@multiplatform.one/auth 7.7.2

package/dist/esm/index.mjs

@@ -0,0 +1,336 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { betterAuth, matchesHostPattern } from "better-auth";
+import { APIError, createAuthEndpoint, createAuthMiddleware, getSessionFromCtx, isAPIError } from "better-auth/api";
+import { deleteSessionCookie, getAccountCookie } from "better-auth/cookies";
+import { genericOAuth, keycloak } from "better-auth/plugins";
+import { expo } from "@better-auth/expo";
+import { FAILED_TO_GET_ACCESS_TOKEN, TOKEN_REFRESH_UNAVAILABLE } from "./accessTokenRefresh.mjs";
+import { ACCESS_TOKEN_RETRY_DELAYS_MS, FAILED_TO_GET_ACCESS_TOKEN as FAILED_TO_GET_ACCESS_TOKEN2, TOKEN_REFRESH_UNAVAILABLE as TOKEN_REFRESH_UNAVAILABLE2, classifyAccessTokenResponse, retryWhileTransient, watchDocumentVisible } from "./accessTokenRefresh.mjs";
+const requestOriginStorage = new AsyncLocalStorage();
+function deriveRequestOrigin(req) {
+  const isDevHost = host => DEV_LAN_HOST_PATTERNS.some(pattern => matchesHostPattern(host, pattern));
+  const forwardedHost = req.headers.get("x-forwarded-host");
+  if (forwardedHost && isDevHost(forwardedHost)) {
+    const proto = req.headers.get("x-forwarded-proto") === "https" ? "https" : "http";
+    return `${proto}://${forwardedHost}`;
+  }
+  const originHeader = req.headers.get("origin");
+  if (originHeader) {
+    try {
+      const url = new URL(originHeader);
+      if (isDevHost(url.host)) return url.origin;
+    } catch {}
+  }
+  try {
+    return new URL(req.url).origin;
+  } catch {
+    return void 0;
+  }
+}
+const DEV_LAN_HOST_PATTERNS = ["localhost", "localhost:*", "127.0.0.1", "127.0.0.1:*", "10.*", "192.168.*", "172.*", "*.local", "*.local:*"];
+function createKeycloakSsoPlugin(options) {
+  const {
+    realm,
+    clientId,
+    clientSecret,
+    issuer,
+    baseUrl,
+    publicKeycloakBaseFor
+  } = options;
+  const tokenEndpoint = `${issuer}/protocol/openid-connect/token`;
+  const resolveVisitorOrigin = request => requestOriginStorage.getStore() ?? (request ? deriveRequestOrigin(request) : void 0);
+  const isRefreshDefinitivelyDead = async refreshToken => {
+    try {
+      const res = await fetch(tokenEndpoint, {
+        method: "POST",
+        headers: {
+          "content-type": "application/x-www-form-urlencoded"
+        },
+        body: new URLSearchParams({
+          grant_type: "refresh_token",
+          refresh_token: refreshToken,
+          client_id: clientId,
+          client_secret: clientSecret
+        }),
+        signal: AbortSignal.timeout(5e3)
+      });
+      if (res.ok) return false;
+      if (res.status !== 400 && res.status !== 401) return false;
+      const body = await res.json().catch(() => null);
+      return body?.error === "invalid_grant" || body?.error === "invalid_token";
+    } catch {
+      return false;
+    }
+  };
+  const signOutSso = createAuthEndpoint("/sign-out/sso", {
+    method: "GET"
+  }, async ctx => {
+    const visitorOrigin = resolveVisitorOrigin(ctx.request) ?? baseUrl;
+    const searchParams = ctx.request ? new URL(ctx.request.url).searchParams : void 0;
+    const rawCallback = searchParams?.get("callbackURL") ?? null;
+    const jsonMode = searchParams?.get("mode") === "json";
+    const answer = (url, redirect) => {
+      if (jsonMode) return ctx.json({
+        redirect,
+        url
+      });
+      throw ctx.redirect(url);
+    };
+    const callbackURL = rawCallback || "/";
+    const postLogoutRedirect = callbackURL.startsWith("/") ? `${visitorOrigin}${callbackURL}` : callbackURL;
+    let idTokenHint;
+    const sessionToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
+    const session = await getSessionFromCtx(ctx).catch(() => null);
+    if (session) {
+      const accounts = await ctx.context.internalAdapter.findAccounts(session.user.id).catch(() => []);
+      idTokenHint = accounts.find(account => account.providerId === "keycloak")?.idToken ?? void 0;
+    }
+    if (!idTokenHint) {
+      const accountCookie = await getAccountCookie(ctx).catch(() => null);
+      if (accountCookie?.providerId === "keycloak" && accountCookie.idToken) {
+        idTokenHint = accountCookie.idToken;
+      }
+    }
+    if (sessionToken) {
+      await ctx.context.internalAdapter.deleteSession(sessionToken).catch(error => {
+        ctx.context.logger.error("Failed to delete session during SSO sign-out", error);
+      });
+    }
+    deleteSessionCookie(ctx);
+    const keycloakBase = publicKeycloakBaseFor(visitorOrigin);
+    if (!keycloakBase || !session && !idTokenHint && !sessionToken) {
+      return answer(postLogoutRedirect, false);
+    }
