAS,IAAI,GAAG;AAAA,IACzB,OAAO,SAAS,QAAQ,MAAM,GAAG;AAAA,EACrC;AAAA,EACA,OAAO;AAAA;AAEX,SAAS,gBAAgB,CAAC,KAAK,WAAW,wBAAwB,OAAO;AAAA,EACrE,IAAI,IAAI,aAAa,KAAK;AAAA,IACtB,IAAI,WAAW;AAAA,EACnB,EACK;AAAA,IACD,IAAI,WAAW,mBAAmB,GAAG,aAAa,wBAAwB,IAAI,WAAW,IAAI,SAAS,QAAQ,SAAS,EAAE,GAAG;AAAA;AAAA,EAEhI,OAAO;AAAA;AAEX,SAAS,eAAe,CAAC,KAAK,WAAW;AAAA,EACrC,IAAI,WAAW,mBAAmB,GAAG,IAAI,YAAY,WAAW;AAAA,EAChE,OAAO;AAAA;AAEX,eAAe,gBAAgB,CAAC,OAAO,SAAS,WAAW,SAAS;AAAA,EAChE,IAAI,EAAE,iBAAiB,MAAM;AAAA,IACzB,MAAM,eAAe,IAAI,uCAAuC,oBAAoB;AAAA,EACxF;AAAA,EACA,cAAc,OAAO,UAAU,2BAA2B,IAAI;AAAA,EAC9D,MAAM,MAAM,UAAU,IAAI,IAAI,MAAM,IAAI,CAAC;AAAA,EACzC,MAAM,UAAU,eAAe,SAAS,OAAO;AAAA,EAC/C,QAAQ,IAAI,UAAU,kBAAkB;AAAA,EACxC,QAAQ,UAAU,gBAAgB,OAAO,IAAI,MAAM;AAAA,IAC/C,MAAM;AAAA,IACN,SAAS,OAAO,YAAY,QAAQ,QAAQ,CAAC;AAAA,IAC7C,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ,OAAO,KAAK,SAAS,MAAM;AAAA,EACvC,CAAC;AAAA;AAEL,eAAsB,gBAAgB,CAAC,kBAAkB,SAAS;AAAA,EAC9D,OAAO,iBAAiB,kBAAkB,oBAAoB,CAAC,QAAQ;AAAA,IACnE,QAAQ,SAAS;AAAA,WACR;AAAA,WACA;AAAA,QACD,gBAAgB,KAAK,kCAAkC;AAAA,QACvD;AAAA,WACC;AAAA,QACD,iBAAiB,KAAK,wCAAwC;AAAA,QAC9D;AAAA;AAAA,QAEA,MAAM,eAAe,6DAA6D,qBAAqB;AAAA;AAAA,IAE/G,OAAO;AAAA,KACR,OAAO;AAAA;AAEd,SAAS,YAAY,CAAC,OAAO,QAAQ,IAAI,MAAM,OAAO;AAAA,EAClD,IAAI;AAAA,IACA,IAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,GAAG;AAAA,MACtD,MAAM,eAAe,GAAG,uBAAuB,sBAAsB,KAAK;AAAA,IAC9E;AAAA,IACA,IAAI,QAAQ;AAAA,MACR;AAAA,IACJ,IAAI,QAAQ;AAAA,MACR,IAAI,UAAU,GAAG;AAAA,QACb,MAAM,eAAe,GAAG,oCAAoC,uBAAuB,KAAK;AAAA,MAC5F;AAAA,MACA;AAAA,IACJ;AAAA,IACA,MAAM,eAAe,GAAG,gCAAgC,uBAAuB,KAAK;AAAA,IAExF,OAAO,KAAK;AAAA,IACR,IAAI,MAAM;AAAA,MACN,MAAM,IAAI,IAAI,SAAS,MAAM,KAAK;AAAA,IACtC;AAAA,IACA,MAAM;AAAA;AAAA;AAGd,SAAS,YAAY,CAAC,OAAO,IAAI,MAAM,OAAO;AAAA,EAC1C,IAAI;AAAA,IACA,IAAI,OAAO,UAAU,UAAU;AAAA,MAC3B,MAAM,eAAe,GAAG,uBAAuB,sBAAsB,KAAK;AAAA,IAC9E;AAAA,IACA,IAAI,MAAM,WAAW,GAAG;AAAA,MACpB,MAAM,eAAe,GAAG,wBAAwB,uBAAuB,KAAK;AAAA,IAChF;AAAA,IAEJ,OAAO,KAAK;AAAA,IACR,IAAI,MAAM;AAAA,MACN,MAAM,IAAI,IAAI,SAAS,MAAM,KAAK;AAAA,IACtC;AAAA,IACA,MAAM;AAAA;AAAA;AAGd,eAAsB,wBAAwB,CAAC,0BAA0B,UAAU;AAAA,EAC/E,MAAM,WAAW;AAAA,EACjB,IAAI,EAAE,oBAAoB,QAAQ,aAAa,mBAAmB;AAAA,IAC9D,MAAM,eAAe,yDAAyD,oBAAoB;AAAA,EACtG;AAAA,EACA,IAAI,CAAC,gBAAgB,UAAU,QAAQ,GAAG;AAAA,IACtC,MAAM,eAAe,8CAA8C,oBAAoB;AAAA,EAC3F;AAAA,EACA,IAAI,SAAS,WAAW,KAAK;AAAA,IACzB,MAAM,IAAI,oGAAoG,yBAAyB,QAAQ;AAAA,EACnJ;AAAA,EACA,uBAAuB,QAAQ;AAAA,EAC/B,MAAM,OAAO,MAAM,oBAAoB,QAAQ;AAAA,EAC/C,aAAa,KAAK,QAAQ,qCAAqC,kBAAkB,EAAE,MAAM,KAAK,CAAC;AAAA,EAC/F,IAAI,aAAa,qBAAqB,IAAI,IAAI,KAAK,MAAM,EAAE,SAAS,SAAS,MAAM;AAAA,IAC/E,MAAM,IAAI,uEAAuE,2BAA2B,EAAE,UAAU,SAAS,MAAM,MAAM,MAAM,WAAW,SAAS,CAAC;AAAA,EAC5K;AAAA,EACA,OAAO;AAAA;AAEX,SAAS,qBAAqB,CAAC,UAAU;AAAA,EACrC,kBAAkB,UAAU,kBAAkB;AAAA;AAElD,SAAS,OAAO,CAAC,aAAa,OAAO;AAAA,EACjC,IAAI,MAAM;AAAA,EACV,IAAI,MAAM,SAAS,GAAG;AAAA,IAClB,MAAM,OAAO,MAAM,IAAI;AAAA,IACvB,OAAO,GAAG,MAAM,KAAK,IAAI,SAAS;AAAA,EACtC,EACK,SAAI,MAAM,WAAW,GAAG;AAAA,IACzB,OAAO,GAAG,MAAM,SAAS,MAAM;AAAA,EACnC,EACK;AAAA,IACD,OAAO,MAAM;AAAA;AAAA,EAEjB,OAAO,IAAI,KAAK,sBAAsB,QAAQ;AAAA;AAElD,SAAS,kBAAkB,CAAC,aAAa,OAAO;AAAA,EAC5C,IAAI,CAAC,MAAM,SAAS,eAAe,QAAQ,CAAC,GAAG;AAAA,IAC3C,MAAM,QAAQ,UAAU,GAAG,KAAK;AAAA,EACpC;AAAA;AAEJ,SAAS,iBAAiB,CAAC,UAAU,aAAa;AAAA,EAC9C,IAAI,eAAe,QAAQ,MAAM,aAAa;AAAA,IAC1C,MAAM,QAAQ,UAAU,WAAW;AAAA,EACvC;AAAA;AAEJ,SAAS,WAAW,GAAG;AAAA,EACnB,OAAO,KAAK,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;AAAA;AAEnD,SAAS,0BAA0B,GAAG;AAAA,EACzC,OAAO,YAAY;AAAA;AAEhB,SAAS,mBAAmB,GAAG;AAAA,EAClC,OAAO,YAAY;AAAA;AAEhB,SAAS,mBAAmB,GAAG;AAAA,EAClC,OAAO,YAAY;AAAA;AAEvB,eAAsB,0BAA0B,CAAC,cAAc;AAAA,EAC3D,aAAa,cAAc,cAAc;AAAA,EACzC,OAAO,KAAK,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC;AAAA;AA4ExE,SAAS,YAAY,CAAC,QAAQ;AAAA,EAC1B,MAAM,OAAO,SAAS;AAAA,EACtB,OAAO,OAAO,SAAS,YAAY,OAAO,SAAS,IAAI,IAAI,OAAO;AAAA;AAEtE,SAAS,iBAAiB,CAAC,QAAQ;AAAA,EAC/B,MAAM,YAAY,SAAS;AAAA,EAC3B,OAAO,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,KAAK,KAAK,KAAK,SAAS,MAAM,KACzF,YACA;AAAA;AAEV,SAAS,SAAS,GAAG;AAAA,EACjB,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,IAAI;AAAA;AAEvC,SAAS,QAAQ,CAAC,IAAI;AAAA,EAClB,IAAI,OAAO,OAAO,YAAY,OAAO,MAAM;AAAA,IACvC,MAAM,eAAe,0BAA0B,oBAAoB;AAAA,EACvE;AAAA,EACA,aAAa,GAAG,QAAQ,aAAa;AAAA;AAEzC,SAAS,YAAY,CAAC,QAAQ;AAAA,EAC1B,IAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AAAA,IAC/C,MAAM,eAAe,8BAA8B,oBAAoB;AAAA,EAC3E;AAAA,EACA,aAAa,OAAO,WAAW,oBAAoB;AAAA;AAEvD,SAAS,aAAa,CAAC,OAAO;AAAA,EAC1B,OAAO,mBAAmB,KAAK,EAAE,QAAQ,wBAAwB,CAAC,cAAc;AAAA,IAC5E,QAAQ;AAAA,WACC;AAAA,WACA;AAAA,WACA;AAAA,WACA;AAAA,WACA;AAAA,WACA;AAAA,WACA;AAAA,WACA;AAAA,WACA;AAAA,QACD,OAAO,IAAI,UAAU,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE,YAAY;AAAA,WAC3D;AAAA,QACD,OAAO;AAAA;AAAA,QAEP,MAAM,IAAI;AAAA;AAAA,GAErB;AAAA;AAEE,SAAS,gBAAgB,CAAC,cAAc;AAAA,EAC3C,aAAa,cAAc,gBAAgB;AAAA,EAC3C,OAAO,CAAC,KAAK,QAAQ,MAAM,aAAa;AAAA,IACpC,KAAK,IAAI,aAAa,OAAO,SAAS;AAAA,IACtC,KAAK,IAAI,iBAAiB,YAAY;AAAA;AAAA;AAGvC,SAAS,iBAAiB,CAAC,cAAc;AAAA,EAC5C,aAAa,cAAc,gBAAgB;AAAA,EAC3C,OAAO,CAAC,KAAK,QAAQ,OAAO,YAAY;AAAA,IACpC,MAAM,WAAW,cAAc,OAAO,SAAS;AAAA,IAC/C,MAAM,WAAW,cAAc,YAAY;AAAA,IAC3C,MAAM,cAAc,KAAK,GAAG,YAAY,UAAU;AAAA,IAClD,QAAQ,IAAI,iBAAiB,SAAS,aAAa;AAAA;AAAA;AA2CpD,SAAS,IAAI,GAAG;AAAA,EACnB,OAAO,CAAC,KAAK,QAAQ,MAAM,aAAa;AAAA,IACpC,KAAK,IAAI,aAAa,OAAO,SAAS;AAAA;AAAA;AA6F9C,IAAM,WAAW,IAAI,QAEb,CAAC,KAAK,SAAS,IAAI,MAAM,KAAK,IAAI,IACpC,CAAC,KAAK,SAAS;AAAA,EACb,IAAI;AAAA,IACA,OAAO,IAAI,IAAI,KAAK,IAAI;AAAA,IAE5B,MAAM;AAAA,IACF,OAAO;AAAA;AAAA;AAGZ,SAAS,aAAa,CAAC,KAAK,cAAc;AAAA,EAC7C,IAAI,gBAAgB,IAAI,aAAa,UAAU;AAAA,IAC3C,MAAM,IAAI,sCAAsC,wBAAwB,GAAG;AAAA,EAC/E;AAAA,EACA,IAAI,IAAI,aAAa,YAAY,IAAI,aAAa,SAAS;AAAA,IACvD,MAAM,IAAI,4CAA4C,4BAA4B,GAAG;AAAA,EACzF;AAAA;AAEJ,SAAS,gBAAgB,CAAC,OAAO,UAAU,cAAc,cAAc;AAAA,EACnE,IAAI;AAAA,EACJ,IAAI,OAAO,UAAU,YAAY,EAAE,MAAM,SAAS,KAAK,IAAI;AAAA,IACvD,MAAM,IAAI,0DAA0D,eAAe,6BAA6B,cAAc,OAAO,eAAe,UAAU,YAAY,0BAA0B,yBAAyB,EAAE,WAAW,eAAe,yBAAyB,aAAa,SAAS,CAAC;AAAA,EAC7S;AAAA,EACA,cAAc,KAAK,YAAY;AAAA,EAC/B,OAAO;AAAA;AAEJ,SAAS,eAAe,CAAC,IAAI,UAAU,cAAc,cAAc;AAAA,EACtE,IAAI,gBAAgB,GAAG,yBAAyB,YAAY,GAAG,uBAAuB;AAAA,IAClF,OAAO,iBAAiB,GAAG,sBAAsB,WAAW,UAAU,cAAc,YAAY;AAAA,EACpG;AAAA,EACA,OAAO,iBAAiB,GAAG,WAAW,UAAU,cAAc,YAAY;AAAA;AA8FvE,SAAS,gBAAgB,CAAC,KAAK;AAAA,EAClC,IAAI,eAAe,+BAA+B;AAAA,IAC9C,OAAO,IAAI,MAAM,KAAK,CAAC,cAAc,UAAU,WAAW,UAAU,UAAU,WAAW,UAAU,gBAAgB;AAAA,EACvH;AAAA,EACA,IAAI,eAAe,mBAAmB;AAAA,IAClC,OAAO,IAAI,UAAU;AAAA,EACzB;AAAA,EACA,OAAO;AAAA;AAKJ,MAAM,0BAA0B,MAAM;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,CAAC,SAAS,SAAS;AAAA,IAC1B,MAAM,SAAS,OAAO;AAAA,IACtB,KAAK,OAAO,KAAK,YAAY;AAAA,IAC7B,KAAK,OAAO;AAAA,IACZ,KAAK,QAAQ,QAAQ;AAAA,IACrB,KAAK,QAAQ,QAAQ,MAAM;AAAA,IAC3B,KAAK,SAAS,QAAQ,SAAS;AAAA,IAC/B,KAAK,oBAAoB,QAAQ,MAAM;AAAA,IACvC,OAAO,eAAe,MAAM,YAAY,EAAE,YAAY,OAAO,OAAO,QAAQ,SAAS,CAAC;AAAA,IACtF,MAAM,oBAAoB,MAAM,KAAK,WAAW;AAAA;AAExD;AAAA;AACO,MAAM,mCAAmC,MAAM;AAAA,EAClD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,CAAC,SAAS,SAAS;AAAA,IAC1B,MAAM,SAAS,OAAO;AAAA,IACtB,KAAK,OAAO,KAAK,YAAY;AAAA,IAC7B,KAAK,OAAO;AAAA,IACZ,KAAK,QAAQ,QAAQ;AAAA,IACrB,KAAK,QAAQ,QAAQ,MAAM,IAAI,OAAO;AAAA,IACtC,KAAK,oBAAoB,QAAQ,MAAM,IAAI,mBAAmB,KAAK;AAAA,IACnE,MAAM,oBAAoB,MAAM,KAAK,WAAW;AAAA;AAExD;AAAA;AACO,MAAM,sCAAsC,MAAM;AAAA,EACrD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,CAAC,SAAS,SAAS;AAAA,IAC1B,MAAM,SAAS,OAAO;AAAA,IACtB,KAAK,OAAO,KAAK,YAAY;AAAA,IAC7B,KAAK,OAAO;AAAA,IACZ,KAAK,QAAQ,QAAQ;AAAA,IACrB,KAAK,SAAS,QAAQ,SAAS;AAAA,IAC/B,KAAK,WAAW,QAAQ;AAAA,IACxB,OAAO,eAAe,MAAM,YAAY,EAAE,YAAY,MAAM,CAAC;AAAA,IAC7D,MAAM,oBAAoB,MAAM,KAAK,WAAW;AAAA;AAExD;AACA,IAAM,aAAa;AACnB,IAAM,eAAe;AACrB,IAAM,cAAc;AACpB,IAAM,qBAAqB,MAAM,aAAa,eAAe;AAC7D,IAAM,eAAe,MAAM,aAAa,gBAAgB,aAAa;AACrE,IAAM,WAAW,IAAI,OAAO,cAAc,aAAa,GAAG;AAC1D,IAAM,gBAAgB,IAAI,OAAO,aAAa,qBAAqB,aAAa;AAChF,IAAM,kBAAkB,IAAI,OAAO,aAAa,eAAe,aAAa;AAC5E,IAAM,iBAAiB,IAAI,OAAO,OAAO,eAAe,mBAAmB;AAC3E,SAAS,8BAA8B,CAAC,UAAU;AAAA,EAC9C,IAAI,CAAC,gBAAgB,UAAU,QAAQ,GAAG;AAAA,IACtC,MAAM,eAAe,8CAA8C,oBAAoB;AAAA,EAC3F;AAAA,EACA,MAAM,SAAS,SAAS,QAAQ,IAAI,kBAAkB;AAAA,EACtD,IAAI,WAAW,MAAM;AAAA,IACjB;AAAA,EACJ;AAAA,EACA,MAAM,aAAa,CAAC;AAAA,EACpB,IAAI,OAAO;AAAA,EACX,OAAO,MAAM;AAAA,IACT,IAAI,QAAQ,KAAK,MAAM,QAAQ;AAAA,IAC/B,MAAM,SAAS,QAAQ,KAAK,YAAY;AAAA,IACxC,IAAI,CAAC,QAAQ;AAAA,MACT;AAAA,IACJ;AAAA,IACA,MAAM,cAAc,KAAK,UAAU,MAAM,GAAG,MAAM;AAAA,IAClD,IAAI,eAAe,CAAC,YAAY,MAAM,QAAQ,GAAG;AAAA,MAC7C;AAAA,IACJ;AAAA,IACA,MAAM,aAAa,YAAY,MAAM,WAAW;AAAA,IAChD,MAAM,gBAAgB,CAAC,CAAC;AAAA,IACxB,OAAO,aAAa,WAAW,KAAK;AAAA,IACpC,MAAM,aAAa,CAAC;AAAA,IACpB,IAAI;AAAA,IACJ,IAAI,eAAe;AAAA,MACf,OAAO,MAAM;AAAA,QACT,IAAI;AAAA,QACJ,IAAI;AAAA,QACJ,IAAK,QAAQ,KAAK,MAAM,aAAa,GAAI;AAAA,UAErC,GAAG,KAAK,OAAO,IAAI,IAAI;AAAA,UACvB,IAAI,MAAM,SAAS,IAAI,GAAG;AAAA,YACtB,QAAQ,MAAM,QAAQ,eAAe,IAAI;AAAA,UAC7C;AAAA,UACA,WAAW,IAAI,YAAY,KAAK;AAAA,UAChC;AAAA,QACJ;AAAA,QACA,IAAK,QAAQ,KAAK,MAAM,eAAe,GAAI;AAAA,UAEvC,GAAG,KAAK,OAAO,IAAI,IAAI;AAAA,UACvB,WAAW,IAAI,YAAY,KAAK;AAAA,UAChC;AAAA,QACJ;AAAA,QACA,IAAK,QAAQ,KAAK,MAAM,cAAc,GAAI;AAAA,UACtC,IAAI,OAAO,KAAK,UAAU,EAAE,QAAQ;AAAA,YAChC;AAAA,UACJ;AAAA,UAEA,GAAG,SAAS,IAAI,IAAI;AAAA,UACpB;AAAA,QACJ;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,EACK;AAAA,MACD,OAAO,eAAe;AAAA;AAAA,IAE1B,MAAM,YAAY,EAAE,QAAQ,WAAW;AAAA,IACvC,IAAI,SAAS;AAAA,MACT,UAAU,UAAU;AAAA,IACxB;AAAA,IACA,WAAW,KAAK,SAAS;AAAA,EAC7B;AAAA,EACA,IAAI,CAAC,WAAW,QAAQ;AAAA,IACpB;AAAA,EACJ;AAAA,EACA,OAAO;AAAA;AAqBX,eAAe,2BAA2B,CAAC,UAAU;AAAA,EACjD,IAAI,SAAS,SAAS,OAAO,SAAS,SAAS,KAAK;AAAA,IAChD,uBAAuB,QAAQ;AAAA,IAC/B,sBAAsB,QAAQ;AAAA,IAC9B,IAAI;AAAA,MACA,MAAM,OAAO,MAAM,SAAS,MAAM,EAAE,KAAK;AAAA,MACzC,IAAI,aAAa,IAAI,KAAK,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,QAAQ;AAAA,QAC3E,OAAO;AAAA,MACX;AAAA,MAEJ,MAAM;AAAA,EACV;AAAA,EACA;AAAA;AAEJ,eAAe,mBAAmB,CAAC,UAAU,UAAU,OAAO;AAAA,EAC1D,IAAI,SAAS,WAAW,UAAU;AAAA,IAC9B,8BAA8B,QAAQ;AAAA,IACtC,IAAI;AAAA,IACJ,IAAK,MAAM,MAAM,4BAA4B,QAAQ,GAAI;AAAA,MACrD,MAAM,SAAS,MAAM,OAAO;AAAA,MAC5B,MAAM,IAAI,kBAAkB,uDAAuD;AAAA,QAC/E,OAAO;AAAA,QACP;AAAA,MACJ,CAAC;AAAA,IACL;AAAA,IACA,MAAM,IAAI,+BAA+B,gDAAgD,yBAAyB,QAAQ;AAAA,EAC9H;AAAA;AAEJ,SAAS,UAAU,CAAC,QAAQ;AAAA,EACxB,IAAI,CAAC,QAAQ,IAAI,MAAM,GAAG;AAAA,IACtB,MAAM,eAAe,4CAA4C,qBAAqB;AAAA,EAC1F;AAAA;AAEJ,eAAe,eAAe,CAAC,aAAa,QAAQ,KAAK,SAAS,MAAM,SAAS;AAAA,EAC7E,aAAa,aAAa,eAAe;AAAA,EACzC,IAAI,EAAE,eAAe,MAAM;AAAA,IACvB,MAAM,eAAe,oCAAoC,oBAAoB;AAAA,EACjF;AAAA,EACA,cAAc,KAAK,UAAU,2BAA2B,IAAI;AAAA,EAC5D,UAAU,eAAe,OAAO;AAAA,EAChC,IAAI,SAAS,MAAM;AAAA,IACf,WAAW,QAAQ,IAAI;AAAA,IACvB,MAAM,QAAQ,KAAK,SAAS,KAAK,SAAS,OAAO,YAAY,GAAG,WAAW;AAAA,EAC/E;AAAA,EACA,QAAQ,IAAI,iBAAiB,GAAG,QAAQ,IAAI,MAAM,IAAI,SAAS,YAAY,aAAa;AAAA,EACxF,MAAM,WAAW,OAAO,UAAU,gBAAgB,OAAO,IAAI,MAAM;AAAA,IAC/D,QAAQ,gBAAgB,MAAM,cAAc,IAAI,SAAS;AAAA,IACzD;AAAA,IACA,SAAS,OAAO,YAAY,QAAQ,QAAQ,CAAC;AAAA,IAC7C;AAAA,IACA,UAAU;AAAA,IACV,QAAQ,OAAO,KAAK,SAAS,MAAM;AAAA,EACvC,CAAC;AAAA,EACD,SAAS,MAAM,WAAW,UAAU,GAAG;AAAA,EACvC,OAAO;AAAA;AAEX,eAAsB,wBAAwB,CAAC,aAAa,QAAQ,KAAK,SAAS,MAAM,SAAS;AAAA,EAC7F,MAAM,WAAW,MAAM,gBAAgB,aAAa,QAAQ,KAAK,SAAS,MAAM,OAAO;AAAA,EACvF,8BAA8B,QAAQ;AAAA,EACtC,OAAO;AAAA;AAmBX,IAAI;AACJ,IAAI;AACJ,IAAI;AACJ,SAAS,YAAY,CAAC,IAAI,MAAM,KAAK,OAAO;AAAA,EACxC,YAAY,IAAI;AAAA,EAChB,QAAQ,IAAI,IAAI;AAAA,IACZ;AAAA,IACA;AAAA,QACI,GAAG,GAAG;AAAA,MACN,OAAO,UAAU,IAAI,KAAK;AAAA;AAAA,EAElC,CAAC;AAAA,EACD,IAAI,OAAO;AAAA,IACP,OAAO,OAAO,OAAO,EAAE,MAAM,gBAAgB,IAAI,GAAG,IAAI,CAAC;AAAA,EAC7D;AAAA;AAEJ,SAAS,gBAAgB,CAAC,OAAO;AAAA,EAC7B,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM;AAAA,IAC7C,OAAO;AAAA,EACX;AAAA,EACA,IAAI,EAAE,SAAS,UAAU,OAAO,MAAM,QAAQ,YAAY,UAAU,IAAI,MAAM,OAAO,KAAK;AAAA,IACtF,OAAO;AAAA,EACX;AAAA,EACA,IAAI,EAAE,UAAU,UACZ,CAAC,aAAa,MAAM,IAAI,KACxB,CAAC,MAAM,QAAQ,MAAM,KAAK,IAAI,KAC9B,CAAC,MAAM,UAAU,MAAM,KAAK,MAAM,KAAK,MAAM,YAAY,GAAG;AAAA,IAC5D,OAAO;AAAA,EACX;AAAA,EACA,OAAO;AAAA;AAEX,SAAS,cAAc,CAAC,IAAI,OAAO;AAAA,EAC/B,SAAS,OAAO,EAAE;AAAA,EAClB,OAAO,OAAO;AAAA,EACd,OAAO,OAAO;AAAA;AAElB,eAAe,gCAAgC,CAAC,IAAI,SAAS,QAAQ;AAAA,EACjE,QAAQ,KAAK,QAAQ;AAAA,EACrB,qBAAqB,MAAM;AAAA,EAC3B,IAAI,CAAC,SAAS,IAAI,EAAE,KAAK,iBAAiB,UAAU,UAAU,GAAG;AAAA,IAC7D,aAAa,IAAI,UAAU,WAAW,MAAM,UAAU,WAAW,GAAG;AAAA,EACxE;AAAA,EACA,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,IAAI,SAAS,IAAI,EAAE,GAAG;AAAA,KAEjB,EAAE,MAAM,IAAI,IAAI,QAAQ,IAAI,EAAE;AAAA,IAC/B,IAAI,OAAO,KAAK;AAAA,MACZ,eAAe,IAAI,UAAU,UAAU;AAAA,MACvC,OAAO,iCAAiC,IAAI,SAAS,MAAM;AAAA,IAC/D;AAAA,EACJ,EACK;AAAA,IACD,MAAM,aAAa,MAAM,YAAY,IAAI,OAAO;AAAA,IAChD,OAAO,WAAW;AAAA,IAClB,MAAM,UAAU,IAAI,WAAW;AAAA,IAC/B,aAAa,IAAI,MAAM,WAAW,KAAK,UAAU,UAAU;AAAA;AAAA,EAE/D,IAAI;AAAA,EACJ,QAAQ,IAAI,MAAM,GAAG,CAAC;AAAA,SACb;AAAA,SACA;AAAA,MACD,MAAM;AAAA,MACN;AAAA,SACC;AAAA,MACD,MAAM;AAAA,MACN;AAAA,SACC;AAAA,MACD,MAAM;AAAA,MACN;AAAA,SACC;AAAA,MACD,MAAM;AAAA,MACN;AAAA;AAAA,MAEA,MAAM,IAAI,0BAA0B,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAAA;AAAA,EAE3F,MAAM,aAAa,KAAK,KAAK,OAAO,CAAC,QAAQ;AAAA,IACzC,IAAI,IAAI,QAAQ,KAAK;AAAA,MACjB,OAAO;AAAA,IACX;AAAA,IACA,IAAI,QAAQ,aAAa,QAAQ,IAAI,KAAK;AAAA,MACtC,OAAO;AAAA,IACX;AAAA,IACA,IAAI,IAAI,QAAQ,aAAa,QAAQ,IAAI,KAAK;AAAA,MAC1C,OAAO;AAAA,IACX;AAAA,IACA,IAAI,IAAI,QAAQ,aAAa,IAAI,QAAQ,OAAO;AAAA,MAC5C,OAAO;AAAA,IACX;AAAA,IACA,IAAI,IAAI,SAAS,SAAS,QAAQ,MAAM,OAAO;AAAA,MAC3C,OAAO;AAAA,IACX;AAAA,IACA,QAAQ;AAAA,YACC,QAAQ,WAAW,IAAI,QAAQ;AAAA,YAC/B,QAAQ,WAAW,IAAI,QAAQ;AAAA,YAC/B,QAAQ,WAAW,IAAI,QAAQ;AAAA,YAC/B,QAAQ,aAAa,IAAI,QAAQ;AAAA,YACjC,QAAQ,WAAW,IAAI,QAAQ;AAAA,QAChC,OAAO;AAAA;AAAA,IAEf,OAAO;AAAA,GACV;AAAA,EACD,QAAQ,GAAG,KAAK,WAAW;AAAA,EAC3B,IAAI,CAAC,QAAQ;AAAA,IACT,IAAI,OAAO,IAAI;AAAA,MACX,eAAe,IAAI,UAAU,UAAU;AAAA,MACvC,OAAO,iCAAiC,IAAI,SAAS,MAAM;AAAA,IAC/D;AAAA,IACA,MAAM,IAAI,yEAAyE,eAAe,EAAE,QAAQ,YAAY,UAAU,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;AAAA,EAC5J;AAAA,EACA,IAAI,WAAW,GAAG;AAAA,IACd,MAAM,IAAI,yHAAyH,eAAe,EAAE,QAAQ,YAAY,UAAU,IAAI,IAAI,GAAG,QAAQ,EAAE,CAAC;AAAA,EAC5M;AAAA,EACA,aAAa,IAAI;AAAA,EACjB,IAAI,OAAO,SAAS,IAAI,GAAG;AAAA,EAC3B,IAAI,CAAC,MAAM;AAAA,IACP,OAAO,IAAI;AAAA,IACX,SAAS,IAAI,KAAK,IAAI;AAAA,EAC1B;AAAA,EACA,IAAI,MAAM,KAAK,IAAI,GAAG;AAAA,EACtB,IAAI,CAAC,KAAK;AAAA,IACN,MAAM,UAAU,KAAK,GAAG,EAAE,MAAM,CAAC,UAAU;AAAA,MACvC,KAAK,OAAO,GAAG;AAAA,MACf,MAAM;AAAA,KACT;AAAA,IACD,KAAK,IAAI,KAAK,GAAG;AAAA,EACrB;AAAA,EACA,OAAO;AAAA;AAEJ,IAAM,mBAAmB,OAAO;AAChC,SAAS,cAAc,CAAC,OAAO;AAAA,EAClC,OAAO,MAAM,QAAQ,IAAI,cAAc,GAAG,MAAM,GAAG,EAAE;AAAA;AA2CzD,eAAe,oBAAoB,CAAC,IAAI,QAAQ,sBAAsB,KAAK,MAAM,SAAS,SAAS;AAAA,EAC/F,MAAM,qBAAqB,IAAI,QAAQ,MAAM,OAAO;AAAA,EACpD,QAAQ,IAAI,gBAAgB,iDAAiD;AAAA,EAC7E,QAAQ,UAAU,gBAAgB,OAAO,IAAI,MAAM;AAAA,IAC/C;AAAA,IACA,SAAS,OAAO,YAAY,QAAQ,QAAQ,CAAC;AAAA,IAC7C,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,QAAQ,OAAO,KAAK,SAAS,MAAM;AAAA,EACvC,CAAC;AAAA;AAEL,eAAe,oBAAoB,CAAC,IAAI,QAAQ,sBAAsB,WAAW,YAAY,SAAS;AAAA,EAClG,MAAM,MAAM,gBAAgB,IAAI,kBAAkB,OAAO,2BAA2B,UAAU,2BAA2B,IAAI;AAAA,EAC7H,WAAW,IAAI,cAAc,SAAS;AAAA,EACtC,MAAM,UAAU,eAAe,SAAS,OAAO;AAAA,EAC/C,QAAQ,IAAI,UAAU,kBAAkB;AAAA,EACxC,IAAI,SAAS,SAAS,WAAW;AAAA,IAC7B,WAAW,QAAQ,IAAI;AAAA,IACvB,MAAM,QAAQ,KAAK,SAAS,KAAK,SAAS,MAAM;AAAA,EACpD;AAAA,EACA,MAAM,WAAW,MAAM,qBAAqB,IAAI,QAAQ,sBAAsB,KAAK,YAAY,SAAS,OAAO;AAAA,EAC/G,SAAS,MAAM,WAAW,UAAU,GAAG;AAAA,EACvC,OAAO;AAAA;AAUX,IAAM,gBAAgB,IAAI;AAC1B,IAAM,UAAU,IAAI;AACb,SAAS,yBAAyB,CAAC,KAAK;AAAA,EAC3C,IAAI,CAAC,IAAI,UAAU;AAAA,IACf;AAAA,EACJ;AAAA,EACA,MAAM,SAAS,cAAc,IAAI,GAAG;AAAA,EACpC,IAAI,CAAC,QAAQ;AAAA,IACT,MAAM,eAAe,kFAAkF,qBAAqB;AAAA,EAChI;AAAA,EACA,OAAO;AAAA;AAEX,eAAsB,iCAAiC,CAAC,IAAI,KAAK,SAAS;AAAA,EACtE,SAAS,EAAE;AAAA,EACX,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG;AAAA,IACnB,MAAM,eAAe,8EAA8E,qBAAqB;AAAA,EAC5H;AAAA,EACA,QAAQ,GAAG,iBAAiB,GAAG,SAAS,GAAG,qBAAqB,QAAQ,IAAI,GAAG,EAAE,MAAM,GAAG;AAAA,EAC1F,MAAM,SAAS,KAAK,MAAM,IAAI,KAAK,eAAe,CAAC,CAAC;AAAA,EACpD,IAAI,OAAO,IAAI,WAAW,IAAI,GAAG;AAAA,IAC7B,MAAM,IAAI,0BAA0B,6BAA6B,EAAE,OAAO,EAAE,KAAK,OAAO,IAAI,EAAE,CAAC;AAAA,EACnG;AAAA,EACA,IAAI;AAAA,EACJ,MAAM,MAAM,iCAAiC,IAAI,SAAS,MAAM;AAAA,EAChE,MAAM,qBAAqB,iBAAiB,SAAS,KAAK,KAAK,gBAAgB,CAAC;AAAA;AAEpF,eAAe,iCAAiC,CAAC,IAAI,QAAQ,UAAU,iCAAiC,WAAW,sBAAsB;AAAA,EACrI,SAAS,EAAE;AAAA,EACX,aAAa,MAAM;AAAA,EACnB,IAAI,CAAC,gBAAgB,UAAU,QAAQ,GAAG;AAAA,IACtC,MAAM,eAAe,8CAA8C,oBAAoB;AAAA,EAC3F;AAAA,EACA,MAAM,oBAAoB,UAAU,KAAK,gBAAgB;AAAA,EACzD,uBAAuB,QAAQ;AAAA,EAC/B,MAAM,OAAO,MAAM,oBAAoB,QAAQ;AAAA,EAC/C,aAAa,KAAK,cAAc,