@nestjs-kit/better-auth 0.0.0-stage → 2.1.0

package/dist/testing/conformance.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.mjs","names":["sessionToken","request","nodeRequest","staticMember","kitModule","json","variantOf","harness","withHarness","sessionReads","API_KEY_KIND","SESSION_KIND","API_KEY_KIND","createKey","withHarness","variantOf","withHarness","sessionReads","variantOf","policyHarness"],"sources":["../../src/database-hook-dispatcher.ts","../../src/hook-dispatcher.ts","../../src/plugin.ts","../../src/conformance-fixtures.ts","../../src/conformance-http.ts","../../src/conformance-policy-harness.ts","../../src/conformance-policy-units.ts","../../src/conformance-policy.ts","../../src/conformance-principal.ts","../../src/conformance-transport.ts"],"sourcesContent":["import type { BetterAuthOptions } from \"better-auth\";\nimport type { DatabaseHookTarget } from \"./auth-contracts.js\";\nimport type {\n  DatabaseHookData,\n  DatabaseHookResult,\n  DbHookFn,\n} from \"./auth-types.js\";\nimport type { BridgeBinding } from \"./bridge-protocol.js\";\n\n/**\n * Construct all dispatchers once; bindings supply only the late-bound methods.\n *\n * The dispatchers take the SDK's own parameter types, so they satisfy `databaseHooks` whatever\n * instance the program registers. Bound hooks declare `DatabaseHookData`, which adds the\n * registered instance's plugin and additional fields (for example admin()'s `banned`) to the\n * same rows; the dispatcher states that narrowing once when it forwards a payload.\n */\nexport function createDatabaseDispatchers(\n  getBinding: () => BridgeBinding | null,\n  countUnbound: () => void,\n): NonNullable<BetterAuthOptions[\"databaseHooks\"]> {\n  function operation<E extends DatabaseHookTarget>(target: E) {\n    const before = async (\n      ...[data, ctx]: Parameters<DbHookFn<E, \"before\">>\n    ): Promise<DatabaseHookResult<E, \"before\">> => {\n      const binding = getBinding();\n      if (!binding) {\n        countUnbound();\n        return undefined as DatabaseHookResult<E, \"before\">;\n      }\n      const hooks = binding.database[target].before;\n      let accumulated: Record<string, unknown> = {};\n      let changed = false;\n      for (const hook of hooks) {\n        const result = await hook(\n          (target.endsWith(\".create\")\n            ? { ...data, ...accumulated }\n            : data) as DatabaseHookData<E, \"before\">,\n          ctx,\n        );\n        if (result === false) {\n          return false as DatabaseHookResult<E, \"before\">;\n        }\n        if (\n          !target.endsWith(\".delete\") &&\n          result &&\n          typeof result === \"object\" &&\n          \"data\" in result\n        ) {\n          accumulated = { ...accumulated, ...result.data };\n          changed = true;\n        }\n      }\n      // A generic target cannot express the runtime delete narrowing. Delete\n      // never reaches this branch; the public binding keeps its void/false type.\n      return (\n        changed ? { data: accumulated } : undefined\n      ) as DatabaseHookResult<E, \"before\">;\n    };\n    const after = async (\n      ...[data, ctx]: Parameters<DbHookFn<E, \"after\">>\n    ): Promise<void> => {\n      const binding = getBinding();\n      if (!binding) {\n        countUnbound();\n        return;\n      }\n      for (const hook of binding.database[target].after) {\n        await hook(data as DatabaseHookData<E, \"after\">, ctx);\n      }\n    };\n    return { before, after };\n  }\n  return {\n    user: {\n      create: operation(\"user.create\"),\n      update: operation(\"user.update\"),\n      delete: operation(\"user.delete\"),\n    },\n    session: {\n      create: operation(\"session.create\"),\n      update: operation(\"session.update\"),\n      delete: operation(\"session.delete\"),\n    },\n    account: {\n      create: operation(\"account.create\"),\n      update: operation(\"account.update\"),\n      delete: operation(\"account.delete\"),\n    },\n    verification: {\n      create: operation(\"verification.create\"),\n      update: operation(\"verification.update\"),\n      delete: operation(\"verification.delete\"),\n    },\n  };\n}\n","import type { HookEndpointContext } from \"better-auth\";\nimport { APIError, createAuthMiddleware, isAPIError } from \"better-auth/api\";\nimport { createDefu } from \"defu\";\nimport type { BridgeBinding, ScopeView } from \"./bridge-protocol.js\";\n\nconst API_ERROR_HEADERS = Symbol.for(\"better-call:api-error-headers\");\nconst mergeContext = createDefu((object, key, value) => {\n  if (Array.isArray(object[key]) && Array.isArray(value)) {\n    object[key] = value;\n    return true;\n  }\n});\n\nfunction mergeHeaders(\n  target: Headers,\n  source: Headers | null | undefined,\n): void {\n  source?.forEach((value, key) => {\n    if (key === \"set-cookie\") {\n      target.append(key, value);\n    } else {\n      target.set(key, value);\n    }\n  });\n}\n\nfunction errorHeaders(error: APIError): Headers | undefined {\n  const attached = (error as unknown as Record<symbol, Headers | undefined>)[\n    API_ERROR_HEADERS\n  ];\n  if (!attached && !error.headers) {\n    return undefined;\n  }\n  const headers = new Headers(attached);\n  if (error.headers && error.headers !== attached) {\n    mergeHeaders(headers, new Headers(error.headers));\n  }\n  return headers;\n}\n\n/** Run each method through the SDK middleware so its cookie/header state is isolated. */\nexport async function runBefore(\n  binding: BridgeBinding,\n  ctx: HookEndpointContext,\n  scope: ScopeView | undefined,\n): Promise<unknown> {\n  let accumulated: Record<string, unknown> = {};\n  for (const hook of binding.before) {\n    let matched: boolean;\n    try {\n      matched = hook.matches(ctx, scope);\n    } catch (error) {\n      ctx.context.logger.error(\n        \"An error occurred during Nest hook matcher execution:\",\n        error,\n      );\n      throw new APIError(\"INTERNAL_SERVER_ERROR\", {\n        message:\n          \"An error occurred during hook matcher execution. Check the logs for more details.\",\n      });\n    }\n    if (!matched) {\n      continue;\n    }\n    let result: { response: unknown; headers: Headers };\n    try {\n      result = (await createAuthMiddleware(hook.run)({\n        ...ctx,\n        returnHeaders: true,\n      })) as { response: unknown; headers: Headers };\n    } catch (error) {\n      if (isAPIError(error)) {\n        // The enclosing SDK middleware reattaches its own header object. Keep\n        // the throwing method's headers, including non-enumerable cookie state.\n        ctx.responseHeaders =\n          (error as unknown as Record<symbol, Headers | undefined>)[\n            API_ERROR_HEADERS\n          ] ?? new Headers();\n      }\n      throw error;\n    }\n    ctx.context.responseHeaders ??= new Headers();\n    mergeHeaders(ctx.context.responseHeaders, result.headers);\n    const value = result.response;\n    if (value && typeof value === \"object\") {\n      if (\"context\" in value && typeof value.context === \"object\") {\n        const { headers, ...rest } = value.context as Record<string, unknown>;\n        if (headers instanceof Headers) {\n          const requestHeaders =\n            accumulated.headers instanceof Headers\n              ? accumulated.headers\n              : new Headers();\n          headers.forEach((header, key) => {\n            requestHeaders.set(key, header);\n          });\n          accumulated.headers = requestHeaders;\n        }\n        accumulated = mergeContext(rest, accumulated);\n      } else {\n        return value;\n      }\n    }\n  }\n  return Object.keys(accumulated).length ? { context: accumulated } : undefined;\n}\n\nexport async function runAfter(\n  binding: BridgeBinding,\n  ctx: HookEndpointContext,\n  scope: ScopeView | undefined,\n  relayMatcherError?: (error: unknown) => void,\n): Promise<unknown> {\n  for (const hook of binding.after) {\n    let matched: boolean;\n    try {\n      matched = hook.matches(ctx, scope);\n    } catch (error) {\n      if (!relayMatcherError) {\n        throw error;\n      }\n      // A surrounding SDK handler catches APIErrors as recoverable results.\n      // Stop here and rethrow from the next fixed SDK matcher instead.\n      relayMatcherError(error);\n      return undefined;\n    }\n    if (!matched) {\n      continue;\n    }\n    let result: { response: unknown; headers?: Headers | null };\n    try {\n      result = (await createAuthMiddleware(hook.run)({\n        ...ctx,\n        returnHeaders: true,\n      })) as { response: unknown; headers: Headers };\n    } catch (error) {\n      if (!isAPIError(error)) {\n        throw error;\n      }\n      result = { response: error, headers: errorHeaders(error) };\n    }\n    if (result.headers) {\n      ctx.context.responseHeaders ??= new Headers();\n      mergeHeaders(ctx.context.responseHeaders, result.headers);\n    }\n    if (result.response !== undefined) {\n      ctx.context.returned = result.response;\n    }\n  }\n  return ctx.context.returned;\n}\n","import type { BetterAuthPlugin, HookEndpointContext } from \"better-auth\";\nimport {\n  createAuthMiddleware,\n  setShouldSkipSessionRefresh,\n} from \"better-auth/api\";\nimport { parseCookies } from \"better-auth/cookies\";\nimport type { NestjsPluginOptions } from \"./auth-contracts.js\";\nimport {\n  BRIDGE_HANDLE,\n  type BridgeBinding,\n  type BridgeHandle,\n  type ScopeView,\n} from \"./bridge-protocol.js\";\nimport { createDatabaseDispatchers } from \"./database-hook-dispatcher.js\";\nimport { runAfter, runBefore } from \"./hook-dispatcher.js\";\n\nexport type { NestjsPluginOptions } from \"./auth-contracts.js\";\nexport const NESTJS_PLUGIN_ID = \"@nestjs-kit/better-auth\";\n\nconst isRouter = (ctx: object): boolean =>\n  \"_flag\" in ctx && ctx._flag === \"router\";\nconst separator = \"\\u0000\";\n\nfunction sessionToken(\n  headers: Headers | undefined,\n  ctx: HookEndpointContext,\n): string {\n  return (\n    parseCookies(headers?.get(\"cookie\") ?? \"\").get(\n      ctx.context.authCookies.sessionToken.name,\n    ) ?? \"\"\n  );\n}\n\nfunction credential(\n  headers: Headers | undefined,\n  ctx: HookEndpointContext,\n  extra: readonly string[],\n): string {\n  return [\n    sessionToken(headers, ctx),\n    headers?.get(\"authorization\") ?? \"\",\n    ...extra.map((name) => headers?.get(name) ?? \"\"),\n  ].join(separator);\n}\n\nfunction sameCredential(\n  ctx: HookEndpointContext,\n  scope: ScopeView,\n  extra: readonly string[],\n): boolean {\n  const call = credential(ctx.headers, ctx, extra);\n  return (\n    call === separator.repeat(extra.length + 1) ||\n    call === credential(scope.inbound?.(), ctx, extra)\n  );\n}\n\n/** Pure construction-time Better Auth plugin; the Nest kernel binds through a global symbol. */\nexport function nestjs(\n  options: NestjsPluginOptions = {},\n): BetterAuthPlugin & { id: typeof NESTJS_PLUGIN_ID } {\n  let binding: BridgeBinding | null = null;\n  let registration: ReturnType<BridgeHandle[\"bind\"]> | undefined;\n  let unboundDispatches = 0;\n  const endpointResults = new WeakSet<object>();\n  const afterMatcherErrors = new WeakMap<object, unknown>();\n  const scope = () => binding?.current();\n  const clientIpHeader =\n    options.clientIpHeader === false\n      ? null\n      : (options.clientIpHeader ??