+    const endSession = new URL(`${keycloakBase}/realms/${realm}/protocol/openid-connect/logout`);
+    endSession.searchParams.set("post_logout_redirect_uri", postLogoutRedirect);
+    endSession.searchParams.set("client_id", clientId);
+    if (idTokenHint) endSession.searchParams.set("id_token_hint", idTokenHint);
+    return answer(endSession.toString(), true);
+  });
+  return {
+    id: "keycloak-sso",
+    endpoints: {
+      signOutSso
+    },
+    hooks: {
+      after: [{
+        matcher: ctx => ctx.path === "/get-access-token",
+        handler: createAuthMiddleware(async ctx => {
+          const returned = ctx.context.returned;
+          if (!isAPIError(returned)) return;
+          const body = returned.body;
+          if (body?.code !== FAILED_TO_GET_ACCESS_TOKEN) return;
+          const providerId = ctx.body?.providerId;
+          if (providerId && providerId !== "keycloak") return;
+          const session = await getSessionFromCtx(ctx).catch(() => null);
+          if (!session) return;
+          const accounts = await ctx.context.internalAdapter.findAccounts(session.user.id).catch(() => []);
+          let refreshToken = accounts.find(account => account.providerId === "keycloak")?.refreshToken;
+          if (!refreshToken) {
+            const accountCookie = await getAccountCookie(ctx).catch(() => null);
+            if (accountCookie?.providerId === "keycloak") {
+              refreshToken = accountCookie.refreshToken;
+            }
+          }
+          const definitive = refreshToken ? await isRefreshDefinitivelyDead(refreshToken) : true;
+          if (!definitive) {
+            return new APIError("INTERNAL_SERVER_ERROR", {
+              message: "Keycloak token refresh temporarily unavailable",
+              code: TOKEN_REFRESH_UNAVAILABLE
+            });
+          }
+          ctx.context.logger.warn("Keycloak refresh token is dead (invalid_grant); revoking the stale Better Auth session");
+          const sessionToken = await ctx.getSignedCookie(ctx.context.authCookies.sessionToken.name, ctx.context.secret);
+          if (sessionToken) {
+            await ctx.context.internalAdapter.deleteSession(sessionToken).catch(error => {
+              ctx.context.logger.error("Failed to delete stale session", error);
+            });
+          }
+          deleteSessionCookie(ctx);
+          const headers = new Headers();
+          const accumulated = ctx.responseHeaders;
+          accumulated?.getSetCookie().forEach(cookie => {
+            headers.append("set-cookie", cookie);
+          });
+          return new APIError("BAD_REQUEST", {
+            message: body?.message || "Failed to get a valid access token",
+            code: FAILED_TO_GET_ACCESS_TOKEN
+          }, headers);
+        })
+      }]
+    }
+  };
+}
+function createAuth(options = {}) {
+  const baseUrl = options.baseUrl || process.env.BASE_URL || `http://localhost:${process.env.ONE_PORT || "3000"}`;
+  const isProduction = process.env.NODE_ENV === "production";
+  const keycloakBaseUrl = options.keycloak?.baseUrl || process.env.KEYCLOAK_BACKCHANNEL_URL || `${baseUrl}/auth`;
+  const keycloakRealm = options.keycloak?.realm || process.env.KEYCLOAK_REALM || "master";
+  const issuer = `${keycloakBaseUrl}/realms/${keycloakRealm}`;
+  const keycloakClientId = options.keycloak?.clientId || process.env.KEYCLOAK_CLIENT_ID || "";
+  const keycloakClientSecret = options.keycloak?.clientSecret || process.env.KEYCLOAK_CLIENT_SECRET || "";
+  const expoPlugin = options.enableExpo !== false ? expo() : void 0;
+  const basePath = options.basePath || "/api/auth";
+  const keycloakProviderConfig = {
+    ...keycloak({
+      clientId: keycloakClientId,
+      clientSecret: keycloakClientSecret,
+      issuer
+    }),
+    // Backchannel token/userinfo: `/get-access-token` refresh keeps these
+    // when discovery fails (Keycloak restart), so we don't depend on the
+    // well-known document coming up in the same instant as the token
+    // endpoint. Browser-facing authorize/issuer stay on the public /auth
+    // proxy (getters below).
+    tokenUrl: `${issuer}/protocol/openid-connect/token`,
+    userInfoUrl: `${issuer}/protocol/openid-connect/userinfo`,
+    // Wallet (SIWE-style) users authenticate by signature and have NO email —
+    // Keycloak issues them a username = wallet address and no email claim.
+    // better-auth's genericOAuth callback hard-rejects a user with no email
+    // ("email_is_missing"), so synthesize a stable, unique placeholder from the
+    // wallet address / subject. `.wallet` is a non-routable placeholder domain;
+    // the address stays the stable identity.