2CAA2C,kBAAkB;AAAA,IACzF,MAAM;AAAA,EACV,CAAC;AAAA,EACD,aAAa,KAAK,YAAY,yCAAyC,kBAAkB;AAAA,IACrF,MAAM;AAAA,EACV,CAAC;AAAA,EACD,KAAK,aAAa,KAAK,WAAW,YAAY;AAAA,EAC9C,IAAI,KAAK,eAAe,WAAW;AAAA,IAC/B,IAAI,YAAY,OAAO,KAAK,eAAe,WAAW,WAAW,KAAK,UAAU,IAAI,KAAK;AAAA,IACzF,aAAa,WAAW,MAAM,yCAAyC,kBAAkB;AAAA,MACrF,MAAM;AAAA,IACV,CAAC;AAAA,IACD,KAAK,aAAa;AAAA,EACtB;AAAA,EACA,IAAI,KAAK,kBAAkB,WAAW;AAAA,IAClC,aAAa,KAAK,eAAe,4CAA4C,kBAAkB;AAAA,MAC3F,MAAM;AAAA,IACV,CAAC;AAAA,EACL;AAAA,EACA,IAAI,KAAK,UAAU,aAAa,OAAO,KAAK,UAAU,UAAU;AAAA,IAC5D,MAAM,IAAI,qDAAqD,kBAAkB,EAAE,MAAM,KAAK,CAAC;AAAA,EACnG;AAAA,EACA,IAAI,KAAK,aAAa,WAAW;AAAA,IAC7B,aAAa,KAAK,UAAU,uCAAuC,kBAAkB;AAAA,MACjF,MAAM;AAAA,IACV,CAAC;AAAA,IACD,MAAM,iBAAiB,CAAC;AAAA,IACxB,IAAI,OAAO,sBAAsB,MAAM;AAAA,MACnC,eAAe,KAAK,WAAW;AAAA,IACnC;AAAA,IACA,IAAI,OAAO,oBAAoB,WAAW;AAAA,MACtC,aAAa,OAAO,iBAAiB,MAAM,0BAA0B;AAAA,MACrE,eAAe,KAAK,WAAW;AAAA,IACnC;AAAA,IACA,IAAI,iCAAiC,QAAQ;AAAA,MACzC,eAAe,KAAK,GAAG,+BAA+B;AAAA,IAC1D;AAAA,IACA,QAAQ,QAAQ,QAAQ,MAAM,sBAAsB,IAAI,QAAQ,KAAK,UAAU,gBAAgB,SAAS;AAAA,IACxG,+BAA+B,QAAQ,MAAM;AAAA,IAC7C,6BAA6B,MAAM;AAAA,IACnC,QAAQ,IAAI,UAAU,GAAG;AAAA,IACzB,cAAc,IAAI,MAAM,MAAM;AAAA,EAClC;AAAA,EACA,IAAI,uBAAuB,KAAK,gBAAgB,WAAW;AAAA,IACvD,qBAAqB,KAAK,YAAY,UAAU,IAAI;AAAA,EACxD,EACK,SAAI,KAAK,eAAe,UAAU,KAAK,eAAe,UAAU;AAAA,IACjE,MAAM,IAAI,0BAA0B,kCAAkC,EAAE,OAAO,EAAE,MAAM,KAAK,EAAE,CAAC;AAAA,EACnG;AAAA,EACA,OAAO;AAAA;AAEX,SAAS,6BAA6B,CAAC,UAAU;AAAA,EAC7C,IAAI;AAAA,EACJ,IAAK,aAAa,+BAA+B,QAAQ,GAAI;AAAA,IACzD,MAAM,IAAI,8BAA8B,yEAAyE,EAAE,OAAO,YAAY,SAAS,CAAC;AAAA,EACpJ;AAAA;AAWJ,SAAS,gBAAgB,CAAC,UAAU,QAAQ;AAAA,EACxC,IAAI,MAAM,QAAQ,OAAO,OAAO,GAAG,GAAG;AAAA,IAClC,IAAI,CAAC,OAAO,OAAO,IAAI,SAAS,QAAQ,GAAG;AAAA,MACvC,MAAM,IAAI,+CAA+C,sBAAsB;AAAA,QAC3E;AAAA,QACA,QAAQ,OAAO;AAAA,QACf,OAAO;AAAA,MACX,CAAC;AAAA,IACL;AAAA,EACJ,EACK,SAAI,OAAO,OAAO,QAAQ,UAAU;AAAA,IACrC,MAAM,IAAI,+CAA+C,sBAAsB;AAAA,MAC3E;AAAA,MACA,QAAQ,OAAO;AAAA,MACf,OAAO;AAAA,IACX,CAAC;AAAA,EACL;AAAA,EACA,OAAO;AAAA;AAQX,SAAS,cAAc,CAAC,IAAI,QAAQ;AAAA,EAChC,MAAM,WAAW,GAAG,mBAAmB,MAAM,KAAK,GAAG;AAAA,EACrD,IAAI,OAAO,OAAO,QAAQ,UAAU;AAAA,IAChC,MAAM,IAAI,6CAA6C,sBAAsB;AAAA,MACzE;AAAA,MACA,QAAQ,OAAO;AAAA,MACf,OAAO;AAAA,IACX,CAAC;AAAA,EACL;AAAA,EACA,OAAO;AAAA;AAEX,IAAM,UAAU,IAAI;AACpB,SAAS,KAAK,CAAC,cAAc;AAAA,EACzB,QAAQ,IAAI,YAAY;AAAA,EACxB,OAAO;AAAA;AAEJ,IAAM,SAAS,OAAO;AAC7B,eAAsB,6BAA6B,CAAC,IAAI,QAAQ,sBAAsB,oBAAoB,aAAa,cAAc,SAAS;AAAA,EAC1I,SAAS,EAAE;AAAA,EACX,aAAa,MAAM;AAAA,EACnB,IAAI,CAAC,QAAQ,IAAI,kBAAkB,GAAG;AAAA,IAClC,MAAM,eAAe,qIAAqI,qBAAqB;AAAA,EACnL;AAAA,EACA,aAAa,aAAa,eAAe;AAAA,EACzC,MAAM,OAAO,sBAAsB,oBAAoB,MAAM;AAAA,EAC7D,IAAI,CAAC,MAAM;AAAA,IACP,MAAM,IAAI,iDAAiD,gBAAgB;AAAA,EAC/E;AAAA,EACA,MAAM,aAAa,IAAI,gBAAgB,SAAS,oBAAoB;AAAA,EACpE,WAAW,IAAI,gBAAgB,WAAW;AAAA,EAC1C,WAAW,IAAI,QAAQ,IAAI;AAAA,EAC3B,IAAI,iBAAiB,QAAQ;AAAA,IACzB,aAAa,cAAc,gBAAgB;AAAA,IAC3C,WAAW,IAAI,iBAAiB,YAAY;AAAA,EAChD;AAAA,EACA,OAAO,qBAAqB,IAAI,QAAQ,sBAAsB,sBAAsB,YAAY,OAAO;AAAA;AAE3G,IAAM,gBAAgB;AAAA,EAClB,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,KAAK;AAAA,EACL,WAAW;AACf;AACA,SAAS,gBAAgB,CAAC,UAAU,QAAQ;AAAA,EACxC,WAAW,SAAS,UAAU;AAAA,IAC1B,IAAI,OAAO,OAAO,WAAW,WAAW;AAAA,MACpC,MAAM,IAAI,QAAQ,WAAW,cAAc,yBAAyB,kBAAkB;AAAA,QAClF,QAAQ,OAAO;AAAA,MACnB,CAAC;AAAA,IACL;AAAA,EACJ;AAAA,EACA,OAAO;AAAA;AAEX,SAAS,mBAAmB,CAAC,OAAO,QAAQ;AAAA,EACxC,IAAI,OAAO,OAAO,OAAO,WAAW,UAAU;AAAA,IAC1C,MAAM,IAAI,mBAAmB,WAAW,cAAc,sBAAsB,kBAAkB;AAAA,MAC1F,QAAQ,OAAO;AAAA,IACnB,CAAC;AAAA,EACL;AAAA,EACA,OAAO;AAAA;AAEX,SAAS,qBAAqB,CAAC,IAAI,QAAQ,SAAS,gBAAgB,WAAW;AAAA,EAC3E,OAAO,YAAY,SAAS,sBAAsB,KAAK,WAAW,OAAO,8BAA8B,GAAG,uCAAuC,OAAO,GAAG,aAAa,MAAM,GAAG,kBAAkB,MAAM,GAAG,SAAS,EAChN,KAAK,iBAAiB,KAAK,WAAW,CAAC,OAAO,OAAO,OAAO,OAAO,OAAO,GAAG,cAAc,CAAC,CAAC,EAC7F,KAAK,eAAe,KAAK,WAAW,EAAE,CAAC,EACvC,KAAK,iBAAiB,KAAK,WAAW,OAAO,SAAS,CAAC,EACvD,KAAK,oBAAoB,KAAK,WAAW,KAAK,CAAC;AAAA;AAExD,SAAS,oBAAoB,CAAC,QAAQ,QAAQ;AAAA,EAC1C,IAAI,WAAW,mBAAmB;AAAA,IAC9B,OAAO;AAAA,EACX;AAAA,EACA,MAAM,aAAa,WAAW;AAAA,EAC9B,IAAI,YAAY;AAAA,IACZ,SAAS,OAAO;AAAA,EACpB;AAAA,EACA,IAAI,WAAW,WAAW;AAAA,IACtB,OAAO;AAAA,EACX;AAAA,EACA,aAAa,QAAQ,MAAM,aAAa,6BAA6B,mBAAmB;AAAA,EACxF,OAAO;AAAA;AAEX,SAAS,4BAA4B,CAAC,QAAQ;AAAA,EAC1C,IAAI,OAAO,cAAc,WAAW;AAAA,IAChC,aAAa,OAAO,WAAW,MAAM,8CAA8C,kBAAkB,EAAE,OAAO,CAAC;AAAA,EACnH;AAAA;AAEJ,SAAS,uBAAuB,CAAC,QAAQ,QAAQ,QAAQ;AAAA,EACrD,IAAI,WAAW,mBAAmB;AAAA,IAC9B;AAAA,EACJ;AAAA,EACA,MAAM,MAAM,UAAU,IAAI,aAAa,MAAM;AAAA,EAC7C,MAAM,YAAY,kBAAkB,MAAM;AAAA,EAC1C,IAAI,OAAO,YAAY,SAAS,MAAM,WAAW;AAAA,IAC7C,MAAM,IAAI,oEAAoE,qBAAqB,EAAE,QAAQ,KAAK,WAAW,OAAO,YAAY,CAAC;AAAA,EACrJ;AAAA;AAEJ,SAAS,oBAAoB,CAAC,QAAQ,eAAe;AAAA,EACjD,MAAM,WAAW,kBAAkB,gBAAgB,YAAY;AAAA,EAC/D,IAAI,OAAO,UAAU,UAAU;AAAA,IAC3B,MAAM,IAAI,2CAA2C,sBAAsB;AAAA,MACvE;AAAA,MACA;AAAA,MACA,OAAO;AAAA,IACX,CAAC;AAAA,EACL;AAAA;AAEJ,SAAS,8BAA8B,CAAC,QAAQ,QAAQ;AAAA,EACpD,IAAI,MAAM,QAAQ,OAAO,GAAG,KAAK,OAAO,IAAI,WAAW,GAAG;AAAA,IACtD,IAAI,OAAO,QAAQ,WAAW;AAAA,MAC1B,MAAM,IAAI,2EAA2E,sBAAsB,EAAE,QAAQ,OAAO,MAAM,CAAC;AAAA,IACvI;AAAA,IACA,IAAI,OAAO,QAAQ,OAAO,WAAW;AAAA,MACjC,MAAM,IAAI,4DAA4D,sBAAsB;AAAA,QACxF,UAAU,OAAO;AAAA,QACjB;AAAA,QACA,OAAO;AAAA,MACX,CAAC;AAAA,IACL;AAAA,EACJ;AAAA;AAEG,IAAM,gBAAgB,OAAO;AAC7B,IAAM,oBAAoB,OAAO;AACxC,eAAsB,gCAAgC,CAAC,IAAI,QAAQ,UAAU,SAAS;AAAA,EAClF,IAAI,OAAO,SAAS,kBAAkB,YAClC,OAAO,SAAS,WAAW,YAC3B,SAAS,gBAAgB;AAAA,IACzB,OAAO,uCAAuC,IAAI,QAAQ,UAAU,QAAQ,eAAe,QAAQ,QAAQ,QAAQ,aAAa,QAAQ,oBAAoB;AAAA,EAChK;AAAA,EACA,OAAO,uCAAuC,IAAI,QAAQ,UAAU,SAAS,QAAQ,UAAU,aAAa,SAAS,oBAAoB;AAAA;AAE7I,eAAe,sCAAsC,CAAC,IAAI,QAAQ,UAAU,eAAe,QAAQ,WAAW,sBAAsB;AAAA,EAChI,MAAM,2BAA2B,CAAC;AAAA,EAClC,QAAQ;AAAA,SACC;AAAA,MACD,gBAAgB;AAAA,MAChB;AAAA,SACC;AAAA,MACD;AAAA;AAAA,MAEA,aAAa,eAAe,0BAA0B;AAAA,MACtD,yBAAyB,KAAK,OAAO;AAAA;AAAA,EAE7C,SAAS,qBAAqB,QAAQ,MAAM;AAAA,EAC5C,IAAI,WAAW,mBAAmB;AAAA,IAC9B,yBAAyB,KAAK,WAAW;AAAA,EAC7C;AAAA,EACA,MAAM,SAAS,MAAM,kCAAkC,IAAI,QAAQ,UAAU,0BAA0B,WAAW,oBAAoB;AAAA,EACtI,aAAa,OAAO,UAAU,uCAAuC,kBAAkB;AAAA,IACnF,MAAM;AAAA,EACV,CAAC;AAAA,EACD,MAAM,SAAS,0BAA0B,MAAM;AAAA,EAC/C,wBAAwB,QAAQ,QAAQ,MAAM;AAAA,EAC9C,qBAAqB,QAAQ,aAAa;AAAA,EAC1C,OAAO;AAAA;AAEX,eAAe,sCAAsC,CAAC,IAAI,QAAQ,UAAU,QAAQ,WAAW,sBAAsB;AAAA,EACjH,MAAM,SAAS,MAAM,kCAAkC,IAAI,QAAQ,UAAU,WAAW,WAAW,oBAAoB;AAAA,EACvH,MAAM,SAAS,0BAA0B,MAAM;AAAA,EAC/C,IAAI,QAAQ;AAAA,IACR,wBAAwB,QAAQ,QAAQ,qBAAqB,QAAQ,MAAM,CAAC;AAAA,IAC5E,qBAAqB,QAAQ,aAAa;AAAA,EAC9C;AAAA,EACA,OAAO;AAAA;AAEJ,IAAM,6BAA6B;AACnC,IAAM,sBAAsB;AAC5B,IAAM,wBAAwB;AAC9B,IAAM,+BAA+B;AAErC,IAAM,cAAc;AACpB,IAAM,mBAAmB;AAEzB,IAAM,uBAAuB;AAC7B,IAAM,0BAA0B;AAChC,IAAM,yBAAyB;AAC/B,IAAM,6BAA6B;AACnC,IAAM,sBAAsB;AAC5B,IAAM,uBAAuB;AAC7B,IAAM,4BAA4B;AAClC,IAAM,gBAAgB;AACtB,IAAM,0BAA0B;AAChC,IAAM,0BAA0B;AA4CvC,SAAS,sBAAsB,CAAC,UAAU;AAAA,EACtC,IAAI,SAAS,UAAU;AAAA,IACnB,MAAM,eAAe,yCAAyC,qBAAqB;AAAA,EACvF;AAAA;AAoDJ,eAAe,WAAW,CAAC,IAAI,SAAS;AAAA,EACpC,SAAS,EAAE;AAAA,EACX,MAAM,MAAM,gBAAgB,IAAI,YAAY,OAAO,UAAU,2BAA2B,IAAI;AAAA,EAC5F,MAAM,UAAU,eAAe,SAAS,OAAO;AAAA,EAC/C,QAAQ,IAAI,UAAU,kBAAkB;AAAA,EACxC,QAAQ,OAAO,UAAU,0BAA0B;AAAA,EACnD,MAAM,iBAAiB,OAAO,YAAY,QAAQ,QAAQ,CAAC;AAAA,EAC3D,MAAM,aAAa,KAAK,UAAU,cAAc;AAAA,EAChD,MAAM,UAAU,UAAU,gBAAgB;AAAA,EAC1C,MAAM,gBAAgB,OAAO,KAAK,SAAS,MAAM;AAAA,EACjD,iBAAiB,IAAI;AAAA,EACrB,MAAM,WAAW,aAAa,IAAI,EAAE,KAAK,IAAI;AAAA,EAC7C,WAAW,WAAW,UAAU;AAAA,IAC5B,IAAI,QAAQ,QAAQ,IAAI,QACpB,QAAQ,YAAY,cACpB,QAAQ,UAAU,WAClB,QAAQ,WAAW,eAAe;AAAA,MAClC,OAAO,QAAQ;AAAA,IACnB;AAAA,EACJ;AAAA,EACA,MAAM,UAAU;AAAA,IACZ,KAAK,IAAI;AAAA,IACT,SAAS;AAAA,IACT,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS,QAAQ,QAAQ,EACpB,KAAK,MAAM,QAAQ,IAAI,MAAM;AAAA,MAC9B,MAAM;AAAA,MACN,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,QAAQ;AAAA,IACZ,CAAC,CAAC,EACG,KAAK,mBAAmB,EACxB,KAAK,CAAC,SAAS;AAAA,MAChB,MAAM,MAAM,UAAU;AAAA,MACtB,aAAa,IAAI,MAAM,GAAG;AAAA,MAC1B,OAAO,EAAE,MAAM,IAAI;AAAA,KACtB,EACI,QAAQ,MAAM;AAAA,MACf,SAAS,OAAO,OAAO;AAAA,MACvB,IAAI,CAAC,SAAS,MAAM;AAAA,QAChB,aAAa,OAAO,EAAE;AAAA,MAC1B;AAAA,KACH;AAAA,EACL;AAAA,EACA,SAAS,IAAI,OAAO;AAAA,EACpB,aAAa,IAAI,IAAI,QAAQ;AAAA,EAC7B,OAAO,QAAQ;AAAA;AAEnB,eAAe,mBAAmB,CAAC,UAAU;AAAA,EACzC,IAAI,CAAC,gBAAgB,UAAU,QAAQ,GAAG;AAAA,IACtC,MAAM,eAAe,8CAA8C,oBAAoB;AAAA,EAC3F;AAAA,EACA,IAAI,SAAS,WAAW,KAAK;AAAA,IACzB,MAAM,IAAI,uFAAuF,yBAAyB,QAAQ;AAAA,EACtI;AAAA,EACA,uBAAuB,QAAQ;AAAA,EAC/B,MAAM,OAAO,MAAM,oBAAoB,UAAU,CAAC,aAAa,mBAAmB,UAAU,oBAAoB,0BAA0B,CAAC;AAAA,EAC3I,IAAI,CAAC,MAAM,QAAQ,KAAK,IAAI,GAAG;AAAA,IAC3B,MAAM,IAAI,oDAAoD,kBAAkB,EAAE,MAAM,KAAK,CAAC;AAAA,EAClG;AAAA,EACA,IAAI,CAAC,MAAM,UAAU,MAAM,KAAK,KAAK,MAAM,YAAY,GAAG;AAAA,IACtD,MAAM,IAAI,yEAAyE,kBAAkB,EAAE,MAAM,KAAK,CAAC;AAAA,EACvH;AAAA,EACA,OAAO;AAAA;AAEX,SAAS,SAAS,CAAC,KAAK;AAAA,EACpB,QAAQ;AAAA,SACC;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,MACD,OAAO;AAAA;AAAA,MAEP,OAAO;AAAA;AAAA;AAGnB,SAAS,oBAAoB,CAAC,QAAQ;AAAA,EAClC,IAAI,CAAC,UAAU,OAAO,GAAG,GAAG;AAAA,IACxB,MAAM,IAAI,0BAA0B,oCAAoC;AAAA,MACpE,OAAO,EAAE,KAAK,OAAO,IAAI;AAAA,IAC7B,CAAC;AAAA,EACL;AAAA;AAEJ,SAAS,oBAAoB,CAAC,KAAK;AAAA,EAC/B,QAAQ,cAAc;AAAA,EACtB,IAAI,OAAO,UAAU,kBAAkB,YAAY,UAAU,gBAAgB,MAAM;AAAA,IAC/E,MAAM,IAAI,0BAA0B,eAAe,UAAU,sBAAsB;AAAA,MAC/E,OAAO;AAAA,IACX,CAAC;AAAA,EACL;AAAA;AAEJ,SAAS,aAAa,CAAC,KAAK;AAAA,EACxB,QAAQ,cAAc;AAAA,EACtB,QAAQ,UAAU;AAAA,SACT;AAAA,MACD,OAAO;AAAA,SACN;AAAA,MACD,OAAO;AAAA,SACN;AAAA,MACD,OAAO;AAAA;AAAA,MAEP,MAAM,IAAI,0BAA0B,gCAAgC,EAAE,OAAO,IAAI,CAAC;AAAA;AAAA;AAG9F,SAAS,WAAW,CAAC,KAAK;AAAA,EACtB,QAAQ,IAAI,UAAU;AAAA,SACb;AAAA,MACD,OAAO;AAAA,QACH,MAAM,IAAI,UAAU;AAAA,QACpB,MAAM,cAAc,GAAG;AAAA,MAC3B;AAAA,SACC,WAAW;AAAA,MACZ,qBAAqB,GAAG;AAAA,MACxB,QAAQ,IAAI,UAAU,KAAK;AAAA,aAClB;AAAA,aACA;AAAA,aACA;AAAA,UACD,OAAO;AAAA,YACH,MAAM,IAAI,UAAU;AAAA,YACpB,YAAY,SAAS,IAAI,UAAU,KAAK,KAAK,MAAM,EAAE,GAAG,EAAE,KAAK;AAAA,UACnE;AAAA;AAAA,UAEA,MAAM,IAAI,0BAA0B,iCAAiC,EAAE,OAAO,IAAI,CAAC;AAAA;AAAA,IAE/F;AAAA,SACK;AAAA,MACD,qBAAqB,GAAG;AAAA,MACxB,OAAO,IAAI,UAAU;AAAA,SACpB;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,MACD,OAAO,IAAI,UAAU;AAAA;AAAA,EAE7B,MAAM,IAAI,0BAA0B,wCAAwC,EAAE,OAAO,IAAI,CAAC;AAAA;AAE9F,eAAe,oBAAoB,CAAC,iBAAiB,SAAS,KAAK,WAAW;AAAA,EAC1E,MAAM,OAAO,IAAI,GAAG,mBAAmB,SAAS;AAAA,EAChD,MAAM,YAAY,YAAY,GAAG;AAAA,EACjC,MAAM,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,KAAK,WAAW,IAAI;AAAA,EAC3E,IAAI,CAAC,UAAU;AAAA,IACX,MAAM,IAAI,qCAAqC,kBAAkB;AAAA,MAC7D;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAEJ,eAAe,WAAW,CAAC,KAAK,UAAU,WAAW,gBAAgB,YAAY;AAAA,EAC7E,MAAM,GAAG,iBAAiB,GAAG,SAAS,WAAW,IAAI,MAAM,GAAG;AAAA,EAC9D,IAAI,WAAW,GAAG;AAAA,IACd,IAAI,eAAe,WAAW;AAAA,MAC1B,MAAM,MAAM,WAAW,GAAG;AAAA,OACzB,EAAE,GAAG,iBAAiB,GAAG,SAAS,OAAO,IAAI,IAAI,MAAM,GAAG;AAAA,IAC/D,EACK;AAAA,MACD,MAAM,IAAI,0BAA0B,oCAAoC,EAAE,OAAO,IAAI,CAAC;AAAA;AAAA,EAE9F;AAAA,EACA,IAAI,WAAW,GAAG;AAAA,IACd,MAAM,IAAI,eAAe,kBAAkB,GAAG;AAAA,EAClD;AAAA,EACA,IAAI;AAAA,EACJ,IAAI;AAAA,IACA,SAAS,KAAK,MAAM,IAAI,KAAK,eAAe,CAAC,CAAC;AAAA,IAElD,OAAO,OAAO;AAAA,IACV,MAAM,IAAI,6DAA6D,aAAa,KAAK;AAAA;AAAA,EAE7F,IAAI,CAAC,aAAa,MAAM,GAAG;AAAA,IACvB,MAAM,IAAI,yCAAyC,kBAAkB,GAAG;AAAA,EAC5E;AAAA,EACA,SAAS,MAAM;AAAA,EACf,IAAI,OAAO,SAAS,WAAW;AAAA,IAC3B,MAAM,IAAI,0BAA0B,2DAA2D;AAAA,MAC3F,OAAO,EAAE,OAAO;AAAA,IACpB,CAAC;AAAA,EACL;AAAA,EACA,IAAI;AAAA,EACJ,IAAI;AAAA,IACA,SAAS,KAAK,MAAM,IAAI,KAAK,OAAO,CAAC,CAAC;AAAA,IAE1C,OAAO,OAAO;AAAA,IACV,MAAM,IAAI,8DAA8D,aAAa,KAAK;AAAA;AAAA,EAE9F,IAAI,CAAC,aAAa,MAAM,GAAG;AAAA,IACvB,MAAM,IAAI,0CAA0C,kBAAkB,GAAG;AAAA,EAC7E;AAAA,EACA,MAAM,MAAM,UAAU,IAAI;AAAA,EAC1B,IAAI,OAAO,QAAQ,WAAW;AAAA,IAC1B,IAAI,OAAO,OAAO,QAAQ,UAAU;AAAA,MAChC,MAAM,IAAI,qDAAqD,kBAAkB,EAAE,OAAO,CAAC;AAAA,IAC/F;AAAA,IACA,IAAI,OAAO,OAAO,MAAM,gBAAgB;AAAA,MACpC,MAAM,IAAI,4FAA4F,qBAAqB,EAAE,QAAQ,KAAK,WAAW,gBAAgB,OAAO,MAAM,CAAC;AAAA,IACvL;AAAA,EACJ;AAAA,EACA,IAAI,OAAO,QAAQ,WAAW;AAAA,IAC1B,IAAI,OAAO,OAAO,QAAQ,UAAU;AAAA,MAChC,MAAM,IAAI,+CAA+C,kBAAkB,EAAE,OAAO,CAAC;AAAA,IACzF;AAAA,EACJ;AAAA,EACA,IAAI,OAAO,QAAQ,WAAW;AAAA,IAC1B,IAAI,OAAO,OAAO,QAAQ,UAAU;AAAA,MAChC,MAAM,IAAI,4CAA4C,kBAAkB,EAAE,OAAO,CAAC;AAAA,IACtF;AAAA,EACJ;AAAA,EACA,IAAI,OAAO,QAAQ,WAAW;AAAA,IAC1B,IAAI,OAAO,OAAO,QAAQ,UAAU;AAAA,MAChC,MAAM,IAAI,gDAAgD,kBAAkB,EAAE,OAAO,CAAC;AAAA,IAC1F;AAAA,IACA,IAAI,OAAO,MAAM,MAAM,gBAAgB;AAAA,MACnC,MAAM,IAAI,iDAAiD,qBAAqB;AAAA,QAC5E;AAAA,QACA;AAAA,QACA,WAAW;AAAA,QACX,OAAO;AAAA,MACX,CAAC;AAAA,IACL;AAAA,EACJ;AAAA,EACA,IAAI,OAAO,QAAQ,WAAW;AAAA,IAC1B,IAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,MAAM,QAAQ,OAAO,GAAG,GAAG;AAAA,MAC9D,MAAM,IAAI,8CAA8C,kBAAkB,EAAE,OAAO,CAAC;AAAA,IACxF;AAAA,EACJ;AAAA,EACA,OAAO,EAAE,QAAQ,QAAQ,KAAK,IAAI;AAAA;AAwEtC,eAAe,aAAa,CAAC,SAAS;AAAA,EAClC,IAAI,QAAQ,UAAU;AAAA,IAClB,MAAM,eAAe,4DAA4D,uBAAuB,EAAE,OAAO,QAAQ,CAAC;AAAA,EAC9H;AAAA,EACA,OAAO,QAAQ,KAAK;AAAA;AAExB,eAAsB,gBAAgB,CAAC,SAAS;AAAA,EAC5C,IAAI,QAAQ,WAAW,QAAQ;AAAA,IAC3B,MAAM,eAAe,2DAA2D,uBAAuB,EAAE,OAAO,QAAQ,CAAC;AAAA,EAC7H;AAAA,EACA,IAAI,eAAe,OAAO,MAAM,qCAAqC;AAAA,IACjE,MAAM,eAAe,8FAA8F,uBAAuB,EAAE,OAAO,QAAQ,CAAC;AAAA,EAChK;AAAA,EACA,OAAO,cAAc,OAAO;AAAA;AA2FhC,SAAS,qBAAqB,CAAC,QAAQ,QAAQ,UAAU,QAAQ;AAAA,EAC7D,IAAI,WAAW,WAAW;AAAA,IACtB,IAAI,OAAO,WAAW,WAAW,OAAO,QAAQ,SAAS,CAAC,OAAO,SAAS,OAAO,GAAG,GAAG;AAAA,MACnF,MAAM,IAAI,yCAAyC,kBAAkB;AAAA,QACjE;AAAA,QACA,UAAU;AAAA,QACV,QAAQ;AAAA,MACZ,CAAC;AAAA,IACL;AAAA,IACA;AAAA,EACJ;AAAA,EACA,IAAI,MAAM,QAAQ,MAAM,GAAG;AAAA,IACvB,IAAI,CAAC,OAAO,SAAS,OAAO,GAAG,GAAG;AAAA,MAC9B,MAAM,IAAI,yCAAyC,kBAAkB;AAAA,QACjE;AAAA,QACA,UAAU;AAAA,QACV,QAAQ;AAAA,MACZ,CAAC;AAAA,IACL;AAAA,IACA;AAAA,EACJ;AAAA,EACA,IAAI,aAAa,WAAW;AAAA,IACxB,IAAI,OAAO,aAAa,WAClB,OAAO,QAAQ,WACf,OAAO,aAAa,aAChB,CAAC,SAAS,OAAO,GAAG,IACpB,CAAC,SAAS,SAAS,OAAO,GAAG,GAAG;AAAA,MACtC,MAAM,IAAI,yCAAyC,kBAAkB;AAAA,QACjE;AAAA,QACA,UAAU;AAAA,QACV,QAAQ;AAAA,MACZ,CAAC;AAAA,IACL;AAAA,IACA;AAAA,EACJ;AAAA,EACA,MAAM,IAAI,oFAAoF,WAAW,EAAE,QAAQ,QAAQ,SAAS,CAAC;AAAA;AAEzI,SAAS,qBAAqB,CAAC,YAAY,MAAM;AAAA,EAC7C,QAAQ,GAAG,OAAO,WAAW,WAAW,OAAO,IAAI;AAAA,EACnD,IAAI,SAAS,GAAG;AAAA,IACZ,MAAM,IAAI,IAAI,8CAA8C,gBAAgB;AAAA,EAChF;AAAA,EACA,OAAO;AAAA;AAEJ,IAAM,iBAAiB,OAAO;AAC9B,IAAM,gBAAgB,OAAO;AAC7B,SAAS,oBAAoB,CAAC,IAAI,QAAQ,YAAY,eAAe;AAAA,EACxE,SAAS,EAAE;AAAA,EACX,aAAa,MAAM;AAAA,EACnB,IAAI,sBAAsB,KAAK;AAAA,IAC3B,aAAa,WAAW;AAAA,EAC5B;AAAA,EACA,IAAI,EAAE,sBAAsB,kBAAkB;AAAA,IAC1C,MAAM,eAAe,+DAA+D,oBAAoB;AAAA,EAC5G;AAAA,EACA,IAAI,sBAAsB,YAAY,UAAU,GAAG;AAAA,IAC/C,MAAM,IAAI,0GAA0G,kBAAkB,EAAE,WAAW,CAAC;AAAA,EACxJ;AAAA,EACA,MAAM,MAAM,sBAAsB,YAAY,KAAK;AAAA,EACnD,MAAM,QAAQ,sBAAsB,YAAY,OAAO;AAAA,EACvD,IAAI,CAAC,OAAO,GAAG,gDAAgD;AAAA,IAC3D,MAAM,IAAI,6CAA6C,kBAAkB,EAAE,WAAW,CAAC;AAAA,EAC3F;AAAA,EACA,IAAI,OAAO,QAAQ,GAAG,QAAQ;AAAA,IAC1B,MAAM,IAAI,sDAAsD,kBAAkB;AAAA,MAC9E,UAAU,GAAG;AAAA,MACb;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EACA,QAAQ;AAAA,SACC;AAAA,SACA;AAAA,MACD,IAAI,UAAU,WAAW;AAAA,QACrB,MAAM,IAAI,qDAAqD,kBAAkB;AAAA,UAC7E,UAAU;AAAA,UACV;AAAA,QACJ,CAAC;AAAA,MACL;AAAA,MACA;AAAA,SACC;AAAA,MACD;AAAA;AAAA,MAEA,aAAa,eAAe,0BAA0B;AAAA,MACtD,IAAI,UAAU,eAAe;AAAA,QACzB,MAAM,IAAI,UAAU,YACd,uCACA,+CAA+C,kBAAkB,EAAE,UAAU,eAAe,WAAW,CAAC;AAAA,MAClH;AAAA;AAAA,EAER,MAAM,QAAQ,sBAAsB,YAAY,OAAO;AAAA,EACvD,IAAI,OAAO;AAAA,IACP,MAAM,IAAI,2BAA2B,sDAAsD;AAAA,MACvF,OAAO;AAAA,IACX,CAAC;AAAA,EACL;AAAA,EACA,MAAM,WAAW,sBAAsB,YAAY,UAAU;AAAA,EAC7D,MAAM,QAAQ,sBAAsB,YAAY,OAAO;AAAA,EACvD,IAAI,aAAa,aAAa,UAAU,WAAW;AAAA,IAC/C,MAAM,IAAI,0BAA0B,6CAA6C;AAAA,EACrF;AAAA,EACA,OAAO,MAAM,IAAI,gBAAgB,UAAU,CAAC;AAAA;AAEhD,SAAS,WAAW,CAAC,KAAK;AAAA,EACtB,QAAQ;AAAA,SACC;AAAA,SACA;AAAA,SACA;AAAA,MACD,OAAO,EAAE,MAAM,WAAW,MAAM,OAAO,IAAI,MAAM,EAAE,IAAI;AAAA,SACtD;AAAA,SACA;AAAA,SACA;AAAA,MACD,OAAO,EAAE,MAAM,qBAAqB,MAAM,OAAO,IAAI,MAAM,EAAE,IAAI;AAAA,SAChE;AAAA,SACA;AAAA,MACD,OAAO,EAAE,MAAM,SAAS,YAAY,KAAK,IAAI,MAAM,EAAE,IAAI;AAAA,SACxD;AAAA,MACD,OAAO,EAAE,MAAM,SAAS,YAAY,QAAQ;AAAA,SAC3C;AAAA,MACD,OAAO;AAAA,SACN;AAAA,SACA;AAAA,SACA;AAAA,SACA;AAAA,MACD,OAAO;AAAA;AAAA,MAEP,MAAM,IAAI,0BAA0B,6BAA6B,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAAA;AAAA;AAG/F,eAAe,SAAS,CAAC,KAAK,KAAK;AAAA,EAC/B,QAAQ,KAAK,SAAS,QAAQ,QAAQ;AAAA,EACtC,OAAO,OAAO,OAAO,UAAU,OAAO,KAAK,YAAY,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC;AAAA;AAmWjF,eAAe,mBAAmB,CAAC,UAAU,QAAQ,uBAAuB;AAAA,EACxE,IAAI;AAAA,EACJ,IAAI;AAAA,IACA,OAAO,MAAM,SAAS,KAAK;AAAA,IAE/B,OAAO,OAAO;AAAA,IACV,MAAM,QAAQ;AAAA,IACd,MAAM,IAAI,2CAA2C,aAAa,KAAK;AAAA;AAAA,EAE3E,IAAI,CAAC,aAAa,IAAI,GAAG;AAAA,IACrB,MAAM,IAAI,8CAA8C,kBAAkB,EAAE,MAAM,KAAK,CAAC;AAAA,EAC5F;AAAA,EACA,OAAO;AAAA;AAGJ,IAAM,oBAAoB,OAAO;AACjC,IAAM,kBAAkB,OAAO;;;AC59EtC,IAAI;AACJ,IAAI;AACJ,IAAI,OAAO,cAAc,eAAe,CAAC,UAAU,WAAW,aAAa,cAAc,GAAG;AAAA,EACxF,MAAM,OAAO;AAAA,EACb,MAAM,UAAU;AAAA,EAChB,cAAa,GAAG,QAAQ;AAAA,EACxB,UAAU,EAAE,cAAc,YAAW;AACzC;AACA,IAAM,MAAM,CAAC,WAAW;AAAA,EACpB,OAAO,MAAM,IAAI,MAAM;AAAA;AAE3B,IAAI;AAEJ,IAAI;AACG,SAAS,iBAAgB,CAAC,cAAc;AAAA,EAC3C,IAAI,iBAAiB,WAAW;AAAA,IAC5B,OAAa,iBAAiB,YAAY;AAAA,EAC9C;AAAA,EACA,QAAQ,IAAI;AAAA,EACZ,OAAO,CAAC,IAAI,QAAQ,MAAM,YAAY;AAAA,IAClC,IAAI;AAAA,IACJ,IAAI,EAAE,OAAO,IAAI,IAAI,MAAM,IAAI;AAAA,MAC3B,cAAa,OAAO,eAAe,0BAA0B;AAAA,MAC7D,OAAa,iBAAiB,OAAO,aAAa;AAAA,MAClD,IAAI,IAAI,QAAQ,IAAI;AAAA,IACxB;AAAA,IACA,OAAO,KAAK,IAAI,QAAQ,MAAM,OAAO;AAAA;AAAA;AAG7C,SAAS,aAAY,CAAC,OAAO,IAAI;AAAA,EAC7B,IAAI,OAAO,UAAU,UAAU;AAAA,IAC3B,MAAM,gBAAe,GAAG,uBAAuB,qBAAoB;AAAA,EACvE;AAAA,EACA,IAAI,MAAM,WAAW,GAAG;AAAA,IACpB,MAAM,gBAAe,GAAG,wBAAwB,sBAAqB;AAAA,EACzE;AAAA;AAEG,SAAS,kBAAiB,CAAC,cAAc;AAAA,EAC5C,IAAI,iBAAiB,WAAW;AAAA,IAC5B,OAAa,kBAAkB,YAAY;AAAA,EAC/C;AAAA,EACA,QAAQ,IAAI;AAAA,EACZ,OAAO,CAAC,IAAI,QAAQ,MAAM,YAAY;AAAA,IAClC,IAAI;AAAA,IACJ,IAAI,EAAE,OAAO,IAAI,IAAI,MAAM,IAAI;AAAA,MAC3B,cAAa,OAAO,eAAe,0BAA0B;AAAA,MAC7D,OAAa,kBAAkB,OAAO,aAAa;AAAA,MACnD,IAAI,IAAI,QAAQ,IAAI;AAAA,IACxB;AAAA,IACA,OAAO,KAAK,IAAI,QAAQ,MAAM,OAAO;AAAA;AAAA;AAkBtC,SAAS,KAAI,GAAG;AAAA,EACnB,OAAa,KAAK;AAAA;AAUf,IAAM,eAAoB;AAIjC,IAAM,yBAAwB;AAC9B,IAAM,wBAAuB;AAC7B,SAAS,eAAc,CAAC,SAAS,MAAM,OAAO;AAAA,EAC1C,MAAM,MAAM,IAAI,UAAU,SAAS,EAAE,MAAM,CAAC;AAAA,EAC5C,OAAO,OAAO,KAAK,EAAE,KAAK,CAAC;AAAA,EAC3B,OAAO;AAAA;AAEJ,SAAS,2BAA0B,CAAC,cAAc;AAAA,EACrD,OAAa,2BAA2B,YAAY;AAAA;AAEjD,SAAS,sBAAsB,GAAG;AAAA,EACrC,OAAa,2BAA2B;AAAA;AAErC,SAAS,WAAW,GAAG;AAAA,EAC1B,OAAa,oBAAoB;AAAA;AAE9B,SAAS,WAAW,GAAG;AAAA,EAC1B,OAAa,oBAAoB;AAAA;AAAA;AAE9B,MAAM,oBAAoB,MAAM;AAAA,EACnC;AAAA,EACA,WAAW,CAAC,SAAS,SAAS;AAAA,IAC1B,MAAM,SAAS,OAAO;AAAA,IACtB,KAAK,OAAO,KAAK,YAAY;AAAA,IAC7B,KAAK,OAAO,SAAS;AAAA,IACrB,MAAM,oBAAoB,MAAM,KAAK,WAAW;AAAA;AAExD;AACA,IAAM,WAAU,IAAI;AACpB,SAAS,CAAC,CAAC,KAAK,OAAO,MAAM;AAAA,EACzB,OAAO,IAAI,YAAY,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA;AAE/C,SAAS,YAAY,CAAC,KAAK;AAAA,EACvB,IAAI,eAAe,aACf,eAAe,eACf,eAAqB,qBACrB,eAAqB,8BACrB,eAAqB,+BAA+B;AAAA,IACpD,MAAM;AAAA,EACV;AAAA,EACA,IAAI,eAAqB,0BAA0B;AAAA,IAC/C,QAAQ,IAAI;AAAA,WACG;AAAA,QACP,MAAM,EAAE,sCAAsC,KAAK,IAAI,IAAI;AAAA,WACpD;AAAA,QACP,MAAM,EAAE,8CAA8C,KAAK,IAAI,IAAI;AAAA,WAC5D;AAAA,QACP,MAAM,EAAE,wCAAwC,IAAI,OAAO,IAAI,IAAI;AAAA,WAC5D;AAAA,QACP,MAAM,EAAE,oCAAoC,IAAI,OAAO,IAAI,IAAI;AAAA,WACxD;AAAA,QACP,MAAM,EAAE,yBAAyB,KAAK,IAAI,IAAI;AAAA,WACvC;AAAA,QACP,MAAM,EAAE,gCAAgC,KAAK,IAAI,IAAI;AAAA,WAC9C;AAAA,QACP,MAAM,EAAE,0CAA0C,KAAK,IAAI,IAAI;AAAA,WACxD;AAAA,QACP,MAAM,EAAE,+CAA+C,KAAK,IAAI,IAAI;AAAA,WAC7D;AAAA,QACP,MAAM,EAAE,+CAA+C,KAAK,IAAI,IAAI;AAAA;AAAA,QAEpE,MAAM,EAAE,IAAI,SAAS,KAAK,IAAI,IAAI;AAAA;AAAA,EAE9C;AAAA,EACA,IAAI,eAAqB,2BAA2B;AAAA,IAChD,MAAM,EAAE,yBAAyB,KAAK,IAAI,IAAI;AAAA,EAClD;AAAA,EACA,IAAI,eAAe,cAAc;AAAA,IAC7B,QAAQ,IAAI;AAAA,WACH;AAAA,QACD,MAAM,EAAE,2BAA2B,KAAW,qBAAqB;AAAA,WAClE;AAAA,QACD,MAAM,EAAE,iCAAiC,KAAW,qBAAqB;AAAA,WACxE;AAAA,QACD,MAAM,EAAE,uBAAuB,KAAK,eAAe;AAAA,WAClD;AAAA,QACD,MAAM,EAAE,qBAAqB,KAAK,aAAa;AAAA;AAAA,EAE3D;AAAA,EACA,MAAM,IAAI,YAAY,wBAAwB,EAAE,OAAO,IAAI,CAAC;AAAA;AAShE,SAAS,aAAa,CAAC,QAAQ,IAAI,SAAS;AAAA,EACxC,IAAI,OAAO,WAAW,wCACjB,CAAC,SAAS,aAAa,QAAQ,cAAc,SAAS;AAAA,IACvD,GAAG,YAAY;AAAA,IACf,OAAO;AAAA,EACX;AAAA,EACA,OAAO;AAAA;AAEX,SAAS,cAAc,CAAC,QAAQ,SAAS;AAAA,EACrC,IAAI,OAAO,SAAS,SAAS,eAAe,MACvC,CAAC,SAAS,aAAa,QAAQ,cAAc,SAAS;AAAA,IACvD,OAAO;AAAA,EACX;AAAA,EACA,OAAO;AAAA;AAuDX,eAAsB,SAAS,CAAC,QAAQ,UAAU,UAAU,sBAAsB,SAAS;AAAA,EACvF,MAAM,KAAK,MAAM,kBAAiB,QAAQ,OAAO;AAAA,EACjD,MAAM,WAAW,IAAI,cAAc,IAAI,UAAU,UAAU,oBAAoB;AAAA,EAC/E,IAAI,YAAY,IAAI,QAAQ;AAAA,EAC5B,IAAI,UAAU,eAAc;AAAA,IACxB,UAAU,QAAQ,QAAQ;AAAA,EAC9B;AAAA,EACA,IAAI,SAAS,SAAS;AAAA,IAClB,UAAU,UAAU,QAAQ;AAAA,EAChC;AAAA,EACA,IAAI,SAAS,SAAS;AAAA,IAClB,WAAW,aAAa,QAAQ,SAAS;AAAA,MACrC,UAAU,QAAQ;AAAA,IACtB;AAAA,EACJ;AAAA,EACA,OAAO;AAAA;AAEX,eAAe,iBAAgB,CAAC,QAAQ,SAAS;AAAA,EAC7C,IAAI,EAAE,kBAAkB,MAAM;AAAA,IAC1B,MAAM,gBAAe,uCAAuC,qBAAoB;AAAA,EACpF;AAAA,EACA,MAAM,UAAU,CAAC,OAAO,KAAK,SAAS,eAAe;AAAA,EACrD,MAAM,UAAU,SAAS,WAAW;AAAA,EACpC,MAAM,SAAS,YAAY,QAAQ,UAAU,IAAI;AAAA,EACjD,MAAM,KAAK,OAAO,UACN,iBAAiB,QAAQ;AAAA,IAC7B,WAAW,SAAS;AAAA,KACb,cAAc,UAAU;AAAA,KACxB,wBAAwB,SAAS,SAAS,SAAS,sBAAqB;AAAA,IAC/E;AAAA,IACA,SAAS,IAAI,QAAQ,OAAO;AAAA,EAChC,CAAC,KACE,UAAU,iBAAgB,QAAQ,MAAM;AAAA,IACjC,cAAc,QAAQ,SAAS,SAAS,SAAS,sBAAqB,IAAI,QAAQ,IAAI;AAAA,IAC5F,OAAO,OAAO;AAAA,KACf,GAAG;AAAA,IACF,SAAS,OAAO,YAAY,IAAI,QAAQ,EAAE,QAAQ,uBAAuB,QAAQ,CAAC,EAAE,QAAQ,CAAC;AAAA,IAC7F,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV;AAAA,EACJ,CAAC,GACA,KAAK,CAAC,aAAmB,yBAA+B,mBAAmB,QAAQ,CAAC,EACpF,MAAM,YAAY;AAAA,EACvB,IAAI,WAAW,IAAI,IAAI,GAAG,MAAM,EAAE,SAAS,OAAO,MAAM;AAAA,IACpD,cAAc,QAAQ,IAAI,OAAO,KAC7B,eAAe,QAAQ,OAAO,MAC7B,MAAM;AAAA,MACH,MAAM,IAAI,YAAY,iEAAiE;AAAA,QACnF,MAAY;AAAA,QACZ,OAAO;AAAA,UACH,UAAU,OAAO;AAAA,UACjB,MAAM;AAAA,UACN,WAAW;AAAA,QACf;AAAA,MACJ,CAAC;AAAA,OACF;AAAA,EACX;AAAA,EACA,OAAO;AAAA;AAkJX,SAAS,gBAAgB,CAAC,UAAU;AAAA,EAChC,OAAO;AAAA,IACH,cAAc;AAAA,MACV,WAAW;AAAA,MACX,KAAK,CAAC,SAAS,QAAQ;AAAA,QACnB,OAAQ,SAAS,kCAAkC,SAAS,MAAM,MAAM;AAAA;AAAA,IAEhF;AAAA,EACJ;AAAA;AAEJ,SAAS,gBAAgB,CAAC,UAAU;AAAA,EAChC,OAAO,iBAAiB,UAAU,iBAAiB,QAAQ,CAAC;AAAA;AAEhE,IAAM,WAAW,OAAO;AAAA;AACjB,MAAM,cAAc;AAAA,EACvB,WAAW,CAAC,QAAQ,UAAU,UAAU,sBAAsB;AAAA,IAC1D,IAAI,OAAO,aAAa,YAAY,CAAC,SAAS,QAAQ;AAAA,MAClD,MAAM,gBAAe,yCAAyC,qBAAoB;AAAA,IACtF;AAAA,IACA,IAAI,OAAO,aAAa,UAAU;AAAA,MAC9B,WAAW,EAAE,eAAe,SAAS;AAAA,IACzC;AAAA,IACA,IAAI,UAAU,cAAc,aAAa,aAAa,SAAS,WAAW;AAAA,MACtE,MAAM,gBAAe,wDAAwD,sBAAqB;AAAA,IACtG;AAAA,IACA,MAAM,SAAS;AAAA,SACR,gBAAgB,QAAQ;AAAA,MAC3B,WAAW;AAAA,IACf;AAAA,IACA,OAAa,aAAa,WAAiB,cAAc;AAAA,IACzD,OAAa,kBAAkB,WAAiB,mBAAmB;AAAA,IACnE,IAAI;AAAA,IACJ,IAAI,sBAAsB;AAAA,MACtB,OAAO;AAAA,IACX,EACK;AAAA,MACD,IAAI,OAAO,OAAO,kBAAkB,YAChC,OAAO,cAAc,QAAQ;AAAA,QAC7B,OAAO,kBAAiB,OAAO,aAAa;AAAA,MAChD,EACK;AAAA,QACD,OAAO,MAAK;AAAA;AAAA;AAAA,IAGpB,IAAI,IAAI,OAAO,OAAO,MAAM;AAAA,IAC5B,MAAM,QAAQ,gBAAgB,MAAM;AAAA,IACpC,IAAI,YAAY,QAAQ;AAAA,MACpB,MAAY,mBAAmB,GAAG,UAAU,YAAY,OAAO,OAAO,QAAQ,cAAc,GAAG;AAAA,IACnG;AAAA,IACA,IAAI,KAAK,OAAO,OAAO,KAAK;AAAA,IAC5B,UAAU,IAAI;AAAA,IACd,MAAM,IAAI,MAAM;AAAA,MACZ,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,WAAW,CAAC;AAAA,IAChB,CAAC;AAAA;AAAA,EAEL,cAAc,GAAG;AAAA,IACb,MAAM,WAAW,gBAAgB,IAAI,IAAI,EAAE,EAAE;AAAA,IAC7C,iBAAiB,QAAQ;AAAA,IACzB,OAAO;AAAA;AAAA,EAEX,cAAc,GAAG;AAAA,IACb,MAAM,WAAW,gBAAgB,IAAI,IAAI,EAAE,CAAC;AAAA,IAC5C,OAAO;AAAA;AAAA,MAEP,OAAO,GAAG;AAAA,IACV,OAAO,IAAI,IAAI,EAAE;AAAA;AAAA,MAEjB,OAAO,CAAC,OAAO;AAAA,IACf,IAAI,IAAI,EAAE,UAAU;AAAA;AAAA,OAEnB,aAAY,GAAG;AAAA,IAChB,OAAO,IAAI,IAAI,EAAE;AAAA;AAAA,OAEhB,aAAY,CAAC,OAAO;AAAA,IACrB,IAAI,IAAI,EAAE,QAAQ;AAAA;AAE1B;AACA,OAAO,OAAO,cAAc,SAAS;AACrC,SAAS,UAAU,CAAC,UAAU;AAAA,EAC1B,IAAI,MAAM;AAAA,EACV,IAAI,SAAS,eAAe,WAAW;AAAA,IACnC,MAAM,MAAM,IAAI;AAAA,IAChB,IAAI,WAAW,IAAI,WAAW,IAAI,SAAS,UAAU;AAAA,IACrD,MAAM,IAAI,QAAQ;AAAA,EACtB;AAAA,EACA,OAAO;AAAA,IACH,WAAW;AAAA,MACP,WAAW;AAAA,MACX,KAAK,GAAG;AAAA,QACJ,IAAI,KAAK;AAAA,UACL,MAAM,MAAM,KAAK,IAAI;AAAA,UACrB,IAAI,MAAM,KAAK;AAAA,YACX,OAAO,KAAK,OAAO,MAAM,OAAO,IAAI;AAAA,UACxC;AAAA,UACA,OAAO;AAAA,QACX;AAAA,QACA;AAAA;AAAA,IAER;AAAA,IACA,QAAQ;AAAA,MACJ,WAAW;AAAA,MACX,KAAK,GAAG;AAAA,QACJ,IAAI;AAAA,UACA,OAAa,0BAA0B,IAAI;AAAA,UAE/C,MAAM;AAAA,UACF;AAAA;AAAA;AAAA,IAGZ;AAAA,EACJ;AAAA;AAEJ,SAAS,UAAU,CAAC,UAAU;AAAA,EAC1B,OAAO,iBAAiB,UAAU,WAAW,QAAQ,CAAC;AAAA;AA4OnD,SAAS,sBAAqB,CAAC,QAAQ;AAAA,EAC1C,IAAI,MAAM,EAAE,UAAU;AAAA;AAYnB,SAAS,0BAA0B,CAAC,QAAQ;AAAA,EAC/C,YAAY,MAAM;AAAA,EAClB,IAAI,MAAM,EAAE,iBAAiB,CAAC,aAAa;AAAA,IACvC,QAAQ,IAAI,eAAO,SAAS,SAAS,0BAAc,IAAI,MAAM;AAAA,IAC7D,OACK,kCAAkC,IAAI,UAAU;AAAA,OAC1C,cAAc;AAAA,OACd,wBAAwB,CAAC;AAAA,MAChC,SAAS,IAAI,QAAQ,OAAO;AAAA,MAC5B,QAAQ,QAAO,OAAO;AAAA,OACf,YAAY;AAAA,IACvB,CAAC,EACI,MAAM,YAAY;AAAA;AAAA;AAmG/B,SAAS,WAAW,CAAC,KAAK;AAAA,EACtB,MAAM,IAAI,IAAI,GAAG;AAAA,EACjB,IAAI,SAAS;AAAA,EACb,IAAI,OAAO;AAAA,EACX,OAAO,IAAI;AAAA;AAEf,SAAS,aAAa,CAAC,OAAO,aAAa;AAAA,EACvC,IAAI;AAAA,IACA,OAAO,OAAO,eAAe,KAAK,EAAE,OAAO,iBAAiB;AAAA,IAEhE,MAAM;AAAA,IACF,OAAO;AAAA;AAAA;AAGf,eAAsB,sBAAsB,CAAC,QAAQ,YAAY,QAAQ,yBAAyB,SAAS;AAAA,EACvG,YAAY,MAAM;AAAA,EAClB,IAAI,SAAS,SAAS,SAClB,EAAE,sBAAsB,QACxB,CAAC,cAAc,YAAY,SAAS,GAAG;AAAA,IACvC,MAAM,gBAAe,uDAAuD,qBAAoB;AAAA,EACpG;AAAA,EACA,IAAI;AAAA,EACJ,IAAI;AAAA,EACJ,QAAQ,IAAI,GAAG,MAAM,eAAO,SAAS,MAAM,QAAQ,gBAAgB,SAAS,SAAS,aAAa,IAAI,MAAM;AAAA,EAC5G,IAAI,SAAS,SAAS,OAAO;AAAA,IACzB,eAAe,QAAQ;AAAA,IACvB,cAAc,QAAQ;AAAA,EAC1B,EACK;AAAA,IACD,IAAI,EAAE,sBAAsB,MAAM;AAAA,MAC9B,MAAM,UAAU;AAAA,MAChB,aAAa,IAAI,IAAI,WAAW,GAAG;AAAA,MACnC,QAAQ,QAAQ;AAAA,aACP;AAAA,UACD;AAAA,aACC;AAAA,UACD,MAAM,SAAS,IAAI,gBAAgB,MAAY,iBAAiB,OAAO,CAAC;AAAA,UACxE,IAAI,QAAQ;AAAA,YACR,WAAW,OAAO,OAAO,SAAS;AAAA,UACtC,EACK;AAAA,YACD,YAAY,GAAG,MAAM,OAAO,QAAQ,GAAG;AAAA,cACnC,WAAW,aAAa,OAAO,GAAG,CAAC;AAAA,YACvC;AAAA;AAAA,UAEJ;AAAA;AAAA,UAEA,MAAM,gBAAe,kCAAkC,sBAAqB;AAAA;AAAA,IAExF;AAAA,IACA,cAAc,YAAY,UAAU;AAAA,IACpC,QAAQ;AAAA,WACC,CAAC,CAAC;AAAA,QACH,eAAe,MAAM,KAAK,YAAY,QAAQ,aAAa;AAAA,QAC3D;AAAA,WACC,CAAC,CAAC;AAAA,QACH,eAAe,MAAM,OAAO,YAAY,QAAQ,eAAe,QAAQ,eAAe,QAAQ,MAAM;AAAA,QACpG;AAAA,WACC,CAAC,CAAC;AAAA,QACH,MAAM,IAAI,UAAU,2EAA2E;AAAA;AAAA,QAE/F,IAAI;AAAA,UACA,eAAqB,qBAAqB,IAAI,GAAG,WAAW,cAAc,QAAQ,aAAa;AAAA,UAEnG,OAAO,KAAK;AAAA,UACR,aAAa,GAAG;AAAA;AAAA;AAAA;AAAA,EAIhC,MAAM,WAAW,MACZ,8BAA8B,IAAI,GAAG,MAAM,cAAc,aAAa,QAAQ,oBAA0B,QAAQ;AAAA,IACjH,sBAAsB;AAAA,KACf,cAAc;AAAA,KACd,wBAAwB,CAAC;AAAA,IAChC,MAAM,SAAS;AAAA,IACf,SAAS,IAAI,QAAQ,OAAO;AAAA,IAC5B,QAAQ,QAAO,OAAO;AAAA,EAC1B,CAAC,EACI,MAAM,YAAY;AAAA,EACvB,IAAI,OAAO,QAAQ,kBAAkB,YACjC,OAAO,QAAQ,WAAW,UAAU;AAAA,IACpC,OAAO,kBAAkB;AAAA,EAC7B;AAAA,EACA,MAAM,IAAU,iCAAiC,IAAI,GAAG,UAAU;AAAA,IAC9D,eAAe,QAAQ;AAAA,IACvB,QAAQ,QAAQ;AAAA,IAChB,gBAAgB,QAAQ;AAAA,KACjB,aAAa;AAAA,EACxB,CAAC;AAAA,EACD,IAAI;AAAA,EACJ,IAAI;AAAA,IACA,SAAS,MAAM;AAAA,IAEnB,OAAO,KAAK;AAAA,IACR,IAAI,UAAU,KAAK,OAAO,GAAG;AAAA,MACzB,OAAO,uBAAuB,QAAQ,WAAW,QAAQ,yBAAyB;AAAA,WAC3E;AAAA,QACH,MAAM;AAAA,QACN;AAAA,QACA;AAAA,MACJ,CAAC;AAAA,IACL;AAAA,IACA,aAAa,GAAG;AAAA;AAAA,EAEpB,OAAO,YAAa,MAAM,iBAAiB,QAAQ;AAAA,EACnD,WAAW,MAAM;AAAA,EACjB,OAAO;AAAA;AAkGJ,SAAS,qBAAqB,CAAC,QAAQ,YAAY;AAAA,EACtD,YAAY,MAAM;AAAA,EAClB,QAAQ,IAAI,GAAG,SAAS,QAAQ,MAAM,aAAa,IAAI,MAAM;AAAA,EAC7D,MAAM,wBAA8B,gBAAgB,IAAI,0BAA0B,OAAO,OAAO;AAAA,EAChG,aAAa,IAAI,gBAAgB,UAAU;AAAA,EAC3C,IAAI,CAAC,WAAW,IAAI,WAAW,GAAG;AAAA,IAC9B,WAAW,IAAI,aAAa,EAAE,SAAS;AAAA,EAC3C;AAAA,EACA,IAAI,CAAC,WAAW,IAAI,aAAa,KAAK,CAAC,WAAW,IAAI,SAAS,GAAG;AAAA,IAC9D,IAAI,CAAC,WAAW,IAAI,eAAe,GAAG;AAAA,MAClC,WAAW,IAAI,iBAAiB,SAAS,kBAAkB,WAAW,aAAa,MAAM;AAAA,IAC7F;AAAA,IACA,IAAI,YAAY,CAAC,WAAW,IAAI,OAAO,GAAG;AAAA,MACtC,MAAM,gBAAe,2GAA2G,sBAAqB;AAAA,IACzJ;AAAA,IACA,IAAI,MAAM;AAAA,MACN,WAAW,IAAI,iBAAiB,KAAK;AAAA,IACzC;AAAA,EACJ;AAAA,EACA,YAAY,GAAG,MAAM,WAAW,QAAQ,GAAG;AAAA,IACvC,sBAAsB,aAAa,OAAO,GAAG,CAAC;AAAA,EAClD;AAAA,EACA,OAAO;AAAA;AAyDX,SAAS,WAAW,CAAC,OAAO;AAAA,EACxB,IAAI,EAAE,iBAAiB,gBAAgB;AAAA,IACnC,MAAM,gBAAe,iDAAiD,qBAAoB;AAAA,EAC9F;AAAA,EACA,IAAI,OAAO,eAAe,KAAK,MAAM,cAAc,WAAW;AAAA,IAC1D,MAAM,gBAAe,4CAA4C,sBAAqB;AAAA,EAC1F;AAAA;AAEJ,SAAS,OAAM,CAAC,SAAS;AAAA,EACrB,OAAO,UAAU,YAAY,QAAQ,UAAU,IAAI,IAAI;AAAA;AAkC3D,SAAS,SAAS,CAAC,KAAK,SAAS;AAAA,EAC7B,IAAI,SAAS,QAAQ,QAAQ,SAAS,OAAO;AAAA,IACzC,OAAa,iBAAiB,GAAG;AAAA,EACrC;AAAA,EACA,OAAO;AAAA;AAuBX,IAAM,QAAQ,OAAO;AAoDrB,eAAsB,sBAAsB,CAAC,QAAQ,aAAa,KAAK,QAAQ,MAAM,SAAS,SAAS;AAAA,EACnG,YAAY,MAAM;AAAA,EAClB,YAAY,IAAI;AAAA,EAChB,IAAI,CAAC,QAAQ,IAAI,YAAY,GAAG;AAAA,IAC5B,QAAQ,IAAI,cAAc,WAAU;AAAA,EACxC;AAAA,EACA,QAAQ,eAAO,SAAS,YAAY,IAAI,MAAM;AAAA,EAC9C,MAAM,OAAa,yBAAyB,aAAa,QAAQ,KAAK,SAAS,MAAM;AAAA,KAC1E,cAAc;AAAA,KACd,wBAAwB,CAAC;AAAA,IAChC,MAAM,SAAS;AAAA,IACf,QAAQ,QAAO,OAAO;AAAA,EAC1B,CAAC;AAAA,EACD,IAAI;AAAA,EACJ,IAAI;AAAA,IACA,SAAS,MAAM;AAAA,IAEnB,OAAO,KAAK;AAAA,IACR,IAAI,UAAU,KAAK,OAAO,GAAG;AAAA,MACzB,OAAO,uBAAuB,QAAQ,aAAa,KAAK,QAAQ,MAAM,SAAS;AAAA,WACxE;AAAA,QACH,MAAM;AAAA,MACV,CAAC;AAAA,IACL;AAAA,IACA,aAAa,GAAG;AAAA;AAAA,EAEpB,OAAO;AAAA;;;ACz0CX;;;ACDO,MAAM,qBAAqB,MAAM;AAAA,EACf;AAAA,EAAuB;AAAA,EAA5C,WAAW,CAAU,MAAuB,SAAS,KAAK;AAAA,IAAE,MAAM,IAAI;AAAA,IAAjD;AAAA,IAAuB;AAAA;AAChD;AACO,SAAS,IAAI,CAAC,MAAc,SAAS,KAAY;AAAA,EAAE,MAAM,IAAI,aAAa,MAAM,MAAM;AAAA;;;ADC7F,gDAAiC;;;AEGjC,IAAM,UAAU,OAAO,IAAI,mCAAmC;AAI9D,SAAS,YAAY,CAAC,WAAoB,CAAC,GAAkB;AAAA,EAC3D,MAAM,SAAS,CAAC,UACd,CAAC,OAAyB,YAAqB;AAAA,IAC7C,MAAM,OAAQ,WAAuC;AAAA,IACrD,IAAI,MAAM;AAAA,MACR,IAAI,OAAO,UAAU;AAAA,QAAU,KAAK,OAAO,UAAU,KAAK;AAAA,MACrD;AAAA,aAAK,OAAO,KAAI,aAAa,MAAK,GAAG,OAAO;AAAA,IACnD,EAAO,SAAI,UAAU,WAAW,QAAQ,IAAI,cAAc,SAAS;AAAA,MACjE,MAAM,QAAQ,UAAU,UAAU,QAAQ,QAAQ,QAAQ;AAAA,MAC1D,MAAM,YAAY,OAAO,UAAU,WAAW,QAAQ,KAAK,OAAO,UAAU,WAAW,WAAW,KAAI,aAAa,MAAK,CAAC;AAAA,IAC3H;AAAA;AAAA,EAEJ,OAAO;AAAA,IAAC,MAAM,OAAO,MAAM;AAAA,IAAG,MAAM,OAAO,MAAM;AAAA,IAAG,OAAO,OAAO,OAAO;AAAA,IAAG,OAAO,OAAO,OAAO;AAAA,IAC/F,OAAO,OAAO,OAAO;AAAA,IAAG,OAAO,WAAS,aAAa,KAAI,aAAa,MAAK,CAAC;AAAA,EAAC;AAAA;AAE1E,IAAM,SAAS,aAAa;;;ACd5B,IAAM,2BAA2B,OAAO,0BAA0B;;ACRlE,IAAM,sBAAqC,OAAO,OAAO,EAAC,QAAQ,aAAa,OAAO,IAAI,mBAAmB,EAAC,CAAC;;AC6B/G,SAAS,2BAA2B,CAAC,OAAoD;AAAA,EAC9F,OAAO,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS;AAAA;AAErE,IAAM,YAAY,OAAO;;ACZzB;;;AC+FO,IAAM,qBAAqB,KAAK;AAEhC,IAAM,yBAAyB,MAAM;AAQ5C,IAAM,oBAAoB,IAAI,IAAoB,CAAC,aAAa,cAAc,cAAc,WAAW,SAAS,CAAC;AACjH,IAAM,4BAA4B,IAAI,IAA6B,CAAC,qBAAqB,qBAAqB,MAAM,CAAC;AACrH,IAAM,0BAA0B,IAAI,IAAI,CAAC,iBAAiB,qBAAqB,cAAc,gBAAgB,CAAC;;;ACxF9G,IAAM,YAAY,IAAI,IAAY,CAAC,WAAW,UAAU,SAAS,CAAC;AAClE,IAAM,SAAS,IAAI,IAAY,CAAC,UAAU,SAAS,CAAC;AACpD,IAAM,WAAW,IAAI,IAAY,CAAC,aAAa,cAAc,cAAc,WAAW,SAAS,CAAC;AAqQhG,IAAM,YAAY,IAAI;AAEtB,IAAM,UAAU,IAAI;;;AFnOpB,IAAM,yBAA8D;AAAA,EAClE,cAAc;AAAA,EACd,WAAW;AAAA,EACX,SAAS;AAAA,EACT,SAAS;AAAA,EACT,oBAAoB;AAAA,EACpB,eAAe;AAAA,EACf,eAAe;AAAA,EACf,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,YAAY;AAAA,EACZ,WAAW;AAAA,EACX,SAAS;AAAA,EACT,SAAS;AAAA,EACT,wBAAwB;AAAA,EACxB,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,SAAS;AAAA,EACT,SAAS;AAAA,EACT,UAAU;AAAA,EACV,SAAS;AAAA,EACT,iBAAiB;AAAA,EACjB,UAAU;AAAA,EACV,qBAAqB;AAAA,EACrB,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,qBAAqB;AAAA,EACrB,sBAAsB;AACxB;AAEA,IAAM,sBAAsB,IAAI,IAAyB,OAAO,KAAK,sBAAsB,CAA0B;AAqSrH,IAAM,gBAAgC,OAAO,OAAO,CAAC,CAAC;AAWtD,IAAM,cAAc,IAAI;AA8CxB,IAAM,cAAc,IAAI;;AGhbjB,IAAM,4BAA4B,IAAI;AAEtC,IAAM,2BAA2B,KAAK;AAEtC,IAAM,0BAA0B,KAAK;AAiDrC,IAAM,uBAAqD,OAAO,OAAO,CAAC,SAAS,YAAY,QAAQ,CAAC;AA4F/G,IAAM,cAAc,IAAI,IAA4B;AAAA,EAClD;AAAA,EAAe;AAAA,EAAa;AAAA,EAAgB;AAAA,EAAW;AAAA,EAAc;AAAA,EACrE;AAAA,EAAY;AAAA,EAAO;AAAA,EAAa;AAAA,EAAY;AAAA,EAAa;AAAA,EAAU;AAAA,EAAW;AAChF,CAAC;AAuCD,IAAM,qBAAoB,IAAI,IAAoB,CAAC,aAAa,cAAc,cAAc,WAAW,SAAS,CAAC;;;ACtI1G,IAAM,oCAAoC,IAAI;AAE9C,IAAM,iCAAiC,KAAK;AAE5C,IAAM,iCAAiC,KAAK,OAAO;AAEnD,IAAM,kCAAkC,IAAI;AAG5C,IAAM,sCAAsC,IAAI;AAchD,IAAM,6BAA6B,KAAK,OAAO;AAQ/C,IAAM,kCAAkC,KAAK;AAGpD,IAAM,QAAQ,IAAI,WAAW,CAAC;AAqgB9B,IAAM,uBAAuB,IAAI;;;AC1lBjC,IAAM,sBAAsB,KAAK;AAQjC,IAAM,uBAAuB,IAAI;;;AClBjC,IAAM,gBAAgB,IAAI,IAAI,CAAC,UAAU,YAAY,QAAQ,CAAC;;ACrB9D,IAAM,mBAAiB,OAAO,IAAI,wCAAwC;;ACC1E,IAAM,OAAO;AACN,IAAM,2BAA2B,KAAK,KAAK;;AdMlD,IAAM,OAAO;AACb,IAAM,YAAY;AAClB,IAAM,YAAY;AAClB,IAAM,kBAAkB,YAAY;AACpC,IAAM,QAAQ,OAAO;AAErB,SAAS,cAAc,CAAC,OAAgC,QAAkB;AAAA,EAAE,IAAI,OAAO,KAAK,KAAK,EAAE,KAAK,SAAO,CAAC,OAAO,SAAS,GAAG,CAAC;AAAA,IAAG,KAAK,eAAe;AAAA;AAC3J,SAAS,cAAc,CAAC,OAAyC;AAAA,EAAE,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK;AAAA,IAAG,KAAK,eAAe;AAAA,EAAG,OAAO;AAAA;AAC3J,SAAS,WAAW,CAAC,OAAqB;AAAA,EAC7C,IAAI;AAAA,EACJ,IAAI;AAAA,IAAE,IAAI,OAAO,UAAU,YAAY,CAAC,SAAS,MAAM,SAAS;AAAA,MAAM,KAAK,kBAAkB;AAAA,IAAG,MAAM,IAAI,IAAI,KAAK;AAAA,IAAK,MAAM;AAAA,IAAE,OAAO,KAAK,kBAAkB;AAAA;AAAA,EAC9J,IAAI,IAAI,YAAY,IAAI,YAAY,IAAI,QAAS,OAAO,UAAU,aAAa,MAAM,SAAS,GAAG,KAAK,wBAAwB,KAAK,KAAK,MAAQ,IAAI,aAAa,YAAY,EAAE,IAAI,aAAa,WAAW,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,IAAI,QAAQ;AAAA,IAAK,KAAK,kBAAkB;AAAA,EAChS,OAAO;AAAA;AAEJ,SAAS,aAAa,CAAC,UAAmB,OAAgB,aAAqG;AAAA,EAClK,IAAI,CAAC,CAAC,UAAU,aAAa,UAAU,MAAM,EAAE,SAAS,QAAkB;AAAA,IAAG,KAAK,kBAAkB;AAAA,EACpG,MAAM,IAAI,UAA2B,IAAI,eAAe,KAAK;AAAA,EAC7D,IAAI,QAAgB;AAAA,EACpB,IAAI,MAAM,YAAY,MAAM,UAAU;AAAA,IAAE,eAAe,GAAG,CAAC,CAAC;AAAA,IAAG,SAAS,MAAM,WAAW,gCAAgC;AAAA,IAAsB,gBAAgB,CAAC;AAAA,EAAG,EAC9J,SAAI,MAAM,aAAa;AAAA,IACxB,eAAe,GAAG,CAAC,eAAe,UAAU,CAAC;