\n        `x-nestjs-kit-better-auth-ip-${globalThis.crypto.randomUUID().replaceAll(\"-\", \"\")}`);\n  const handle: BridgeHandle = {\n    protocol: 4,\n    clientIpHeader,\n    get state() {\n      return binding === null\n        ? \"unbound\"\n        : binding.state === \"closed\"\n          ? \"closed\"\n          : \"bound\";\n    },\n    get unboundDispatches() {\n      return unboundDispatches;\n    },\n    bind(next) {\n      if (binding && binding.instance !== next.instance) {\n        throw new Error(\n          `PLUGIN_SHARED_BETWEEN_INSTANCES: '${binding.instance}' and '${next.instance}'`,\n        );\n      }\n      if (binding?.owner === next.owner && registration) {\n        return registration;\n      }\n      if (binding?.state === \"bootstrapped\") {\n        throw new Error(\n          `INSTANCE_ALREADY_BOUND: bound to ${binding.owner.description}`,\n        );\n      }\n      let tookOverFrom: string | undefined;\n      if (binding?.state === \"initialized\") {\n        tookOverFrom = binding.owner.description;\n        // Its application may still be initializing: its bootstrap must fail rather than run without hooks.\n        binding.state = \"displaced\";\n      }\n      binding = next;\n      unboundDispatches = 0;\n      registration = {\n        tookOverFrom,\n        close: () => {\n          next.state = \"closed\";\n        },\n      };\n      return registration;\n    },\n    producedByEndpoint(value) {\n      return (\n        typeof value === \"object\" &&\n        value !== null &&\n        endpointResults.has(value)\n      );\n    },\n  };\n  const plugin = {\n    id: NESTJS_PLUGIN_ID,\n    [BRIDGE_HANDLE]: handle,\n    init: () => ({\n      options: {\n        databaseHooks: createDatabaseDispatchers(\n          () => binding,\n          () => {\n            unboundDispatches++;\n          },\n        ),\n        ...(clientIpHeader\n          ? { advanced: { ipAddress: { ipAddressHeaders: [clientIpHeader] } } }\n          : {}),\n      },\n    }),\n    hooks: {\n      before: [\n        {\n          matcher: (ctx) => {\n            if (!binding) {\n              unboundDispatches++;\n              return false;\n            }\n            return !isRouter(ctx) && scope()?.cookies === null;\n          },\n          handler: createAuthMiddleware(async () => {\n            await setShouldSkipSessionRefresh(true);\n          }),\n        },\n        {\n          matcher: (ctx) => {\n            if (!binding || isRouter(ctx)) {\n              return false;\n            }\n            const current = scope();\n            if (!current || current.internal) {\n              return false;\n            }\n            // Access capabilities before testing credentials: extraction errors\n            // must fail even a credential-free direct endpoint call.\n            const check = current.checkCallerSession;\n            current.inbound?.();\n            const browser = current.browserHeaders?.();\n            const token = sessionToken(ctx.headers, ctx);\n            // Only the browser leg's own cookie is ambient. A session cookie that a\n            // transport mapped in-band (graphql-ws connectionParams, socket\n            // credentials) cannot ride a cross-site request.\n            return (\n              !!check && token !== \"\" && token === sessionToken(browser, ctx)\n            );\n          },\n          handler: createAuthMiddleware(async (ctx) => {\n            scope()?.checkCallerSession?.(ctx.path, binding!.instance);\n          }),\n        },\n        {\n          matcher: () => binding !== null && binding.before.length > 0,\n          handler: createAuthMiddleware((ctx) =>\n            runBefore(binding!, ctx, scope()),\n          ),\n        },\n      ],\n      after: [\n        {\n          matcher: () => binding !== null && binding.after.length > 0,\n          handler: createAuthMiddleware((ctx) =>\n            runAfter(binding!, ctx, scope(), (error) => {\n              afterMatcherErrors.set(ctx.context, error);\n            }),\n          ),\n        },\n        {\n          matcher: (ctx) => {\n            // Each endpoint dispatch owns this shared context, including nested\n            // calls. Rethrow outside the SDK's recoverable handler-error catch.\n            if (afterMatcherErrors.has(ctx.context)) {\n              const error = afterMatcherErrors.get(ctx.context);\n              afterMatcherErrors.delete(ctx.context);\n              throw error;\n            }\n            return binding !== null && !isRouter(ctx);\n          },\n          handler: createAuthMiddleware(async (ctx) => {\n            const value = ctx.context.returned;\n            if (typeof value === \"object\" && value !== null) {\n              endpointResults.add(value);\n            }\n          }),\n        },\n        {\n          matcher: (ctx) => {\n            if (isRouter(ctx)) {\n              return false;\n            }\n            const current = scope();\n            return !!current?.cookies && current.forward !== \"none\";\n          },\n          handler: createAuthMiddleware(async (ctx) => {\n            const current = scope()!;\n            if (\n              current.forward === \"same-credential\" &&\n              !sameCredential(ctx, current, binding!.credentialHeaders)\n            ) {\n              binding!.onDropped(ctx.path);\n              return;\n            }\n            const cookies = ctx.context.responseHeaders?.getSetCookie() ?? [];\n            if (cookies.length) {\n              current.cookies!.append(cookies);\n            }\n          }),\n        },\n      ],\n    },\n  } satisfies BetterAuthPlugin & { [BRIDGE_HANDLE]: BridgeHandle };\n  return plugin;\n}\n","import {\n  type IncomingHttpHeaders,\n  type OutgoingHttpHeaders,\n  request as nodeRequest,\n} from \"node:http\";\nimport { inspect } from \"node:util\";\nimport type { LoggerService } from \"@nestjs/common\";\nimport {\n  betterAuth,\n  type BetterAuthOptions,\n  type BetterAuthPlugin,\n} from \"better-auth\";\nimport { memoryAdapter } from \"better-auth/adapters/memory\";\nimport {\n  APIError,\n  createAuthEndpoint,\n  createAuthMiddleware,\n  getIP,\n  getShouldSkipSessionRefresh,\n} from \"better-auth/api\";\nimport { bearer, testUtils } from \"better-auth/plugins\";\nimport type {\n  ConformanceCase,\n  ConformanceOutcome,\n  ConformanceRunner,\n  ConformanceSkip,\n} from \"./auth-contracts.js\";\nimport { BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport type { AuthLike } from \"./auth-types.js\";\nimport { nestjs } from \"./plugin.js\";\n\nexport type {\n  ConformanceCase,\n  ConformanceOutcome,\n  ConformanceRunner,\n  ConformanceSkip,\n} from \"./auth-contracts.js\";\n\nexport const PROBE_PLUGIN_ID = \"nestjs-kit-better-auth-conformance-probe\";\n/** The trusted origin the probe plugin contributes through init(), so origin cases see the post-init set. */\nexport const PROBE_TRUSTED_ORIGIN = \"https://probe-plugin.example\";\nexport const KIT_BASE_URL = \"http://localhost:3000\";\nexport const UNTRUSTED_ORIGIN = \"https://evil.example\";\nconst PROBE_STATE = Symbol.for(\"@nestjs-kit/better-auth:conformance-probe\");\n\n/** One database adapter operation the probe observed. */\nexport interface StorageCall {\n  readonly method: string;\n  readonly model: string | undefined;\n}\n\n/** The Set-Cookie lines one dispatched endpoint produced, with the request headers of that call. */\nexport interface ProducedCookies {\n  readonly path: string;\n  readonly setCookies: readonly string[];\n  readonly headers: Headers | undefined;\n  /** The instance's session cookie name, to compare the call's credential with a request's. */\n  readonly sessionCookie: string;\n}\n\n/** Observations and fault injection of one conformanceProbePlugin() object. */\nexport interface ProbeState {\n  /** Every endpoint path Better Auth dispatched (router and auth.api), in order. */\n  readonly calls: string[];\n  /** Database writes as `<model>.<create|update|delete>`. */\n  readonly writes: string[];\n  /** Every database adapter operation as `<method>:<model>`, reads included, transactions included. */\n  readonly storage: string[];\n  /** Endpoint dispatches that produced Set-Cookie lines, seen by an after hook. */\n  readonly produced: ProducedCookies[];\n  /** getShouldSkipSessionRefresh() observed by an after hook, per dispatched path. */\n  readonly refresh: { readonly path: string; readonly skip: boolean }[];\n  /** 'middleware' and 'auth' markers for ordering cases. */\n  readonly order: string[];\n  /** Returns a value to throw from the before hook for a path; undefined dispatches normally. */\n  fault: ((path: string) => unknown) | undefined;\n  /** Returns a value to throw from a database adapter operation (a storage outage); undefined runs it. */\n  storageFault: ((call: StorageCall) => unknown) | undefined;\n  /** Milliseconds a database adapter operation waits before it runs or throws its fault (a stalled storage). */\n  storageDelay: ((call: StorageCall) => number | undefined) | undefined;\n  /**\n   * Returns a value the before hook answers with instead of dispatching the endpoint, as a plugin's hook that\n   * short-circuits an endpoint does (apiKey's session for /get-session); undefined dispatches normally.\n   */\n  respond:\n    | ((path: string, headers: Headers | undefined) => unknown)\n    | undefined;\n  /** Milliseconds the before hook waits for a path, so that concurrent sources settle in a chosen order. */\n  delay: ((path: string) => number | undefined) | undefined;\n  /** A response header the after hook sets on a dispatched path, beside its Set-Cookie lines; undefined sets none. */\n  responseHeader: ((path: string) => [string, string] | undefined) | undefined;\n  streamCancelled: boolean;\n}\n\nexport function createProbeState(): ProbeState {\n  return {\n    calls: [],\n    writes: [],\n    storage: [],\n    produced: [],\n    refresh: [],\n    order: [],\n    fault: undefined,\n    storageFault: undefined,\n    storageDelay: undefined,\n    respond: undefined,\n    delay: undefined,\n    responseHeader: undefined,\n    streamCancelled: false,\n  };\n}\n\n/** A case result: the case does not apply to this unit, for the given reason. */\nexport function conformanceSkip(reason: string): ConformanceSkip {\n  return { skipped: reason };\n}\n\nconst STORAGE_METHODS = [\n  \"create\",\n  \"update\",\n  \"updateMany\",\n  \"findOne\",\n  \"findMany\",\n  \"delete\",\n  \"deleteMany\",\n  \"consumeOne\",\n  \"count\",\n] as const;\nconst INSTRUMENTED = Symbol(\"@nestjs-kit/better-auth:conformance-storage\");\n\n/** Counts and faults every data operation of a database adapter in place, including the adapters of its transactions. */\nfunction instrumentStorage(adapter: unknown, state: ProbeState): void {\n  if (\n    !adapter ||\n    typeof adapter !== \"object\" ||\n    Reflect.get(adapter, INSTRUMENTED)\n  ) {\n    return;\n  }\n  const target = adapter as Record<string, unknown>;\n  Object.defineProperty(target, INSTRUMENTED, { value: true });\n  for (const method of STORAGE_METHODS) {\n    const original = target[method];\n    if (typeof original !== \"function\") {\n      continue;\n    }\n    target[method] = async (...args: unknown[]) => {\n      const model = (args[0] as { model?: unknown } | undefined)?.model;\n      const call = {\n        method,\n        model: typeof model === \"string\" ? model : undefined,\n      };\n      state.storage.push(`${method}:${call.model ?? \"\"}`);\n      const stall = state.storageDelay?.(call);\n      if (stall) {\n        await new Promise((resolve) => setTimeout(resolve, stall));\n      }\n      const fault = state.storageFault?.(call);\n      if (fault !