+    mapProfileToUser: profile => {
+      const handle = profile.preferred_username || profile.sub || profile.id || profile.name;
+      const email = profile.email || (handle ? `${handle}@wallet` : void 0);
+      return {
+        ...profile,
+        email,
+        emailVerified: profile.email_verified ?? true,
+        name: profile.name || handle
+      };
+    }
+  };
+  const keycloakPublicPath = (() => {
+    try {
+      const path = new URL(keycloakBaseUrl).pathname.replace(/\/+$/, "");
+      return path && path !== "/" ? path : void 0;
+    } catch {
+      return void 0;
+    }
+  })();
+  const publicKeycloakBaseFor = requestOrigin => {
+    if (!keycloakPublicPath) return keycloakBaseUrl;
+    try {
+      const url = new URL(baseUrl);
+      if (!isProduction && requestOrigin) {
+        url.hostname = new URL(requestOrigin).hostname;
+      }
+      return `${url.origin}${keycloakPublicPath}`;
+    } catch {
+      return void 0;
+    }
+  };
+  if (!isProduction) {
+    Object.defineProperty(keycloakProviderConfig, "redirectURI", {
+      enumerable: true,
+      get() {
+        const origin = requestOriginStorage.getStore();
+        return origin ? `${origin}${basePath}/oauth2/callback/keycloak` : void 0;
+      }
+    });
+    const keycloakPublicBase = () => {
+      const origin = requestOriginStorage.getStore();
+      if (!origin || !keycloakPublicPath) return void 0;
+      return publicKeycloakBaseFor(origin);
+    };
+    if (keycloakPublicPath) {
+      Object.defineProperty(keycloakProviderConfig, "authorizationUrl", {
+        enumerable: true,
+        get() {
+          const base = keycloakPublicBase();
+          return base ? `${base}/realms/${keycloakRealm}/protocol/openid-connect/auth` : void 0;
+        }
+      });
+      Object.defineProperty(keycloakProviderConfig, "issuer", {
+        enumerable: true,
+        get() {
+          const base = keycloakPublicBase();
+          return base ? `${base}/realms/${keycloakRealm}` : void 0;
+        }
+      });
+    }
+  }
+  const oauthPlugin = genericOAuth({
+    config: [keycloakProviderConfig]
+  });
+  const keycloakSsoPlugin = createKeycloakSsoPlugin({
+    realm: keycloakRealm,
+    clientId: keycloakClientId,
+    clientSecret: keycloakClientSecret,
+    issuer,
+    baseUrl,
+    publicKeycloakBaseFor
+  });
+  const plugins = [...(expoPlugin ? [expoPlugin] : []), oauthPlugin, keycloakSsoPlugin, ...(options.plugins ?? [])];
+  const database = options.database ?? (process.env.DATABASE_URL || void 0);
+  return betterAuth({
+    basePath,
+    // Static on purpose: better-auth's dynamic `baseURL` config (allowedHosts)
+    // is not honored by the genericOAuth plugin — it pins redirect URIs at
+    // init time, which turned them relative and bounced callbacks to the
+    // Keycloak host. Dev multi-host support comes from the per-request
+    // redirectURI getter above + the LAN trustedOrigins below instead.
+    baseURL: baseUrl,
+    ...(database ? {
+      database
+    } : {}),
+    secret: options.secret || process.env.SECRET || "",