AAAA,IAC7C,IAAI,CAAC,CAAC,UAAU,iBAAiB,aAAa,QAAQ,EAAE,SAAS,EAAE,WAAqB;AAAA,MAAG,KAAK,iCAAiC;AAAA,IACjI,IAAI,EAAE,gBAAgB,WAAW,OAAO,EAAE,aAAa,YAAY,CAAC,KAAK,KAAK,EAAE,QAAQ,IAAI,OAAO,OAAO,GAAG,UAAU;AAAA,MAAG,KAAK,iCAAiC;AAAA,IAChK,gBAAgB,EAAE,aAAa,EAAE,gBAA0D,EAAE,gBAAgB,WAAW,EAAE,UAAW,EAAE,SAAoB,YAAY,EAAE,IAAI,CAAC,EAAG;AAAA,IACjL,SAAS,aAAa,cAAc,YAAY,cAAc,eAAe;AAAA,EACjF,EAAO;AAAA,IACH,IAAI,CAAC,CAAC,UAAU,aAAa,QAAQ,EAAE,SAAS,EAAE,IAAc;AAAA,MAAG,KAAK,4BAA4B;AAAA,IACpG,MAAM,SAAS,EAAE,SAAS,WAAW,CAAC,QAAQ,QAAQ,IAAI,EAAE,SAAS,cAAc,CAAC,QAAQ,UAAU,cAAc,IAAI,CAAC,QAAQ,UAAU,yBAAyB,iBAAiB,WAAW,2BAA2B,mBAAmB;AAAA,IAC9O,eAAe,GAAG,MAAM;AAAA,IAAG,YAAY,EAAE,MAAM;AAAA,IAAG,SAAS,EAAE;AAAA,IAC7D,IAAI,IAAI,IAAI,MAAM,EAAE;AAAA,MAAQ,KAAK,kBAAkB;AAAA,IACnD,IAAI,EAAE,SAAS;AAAA,MAAa,YAAY,EAAE,YAAY;AAAA,IACtD,IAAI,EAAE,SAAS,UAAU;AAAA,MACrB,WAAW,SAAS,CAAC,yBAAyB,iBAAiB,SAAS;AAAA,QAAG,YAAY,EAAE,MAAM;AAAA,MAC/F,IAAI,EAAE,4BAA4B,aAAa,CAAC,CAAC,uBAAuB,oBAAoB,EAAE,SAAS,EAAE,uBAAiC;AAAA,QAAG,KAAK,8BAA8B;AAAA,MAChL,IAAI,EAAE,sBAAsB,aAAa,CAAC,CAAC,SAAS,SAAS,OAAO,EAAE,SAAS,EAAE,iBAA2B;AAAA,QAAG,KAAK,8BAA8B;AAAA,IACtJ;AAAA,IACA,gBAAgB,KAAK,EAAE;AAAA;AAAA,EAE3B,IAAI,MAAM,UAAU,gBAAgB;AAAA,IAAW,KAAK,qBAAqB;AAAA,EACzE,MAAM,SAAS,MAAM,WAAW,CAAC,WAAW,IAAI,eAAe,CAAC,UAAU,WAAW,OAAO;AAAA,EAC5F,IAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,CAAC,OAAO,UAAU,OAAO,SAAS,MAAM,OAAO,KAAK,OAAK,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC,KAAM,MAAM,YAAY,CAAC,OAAO,SAAS,QAAQ;AAAA,IAAI,KAAK,eAAe;AAAA,EAC7N,OAAO,EAAE,UAAU,GAAG,QAAQ,eAAe,OAAO;AAAA;AAExD,eAAe,eAAe,CAAC,UAAuC;AAAA,EAClE,IAAI,CAAC,SAAS;AAAA,IAAM,OAAO;AAAA,EAC3B,MAAM,SAAS,SAAS,KAAK,UAAU;AAAA,EACvC,MAAM,SAAuB,CAAC;AAAA,EAAG,IAAI,OAAO;AAAA,EAC5C,IAAI;AAAA,IACA,UAAS;AAAA,MACL,MAAM,QAAQ,MAAM,OAAO,KAAK;AAAA,MAChC,IAAI,MAAM;AAAA,QAAM;AAAA,MAChB,QAAQ,MAAM,MAAM;AAAA,MACpB,IAAI,OAAO,OAAO;AAAA,QAAE,MAAM,OAAO,OAAO;AAAA,QAAG,KAAK,qBAAqB;AAAA,MAAG;AAAA,MACxE,OAAO,KAAK,MAAM,KAAK;AAAA,IAC3B;AAAA,YACF;AAAA,IAAU,OAAO,YAAY;AAAA;AAAA,EAC/B,MAAM,UAAU,IAAI,QAAQ,SAAS,OAAO;AAAA,EAC5C,QAAQ,OAAO,kBAAkB;AAAA,EAAG,QAAQ,OAAO,gBAAgB;AAAA,EACnE,OAAO,IAAI,SAAS,OAAO,OAAO,MAAM,GAAG,EAAC,QAAQ,SAAS,QAAQ,YAAY,SAAS,YAAY,QAAO,CAAC;AAAA;AAElH,eAAe,WAAW,CAAC,UAAsC;AAAA,EAC7D,IAAI,CAAC,SAAS;AAAA,IAAI,KAAK,wBAAwB,GAAG;AAAA,EAClD,MAAM,SAAS,SAAS,MAAM,UAAU;AAAA,EAAG,IAAI,CAAC;AAAA,IAAQ,KAAK,uBAAuB;AAAA,EACpF,IAAI,OAAO;AAAA,EAAG,MAAM,SAAuB,CAAC;AAAA,EAC5C,IAAI;AAAA,IAAE,UAAS;AAAA,MAAE,MAAM,IAAI,MAAM,OAAO,KAAK;AAAA,MAAG,IAAI,EAAE;AAAA,QAAM;AAAA,MAAO,QAAQ,EAAE,MAAM;AAAA,MAAQ,IAAI,OAAO,OAAO;AAAA,QAAE,MAAM,OAAO,OAAO;AAAA,QAAG,KAAK,qBAAqB;AAAA,MAAG;AAAA,MAAE,OAAO,KAAK,EAAE,KAAK;AAAA,IAAG;AAAA,IAC3L,OAAO,OAAO;AAAA,IAAE,IAAI,iBAAiB;AAAA,MAAc,MAAM;AAAA,IAAO,KAAK,uBAAuB,GAAG;AAAA,YAC/F;AAAA,IAAU,OAAO,YAAY;AAAA;AAAA,EAC7B,IAAI;AAAA,IAAE,OAAO,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC;AAAA,IAAK,MAAM;AAAA,IAAE,OAAO,KAAK,uBAAuB;AAAA;AAAA;AAGlH,SAAS,YAAY,CAAC,QAAgB;AAAA,EAAE,MAAM,MAAM,YAAY,MAAM;AAAA,EAAG,IAAI,WAAW,IAAI,SAAS,QAAQ,OAAO,EAAE,IAAI;AAAA,EAAqC,OAAO,IAAI;AAAA;AAC1K,SAAS,aAAa,CAAC,OAAgB,UAAwC;AAAA,EAC3E,MAAM,IAAI,eAAe,KAAK;AAAA,EAC9B,IAAI,OAAO,EAAE,WAAW;AAAA,IAAU,KAAK,uBAAuB;AAAA,EAC9D,IAAI,YAAY,EAAE,MAAM,EAAE;AAAA,IAAQ,KAAK,kBAAkB;AAAA,EACzD,IAAI,aAAa,aAAa,EAAE,WAAW;AAAA,IAAU,KAAK,sBAAsB;AAAA,EAChF,WAAW,OAAO,CAAC,0BAA0B,kBAAkB,UAAU;AAAA,IAAG,YAAY,EAAE,IAAI;AAAA,EAC9F,WAAW,OAAO,CAAC,yCAAyC,uCAAuC;AAAA,IAAG,IAAI,EAAE,SAAS,cAAc,CAAC,MAAM,QAAQ,EAAE,IAAI,KAAM,EAAE,KAAmB,KAAK,OAAK,OAAO,MAAM,QAAQ;AAAA,MAAI,KAAK,uBAAuB;AAAA,EAClP,MAAM,UAAU,EAAE;AAAA,EAClB,IAAI,WAAW,CAAC,QAAQ,KAAK,OAAK,CAAC,uBAAuB,oBAAoB,EAAE,SAAS,CAAC,CAAC;AAAA,IAAG,KAAK,8BAA8B;AAAA,EACjI,MAAM,OAAO,EAAE;AAAA,EACf,IAAI,CAAC,MAAM,KAAK,OAAK,CAAC,SAAS,SAAS,OAAO,EAAE,SAAS,CAAC,CAAC;AAAA,IAAG,KAAK,8BAA8B;AAAA,EAClG,IAAI,EAAE,qCAAqC,cAAc,CAAC,MAAM,QAAQ,EAAE,gCAAgC,KAAK,CAAC,EAAE,iCAAiC,SAAS,MAAM;AAAA,IAAI,KAAK,uBAAuB;AAAA,EAClM,OAAO;AAAA;AAAA;AAEJ,MAAM,eAAe;AAAA,EACK;AAAA,EAAmC;AAAA,EAAhE,WAAW,CAAkB,SAAmC,QAAqB;AAAA,IAAxD;AAAA,IAAmC;AAAA;AAAA,OAClD,QAAO,CAAC,OAA+B,OAAoB,CAAC,GAAG;AAAA,IACzE,YAAY,iBAAiB,UAAU,MAAM,MAAM,OAAO,KAAK,CAAC;AAAA,IAChE,IAAI;AAAA,MAAE,OAAO,MAAM,gBAAgB,MAAM,KAAK,QAAQ,OAAO,KAAK,MAAM,UAAU,SAAS,QAAQ,YAAY,IAAI,CAAC,KAAK,QAAQ,YAAY,QAAQ,IAAI,GAAG,GAAI,KAAK,SAAS,CAAC,KAAK,MAAM,IAAI,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC;AAAA,MACtM,OAAO,OAAO;AAAA,MAAE,IAAI,iBAAiB;AAAA,QAAc,MAAM;AAAA,MAAO,KAAK,uBAAuB,GAAG;AAAA;AAAA;AAAA,OAE7F,SAAQ,CAAC,MAAe,OAA0C;AAAA,IACpE,IAAI,SAAS,YAAY,SAAS;AAAA,MAAa,KAAK,eAAe;AAAA,IACnE,MAAM,MAAM,YAAY,KAAK;AAAA,IAAG,IAAI,SAAS,YAAY,IAAI;AAAA,MAAQ,KAAK,kBAAkB;AAAA,IAC5F,MAAM,WAAW,SAAS,WAAW,aAAa,KAAe,IAAI,IAAI;AAAA,IACzE,MAAM,IAAI,cAAc,MAAM,YAAY,MAAM,KAAK,QAAQ,QAAQ,CAAC,GAAG,SAAS,WAAW,QAAkB,SAAS;AAAA,IACxH,OAAO,EAAE,QAAQ,EAAE,QAAQ,cAAc,UAAU,uBAAuB,EAAE,wBAAyB,eAAe,EAAE,gBAAiB,SAAS,EAAE,UAAW,0BAA0B,EAAE,yCAAyC,CAAC,qBAAqB,GAAG,oBAAoB,EAAE,sCAAuC;AAAA;AAAA,OAE9S,SAAQ,CAAC,GAAqD;AAAA,IAExE,IAAI,EAAE,aAAa;AAAA,MAAU,OAAO,EAAE,QAAQ,kCAAkC,gDAAgD,MAAM,wBAAwB,4CAA4C,gBAAgB,+CAA+C,uCAAuC,CAAC,oBAAoB,EAAE;AAAA,IACvU,MAAM,gBAAgB,EAAE;AAAA,IACxB,IAAI,EAAE,aAAa,UAAU,cAAc,SAAS;AAAA,MAAU,OAAO,cAAc,EAAE,QAAQ,EAAE,QAAQ,wBAAwB,cAAc,uBAAuB,gBAAgB,cAAc,eAAe,UAAU,cAAc,SAAS,uCAAuC,CAAC,cAAc,2BAA2B,qBAAqB,GAAG,uCAAuC,CAAC,cAAc,qBAAqB,OAAO,EAAE,GAAG,EAAE,MAAM;AAAA,IAC1b,MAAM,WAAW,EAAE,aAAa,UAAU,cAAc,SAAS,cAAc,cAAc,eAAgB,aAAa,EAAE,MAAM;AAAA,IAClI,MAAM,MAAM,MAAM,YAAY,MAAM,KAAK,QAAQ,QAAQ,CAAC;AAAA,IAC1D,MAAM,KAAK,EAAE;AAAA,IACb,MAAM,WAAW,EAAE,aAAa,eAAe,GAAG,gBAAgB,WAAY,GAAG,gBAAgB,cAAc,YAAY,YAAY,UAAU,kBAAmB,EAAE;AAAA,IACtK,OAAO,cAAc,KAAK,QAAQ;AAAA;AAAA,OAEhC,SAAQ,CAAC,GAAuB;AAAA,IAAE,MAAM,KAAK,SAAS,CAAC;AAAA;AAAA,EACrD,eAAe,CAAC,YAAgC,QAAyC;AAAA,IAC7F,MAAM,IAAI,WAAW,eAAyC,MAAM,OAAO;AAAA,IAC3E,IAAI,OAAO,QAAQ,YAAY,CAAC,KAAK,KAAK,GAAG;AAAA,MAAG,KAAK,4BAA4B,GAAG;AAAA,IACpF,MAAM,aAAa,IAAI,YAAY;AAAA,IACnC,IAAI,OAAO,QAAQ,YAAY,MAAM,WAAY,EAAE,gBAAgB,YAAY,eAAe,EAAE,YAAc,EAAE,gBAAgB,mBAAmB,eAAe,aAAe,EAAE,gBAAgB,eAAe,eAAe;AAAA,MAAY,KAAK,2BAA2B,GAAG;AAAA,IAChR,OAAO,OAAO;AAAA;AAAA,OAEZ,cAAa,CAAC,GAAuB,QAA6C;AAAA,IACpF,MAAM,WAAW,MAAM,KAAK,SAAS,CAAC;AAAA,IACtC,MAAM,SAAS,EAAE;AAAA,IACjB,MAAM,UAAU,SAAS,yCAAyC,CAAC,qBAAqB;AAAA,IACxF,MAAM,SAAS,EAAE,aAAa,UAAU,OAAO,SAAS,WAAW,OAAO,2BAA2B,wBAAwB,QAAQ,SAAS,oBAAoB,IAAI,uBAAuB;AAAA,IAC7L,MAAM,OAAO,WAAW,uBAA4B,kBAAiB,MAAM,IAAS,mBAAkB,MAAM;AAAA,IAC5G,IAAI;AAAA,IACJ,MAAM,cAAgC,OAAO,OAAO,SAAS;AAAA,MACzD,QAAQ,SAAS,YAAY;AAAA,MAC7B,MAAM,WAAW,MAAM,KAAK,QAAQ,OAAO,KAAK,SAAS,MAAM,gBAAgB,aAAa,IAAI,WAAW,IAAI,EAAE,SAAS,KAAK,CAAC;AAAA,MAChI,IAAI,EAAE,aAAa,YAAY,OAAO,KAAK,MAAM,SAAS,gBAAgB;AAAA,QAGtE,IAAI;AAAA,QACJ,IAAI;AAAA,UAAE,QAAQ,MAAM,SAAS,MAAM,EAAE,KAAK;AAAA,UAAK,MAAM;AAAA,UAAE,KAAK,sBAAsB,GAAG;AAAA;AAAA,QACrF,IAAI,SAAS,OAAO,UAAU,YAAY,WAAW,OAAO;AAAA,UACxD,QAAQ,MAAM;AAAA,iBACL;AAAA,cAAgC,KAAK,yBAAyB,GAAG;AAAA,iBACjE;AAAA,cAAyB,KAAK,2BAA2B,GAAG;AAAA,iBAC5D;AAAA,cAAyB,KAAK,uBAAuB,GAAG;AAAA,iBACxD;AAAA,cAAyB,KAAK,0BAA0B,GAAG;AAAA;AAAA,cACvD,KAAK,sBAAsB,GAAG;AAAA;AAAA,QAE/C;AAAA,MACJ;AAAA,MACA,IAAI,EAAE,aAAa;AAAA,QAAa,OAAO;AAAA,MACvC,IAAI,OAAO,KAAK,MAAM,SAAS,kBAAkB,SAAS,IAAI;AAAA,QAI1D,MAAM,QAAQ,MAAM,YAAY,SAAS,MAAM,CAAC;AAAA,QAChD,IAAI;AAAA,UAAE,IAAI,OAAO,MAAM,aAAa;AAAA,YAAU,KAAK,yBAAyB,GAAG;AAAA,UAAG,MAAM,SAAS,eAAe,KAAK,MAAM,OAAO,KAAK,MAAM,SAAS,MAAM,GAAG,EAAE,IAAK,WAAW,EAAE,SAAS,CAAC,CAAC;AAAA,UAAG,eAAe,KAAK,gBAAgB,GAAG,MAAM;AAAA,UAC9O,OAAO,OAAO;AAAA,UAAE,IAAI,iBAAiB;AAAA,YAAc,MAAM;AAAA,UAAO,KAAK,yBAAyB,GAAG;AAAA;AAAA,MACrG;AAAA,MACA,IAAI,OAAO,KAAK,MAAM,SAAS,UAAU;AAAA,QACrC,IAAI,CAAC;AAAA,UAAc,KAAK,yBAAyB,GAAG;AAAA,QACpD,MAAM,QAAQ,eAAe,MAAM,YAAY,QAAQ,CAAC;AAAA,QACxD,IAAI,CAAC,MAAM,QAAQ,MAAM,IAAI;AAAA,UAAG,KAAK,uBAAuB;AAAA,QAC5D,MAAM,OAAO,MAAM,KAAK,OAAO,SAAO,OAAO,OAAO,QAAQ,YAAY,OAAO,IAAI,WAAW,YAAY,IAAI,OAAO,QAAQ,cAAc,aAAc,MAAM,UAAU,QAAQ,CAAC,QAAQ,MAAM,CAAC,MAAM,YAAY;AAAA,QACnN,IAAI,CAAC,KAAK;AAAA,UAAQ,KAAK,gCAAgC,GAAG;AAAA,QAC1D,OAAO,SAAS,KAAK,EAAE,KAAK,CAAC;AAAA,MACjC;AAAA,MACA,OAAO;AAAA;AAAA,IAEX,MAAM,aAAa,SAAS,uCAAuC,SAAS,OAAO,IAAI,UAAU,SAAS,uCAAuC,KAAK,SAAO,CAAC,SAAS,OAAO,EAAE,SAAS,GAAG,CAAC;AAAA,IAC7L,IAAI;AAAA,IACJ,IAAI,EAAE,aAAa,aAAa;AAAA,MAG5B,SAAS,MAAW,UAAU,IAAI,IAAI,EAAE,MAAM,GAAG,EAAE,UAAU,EAAC,eAAe,QAAQ,8BAA8B,QAAO,GAAG,MAAM,EAAE,SAAS,IAAS,eAAc,YAAY,SAAS,KAAK,QAAQ,EAAE,CAAC;AAAA,IAC9M,EAAO;AAAA,eAAS,IAAS,cAAc,UAAU,EAAE,UAAU,EAAE,eAAe,WAAY,EAAE,aAAa,WAAW,EAAC,8BAA8B,WAAU,IAAI,CAAC,EAAG,GAAG,IAAI;AAAA,IAC5K,OAAY,gBAAe;AAAA,IAAa,OAAO,UAAU;AAAA,IACzD,IAAI,CAAC,EAAE,QAAQ,SAAS,gBAAgB,SAAS,QAAQ,EAAE,KAAK,SAAO,KAAK,WAAW,OAAO,CAAC;AAAA,MAAQ,uBAAsB,MAAM;AAAA,IACnI,IAAI,EAAE,aAAa;AAAA,MAAe,2BAA2B,MAAM;AAAA,IACnE,OAAO;AAAA;AAAA,OAEL,SAAQ,CAAC,GAAuB,QAA4B,UAAe,QAA6G;AAAA,IAC1L,MAAM,SAAS,MAAW,uBAAuB,QAAQ,UAAU,EAAE,aAAa,WAAW,EAAC,kBAAkB,OAAO,kBAAkB,eAAe,OAAO,cAAa,IAAI,KAAI,QAAQ,iBAAiB,KAAI,CAAC,EAAE,MAAM,WAAS;AAAA,MAC/N,IAAI,iBAAiB;AAAA,QAAc,MAAM;AAAA,MACzC,IAAI,iBAAsB,eAAe,MAAM,iBAAiB;AAAA,QAAc,MAAM,MAAM;AAAA,MAC1F,IAAI,EAAE,aAAa;AAAA,QAAU,MAAM;AAAA,MACnC,KAAK,sBAAsB,GAAG;AAAA,KACjC;AAAA,IACD,IAAI,EAAE,aAAa,UAAU;AAAA,MACzB,MAAM,WAAW,MAAW,uBAAuB,QAAQ,OAAO,cAAc,IAAI,IAAI,6BAA6B,GAAG,OAAO,WAAW,IAAI,QAAQ,EAAC,QAAU,+BAA+B,wBAAwB,cAAc,cAAc,SAAQ,CAAC,CAAC;AAAA,MAC9P,MAAM,OAAO,eAAe,MAAM,YAAY,QAAQ,CAAC;AAAA,MACvD,IAAI,CAAC,OAAO,cAAc,KAAK,EAAE,KAAM,KAAK,MAAiB;AAAA,QAAG,KAAK,0BAA0B,GAAG;AAAA,MAClG,OAAO,EAAC,UAAU,UAAU,QAAQ,sBAAsB,SAAS,OAAO,KAAK,EAAE,GAAG,aAAa,OAAO,KAAK,SAAS,WAAW,CAAC,GAAG,KAAK,IAAI,EAAE,MAAM,GAAE,GAAG,EAAE,KAAK,EAAE,IAAI,cAAa;AAAA,IACzL;AAAA,IACA,MAAM,SAAS,OAAO,OAAO;AAAA,IAC7B,IAAI,CAAC,UAAU,OAAO,OAAO,QAAQ,YAAY,CAAC,OAAO,OAAO,OAAO,IAAI,SAAS,OAAO,OAAO,OAAO,QAAQ;AAAA,MAAU,KAAK,yBAAyB,GAAG;AAAA,IAC5J,IAAI,EAAE,aAAa;AAAA,MAAa,KAAK,gBAAgB,GAAG,MAAM;AAAA,IAC9D,OAAO,EAAC,UAAU,QAAQ,QAAQ,OAAO,KAAK,SAAS,OAAO,KAAK,aAAa,OAAO,OAAO,SAAS,WAAW,CAAC,GAAG,OAAO,IAAI,EAAE,MAAM,GAAE,GAAG,EAAE,KAAK,EAAE,IAAI,WAAU;AAAA;AAE7K;AAoEA,IAAM,YAAY;AAAlB,IAAuB,kBAAkB;AAAzC,IAA6C,iBAAiB;AAA9D,IAAmE,YAAY;AAA/E,IAAoF,YAAY;AAChG,IAAM,cAAc;AACpB,IAAM,cAAc;AACpB,IAAM,iBAAgC,EAAE,iBAAiB,OAAO,cAAc,GAAG,cAAc,EAAE;AACjG,IAAM,kBAA6B,EAAE,SAAS,OAAO,SAAS,IAAI,WAAW,IAAI,WAAW,CAAC,EAAE;AAkC/F,IAAM,WAAW;AACjB,IAAM,SAAS;AACf,IAAM,yBAAkD,OAAO,OAAO,EAAE,oBAAoB,IAAI,wBAAwB,IAAI,CAAC;AAG7H,IAAM,uBAAuB,MAAM,KAAK,KAAK;AAC7C,IAAM,sBAAsB;AAC5B,IAAM,MAAM,CAAC,eAAe,gBAAgB,aAAa,aAAa,aAAa,cAAc,gBAAgB,kBAAkB,gBAAgB,aAAa,iBAAiB,aAAa;AAC9L,SAAS,MAAM,CAAC,GAAqC;AAAA,EAAE,IAAI,CAAC,KAAK,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC;AAAA,IACrG,KAAK,eAAe;AAAA,EAAG,OAAO;AAAA;AAClC,SAAS,KAAK,CAAC,GAA4B,QAAkB;AAAA,EAAE,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,OAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAAA,IAC3G,KAAK,eAAe;AAAA;AACxB,SAAS,QAAQ,CAAC,GAAoB;AAAA,EAAE,IAAI,OAAO,MAAM,YAAY,CAAC,qCAAqC,KAAK,CAAC;AAAA,IAC7G,KAAK,eAAe;AAAA,EAAG,OAAO,EAAE,YAAY;AAAA;AAChD,SAAS,QAAQ,CAAC,GAAoB;AAAA,EAAE,IAAI,OAAO,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS,KAAK,CAAC,GAAG,CAAC,EAAE,SAAS;AAAA,IACtG,KAAK,kBAAkB;AAAA,EAAG,OAAO;AAAA;AACrC,SAAS,MAAM,CAAC,GAAmB;AAAA,EAAE,OAAO,WAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK;AAAA;AACvF,SAAS,IAAI,CAAC,OAAuB;AAAA,EAAE,OAAO,WAAW,UAAU,KAAK,EAAE,OAAO,mBAAmB,EAAE,OAAO,WAAW;AAAA;AACxH,SAAS,QAAQ,CAAC,GAAW,GAAoB;AAAA,EAAE,MAAM,KAAK,OAAO,KAAK,CAAC,GAAG,KAAK,OAAO,KAAK,CAAC;AAAA,EAAG,OAAO,GAAG,WAAW,GAAG,UAAU,gBAAgB,IAAI,EAAE;AAAA;AAC3J,SAAS,GAAG,CAAC,GAAkB;AAAA,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,UAAU,aAAa,EAAE,aAAa,UAAU,EAAE,UAAU,kBAAkB,CAAC,CAAC,EAAE,cAAc,wBAAwB,EAAE,UAAU;AAAA;AACpM,SAAS,IAAI,CAAC,GAAY,SAAS,KAAK,UAAkC,CAAC,GAAa;AAAA,EAAE,OAAO,SAAS,KAAK,GAAG,EAAE,QAAQ,SAAS,EAAE,iBAAiB,eAAe,QAAQ,EAAE,CAAC;AAAA;AAClL,SAAS,IAAI,CAAC,OAA0B;AAAA,EAAE,OAAO,iBAAiB,eAAe,KAAK,EAAE,OAAO,MAAM,KAAK,GAAG,MAAM,MAAM,IAAI,KAAK,EAAE,OAAO,uBAAuB,GAAG,GAAG;AAAA;AACxK,eAAe,IAAI,CAAC,SAAoD;AAAA,EACpE,MAAM,SAAS,QAAQ,MAAM,UAAU;AAAA,EACvC,IAAI,CAAC;AAAA,IACD,KAAK,eAAe;AAAA,EACxB,IAAI,OAAO;AAAA,EACX,MAAM,SAAuB,CAAC;AAAA,EAC9B,IAAI;AAAA,IACA,UAAS;AAAA,MACL,MAAM,IAAI,MAAM,OAAO,KAAK;AAAA,MAC5B,IAAI,EAAE;AAAA,QACF;AAAA,MACJ,QAAQ,EAAE,MAAM;AAAA,MAChB,IAAI,OAAO,MAAM;AAAA,QACb,MAAM,OAAO,OAAO;AAAA,QACpB,KAAK,cAAc,GAAG;AAAA,MAC1B;AAAA,MACA,OAAO,KAAK,EAAE,KAAK;AAAA,IACvB;AAAA,YAEJ;AAAA,IACI,OAAO,YAAY;AAAA;AAAA,EAEvB,IAAI;AAAA,IACA,OAAO,OAAO,KAAK,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,CAAC,CAAC;AAAA,IAEpE,OAAO,GAAG;AAAA,IACN,IAAI,aAAa;AAAA,MACb,MAAM;AAAA,IACV,OAAO,KAAK,eAAe;AAAA;AAAA;AAGnC,SAAS,WAAW,CAAC,SAGZ;AAAA,EACL,MAAM,OAAO,QAAQ,QAAQ,IAAI,eAAe;AAAA,EAChD,IAAI,SAAS,MAAM;AAAA,IACf,MAAM,IAAI,+BAA+B,KAAK,IAAI;AAAA,IAClD,OAAO,IAAI,EAAE,OAAO,EAAE,IAAK,WAAW,SAAS,IAAI;AAAA,EACvD;AAAA,EACA,MAAM,UAAU,QAAQ,QAAQ,IAAI,QAAQ,KAAK,IAAI,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,OAAO,OAAK,EAAE,WAAW,SAAS,GAAG,CAAC;AAAA,EACzH,IAAI,OAAO,WAAW;AAAA,IAClB,OAAO;AAAA,EACX,MAAM,QAAQ,OAAO,GAAI,MAAM,OAAO,SAAS,CAAC;AAAA,EAChD,OAAO,sBAAsB,KAAK,KAAK,IAAI,EAAE,OAAO,WAAW,SAAS,IAAI;AAAA;AAEhF,SAAS,MAAM,CAAC,SAAkB,UAAmB;AAAA,EAAE,IAAI,QAAQ,QAAQ,IAAI,QAAQ,OAAO,YAAY,IAAI,IAAI,QAAQ,GAAG,EAAE;AAAA,IAC3H,KAAK,kBAAkB,GAAG;AAAA;AAC9B,SAAS,MAAM,CAAC,SAAkB,OAAe,QAAgB,kBAA2B;AAAA,EAAE,OAAO,GAAG,UAAU,qDAAqD,SAAS,IAAI,IAAI,oBAAoB,QAAQ,GAAG,EAAE,aAAa,WAAW,aAAa;AAAA;AAC9P,SAAS,qBAAqB,CAAC,OAAgB,OAAO,0BAA0B,SAAS,KAAoB;AAAA,EACzG,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK;AAAA,IAC1D,KAAK,MAAM,MAAM;AAAA,EACrB,MAAM,IAAI;AAAA,EACV,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,SAAO,CAAC,CAAC,sBAAsB,wBAAwB,EAAE,SAAS,GAAG,CAAC,KACvF,CAAC,CAAC,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,MAAM,OAAK,OAAO,cAAc,CAAC,KAAK,KAAK,KAAK,KAAK,mBAAmB,KAAK,EAAE,2BAA2B;AAAA,IAC/J,KAAK,MAAM,MAAM;AAAA,EACrB,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,wBAAwB,EAAE,uBAAuB;AAAA;AAIjG,IAAM,wBAAwB;AAC9B,IAAM,eAAe;AAArB,IAA0B,eAAe;AAChD,IAAM,SAAS,CAAC,UAAmB;AACnC,SAAS,YAAY,CAAC,OAAsB;AAAA,EACxC,MAAM,IAAI;AAAA,EACV,IAAI,CAAC,KAAK,OAAO,KAAK,CAAC,EAAE,KAAK,OAAK,CAAC,CAAC,MAAM,YAAY,eAAe,YAAY,YAAY,EAAE,SAAS,CAAC,CAAC,KAAK,OAAO,EAAE,OAAO,YAAY,CAAC,kBAAkB,KAAK,EAAE,EAAE,KAAK,OAAO,EAAE,aAAa,YAAY,CAAC,+BAA+B,KAAK,EAAE,QAAQ,KAAK,OAAO,EAAE,gBAAgB,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,SAAS,OAAO,OAAO,EAAE,aAAa,aAAa,CAAC,OAAO,cAAc,EAAE,UAAU,KAAK,EAAE,aAAa;AAAA,IACha,KAAK,iBAAiB,GAAG;AAAA,EAC7B,OAAO;AAAA;AAEX,SAAS,UAAU,CAAC,QAAkE;AAAA,EAClF,IAAI,CAAC;AAAA,IACD,OAAO;AAAA,EACX,MAAM,IAAI,SAAS,OAAO,OAAO,YAAY;AAAA,EAC7C,IAAI,CAAC,KAAK,OAAO,KAAK,CAAC,EAAE,KAAK,OAAK,CAAC,CAAC,gBAAgB,WAAW,EAAE,SAAS,CAAC,CAAC,KAAK,OAAO,EAAE,iBAAiB,YAAY,CAAC,EAAE,aAAa,WAAW,YAAY,KAAK,OAAO,EAAE,cAAc;AAAA,IACvL,KAAK,iBAAiB,GAAG;AAAA,EAC7B,OAAO;AAAA;AAEX,SAAS,KAAQ,CAAC,SAAmC,KAAa,OAAe,UAAsB;AAAA,EACnG,MAAM,IAAI,QAAQ,KAAK,OAAK,EAAE,QAAQ,GAAG;AAAA,EACzC,OAAO,EAAE,KAAK,SAAS,GAAG,WAAW,GAAG,OAAO,IAAI,SAAS,EAAE,OAAO,KAAK,IAAS,SAAS;AAAA;AAEhG,SAAS,KAAK,CAAC,SAAoD;AAAA,EAC/D,MAAM,SAAS,QAAQ,OAAO,OAAK,EAAE,IAAI,WAAW,OAAO,CAAC,EAAE,IAAI,OAAK;AAAA,IAAE,MAAM,IAAI,aAAa,SAAS,EAAE,OAAO,MAAM,CAAC;AAAA,IAAG,IAAI,EAAE,QAAQ,UAAU,EAAE;AAAA,MAClJ,KAAK,iBAAiB,GAAG;AAAA,IAAG,MAAM,IAAI,WAAW,QAAQ,KAAK,OAAK,EAAE,QAAQ,gBAAgB,EAAE,EAAE,CAAC;AAAA,IAAG,OAAO,KAAK,GAAG,cAAc,GAAG,gBAAgB,IAAI,WAAW,GAAG,aAAa,MAAM;AAAA,GAAI;AAAA,EAClM,IAAI,OAAO,SAAS,aAAa,IAAI,IAAI,OAAO,IAAI,OAAK,EAAE,QAAQ,CAAC,EAAE,SAAS,OAAO;AAAA,IAClF,KAAK,iBAAiB,GAAG;AAAA,EAC7B,OAAO;AAAA;AAEX,SAAS,QAAQ,CAAC,SAAwD;AAAA,EACtE,MAAM,IAAI,MAAM,SAAS,kBAAkB,YAAY,cAAc,GAAG,IAAI,EAAE;AAAA,EAC9E,mBAAmB,SAAS,EAAE,OAAO;AAAA,EACrC,IAAI,CAAC,KAAK,OAAO,KAAK,CAAC,EAAE,KAAK,OAAK,CAAC,CAAC,mBAAmB,gBAAgB,cAAc,EAAE,SAAS,CAAC,CAAC,KAAK,OAAO,EAAE,oBAAoB,aAAa,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,OAAK,OAAO,cAAc,CAAC,KAAK,IAAI,CAAC;AAAA,IAC3N,KAAK,iBAAiB,GAAG;AAAA,EAC7B,OAAO;AAAA;AAEX,SAAS,SAAS,CAAC,SAAoD;AAAA,EACnE,MAAM,IAAI,MAAM,SAAS,aAAa,aAAa,eAAe,GAAG,IAAI,EAAE;AAAA,EAC3E,mBAAmB,SAAS,EAAE,OAAO;AAAA,EACrC,IAAI,CAAC,KAAK,OAAO,KAAK,CAAC,EAAE,KAAK,OAAK,CAAC,CAAC,WAAW,WAAW,aAAa,WAAW,EAAE,SAAS,CAAC,CAAC,KAAK,OAAO,EAAE,YAAY,aAAa,OAAO,EAAE,YAAY,YAAY,OAAO,EAAE,cAAc,YAAY,CAAC,MAAM,QAAQ,EAAE,SAAS,KAAK,EAAE,UAAU,KAAK,OAAK,OAAO,MAAM,QAAQ,KAAM,EAAE,YAAY,CAAC,EAAE,WAAW,CAAC,EAAE,aAAa,CAAC,EAAE,UAAU;AAAA,IAChV,KAAK,iBAAiB,GAAG;AAAA,EAC7B,OAAO;AAAA;AAEX,SAAS,kBAAkB,CAAC,SAAmC,SAAiB;AAAA,EAC5E,MAAM,QAAQ,QAAQ,KAAK,OAAK,EAAE,QAAQ,OAAO;AAAA,EACjD