== undefined) {\n        throw fault;\n      }\n      return (original as (...values: unknown[]) => unknown).apply(\n        target,\n        args,\n      );\n    };\n  }\n  const transaction = target.transaction;\n  if (typeof transaction === \"function\") {\n    target.transaction = (callback: (adapter: unknown) => unknown) =>\n      (transaction as (fn: (adapter: unknown) => unknown) => unknown).call(\n        target,\n        (inner: unknown) => {\n          instrumentStorage(inner, state);\n          return callback(inner);\n        },\n      );\n  }\n}\n\nfunction base64(bytes: Uint8Array): string {\n  return Buffer.from(bytes).toString(\"base64\");\n}\n\nfunction writes(state: ProbeState) {\n  const record = (entry: string) => async () => {\n    state.writes.push(entry);\n  };\n  return Object.fromEntries(\n    [\"user\", \"session\", \"account\", \"verification\"].map((model) => [\n      model,\n      {\n        create: { after: record(`${model}.create`) },\n        update: { after: record(`${model}.update`) },\n        delete: { after: record(`${model}.delete`) },\n      },\n    ]),\n  );\n}\n\n/**\n * The conformance kits' Better Auth probe: byte-exact echo, multi-cookie, redirect, stream, HTML, method, URL\n * and IP endpoints under /probe, a before hook that counts dispatches and injects faults, an after hook that\n * records refresh suppression and the Set-Cookie lines each call produced, database write counters, a storage\n * instrument that counts and faults every database adapter operation, and https://probe-plugin.example as a trusted\n * origin contributed through init(). Put it before nestjs() in the plugin list.\n */\nexport function conformanceProbePlugin(): BetterAuthPlugin {\n  return probePlugin();\n}\n\nfunction probePlugin(\n  options: { memoryTables?: Record<string, unknown[]> } = {},\n): BetterAuthPlugin {\n  const state = createProbeState();\n  const plugin = {\n    id: PROBE_PLUGIN_ID,\n    init(context: { adapter: unknown; tables?: object }) {\n      if (options.memoryTables) {\n        for (const table of Object.values(context.tables ?? {}) as {\n          modelName: string;\n        }[]) {\n          options.memoryTables[table.modelName] ??= [];\n        }\n      }\n      instrumentStorage(context.adapter, state);\n      return {\n        options: {\n          trustedOrigins: [PROBE_TRUSTED_ORIGIN],\n          databaseHooks: writes(state),\n        },\n      };\n    },\n    endpoints: {\n      probeEchoRaw: createAuthEndpoint(\n        \"/probe/echo-raw\",\n        {\n          method: [\"GET\", \"POST\", \"PUT\", \"PATCH\", \"DELETE\"],\n          disableBody: true,\n          requireRequest: true,\n        },\n        async (ctx) => {\n          state.order.push(\"auth\");\n          const bytes = new Uint8Array(await ctx.request.arrayBuffer());\n          return Response.json({\n            method: ctx.request.method,\n            url: ctx.request.url,\n            headers: [...ctx.request.headers],\n            body: base64(bytes),\n          });\n        },\n      ),\n      probeMultiCookie: createAuthEndpoint(\n        \"/probe/multi-cookie\",\n        { method: \"GET\" },\n        async (ctx) => {\n          ctx.setCookie(\"probe_a\", \"alpha\", { path: \"/\" });\n          ctx.setCookie(\"probe_b\", \"beta\", { path: \"/\" });\n          ctx.setCookie(\"probe_c\", \"gamma, delta\", { path: \"/\" });\n          return ctx.json({ cookies: 3 });\n        },\n      ),\n      probeRedirect: createAuthEndpoint(\n        \"/probe/redirect\",\n        { method: \"GET\" },\n        async () =>\n          new Response(null, {\n            status: 302,\n            headers: [\n              [\"location\", `${PROBE_TRUSTED_ORIGIN}/next`],\n              [\"set-cookie\", \"probe_redirect=1; Path=/\"],\n            ],\n          }),\n      ),\n      probeStream: createAuthEndpoint(\n        \"/probe/stream\",\n        { method: \"GET\" },\n        async () => {\n          let index = 0;\n          let timer: ReturnType<typeof setTimeout> | undefined;\n          const stream = new ReadableStream<Uint8Array>({\n            pull(controller) {\n              return new Promise<void>((resolve) => {\n                timer = setTimeout(() => {\n                  if (index === 3) {\n                    controller.close();\n                  } else {\n                    controller.enqueue(\n                      new TextEncoder().encode(`chunk-${index++};`),\n                    );\n                  }\n                  resolve();\n                }, 25);\n              });\n            },\n            cancel() {\n              clearTimeout(timer);\n              state.streamCancelled = true;\n            },\n          });\n          return new Response(stream, {\n            headers: { \"content-type\": \"text/plain\" },\n          });\n        },\n      ),\n      probeHtml: createAuthEndpoint(\n        \"/probe/html\",\n        { method: \"GET\" },\n        async () =>\n          new Response(\"<p>probe</p>\", {\n            headers: {\n              \"content-type\": \"text/html; charset=utf-8\",\n              vary: \"Accept\",\n            },\n          }),\n      ),\n      probePut: createAuthEndpoint(\n        \"/probe/put\",\n        { method: \"PUT\" },\n        async (ctx) => ctx.json({ method: \"PUT\" }),\n      ),\n      probePatch: createAuthEndpoint(\n        \"/probe/patch\",\n        { method: \"PATCH\" },\n        async (ctx) => ctx.json({ method: \"PATCH\" }),\n      ),\n      probeDelete: createAuthEndpoint(\n        \"/probe/delete\",\n        { method: \"DELETE\" },\n        async (ctx) => ctx.json({ method: \"DELETE\" }),\n      ),\n      probeUrl: createAuthEndpoint(\n        \"/probe/url\",\n        { method: \"GET\", requireRequest: true },\n        async (ctx) => ctx.json({ url: ctx.request.url }),\n      ),\n      probeIp: createAuthEndpoint(\n        \"/probe/ip\",\n        { method: \"GET\", requireRequest: true },\n        async (ctx) =>\n          ctx.json({\n            ip: getIP(ctx.request, ctx.context.options),\n            resolved: resolvedIp(ctx.request, ctx.context.options),\n          }),\n      ),\n      probeThrowApiError: createAuthEndpoint(\n        \"/probe/throw-api-error\",\n        { method: \"GET\" },\n        async () => {\n          throw new APIError(\"BAD_REQUEST\", {\n            code: \"PROBE_API_ERROR\",\n            message: \"Probe API error\",\n          });\n        },\n      ),\n      probeThrowError: createAuthEndpoint(\n        \"/probe/throw-error\",\n        { method: \"GET\" },\n        async () => {\n          throw new Error(\"probe infrastructure failure\");\n        },\n      ),\n    },\n    hooks: {\n      before: [\n        {\n          matcher: () => true,\n          handler: createAuthMiddleware(async (ctx) => {\n            state.calls.push(ctx.path);\n            const wait = state.delay?.(ctx.path);\n            if (wait) {\n              await new Promise((resolve) => setTimeout(resolve, wait));\n            }\n            const fault = state.fault?.(ctx.path);\n            if (fault !== undefined) {\n              throw fault;\n            }\n            const response = state.respond?.(ctx.path, ctx.headers);\n            if (response !== undefined) {\n              return response;\n            }\n          }),\n        },\n      ],\n      after: [\n        {\n          matcher: () => true,\n          handler: createAuthMiddleware(async (ctx) => {\n            state.refresh.push({\n              path: ctx.path,\n              skip: (await getShouldSkipSessionRefresh()) === true,\n            });\n            const header = state.responseHeader?.(ctx.path);\n            if (header) {\n              ctx.setHeader(header[0], header[1]);\n            }\n            const setCookies =\n              ctx.context.responseHeaders?.getSetCookie() ?? [];\n            if (setCookies.length) {\n              state.produced.push({\n                path: ctx.path,\n                setCookies,\n                headers: ctx.headers ? new Headers(ctx.headers) : undefined,\n                sessionCookie: ctx.context.authCookies.sessionToken.name,\n              });\n            }\n          }),\n        },\n      ],\n    },\n  } satisfies BetterAuthPlugin;\n  Object.defineProperty(plugin, PROBE_STATE, { value: state });\n  return plugin;\n}\n\n/** A TEST-NET-2 address that no kit request sends and no kit configuration trusts. */\nconst IP_SENTINEL = \"198.51.100.254\";\nconst IP_SENTINEL_HEADER = \"x-conformance-ip-sentinel\";\n\n/**\n * The client IP Better Auth resolves from the request's IP headers, without the localhost fallback getIP() returns\n * under NODE_ENV=development/test or a truthy TEST (vitest sets it): the sentinel header is read last, so getIP()\n * returns the sentinel exactly when the configured headers yield no trusted address.\n */\nfunction resolvedIp(request: Request, options: BetterAuthOptions) {\n  const ipAddress = options.advanced?.ipAddress;\n  const headers = new Headers(request.headers);\n  headers.set(IP_SENTINEL_HEADER, IP_SENTINEL);\n  const ip = getIP(headers, {\n    ...options,\n    advanced: {\n      ...options.advanced,\n      ipAddress: {\n        ...ipAddress,\n        ipAddressHeaders: [\n          ...(ipAddress?.ipAddressHeaders ?? [\"x-forwarded-for\"]),\n          IP_SENTINEL_HEADER,\n        ],\n      },\n    },\n  });\n  return ip === IP_SENTINEL ? null : ip;\n}\n\n/** The probe state of an instance that includes conformanceProbePlugin(). */\nexport async function probeOf(auth: AuthLike): Promise<ProbeState> {\n  const context = (await auth.$context) as { getPlugin(id: string): unknown };\n  const plugin = context.getPlugin(PROBE_PLUGIN_ID);\n  const state =\n    plugin && typeof plugin === \"object\"\n      ? (Reflect.get(plugin, PROBE_STATE) as ProbeState | undefined)\n      : undefined;\n  if (!state) {\n    throw new BetterAuthConfigurationError(\n      \"CONFORMANCE_PROBE_MISSING\",\n      \"The conformance kits need conformanceProbePlugin() on the Better Auth instance.\",\n      \"Create the instance with createConformanceAuth() or add conformanceProbePlugin() before nestjs().\",\n    );\n  }\n  return state;\n}\n\n/**\n * Better Auth's origin-check flags of a conformance instance. Both default to false, so every origin check is on; a\n * caller's `options.advanced` cannot change them, only this argument can.\n */\nexport interface ConformanceAuthSettings {\n  /**\n   * Better Auth's advanced.disableOriginCheck. true skips Better Auth's own origin validation of its routes; with\n   * disableCSRFCheck false the library's application-route checks stay on (BA-r6-01, T-csrf-http-unsafe).\n   */\n  readonly disableOriginCheck?: boolean;\n  /** Better Auth's advanced.disableCSRFCheck. true switches every origin check off, the library's included. */\n  readonly disableCSRFCheck?: boolean;\n}\n\n/**\n * A memory-adapter Better Auth instance with the settings the kits assume: origin checks explicitly on\n * (advanced.disableOriginCheck: false, which vitest's TEST=true would otherwise switch off, and\n * advanced.disableCSRFCheck: false, which would otherwise switch every origin check off), session.updateAge 0 so\n * every session read refreshes, testUtils(), bearer(), conformanceProbePlugin() and nestjs() last. The kit settings\n * win over the same options in `options`; `settings` switches the origin checks off explicitly.\n */\nexport function createConformanceAuth(\n  options: Omit<BetterAuthOptions, \"database\"> = {},\n  settings: ConformanceAuthSettings = {},\n): AuthLike {\n  // The probe creates a table for every model of the resolved schema when Better Auth initializes it.