+    trustedOrigins: options.trustedOrigins || [baseUrl, keycloakBaseUrl,
+    // In dev, ONE_PORT may differ from BASE_URL; ensure the dev server origin is trusted.
+    ...(process.env.ONE_PORT && !baseUrl.includes(`:${process.env.ONE_PORT}`) ? [`http://localhost:${process.env.ONE_PORT}`] : []), "multiplatform-one://",
+    // Expo Go (dev) receives OAuth returns on the exp:// scheme — the app
+    // derives its callbackURL via Linking.createURL, which yields
+    // exp://<host>:<port>/--/ there. Never trusted in production builds.
+    // Dev also trusts private-network origins (see DEV_LAN_HOST_PATTERNS)
+    // so sign-in from a phone / the machine's LAN IP is not rejected.
+    ...(isProduction ? [] : ["exp://", ...DEV_LAN_HOST_PATTERNS.map(host => `http://${host}`)])],
+    session: {
+      cookieCache: {
+        enabled: true,
+        maxAge: options.sessionMaxAge ?? 7 * 24 * 60 * 60,
+        strategy: "jwe",
+        refreshCache: true
+      }
+    },
+    account: {
+      storeStateStrategy: "cookie",
+      storeAccountCookie: true
+    },
+    plugins
+  });
+}
+function createAuthRouteHandler(auth) {
+  const handler = req => {
+    const origin = deriveRequestOrigin(req);
+    return origin ? requestOriginStorage.run(origin, () => auth.handler(req)) : auth.handler(req);
+  };
+  return {
+    GET: handler,
+    POST: handler
+  };
+}
+function createSessionHelpers(auth) {
+  async function getSession(req) {
+    return auth.api.getSession({
+      headers: req.headers
+    });
+  }
+  async function verifyAuth(req) {
+    const session = await auth.api.getSession({
+      headers: req.headers
+    });
+    if (!session) {
+      throw new Response("Unauthorized", {
+        status: 401
+      });
+    }
+    return session;
+  }
+  return {
+    verifyAuth,
+    getSession
+  };
+}
+export { ACCESS_TOKEN_RETRY_DELAYS_MS, FAILED_TO_GET_ACCESS_TOKEN2 as FAILED_TO_GET_ACCESS_TOKEN, TOKEN_REFRESH_UNAVAILABLE2 as TOKEN_REFRESH_UNAVAILABLE, classifyAccessTokenResponse, createAuth, createAuthRouteHandler, createSessionHelpers, retryWhileTransient, watchDocumentVisible };
+//# sourceMappingURL=index.mjs.map

package/dist/esm/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"names":["AsyncLocalStorage","betterAuth","matchesHostPattern","APIError","createAuthEndpoint","createAuthMiddleware","getSessionFromCtx","isAPIError","deleteSessionCookie","getAccountCookie","genericOAuth","keycloak","expo","FAILED_TO_GET_ACCESS_TOKEN","TOKEN_REFRESH_UNAVAILABLE","ACCESS_TOKEN_RETRY_DELAYS_MS","FAILED_TO_GET_ACCESS_TOKEN2","TOKEN_REFRESH_UNAVAILABLE2","classifyAccessTokenResponse","retryWhileTransient","watchDocumentVisible","requestOriginStorage","deriveRequestOrigin","req","isDevHost","host","DEV_LAN_HOST_PATTERNS","some","pattern","forwardedHost","headers","get","proto","originHeader","url","URL","origin","createKeycloakSsoPlugin","options","realm","clientId","clientSecret","issuer","baseUrl","publicKeycloakBaseFor","tokenEndpoint","resolveVisitorOrigin","request","getStore","isRefreshDefinitivelyDead","refreshToken","res","fetch","method","body","URLSearchParams","grant