,IAAI,CAAC,WAAW,SAAU,SAAS,MAAM,OAAO,OAAO,EAAY,UAAU;AAAA,IAAS,KAAK,iBAAiB,GAAG;AAAA;AAEnH,SAAS,eAAe,CAAC,SAAuD;AAAA,EAC5E,MAAM,MAAM,IAAI;AAAA,EAChB,MAAM,SAAS,QAAQ,OAAO,OAAK,EAAE,IAAI,WAAW,aAAa,CAAC,EAAE,IAAI,OAAK;AAAA,IACzE,MAAM,IAAI,SAAS,EAAE,OAAO,YAAY;AAAA,IACxC,IAAI,MAAM;AAAA,MAAM,OAAO,EAAE,KAAK,EAAE,KAAK,SAAS,EAAE,SAAS,OAAO,KAAK;AAAA,IACrE,IAAI,CAAC,KAAM,EAAE,aAAa,cAAc,CAAC,EAAE,YAAY,EAAE,WAAW,OAAO,KAAK,EAAE,QAAQ,EAAE,KAAK,OAAK,MAAM,YAAY,KAAK,CAAC,MAAM,QAAQ,EAAE,SAAS,UAAU,KAAK,EAAE,SAAS,WAAW,SAAS,YAAY,KAAK,EAAE,SAAS,WAAW,KAAK,SAAO,OAAO,QAAQ,YAAY,CAAC,iCAAiC,KAAK,GAAG,CAAC,MAAO,OAAO,KAAK,CAAC,EAAE,KAAK,OAAK,CAAC,CAAC,MAAM,SAAS,WAAW,UAAU,YAAY,iBAAiB,YAAY,aAAa,UAAU,cAAc,UAAU,EAAE,SAAS,CAAC,CAAC,KAAK,OAAO,EAAE,OAAO,YAAY,CAAC,kBAAkB,KAAK,EAAE,EAAE,KAAK,IAAI,IAAI,EAAE,EAAE,KAAK,OAAO,EAAE,UAAU,YAAY,OAAO,EAAE,YAAY,aAAa,OAAO,EAAE,WAAW,YAAY,OAAO,EAAE,aAAa,YAAY,OAAO,EAAE,cAAc,YAAY,CAAC,MAAM,QAAQ,EAAE,MAAM,KAAM,EAAE,aAAa,YAAY,CAAC,EAAE,OAAO,SAAS,QAAQ,KAAM,EAAE,OAAO,KAAK,OAAK,OAAO,MAAM,QAAQ,KAAK,CAAC,OAAO,cAAc,EAAE,UAAU,KAAK,EAAE,aAAa;AAAA,MAC15B,KAAK,iBAAiB,GAAG;AAAA,IAC7B,IAAI;AAAA,MAAE,MAAM,SAAS,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,SAAS,EAAE,SAAS,SAAS;AAAA,MAAG,IAAI,KAAK,UAAU,MAAM,MAAM,KAAK,UAAU,EAAC,UAAU,EAAE,UAAU,QAAQ,EAAE,QAAQ,eAAe,EAAE,eAAe,QAAQ,EAAE,OAAM,CAAC;AAAA,QAAG,KAAK,iBAAiB,GAAG;AAAA,MAAK,MAAM;AAAA,MAAE,KAAK,iBAAiB,GAAG;AAAA;AAAA,IACzT,IAAI,IAAI,EAAE,EAAE;AAAA,IACZ,OAAO,EAAE,KAAK,EAAE,KAAK,SAAS,EAAE,SAAS,OAAO,EAAE;AAAA,GACrD;AAAA,EACD,IAAI,OAAO,SAAS;AAAA,IAChB,KAAK,iBAAiB,GAAG;AAAA,EAC7B,OAAO;AAAA;AAEX,SAAS,WAAW,CAAC,SAAiD;AAAA,EAAE,OAAO,gBAAgB,OAAO,EAAE,QAAQ,UAAQ,KAAK,SAAS,CAAC,KAAK,MAAM,WAAW,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;AAAA;AAC9K,SAAS,UAAU,CAAC,SAA+C;AAAA,EAC/D,MAAM,SAAS,QAAQ,OAAO,OAAK,EAAE,IAAI,WAAW,WAAW,CAAC,EAAE,QAAQ,OAAK;AAAA,IAAE,MAAM,IAAI,SAAS,EAAE,OAAO,UAAU;AAAA,IAAsB,IAAI,MAAM;AAAA,MACnJ,OAAO,CAAC;AAAA,IAAG,IAAI,CAAC,KAAK,OAAO,KAAK,CAAC,EAAE,KAAK,OAAK,CAAC,CAAC,MAAM,UAAU,gBAAgB,UAAU,WAAW,UAAU,EAAE,SAAS,CAAC,CAAC,KAAK,OAAO,EAAE,WAAW,YAAY,OAAO,EAAE,iBAAiB,YAAY,OAAO,EAAE,WAAW,YAAY,CAAC,CAAC,QAAQ,QAAQ,EAAE,SAAS,EAAE,QAAQ,KAAK,OAAO,EAAE,YAAY,YAAY,CAAC,EAAE,WAAW,EAAE,QAAQ,cAAc,EAAE,MAAM,EAAE,OAAO,OAAO,EAAE,SAAS,SAAO,EAAE,OAAO;AAAA,MAC7Y,KAAK,iBAAiB,GAAG;AAAA,IAAG,OAAO,CAAC,CAAC;AAAA,GAAI;AAAA,EAC7C,IAAI,OAAO,SAAS;AAAA,IAChB,KAAK,iBAAiB,GAAG;AAAA,EAC7B,OAAO;AAAA;AAEX,SAAS,QAAQ,CAAC,OAAgB,OAAwB;AAAA,EACtD,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK;AAAA,IAC1D,KAAK,iBAAiB,GAAG;AAAA,EAC7B,MAAM,IAAI;AAAA,EACV,IAAI,EAAE,WAAW,yBAAyB,CAAC,OAAO,OAAO,GAAG,KAAK,KAAK,OAAO,KAAK,CAAC,EAAE,KAAK,OAAK,MAAM,YAAY,MAAM,KAAK;AAAA,IACxH,KAAK,iBAAiB,GAAG;AAAA,EAC7B,OAAO,EAAE;AAAA;AAEb,SAAS,eAAe,CAAC,OAAgC;AAAA,EACrD,IAAI,UAAU;AAAA,IACV,OAAO;AAAA,EACX,MAAM,IAAI;AAAA,EACV,IAAI,CAAC,KAAK,OAAO,KAAK,CAAC,EAAE,KAAK,OAAK,CAAC,CAAC,UAAU,mBAAmB,cAAc,WAAW,WAAW,gBAAgB,aAAa,UAAU,SAAS,gBAAgB,sBAAsB,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,iBAAiB,KAAK,EAAE,MAAM,KAAK,OAAO,EAAE,oBAAoB,YAAY,CAAC,EAAE,mBAAmB,CAAC,OAAO,cAAc,EAAE,UAAU,KAAK,EAAE,aAAa,KAAK,CAAC,OAAO,cAAc,EAAE,OAAO,KAAK,EAAE,UAAU,KAAK,CAAC,OAAO,cAAc,EAAE,OAAO,KAAK,EAAE,UAAU,EAAE,WAAY,EAAE,iBAAiB,cAAc,CAAC,OAAO,cAAc,EAAE,YAAY,KAAK,EAAE,eAAe,EAAE,YAAa,CAAC,OAAO,cAAc,EAAE,KAAK,KAAK,EAAE,QAAQ,KAAM,EAAE,iBAAiB,cAAc,OAAO,EAAE,iBAAiB,YAAY,CAAC,OAAO,cAAc,EAAE,oBAAoB,MAAO,CAAC,CAAC,UAAU,QAAQ,EAAE,SAAS,EAAE,SAAS;AAAA,IAC3xB,KAAK,iBAAiB,GAAG;AAAA,EAC7B,sBAAsB,EAAE,QAAQ,iBAAiB,GAAG;AAAA,EACpD,OAAO;AAAA;AAEX,SAAS,eAAe,CAAC,OAAgC;AAAA,EACrD,IAAI,UAAU;AAAA,IACV,OAAO;AAAA,EACX,MAAM,IAAI;AAAA,EACV,IAAI,CAAC,KAAK,OAAO,KAAK,CAAC,EAAE,KAAK,OAAK,CAAC,CAAC,OAAO,SAAS,SAAS,OAAO,EAAE,SAAS,CAAC,CAAC,KAAK,OAAO,EAAE,QAAQ,YAAY,CAAC,4CAA4C,KAAK,EAAE,GAAG,KAAK,CAAC,OAAO,cAAc,EAAE,KAAK,KAAK,EAAE,QAAQ,KAAK,CAAC,OAAO,cAAc,EAAE,KAAK,KAAK,EAAE,QAAQ,KAAK,CAAC,OAAO,cAAc,EAAE,KAAK,KAAK,EAAE,QAAQ;AAAA,IAC1T,KAAK,iBAAiB,GAAG;AAAA,EAC7B,OAAO;AAAA;AAEX,SAAS,KAA6C,CAAC,SAAmC,MAAc,OAAe,UAA+C;AAAA,EAClK,MAAM,SAAoB,MAAM,KAAK,EAAE,QAAQ,MAAM,GAAG,CAAC,GAAG,OAAO,EAAE,KAAK,GAAG,QAAQ,KAAK,SAAS,GAAG,OAAO,KAAK,EAAE;AAAA,EACpH,MAAM,OAAO,IAAI;AAAA,EACjB,WAAW,KAAK,QAAQ,OAAO,OAAK,EAAE,IAAI,WAAW,OAAO,GAAG,CAAC,GAAG;AAAA,IAC/D,MAAM,QAAQ,OAAO,EAAE,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC;AAAA,IACjD,IAAI,CAAC,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAK,SAAS,SAAS,EAAE,QAAQ,GAAG,QAAQ;AAAA,MAChF,KAAK,iBAAiB,GAAG;AAAA,IAC7B,MAAM,QAAQ,SAAS,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,IAC9C,MAAM,WAAW,UAAU,SAAS,YAAa,MAAkB,SAAS,SAAS,YAAa,MAAkB,MAAO,MAAmB;AAAA,IAC9I,IAAI,YAAY,KAAK,IAAI,QAAQ;AAAA,MAC7B,KAAK,iBAAiB,GAAG;AAAA,IAC7B,IAAI;AAAA,MACA,KAAK,IAAI,QAAQ;AAAA,IACrB,OAAO,SAAS,EAAE,KAAK,EAAE,KAAK,SAAS,EAAE,SAAS,MAAM;AAAA,EAC5D;AAAA,EACA,OAAO;AAAA;AAEX,IAAM,WAAW,CAAI,MAAe,OAAe,WAAsC,EAAE,KAAK,KAAK,KAAK,iBAAiB,KAAK,SAAS,OAAO,OAAO,EAAE,QAAQ,wBAAwB,QAAQ,MAAM,CAAC,EAAE;AAC1M,SAAS,IAAI,CAAC,OAAuB;AAAA,EAAE,IAAI,CAAC,OAAO,cAAc,QAAQ,CAAC;AAAA,IACtE,KAAK,qBAAqB;AAAA,EAAG,OAAO,QAAQ;AAAA;AAkBhD,SAAS,YAAY,CAAC,SAAmC;AAAA,EACrD,WAAW,KAAK;AAAA,IACZ,IAAI,CAAC,CAAC,SAAS,SAAS,kBAAkB,oBAAoB,mBAAmB,kBAAkB,WAAW,EAAE,SAAS,EAAE,GAAG,KAAK,CAAC,CAAC,YAAY,YAAY,SAAS,eAAe,aAAa,eAAe,SAAS,QAAQ,EAAE,KAAK,OAAK,EAAE,IAAI,WAAW,CAAC,CAAC;AAAA,MAC7P,KAAK,iBAAiB,GAAG;AAAA;AAErC,SAAS,aAAa,CAAC,SAAiC;AAAA,EACpD,WAAU,UAAU,QAAQ,OAAO,OAAG,EAAE,IAAI,WAAW,QAAQ,CAAC,GAAE;AAAA,IAC9D,MAAM,QAAM,OAAO,OAAO,IAAI,MAAM,CAAC,CAAC;AAAA,IACtC,MAAM,QAAM,SAAS,OAAO,OAAM,OAAO;AAAA,IACzC,IAAG,CAAC,OAAO,UAAU,KAAK,KAAG,QAAM,KAAG,SAAO,aAAW,OAAO,QAAM,WAAS,SAAO,CAAC,SAAO,OAAO,KAAK,KAAK,EAAE,KAAK,OAAG,CAAC,CAAC,SAAQ,UAAS,UAAS,IAAI,EAAE,SAAS,CAAC,CAAC,KAAG,CAAC,MAAM,OAAM,MAAM,QAAO,MAAM,MAAM,EAAE,KAAK,OAAG,OAAO,MAAI,YAAU,CAAC,KAAG,EAAE,SAAO,GAAG,KAAG,CAAC,OAAO,cAAc,MAAM,EAAE,KAAG,MAAM,KAAG;AAAA,MAAE,KAAK,iBAAgB,GAAG;AAAA,EACxU;AAAA;AAEJ,SAAS,UAAU,CAAC,QAAkD;AAAA,EAClE,IAAI,CAAC;AAAA,IACD,KAAK,iBAAiB,GAAG;AAAA,EAC7B,MAAM,QAAQ,SAAS,OAAO,OAAO,iBAAiB;AAAA,EACtD,IAAI,CAAC,OAAO,cAAc,KAAK,KAAM,QAAmB;AAAA,IACpD,KAAK,iBAAiB,GAAG;AAAA,EAC7B,OAAO;AAAA;AAEX,SAAS,QAAQ,CAAC,KAA2B;AAAA,EAAE,MAAM,QAAQ,IAAI;AAAA,EAAG,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ;AAAA,IAC5G,KAAK,iBAAiB,GAAG;AAAA,EAAG,OAAO;AAAA;AACvC,SAAS,aAAa,CAAC,OAA+B;AAAA,EAAE,OAAO,EAAE,KAAK,SAAS,iBAAiB,MAAM,SAAS,OAAO,EAAE,QAAQ,uBAAuB,iBAAiB,MAAM,MAAM,EAAE;AAAA;AACtL,eAAe,YAAY,CAAC,OAA2B,KAAmC;AAAA,EACtF,SAAS,IAAI,EAAG,IAAI,IAAI,KAAK;AAAA,IACzB,MAAM,SAAS,MAAM,MAAM,IAAI,OAAO,GAAG,QAAQ,WAAW,MAAM,GAAG,QAAQ,KAAK,IAAI,OAAO,SAAS,GAAG,CAAC;AAAA,IAC1G,IAAI,UAAU;AAAA,MACV,OAAO,EAAE,SAAS,OAAQ,SAAS,OAAO,aAAa,OAAQ,QAAQ;AAAA,IAC3E,IAAI;AAAA,MACA,OAAO,SAAS,MAAM,MAAM,SAAS,CAAC,cAAc,EAAE,SAAS,OAAQ,SAAS,MAAM,CAAC,CAAC,CAAC;AAAA,MACzF,OAAO,EAAE,SAAS,MAAO,SAAS,OAAO,aAAa,OAAQ,QAAQ;AAAA,MAE1E,OAAO,GAAG;AAAA,MACN,IAAI,CAAC,4BAA4B,CAAC;AAAA,QAC9B,MAAM;AAAA;AAAA,EAElB;AAAA,EACA,OAAO,KAAK,oBAAoB,GAAG;AAAA;AAEvC,SAAS,WAAW,CAAC,SAInB;AAAA,EACE,aAAa,OAAO;AAAA,EACpB,MAAM,SAAS,QAAQ,KAAK,OAAK,EAAE,QAAQ,OAAO;AAAA,EAClD,IAAI,CAAC;AAAA,IACD,KAAK,iBAAiB,GAAG;AAAA,EAC7B,MAAM,QAAQ,SAAS,OAAO,OAAO,OAAO;AAAA,EAC5C,IAAI,CAAC,SAAS,CAAC,CAAC,iBAAiB,OAAO,EAAE,SAAS,MAAM,KAAK,KAAK,OAAO,KAAK,KAAK,EAAE,KAAK,OAAK,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,CAAC,CAAC;AAAA,IAC1H,KAAK,iBAAiB,GAAG;AAAA,EAC7B,IAAI,MAAM,SAAS,cAAc,CAAC,MAAM,QAAQ,CAAC,iBAAiB,KAAK,MAAM,KAAK,MAAM,KAAK,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,KAAK,MAAM,KAAK,YAAY,KAAK,OAAO,KAAK,MAAM,IAAI,EAAE,KAAK,OAAK,CAAC,CAAC,UAAU,WAAW,EAAE,SAAS,CAAC,CAAC;AAAA,IAC1O,KAAK,iBAAiB,GAAG;AAAA,EAC7B,IAAI,MAAM,UAAU,WAAW,MAAM,SAAS;AAAA,IAC1C,KAAK,iBAAiB,GAAG;AAAA,EAC7B,MAAM,MAAM,MAAM,OAAO,GAAG,SAAS,QAAQ,KAAK,OAAK,EAAE,QAAQ,iBAAiB;AAAA,EAClF,IAAK,MAAM,UAAU,YAAa,CAAC,CAAC,IAAI,UAAW,MAAM,UAAU,YAAY,CAAC,UAAU,OAAO,SAAS,OAAO,OAAO,QAAQ,MAAM;AAAA,IAClI,KAAK,iBAAiB,GAAG;AAAA,EAC7B,cAAc,OAAO;AAAA,EACrB,SAAS,OAAO;AAAA,EAChB,UAAU,OAAO;AAAA,EACjB,YAAY,OAAO;AAAA,EACnB,WAAW,OAAO;AAAA,EAClB,WAAW,QAAQ,KAAK,OAAK,EAAE,QAAQ,OAAO,CAAC;AAAA,EAC/C,OAAO,EAAE,KAAK,SAAS,SAAS,OAAO,SAAS,MAAM;AAAA;AAAA;AAEnD,MAAM,gBAA6D;AAAA,EAgBzC;AAAA,EAA2C;AAAA,EAf/D,aAAa;AAAA,EACb,MAAM,CAAC;AAAA,EACP;AAAA,EACQ;AAAA,EACA;AAAA,EACA,WAAW,IAAI;AAAA,EAKf,eAAe,IAAI;AAAA,EAC5B,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,YAA2B,QAAQ,QAAQ;AAAA,EAC3C,yBAAyB;AAAA,EACjC,WAAW,CAAkB,MAA2C,eAA6B,CAAC,GAAG;AAAA,IAA5E;AAAA,IAA2C;AAAA,IACpE,IAAI,CAAC,KAAK;AAAA,MACN,KAAK,0BAA0B,GAAG;AAAA,IACtC,KAAK,QAAQ,KAAK;AAAA,IAClB,KAAK,MAAM,aAAa,OAAO,KAAK;AAAA,IACpC,MAAM,SAAS,CAAC,OAA2D,OAAO,MAAgC;AAAA,MAC9G,IAAI;AAAA,QACA,KAAK,MAAM;AAAA,QACX,IAAI,EAAE,cAAc;AAAA,UAChB,KAAK,WAAW;AAAA,QACpB,OAAO,MAAM,GAAG,CAAC;AAAA,QAErB,OAAO,GAAG;AAAA,QACN,OAAO,KAAK,CAAC;AAAA;AAAA;AAAA,IAGrB,KAAK,MAAM;AAAA,MACP,EAAE,MAAM,aAAa,SAAS,CAAC,MAAM,GAAG,SAAS,kBAAkB,QAAQ,OAAO,OAAO,MAAM;AAAA,QACvF,MAAM,KAAK,kBAAkB,GAAG,iBAAiB,IAAI;AAAA,QACrD,MAAM,IAAI,MAAM,KAAK,EAAE,OAAO;AAAA,QAC9B,MAAM,GAAG,CAAC,mBAAmB,YAAY,sBAAsB,CAAC;AAAA,QAChE,MAAM,KAAK,eAAe,GAAG,CAAC;AAAA,QAC9B,OAAO,KAAK,EAAE,IAAI,KAAK,GAAG,KAAK,EAAE,cAAc,OAAO,EAAE,SAAS,IAAI,GAAG,KAAK,KAAK,gBAAgB,EAAE,CAAC;AAAA,OACxG,EAAE;AAAA,MACP,EAAE,MAAM,WAAW,SAAS,CAAC,MAAM,GAAG,SAAS,UAAU,QAAQ,OAAO,OAAO,MAAM;AAAA,QAAE,MAAM,KAAK,kBAAkB,GAAG,eAAe,IAAI;AAAA,QAAG,OAAO,KAAK,OAAO,EAAE,OAAO;AAAA,OAAI,EAAE;AAAA,MAC/K,EAAE,MAAM,SAAS,SAAS,CAAC,KAAK,GAAG,SAAS,QAAQ,QAAQ,OAAO,OAAO,MAAM;AAAA,QACxE,MAAM,KAAK,kBAAkB,GAAG,eAAe;AAAA,QAC/C,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,UAAE,QAAQ,SAAS,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,QAAQ,YAAY,EAAE,OAAO;AAAA,UAAG,OAAO,EAAE,WAAW,CAAC,GAAG,QAAQ,KAAK,EAAE,eAAe,IAAI,IAAI,MAAO,OAAO,cAAc,WAAW,EAAE,WAAW,KAAK,MAAM,KAAK,EAAE,IAAI,CAAC,EAAG,CAAC,EAAE;AAAA,SAAI;AAAA,OACtQ,EAAE;AAAA,MACP,EAAE,MAAM,mBAAmB,SAAS,CAAC,OAAO,KAAK,GAAG,SAAS,iBAAiB,QAAQ,OAAO,OAAO,MAAM;AAAA,QAClG,MAAM,KAAK,kBAAkB,GAAG,gBAAgB,EAAE,QAAQ,WAAW,KAAK;AAAA,QAC1E,IAAI,EAAE,QAAQ,WAAW;AAAA,UACrB,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,YAAE,MAAM,SAAS,MAAM,KAAK,kBAAkB;AAAA,YAAG,MAAM,KAAK,MAAM,GAAG,IAAI;AAAA,YAAG,OAAO,EAAE,WAAW,CAAC,GAAG,QAAQ,KAAK,MAAM,EAAE;AAAA,WAAI;AAAA,QACnK,MAAM,IAAI,MAAM,KAAK,EAAE,OAAO;AAAA,QAC9B,MAAM,GAAG,CAAC,WAAW,QAAQ,CAAC;AAAA,QAC9B,IAAI,CAAC,OAAO,cAAc,EAAE,OAAO,KAAM,EAAE,UAAqB;AAAA,UAC5D,KAAK,wBAAwB;AAAA,QACjC,MAAM,SAAS,sBAAsB,EAAE,MAAM;AAAA,QAC7C,MAAM,KAAK,kBAAkB,GAAG,gBAAgB,IAAI;AAAA,QACpD,IAAI;AAAA,UACA,MAAM,KAAK,MAAM,OAAO,SAAS;AAAA,YAAE,MAAM,KAAK,MAAM,GAAG,IAAI;AAAA,YAAG,OAAO,EAAE,WAAW,CAAC,EAAE,KAAK,kBAAkB,iBAAiB,EAAE,SAAmB,OAAO,OAAO,EAAE,QAAQ,uBAAuB,OAAO,CAAC,EAAE,CAAC,GAAG,QAAQ,UAAU;AAAA,WAAI;AAAA,UAEzO,OAAO,GAAG;AAAA,UACN,IAAI,4BAA4B,CAAC;AAAA,YAC7B,KAAK,oBAAoB,GAAG;AAAA,UAChC,MAAM;AAAA;AAAA,QAEV,OAAO,KAAK,MAAM,KAAK,kBAAkB,CAAC;AAAA,OAC7C,EAAE;AAAA,MACP,GAAG,KAAK,WAAW,MAAM;AAAA,IAC7B;AAAA;AAAA,EAEI,KAAK,GAAG;AAAA,IAAE,IAAI,KAAK,YAAY,KAAK,KAAK,OAAO;AAAA,MACpD,KAAK,wBAAwB,GAAG;AAAA;AAAA,OACtB,kBAAiB,CAAC,IAA2C;AAAA,IACvE,KAAK,MAAM;AAAA,IACX,IAAI,CAAC,IAAI;AAAA,MACL,MAAM,MAAM,MAAM,MAAM,KAAK,QAAQ,CAAC;AAAA,MACtC,KAAK,IAAI,IAAI;AAAA,IACjB;AAAA,IACA,IAAI,CAAC;AAAA,MACD,OAAO,EAAE,KAAK,gBAAgB,SAAS,GAAG,OAAO,KAAK;AAAA,IAC1D,MAAM,SAAS,MAAM,KAAK,MAAM,IAAI,UAAU,EAAE;AAAA,IAChD,IAAI,CAAC;AAAA,MACD,OAAO,EAAE,KAAK,UAAU,IAAI,SAAS,GAAG,OAAO,KAAK;AAAA,IACxD,MAAM,OAAO,aAAa,SAAS,OAAO,OAAO,MAAM,CAAC,GAAG,aAAa,WAAW,MAAM,KAAK,MAAM,IAAI,gBAAgB,EAAE,CAAC;AAAA,IAC3H,IAAI,KAAK,OAAO;AAAA,MACZ,KAAK,iBAAiB,GAAG;AAAA,IAC7B,OAAO,EAAE,KAAK,OAAO,KAAK,SAAS,OAAO,SAAS,OAAO,KAAK,MAAM,cAAc,YAAY,gBAAgB,IAAI,WAAW,YAAY,aAAa,MAAM,EAAE;AAAA;AAAA,EAE3J,YAAY,CAAC,MAA2B,OAAuC;AAAA,IAAE,QAAQ,cAAc,cAAc,SAAS;AAAA,IAAO,OAAO,SAAS,MAAM,QAAQ,IAAI;AAAA;AAAA,EACvK,kBAAkB,CAAC,SAAmC,IAAY,MAA+B;AAAA,IAAE,MAAM,IAAI,QAAQ,KAAK,OAAK,EAAE,QAAQ,gBAAgB,EAAE;AAAA,IAAG,OAAO,EAAE,KAAK,gBAAgB,IAAI,iBAAiB,GAAG,WAAW,GAAG,OAAO,OAAO,EAAE,QAAQ,uBAAuB,YAAY,EAAE,cAAc,MAAM,WAAW,MAAM,EAAE,CAAC,EAAE;AAAA;AAAA,OACnU,QAAO,GAAG;AAAA,IACpB,KAAK,MAAM;AAAA,IACX,MAAM,UAAU,MAAM,KAAK,MAAM,KAAK;AAAA,IACtC,YAAY,OAAO;AAAA,IACnB,OAAO;AAAA;AAAA,OAEG,MAAQ,CAAC,MAGP;AAAA,IAGZ,IAAI,KAAK,0BAA0B;AAAA,MAC/B,KAAK,iBAAiB,GAAG;AAAA,IAC7B,KAAK;AAAA,IACL,MAAM,OAAO,KAAK,UAAU,KAAK,YAAY;AAAA,MACzC,MAAM,KAAK,0BAA0B;AAAA,MACrC,MAAM,SAAS,MAAM,KAAK,WAAW,IAAI;AAAA,MACzC,MAAM,KAAK,0BAA0B;AAAA,MACrC,OAAO;AAAA,KACV;AAAA,IACD,KAAK,YAAY,KAAK,KAAK,MAAM,IAAK,MAAM,EAAG;AAAA,IAC/C,IAAI;AAAA,MACA,OAAO,MAAM;AAAA,cAEjB;AAAA,MACI,KAAK;AAAA;AAAA;AAAA,OAGC,WAAa,CAAC,MAGZ;AAAA,IACZ,SAAS,IAAI,EAAG,IAAI,IAAI,KAAK;AAAA,MACzB,MAAM,SAAS,MAAM,KAAK,MAAM,IAAI,OAAO;AAAA,MAC3C,WAAW,MAAM;AAAA,MACjB,IAAI;AAAA,MAGJ,MAAM,OAAO,YAAY;AAAA,QAAE,MAAM,QAAQ,OAAO,WAAW,MAAM,aAAa,KAAK,OAAO,KAAK,GAAG;AAAA,QAAG,QAAQ,SAAS,SAAS,gBAAgB,MAAM,UAAU,KAAK,UAAU,aAAa,MAAM,YAAY,IAAI;AAAA,QAAU,OAAO,MAAM;AAAA;AAAA,MACxO,IAAI;AAAA,MAIJ,IAAI;AAAA,QACA,UAAU,MAAM,KAAK,IAAI;AAAA,QAE7B,OAAO,OAAO;AAAA,QACV,MAAM,KAAK;AAAA,QACX,MAAM;AAAA;AAAA,MAEV,IAAI,CAAC;AAAA,QACD,MAAM,KAAK;AAAA,MAGf,IAAI,MAAO,gBAAgB,OAAQ;AAAA,QAC/B;AAAA,MACJ,IAAI,CAAC,QAAQ,UAAU;AAAA,QACnB,OAAO,QAAQ;AAAA,MACnB,KAAK,MAAM;AAAA,MACX,IAAI;AAAA,QACA,MAAM,KAAK,MAAM,SAAS,CAAC,GAAG,QAAQ,WAAW,cAAc,KAAM,CAAC,CAAC;AAAA,QACvE,OAAO,QAAQ;AAAA,QAEnB,OAAO,GAAG;AAAA,QACN,IAAI,CAAC,4BAA4B,CAAC;AAAA,UAC9B,MAAM;AAAA;AAAA,IAElB;AAAA,IACA,OAAO,KAAK,oBAAoB,GAAG;AAAA;AAAA,OAEzB,0BAAyB,GAAkB;AAAA,IAIrD,IAAI,CAAC,gBAAgB,MAAM,KAAK,MAAM,KAAK,CAAC,EAAE,KAAK,UAAQ,KAAK,OAAO,QAAQ;AAAA,MAAG;AAAA,IAIlF,UAAS;AAAA,MACL,MAAM,UAAU,MAAM,KAAK,WAAW,YAAY;AAAA,QAC9C,MAAM,UAAU,MAAM,KAAK,QAAQ;AAAA,QACnC,MAAM,OAAO,gBAAgB,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,QAAQ;AAAA,QACjE,IAAI,CAAC;AAAA,UAAM,OAAO,EAAE,WAAW,CAAC,GAAG,QAAQ,EAAE,MAAM,MAAM,YAAY,KAA0B,EAAE;AAAA,QACjG,MAAM,KAAK,KAAK,MAAO;AAAA,QACvB,MAAM,WAAW,WAAW,OAAO,EAAE,OAAO,OAAK,EAAE,iBAAiB,EAAE;AAAA,QACtE,MAAM,QAAQ,KAAK,MAAM,OAAO,EAAE,OAAO,OAAK,EAAE,OAAO,iBAAiB,EAAE;AAAA,QAC1E,MAAM,UAAU;AAAA,UACZ,GAAG,SAAS,IAAI,OAAK,SAAS,MAAM,SAAS,cAAc,EAAE,IAAI,YAAY,IAAI,GAAG,YAAY,IAAI,CAAC;AAAA,UACrG,GAAG,MAAM,IAAI,OAAK,SAAS,GAAG,QAAQ,IAAI,CAAC;AAAA,QAC/C;AAAA,QAEA,OAAO,EAAE,WAAW,QAAQ,MAAM,GAAG,GAAG,GAAG,QAAQ,EAAE,MAAM,OAAO,YAAY,QAAQ,SAAS,OAAO,KAAK,MAAM,EAAE;AAAA,OACtH;AAAA,MACD,IAAI,QAAQ;AAAA,QAAM;AAAA,MAClB,IAAI,CAAC,QAAQ;AAAA,QAAY;AAAA,MACzB,WAAW,OAAO,QAAQ,WAAW,SAAU,YAAY;AAAA,QACvD,MAAM,QAAQ,iCAAiC,KAAK,GAAG;AAAA,QACvD,MAAM,MAAM,iBAAiB,MAAM,IAAI,UAAU,OAAO,MAAM,EAAE;AAAA,QAChE,MAAM,QAAQ,MAAM,KAAK,KAAK,YAAY,IAAI,GAAG;AAAA,QAEjD,IAAI,OAAO,YAAY;AAAA,UAAS,MAAM,KAAK,KAAK,YAAY,OAAO,KAAK,OAAO;AAAA,MACnF;AAAA,MACA,MAAM,KAAK,WAAW,YAAY;AAAA,QAC9B,MAAM,UAAU,MAAM,KAAK,QAAQ;AAAA,QACnC,MAAM,OAAO,gBAAgB,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,OAAO,QAAQ,WAAY,MAAM,EAAE,MAAM,QAAQ;AAAA,QAC1G,OAAO,EAAE,WAAW,OAAO,CAAC,SAAS,MAAM,cAAc,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,UAAU;AAAA,OAC3F;AAAA,IACL;AAAA;AAAA,OAEU,kBAAiB,GAG5B;AAAA,IACC,KAAK,MAAM;AAAA,IACX,MAAM,SAAS,MAAM,KAAK,MAAM,IAAI,gBAAgB;AAAA,IACpD,OAAO,EAAE,SAAS,QAAQ,WAAW,GAAG,QAAQ,SAAS,sBAAsB,SAAS,OAAO,OAAO,QAAQ,GAAG,iBAAiB,GAAG,IAAI,KAAK,uBAAuB,EAAE;AAAA;AAAA,OAErK,MAAK,GAAG;AAAA,IACV,MAAM,oBAAoB,KAAK,KAAK;AAAA,IACpC,MAAM,aAAa,KAAK,OAAO,KAAK,GAAG;AAAA,IACvC,MAAM,KAAK,kBAAkB;AAAA,IAC7B,MAAM,UAAU,MAAM,KAAK,QAAQ;AAAA,IACnC,MAAM,SAAS,WAAW,cAAc,eAAe;AAAA,IACvD,MAAM,SAAS,WAAW,cAAc,eAAe;AAAA,IACvD,KAAK,MAAM,OAAO;AAAA,IAClB,WAAW,KAAK,QAAQ,OAAO,OAAK,EAAE,IAAI,WAAW,aAAa,CAAC,GAAG;AAAA,MAClE,WAAW,CAAC;AAAA,MACZ,IAAI,CAAC,MAAM,OAAO,EAAE,KAAK,OAAK,EAAE,QAAQ,gBAAgB,EAAE,EAAE;AAAA,QACxD,KAAK,iBAAiB,GAAG;AAAA,IACjC;AAAA,IACA,MAAM,KAAK,0BAA0B;AAAA,IACrC,KAAK,QAAQ,MAAM,KAAK,KAAK,aAAY,EAAE,EAAE,SAAS,WAAW,CAAC;AAAA;AAAA,EAEtE,OAAO,GAAG;AAAA,IAAE,KAAK,WAAW;AAAA;AAAA,EACpB,IAAI,CAAC,GAAW;AAAA,IAAE,OAAO,IAAI,SAAS,KAAK,GAAG,EAAE,WAAW,YAAY,YAAY,OAAO,UAAU,EAAE,CAAC;AAAA;AAAA,OACzG,YAAW,GAAuC;AAAA,IAAE,QAAQ,MAAM,oBAAoB,KAAK,KAAK,GAAG,cAAc,UAAU;AAAA;AAAA,OAC3H,YAAW,GAAG;AAAA,IAAE,OAAO,MAAM,KAAK,YAAY,MAAM,WAAW,MAAM,MAAM,KAAK,QAAQ,CAAC,EAAE,KAAK,OAAK,CAAC,EAAE,QAAQ;AAAA;AAAA,OAChH,eAAc,GAAG;AAAA,IAAE,MAAM,KAAK,MAAM,YAAY;AAAA,MAAE,MAAM,IAAI,SAAS,MAAM,KAAK,QAAQ,CAAC;AAAA,MAAG,OAAO,EAAE,WAAW,CAAC,SAAS,GAAG,YAAY,KAAK,EAAE,OAAQ,cAAc,KAAK,EAAE,MAAO,YAAY,EAAE,CAAC,CAAC,GAAG,QAAQ,UAAU;AAAA,KAAI;AAAA;AAAA,OAC7N,UAAS,CAAC,OAAgB;AAAA,IAC5B,MAAM,IAAI,OAAO,KAAK;AAAA,IACtB,MAAM,GAAG,CAAC,YAAY,UAAU,CAAC;AAAA,IACjC,MAAM,OAAO,SAAS,EAAE,QAAQ,GAAG,IAAI,SAAS,EAAE,QAAQ;AAAA,IAC1D,IAAI,MAAM,KAAK,YAAY,MAAM;AAAA,MAC7B,KAAK,2BAA2B,GAAG;AAAA,IACvC,MAAM,QAAQ,MAAM,MAAM,KAAK,QAAQ,CAAC,EAAE,KAAK,OAAK,EAAE,aAAa,IAAI;AAAA,IACvE,IAAI,CAAC,OAAO;AAAA,MACR,KAAK,uBAAuB,GAAG;AAAA,IACnC,IAAI,MAAM,aAAa,QAAQ,MAAM,YAAY,CAAC,MAAM,IAAI,SAAS,OAAO,GAAG,MAAM,YAAY;AAAA,MAC7F,KAAK,uBAAuB,GAAG;AAAA,IACnC,MAAM,UAAU,MAAM,KAAK,kBAAkB,MAAM,EAAE,GAAG;AAAA,IACxD,IAAI,CAAC,UAAU,OAAO,OAAO,MAAM,MAAM,OAAO,eAAe,MAAM,cAAc,OAAO,aAAa,MAAM,YAAY,OAAO;AAAA,MAC5H,KAAK,uBAAuB,GAAG;AAAA;AAAA,EAE/B,MAAM,CAAC,SAA0B;AAAA,IAAE,QAAQ,KAAK,aAAa,iBAAiB,KAAK,KAAK,iBAAiB,OAAO,KAAK;AAAA;AAAA,OAC/G,QAAO,CAAC,MAAiC;AAAA,IACnD,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,MAC9B,MAAM,QAAQ,SAAS,MAAM,KAAK,QAAQ,CAAC,EAAE,MAAO;AAAA,MACpD,MAAM,WAAW,MAAM,MAAM,KAAK,QAAQ,GAAG,WAAW,cAAc,eAAe,GAAG,WAA4B,CAAC,GAAG,MAAM,MAAM,KAAK;AAAA,MACzI,WAAW,OAAO,MAAM;AAAA,QACpB,IAAI,OAAO,SAAS,KAAK,OAAK,CAAC,SAAS,SAAS,CAAC,KAAK,EAAE,OAAO,QAAQ,GAAG;AAAA,QAC3E,MAAM,SAAS,MAAM,SAAS,KAAK,MAAM,UAAU,SAAS,KAAK,MAAM,QAAQ;AAAA,QAC/E,IAAI,UAAU,KAAM,MAAO,SAAS;AAAA,UAChC,KAAK,iBAAiB,GAAG;AAAA,QAC7B,SAAS,SAAS,KAAK,OAAK,CAAC,SAAS,SAAS,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,MAAM,UAAU,SAAS,EAAE,MAAM,SAAS,IAAI;AAAA,QAClH,IAAI,CAAC;AAAA,UACD,KAAK,iBAAiB,GAAG;AAAA,QAC7B,SAAS,KAAK,IAAI;AAAA,MACtB;AAAA,MACA,OAAO,EAAE,WAAW,SAAS,IAAI,CAAC,MAAM,MAAM;AAAA,QAAE,MAAM,QAAQ,KAAK;AAAA,QAAO,OAAO,SAAS,MAAM,WAAW,EAAE,KAAK,KAAK,IAAK,OAAO,SAAS,MAAM,QAAQ,KAAK,MAAM,MAAM,UAAU,SAAS,MAAM,QAAQ,MAAM,MAAM,QAAQ,IAAI,GAAG,OAAO,SAAS,MAAM,QAAQ,KAAK,MAAM,MAAM,UAAU,SAAS,MAAM,QAAQ,MAAM,MAAM,QAAQ,MAAM,KAAK,OAAO,MAAM,CAAC;AAAA,OAAI,GAAG,QAAQ,MAAM;AAAA,KAC5X;AAAA;AAAA,OAEC,WAAU,CAAC,SAAqC;AAAA,IAClD,IAAI;AAAA,MACA,KAAK,MAAM;AAAA,MACX,IAAI,QAAQ,WAAW;AAAA,QACnB,KAAK,sBAAsB,GAAG;AAAA,MAClC,OAAO,SAAS,KAAK,KAAK,gBAAgB;AAAA,MAC1C,MAAM,IAAI,MAAM,KAAK,OAAO;AAAA,MAC5B,MAAM,GAAG,CAAC,aAAa,YAAY,YAAY,sBAAsB,CAAC;AAAA,MACtE,MAAM,KAAK,QAAQ,CAAC,YAAY,OAAO,KAAK,OAAO,OAAO,CAAC,CAAC,CAAC;AAAA,MAC7D,MAAM,QAAQ,OAAO,SAAgC;AAAA,QACjD,MAAM,UAAU,MAAM,KAAK,QAAQ,GAAG,QAAQ,YAAY,OAAO,GAAG,MAAM,MAAM,KAAK;AAAA,QACrF,IAAI,MAAM,MAAM,UAAU;AAAA,UACtB,KAAK,uBAAuB,GAAG;AAAA,QACnC,IAAI,CAAC,MAAM,MAAM,QAAQ,OAAO,MAAM,MAAM,KAAK,aAAa,OAAO,EAAE,cAAc,YAAY,CAAC,SAAS,OAAO,EAAE,SAAS,GAAG,MAAM,MAAM,KAAK,MAAM;AAAA,UACnJ,KAAK,sBAAsB,GAAG;AAAA,QAClC,OAAO,EAAE,OAAO,QAAQ;AAAA;AAAA,MAE5B,MAAM,UAAU,MAAM,KAAK,MAAM,OAAO,UAAU,EAAE,WAAW,CAAC,GAAG,QAAQ,MAAM,MAAM,IAAI,EAAE,EAAE;AAAA,MAC/F,MAAM,OAAO,SAAS,EAAE,QAAQ,GAAG,IAAI,SAAS,EAAE,QAAQ;AAAA,MAC1D,IAAI,EAAE,yBAAyB;AAAA,QAC3B,KAAK,uBAAuB;AAAA,MAChC,MAAM,eAAe,MAAM,KAAK,KAAK,CAAC;AAAA,MACtC,MAAM,KAAK,MAAM,OAAO,SAAS;AAAA,QAC7B,QAAQ,OAAO,YAAY,MAAM,MAAM,IAAI;AAAA,QAC3C,IAAI,MAAM,YAAY,QAAQ,MAAM;AAAA,UAChC,KAAK,sBAAsB,GAAG;AAAA,QAClC,MAAM,UAAgB,EAAE,IAAI,WAAW,GAAG,UAAU,MAAM,aAAa,MAAM,UAAU,OAAO,YAAY,EAAE;AAAA,QAC5G,OAAO,EAAE,WAAW,CAAC,SAAS,OAAO,SAAS,EAAE,OAAO,QAAQ,CAAU,GAAG,SAAS,SAAS,OAAO,GAAG,YAAY,cAAc,GAAG,SAAS,UAAU,OAAO,GAAG,aAAa,eAAe,GAAG,EAAE,KAAK,UAAU,QAAQ,IAAI,iBAAiB,GAAG,OAAO,OAAO,EAAE,QAAQ,uBAAuB,MAAM,QAAQ,CAAC,EAAE,GAAG,KAAK,mBAAmB,SAAS,QAAQ,IAAI,YAAY,GAAG,EAAE,KAAK,mBAAmB,iBAAiB,GAAG,OAAO,EAAE,QAAQ,uBAAuB,QAAQ,QAAQ,GAAG,EAAE,CAAC,GAAG,QAAQ,UAAU;AAAA,OACrf;AAAA,MACD,OAAO,KAAK,EAAE,aAAa,KAAK,CAAC;AAAA,MAErC,OAAO,GAAG;AAAA,MACN,OAAO,KAAK,CAAC;AAAA;AAAA;AAAA,EAGb,IAAI,CAAC,GAAyB,SAAkB,KAAa,SAA8D;AAAA,IAC/H,IAAI,QAAQ,UAAU,SAAS,OAAO,EAAE,MAAO;AAAA,MAC3C;AAAA,IACJ,IAAI,QAAQ,cAAc;AAAA,MACtB,MAAM,IAAI,YAAY,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,QAAQ,YAAY;AAAA,MACtE,IAAI,CAAC,GAAG,WAAW,EAAE,eAAe,QAAQ;AAAA,QACxC;AAAA,IACR;AAAA,IACA,MAAM,SAAS,QAAQ;AAAA,IACvB,IAAI,MAAM,QAAQ,WAAW,MAAM,QAAQ,WAAY,OAAO,qBAAqB,KAAK,MAAM,QAAQ,WAAW,OAAO,qBAAqB,SAAU,MAAM,QAAQ,WAAW,OAAO,yBAAyB;AAAA,MAC5M;AAAA,IACJ,OAAO,KAAK,EAAE,OAAO,QAAQ,mBAAmB,CAAC,EAAE,YAAY,EAAE,eAAe,QAAQ,aAAa,IAAI;AAAA;AAAA,OAE/F,YAAW,CAAC,GAA+C;AAAA,IACrE,KAAK,MAAM;AAAA,IACX,MAAM,MAAM,KAAK,aAAa,IAAI,CAAC;AAAA,IACnC,IAAI,KAAK;AAAA,MACL,MAAM,SAAS,MAAM,KAAK,MAAM,IAAI,GAAG,GAAG,QAAQ,UAAU,gBAAgB,SAAS,OAAO,OAAO,SAAS,CAAC;AAAA,MAC7G,IAAI,UAAU,OAAO,WAAW;AAAA,QAC5B,OAAO,EAAE,KAAK,SAAS,OAAO,SAAS,MAAM;AAAA,MACjD,KAAK,aAAa,OAAO,CAAC;AAAA,IAC9B;AAAA,IACA,MAAM,QAAQ,MAAM,MAAM,KAAK,QAAQ,GAAG,WAAW,cAAc,eAAe,EAAE,KAAK,OAAK,EAAE,OAAO,WAAW,CAAC;AAAA,IACnH,IAAI,OAAO;AAAA,MACP,IAAI,KAAK,aAAa,QAAQ;AAAA,QAC1B,KAAK,aAAa,MAAM;AAAA,MAC5B,KAAK,aAAa,IAAI,GAAG,MAAM,GAAG;AAAA,IACtC;AAAA,IACA,OAAO;AAAA;AAAA,EAEH,SAAS,CAAC,QAAuB,YAAY,GAAW;AAAA,IAAE,OAAO,KAAK,IAAI,GAAG,KAAK,IAAI,sBAAsB,KAAK,OAAO,OAAO,yBAAyB,QAAQ,aAAa,IAAI,CAAC,CAAC;AAAA;AAAA,OACrL,cAAa,CAAC,SAA+C;AAAA,IAC/D,KAAK,MAAM;AAAA,IACX,MAAM,QAAQ,YAAY,OAAO;AAAA,IACjC,IAAI,OAAO,cAAc;AAAA,MACrB;AAAA,IACJ,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,MAC9B,MAAM,OAAO,MAAM,KAAK,YAAY,OAAO,MAAM,KAAK,CAAC,GAAG,UAAU,MAAM,OAAO,KAAK,MAAM,KAAK,kBAAkB,SAAS,eAAe,GAAG,OAAO,UAAU,MAAM,KAAK,QAAQ,GAAG,MAAM,MAAM,KAAK;AAAA,MACtM,OAAO,EAAE,WAAW,CAAC,GAAG,QAAQ,WAAW,QAAQ,cAAc,YAAY,KAAK,KAAK,GAAG,SAAS,KAAK,OAAO,IAAI,OAAO,SAAS,MAAM,OAAO,KAAK,UAAU,QAAQ,QAAQ,MAAM,QAAQ,OAAO,GAAG,KAAK,KAAK,gBAAgB,IAAI,UAAU;AAAA,KAClP;AAAA;AAAA,OAEC,aAAY,CAAC,SAAqD;AAAA,IACpE,KAAK,MAAM;AAAA,IACX,MAAM,IAAI,YAAY,OAAO;AAAA,IAC7B,IAAI,CAAC;AAAA,MACD,OAAO;AAAA,IACX,MAAM,IAAI,OAAO,EAAE,KAAK;AAAA,IAGxB,MAAM,WAAW,MAAM,KAAK,MAAM,OAAO,SAAS;AAAA,MAC9C,MAAM,OAAO,MAAM,KAAK,YAAY,CAAC,GAAG,UAAU,MAAM,OAAO,KAAK,MAAM,KAAK,kBAAkB,SAAS,eAAe,GAAG,OAAO,UAAU,MAAM,KAAK,QAAQ,GAAG,MAAM,MAAM,KAAK;AAAA,MACpL,MAAM,gBAAgB,WAAW,QAAQ,cAAc,EAAE,aAAa,KAAK,KAAK,GAAG,SAAS,KAAK,OAAO;AAAA,MACxG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;AAAA,QACtB,OAAO,EAAE,WAAW,CAAC,GAAG,QAAQ,MAAM;AAAA,MAC1C,OAAO,EAAE,WAAW,QAAQ,iBAAiB,YAAY,CAAC,SAAS,MAAM,WAAW,KAAK,SAAS,cAAc,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,QAAQ,KAAK;AAAA,KAC9I,EAAE,MAAM,OAAO,UAAU;AAAA,MAItB,IAAI;AAAA,QACA,MAAM,aAAa,KAAK,OAAO,KAAK,GAAG;AAAA,QAE3C,MAAM;AAAA,MACN,MAAM;AAAA,KACT;AAAA,IACD,IAAI,CAAC;AAAA,MACD,OAAO;AAAA,IACX,MAAM,gBAAgB,MAAM,KAAK,MAAM,OAAO,SAAS;AAAA,MACnD,MAAM,OAAO,MAAM,KAAK,YAAY,CAAC,GAAG,UAAU,MAAM,OAAO,KAAK,MAAM,KAAK,kBAAkB,SAAS,eAAe,GAAG,OAAO,UAAU,MAAM,KAAK,QAAQ,GAAG,MAAM,MAAM,KAAK;AAAA,MACpL,MAAM,gBAAgB,WAAW,QAAQ,cAAc,EAAE,aAAa,KAAK,KAAK,GAAG,SAAS,KAAK,OAAO;AAAA,MACxG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;AAAA,QACtB,OAAO,EAAE,WAAW,CAAC,GAAG,QAAQ,KAAK;AAAA,MAIzC,QAAQ,iBAAiB,cAAc;AAAA,MAGvC,OAAO,EAAE,WAAW,iBAAiB,YAAY,CAAC,IAAI,CAAC,SAAS,MAAM,WAAW,KAAK,WAAW,SAAS,IAAI,CAAC,CAAC,GAAG,QAAQ,cAAc;AAAA,KAC5I;AAAA,IACD,IAAI,CAAC;AAAA,MACD,OAAO;AAAA,IACX,MAAM,UAAU,OAAO,OAAO,EAAE,IAAI,cAAc,IAAI,UAAU,UAAU,cAAc,OAAO,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,wBAAwB,cAAc,UAAU,CAAC;AAAA,IAClK,KAAK,SAAS,IAAI,SAAS,EAAE,YAAY,cAAc,YAAY,QAAQ,EAAE,CAAC;AAAA,IAC9E,OAAO,MAAM,KAAK,UAAU,SAAS,aAAa,IAAI,UAAU;AAAA;AAAA,OAE9D,UAAS,CAAC,SAA4B,aAAuC;AAAA,IAC/E,KAAK,MAAM;AAAA,IACX,MAAM,SAAS,KAAK,SAAS,IAAI,OAAO;AAAA,IACxC,IAAI,CAAC,UAAU,QAAQ,aAAa;AAAA,MAChC,OAAO;AAAA,IACX,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,MAC9B,MAAM,OAAO,MAAM,KAAK,YAAY,OAAO,MAAM,GAAG,UAAU,MAAM,OAAO,WAAW,MAAM,KAAK,kBAAkB,SAAS,eAAe,GAAG,OAAO,UAAU,MAAM,KAAK,QAAQ,GAAG,MAAM,MAAM,KAAK,GAAG,IAAI,WAAW,KAAK,KAAK,SAAS,SAAS,KAAK,OAAO;AAAA,MAChQ,OAAO,EAAE,WAAW,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,EAAE,OAAO,QAAQ,MAAM,EAAE,eAAe,OAAO,WAAW;AAAA,KACpG;AAAA;AAAA,OAES,kBAAiB,CAAC,GAA6B,YAAoB,QAAQ,OAAO;AAAA,IAAE,IAAI,CAAC,EAAE,WAAW,CAAC,YAAY,EAAE,OAAO,KAAK,KAAK,SAAS,IAAI,EAAE,OAAO,GAAG,WAAW,OAAO,YAAY,EAAE,OAAO,EAAG,KAAK,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,SAAS,UAAU;AAAA,MACxQ,KAAK,aAAa,GAAG;AAAA,IAAG,IAAI;AAAA,MAC5B,KAAK,WAAW,EAAE,OAAO;AAAA;AAAA,EAC7B,aAAa,CAAC,SAAkB;AAAA,IAAE,KAAK,WAAW,OAAO;AAAA;AAAA,EACzD,SAAS,CAAC,SAAsC;AAAA,IAAE,MAAM,IAAI,YAAY,OAAO;AAAA,IAAG,OAAO,GAAG,cAAc,WAAW,KAAK,EAAE,KAAK,IAAI;AAAA;AAAA,EAC7H,UAAU,CAAC,SAAkB;AAAA,IAAE,MAAM,IAAI,YAAY,OAAO;AAAA,IAAG,IAAI,CAAC;AAAA,MACxE,KAAK,gBAAgB,GAAG;AAAA,IAAG,IAAI,EAAE,cAAc,UAAU;AAAA,MACzD,OAAO,SAAS,KAAK,KAAK,gBAAgB;AAAA,MAC1C,IAAI,CAAC,SAAS,QAAQ,QAAQ,IAAI,cAAc,KAAK,IAAI,KAAK,EAAE,KAAK,CAAC;AAAA,QAClE,KAAK,gBAAgB,GAAG;AAAA,IAChC;AAAA;AAAA,OACM,MAAK,CAAC,SAAqC;AAAA,IAC7C,IAAI;AAAA,MACA,KAAK,MAAM;AAAA,MACX,IAAI,QAAQ,WAAW;AAAA,QACnB,KAAK,sBAAsB,GAAG;AAAA,MAClC,MAAM,IAAI,MAAM,KAAK,OAAO;AAAA,MAC5B,MAAM,GAAG,CAAC,YAAY,YAAY,aAAa,gBAAgB,CAAC;AAAA,MAChE,MAAM,OAAO,SAAS,EAAE,QAAQ,GAAG,IAAI,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW;AAAA,MACrF,MAAM,YAAY,EAAE,aAAa;AAAA,MACjC,IAAI,cAAc,YAAY,cAAc;AAAA,QACxC,KAAK,eAAe;AAAA,MACxB,IAAI,cAAc,YAAY,QAAQ,QAAQ,IAAI,QAAQ;AAAA,QACtD,OAAO,SAAS,KAAK,KAAK,gBAAgB;AAAA,MAC9C,MAAM,OAAO,CAAC,aAAa,OAAO,IAAI,GAAG,YAAY,OAAO,KAAK,OAAO,OAAO,CAAC,CAAC;AAAA,MACjF,MAAM,cAAc,MAAM,KAAK,QAAQ,IAAI;AAAA,MAC3C,IAAI,MAAM,KAAK,YAAY,MAAM;AAAA,QAC7B,KAAK,uBAAuB,GAAG;AAAA,MACnC,MAAM,OAAO,UAAU,MAAM,KAAK,QAAQ,CAAC;AAAA,MAC3C,MAAM,KAAK,gBAAgB,EAAE,gBAAgB,KAAK,OAAQ,OAAO;AAAA,MACjE,MAAM,gBAAgB,MAAM,MAAM,KAAK,QAAQ,CAAC,EAAE,KAAK,OAAK,EAAE,aAAa,IAAI;AAAA,MAC/E,MAAM,QAAQ,MAAM,IAAI,SAAS,OAAO,GAAG,eAAe,gBAAgB,KAAK,SAAS,MAAM,KAAK,KAAK,wBAAwB,CAAC;AAAA,MACjI,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,cAAc,gBAAgB,cAAc;AAAA,QACzE,KAAK,uBAAuB,GAAG;AAAA,MACnC,MAAM,QAAQ,aAAY,EAAE,EAAE,SAAS,WAAW;AAAA,MAClD,IAAI,SAAwB,KAAK,uBAAuB;AAAA,MACxD,MAAM,UAAU,MAAM,KAAK,MAAM,OAAO,SAAS;AAAA,QAC7C,MAAM,KAAK,MAAM,KAAK,kBAAkB,cAAc,EAAE,GAAG;AAAA,QAC3D,IAAI,CAAC,KAAK,EAAE,OAAO,cAAc,MAAM,EAAE,aAAa,cAAc,YAAY,EAAE,YAAY,EAAE,eAAe,cAAc;AAAA,UACzH,KAAK,uBAAuB,GAAG;AAAA,QACnC,MAAM,UAAU,MAAM,KAAK,QAAQ;AAAA,QACnC,UAAU,MAAM,KAAK,kBAAkB,GAAG;AAAA,QAC1C,IAAI,SAAS,OAAO,EAAE,MAAO,iBAAiB,eAAe,UAAU,OAAO,EAAE,YAAY,KAAK;AAAA,UAC7F,KAAK,oBAAoB,GAAG;AAAA,QAChC,MAAM,MAAM,MAAM,KAAK,GAAG,WAAW,MAAM,SAAS,WAAW,cAAc,eAAe,GAAG,OAAO,SAAS,KAAK,OAAK,CAAC,EAAE,SAAS,CAAC,KAAK,KAAK,MAAM,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,EAAE,MAAO,eAAe,KAAK,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;AAAA,QAC3O,IAAI,CAAC;AAAA,UACD,KAAK,iBAAiB,GAAG;AAAA,QAC7B,MAAM,UAAU,CAAC,SAAS,MAAM,WAAW,EAAE,QAAQ,OAAO,KAAK,GAAG,iBAAiB,EAAE,IAAI,YAAY,EAAE,YAAY,SAAS,KAAK,SAAS,KAAK,WAAW,QAAQ,OAAO,SAAS,OAAO,EAAE,MAAO,aAAa,CAAC,GAAG,KAAK,MAAM,SAAS,EAAE,IAAI,eAAe,GAAG,CAAC;AAAA,QAClQ,MAAM,WAAW,MAAM,SAAS,WAAW,cAAc,eAAe;AAAA,QACxE,MAAM,UAAU,SAAS,KAAK,OAAK,EAAE,OAAO,QAAQ,KAAK,MAAM,EAAE,MAAM,UAAU,WAAW;AAAA,QAC5F,IAAI;AAAA,UACA,QAAQ,KAAK,SAAS,SAAS,WAAW,IAAI,CAAC;AAAA,QACnD,MAAM,SAAS,SAAS,KAAK,OAAK,EAAE,OAAO,QAAQ,KAAK,MAAM,EAAE,MAAM,UAAU,WAAW;AAAA,QAC3F,IAAI;AAAA,UACA,QAAQ,KAAK,SAAS,QAAQ,WAAW,KAAK,OAAO,OAAQ,OAAO,KAAK,IAAI,GAAG,OAAO,MAAO,QAAQ,CAAC,EAAE,CAAC,CAAC;AAAA,QAC/G,OAAO,EAAE,WAAW,SAAS,QAAQ,IAAI;AAAA,OAC5C;AAAA,MACD,MAAM,UAAU,MAAM,KAAK,kBAAkB,cAAc,EAAE,GAAG;AAAA,MAChE,IAAI,CAAC,UAAU,OAAO,YAAY,OAAO,eAAe,cAAc,cAAc,OAAO,OAAO,cAAc;AAAA,QAC5G,KAAK,uBAAuB,GAAG;AAAA,MACnC,OAAO,cAAc,WAAW,KAAK,EAAE,eAAe,IAAI,aAAa,GAAG,WAAW,KAAK,KAAK,EAAE,GAAG,KAAK,EAAE,cAAc,OAAO,SAAS,OAAO,KAAK,UAAU,SAAS,MAAM,aAAa,KAAK,OAAO,KAAK,GAAG,GAAG,QAAQ,OAAO,GAAG,KAAK,KAAK,gBAAgB,EAAE,CAAC,IAAI,KAAK,EAAE,eAAe,IAAI,aAAa,GAAG,OAAO,WAAW,OAAO,yBAAyB,GAAG,CAAC;AAAA,MAEzW,OAAO,GAAG;AAAA,MACN,MAAM,KAAK,cAAc,eAAc,CAAC;AAAA,MACxC,OAAO,KAAK,CAAC;AAAA;AAAA;AAAA,OAGf,OAAM,CAAC,SAAqC;AAAA,IAC9C,IAAI;AAAA,MACA,KAAK,MAAM;AAAA,MACX,IAAI,QAAQ,WAAW;AAAA,QACnB,KAAK,sBAAsB,GAAG;AAAA,MAClC,KAAK,WAAW,OAAO;AAAA,MACvB,MAAM,IAAI,YAAY,OAAO;AAAA,MAC7B,MAAM,KAAK,MAAM,YAAY;AAAA,QAAE,MAAM,OAAO,MAAM,KAAK,YAAY,OAAO,EAAE,KAAK,CAAC;AAAA,QAAG,OAAO,EAAE,WAAW,MAAM,QAAQ,CAAC,SAAS,MAAM,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,UAAU;AAAA,OAAI;AAAA,MACrL,OAAO,KAAK,EAAE,IAAI,KAAK,GAAG,KAAK,EAAE,cAAc,OAAO,SAAS,IAAI,GAAG,KAAK,KAAK,gBAAgB,EAAE,CAAC;AAAA,MAEvG,OAAO,GAAG;AAAA,MACN,OAAO,KAAK,CAAC;AAAA;AAAA;AAAA,OAGP,eAAc,CAAC,GAA6B,GAA4B;AAAA,IAClF,MAAM,IAAI,SAAS,EAAE,QAAQ;AAAA,IAC7B,IAAI,EAAE,yBAAyB;AAAA,MAC3B,KAAK,uBAAuB;AAAA,IAChC,MAAM,KAAK,EAAE,QAAS,IAAI,KAAK,MAAM,KAAK,kBAAkB,EAAE,GAAG;AAAA,IACjE,IAAI,CAAC,KAAK,CAAC,EAAE,gBAAgB,EAAE,OAAO,MAAM,OAAO,EAAE,oBAAoB,YAAY,CAAC,MAAM,IAAI,SAAS,OAAO,EAAE,iBAAiB,EAAE,YAAY;AAAA,MAC7I,KAAK,uBAAuB,GAAG;AAAA,IACnC,IAAI,SAAS,GAAG,EAAE,eAAe;AAAA,MAC7B,KAAK,oBAAoB;AAAA,IAC7B,MAAM,SAAS,MAAM,KAAK,KAAK,CAAC;AAAA,IAChC,MAAM,KAAK,MAAM,OAAO,SAAS;AAAA,MAC7B,KAAK,WAAW,EAAE,OAAO;AAAA,MACzB,MAAM,IAAI,MAAM,KAAK,kBAAkB,EAAE,GAAG,UAAU,EAAE,OAAO,UAAU,MAAM,KAAK,QAAQ;AAAA,MAC5F,IAAI,CAAC,WAAW,QAAQ,OAAO,MAAM,QAAQ,YAAY,QAAQ,eAAe,EAAE;AAAA,QAC9E,KAAK,oBAAoB,GAAG;AAAA,MAChC,MAAM,SAAS,KAAK,SAAS,IAAI,EAAE,OAAQ,GAAI,OAAO,MAAM,KAAK,YAAY,OAAO,MAAM,GAAG,MAAM,MAAM,KAAK;AAAA,MAC9G,IAAI,CAAC,MAAM,SAAS,CAAC,KAAK,KAAK,SAAS,KAAK,OAAO,KAAK,OAAO;AAAA,QAC5D,KAAK,aAAa,GAAG;AAAA,MACzB,OAAO,EAAE,WAAW,CAAC,KAAK,aAAa,GAAG,KAAK,SAAS,YAAY,KAAK,QAAQ,UAAU,EAAE,CAAC,GAAG,KAAK,mBAAmB,SAAS,IAAI,MAAM,GAAG,SAAS,MAAM,WAAW,IAAI,GAAG,KAAK,MAAM,SAAS,IAAI,wBAAwB,GAAG,CAAC,GAAG,QAAQ,UAAU;AAAA,KAC5P;AAAA;AAAA,OAES,MAAK,CAAC,GAA6B,MAG9C;AAAA,IACC,KAAK,mBAAmB,EAAE,OAAO;AAAA,IACjC,MAAM,SAAS,EAAE,WAAW,KAAK,SAAS,IAAI,EAAE,OAAO,GAAG,QAAQ,YAAY,EAAE,OAAO;AAAA,IACvF,IAAI,CAAC,UAAU,CAAC,SAAS,OAAO,WAAW,OAAO,MAAM,KAAK;AAAA,MACzD,KAAK,aAAa,GAAG;AAAA,IACzB,MAAM,OAAO,MAAM,KAAK,YAAY,OAAO,MAAM,GAAG,UAAU,MAAM,KAAK,QAAQ,GAAG,OAAO,MAAM,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,EAAE,QAAS,EAAE,GAAG,MAAM,MAAM,KAAK;AAAA,IAC9J,IAAI,CAAC,MAAM,SAAS,KAAK,MAAM,cAAc,MAAM,aAAa,CAAC,QAAQ,KAAK,eAAe,OAAO,cAAc,CAAC,KAAK,KAAK,MAAM,KAAK,OAAO,KAAK,OAAO;AAAA,MACvJ,KAAK,aAAa,GAAG;AAAA,IACzB,OAAO,EAAE,MAAM,QAAQ;AAAA;AAAA,EAEnB,kBAAkB,CAAC,SAAkB;AAAA,IAAE,IAAI,CAAC,CAAC,OAAO,MAAM,EAAE,SAAS,QAAQ,MAAM;AAAA,MACvF,KAAK,WAAW,OAAO;AAAA;AAAA,EACnB,KAAK,CAAC,SAAmC,OAAe,QAAgB,IAAW,SAAO,WAA4B;AAAA,IAC1H,MAAM,gBAAgB,MAAM,KAAK,EAAE,QAAQ,UAAU,GAAG,CAAC,GAAG,MAAM,QAAQ,KAAK,OAAK,EAAE,QAAQ,WAAW,CAAC,CAAC;AAAA,IAC3G,MAAM,QAAQ,cAAc,UAAU,OAAK,CAAC,CAAC;AAAA,IAC7C,MAAM,OAAO,SAAS,IAAI,QAAQ,cAAc,OAAO,CAAC,MAAM,GAAG,MAAQ,SAAS,EAAG,OAAO,OAAO,EAEhG,KAAM,SAAS,cAAc,MAAO,OAAO,OAAO,EAElD,KAAK,IAAI,MAAO,CAAC;AAAA,IACpB,OAAO,EAAE,KAAK,WAAW,MAAM,iBAAiB,cAAc,OAAO,WAAW,GAAG,OAAO,OAAO,EAAE,QAAQ,uBAAuB,OAAO,EAAE,OAAO,QAAQ,QAAQ,GAAG,EAAE,CAAC,EAAE;AAAA;AAAA,OAEhK,cAAa,CAAC,QAAc,OAAc;AAAA,IAAC,IAAG;AAAA,MAAC,MAAM,KAAK,MAAM,OAAM,SAAM;AAAA,QAAC,MAAM,UAAQ,MAAM,KAAK,QAAQ,GAAE,KAAG,MAAM,KAAK;AAAA,QAAE,OAAO,EAAC,WAAU,CAAC,KAAK,MAAM,SAAQ,aAAY,QAAO,IAAG,iBAAiB,eAAa,MAAM,OAAK,sBAAsB,CAAC,GAAE,QAAO,UAAS;AAAA,OAAG;AAAA,MAAG,MAAK;AAAA;AAAA,EAC/R,UAAU,CAAC,QAAwH;AAAA,IACvI,MAAM,QAAQ,CAAC,MAAc,SAAmB,SAAiB,QAA4D,EAAE,MAAM,SAAS,SAAS,QAAQ,OAAO,EAAE,EAAE;AAAA,IAC1K,OAAO;AAAA,MACH,MAAM,UAAU,CAAC,OAAO,MAAM,GAAG,SAAS,OAAO,MAAM;AAAA,QACnD,MAAM,KAAK,kBAAkB,GAAG,gBAAgB,EAAE,QAAQ,WAAW,MAAM;AAAA,QAC3E,IAAI,EAAE,QAAQ,WAAW;AAAA,UACrB,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,YAAE,QAAQ,YAAY,MAAM,KAAK,MAAM,GAAG,IAAI;AAAA,YAAG,OAAO,EAAE,WAAW,CAAC,GAAG,QAAQ,KAAK,EAAE,OAAO,MAAM,OAAO,EAAE,IAAI,GAAG,EAAE,CAAC,EAAE;AAAA,WAAI;AAAA,QACpK,MAAM,IAAI,MAAM,KAAK,EAAE,OAAO;AAAA,QAC9B,MAAM,GAAG,CAAC,YAAY,eAAe,YAAY,sBAAsB,CAAC;AAAA,QACxE,MAAM,OAAO,SAAS,EAAE,QAAQ,GAAG,cAAc,KAAK,YAAY,EAAE,eAAe,IAAI;AAAA,QACvF,MAAM,OAAO,EAAE,aAAa,YAAY,KAAK,MAAM,KAAK,KAAK,KAAK,gBAAgB,CAAC,CAAC,GAAG,KAAK,WAAW;AAAA,QACvG,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,UAC9B,QAAQ,SAAS,SAAS,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,MAAM,MAAM,OAAO;AAAA,UACxE,IAAI,IAAI,UAAU;AAAA,YACd,KAAK,cAAc,GAAG;AAAA,UAC1B,IAAI,IAAI,KAAK,OAAK,EAAE,aAAa,IAAI;AAAA,YACjC,KAAK,mBAAmB,GAAG;AAAA,UAC/B,MAAM,IAAmB,EAAE,IAAI,UAAU,MAAM,aAAa,UAAU,OAAO,YAAY,GAAG,cAAc,MAAM,WAAW,MAAM;AAAA,UACjI,OAAO,EAAE,WAAW,CAAC,KAAK,aAAa,EAAE,KAAK,UAAU,IAAI,SAAS,GAAG,OAAO,KAAK,GAAG,CAAC,GAAG,GAAI,OAAO,CAAC,KAAK,mBAAmB,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,GAAI,KAAK,MAAM,SAAS,KAAK,IAAI,eAAe,MAAM,KAAK,CAAC,CAAC,GAAG,QAAQ,KAAK,EAAE,MAAM,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE;AAAA,SAC7P;AAAA,OACJ;AAAA,MACD,MAAM,iBAAiB,CAAC,KAAK,GAAG,cAAc,OAAO,MAAM;AAAA,QACvD,MAAM,KAAK,kBAAkB,GAAG,gBAAgB,IAAI;AAAA,QACpD,MAAM,IAAI,MAAM,KAAK,EAAE,OAAO;AAAA,QAC9B,MAAM,GAAG,CAAC,MAAM,YAAY,eAAe,UAAU,CAAC;AAAA,QACtD,MAAM,KAAK,KAAK,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,SAAS,EAAE,QAAQ,GAAG,cAAc,KAAK,YAAY,EAAE,WAAW;AAAA,QACzG,IAAI,OAAO,EAAE,aAAa;AAAA,UACtB,KAAK,eAAe;AAAA,QACxB,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,UAC9B,QAAQ,SAAS,SAAS,