\n  const tables: Record<string, unknown[]> = {};\n  const resolved = {\n    secret: globalThis.crypto.randomUUID() + globalThis.crypto.randomUUID(),\n    baseURL: KIT_BASE_URL,\n    emailAndPassword: { enabled: true },\n    logger: { disabled: true },\n    ...options,\n    session: { ...options.session, updateAge: 0 },\n    advanced: {\n      ...options.advanced,\n      disableOriginCheck: settings.disableOriginCheck === true,\n      disableCSRFCheck: settings.disableCSRFCheck === true,\n    },\n    plugins: [\n      testUtils(),\n      bearer(),\n      probePlugin({ memoryTables: tables }),\n      ...(options.plugins ?? []),\n      nestjs(),\n    ],\n  } satisfies BetterAuthOptions;\n  return betterAuth<BetterAuthOptions>({\n    ...resolved,\n    database: memoryAdapter(tables),\n  }) as unknown as AuthLike;\n}\n\ninterface TestHelpers {\n  createUser(overrides?: Record<string, unknown>): { id: string };\n  saveUser(user: { id: string }): Promise<{ id: string }>;\n  login(options: { userId: string }): Promise<{\n    headers: Headers;\n    token: string;\n    session: { token: string; expiresAt: Date };\n  }>;\n}\n\nexport interface KitIdentity {\n  readonly userId: string;\n  readonly email: string;\n  readonly password?: string;\n  /** Cookie header value of a fresh session. */\n  readonly cookie: string;\n  /** Raw session token for the bearer() plugin. */\n  readonly token: string;\n}\n\nexport async function testHelpers(auth: AuthLike): Promise<TestHelpers> {\n  const context = (await auth.$context) as { test?: TestHelpers };\n  if (!context.test) {\n    throw new BetterAuthConfigurationError(\n      \"TEST_UTILS_MISSING\",\n      \"The conformance kits need Better Auth's testUtils() plugin on the instance.\",\n      \"Create the instance with createConformanceAuth() or add testUtils().\",\n    );\n  }\n  return context.test;\n}\n\n/** A stored user with a fresh session; `password` signs the user up through Better Auth instead. */\nexport async function kitIdentity(\n  auth: AuthLike,\n  options: { password?: boolean; role?: string } = {},\n): Promise<KitIdentity> {\n  const helpers = await testHelpers(auth);\n  const email = `${globalThis.crypto.randomUUID()}@conformance.example`;\n  let userId: string;\n  let password: string | undefined;\n  if (options.password) {\n    password = `pw-${globalThis.crypto.randomUUID()}`;\n    const result = (await (\n      auth.api as unknown as {\n        signUpEmail(input: {\n          body: { email: string; password: string; name: string };\n        }): Promise<{ user: { id: string } }>;\n      }\n    ).signUpEmail({ body: { email, password, name: \"Conformance\" } })) as {\n      user: { id: string };\n    };\n    userId = result.user.id;\n  } else {\n    userId = (\n      await helpers.saveUser(\n        helpers.createUser({\n          email,\n          name: \"Conformance\",\n          ...(options.role ? { role: options.role } : {}),\n        }),\n      )\n    ).id;\n  }\n  const login = await helpers.login({ userId });\n  return {\n    userId,\n    email,\n    password,\n    cookie: login.headers.get(\"cookie\") ?? \"\",\n    token: login.token,\n  };\n}\n\n/** Build the cases that one kit returns. */\nexport function conformanceCase(\n  id: string,\n  title: string,\n  run: () => Promise<ConformanceOutcome>,\n  skip?: string,\n): ConformanceCase {\n  return skip === undefined ? { id, title, run } : { id, title, skip, run };\n}\n\n/**\n * Register cases with a runner that has describe/it (vitest, jest, node:test). Cases are grouped by id. A case with\n * `skip` registers a passing test whose name states the reason, so every unsupported capability stays visible. A case\n * that skips at run time calls the runner's context.skip(reason) when the runner passes a context (Vitest, node:test);\n * under Jest it passes.\n */\nexport function runConformance(\n  cases: readonly ConformanceCase[],\n  runner: ConformanceRunner,\n): void {\n  const groups = new Map<string, ConformanceCase[]>();\n  for (const item of cases) {\n    groups.set(item.id, [...(groups.get(item.id) ?? []), item]);\n  }\n  for (const [id, items] of groups) {\n    runner.describe(id, () => {\n      for (const item of items) {\n        if (item.skip !== undefined) {\n          runner.it(`${item.title} (skipped: ${item.skip})`, async () => {});\n        } else {\n          // No declared parameters: Jest would treat one as a done callback, and Vitest parses it for fixtures.\n          runner.it(item.title, async function () {\n            // biome-ignore lint/complexity/noArguments: see above; the runner's test context is the first argument.\n            const context = arguments[0] as\n              | { skip?: (note?: string) => void }\n              | undefined;\n            const result = await item.run();\n            if (result && typeof result.skipped === \"string\") {\n              context?.skip?.(result.skipped);\n            }\n          });\n        }\n      }\n    });\n  }\n}\n\nexport interface LogEntry {\n  readonly level: \"log\" | \"error\" | \"warn\" | \"debug\" | \"verbose\" | \"fatal\";\n  readonly text: string;\n}\n\nfunction render(value: unknown): string {\n  if (value instanceof Error) {\n    return inspect(value, { depth: 4 });\n  }\n  if (typeof value === \"string\") {\n    return value;\n  }\n  try {\n    return JSON.stringify(value);\n  } catch {\n    return String(value);\n  }\n}\n\n/** A Nest logger that records every entry for log assertions. */\nexport class CapturingLogger implements LoggerService {\n  readonly entries: LogEntry[] = [];\n\n  private record(level: LogEntry[\"level\"], values: unknown[]): void {\n    this.entries.push({ level, text: values.map(render).join(\" \") });\n  }\n\n  log(...values: unknown[]): void {\n    this.record(\"log\", values);\n  }\n\n  error(...values: unknown[]): void {\n    this.record(\"error\", values);\n  }\n\n  warn(...values: unknown[]): void {\n    this.record(\"warn\", values);\n  }\n\n  debug(...values: unknown[]): void {\n    this.record(\"debug\", values);\n  }\n\n  verbose(...values: unknown[]): void {\n    this.record(\"verbose\", values);\n  }\n\n  fatal(...values: unknown[]): void {\n    this.record(\"fatal\", values);\n  }\n\n  errors(): LogEntry[] {\n    return this.entries.filter(\n      (entry) => entry.level === \"error\" || entry.level === \"fatal\",\n    );\n  }\n\n  text(): string {\n    return this.entries.map((entry) => entry.text).join(\"\\n\");\n  }\n}\n\nexport interface RawResponse {\n  readonly status: number;\n  readonly headers: IncomingHttpHeaders;\n  readonly body: Buffer;\n}\n\n/**\n * An HTTP/1.1 request through node:http, which adds no fetch metadata (Sec-Fetch-*) and keeps every Set-Cookie line.\n * `chunks` sends a chunked body; `abortAfterFirstChunk` destroys the response after its first data event.\n */\nexport function sendRaw(\n  url: string,\n  options: {\n    method?: string;\n    headers?: OutgoingHttpHeaders;\n    body?: Uint8Array | string;\n    chunks?: readonly (Uint8Array | string)[];\n    timeoutMs?: number;\n    abortAfterFirstChunk?: boolean;\n  } = {},\n): Promise<RawResponse> {\n  return new Promise((resolve, reject) => {\n    const request = nodeRequest(\n      url,\n      {\n        method: options.method ?? \"GET\",\n        headers: options.headers,\n        agent: false,\n      },\n      (response) => {\n        const chunks: Buffer[] = [];\n        response.on(\"data\", (chunk: Buffer) => {\n          chunks.push(chunk);\n          if (options.abortAfterFirstChunk) {\n            response.destroy();\n            resolve({\n              status: response.statusCode ?? 0,\n              headers: response.headers,\n              body: Buffer.concat(chunks),\n            });\n          }\n        });\n        response.once(\"error\", reject);\n        response.once(\"end\", () =>\n          resolve({\n            status: response.statusCode ?? 0,\n            headers: response.headers,\n            body: Buffer.concat(chunks),\n          }),\n        );\n      },\n    );\n    request.setTimeout(options.timeoutMs ?? 5_000, () => {\n      request.destroy(new Error(`Request to ${url} timed out`));\n    });\n    request.once(\"error\", reject);\n    if (options.chunks) {\n      for (const chunk of options.chunks) {\n        request.write(chunk);\n      }\n    } else if (options.body !== undefined) {\n      request.write(options.body);\n    }\n    request.end();\n  });\n}\n\nexport function setCookieLines(headers: IncomingHttpHeaders): string[] {\n  const value = headers[\"set-cookie\"];\n  return value === undefined ? [] : Array.isArray(value) ? value : [value];\n}\n\nexport async function settle<T>(\n  fn: () => Promise<T>,\n): Promise<{ ok: true; value: T } | { ok: false; error: unknown }> {\n  try {\n    return { ok: true, value: await fn() };\n  } catch (error) {\n    return { ok: false, error };\n  }\n}\n\n/** Collect issue codes from an AUTH_BOOT_FAILED error (or the codes of a single configuration error). */\nexport function bootIssueCodes(error: unknown): string[] {\n  const codes: string[] = [];\n  const visit = (value: unknown) => {\n    if (!value || typeof value !== \"object\") {\n      return;\n    }\n    const code = Reflect.get(value, \"code\");\n    if (typeof code === \"string\") {\n      codes.push(code);\n    }\n    const issues = Reflect.get(value, \"issues\");\n    if (Array.isArray(issues)) {\n      issues.forEach(visit);\n    }\n  };\n  visit(error);\n  return codes;\n}\n","import assert from \"node:assert/strict\";\nimport { IncomingMessage } from \"node:http\";\nimport { connect } from \"node:http2\";\nimport { Socket } from \"node:net\";\nimport {\n  Body,\n  Catch,\n  Controller,\n  Get,\n  Injectable,\n  Module,\n  Post,\n  Req,\n  RequestMethod,\n  Res,\n  UseGuards,\n  UseInterceptors,\n  VersioningType,\n  type ArgumentsHost,\n  type CallHandler,\n  type CanActivate,\n  type DynamicModule,\n  type ExecutionContext,\n  type INestApplication,\n  type INestMicroservice,\n  type MiddlewareConsumer,\n  type NestInterceptor,\n  type NestModule,\n  type OnApplicationShutdown,\n  type Type,\n} from \"@nestjs/common\";\nimport {\n  APP_FILTER,\n  BaseExceptionFilter,\n  NestFactory,\n  type AbstractHttpAdapter,\n} from \"@nestjs/core\";\nimport { Test } from \"@nestjs/testing\";\nimport type { BetterAuthOptions } from \"better-auth\";\nimport { APIError, isAPIError } from \"better-auth/api\";\nimport type { Observable } from \"rxjs\";\nimport type {\n  AuthHandlerInterceptor,\n  BetterAuthRuntimeOptions,\n  ExtensionRef,\n  HttpPlatform,\n  HttpRequestAccessor,\n} from \"./auth-contracts.js\";\nimport {\n  BeforeAuth,\n  CurrentPrincipal,\n  Public,\n  RequireAuth,\n} from \"./auth-decorators.js\";\nimport { isInfrastructureError } from \"./auth-errors.js\";\nimport { BetterAuthModule } from \"./auth-module.js\";\nimport { MOUNT_COORDINATOR } from \"./auth-tokens.js\";\nimport type { AuthHookContext, AuthLike, AuthPrincipal } from \"./auth-types.js\";\nimport {\n  BRIDGE_HANDLE,\n  type BridgeHandle,\n  EXTENSION_DEFINITION,\n} from \"./bridge-protocol.js\";\nimport {\n  bootIssueCodes,\n  CapturingLogger,\n  type ConformanceCase,\n  conformanceCase,\n  conformanceSkip,\n  type ConformanceOutcome,\n  type ConformanceSkip,\n  createConformanceAuth,\n  KIT_BASE_URL,\n  kitIdentity,\n  probeOf,\n  type ProbeState,\n  type RawResponse,\n  sendRaw,\n  setCookieLines,\n  settle,\n} from \"./conformance-fixtures.js\";\nimport type { MountCoordinator } from \"./mount-coordinator.js\";\n\nexport interface HttpConformanceOptions {\n  platform: ExtensionRef<HttpPlatform>;\n  /** Fresh Nest HTTP adapter per app, e.g. () => new ExpressAdapter(). */\n  createHttpAdapter(): AbstractHttpAdapter;\n  /** Bootstraps to exercise. Default both. */\n  bootstrap?: readonly (\"factory\" | \"testing\")[];\n  /** Enable host CORS the platform's usual way. Default: app.enableCors({ origin, credentials: true }). */\n  enableHostCors?