_type","refresh_token","client_id","client_secret","signal","AbortSignal","timeout","ok","status","json","catch","error","signOutSso","ctx","visitorOrigin","searchParams","rawCallback","jsonMode","answer","redirect","callbackURL","postLogoutRedirect","startsWith","idTokenHint","sessionToken","getSignedCookie","context","authCookies","name","secret","session","accounts","internalAdapter","findAccounts","user","id","find","account","providerId","idToken","accountCookie","deleteSession","logger","keycloakBase","endSession","set","toString","endpoints","hooks","after","matcher","path","handler","returned","code","definitive","message","warn","Headers","accumulated","responseHeaders","getSetCookie","forEach","cookie","append","createAuth","process","env","BASE_URL","ONE_PORT","isProduction","NODE_ENV","keycloakBaseUrl","KEYCLOAK_BACKCHANNEL_URL","keycloakRealm","KEYCLOAK_REALM","keycloakClientId","KEYCLOAK_CLIENT_ID","keycloakClientSecret","KEYCLOAK_CLIENT_SECRET","expoPlugin","enableExpo","basePath","keycloakProviderConfig","tokenUrl","userInfoUrl","mapProfileToUser","profile","handle","preferred_username","sub","email","emailVerified","email_verified","keycloakPublicPath","pathname","replace","requestOrigin","hostname","Object","defineProperty","enumerable","keycloakPublicBase","base","oauthPlugin","config","keycloakSsoPlugin","plugins","database","DATABASE_URL","baseURL","SECRET","trustedOrigins","includes","map","cookieCache","enabled","maxAge","sessionMaxAge","strategy","refreshCache","storeStateStrategy","storeAccountCookie","createAuthRouteHandler","auth","run","GET","POST","createSessionHelpers","getSession","api","verifyAuth","Response"],"sources":["../../src/index.ts"],"sourcesContent":[null],"mappings":"AAgBA,SAASA,iBAAA,QAAyB;AAClC,SAASC,UAAA,EAAYC,kBAAA,QAA0B;AAE/C,SACEC,QAAA,EACAC,kBAAA,EACAC,oBAAA,EACAC,iBAAA,EACAC,UAAA,QACK;AACP,SAASC,mBAAA,EAAqBC,gBAAA,QAAwB;AACtD,SAASC,YAAA,EAAcC,QAAA,QAAgB;AACvC,SAASC,IAAA,QAAY;AACrB,SAASC,0BAAA,EAA4BC,yBAAA,QAAiC;AAEtE,SACEC,4BAAA,EACAF,0BAAA,IAAAG,2BAAA,EACAF,yBAAA,IAAAG,0BAAA,EACAC,2BAAA,EACAC,mBAAA,EACAC,oBAAA,QACK;AAYP,MAAMC,oBAAA,GAAuB,IAAIrB,iBAAA,CAA0B;AAW3D,SAASsB,oBAAoBC,GAAA,EAAkC;EAC7D,MAAMC,SAAA,GAAaC,IAAA,IACjBC,qBAAA,CAAsBC,IAAA,CAAMC,OAAA,IAAY1B,kBAAA,CAAmBuB,IAAA,EAAMG,OAAO,CAAC;EAE3E,MAAMC,aAAA,GAAgBN,GAAA,CAAIO,OAAA,CAAQC,GAAA,CAAI,kBAAkB;EACxD,IAAIF,aAAA,IAAiBL,SAAA,CAAUK,aAAa,GAAG;IAC7C,MAAMG,KAAA,GAAQT,GAAA,CAAIO,OAAA,CAAQC,GAAA,CAAI,mBAAmB,MAAM,UAAU,UAAU;IAC3E,OAAO,GAAGC,KAAK,MAAMH,aAAa;EACpC;EAEA,MAAMI,YAAA,GAAeV,GAAA,CAAIO,OAAA,CAAQC,GAAA,CAAI,QAAQ;EAC7C,IAAIE,YAAA,EAAc;IAChB,IAAI;MACF,MAAMC,GAAA,GAAM,IAAIC,GAAA,CAAIF,YAAY;MAChC,IAAIT,SAAA,CAAUU,GAAA,CAAIT,IAAI,GAAG,OAAOS,GAAA,CAAIE,MAAA;IACtC,QAAQ,CAER;EACF;EAEA,IAAI;IACF,OAAO,IAAID,GAAA,CAAIZ,GAAA,CAAIW,GAAG,EAAEE,MAAA;EAC1B,QAAQ;IACN,OAAO;EACT;AACF;AAqDA,MAAMV,qBAAA,GAAwB,CAC5B,aACA,eACA,aACA,eACA,QACA,aACA,SACA,WACA,YACF;AAsDA,SAASW,wBAAwBC,OAAA,EAAmC;EAClE,MAAM;IAAEC,KAAA;IAAOC,QAAA;IAAUC,YAAA;IAAcC,MAAA;IAAQC,OAAA;IAASC;EAAsB,IAAIN,OAAA;EAClF,MAAMO,aAAA,GAAgB,GAAGH,MAAM;EAG/B,MAAMI,oBAAA,GAAwBC,OAAA,IAC5B1B,oBAAA,CAAqB2B,QAAA,CAAS,MAAMD,OAAA,GAAUzB,mBAAA,CAAoByB,OAAO,IAAI;EAQ/E,MAAME,yBAAA,GAA4B,MAAOC,YAAA,IAA2C;IAClF,IAAI;MACF,MAAMC,GAAA,GAAM,MAAMC,KAAA,CAAMP,aAAA,EAAe;QACrCQ,MAAA,EAAQ;QACRvB,OAAA,EAAS;UAAE,gBAAgB;QAAoC;QAC/DwB,IAAA,EAAM,IAAIC,eAAA,CAAgB;UACxBC,UAAA,EAAY;UACZC,aAAA,EAAeP,YAAA;UACfQ,SAAA,EAAWlB,QAAA;UACXmB,aAAA,EAAelB;QACjB,CAAC;QACDmB,MAAA,EAAQC,WAAA,CAAYC,OAAA,CAAQ,GAAI;MAClC,CAAC;MACD,IAAIX,GAAA,CAAIY,EAAA,EAAI,OAAO;MACnB,IAAIZ,GAAA,CAAIa,MAAA,KAAW,OAAOb,GAAA,CAAIa,MAAA,KAAW,KAAK,OAAO;MACrD,MAAMV,IAAA,GAAQ,MAAMH,GAAA,CAAIc,IAAA,CAAK,EAAEC,KAAA,CAAM,MAAM,IAAI;MAC/C,OAAOZ,IAAA,EAAMa,KAAA,KAAU,mBAAmBb,IAAA,EAAMa,KAAA,KAAU;IAC5D,QAAQ;MACN,OAAO;IACT;EACF;EAEA,MAAMC,UAAA,GAAahE,kBAAA,CAAmB,iBAAiB;IAAEiD,MAAA,EAAQ;EAAM,GAAG,MAAOgB,GAAA,IAAQ;IACvF,MAAMC,aAAA,GAAgBxB,oBAAA,CAAqBuB,GAAA,CAAItB,OAAO,KAAKJ,OAAA;IAC3D,MAAM4B,YAAA,GAAeF,GAAA,CAAItB,OAAA,GAAU,IAAIZ,GAAA,CAAIkC,GAAA,CAAItB,OAAA,CAAQb,GAAG,EAAEqC,YAAA,GAAe;IAC3E,MAAMC,WAAA,GAAcD,YAAA,EAAcxC,GAAA,CAAI,aAAa,KAAK;IAExD,MAAM0C,QAAA,GAAWF,YAAA,EAAcxC,GAAA,CAAI,MAAM,MAAM;IAC/C,MAAM2C,MAAA,GAASA,CAACxC,GAAA,EAAayC,QAAA,KAAsB;MACjD,IAAIF,QAAA,EAAU,OAAOJ,GAAA,CAAIJ,IAAA,CAAK;QAAEU,QAAA;QAAUzC;MAAI,CAAC;MAC/C,MAAMmC,GAAA,CAAIM,QAAA,CAASzC,GAAG;IACxB;IACA,MAAM0C,WAAA,GAAcJ,WAAA,IAAe;IAGnC,MAAMK,kBAAA,GAAqBD,WAAA,CAAYE,UAAA,CAAW,GAAG,IACjD,GAAGR,aAAa,GAAGM,WAAW,KAC9BA,WAAA;IAOJ,IAAIG,WAAA;IACJ,MAAMC,YAAA,GAAe,MAAMX,GAAA,CAAIY,eAAA,CAC7BZ,GAAA,CAAIa,OAAA,CAAQC,WAAA,CAAYH,YAAA,CAAaI,IAAA,EACrCf,GAAA,CAAIa,OAAA,CAAQG,MACd;IACA,MAAMC,OAAA,GAAU,MAAMhF,iBAAA,CAAkB+D,GAAG,EAAEH,KAAA,CAAM,MAAM,IAAI;IAC7D,IAAIoB,OAAA,EAAS;MACX,MAAMC,QAAA,GAAY,MAAMlB,GAAA,CAAIa,OAAA,CAAQM,eAAA,CACjCC,YAAA,CAAaH,OAAA,CAAQI,IAAA,CAAKC,EAAE,EAC5BzB,KAAA,CAAM,MAAM,EAAE;MACjBa,WAAA,GACEQ,QAAA,CAASK,IAAA,CAAMC,OAAA,IAAYA,OAAA,CAAQC,UAAA,KAAe,UAAU,GAAGC,OAAA,IAAW;IAC9E;IACA,IAAI,CAAChB,WAAA,EAAa;MAChB,MAAMiB,aAAA,GAAiB,MAAMvF,gBAAA,CAAiB4D,GAAG,EAAEH,KAAA,CACjD,MAAM,IACR;MACA,IAAI8B,aAAA,EAAeF,UAAA,KAAe,cAAcE,aAAA,CAAcD,OAAA,EAAS;QACrEhB,WAAA,GAAciB,aAAA,CAAcD,OAAA;MAC9B;IACF;IAEA,IAAIf,YAAA,EAAc;MAChB,MAAMX,GAAA,CAAIa,OAAA,CAAQM,eAAA,CAAgBS,aAAA,CAAcjB,YAAY,EAAEd,KAAA,CAAOC,KAAA,IAAmB;QACtFE,GAAA,CAAIa,OAAA,CAAQgB,MAAA,CAAO/B,KAAA,CAAM,gDAAgDA,KAAK;MAChF,CAAC;IACH;IACA3D,mBAAA,CAAoB6D,GAAG;IAOvB,MAAM8B,YAAA,GAAevD,qBAAA,CAAsB0B,aAAa;IACxD,IAAI,CAAC6B,YAAA,IAAiB,CAACb,OAAA,IAAW,CAACP,WAAA,IAAe,CAACC,YAAA,EAAe;MAChE,OAAON,MAAA,CAAOG,kBAAA,EAAoB,KAAK;IACzC;IAEA,MAAMuB,UAAA,GAAa,IAAIjE,GAAA,CAAI,GAAGgE,YAAY,WAAW5D,KAAK,iCAAiC;IAC3F6D,UAAA,CAAW7B,YAAA,CAAa8B,GAAA,CAAI,4BAA4BxB,kBAAkB;IAC1EuB,UAAA,CAAW7B,YAAA,CAAa8B,GAAA,CAAI,aAAa7D,QAAQ;IACjD,IAAIuC,WAAA,EAAaqB,UAAA,CAAW7B,YAAA,CAAa8B,GAAA,CAAI,iBAAiBtB,WAAW;IACzE,OAAOL,MAAA,CAAO0B,UAAA,CAAWE,QAAA,CAAS,GAAG,IAAI;EAC3C,CAAC;EAED,OAAO;IACLX,EAAA,EAAI;IACJY,SAAA,EAAW;MACTnC;IACF;IACAoC,KAAA,EAAO;MACLC,KAAA,EAAO,CACL;QACEC,OAAA,EAAUrC,GAAA,IAAQA,GAAA,CAAIsC,IAAA,KAAS;QAC/BC,OAAA,EAASvG,oBAAA,CAAqB,MAAOgE,GAAA,IAAQ;UAC3C,MAAMwC,QAAA,GAAWxC,GAAA,CAAIa,OAAA,CAAQ2B,QAAA;UAC7B,IAAI,CAACtG,UAAA,CAAWsG,QAAQ,GAAG;UAC3B,MAAMvD,IAAA,GAAOuD,QAAA,CAASvD,IAAA;UACtB,IAAIA,IAAA,EAAMwD,IAAA,KAASjG,0BAAA,EAA4B;UAC/C,MAAMiF,UAAA,GAAczB,GAAA,CAAIf,IAAA,EAA8CwC,UAAA;UACtE,IAAIA,UAAA,IAAcA,UAAA,KAAe,YAAY;UAE7C,MAAMR,OAAA,GAAU,MAAMhF,iBAAA,CAAkB+D,GAAG,EAAEH,KAAA,CAAM,MAAM,IAAI;UAC7D,IAAI,CAACoB,OAAA,EAAS;UAKd,MAAMC,QAAA,GAAY,MAAMlB,GAAA,CAAIa,OAAA,CAAQM,eAAA,CACjCC,YAAA,CAAaH,OAAA,CAAQI,IAAA,CAAKC,EAAE,EAC5BzB,KAAA,CAAM,MAAM,EAAE;UACjB,IAAIhB,YAAA,GAAeqC,QAAA,CAASK,IAAA,CACzBC,OAAA,IAAYA,OAAA,CAAQC,UAAA,KAAe,UACtC,GAAG5C,YAAA;UACH,IAAI,CAACA,YAAA,EAAc;YACjB,MAAM8C,aAAA,GAAiB,MAAMvF,gBAAA,CAAiB4D,GAAG,EAAEH,KAAA,CACjD,MAAM,IACR;YACA,IAAI8B,aAAA,EAAeF,UAAA,KAAe,YAAY;cAC5C5C,YAAA,GAAe8C,aAAA,CAAc9C,YAAA;YAC/B;UACF;UACA,MAAM6D,UAAA,GAAa7D,YAAA,GAAe,MAAMD,yBAAA,CAA0BC,YAAY,IAAI;UAClF,IAAI,CAAC6D,UAAA,EAAY;YAIf,OAAO,IAAI5G,QAAA,CAAS,yBAAyB;cAC3C6G,OAAA,EAAS;cACTF,IAAA,EAAMhG;YACR,CAAC;UACH;UAEAuD,GAAA,CAAIa,OAAA,CAAQgB,MAAA,CAAOe,IAAA,CACjB,wFACF;UACA,MAAMjC,YAAA,GAAe,MAAMX,GAAA,CAAIY,eAAA,CAC7BZ,GAAA,CAAIa,OAAA,CAAQC,WAAA,CAAYH,YAAA,CAAaI,IAAA,EACrCf,GAAA,CAAIa,OAAA,CAAQG,MACd;UACA,IAAIL,YAAA,EAAc;YAChB,MAAMX,GAAA,CAAIa,OAAA,CAAQM,eAAA,CACfS,aAAA,CAAcjB,YAAY,EAC1Bd,KAAA,CAAOC,KAAA,IAAmB;cACzBE,GAAA,CAAIa,OAAA,CAAQgB,MAAA,CAAO/B,KAAA,CAAM,kCAAkCA,KAAK;YAClE,CAAC;UACL;UACA3D,mBAAA,CAAoB6D,GAAG;UAKvB,MAAMvC,OAAA,GAAU,IAAIoF,OAAA,CAAQ;UAC5B,MAAMC,WAAA,GAAe9C,GAAA,CAAiD+C,eAAA;UACtED,WAAA,EAAaE,YAAA,CAAa,EAAEC,OAAA,CAASC,MAAA,IAAW;YAC9CzF,OAAA,CAAQ0F,MAAA,CAAO,cAAcD,MAAM;UACrC,CAAC;UACD,OAAO,IAAIpH,QAAA,CACT,eACA;YACE6G,OAAA,EAAS1D,IAAA,EAAM0D,OAAA,IAAW;YAC1BF,IAAA,EAAMjG;UACR,GACAiB,OACF;QACF,CAAC;MACH;IAEJ;EACF;AACF;AAMO,SAAS2F,WAAWnF,OAAA,GAA6B,CAAC,GAAG;EAC1D,MAAMK,OAAA,GACJL,OAAA,CAAQK,OAAA,IAAW+E,OAAA,CAAQC,GAAA,CAAIC,QAAA,IAAY,oBAAoBF,OAAA,CAAQC,GAAA,CAAIE,QAAA,IAAY,MAAM;EAC/F,MAAMC,YAAA,GAAeJ,OAAA,CAAQC,GAAA,CAAII,QAAA,KAAa;EAI9C,MAAMC,eAAA,GACJ1F,OAAA,CAAQ3B,QAAA,EAAUgC,OAAA,IAAW+E,OAAA,CAAQC,GAAA,CAAIM,wBAAA,IAA4B,GAAGtF,OAAO;EACjF,MAAMuF,aAAA,GAAgB5F,OAAA,CAAQ3B,QAAA,EAAU4B,KAAA,IAASmF,OAAA,CAAQC,GAAA,CAAIQ,cAAA,IAAkB;EAC/E,MAAMzF,MAAA,GAAS,GAAGsF,eAAe,WAAWE,aAAa;EAEzD,MAAME,gBAAA,GAAmB9F,OAAA,CAAQ3B,QAAA,EAAU6B,QAAA,IAAYkF,OAAA,CAAQC,GAAA,CAAIU,kBAAA,IAAsB;EACzF,MAAMC,oBAAA,GACJhG,OAAA,CAAQ3B,QAAA,EAAU8B,YAAA,IAAgBiF,OAAA,CAAQC,GAAA,CAAIY,sBAAA,IAA0B;EAE1E,MAAMC,UAAA,GAAalG,OAAA,CAAQmG,UAAA,KAAe,QAAQ7H,IAAA,CAAK,IAAI;EAE3D,MAAM8H,QAAA,GAAWpG,OAAA,CAAQoG,QAAA,IAAY;EAErC,MAAMC,sBAAA,GAAyB;IAC7B,GAAGhI,QAAA,CAAS;MACV6B,QAAA,EAAU4F,gBAAA;MACV3F,YAAA,EAAc6F,oBAAA;MACd5F;IACF,CAAC;IAAA;IAAA;IAAA;IAAA;IAAA;IAMDkG,QAAA,EAAU,GAAGlG,MAAM;IACnBmG,WAAA,EAAa,GAAGnG,MAAM;IAAA;IAAA;IAAA;IAAA;IAAA;IAAA;IAOtBoG,gBAAA,EAAmBC,OAAA,IAAiC;MAClD,MAAMC,MAAA,GAASD,OAAA,CAAQE,kBAAA,IAAsBF,OAAA,CAAQG,GAAA,IAAOH,OAAA,CAAQpD,EAAA,IAAMoD,OAAA,CAAQ3D,IAAA;MAClF,MAAM+D,KAAA,GAAQJ,OAAA,CAAQI,KAAA,KAAUH,MAAA,GAAS,GAAGA,MAAM,YAAY;MAC9D,OAAO;QACL,GAAGD,OAAA;QACHI,KAAA;QACAC,aAAA,EAAeL,OAAA,CAAQM,cAAA,IAAkB;QACzCjE,IAAA,EAAM2D,OAAA,CAAQ3D,IAAA,IAAQ4D;MACxB;IACF;EACF;EAGA,MAAMM,kBAAA,IAAsB,MAAM;IAChC,IAAI;MACF,MAAM3C,IAAA,GAAO,IAAIxE,GAAA,CAAI6F,eAAe,EAAEuB,QAAA,CAASC,OAAA,CAAQ,QAAQ,EAAE;MACjE,OAAO7C,IAAA,IAAQA,IAAA,KAAS,MAAMA,IAAA,GAAO;IACvC,QAAQ;MACN,OAAO;IACT;EACF,GAAG;EASH,MAAM/D,qBAAA,GAAyB6G,aAAA,IAA+C;IAC5E,IAAI,CAACH,kBAAA,EAAoB,OAAOtB,eAAA;IAChC,IAAI;MACF,MAAM9F,GAAA,GAAM,IAAIC,GAAA,CAAIQ,OAAO;MAC3B,IAAI,CAACmF,YAAA,IAAgB2B,aAAA,EAAe;QAClCvH,GAAA,CAAIwH,QAAA,GAAW,IAAIvH,GAAA,CAAIsH,aAAa,EAAEC,QAAA;MACxC;MACA,OAAO,GAAGxH,GAAA,CAAIE,MAAM,GAAGkH,kBAAkB;IAC3C,QAAQ;MACN,OAAO;IACT;EACF;EAEA,IAAI,CAACxB,YAAA,EAAc;IAQjB6B,MAAA,CAAOC,cAAA,CAAejB,sBAAA,EAAwB,eAAe;MAC3DkB,UAAA,EAAY;MACZ9H,IAAA,EAAM;QACJ,MAAMK,MAAA,GAASf,oBAAA,CAAqB2B,QAAA,CAAS;QAC7C,OAAOZ,MAAA,GAAS,GAAGA,MAAM,GAAGsG,QAAQ,8BAA8B;MACpE;IACF,CAAC;IAsBD,MAAMoB,kBAAA,GAAqBA,CAAA,KAA0B;MACnD,MAAM1H,MAAA,GAASf,oBAAA,CAAqB2B,QAAA,CAAS;MAC7C,IAAI,CAACZ,MAAA,IAAU,CAACkH,kBAAA,EAAoB,OAAO;MAC3C,OAAO1G,qBAAA,CAAsBR,MAAM;IACrC;IACA,IAAIkH,kBAAA,EAAoB;MACtBK,MAAA,CAAOC,cAAA,CAAejB,sBAAA,EAAwB,oBAAoB;QAChEkB,UAAA,EAAY;QACZ9H,IAAA,EAAM;UACJ,MAAMgI,IAAA,GAAOD,kBAAA,CAAmB;UAChC,OAAOC,IAAA,GAAO,GAAGA,IAAI,WAAW7B,aAAa,kCAAkC;QACjF;MACF,CAAC;MAQDyB,MAAA,CAAOC,cAAA,CAAejB,sBAAA,EAAwB,UAAU;QACtDkB,UAAA,EAAY;QACZ9H,IAAA,EAAM;UACJ,MAAMgI,IAAA,GAAOD,kBAAA,CAAmB;UAChC,OAAOC,IAAA,GAAO,GAAGA,IAAI,WAAW7B,aAAa,KAAK;QACpD;MACF,CAAC;IACH;EACF;EAIA,MAAM8B,WAAA,GAActJ,YAAA,CAAa;IAC/BuJ,MAAA,EAAQ,CAACtB,sBAA8E;EACzF,CAAC;EAED,MAAMuB,iBAAA,GAAoB7H,uBAAA,CAAwB;IAChDE,KAAA,EAAO2F,aAAA;IACP1F,QAAA,EAAU4F,gBAAA;IACV3F,YAAA,EAAc6F,oBAAA;IACd5F,MAAA;IACAC,OAAA;IACAC;EACF,CAAC;EAED,MAAMuH,OAAA,GAAiB,CACrB,IAAI3B,UAAA,GAAa,CAACA,UAAU,IAAI,EAAC,GACjCwB,WAAA,EACAE,iBAAA,EACA,IAAI5H,OAAA,CAAQ6H,OAAA,IAAW,EAAC,EAC1B;EAIA,MAAMC,QAAA,GAAW9H,OAAA,CAAQ8H,QAAA,KAAa1C,OAAA,CAAQC,GAAA,CAAI0C,YAAA,IAAgB;EAElE,OAAOpK,UAAA,CAAW;IAChByI,QAAA;IAAA;IAAA;IAAA;IAAA;IAAA;IAMA4B,OAAA,EAAS3H,OAAA;IACT,IAAIyH,QAAA,GAAW;MAAEA;IAAS,IAAI,CAAC;IAC/B/E,MAAA,EAAQ/C,OAAA,CAAQ+C,MAAA,IAAUqC,OAAA,CAAQC,GAAA,CAAI4C,MAAA,IAAU;IAChDC,cAAA,EAAgBlI,OAAA,CAAQkI,cAAA,IAAkB,CACxC7H,OAAA,EACAqF,eAAA;IAAA;IAEA,IAAIN,OAAA,CAAQC,GAAA,CAAIE,QAAA,IAAY,CAAClF,OAAA,CAAQ8H,QAAA,CAAS,IAAI/C,OAAA,CAAQC,GAAA,CAAIE,QAAQ,EAAE,IACpE,CAAC,oBAAoBH,OAAA,CAAQC,GAAA,CAAIE,QAAQ,EAAE,IAC3C,EAAC,GACL;IAAA;IAAA;IAAA;IAAA;IAAA;IAMA,IAAIC,YAAA,GAAe,EAAC,GAAI,CAAC,UAAU,GAAGpG,qBAAA,CAAsBgJ,GAAA,CAAKjJ,IAAA,IAAS,UAAUA,IAAI,EAAE,CAAC,GAC7F;IACA6D,OAAA,EAAS;MACPqF,WAAA,EAAa;QACXC,OAAA,EAAS;QACTC,MAAA,EAAQvI,OAAA,CAAQwI,aAAA,IAAiB,IAAI,KAAK,KAAK;QAC/CC,QAAA,EAAU;QACVC,YAAA,EAAc;MAChB;IACF;IACAnF,OAAA,EAAS;MACPoF,kBAAA,EAAoB;MACpBC,kBAAA,EAAoB;IACtB;IACAf;EACF,CAAC;AACH;AAmBO,SAASgB,uBAAuBC,IAAA,EAAgB;EAKrD,MAAMxE,OAAA,GAAWrF,GAAA,IAAiB;IAChC,MAAMa,MAAA,GAASd,mBAAA,CAAoBC,GAAG;IACtC,OAAOa,MAAA,GAASf,oBAAA,CAAqBgK,GAAA,CAAIjJ,MAAA,EAAQ,MAAMgJ,IAAA,CAAKxE,OAAA,CAAQrF,GAAG,CAAC,IAAI6J,IAAA,CAAKxE,OAAA,CAAQrF,GAAG;EAC9F;EACA,OAAO;IAAE+J,GAAA,EAAK1E,OAAA;IAAS2E,IAAA,EAAM3E;EAAQ;AACvC;AASO,SAAS4E,qBAAqBJ,IAAA,EAAgB;EAEnD,eAAeK,WAAWlK,GAAA,EAAc;IACtC,OAAO6J,IAAA,CAAKM,GAAA,CAAID,UAAA,CAAW;MAAE3J,OAAA,EAASP,GAAA,CAAIO;IAAQ,CAAC;EACrD;EAGA,eAAe6J,WAAWpK,GAAA,EAAc;IACtC,MAAM+D,OAAA,GAAU,MAAM8F,IAAA,CAAKM,GAAA,CAAID,UAAA,CAAW;MAAE3J,OAAA,EAASP,GAAA,CAAIO;IAAQ,CAAC;IAClE,IAAI,CAACwD,OAAA,EAAS;MACZ,MAAM,IAAIsG,QAAA,CAAS,gBAAgB;QAAE5H,MAAA,EAAQ;MAAI,CAAC;IACpD;IACA,OAAOsB,OAAA;EACT;EAEA,OAAO;IAAEqG,UAAA;IAAYF;EAAW;AAClC","ignoreList":[]}