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,MAAM,MAAM,OAAO,GAAG,IAAI,IAAI,KAAK,OAAK,EAAE,OAAO,EAAE;AAAA,UACxG,IAAI,CAAC;AAAA,YACD,KAAK,aAAa,GAAG;AAAA,UACzB,IAAI,IAAI,KAAK,OAAK,EAAE,OAAO,MAAM,EAAE,aAAa,IAAI;AAAA,YAChD,KAAK,mBAAmB,GAAG;AAAA,UAC/B,IAAI,EAAE,YAAY,CAAC,EAAE,YAAY,EAAE,gBAAgB,CAAC,IAAI,KAAK,OAAK,EAAE,OAAO,MAAM,CAAC,EAAE,YAAY,EAAE,YAAY;AAAA,YAC1G,KAAK,mBAAmB,GAAG;AAAA,UAC/B,MAAM,UAAU,KAAK,GAAG,UAAU,MAAM,aAAa,UAAU,EAAE,UAAqB,YAAY,EAAE,aAAa,EAAE,WAAW,KAAK,EAAE,UAAU,IAAI,EAAE,WAAW;AAAA,UAChK,MAAM,IAAI,QAAQ,KAAK,OAAK,EAAE,QAAQ,UAAU,EAAE;AAAA,UAClD,OAAO,EAAE,WAAW,CAAC,KAAK,aAAa,EAAE,KAAK,EAAE,KAAK,SAAS,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,GAAG,KAAK,MAAM,SAAS,KAAK,IAAI,eAAe,MAAM,KAAK,CAAC,CAAC,GAAG,QAAQ,KAAK,EAAE,MAAM,IAAI,OAAO,EAAE,CAAC,EAAE;AAAA,SACnM;AAAA,OACJ;AAAA,MACD,MAAM,mBAAmB,CAAC,MAAM,GAAG,qBAAqB,OAAO,MAAM;AAAA,QACjE,MAAM,KAAK,kBAAkB,GAAG,gBAAgB,IAAI;AAAA,QACpD,MAAM,IAAI,MAAM,KAAK,EAAE,OAAO;AAAA,QAC9B,MAAM,GAAG,CAAC,MAAM,YAAY,sBAAsB,CAAC;AAAA,QACnD,MAAM,KAAK,KAAK,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,MAAM,KAAK,KAAK,KAAK,gBAAgB,CAAC,CAAC;AAAA,QAC9E,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,UAC9B,QAAQ,SAAS,SAAS,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,IAAI,MAAM,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,EAAE;AAAA,UAC7F,IAAI,CAAC;AAAA,YACD,KAAK,aAAa,GAAG;AAAA,UACzB,MAAM,IAAI,QAAQ,KAAK,OAAK,EAAE,QAAQ,UAAU,EAAE;AAAA,UAClD,OAAO,EAAE,WAAW,CAAC,KAAK,aAAa,EAAE,KAAK,EAAE,KAAK,SAAS,EAAE,SAAS,OAAO,EAAE,GAAG,KAAK,GAAG,YAAY,KAAK,EAAE,UAAU,EAAE,CAAC,GAAG,KAAK,mBAAmB,SAAS,IAAI,IAAI,GAAG,KAAK,MAAM,SAAS,KAAK,IAAI,uBAAuB,MAAM,KAAK,CAAC,CAAC,GAAG,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC,EAAE;AAAA,SAC9Q;AAAA,OACJ;AAAA,MACD,MAAM,eAAe,CAAC,OAAO,QAAQ,QAAQ,GAAG,cAAc,OAAO,MAAM;AAAA,QACvE,MAAM,KAAK,kBAAkB,GAAG,gBAAgB,EAAE,QAAQ,WAAW,KAAK;AAAA,QAC1E,MAAM,IAAI,EAAE,QAAQ,WAAW,QAAQ,CAAC,IAAI,MAAM,KAAK,EAAE,OAAO;AAAA,QAChE,MAAM,GAAG,EAAE,QAAQ,WAAW,SAAS,CAAC,UAAU,gBAAgB,SAAS,IAAI,CAAC,IAAI,CAAC;AAAA,QACrF,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,UAC9B,QAAQ,SAAS,SAAS,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,MAAM,WAAW,OAAO;AAAA,UAC7E,IAAI,EAAE,QAAQ,WAAW,OAAO;AAAA,YAC5B,MAAM,KAAK,IAAI,IAAI,EAAE,QAAQ,GAAG,EAAE,aAAa,IAAI,QAAQ;AAAA,YAC3D,OAAO,EAAE,WAAW,CAAC,GAAG,QAAQ,KAAK,EAAE,YAAY,IAAI,OAAO,OAAK,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,CAAC,EAAE;AAAA,UAClG;AAAA,UACA,IAAI;AAAA,UACJ,IAAI,EAAE,QAAQ,WAAW,QAAQ;AAAA,YAC7B,MAAM,aAAa,YAAY,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,EAAE,YAAY;AAAA,YACzE,IAAI,CAAC;AAAA,cACD,KAAK,aAAa,GAAG;AAAA,YACzB,MAAM,KAAK,WAAW;AAAA,YACtB,IAAI,WAAW,aAAa,eAAe,CAAC,UAAU,eAAe,EAAE,SAAS,GAAG,WAAW;AAAA,cAAG,KAAK,4BAA4B;AAAA,YAClI,MAAM,iBAAiB,WAAW,aAAa,eAAe,GAAG,gBAAgB,cAAc,gFAAgF,WAAW;AAAA,YAC1L,MAAM,MAAM,KAAK,KAAK,EAAE,SAAS,GAAG,GAAG,KAAK,OAAO,iBAAiB,SAAO,GAAG;AAAA,YAC9E,IAAI,WAAW,aAAa,aAAa,CAAC,gBAAgB,KAAK,GAAG,KAAK,CAAC,OAAO,cAAc,OAAO,GAAG,CAAC;AAAA,cAAI,KAAK,wBAAwB;AAAA,YACzI,IAAI,IAAI,KAAK,OAAK,EAAE,OAAO,EAAE;AAAA,cACzB,KAAK,mBAAmB,GAAG;AAAA,YAC/B,IAAI,IAAI,UAAU;AAAA,cACd,KAAK,kBAAkB,GAAG;AAAA,YAC9B,WAAW,EAAE,IAAI,QAAQ,KAAK,KAAK,EAAE,QAAQ,EAAE,GAAG,cAAc,WAAW,IAAI,QAAQ,gBAAgB,SAAS,KAAK,UAAU,WAAW,aAAa,WAAW,WAAW,OAAO;AAAA,UACxL,EACK;AAAA,YACD,MAAM,QAAQ,IAAI,KAAK,OAAK,EAAE,OAAO,EAAE,EAAE;AAAA,YACzC,IAAI,CAAC;AAAA,cACD,KAAK,aAAa,GAAG;AAAA,YACzB,WAAW;AAAA;AAAA,UAEf,MAAM,SAAS,MAAM,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,SAAS,MAAM;AAAA,UAChE,IAAI,CAAC;AAAA,YACD,KAAK,aAAa,GAAG;AAAA,UACzB,MAAM,IAAI,QAAQ,KAAK,OAAK,EAAE,QAAQ,UAAU,OAAO,EAAE,GAAI,QAAQ,MAAM,SAAS,cAAc,SAAS,IAAI,YAAY,IAAI;AAAA,UAC/H,OAAO,EAAE,WAAW,CAAC,SAAS,OAAO,YAAY,EAAE,QAAQ,WAAW,SAAS,WAAW,IAAI,GAAG,KAAK,aAAa,EAAE,KAAK,EAAE,KAAK,SAAS,EAAE,SAAS,OAAO,OAAO,GAAG,KAAK,QAAQ,YAAY,KAAK,OAAO,UAAU,EAAE,CAAC,GAAG,KAAK,MAAM,SAAS,KAAK,IAAI,EAAE,QAAQ,WAAW,SAAS,kBAAkB,mBAAmB,MAAM,KAAK,CAAC,CAAC,GAAG,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC,EAAE;AAAA,SACzW;AAAA,OACJ;AAAA,MACD,MAAM,sBAAsB,CAAC,OAAO,QAAQ,OAAO,QAAQ,GAAG,oBAAoB,OAAO,MAAM;AAAA,QAC3F,MAAM,KAAK,kBAAkB,GAAG,gBAAgB,EAAE,QAAQ,WAAW,KAAK;AAAA,QAC1E,IAAI,EAAE,QAAQ,WAAW;AAAA,UACrB,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,YAAE,QAAQ,YAAY,MAAM,KAAK,MAAM,GAAG,IAAI;AAAA,YAAG,OAAO,EAAE,WAAW,CAAC,GAAG,QAAQ,KAAK,EAAE,cAAc,KAAK,KAAK,mBAAmB,KAAK,aAAa,IAAI,MAAM,aAAa,gBAAgB,OAAO,EAAE,QAAQ,UAAQ,KAAK,SAAS,CAAC,KAAK,MAAM,WAAW,CAAC,KAAK,KAAK,cAAc,KAAK,KAAK,GAAG,SAAS,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,EAAE;AAAA,WAAI;AAAA,QAC5W,MAAM,IAAI,MAAM,KAAK,EAAE,OAAO;AAAA,QAC9B,IAAI,EAAE,QAAQ,WAAW,UAAU;AAAA,UAC/B,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC;AAAA,UAC1B,MAAM,KAAK,KAAK,KAAK,EAAE,IAAI,EAAE;AAAA,UAC7B,IAAI,CAAC,OAAO,cAAc,EAAE,OAAO,KAAM,EAAE,UAAqB;AAAA,YAAG,KAAK,eAAe;AAAA,UACvF,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,YAC9B,QAAQ,SAAS,SAAS,MAAM,KAAK,MAAM,GAAG,IAAI;AAAA,YAClD,MAAM,OAAO,gBAAgB,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,OAAO,MAAM,CAAC,EAAE,MAAM,QAAQ;AAAA,YACvF,IAAI,CAAC,QAAQ,KAAK,YAAY,EAAE;AAAA,cAAS,KAAK,oBAAoB,GAAG;AAAA,YACrE,MAAM,cAAc,IAAI,IAAI,WAAW,OAAO,EAAE,OAAO,OAAK,EAAE,iBAAiB,EAAE,EAAE,IAAI,OAAK,EAAE,MAAM,CAAC;AAAA,YACrG,MAAM,WAAW,MAAM,OAAO,EAAE,OAAO,OAAK,YAAY,IAAI,EAAE,EAAE,CAAC;AAAA,YACjE,MAAM,SAAS,KAAK,SAAS,IAAI,EAAE,OAAQ,GAAI,UAAU,MAAM,KAAK,YAAY,OAAO,MAAM;AAAA,YAC7F,OAAO;AAAA,cACH,WAAW;AAAA,gBACP,SAAS,MAAM,cAAc,KAAK,KAAK,OAAQ,SAAS,OAAO,UAAU,EAAE,YAAY,CAAC,GAAG,IAAI,IAAI,CAAC,KAAK,MAAO,WAAW,GAAG,KAAK,MAAM,OAAO,EAAE,OAAO,OAAK,EAAE,OAAO,iBAAiB,EAAE,EAAE,IAAI,OAAK,EAAE,MAAO,WAAW,CAAC,CAAC,CAAC,EAAE,OAAO,OAAO,EAAE,EAAE,CAAC;AAAA,gBACjP,GAAG,SAAS,IAAI,OAAK;AAAA,kBACjB,MAAM,IAAI,QAAQ,KAAK,OAAK,EAAE,QAAQ,UAAU,EAAE,EAAE;AAAA,kBACpD,OAAO,KAAK,aAAa,EAAE,KAAK,EAAE,KAAK,SAAS,EAAE,SAAS,OAAO,EAAE,GAAG,KAAK,GAAG,YAAY,KAAK,EAAE,UAAU,EAAE,CAAC;AAAA,iBAClH;AAAA,gBACD,KAAK,MAAM,SAAS,KAAK,IAAI,gBAAgB,MAAM,KAAK,CAAC;AAAA,cAC7D;AAAA,cACA,QAAQ,KAAK,EAAE,IAAI,MAAM,gBAAgB,YAAY,IAAI,KAAK,EAAE,KAAK,SAAS,OAAO,iBAAiB,GAAG,CAAC;AAAA,YAC9G;AAAA,WACH;AAAA,QACL;AAAA,QACA,MAAM,GAAG,CAAC,MAAM,WAAW,SAAS,WAAW,YAAY,iBAAiB,YAAY,gBAAgB,QAAQ,CAAC;AAAA,QACjH,MAAM,KAAK,KAAK,KAAK,EAAE,IAAI,EAAE,GAAG,QAAQ,KAAK,KAAK,EAAE,OAAO,GAAG,GAAG,WAAW,KAAK,KAAK,EAAE,UAAU,GAAG;AAAA,QACrG,IAAI,CAAC,4EAA4E,KAAK,EAAE,KAAM,EAAE,YAAY,aAAa,OAAO,EAAE,YAAY,aAAe,EAAE,QAAQ,WAAW,UAAU,EAAE,YAAY,aAAe,EAAE,QAAQ,WAAW,UAAU,CAAC,OAAO,cAAc,EAAE,OAAO,KAAM,EAAE,UAAqB;AAAA,UAAK,KAAK,eAAe;AAAA,QAC7U,MAAM,SAAS,cAAc,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM;AAAA,QAClE,MAAM,WAAW,EAAE,QAAQ,WAAW,QAAQ,MAAM,KAAK,MAAM,OAAM,SAAQ;AAAA,UACzE,QAAO,YAAW,MAAM,KAAK,MAAM,GAAG,IAAI;AAAA,UAC1C,MAAM,OAAO,gBAAgB,OAAO,EAAE,KAAK,UAAQ,KAAK,OAAO,OAAO,MAAM,CAAC,KAAK,MAAM,QAAQ;AAAA,UAChG,IAAI,CAAC,MAAM,SAAS,KAAK,YAAY,EAAE;AAAA,YAAS,KAAK,oBAAoB,GAAG;AAAA,UAC5E,IAAI,KAAK,MAAM,aAAa,OAAO;AAAA,YAAU,KAAK,eAAe;AAAA,UACjE,OAAO,EAAC,WAAW,CAAC,GAAG,QAAQ,KAAK,MAAK;AAAA,SAC5C,IAAI;AAAA,QAEL,MAAM,cAAc,YAAY,EAAE,YAAY,SAAS,EAAE,iBAAiB,aACnE,SAAS,aAAa,YAAY,SAAS,WAAW,OAAO,UAC7D,kBAAkB,SAAS,eAAe,OAAO,aAAa,KAC9D,kBAAkB,SAAS,QAAQ,OAAO,MAAM;AAAA,QACvD,IAAI,CAAC;AAAA,UAAa,MAAM,KAAK,eAAe,EAAE,SAAS,KAAI,QAAQ,SAAQ,CAAC;AAAA,QAC5E,MAAM,YAAY,EAAE,iBAAiB,YAAY,YAAY,MAAM,KAAK,YAAY,KAAK,KAAK,EAAE,cAAc,IAAI,CAAC;AAAA,QACnH,IAAI;AAAA,QACJ,IAAI;AAAA,UACA,OAAO,MAAM,KAAK,MAAM,OAAO,SAAS;AAAA,YACpC,QAAQ,SAAS,SAAS,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,QAAQ,gBAAgB,OAAO,GAAG,SAAS,EAAE,QAAQ,WAAW,SAAS,MAAM,KAAK,OAAK,EAAE,OAAO,OAAO,EAAE,KAAK,MAAM,KAAK,OAAK,EAAE,QAAQ,gBAAgB,EAAE,KAAK,MAAM,KAAK,OAAK,EAAE,UAAU,IAAI,IAAI,MAAM,KAAK,OAAK,EAAE,OAAO,OAAO,MAAM,CAAC,EAAE,MAAM,QAAQ,GAAG,MAAM,QAAQ;AAAA,YAClU,IAAI,EAAE,QAAQ,WAAW,UAAU,CAAC,OAAO,QAAQ,YAAY,EAAE;AAAA,cAC7D,KAAK,oBAAoB,GAAG;AAAA,YAChC,IAAI,OAAO,IAAI,aAAa,OAAO;AAAA,cAAU,KAAK,eAAe;AAAA,YACjE,IAAI,EAAE,QAAQ,WAAW,UAAU;AAAA,cAAK,KAAK,oBAAoB,GAAG;AAAA,YACpE,IAAI,EAAE,QAAQ,WAAW,UAAU,MAAM,OAAO,OAAK,EAAE,UAAU,IAAI,EAAE,UAAU;AAAA,cAC7E,KAAK,oBAAoB,GAAG;AAAA,YAChC,cAAc,KAAK;AAAA,YACnB,MAAM,aAAyB,EAAE,IAAI,OAAO,SAAS,EAAE,WAAsB,UAAU,QAAQ,UAAU,WAAW,aAAa,KAAK,aAAa,IAAI,YAAY,KAAK,KAAK,cAAc,CAAC,EAAE;AAAA,YAC9L,IAAI,WAAW,WAAW,CAAC,WAAW;AAAA,cAClC,KAAK,sBAAsB;AAAA,YAC/B,OAAO,EAAE,WAAW,CAAC,EAAE,KAAK,QAAQ,OAAO,gBAAgB,IAAI,iBAAiB,QAAQ,WAAW,GAAG,OAAO,OAAO,EAAE,QAAQ,uBAAuB,WAAW,CAAC,EAAE,GAAG,KAAK,MAAM,SAAS,KAAK,IAAI,mBAAmB,MAAM,KAAK,CAAC,CAAC,GAAG,QAAQ,KAAK,EAAE,YAAY,KAAK,KAAK,cAAc,UAAU,GAAG,UAAU,QAAQ,WAAW,KAAK,EAAE,EAAE,GAAG,EAAE,QAAQ,WAAW,SAAS,MAAM,GAAG,EAAE;AAAA,WAC3X;AAAA,kBAEL;AAAA,UACI,IAAI;AAAA,YACA,MAAM,KAAK,yBAAyB,SAAS;AAAA,UACjD,IAAI;AAAA,YACA,MAAM,KAAK,yBAAyB,WAAW;AAAA;AAAA,OAE1D;AAAA,MACD,MAAM,+BAA+B,CAAC,MAAM,GAAG,2BAA2B,OAAM,MAAK;AAAA,QACjF,MAAM,KAAK,kBAAkB,GAAG,gBAAgB,IAAI;AAAA,QACpD,MAAM,IAAI,MAAM,KAAK,EAAE,OAAO;AAAA,QAAG,MAAM,GAAG,CAAC,QAAQ,KAAK,CAAC;AAAA,QACzD,MAAM,WAAW,MAAM,KAAK,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG;AAAA,QACnE,OAAO,KAAK,MAAM,OAAM,SAAQ;AAAA,UAAE,MAAM,KAAK,MAAM,GAAG,IAAI;AAAA,UAAG,OAAO,EAAC,WAAW,CAAC,GAAG,QAAQ,KAAK,QAAQ,EAAC;AAAA,SAAI;AAAA,OACjH;AAAA,MACD,MAAM,mBAAmB,CAAC,OAAO,KAAK,GAAG,iBAAiB,OAAO,MAAM;AAAA,QACnE,MAAM,KAAK,kBAAkB,GAAG,gBAAgB,EAAE,QAAQ,WAAW,KAAK;AAAA,QAC1E,MAAM,IAAI,EAAE,QAAQ,WAAW,QAAQ,MAAM,KAAK,EAAE,OAAO,IAAI,CAAC;AAAA,QAChE,MAAM,GAAG,CAAC,WAAW,iBAAiB,CAAC;AAAA,QACvC,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,UAC9B,QAAQ,SAAS,SAAS,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,IAAI,SAAS,OAAO;AAAA,UACzE,IAAI,EAAE,QAAQ,WAAW;AAAA,YACrB,OAAO,EAAE,WAAW,CAAC,GAAG,QAAQ,KAAK,EAAE,SAAS,EAAE,SAAS,iBAAiB,EAAE,MAAO,gBAAgB,CAAC,EAAE;AAAA,UAC5G,IAAI,OAAO,EAAE,oBAAoB;AAAA,YAC7B,KAAK,eAAe;AAAA,UACxB,IAAI,EAAE,YAAY,EAAE;AAAA,YAChB,KAAK,oBAAoB,GAAG;AAAA,UAChC,OAAO,EAAE,WAAW,CAAC,SAAS,GAAG,YAAY,KAAK,EAAE,OAAQ,iBAAiB,EAAE,gBAAgB,CAAC,GAAG,KAAK,MAAM,SAAS,KAAK,IAAI,mBAAmB,MAAM,KAAK,CAAC,CAAC,GAAG,QAAQ,KAAK,EAAE,SAAS,EAAE,UAAU,GAAG,iBAAiB,EAAE,gBAAgB,CAAC,EAAE;AAAA,SACnP;AAAA,OACJ;AAAA,MACD,MAAM,cAAc,CAAC,OAAO,KAAK,GAAG,aAAa,OAAO,MAAM;AAAA,QAC1D,MAAM,KAAK,kBAAkB,GAAG,gBAAgB,EAAE,QAAQ,WAAW,KAAK;AAAA,QAC1E,IAAI,EAAE,QAAQ,WAAW;AAAA,UACrB,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,YAAE,QAAQ,YAAY,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,IAAI,UAAU,OAAO;AAAA,YAAG,OAAO,EAAE,WAAW,CAAC,GAAG,QAAQ,KAAK,KAAK,aAAa,CAAC,CAAC,EAAE;AAAA,WAAI;AAAA,QAC9K,MAAM,IAAI,MAAM,KAAK,EAAE,OAAO;AAAA,QAC9B,MAAM,GAAG,CAAC,WAAW,WAAW,WAAW,UAAU,WAAW,CAAC;AAAA,QACjE,IAAI,OAAO,EAAE,YAAY,aAAa,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,SAAS,OAAO,CAAC,MAAM,QAAQ,EAAE,SAAS,KAAK,EAAE,UAAU,SAAS,MAAM,EAAE,UAAU,KAAK,OAAK,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,SAAS,OAAO,CAAC,+BAA+B,KAAK,CAAC,CAAC;AAAA,UACrQ,KAAK,eAAe;AAAA,QACxB,MAAM,MAAM,EAAE,WAAW,YAAY,YAAY,MAAM,KAAK,YAAY,KAAK,KAAK,EAAE,QAAQ,IAAI,CAAC;AAAA,QACjG,IAAI;AAAA,QACJ,IAAI;AAAA,UACA,OAAO,MAAM,KAAK,MAAM,OAAO,SAAS;AAAA,YACpC,QAAQ,SAAS,SAAS,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,IAAI,UAAU,OAAO;AAAA,YAC1E,cAAc,EAAE,MAAO;AAAA,YACvB,IAAI,EAAE,YAAY,EAAE;AAAA,cAChB,KAAK,oBAAoB,GAAG;AAAA,YAChC,MAAM,IAAe,EAAE,SAAS,EAAE,SAAoB,SAAS,EAAE,SAAmB,WAAW,OAAO,EAAE,MAAO,WAAW,WAAW,EAAE,UAAsB;AAAA,YAC7J,IAAI,EAAE,YAAY,CAAC,EAAE,WAAW,CAAC,EAAE,aAAa,CAAC,EAAE,UAAU;AAAA,cACzD,KAAK,sBAAsB;AAAA,YAC/B,OAAO,EAAE,WAAW,CAAC,SAAS,GAAG,aAAa,CAAC,GAAG,KAAK,MAAM,SAAS,KAAK,IAAI,uBAAuB,MAAM,KAAK,CAAC,CAAC,GAAG,QAAQ,KAAK,KAAK,aAAa,EAAE,KAAK,EAAE,KAAK,SAAS,EAAE,UAAU,GAAG,OAAO,EAAE,CAAC,CAAC,EAAE;AAAA,WAC3M;AAAA,kBAEL;AAAA,UACI,IAAI;AAAA,YACA,MAAM,KAAK,yBAAyB,GAAG;AAAA,UAC3C,IAAI;AAAA,YACA,MAAM,KAAK,yBAAyB,WAAW;AAAA;AAAA,OAE1D;AAAA,MACD,MAAM,0BAA0B,CAAC,MAAM,GAAG,qBAAqB,OAAO,MAAM;AAAA,QAAE,MAAM,KAAK,kBAAkB,GAAG,gBAAgB,IAAI;AAAA,QAAG,MAAM,IAAI,MAAM,KAAK,EAAE,OAAO;AAAA,QAAG,MAAM,GAAG,CAAC,cAAc,CAAC;AAAA,QAAG,OAAO,KAAK,UAAU,EAAE,SAAS,KAAK,KAAK,EAAE,cAAc,EAAE,GAAG,mCAAmC,CAAC;AAAA,OAAI;AAAA,MAC1S,MAAM,2BAA2B,CAAC,MAAM,GAAG,sBAAsB,OAAO,MAAM;AAAA,QAAE,MAAM,KAAK,kBAAkB,GAAG,gBAAgB,IAAI;AAAA,QAAG,MAAM,IAAI,MAAM,KAAK,EAAE,OAAO;AAAA,QAAG,MAAM,GAAG,CAAC,QAAQ,CAAC;AAAA,QAAG,OAAO,KAAK,WAAW,GAAG,KAAK,KAAK,EAAE,QAAQ,EAAE,CAAC;AAAA,OAAI;AAAA,IACvP;AAAA;AAAA,EAEI,WAAW,CAAC,GAAoB;AAAA,IAAE,IAAI,OAAO,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,SAAS;AAAA,MACnF,KAAK,eAAe;AAAA,IAAG,OAAO;AAAA;AAAA,EAC1B,IAAI,CAAC,GAAY,KAAqB;AAAA,IAAE,IAAI,OAAO,MAAM,YAAY,CAAC,KAAK,EAAE,SAAS;AAAA,MAC1F,KAAK,eAAe;AAAA,IAAG,OAAO;AAAA;AAAA,EAC1B,eAAe,CAAC,GAAoC;AAAA,IAAE,MAAM,IAAI,SAAS,EAAE,QAAQ;AAAA,IAAG,IAAI,MAAM,EAAE;AAAA,MACtG,KAAK,uBAAuB;AAAA,IAAG,OAAO;AAAA;AAAA,EAClC,aAAa,CAAC,GAAe;AAAA,IAAE,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,OAAO,SAAS,EAAE,SAAS,UAAU,EAAE,UAAU,eAAe,EAAE,eAAe,QAAQ,EAAE,QAAQ,UAAU,EAAE,UAAU,QAAQ,EAAE,QAAQ,WAAW,CAAC,CAAC,EAAE,UAAU;AAAA;AAAA,EAC/N,YAAY,CAAC,GAAoB;AAAA,IAAE,OAAO,EAAE,SAAS,EAAE,SAAS,SAAS,EAAE,MAAO,SAAS,SAAS,EAAE,MAAO,SAAS,WAAW,EAAE,MAAO,WAAW,WAAW,CAAC,CAAC,EAAE,MAAO,UAAU;AAAA;AAAA,OAC/K,YAAW,CAAC,QAAiC;AAAA,IACvD,MAAM,UAAU,KAAK,UAAU,EAAC,OAAO,WAAW,GAAG,OAAO,OAAM,CAAC;AAAA,IACnE,SAAS,QAAQ,EAAG,QAAQ,aAAa,SAAS;AAAA,MAC9C,MAAM,MAAM,iBAAiB;AAAA,MAC7B,IAAI,MAAM,KAAK,KAAK,YAAY,IAAI,GAAG;AAAA,QAAG;AAAA,MAC1C,IAAI;AAAA,QACA,MAAM,UAAU,MAAM,KAAK,KAAK,YAAY,cAAc,KAAK,MAAM,OAAO;AAAA,QAC5E,OAAO,MAAM,MAAM;AAAA,QAEvB,OAAO,OAAO;AAAA,QACV,MAAM,QAAQ,MAAM,KAAK,KAAK,YAAY,IAAI,GAAG;AAAA,QACjD,IAAI,SAAS,SAAS,MAAM,OAAO,OAAO;AAAA,UAAG,OAAO,MAAM,MAAM,MAAM;AAAA,QACtE,IAAI,SAAS,OAAO,UAAU,YAAY,UAAU,SAAS,MAAM,SAAS;AAAA,UAAoB;AAAA,QAChG,MAAM;AAAA;AAAA,IAEd;AAAA,IACA,OAAO,KAAK,gBAAgB,GAAG;AAAA;AAAA,OAErB,WAAU,CAAC,KAAa;AAAA,IAClC,MAAM,QAAQ,iCAAiC,KAAK,GAAG;AAAA,IACvD,IAAI,CAAC,SAAS,OAAO,MAAM,EAAE,KAAK;AAAA,MAAa,OAAO;AAAA,IACtD,MAAM,MAAM,iBAAiB,MAAM,IAAI,QAAQ,MAAM,KAAK,KAAK,YAAY,IAAI,GAAG;AAAA,IAClF,IAAI,OAAO,YAAY,OAAO,MAAM,EAAE;AAAA,MAAG,OAAO;AAAA,IAChD,IAAI;AAAA,MACA,MAAM,QAAQ,KAAK,MAAM,MAAM,KAAK;AAAA,MACpC,OAAO,OAAO,OAAO,UAAU,YAAY,OAAO,MAAM,UAAU,WAAW,EAAC,SAAQ,MAAM,SAAS,OAAM,MAAM,OAAO,IAAG,IAAI;AAAA,MACjI,MAAM;AAAA,MAAE,OAAO;AAAA;AAAA;AAAA,OAEP,aAAY,CAAC,KAAa;AAAA,IACpC,MAAM,QAAQ,MAAM,KAAK,WAAW,GAAG;AAAA,IACvC,IAAI;AAAA,MAAO,MAAM,KAAK,KAAK,YAAY,OAAO,MAAM,KAAK,MAAM,OAAO;AAAA;AAAA,OAE5D,yBAAwB,CAAC,KAAa;AAAA,IAChD,IAAI;AAAA,MACA,MAAM,UAAU,MAAM,KAAK,QAAQ;AAAA,MACnC,IAAI,QAAQ,KAAK,OAAK,KAAK,UAAU,EAAE,KAAK,EAAE,SAAS,GAAG,CAAC;AAAA,QACvD;AAAA,MACJ,MAAM,KAAK,aAAa,GAAG;AAAA,MAE/B,MAAM;AAAA;AAAA,OAEI,gBAAe,CAAC,OAAgB,QAAmB,SAAkB;AAAA,IAC/E,IAAI,CAAC,OAAO;AAAA,MACR;AAAA,IACJ,IAAI,OAAO,UAAU,YAAY,CAAC,SAAS,MAAM,SAAS;AAAA,MACtD,KAAK,sBAAsB,GAAG;AAAA,IAClC,MAAM,KAAK,MAAM,OAAO,SAAS;AAAA,MAC7B,MAAM,UAAU,MAAM,KAAK,QAAQ,GAAG,IAAI,SAAS,OAAO,EAAE,OAAQ,MAAM,MAAM,SAAS,WAAW,cAAc,eAAe,GAAG,MAAM,eAAe,OAAO,KAAK,GAAG,MAAM,MAAM,KAAK;AAAA,MACzL,IAAI,IAAI,KAAK,OAAK,EAAE,OAAO,QAAQ,OAAO,EAAE,MAAM,QAAQ,GAAG;AAAA,QACzD,KAAK,oBAAoB,GAAG;AAAA,MAChC,MAAM,OAAO,IAAI,KAAK,OAAK,CAAC,EAAE,SAAS,EAAE,MAAM,SAAS,GAAG;AAAA,MAC3D,IAAI,CAAC;AAAA,QACD,KAAK,iBAAiB,GAAG;AAAA,MAC7B,OAAO,EAAE,WAAW,CAAC,SAAS,MAAM,WAAW,EAAE,KAAK,OAAO,GAAG,OAAO,MAAM,IAAI,OAAO,OAAO,EAAE,aAAa,CAAC,CAAC,GAAG,QAAQ,UAAU;AAAA,KACxI;AAAA,IACD,MAAM,SAAS,MAAM,KAAK,WAAW,OAAO,SAAS;AAAA,IACrD,IAAI,CAAC;AAAA,MACD,KAAK,oBAAoB,GAAG;AAAA,IAChC,IAAI;AAAA,MACA,MAAM,WAAW,OAAO,KAAK,aAAa,SAAS,OAAO,6DAA6D,EAAE,QAAQ,QAAQ,SAAS,EAAE,gBAAgB,oCAAoC,GAAG,MAAM,IAAI,gBAAgB,EAAE,QAAQ,OAAO,OAAO,UAAU,MAAM,CAAC,GAAG,QAAQ,YAAY,IAAI,CAAC,QAAQ,QAAQ,KAAK,KAAK,QAAQ,YAAY,QAAQ,IAAI,CAAC,CAAC,GAAG,UAAU,QAAQ,CAAC;AAAA,MAC5X,MAAM,SAAS,MAAM,SAAS,KAAK;AAAA,MAKnC,IAAI,CAAC,SAAS,MAAM,OAAO,YAAY,QAAQ,OAAO,OAAO,aAAa,YAAY,CAAC,OAAO,UAAU,SAAS,OAAO,QAAQ,KAAK,OAAO,WAAW;AAAA,QACnJ,KAAK,oBAAoB,GAAG;AAAA,MAEpC,OAAO,GAAG;AAAA,MACN,IAAI,aAAa;AAAA,QACb,MAAM;AAAA,MACV,KAAK,oBAAoB,GAAG;AAAA;AAAA;AAAA,EAG5B,YAAY,GAAW;AAAA,IAC3B,MAAM,aAAa,KAAK,KAAK;AAAA,IAC7B,IAAI,CAAC;AAAA,MAAY,KAAK,8BAA8B,GAAG;AAAA,IACvD,IAAI;AAAA,IACJ,IAAI;AAAA,MAAE,MAAM,IAAI,IAAI,UAAU;AAAA,MAC9B,MAAM;AAAA,MAAE,KAAK,8BAA8B,GAAG;AAAA;AAAA,IAC9C,IAAI,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAAK,IAAI,YAAY,IAAI,YAAY,IAAI,aAAa,OAAO,IAAI,UAAU,IAAI,QAAQ,IAAI,WAAW;AAAA,MAChJ,KAAK,8BAA8B,GAAG;AAAA,IAC1C,OAAO,IAAI;AAAA;AAAA,EAEP,UAAU,CAAC,OAAwB;AAAA,IAAE,IAAI,UAAU;AAAA,MACvD,OAAO;AAAA,IAAO,IAAI,OAAO,UAAU,YAAY,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,MAAM,SAAS,IAAI,KAAK,cAAc,KAAK,KAAK,KAAK,MAAM,SAAS;AAAA,MACvK,KAAK,mBAAmB;AAAA,IAAG,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,aAAa,CAAC;AAAA,IAAG,IAAI,EAAE,WAAW,KAAK,aAAa;AAAA,MAC7G,KAAK,mBAAmB;AAAA,IAAG,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE;AAAA;AAAA,EACxD,UAAU,CAAC,OAAe,SAAS,KAAK;AAAA,IAAE,OAAO,GAAG,eAAe,0EAA0E,SAAS,KAAK,aAAa,EAAE,WAAW,QAAQ,IAAI,aAAa;AAAA;AAAA,EAC9M,KAAK,CAAC,SAAqD;AAAA,IAC/D,OAAO,MAAM,SAAS,QAAQ,WAAW,OAAK;AAAA,MAAE,IAAI,MAAM;AAAA,QACtD,OAAO;AAAA,MAAM,MAAM,IAAI;AAAA,MAAe,IAAI,CAAC,KAAK,OAAO,KAAK,CAAC,EAAE,KAAK,OAAK,CAAC,CAAC,MAAM,SAAS,SAAS,eAAe,gBAAgB,cAAc,WAAW,aAAa,SAAS,YAAY,UAAU,aAAa,WAAW,UAAU,UAAU,EAAE,SAAS,CAAC,CAAC,KAAK,OAAO,EAAE,OAAO,YAAY,OAAO,EAAE,UAAU,YAAY,OAAO,EAAE,UAAU,YAAY,OAAO,EAAE,gBAAgB,YAAY,OAAO,EAAE,iBAAiB,YAAY,CAAC,OAAO,cAAc,EAAE,UAAU,KAAK,CAAC,OAAO,cAAc,EAAE,OAAO,KAAK,CAAC,OAAO,cAAc,EAAE,SAAS,KAAK,CAAC,OAAO,cAAc,EAAE,KAAK,KAAK,CAAC,CAAC,WAAW,cAAc,YAAY,UAAU,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,EAAE,aAAa,YAAa,EAAE,YAAY,aAAa,OAAO,EAAE,YAAY,YAAc,EAAE,WAAW,aAAa,OAAO,EAAE,WAAW,YAAc,EAAE,aAAa,aAAa,CAAC,CAAC,QAAQ,QAAQ,EAAE,SAAS,EAAE,QAAQ,KAAO,EAAE,WAAW,eAAe,CAAC,EAAE,WAAW,CAAC,EAAE,UAAU,CAAC,EAAE,aAAe,EAAE,cAAc,cAAc,CAAC,EAAE,aAAa,OAAO,EAAE,UAAU,WAAW,YAAY,OAAO,EAAE,UAAU,kBAAkB,YAAY,CAAC,OAAO,cAAc,EAAE,UAAU,UAAU;AAAA,QAC3mC,KAAK,iBAAiB,GAAG;AAAA,MAAG,OAAO;AAAA,KAAI;AAAA;AAAA,EAEvC,cAAc,GAAG;AAAA,IAAE,OAAO,IAAI,eAAe,KAAK,aAAa,SAAS,OAAO,KAAK,KAAK,MAAM;AAAA;AAAA,OACzF,WAAU,CAAC,YAAqD;AAAA,IAC1E,MAAM,SAAS,MAAM,KAAK,WAAW,WAAW,SAAS;AAAA,IACzD,IAAI,CAAC;AAAA,MAAQ,KAAK,oBAAoB,GAAG;AAAA,IACzC,OAAO,KAAK,eAAe,EAAE,cAAc,YAAY,OAAO,KAAK;AAAA;AAAA,OAEjE,aAAY,CAAC,UAAsC;AAAA,IAAE,IAAI;AAAA,MAC3D,KAAK,MAAM;AAAA,MACX,MAAM,UAAU,MAAM,KAAK,QAAQ,GAAG,IAAI,UAAU,OAAO,EAAE;AAAA,MAC7D,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,MAAM,WAAW,EAAE,SAAS,EAAE,YAAa,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC,EAAG,EAAE,GAAG,SAAS,YAAY,OAAO,EAAE,OAAO,OAAK,EAAE,OAAO,EAAE,IAAI,QAAM,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,OAAO,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC;AAAA,MAElP,OAAO,GAAG;AAAA,MACN,OAAO,KAAK,CAAC;AAAA;AAAA;AAAA,OAEX,WAAU,CAAC,SAAqC;AAAA,IAAE,IAAI;AAAA,MACxD,KAAK,MAAM;AAAA,MACX,OAAO,SAAS,KAAK,KAAK,gBAAgB;AAAA,MAC1C,MAAM,IAAI,MAAM,KAAK,OAAO;AAAA,MAC5B,MAAM,GAAG,CAAC,YAAY,UAAU,CAAC;AAAA,MACjC,OAAO,MAAM,KAAK,UAAU,SAAS,KAAK,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,WAAW,EAAE,QAAQ,CAAC;AAAA,MAE/F,OAAO,GAAG;AAAA,MACN,OAAO,KAAK,CAAC;AAAA;AAAA;AAAA,OAEH,UAAS,CAAC,SAAkB,UAAkB,UAAkB,GAAiD;AAAA,IAC3H,MAAM,eAAe,KAAK,aAAa;AAAA,IACvC,MAAM,KAAK,QAAQ,CAAC,YAAY,OAAO,KAAK,OAAO,OAAO,CAAC,CAAC,CAAC;AAAA,IAC7D,MAAM,aAAa,YAAY,MAAM,KAAK,QAAQ,CAAC,EAAE,KAAK,OAAK,EAAE,OAAO,YAAY,EAAE,OAAO;AAAA,IAC7F,IAAI,CAAC;AAAA,MACD,KAAK,oBAAoB,GAAG;AAAA,IAChC,MAAM,SAAS,MAAM,KAAK,WAAW,UAAU,GAAG,QAAa,YAAY,GAAG,QAAa,YAAY,GAAG,WAAgB,uBAAuB,GAAG,YAAY,MAAW,4BAA2B,QAAQ,GAAG,cAAc,MAAM,KAAK,YAAY,QAAQ,GAAG,KAAK,WAAW;AAAA,IACjR,IAAI;AAAA,IACJ,IAAI;AAAA,MACA,MAAM,KAAK,MAAM,OAAO,SAAS;AAAA,QAC7B,MAAM,UAAU,IAAI,MAAM,KAAK,MAAM,GAAG,IAAI,IAAI,WAAW,UAAU,SAAS,WAAW,MAAM,KAAK,QAAQ,GAAG,UAAU,YAAY,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,QAAQ,GAAG,MAAM,MAAM,KAAK;AAAA,QAC7L,IAAI,CAAC,SAAS,WAAW,QAAQ,eAAe,WAAW;AAAA,UACvD,KAAK,oBAAoB,GAAG;AAAA,QAChC,MAAM,OAAO,KAAK,MAAM,OAAO,EAAE,KAAK,OAAK,CAAC,EAAE,SAAS,EAAE,MAAM,aAAa,OAAO,EAAE,MAAM,WAAW,UAAU;AAAA,QAChH,IAAI,CAAC;AAAA,UACD,KAAK,cAAc,GAAG;AAAA,QAC1B,cAAc,KAAK,OAAO;AAAA,QAC1B,MAAM,OAAiB,EAAE,IAAI,OAAO,OAAO,aAAa,cAAc,UAAU,YAAY,QAAQ,YAAY,SAAS,KAAK,WAAW,MAAM,KAAK,OAAO,OAAO,SAAS,OAAO,EAAE,MAAO,cAAc,UAAU,QAAQ,cAAe,UAAU,EAAE,WAAW,EAAE,QAAQ,QAAQ,KAAK,IAAI,YAAY,QAAQ,KAAK,YAAY,eAAe,KAAK,SAAS,IAAI,EAAG,OAAQ,EAAG,OAAO,EAAE,IAAI,CAAC,EAAG;AAAA,QACjY,OAAO,EAAE,WAAW,CAAC,SAAS,MAAM,QAAQ,IAAI,CAAC,GAAG,QAAQ,UAAU;AAAA,OACzE;AAAA,MACD,MAAM,mBAAwB,sBAAsB,QAAQ,EAAE,cAAc,eAAe,8BAA8B,UAAU,OAAO,WAAW,OAAO,KAAK,GAAG,GAAG,eAAe,QAAQ,gBAAgB,WAAW,uBAAuB,QAAQ,UAAW,WAAW,aAAa,WAAW,CAAC,IAAI,EAAE,MAAM,EAAG,CAAC,EAAE;AAAA,MACzT,OAAO,KAAK,EAAE,kBAAkB,QAAQ,GAAG,GAAG,KAAK,EAAE,cAAc,KAAK,WAAW,KAAK,EAAE,CAAC;AAAA,cAE/F;AAAA,MACI,MAAM,KAAK,yBAAyB,WAAW;AAAA,MAC/C,IAAI;AAAA,QACA,MAAM,KAAK,yBAAyB,WAAW;AAAA;AAAA;AAAA,OAGrD,cAAa,CAAC,SAAqC;AAAA,IACrD,IAAI;AAAA,IACJ,IAAI;AAAA,MACA,KAAK,MAAM;AAAA,MACX,MAAM,eAAe,KAAK,aAAa,GAAG,WAAW,IAAI,IAAI,QAAQ,GAAG,GAAG,WAAW,SAAS,SAAS,MAAM,GAAG,EAAE,GAAG,EAAE,GAAI,QAAQ,SAAS,aAAa,IAAI,OAAO;AAAA,MACrK,MAAM,WAAW,QAAQ,QAAQ,IAAI,QAAQ,KAAK,IAAI,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,OAAO,OAAK,EAAE,WAAW,cAAc,GAAG,CAAC;AAAA,MAC/H,IAAI,CAAC,SAAS,QAAQ,WAAW,KAAK,CAAC,SAAS,QAAQ,GAAI,MAAM,YAAY,SAAS,CAAC,GAAG,KAAK;AAAA,QAC5F,KAAK,sBAAsB,GAAG;AAAA,MAClC,MAAM,OAAO,MAAM,KAAK,MAAM,OAAO,SAAS;AAAA,QAC1C,MAAM,UAAU,MAAM,KAAK,QAAQ,GAAG,OAAO,KAAK,MAAM,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,UAAU,KAAK,GAAG,aAAa,YAAY,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,QAAQ,GAAG,MAAM,MAAM,KAAK,GAAG,IAAI,MAAM;AAAA,QACpM,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,YAAY,EAAE,WAAW,aAAa,EAAE,UAAU,SAAS,OAAO,EAAE,MAAO,gBAAgB,EAAE,aAAa,OAAO,CAAC,YAAY,WAAW,WAAW,eAAe,EAAE;AAAA,UACvM,KAAK,qBAAqB,GAAG;AAAA,QACjC,OAAO,EAAE,WAAW,CAAC,SAAS,MAAM,QAAQ,KAAK,GAAG,QAAQ,aAAa,CAAC,CAAC,GAAG,QAAQ,EAAE,MAAM,GAAG,WAAW,EAAE;AAAA,OACjH;AAAA,MACD,cAAc,KAAK,KAAK;AAAA,MACxB,MAAM,WAAW,MAAM,KAAK,WAAW,WAAW;AAAA,MAClD,IAAI,CAAC;AAAA,QACD,KAAK,qBAAqB,GAAG;AAAA,MACjC,MAAM,SAAS,MAAM,KAAK,WAAW,KAAK,UAAU;AAAA,MACpD,MAAM,YAAY,IAAI,IAAI,eAAe,8BAA8B,QAAQ;AAAA,MAC/E,UAAU,SAAS,SAAS;AAAA,MAC5B,MAAM,iBAAiB,MAAM,KAAK,eAAe,EAAE,SAAS,KAAK,YAAY,QAAQ,WAAW,EAAC,kBAAkB,SAAS,OAAO,eAAe,OAAO,eAAe,KAAK,KAAK,MAAK,CAAC;AAAA,MACxL,MAAM,QAAQ,aAAY,EAAE,EAAE,SAAS,WAAW;AAAA,MAClD,MAAM,SAAS,MAAM,KAAK,MAIvB,OAAO,SAAS;AAAA,QACf,MAAM,UAAU,MAAM,KAAK,QAAQ,GAAG,OAAO,KAAK,MAAM,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,OAAO,KAAK,KAAK,EAAE,GAAG,IAAI,MAAM,OAAO,UAAU,YAAY,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,QAAQ,GAAG,UAAU,MAAM,KAAK,kBAAkB,GAAG,QAAQ,oBAAoB,GAAG,YAAY,MAAM,KAAK,YAAY,EAAE,UAAU,aAAa,IAAI,WAAW,MAAM,MAAM,KAAK;AAAA,QAC7V,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,gBAAgB,EAAE,UAAU,SAAS,OAAO,EAAE,MAAO,gBAAgB,EAAE,aAAa,OAAO,CAAC,SAAS,WAAW,QAAQ,eAAe,EAAE;AAAA,UACrK,KAAK,qBAAqB,GAAG;AAAA,QACjC,IAAI,EAAE,WAAW;AAAA,UACb,MAAM,IAAI,MAAM,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,EAAE,UAAW,MAAM,GAAG,UAAU;AAAA,UAC5E,IAAI,CAAC,KAAK,EAAE,eAAe,EAAE,UAAU,cAAc,CAAC,SAAS,SAAS,CAAC,KAAK,KAAK,GAAG,QAAQ,OAAO,KAAK,OAAO;AAAA,YAC7G,KAAK,aAAa,GAAG;AAAA,UACzB,OAAO,EAAE,WAAW,CAAC,SAAS,MAAM,QAAQ,KAAK,GAAG,QAAQ,YAAY,SAAS,eAAe,SAAS,QAAQ,eAAe,QAAQ,UAAU,eAAe,SAAS,CAAC,CAAC,GAAG,QAAQ,EAAE,MAAM,MAAM,UAAU,8CAA8C,EAAE,GAAG,EAAE;AAAA,QACxQ;AAAA,QACA,MAAM,KAAK,OAAO,eAAe,SAAS,SAAO,eAAe,OAAO,GAAG,UAAU,WAAW,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,OAAO;AAAA,QACnJ,IAAI,IAAI,WAAW,IAAI,KAAK,OAAK,EAAE,OAAO,QAAQ,MAAM;AAAA,QACxD,MAAM,UAA6B,CAAC;AAAA,QACpC,IAAI,WAAW,CAAC;AAAA,UACZ,KAAK,iBAAiB,GAAG;AAAA,QAC7B,IAAI,YAAY,QAAQ,iBAAiB,QAAQ,MAAM,QAAQ,aAAa,eAAe;AAAA,UACvF,KAAK,gCAAgC,GAAG;AAAA,QAC5C,IAAI,CAAC,GAAG;AAAA,UACJ,IAAI,CAAC,SAAS,OAAO,EAAE,MAAO;AAAA,YAC1B,KAAK,oBAAoB,GAAG;AAAA,UAChC,IAAI,IAAI,UAAU,aAAa,WAAW,OAAO,EAAE,UAAU;AAAA,YACzD,KAAK,cAAc,GAAG;AAAA,UAC1B,MAAM,SAAS,WAAW;AAAA,UAC1B,IAAI,EAAE,IAAI,QAAQ,UAAU,SAAS,QAAQ,aAAa,eAAe,aAAa,UAAU,OAAO,YAAY,GAAG,cAAc,IAAI,WAAW,MAAM;AAAA,UACzJ,QAAQ,KAAK,KAAK,aAAa,EAAE,KAAK,UAAU,QAAQ,SAAS,GAAG,OAAO,KAAK,GAAG,CAAC,CAAC;AAAA,UACrF,MAAM,WAAqB,EAAE,IAAI,QAAQ,cAAc,QAAQ,IAAI,QAAQ,eAAe,QAAQ,SAAS,eAAe,SAAS,UAAU,eAAe,SAAS;AAAA,UACrK,QAAQ,KAAK,SAAS,MAAM,SAAS,cAAc,IAAI,YAAY,IAAI,GAAG,YAAY,QAAQ,CAAC;AAAA,QACnG;AAAA,QACA,IAAI,EAAE;AAAA,UACF,KAAK,iBAAiB,GAAG;AAAA,QAC7B,MAAM,WAAW,MAAM,SAAS,WAAW,cAAc,eAAe,GAAG,UAAU,SAAS,KAAK,OAAK,CAAC,EAAE,SAAS,CAAC,KAAK,KAAK,IAAI,KAAK,OAAK,EAAE,OAAO,EAAE,MAAO,eAAe,KAAK,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC;AAAA,QAC/M,IAAI,CAAC;AAAA,UACD,KAAK,iBAAiB,GAAG;AAAA,QAC7B,QAAQ,KAAK,SAAS,SAAS,WAAW,EAAE,QAAQ,OAAO,KAAK,GAAG,iBAAiB,EAAE,IAAI,YAAY,EAAE,YAAY,SAAS,KAAK,SAAS,KAAK,WAAW,UAAU,QAAQ,OAAO,SAAS,OAAO,EAAE,MAAO,cAAc,cAAc,QAAQ,IAAI,sBAAsB,QAAQ,WAAW,CAAC,GAAG,SAAS,MAAM,QAAQ,KAAK,GAAG,QAAQ,WAAW,CAAC,GAAG,KAAK,MAAM,SAAS,EAAE,IAAI,cAAc,GAAG,CAAC;AAAA,QACpY,OAAO,EAAE,WAAW,SAAS,QAAQ,EAAE,MAAM,OAAO,UAAU,EAAE,UAAU,OAAO,EAAE;AAAA,OACtF;AAAA,MACD,MAAM,UAAU,IAAI,QAAQ,EAAE,UAAY,IAAI,IAAI,OAAO,UAAU,YAAY,EAAE,MAAM,iBAAiB,WAAW,CAAC;AAAA,MACpH,QAAQ,OAAO,cAAc,KAAK,WAAW,IAAI,CAAC,CAAC;AAAA,MACnD,IAAI,CAAC,OAAO,QAAQ,OAAO;AAAA,QACvB,QAAQ,OAAO,cAAc,OAAO,SAAS,OAAO,KAAK,UAAU,OAAO,MAAM,GAAG,YAAY,CAAC;AAAA,MACpG,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,MAEtD,OAAO,OAAO;AAAA,MACV,MAAM,OAAK,iBAAiB,eAAa,MAAM,OAAK;AAAA,MACpD,MAAM,KAAK,cAAc,cAAa,KAAK;AAAA,MAC3C,IAAI;AAAA,QACA,OAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,UAAU,KAAK,aAAa,IAAI,wBAAwB,mBAAmB,IAAI,GAAG,iBAAiB,YAAY,cAAc,KAAK,WAAW,IAAI,CAAC,EAAE,EAAE,CAAC;AAAA,QAE/M,MAAM;AAAA,QACF,OAAO,KAAK,KAAK;AAAA;AAAA,cAGzB;AAAA,MACI,IAAI,aAAa;AAAA,QACb,IAAI;AAAA,UACA,MAAM,KAAK,aAAa,WAAW;AAAA,UAEvC,MAAM;AAAA,MACV;AAAA;AAAA;AAAA,OAGM,WAAU,CAAC,GAA6B,IAA+B;AAAA,IACjF,OAAO,KAAK,MAAM,OAAO,SAAS;AAAA,MAC9B,QAAQ,SAAS,SAAS,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,OAAO,KAAK,MAAM,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,OAAO,EAAE,GAAG,IAAI,MAAM,OAAO,MAAM,MAAM,KAAK,GAAG,aAAa,KAAK,YAAY,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,EAAE,YAAY,GAAG,SAAS,KAAK,SAAS,IAAI,EAAE,OAAQ;AAAA,MACpQ,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,cAAc,EAAE,UAAU,SAAS,OAAO,EAAE,MAAO,gBAAgB,EAAE,aAAa,OAAO,CAAC,EAAE,WAAW,CAAC,EAAE,UAAU,CAAC,EAAE,YAAY,CAAC,EAAE,aAAa,EAAE,UAAU,WAAW,KAAK,MAAM,EAAE,UAAU,eAAe,KAAK,cAAc,EAAE,UAAU,kBAAkB,OAAO,UAAU,CAAC,YAAY,WAAW,WAAW,eAAe,EAAE;AAAA,QAClW,KAAK,qBAAqB,GAAG;AAAA,MACjC,MAAM,WAAqB,EAAE,IAAI,OAAO,EAAE,SAAS,SAAO,EAAE,OAAO,GAAG,QAAQ,KAAK,IAAI,cAAc,WAAW,IAAI,QAAQ,EAAE,QAAQ,SAAS,EAAE,SAAS,UAAU,EAAE,SAAS;AAAA,MAC/K,IAAI,WAAW,OAAO,EAAE,KAAK,OAAK,EAAE,OAAO,SAAS,EAAE;AAAA,QAClD,KAAK,mBAAmB,GAAG;AAAA,MAC/B,IAAI,WAAW,OAAO,EAAE,UAAU;AAAA,QAC9B,KAAK,kBAAkB,GAAG;AAAA,MAC9B,MAAM,IAAI,QAAQ,KAAK,OAAK,EAAE,QAAQ,UAAU,KAAK,EAAE;AAAA,MACvD,OAAO,EAAE,WAAW,CAAC,SAAS,MAAM,SAAS,cAAc,SAAS,IAAI,YAAY,IAAI,GAAG,YAAY,QAAQ,GAAG,KAAK,aAAa,EAAE,KAAK,EAAE,KAAK,SAAS,EAAE,SAAS,OAAO,KAAK,GAAG,KAAK,MAAM,YAAY,KAAK,KAAK,UAAU,EAAE,CAAC,GAAG,SAAS,MAAM,QAAQ,KAAK,GAAG,QAAQ,WAAW,CAAC,GAAG,KAAK,MAAM,SAAS,KAAK,IAAI,iBAAiB,GAAG,CAAC,GAAG,QAAQ,KAAK,EAAE,IAAI,KAAK,CAAC,EAAE;AAAA,KAC/W;AAAA;AAET;AACO,SAAS,aAAa,CAAC,MAA0B,eAA6B,CAAC,GAAoB;AAAA,EAAE,OAAO,IAAI,gBAAgB,MAAM,YAAY;AAAA;AAClJ,IAAM,MAAM;AAAA,EACf,EAAE,MAAM,aAAa,SAAS,CAAC,MAAM,GAAG,SAAS,iBAAiB;AAAA,EAClE,EAAE,MAAM,WAAW,SAAS,CAAC,MAAM,GAAG,SAAS,SAAS;AAAA,EACxD,EAAE,MAAM,SAAS,SAAS,CAAC,KAAK,GAAG,SAAS,OAAO;AAAA,EACnD,EAAE,MAAM,mBAAmB,SAAS,CAAC,OAAO,KAAK,GAAG,SAAS,gBAAgB;AAAA,EAC7E,GAAG,CAAC,CAAC,UAAU,CAAC,OAAO,MAAM,GAAG,OAAO,GAAG,CAAC,iBAAiB,CAAC,KAAK,GAAG,YAAY,GAAG,CAAC,mBAAmB,CAAC,MAAM,GAAG,mBAAmB,GAAG,CAAC,eAAe,CAAC,OAAO,QAAQ,QAAQ,GAAG,YAAY,GAAG,CAAC,sBAAsB,CAAC,OAAO,QAAQ,OAAO,QAAQ,GAAG,kBAAkB,GAAG,CAAC,+BAA+B,CAAC,MAAM,GAAG,yBAAyB,GAAG,CAAC,mBAAmB,CAAC,OAAO,KAAK,GAAG,eAAe,GAAG,CAAC,cAAc,CAAC,OAAO,KAAK,GAAG,WAAW,GAAG,CAAC,0BAA0B,CAAC,MAAM,GAAG,mBAAmB,GAAG,CAAC,2BAA2B,CAAC,MAAM,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,MAAM,SAAS,cAAc,EAAE,MAAM,SAAS,QAAQ,EAAE;AACnnB;AACO,IAAM,MAAM,CAAC;AAAb,IAAgB,aAAa;AAA7B,IAAkC,aAAa;AACtD,eAAsB,mBAAmB,CAAC,OAEvC;AAAA,EACC,MAAM,UAAU,MAAM,MAAM,KAAK,GAAG,QAAQ,YAAY,OAAO;AAAA,EAC/D,MAAM,SAAS,WAAW,cAAc,eAAe;AAAA,EACvD,MAAM,SAAS,WAAW,cAAc,eAAe;AAAA,EACvD,MAAM,SAAS,QAAQ,KAAK,OAAK,EAAE,QAAQ,gBAAgB;AAAA,EAC3D,IAAI;AAAA,IACA,sBAAsB,SAAS,OAAO,OAAO,QAAQ,GAAG,iBAAiB,GAAG;AAAA,EAChF,OAAO,EAAE,aAAa,MAAM,MAAM,UAAU,QAAQ;AAAA;AAGxD,eAAsB,qBAAqB,CAAC,SAGzC;AAAA,EACC,MAAM,QAAQ,QAAQ,cAAc,MAAM,QAAQ,OAAO,KAAK;AAAA,EAC9D,SAAS,IAAI,EAAG,IAAI,IAAI,KAAK;AAAA,IACzB,MAAM,UAAU,MAAM,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ;AAAA,IACrD,IAAI,CAAC;AAAA,MACD,MAAM,oBAAoB,KAAK;AAAA,IACnC,MAAM,QAAQ,QAAQ,YAAY,YAAY,OAAO;AAAA,IACrD,IAAI,OAAO,MAAM,UAAU;AAAA,MACvB,KAAK,uBAAuB,GAAG;AAAA,IACnC,MAAM,QAAQ,QAAQ,EAAE,SAAS,GAAG,OAAO,SAAS,GAAG,EAAE,IAAI,MAAM,aAAa,OAAO,GAAG,GAAG,OAAO,aAAY,EAAE,EAAE,SAAS,WAAW,GAAG,YAAY,MAAM,QAAQ,KAAK;AAAA,IAC1K,IAAI;AAAA,MACA,MAAM,MAAM,SAAS,CAAC,EAAE,KAAK,SAAS,iBAAiB,OAAO,WAAW,GAAG,OAAO,OAAO,EAAE,QAAQ,uBAAuB,OAAO,EAAE,OAAO,iBAAiB,MAAM,EAAE,QAAQ,OAAO,IAAI,GAAG,UAAU,EAAE,EAAE,CAAC,EAAE,GAAG,cAAc,KAAK,CAAC,CAAC;AAAA,MACnO,OAAO,EAAE,MAAM,UAAU;AAAA,MAE7B,OAAO,GAAG;AAAA,MACN,IAAI,CAAC,4BAA4B,CAAC;AAAA,QAC9B,MAAM;AAAA;AAAA,EAElB;AAAA,EACA,OAAO,KAAK,oBAAoB,GAAG;AAAA;AAGvC,eAAsB,eAAe,CAAC,OAAgB,SAA0B;AAAA,EAC5E,MAAM,IAAI,OAAO,KAAK;AAAA,EACtB,MAAM,GAAG,CAAC,aAAa,YAAY,YAAY,wBAAwB,UAAU,kBAAkB,CAAC;AAAA,EACpG,IAAI,EAAE,cAAc,WAAY,EAAE,qBAAqB,aAAa,CAAC,CAAC,IAAI,OAAO,IAAI,EAAE,SAAS,EAAE,gBAA0B;AAAA,IACxH,KAAK,eAAe;AAAA,EACxB,MAAM,OAAO,SAAS,EAAE,QAAQ,GAAG,IAAI,SAAS,EAAE,QAAQ;AAAA,EAC1D,IAAI,EAAE,yBAAyB;AAAA,IAC3B,KAAK,uBAAuB;AAAA,EAChC,IAAI,OAAO,EAAE,WAAW,YAAY,CAAC,EAAE,OAAO,KAAK,KAAK,EAAE,OAAO,SAAS;AAAA,IACtE,KAAK,gBAAgB;AAAA,EACzB,MAAM,QAAQ,QAAQ,cAAc,MAAM,QAAQ,OAAO,KAAK,KAAK,OAAO,MAAM,IAAI,SAAS,KAAK,GAAG,EAAE,WAAW,YAAY,YAAY,OAAO,UAAU,EAAE,CAAC;AAAA,EAC9J,SAAS,IAAI,EAAG,IAAI,IAAI,KAAK;AAAA,IACzB,MAAM,UAAU,MAAM,MAAM,KAAK;AAAA,IACjC,aAAa,OAAO;AAAA,IACpB,MAAM,SAAS,QAAQ,KAAK,OAAK,EAAE,QAAQ,iBAAiB;AAAA,IAC5D,IAAI;AAAA,IACJ,IAAI,QAAQ;AAAA,MACR,MAAM,KAAK,SAAS,OAAO,OAAO,QAAQ;AAAA,MAC1C,IAAI,OAAO,OAAO,YAAY,CAAC,kBAAkB,KAAK,EAAE;AAAA,QACpD,KAAK,iBAAiB,GAAG;AAAA,MAC7B,WAAW;AAAA,IACf;AAAA,IAEA,WAAW,KAAK;AAAA,MACZ,IAAK,EAAE,OAEH,WAAW;AAAA,QACX,KAAK,iBAAiB,GAAG;AAAA,IACjC,MAAM,KAAK,YAAY,WAAW,GAAG,SAAS,QAAQ,KAAK,OAAK,EAAE,QAAQ,UAAU,EAAE;AAAA,IACtF,IAAI;AAAA,IACJ,IAAI,QAAQ;AAAA,MACR,IAAI;AAAA,QACA,QAAQ,aAAa,SAAS,OAAO,OAAO,MAAM,CAAC;AAAA,QAEvD,OAAO,OAAO;AAAA,QACV,IAAI,EAAE,iBAAiB;AAAA,UACnB,MAAM;AAAA;AAAA,IAElB;AAAA,IACA,MAAM,QAAQ,QAAQ,OAAO,OAAK,EAAE,IAAI,WAAW,OAAO,KAAK,EAAE,QAAQ,UAAU,EAAE,EAAE,IAAI,OAAK,aAAa,SAAS,EAAE,OAAO,MAAM,CAAC,CAAC;AAAA,IACvI,IAAI,MAAM,KAAK,OAAK,EAAE,aAAa,IAAI;AAAA,MACnC,KAAK,mBAAmB,GAAG;AAAA,IAC/B,MAAM,IAAI,SAAS,OAAO,GAAG,OAAO,UAAU,OAAO,GAAG,cAAc,QAAQ,KAAK,OAAK,EAAE,QAAQ,OAAO;AAAA,IACzG,IAAI,WAAW;AAAA,IACf,IAAI;AAAA,MACA,WAAW,WAAW,WAAW;AAAA,MAErC,OAAO,OAAO;AAAA,MACV,IAAI,EAAE,iBAAiB;AAAA,QACnB,MAAM;AAAA;AAAA,IAEd,MAAM,KAAK,KAAK,IAAI,UAAU,SAAS,GAAG,CAAC,GAAG,OAAa,EAAE,IAAI,UAAU,MAAM,aAAa,OAAO,eAAe,MAAM,UAAU,OAAO,YAAY,KAAK,OAAO,cAAc,CAAC,EAAE,GAAG,aAAa,QAAQ,KAAK,OAAK,EAAE,QAAQ,gBAAgB,EAAE;AAAA,IAClP,MAAM,WAAW,MAAM,SAAS,WAAW,cAAc,eAAe;AAAA,IACxE,MAAM,SAAS,WAAW,cAAc,eAAe;AAAA,IACvD,YAAY,OAAO;AAAA,IACnB,WAAW,OAAO;AAAA,IAClB,MAAM,UAA6B;AAAA,MAC/B,EAAE,KAAK,UAAU,IAAI,iBAAiB,QAAQ,WAAW,GAAG,OAAO,OAAO,EAAE,QAAQ,uBAAuB,KAAK,CAAC,EAAE;AAAA,MACnH,EAAE,KAAK,gBAAgB,IAAI,iBAAiB,YAAY,WAAW,GAAG,OAAO,EAAE,QAAQ,uBAAuB,YAAY,EAAE,cAAc,MAAM,WAAW,MAAM,EAAE,EAAE;AAAA,MACrK,EAAE,KAAK,mBAAmB,iBAAiB,QAAQ,WAAW,GAAG,OAAO,EAAE,QAAQ,uBAAuB,QAAQ,GAAG,EAAE;AAAA,MACtH,EAAE,KAAK,SAAS,iBAAiB,QAAQ,KAAK,OAAK,EAAE,QAAQ,OAAO,GAAG,WAAW,GAAG,OAAO,EAAE,QAAQ,uBAAuB,OAAO,EAAE,OAAO,QAAQ,EAAE,EAAE;AAAA,MACzJ,EAAE,KAAK,SAAS,iBAAiB,aAAa,WAAW,GAAG,OAAO,EAAE,QAAQ,uBAAuB,iBAAiB,GAAG,EAAE;AAAA,MAC1H,SAAS,GAAG,YAAY,KAAK,EAAE,OAAQ,cAAc,KAAK,EAAE,MAAO,YAAY,GAAG,cAAc,KAAK,KAAK,IAAI,EAAE,MAAO,cAAc,GAAG,SAAS,IAAI,OAAK,EAAE,OAAO,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;AAAA,MAClL,EAAE,KAAK,oBAAoB,iBAAiB,QAAQ,KAAK,OAAK,EAAE,QAAQ,kBAAkB,GAAG,WAAW,GAAG,OAAO,EAAE,QAAQ,uBAAuB,QAAQ,IAAI,QAAQ,EAAE,QAAQ,GAAG,EAAE;AAAA,MACtL,SAAS,MAAM,aAAa,KAAK,KAAK,UAAY,EAAE,qBAAqB,QAAQ,EAAC,SAAS,MAAK,IAAI,CAAC,EAAG,CAAC;AAAA,IAC7G;AAAA,IACA,IAAI;AAAA,MACA,MAAM,MAAM,SAAS,OAAO;AAAA,MAC5B,OAAO,IAAI,KAAK,MAAM,cAAc,MAAM,WAAW,MAAM,CAAC;AAAA,MAEhE,OAAO,GAAG;AAAA,MACN,IAAI,CAAC,4BAA4B,CAAC;AAAA,QAC9B,MAAM;AAAA;AAAA,EAElB;AAAA,EACA,OAAO,KAAK,oBAAoB,GAAG;AAAA;AAEvC,IAAe,oBAAE,eAAe,qBAAqB,iBAAiB;AAAA,EAAE,MAAM;AAAA,EAAY;AAAA,EAClF,SAAS,CAAC,EAAE,MAAM,YAAY,OAAO,qBAAqB,QAAQ,MAAM,GAAG,EAAE,MAAM,YAAY,OAAO,gBAAgB,QAAQ,KAAK,GAAG,EAAE,MAAM,wBAAwB,OAAO,oBAAoB,QAAQ,KAAK,GAAG,EAAE,MAAM,UAAU,OAAO,mBAAmB,QAAQ,MAAM,GAAG,EAAE,MAAM,oBAAoB,OAAO,sDAAsD,QAAQ,MAAM,CAAC;AAAA,EAAG,SAAS;AAAgB,EAAE;",
+  "debugId": "5FEFB6DCD014AEAE64756E2164756E21",
   "names": []
 }