(app: INestApplication, origin: string): void | Promise<void>;\n  /**\n   * Configure trust in one forwarding hop on a created application the platform's usual way, e.g. app.set('trust proxy',\n   * 1). The trusted-hop rows (H-ip-platform, H-proxy-trust, H-url-trust-proxy, H-proxy-untrusted-warning) need this or\n   * createTrustingHttpAdapter; without either they are skipped with the reason.\n   */\n  trustOneProxy?(app: INestApplication): void | Promise<void>;\n  /**\n   * A fresh adapter that already trusts one forwarding hop, for platforms whose proxy trust is fixed when the adapter is\n   * constructed, e.g. () => new FastifyAdapter({ trustProxy: 'loopback' }). The kit's requests come from loopback, so\n   * trusting loopback is trusting one hop. Trusted-hop boots use it when given, instead of createHttpAdapter plus\n   * trustOneProxy.\n   */\n  createTrustingHttpAdapter?(): AbstractHttpAdapter;\n  /**\n   * HTTP/2 variant, required when the platform declares capabilities.http2. Its createTrustingHttpAdapter serves the\n   * HTTP/2 trusted-hop rows as createTrustingHttpAdapter serves the HTTP/1.1 ones.\n   */\n  http2?: {\n    createHttpAdapter(): AbstractHttpAdapter;\n    createTrustingHttpAdapter?(): AbstractHttpAdapter;\n  };\n  /** How to obtain a base URL. Default: app.listen(0) + getUrl(). */\n  listen?(app: INestApplication): Promise<string>;\n  /**\n   * Transport options for the H-no-adapter microservice rows, e.g. () => ({ transport: Transport.TCP, options: { host:\n   * '127.0.0.1', port: 0 } }). The kit does not load the optional @nestjs/microservices peer itself; without this option\n   * those rows are skipped with the reason.\n   */\n  microservice?(): MicroserviceOptions;\n}\n\n/** The options NestFactory.createMicroservice() and TestingModule.createNestMicroservice() accept. */\ntype MicroserviceOptions = NonNullable<\n  Parameters<typeof NestFactory.createMicroservice>[1]\n>;\n\ntype Bootstrap = \"factory\" | \"testing\";\nconst AUTH = \"/api/auth\";\nconst DYNAMIC_AUTH = \"/tenant/auth\";\n/** The client IP of the kit's requests: baseUrl() always connects over IPv4 loopback. */\nconst LOOPBACK = \"127.0.0.1\";\nconst CORS_ORIGIN = \"https://app.example\";\n/** Makes the kit's `around` interceptor throw, so auth.handler rejects with a non-APIError. */\nconst THROW_HEADER = \"x-conformance-throw\";\nconst SDK_HEADERS = Symbol.for(\"better-call:api-error-headers\");\nconst CANONICAL_413 = JSON.stringify({\n  code: \"PAYLOAD_TOO_LARGE\",\n  message: \"Request body exceeds the configured limit\",\n});\n\ninterface BootConfig {\n  auth?: Omit<BetterAuthOptions, \"database\">;\n  module?: Partial<BetterAuthRuntimeOptions<AuthLike>>;\n  async?: boolean;\n  duplicateForRoot?: boolean;\n  cors?: boolean;\n  prefix?: string;\n  versioning?: boolean;\n  middleware?: boolean;\n  http2?: boolean;\n  trustProxy?: boolean;\n  /** Boot on this instance instead of a fresh createConformanceAuth(config.auth). */\n  instance?: AuthLike;\n  /** Receives the paths the kit's @BeforeAuth() hook provider sees. */\n  hooks?: string[];\n  /** Runs in the kit root module's onApplicationShutdown hook. */\n  onShutdown?(): Promise<void>;\n}\n\ninterface AccessorObservation {\n  guardKey?: object;\n  interceptorKey?: object;\n  handlerKey?: object;\n  isRequest?: boolean;\n  rejectsPlain?: boolean;\n  rejectsUpgrade?: boolean;\n  liveInHandler?: boolean;\n  request?: unknown;\n  sinkAppended?: boolean;\n}\n\ninterface HttpBoot {\n  readonly app: INestApplication;\n  readonly url: string;\n  /** Whether the app serves h2c (config.http2). */\n  readonly http2: boolean;\n  readonly auth: AuthLike;\n  readonly probe: ProbeState;\n  readonly logger: CapturingLogger;\n  readonly filtered: unknown[];\n  readonly around: string[];\n  readonly accessor: AccessorObservation;\n  requests(): HttpRequestAccessor;\n  close(): Promise<void>;\n}\n\nfunction resolvedPlatform(app: INestApplication): HttpPlatform {\n  const coordinator = app.get<MountCoordinator>(MOUNT_COORDINATOR, {\n    strict: false,\n  });\n  const platform = coordinator.platform;\n  assert.ok(platform, \"the application selected no HTTP platform\");\n  return platform;\n}\n\n/**\n * The capabilities a platform reference declares, when that is known without booting: a platform object without\n * `capabilities` declares none. Undefined means unknown (a class whose instances may set it, or a definition).\n */\nfunction declaredCapabilities(\n  ref: ExtensionRef<HttpPlatform>,\n): HttpPlatform[\"capabilities\"] | undefined {\n  if (typeof ref === \"function\") {\n    try {\n      return (ref as unknown as { prototype: HttpPlatform }).prototype\n        ?.capabilities;\n    } catch {\n      return undefined;\n    }\n  }\n  if (ref && typeof ref === \"object\" && !(EXTENSION_DEFINITION in ref)) {\n    return (ref as Partial<HttpPlatform>).capabilities ?? {};\n  }\n  return undefined;\n}\n\n/** true/false when a platform member is statically known, undefined for definitions. */\nfunction staticMember(\n  ref: ExtensionRef<HttpPlatform>,\n  name: keyof HttpPlatform,\n): boolean | undefined {\n  if (typeof ref === \"function\") {\n    return typeof Reflect.get(ref.prototype as object, name) === \"function\"\n      ? true\n      : undefined;\n  }\n  if (ref && typeof ref === \"object\" && !(EXTENSION_DEFINITION in ref)) {\n    return typeof Reflect.get(ref, name) === \"function\";\n  }\n  return undefined;\n}\n\nasync function capabilitiesOf(\n  options: HttpConformanceOptions,\n): Promise<HttpPlatform[\"capabilities\"]> {\n  const declared = declaredCapabilities(options.platform);\n  if (declared) {\n    return declared;\n  }\n  const boot = await bootHttp(options, \"testing\", {});\n  try {\n    return resolvedPlatform(boot.app).capabilities;\n  } finally {\n    await boot.close();\n  }\n}\n\nfunction kitModule(\n  options: HttpConformanceOptions,\n  auth: AuthLike,\n  probe: ProbeState,\n  config: BootConfig,\n  state: {\n    filtered: unknown[];\n    around: string[];\n    accessor: AccessorObservation;\n    requests(): HttpRequestAccessor;\n    adapter(): AbstractHttpAdapter;\n    /** Paths the kit's @BeforeAuth() hook provider saw. */\n    hooks?: string[];\n  },\n): Type {\n  const hooks = state.hooks ?? config.hooks;\n  const record: AuthHandlerInterceptor = async (call, next) => {\n    state.around.push(\n      `${call.request.method.toUpperCase()} ${new URL(call.request.url).pathname}`,\n    );\n    const failure = call.request.headers.get(THROW_HEADER);\n    if (failure === \"api-error\") {\n      const error = new APIError(\"BAD_REQUEST\", {\n        code: \"CONFORMANCE_API_ERROR\",\n        message: \"Conformance API error\",\n      });\n      Object.defineProperty(error, SDK_HEADERS, {\n        value: new Headers({ \"set-cookie\": \"conformance_cleared=; Max-Age=0\" }),\n      });\n      throw error;\n    }\n    if (failure) {\n      throw new Error(\"conformance exchange failure\");\n    }\n    return next();\n  };\n  const { http, ...runtime } = config.module ?? {};\n  const moduleOptions = {\n    logSummary: false,\n    ...runtime,\n    http: { ...http, around: [record, ...(http?.around ?? [])] },\n  };\n  const imports: DynamicModule[] = [];\n  if (config.async) {\n    const DEPENDENCY = Symbol(\"conformance-async-dependency\");\n    @Module({\n      providers: [\n        {\n          provide: DEPENDENCY,\n          useFactory: async () => {\n            await new Promise((resolve) => setTimeout(resolve, 20));\n            return { auth };\n          },\n        },\n      ],\n      exports: [DEPENDENCY],\n    })\n    class AsyncDependencyModule {}\n    imports.push(\n      BetterAuthModule.forRootAsync({\n        platforms: [options.platform],\n        imports: [AsyncDependencyModule],\n        inject: [DEPENDENCY],\n        useFactory: async (dependency: { auth: AuthLike }) => ({\n          ...moduleOptions,\n          auth: dependency.auth,\n        }),\n      }),\n    );\n  } else {\n    imports.push(\n      BetterAuthModule.forRoot({\n        ...moduleOptions,\n        auth,\n        platforms: [options.platform],\n      } as never),\n    );\n  }\n  if (config.duplicateForRoot) {\n    imports.push(\n      BetterAuthModule.forRoot({ auth, logSummary: false } as never),\n    );\n  }\n  const guard: CanActivate = {\n    canActivate(context: ExecutionContext) {\n      state.accessor.guardKey = state\n        .requests()\n        .key(context.switchToHttp().getRequest());\n      return true;\n    },\n  };\n  const interceptor: NestInterceptor = {\n    intercept(\n      context: ExecutionContext,\n      next: CallHandler,\n    ): Observable<unknown> {\n      state.accessor.interceptorKey = state\n        .requests()\n        .key(context.switchToHttp().getRequest());\n      return next.handle();\n    },\n  };\n\n  @Controller()\n  class ConformanceAppController {\n    @Public()\n    @Post(\"app/echo\")\n    echo(@Body() body: unknown, @Req() request: { rawBody?: Buffer }) {\n      return {\n        body,\n        rawBody: request.rawBody\n          ? Buffer.from(request.rawBody).toString(\"utf8\")\n          : null,\n      };\n    }\n\n    @Public()\n    @Get(\"app/ping\")\n    ping() {\n      return { pong: true };\n    }\n\n    @Public()\n    @Get(\"api/auth/app-owned\")\n    owned() {\n      return { owner: \"app\" };\n    }\n\n    @Get(\"app/me\")\n    me(@CurrentPrincipal() principal: AuthPrincipal | null) {\n      return { userId: principal?.userId ?? null };\n    }\n\n    @RequireAuth({ authoritative: true })\n    @Get(\"app/authoritative\")\n    authoritative(@CurrentPrincipal() principal: AuthPrincipal | null) {\n      return { userId: principal?.userId ?? null };\n    }\n\n    @Public()\n    @UseGuards(guard)\n    @UseInterceptors(interceptor)\n    @Get(\"app/accessor\")\n    accessor(\n      @Req() request: unknown,\n      @Res({ passthrough: true }) response: unknown,\n    ) {\n      const requests = state.requests();\n      const observed = state.accessor;\n      observed.handlerKey = requests.key(request);\n      observed.isRequest = requests.isRequest(request);\n      observed.rejectsPlain = !requests.isRequest({\n        headers: { host: \"localhost\" },\n        url: \"/app/accessor\",\n        method: \"GET\",\n      });\n      observed.rejectsUpgrade = !requests.isRequest(\n        new IncomingMessage(new Socket()),\n      );\n      observed.liveInHandler = requests.isLive(request);\n      observed.request = request;\n      observed.sinkAppended =\n        requests\n          .cookieSink(request, response)\n          ?.append([\"kit_sink=1; Path=/\"]) ?? false;\n      state\n        .adapter()\n        .appendHeader(response, \"Set-Cookie\", \"kit_handler=1; Path=/\");\n      return { ok: true };\n    }\n  }\n\n  @Injectable()\n  class ConformanceHookProvider {\n    @BeforeAuth(\"/probe/html\")\n    record(_context: AuthHookContext<\"/probe/html\">): void {\n      hooks?.push(\"/probe/html\");\n    }\n  }\n\n  @Catch()\n  class ConformanceRecordingFilter extends BaseExceptionFilter {\n    override catch(exception: unknown, host: ArgumentsHost): void {\n      state.filtered.push(exception);\n      super.catch(exception, host);\n    }\n  }\n\n  @Module({\n    imports,\n    controllers: [ConformanceAppController],\n    providers: [\n      ConformanceHookProvider,\n      { provide: APP_FILTER, useClass: ConformanceRecordingFilter },\n    ],\n  })\n  class ConformanceHttpModule implements NestModule, OnApplicationShutdown {\n    configure(consumer: MiddlewareConsumer): void {\n      if (config.middleware) {\n        consumer\n          .apply((_request: unknown, _response: unknown, next: () => void) => {\n            probe.order.push(\"middleware\");\n            next();\n          })\n          .forRoutes({ path: \"*path\", method: RequestMethod.ALL });\n      }\n    }\n\n    async onApplicationShutdown(): Promise<void> {\n      await config.onShutdown?.();\n    }\n  }\n  return ConformanceHttpModule;\n}\n\n/** The factory of an adapter that trusts one forwarding hop, for HTTP/1.1 or HTTP/2, when the options give one. */\nfunction trustingAdapterOf(\n  options: HttpConformanceOptions,\n  http2: boolean | undefined,\n): (() => AbstractHttpAdapter) | undefined {\n  const source = http2 ? options.http2 : options;\n  return source?.createTrustingHttpAdapter\n    ? () => source.createTrustingHttpAdapter!()\n    : undefined;\n}\n\n/** A fresh adapter for a boot: the trusting adapter for a trusted-hop boot when given, else the default one. */\nfunction createAdapter(\n  options: HttpConformanceOptions,\n  config: BootConfig,\n): AbstractHttpAdapter {\n  const trusting = config.trustProxy\n    ? trustingAdapterOf(options, config.http2)\n    : undefined;\n  if (trusting) {\n    return trusting();\n  }\n  return config.http2\n    ? options.http2!.createHttpAdapter()\n    : options.createHttpAdapter();\n}\n\nasync function bootHttp(\n  options: HttpConformanceOptions,\n  bootstrap: Bootstrap,\n  config: BootConfig,\n): Promise<HttpBoot> {\n  const auth = config.instance ?? createConformanceAuth(config.auth);\n  const probe = await probeOf(auth);\n  const logger = new CapturingLogger();\n  const filtered: unknown[] = [];\n  const around: string[] = [];\n  const accessor: AccessorObservation = {};\n  let application: INestApplication | undefined;\n  const adapter = createAdapter(options, config);\n  const requests = () => resolvedPlatform(application!).requests;\n  const module = kitModule(options, auth, probe, config, {\n    filtered,\n    around,\n    accessor,\n    requests,\n    adapter: () => adapter,\n  });\n  const appOptions = { logger, rawBody: true, abortOnError: false };\n  let app: INestApplication;\n  if (bootstrap === \"factory\") {\n    app = await NestFactory.create(module, adapter, appOptions);\n  } else {\n    const moduleRef = await Test.createTestingModule({\n      imports: [module],\n    }).compile();\n    app = moduleRef.createNestApplication(adapter, appOptions);\n  }\n  application = app;\n  try {\n    if (config.cors) {\n      if (options.enableHostCors) {\n        await options.enableHostCors(app, CORS_ORIGIN);\n      } else {\n        app.enableCors({ origin: CORS_ORIGIN, credentials: true });\n      }\n    }\n    if (config.prefix) {\n      app.setGlobalPrefix(config.prefix);\n    }\n    if (config.versioning) {\n      app.enableVersioning({ type: VersioningType.URI });\n    }\n    if (config.trustProxy && !trustingAdapterOf(options, config.http2)) {\n      assert.ok(\n        options.trustOneProxy,\n        \"trustOneProxy or createTrustingHttpAdapter is required here\",\n      );\n      await options.trustOneProxy(app);\n    }\n    await app.init();\n    const url = await baseUrl(options, app);\n    return {\n      app,\n      url,\n      http2: config.http2 === true,\n      auth,\n      probe,\n      logger,\n      filtered,\n      around,\n      accessor,\n      requests,\n      close: () => app.close(),\n    };\n  } catch (error) {\n    await app.close().catch(() => undefined);\n    throw error;\n  }\n}\n\n/** The base URL of an initialized app: the `listen` option, or listen(0) and getUrl(), normalized. */\nasync function baseUrl(\n  options: HttpConformanceOptions,\n  app: INestApplication,\n): Promise<string> {\n  let url: string;\n  if (options.listen) {\n    url = await options.listen(app);\n  } else {\n    await app.listen(0, \"127.0.0.1\");\n    url = await app.getUrl();\n  }\n  return url.replace(\"[::1]\", \"127.0.0.1\").replace(/\\/$/, \"\");\n}\n\nasync function withBoot(\n  options: HttpConformanceOptions,\n  bootstrap: Bootstrap,\n  config: BootConfig,\n  fn: (boot: HttpBoot) => Promise<ConformanceOutcome>,\n): Promise<ConformanceOutcome> {\n  const boot = await bootHttp(options, bootstrap, config);\n  try {\n    return await fn(boot);\n  } finally {\n    await boot.close();\n  }\n}\n\nfunction json(response: RawResponse): Record<string, unknown> {\n  return JSON.parse(response.body.toString(\"utf8\")) as Record<string, unknown>;\n}\n\nasync function echo(\n  boot: HttpBoot,\n  body: Uint8Array | string | undefined,\n  headers: Record<string, string>,\n  chunks?: readonly (Uint8Array | string)[],\n): Promise<{ bytes: Buffer; headers: Map<string, string>; status: number }> {\n  const response = await sendRaw(`${boot.url}${AUTH}/probe/echo-raw`, {\n    method: \"POST\",\n    headers: { origin: KIT_BASE_URL, ...headers },\n    body,\n    chunks,\n  });\n  assert.equal(\n    response.status,\n    200,\n    `echo-raw answered ${response.status}: ${response.body.toString(\"utf8\")}`,\n  );\n  const value = json(response) as {\n    body: string;\n    headers: [string, string][];\n  };\n  return {\n    status: response.status,\n    bytes: Buffer.from(value.body, \"base64\"),\n    headers: new Map(value.headers),\n  };\n}\n\nfunction bodyCase(\n  id: string,\n  title: string,\n  body: () => {\n    bytes?: Uint8Array | string;\n    chunks?: readonly (Uint8Array | string)[];\n    contentType?: string;\n    headers?: Record<string, string>;\n  },\n) {\n  return async (options: HttpConformanceOptions, bootstrap: Bootstrap) =>\n    withBoot(options, bootstrap, {}, async (boot) => {\n      const input = body();\n      const expected = Buffer.concat(\n        (input.chunks ?? (input.bytes === undefined ? [] : [input.bytes])).map(\n          (chunk) => Buffer.from(chunk),\n        ),\n      );\n      const headers: Record<string, string> = { ...input.headers };\n      if (input.contentType) {\n        headers[\"content-type\"] = input.contentType;\n      }\n      if (!input.chunks) {\n        headers[\"content-length\"] = String(expected.length);\n      }\n      const result = await echo(boot, input.bytes, headers, input.chunks);\n      assert.deepEqual(\n        [...result.bytes],\n        [...expected],\n        `${id}: ${title} bytes changed`,\n      );\n      assert.equal(\n        result.headers.get(\"content-type\") ?? null,\n        input.contentType ?? null,\n        `${id}: content-type changed`,\n      );\n    });\n}\n\nasync function waitFor(\n  predicate: () => boolean,\n  message: string,\n  timeoutMs = 2_000,\n): Promise<void> {\n  const started = Date.now();\n  while (!predicate()) {\n    if (Date.now() - started > timeoutMs) {\n      assert.fail(message);\n    }\n    await new Promise((resolve) => setTimeout(resolve, 10));\n  }\n}\n\n/**\n * Runs `fn` with process.env.NODE_ENV set to `value`, then restores it. The kit's production-mode rows use it: the\n * library treats every NODE_ENV except development, dev and test as production (§5.4). Run kit cases sequentially.\n */\nasync function withNodeEnv<T>(value: string, fn: () => Promise<T>): Promise<T> {\n  const previous = process.env.NODE_ENV;\n  process.env.NODE_ENV = value;\n  try {\n    return await fn();\n  } finally {\n    if (previous === undefined) {\n      Reflect.deleteProperty(process.env, \"NODE_ENV\");\n    } else {\n      process.env.NODE_ENV = previous;\n    }\n  }\n}\n\nconst inProduction = <T>(fn: () => Promise<T>) => withNodeEnv(\"production\", fn);\n\n/** The per-IP rule the rate-limit rows apply to /probe/ip, counted in a per-boot store that records every key. */\nconst IP_RULE = { window: 60, max: 2 } as const;\n\nfunction rateLimited(keys: string[]): BootConfig {\n  const counts = new Map<string, number>();\n  return {\n    auth: {\n      rateLimit: {\n        enabled: true,\n        customRules: { \"/probe/ip\": IP_RULE },\n        customStorage: {\n          async consume(key, rule) {\n            keys.push(key);\n            const count = (counts.get(key) ?? 0) + 1;\n            counts.set(key, count);\n            return count > rule.max\n              ? { allowed: false, retryAfter: rule.window }\n              : { allowed: true, retryAfter: null };\n          },\n        },\n      },\n    },\n  };\n}\n\n/** Better Auth trustedProxies covering every loopback address the kit's requests come from. */\nconst loopbackProxies: BootConfig = {\n  auth: {\n    advanced: { ipAddress: { trustedProxies: [\"127.0.0.0/8\", \"::1/128\"] } },\n  },\n};\n\nfunction warningsWith(boot: HttpBoot, ...parts: string[]): string[] {\n  return boot.logger.entries\n    .filter(\n      (entry) =>\n        entry.level === \"warn\" &&\n        parts.every((part) => entry.text.includes(part)),\n    )\n    .map((entry) => entry.text);\n}\n\nfunction http2Origin(boot: HttpBoot): string {\n  return boot.url.replace(/^https?:/, \"http:\");\n}\n\nfunction http2Request(\n  origin: string,\n  headers: Record<string, string>,\n  body?: string,\n): Promise<{ status: number; body: Buffer }> {\n  return new Promise((resolve, reject) => {\n    const session = connect(origin);\n    const chunks: Buffer[] = [];\n    let status = 0;\n    const fail = (error: Error) => {\n      session.close();\n      reject(error);\n    };\n    session.once(\"error\", fail);\n    const stream = session.request(headers);\n    stream.once(\"error\", fail);\n    stream.once(\"response\", (received) => {\n      status = Number(received[\":status\"] ?? 0);\n    });\n    stream.on(\"data\", (chunk: Buffer) => chunks.push(Buffer.from(chunk)));\n    stream.once(\"end\", () => {\n      session.close();\n      resolve({ status, body: Buffer.concat(chunks) });\n    });\n    stream.end(body);\n  });\n}\n\nconst multipartBoundary = \"----conformance-boundary\";\nconst multipartBody = [\n  `--${multipartBoundary}\\r\\n`,\n  'Content-Disposition: form-data; name=\"field\"\\r\\n\\r\\n',\n  \"value  with  spaces\\r\\n\",\n  `--${multipartBoundary}\\r\\n`,\n  'Content-Disposition: form-data; name=\"file\"; filename=\"a.bin\"\\r\\n',\n  \"Content-Type: application/octet-stream\\r\\n\\r\\n\",\n  \"\\u0000\\u0001\\u0002\\r\\n\",\n  `--${multipartBoundary}--\\r\\n`,\n].join(\"\");\n\ntype PerBootstrap = (\n  options: HttpConformanceOptions,\n  bootstrap: Bootstrap,\n) => Promise<ConformanceOutcome>;\n\n/**\n * The HTTP platform kit (invariants H1–H14). Each case boots a real Nest application per bootstrap with a real Better\n * Auth instance that includes conformanceProbePlugin(), an app controller, a @BeforeAuth() hook provider, a recording\n * global filter and an `around` recorder. HTTP/2 is required when the platform declares capabilities.http2. A platform\n * without the capability or the optional proxyTrust(), and a harness with neither trustOneProxy nor\n * createTrustingHttpAdapter for the trusted-hop rows, get a skip with the reason: before the run for platform objects,\n * at run time for classes and definitions. The microservice rows of H-no-adapter need the\n * `microservice` option. Production-mode rows set process.env.NODE_ENV to 'production' while they run and restore it,\n * so run the cases sequentially.\n */\nexport function httpPlatformConformance(\n  options: HttpConformanceOptions,\n): ConformanceCase[] {\n  const bootstraps = options.bootstrap ?? [\"factory\", \"testing\"];\n  const cases: ConformanceCase[] = [];\n  const add = (\n    id: string,\n    title: string,\n    run: PerBootstrap,\n    only?: (bootstrap: Bootstrap) => string | undefined,\n  ) => {\n    for (const bootstrap of bootstraps) {\n      cases.push(\n        conformanceCase(\n          id,\n          `${title} [${bootstrap}]`,\n          () => run(options, bootstrap),\n          only?.(bootstrap),\n        ),\n      );\n    }\n  };\n  const noHttp2 = () =>\n    declaredCapabilities(options.platform) !== undefined &&\n    !declaredCapabilities(options.platform)?.http2\n      ? \"the platform declares no http2 capability\"\n      : undefined;\n  /** A skip when the resolved platform declares no http2 capability; requires the http2 option when it does. */\n  const http2Ready = async (\n    o: HttpConformanceOptions,\n  ): Promise<ConformanceSkip | undefined> => {\n    const capabilities = await capabilitiesOf(o);\n    if (!capabilities?.http2) {\n      return conformanceSkip(\"the platform declares no http2 capability\");\n    }\n    assert.ok(\n      o.http2,\n      \"the platform declares capabilities.http2, so the kit requires the http2 option\",\n    );\n    return undefined;\n  };\n  const noProxyTrust = () =>\n    staticMember(options.platform, \"proxyTrust\") === false\n      ? \"the platform does not implement the optional proxyTrust()\"\n      : undefined;\n  /** A skip when neither trustOneProxy nor the protocol's createTrustingHttpAdapter can make a trusted-hop boot. */\n  const noTrustHook = (http2 = false) =>\n    options.trustOneProxy || trustingAdapterOf(options, http2)\n      ? undefined\n      : http2\n        ? \"neither trustOneProxy nor http2.createTrustingHttpAdapter was given\"\n        : \"neither trustOneProxy nor createTrustingHttpAdapter was given\";\n  /** The static skip of a trusted-hop row: the HTTP/2 row also needs the http2 capability. */\n  const trustedHop = (http2: boolean) => () =>\n    (http2 ? noHttp2() : undefined) ?? noTrustHook(http2);\n  /** The run-time skip of a trusted-hop row, decided from the resolved platform for HTTP/2. */\n  const trustedHopReady = async (\n    o: HttpConformanceOptions,\n    http2: boolean,\n  ): Promise<ConformanceSkip | undefined> =>\n    http2 ? http2Ready(o) : undefined;\n  const overHttp2 = (http2: boolean, title: string) =>\n    http2 ? `over HTTP/2, ${title}` : title;\n\n  add(\n    \"H-mount-methods\",\n    \"every method under the base path reaches Better Auth\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        for (const method of [\n          \"GET\",\n          \"POST\",\n          \"PUT\",\n          \"PATCH\",\n          \"DELETE\",\n          \"HEAD\",\n          \"OPTIONS\",\n        ]) {\n          await sendRaw(`${boot.url}${AUTH}/probe/echo-raw`, {\n            method,\n            headers: { origin: KIT_BASE_URL, \"content-length\": \"0\" },\n          });\n          assert.ok(\n            boot.around.includes(`${method} ${AUTH}/probe/echo-raw`),\n            `${method} did not reach the auth exchange (saw ${boot.around.join(\", \")})`,\n          );\n        }\n      }),\n  );\n  add(\n    \"H-mount-boundary\",\n    \"the bare base path is mounted, /api/authx falls through, and other controllers work\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        await sendRaw(`${boot.url}${AUTH}`);\n        assert.ok(\n          boot.around.includes(`GET ${AUTH}`),\n          \"the bare base path did not reach Better Auth\",\n        );\n        const adjacent = await sendRaw(`${boot.url}/api/authx`);\n        assert.equal(adjacent.status, 404);\n        assert.ok(\n          !boot.around.some((entry) => entry.includes(\"/api/authx\")),\n          \"/api/authx reached Better Auth\",\n        );\n        const ping = await sendRaw(`${boot.url}/app/ping`);\n        assert.equal(ping.status, 200);\n        assert.deepEqual(json(ping), { pong: true });\n      }),\n  );\n  add(\n    \"H-mount-custom-path\",\n    \"basePath and baseURL paths mount there, unaffected by a global prefix and URI versioning\",\n    async (o, b) => {\n      await withBoot(\n        o,\n        b,\n        {\n          auth: { basePath: \"/custom/auth\" },\n          prefix: \"v1\",\n          versioning: true,\n        },\n        async (boot) => {\n          const response = await sendRaw(`${boot.url}/custom/auth/probe/html`);\n          assert.equal(response.status, 200);\n          assert.equal(response.body.toString(\"utf8\"), \"<p>probe</p>\");\n          const ping = await sendRaw(`${boot.url}/v1/app/ping`);\n          assert.equal(ping.status, 200);\n          const prefixed = await sendRaw(\n            `${boot.url}/v1/custom/auth/probe/html`,\n          );\n          assert.notEqual(prefixed.status, 200);\n        },\n      );\n      await withBoot(\n        o,\n        b,\n        { auth: { baseURL: `${KIT_BASE_URL}/base/auth` } },\n        async (boot) => {\n          const response = await sendRaw(`${boot.url}/base/auth/probe/html`);\n          assert.equal(response.status, 200);\n        },\n      );\n    },\n  );\n  const dynamicHosts = [new URL(KIT_BASE_URL).host, \"tenant.example\"];\n  const dynamicMount: BootConfig = {\n    auth: {\n      baseURL: { allowedHosts: dynamicHosts, fallback: KIT_BASE_URL },\n      basePath: DYNAMIC_AUTH,\n    },\n    prefix: \"v1\",\n    versioning: true,\n  };\n  const assertDynamicUrl = (value: unknown, host: string) => {\n    const url = new URL(String(value));\n    assert.equal(\n      url.host,\n      host,\n      `the request URL lost the allowed host ${host}`,\n    );\n    assert.equal(url.pathname, `${DYNAMIC_AUTH}/probe/url`);\n  };\n  add(\n    \"H-mount-custom-path\",\n    \"a dynamic allowedHosts baseURL mounts at basePath for every allowed host, unaffected by a global prefix and URI versioning\",\n    (o, b) =>\n      withBoot(o, b, dynamicMount, async (boot) => {\n        for (const host of dynamicHosts) {\n          const response = await sendRaw(\n            `${boot.url}${DYNAMIC_AUTH}/probe/url`,\n            {\n              headers: { host },\n            },\n          );\n          assert.equal(\n            response.status,\n            200,\n            `${host}: ${response.body.toString(\"utf8\").slice(0, 200)}`,\n          );\n          assertDynamicUrl(json(response).url, host);\n        }\n        const ping = await sendRaw(`${boot.url}/v1/app/ping`);\n        assert.equal(ping.status, 200);\n        const prefixed = await sendRaw(\n          `${boot.url}/v1${DYNAMIC_AUTH}/probe/html`,\n        );\n        assert.notEqual(prefixed.status, 200);\n        const fallthrough = await sendRaw(`${boot.url}${AUTH}/probe/html`);\n        assert.equal(fallthrough.status, 404);\n        assert.ok(\n          !boot.around.some((entry) => entry.includes(AUTH)),\n          `the default base path reached Better Auth: ${boot.around.join(\", \")}`,\n        );\n      }),\n  );\n  add(\n    \"H-mount-custom-path\",\n    \"over HTTP/2, a dynamic allowedHosts baseURL serves the :authority host at basePath\",\n    async (o, b) => {\n      const skip = await http2Ready(o);\n      if (skip) {\n        return skip;\n      }\n      await withBoot(o, b, { ...dynamicMount, http2: true }, async (boot) => {\n        const response = await http2Request(http2Origin(boot), {\n          \":method\": \"GET\",\n          \":path\": `${DYNAMIC_AUTH}/probe/url`,\n          \":authority\": \"tenant.example\",\n        });\n        assert.equal(response.status, 200, response.body.toString(\"utf8\"));\n        assertDynamicUrl(\n          (JSON.parse(response.body.toString(\"utf8\")) as { url: string }).url,\n          \"tenant.example\",\n        );\n      });\n    },\n    noHttp2,\n  );\n  add(\n    \"H-app-route-precedence\",\n    \"a controller route under the base path is served by Nest\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        const response = await sendRaw(`${boot.url}${AUTH}/app-owned`);\n        assert.equal(response.status, 200);\n        assert.deepEqual(json(response), { owner: \"app\" });\n        assert.ok(\n          !boot.around.some((entry) => entry.endsWith(\"/app-owned\")),\n          \"Better Auth also saw the controller route\",\n        );\n      }),\n  );\n\n  const bodies: [string, string, Parameters<typeof bodyCase>[2]][] = [\n    [\n      \"H-body-json\",\n      \"JSON with odd whitespace and key order\",\n      () => ({\n        bytes: '{ \"b\" :1,\\n\\t\"a\":  [ 2 ,1 ] }  ',\n        contentType: \"application/json\",\n      }),\n    ],\n    [\n      \"H-body-utf8\",\n      \"UTF-8 text\",\n      () => ({\n        bytes: '{\"name\":\"Zoë ✓ 認証 🔐\"}',\n        contentType: \"application/json; charset=utf-8\",\n      }),\n    ],\n    [\n      \"H-body-urlencoded\",\n      \"urlencoded b=%20x&c=1\",\n      () => ({\n        bytes: \"b=%20x&c=1\",\n        contentType: \"application/x-www-form-urlencoded\",\n      }),\n    ],\n    [\n      \"H-body-text\",\n      \"text/plain\",\n      () => ({ bytes: \"plain  text\\r\\n\", contentType: \"text/plain\" }),\n    ],\n    [\n      \"H-body-scim\",\n      \"application/scim+json\",\n      () => ({\n        bytes: '{\"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:PatchOp\"]}',\n        contentType: \"application/scim+json\",\n      }),\n    ],\n    [\n      \"H-body-multipart\",\n      \"multipart/form-data\",\n      () => ({\n        bytes: multipartBody,\n        contentType: `multipart/form-data; boundary=${multipartBoundary}`,\n      }),\n    ],\n    [\n      \"H-body-binary\",\n      \"binary bytes 0x00-0xff\",\n      () => ({\n        bytes: Uint8Array.from({ length: 256 }, (_, index) => index),\n        contentType: \"application/octet-stream\",\n      }),\n    ],\n    [\n      \"H-body-chunked\",\n      \"a chunked transfer\",\n      () => ({\n        chunks: ['{\"part\":', '\"one\",', '\"two\":2}'],\n        contentType: \"application/json\",\n      }),\n    ],\n    [\n      \"H-body-empty\",\n      \"an empty body\",\n      () => ({ bytes: \"\", contentType: \"application/json\" }),\n    ],\n    [\n      \"H-body-no-content-type\",\n      \"a body without content-type\",\n      () => ({ bytes: \"raw-bytes\" }),\n    ],\n  ];\n  for (const [id, title, input] of bodies) {\n    add(id, `${title} arrives byte-exact`, bodyCase(id, title, input));\n  }\n  add(\"H-body-form-sign-in\", \"a urlencoded sign-in succeeds\", (o, b) =>\n    withBoot(o, b, {}, async (boot) => {\n      const identity = await kitIdentity(boot.auth, { password: true });\n      const response = await sendRaw(`${boot.url}${AUTH}/sign-in/email`, {\n        method: \"POST\",\n        headers: {\n          origin: KIT_BASE_URL,\n          \"content-type\": \"application/x-www-form-urlencoded\",\n        },\n        body: new URLSearchParams({\n          email: identity.email,\n          password: identity.password!,\n        }).toString(),\n      });\n      assert.equal(\n        response.status,\n        200,\n        response.body.toString(\"utf8\").slice(0, 200),\n      );\n      assert.ok(\n        setCookieLines(response.headers).some((line) =>\n          line.includes(\"session_token=\"),\n        ),\n        \"the sign-in set no session cookie\",\n      );\n    }),\n  );\n\n  const limited: BootConfig = {\n    module: { http: { bodyLimit: 32 } },\n    cors: true,\n  };\n  add(\n    \"H-limit-declared\",\n    \"a declared over-limit body answers 413 with host CORS headers\",\n    (o, b) =>\n      withBoot(o, b, limited, async (boot) => {\n        const response = await sendRaw(`${boot.url}${AUTH}/probe/echo-raw`, {\n          method: \"POST\",\n          headers: {\n            origin: CORS_ORIGIN,\n            \"content-type\": \"application/json\",\n            \"content-length\": \"40\",\n          },\n          body: \"x\".repeat(40),\n        });\n        assert.equal(response.status, 413);\n        assert.equal(\n          response.headers[\"access-control-allow-origin\"],\n          CORS_ORIGIN,\n        );\n        assert.equal(response.body.toString(\"utf8\"), CANONICAL_413);\n        assert.equal(boot.probe.order.length, 0, \"Better Auth was called\");\n      }),\n  );\n  add(\n    \"H-limit-chunked\",\n    \"a chunked over-limit body answers 413 with host CORS headers\",\n    (o, b) =>\n      withBoot(o, b, limited, async (boot) => {\n        const response = await sendRaw(`${boot.url}${AUTH}/probe/echo-raw`, {\n          method: \"POST\",\n          headers: { origin: CORS_ORIGIN, \"content-type\": \"text/plain\" },\n          chunks: [\"x\".repeat(20), \"y\".repeat(20)],\n        });\n        assert.equal(response.status, 413);\n        assert.equal(\n          response.headers[\"access-control-allow-origin\"],\n          CORS_ORIGIN,\n        );\n        assert.equal(response.body.toString(\"utf8\"), CANONICAL_413);\n        assert.equal(boot.probe.order.length, 0, \"Better Auth was called\");\n      }),\n  );\n  add(\n    \"H-limit-canonical-body\",\n    \"the limit is exact and the 413 body is canonical\",\n    (o, b) =>\n      withBoot(o, b, limited, async (boot) => {\n        const exact = await sendRaw(`${boot.url}${AUTH}/probe/echo-raw`, {\n          method: \"POST\",\n          headers: {\n            origin: KIT_BASE_URL,\n            \"content-type\": \"text/plain\",\n            \"content-length\": \"32\",\n          },\n          body: \"z\".repeat(32),\n        });\n        assert.equal(exact.status, 200, \"a body at the limit was rejected\");\n        const over = await sendRaw(`${boot.url}${AUTH}/probe/echo-raw`, {\n          method: \"POST\",\n          headers: {\n            origin: KIT_BASE_URL,\n            \"content-type\": \"text/plain\",\n            \"content-length\": \"33\",\n          },\n          body: \"z\".repeat(33),\n        });\n        assert.equal(over.status, 413);\n        assert.equal(over.body.toString(\"utf8\"), CANONICAL_413);\n      }),\n  );\n  add(\"H-app-parsing\", \"app routes keep Nest body parsing\", (o, b) =>\n    withBoot(o, b, {}, async (boot) => {\n      const response = await sendRaw(`${boot.url}/app/echo`, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\" },\n        body: '{\"value\":1}',\n      });\n      assert.equal(response.status, 201);\n      assert.deepEqual(json(response).body, { value: 1 });\n    }),\n  );\n  add(\"H-app-rawbody\", \"app routes keep rawBody\", (o, b) =>\n    withBoot(o, b, {}, async (boot) => {\n      const raw = '{ \"value\" : 2 }';\n      const response = await sendRaw(`${boot.url}/app/echo`, {\n        method: \"POST\",\n        headers: { \"content-type\": \"application/json\" },\n        body: raw,\n      });\n      assert.equal(json(response).rawBody, raw);\n    }),\n  );\n  add(\"H-url-query\", \"the query string reaches Better Auth unchanged\", (o, b) =>\n    withBoot(o, b, {}, async (boot) => {\n      const path = `${AUTH}/probe/url?code=abc123&state=xyz%3D`;\n      const response = await sendRaw(`${boot.url}${path}`);\n      assert.equal(json(response).url, `${KIT_BASE_URL}${path}`);\n    }),\n  );\n  add(\"H-url-encoded\", \"percent-encoding is preserved\", (o, b) =>\n    withBoot(o, b, {}, async (boot) => {\n      const path = `${AUTH}/probe/url?next=%2Fa%20b%2Bc&mark=%E2%9C%93`;\n      const response = await sendRaw(`${boot.url}${path}`);\n      assert.equal(json(response).url, `${KIT_BASE_URL}${path}`);\n    }),\n  );\n  add(\n    \"H-headers-passthrough\",\n    \"browser, credential and content headers arrive unmodified\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        const headers = {\n          origin: KIT_BASE_URL,\n          referer: `${KIT_BASE_URL}/page?x=1`,\n          \"sec-fetch-site\": \"same-origin\",\n          \"sec-fetch-mode\": \"cors\",\n          \"sec-fetch-dest\": \"empty\",\n          cookie: \"a=1; b=2\",\n          authorization: \"Bearer conformance.token\",\n          \"content-type\": \"application/json; charset=utf-8\",\n        };\n        const result = await echo(boot, \"{}\", {\n          ...headers,\n          \"content-length\": \"2\",\n        });\n        for (const [name, value] of Object.entries(headers)) {\n          assert.equal(result.headers.get(name), value, `${name} changed`);\n        }\n      }),\n  );\n  /** GET /probe/ip over the boot's protocol. */\n  const probeIp = async (\n    boot: HttpBoot,\n    headers: Record<string, string> = {},\n  ): Promise<{ status: number; ip?: unknown; resolved?: unknown }> => {\n    const response = boot.http2\n      ? await http2Request(http2Origin(boot), {\n          \":method\": \"GET\",\n          \":path\": `${AUTH}/probe/ip`,\n          ...headers,\n        })\n      : await sendRaw(`${boot.url}${AUTH}/probe/ip`, { headers });\n    return response.status === 200\n      ? {\n          status: response.status,\n          ...(JSON.parse(response.body.toString(\"utf8\")) as object),\n        }\n      : { status: response.status };\n  };\n  add(\n    \"H-ip-platform\",\n    \"Better Auth's getIP sees the platform client IP\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        const value = await probeIp(boot);\n        assert.equal(\n          value.resolved,\n          LOOPBACK,\n          \"Better Auth resolved no client IP from the request headers the platform set\",\n        );\n        assert.equal(value.ip, LOOPBACK);\n      }),\n  );\n  add(\n    \"H-ip-platform\",\n    \"over HTTP/2, Better Auth's getIP sees the platform client IP\",\n    async (o, b) => {\n      const skip = await http2Ready(o);\n      if (skip) {\n        return skip;\n      }\n      await withBoot(o, b, { http2: true }, async (boot) => {\n        const response = await http2Request(http2Origin(boot), {\n          \":method\": \"GET\",\n          \":path\": `${AUTH}/probe/ip`,\n        });\n        assert.equal(response.status, 200, response.body.toString(\"utf8\"));\n        const value = JSON.parse(response.body.toString(\"utf8\")) as {\n          resolved: unknown;\n        };\n        assert.equal(\n          value.resolved,\n          LOOPBACK,\n          \"Better Auth resolved no client IP over HTTP/2\",\n        );\n      });\n    },\n    noHttp2,\n  );\n  const spoofedIp = {\n    \"x-forwarded-for\": \"203.0.113.20\",\n    \"x-real-ip\": \"203.0.113.21\",\n    [`x-nestjs-kit-better-auth-ip-${\"0\".repeat(32)}`]: \"203.0.113.22\",\n  };\n  add(\n    \"H-ip-platform\",\n    \"in production mode, the platform IP keys a per-IP rate-limit bucket that client-sent IP headers cannot leave\",\n    (o, b) => {\n      const keys: string[] = [];\n      return inProduction(() =>\n        withBoot(o, b, rateLimited(keys), async (boot) => {\n          const first = await probeIp(boot);\n          assert.equal(first.resolved, LOOPBACK);\n          const statuses = [first.status];\n          for (let index = 1; index <= IP_RULE.max; index++) {\n            statuses.push((await probeIp(boot)).status);\n          }\n          assert.deepEqual(\n            statuses,\n            [200, 200, 429],\n            `the per-IP rule (max ${IP_RULE.max}) answered ${statuses.join(\", \")}`,\n          );\n          assert.equal(\n            (await probeIp(boot, spoofedIp)).status,\n            429,\n            \"client-sent IP headers moved the request out of the platform IP's bucket\",\n          );\n          assert.deepEqual(\n            [...new Set(keys)],\n            [`${LOOPBACK}|/probe/ip`],\n            \"the rate limiter was not keyed by the platform IP\",\n          );\n        }),\n      );\n    },\n  );\n  for (const http2 of [false, true]) {\n    add(\n      \"H-ip-platform\",\n      overHttp2(\n        http2,\n        \"in production mode behind a trusted hop, every forwarded client gets its own rate-limit bucket\",\n      ),\n      async (o, b) => {\n        const skip = await trustedHopReady(o, http2);\n        if (skip) {\n          return skip;\n        }\n        const keys: string[] = [];\n        const [left, right] = [\"203.0.113.30\", \"203.0.113.31\"];\n        return inProduction(() =>\n          withBoot(\n            o,\n            b,\n            { ...rateLimited(keys), trustProxy: true, http2 },\n            async (boot) => {\n              const statuses: number[] = [];\n              for (let index = 0; index <= IP_RULE.max; index++) {\n                statuses.push(\n                  (await probeIp(boot, { \"x-forwarded-for\": left })).status,\n                );\n              }\n              assert.deepEqual(statuses, [200, 200, 429]);\n              const other = await probeIp(boot, { \"x-forwarded-for\": right });\n              assert.equal(\n                other.status,\n                200,\n                \"a second client shared the first client's bucket\",\n              );\n              assert.equal(other.resolved, right);\n              assert.deepEqual([...new Set(keys)].sort(), [\n                `${left}|/probe/ip`,\n                `${right}|/probe/ip`,\n              ]);\n            },\n          ),\n        );\n      },\n      trustedHop(http2),\n    );\n  }\n  add(\n    \"H-ip-platform\",\n    \"with trustedProxies covering the platform IP and trust off, Better Auth resolves no IP and B18 warns where proxyTrust() reports 'none'\",\n    (o, b) =>\n      inProduction(() =>\n        withBoot(o, b, loopbackProxies, async (boot) => {\n          const value = await probeIp(boot, {\n            \"x-forwarded-for\": \"203.0.113.40\",\n          });\n          assert.equal(\n            value.resolved,\n            null,\n            `Better Auth resolved ${String(value.resolved)} although trustedProxies covers the socket IP`,\n          );\n          const platform = resolvedPlatform(boot.app);\n          const trust = platform.proxyTrust?.(\n            boot.app.getHttpAdapter() as AbstractHttpAdapter,\n          );\n          const b18 = warningsWith(boot, \"W_CLIENT_IP\", \"trustedProxies\");\n          if (trust?.mode === \"none\") {\n            assert.equal(b18.length, 1, boot.logger.text());\n          }\n        }),\n      ),\n  );\n  for (const http2 of [false, true]) {\n    add(\n      \"H-ip-platform\",\n      overHttp2(\n        http2,\n        \"with trustedProxies covering the proxy and trust on, Better Auth resolves the client IP without a B18 warning\",\n      ),\n      async (o, b) => {\n        const skip = await trustedHopReady(o, http2);\n        if (skip) {\n          return skip;\n        }\n        return inProduction(() =>\n          withBoot(\n            o,\n            b,\n            { ...loopbackProxies, trustProxy: true, http2 },\n            async (boot) => {\n              const value = await probeIp(boot, {\n                \"x-forwarded-for\": \"203.0.113.41\",\n              });\n              assert.equal(\n                value.resolved,\n                \"203.0.113.41\",\n                \"Better Auth did not resolve the client IP behind the trusted hop\",\n              );\n              assert.deepEqual(\n                warningsWith(boot, \"W_CLIENT_IP\", \"trustedProxies\"),\n                [],\n              );\n            },\n          ),\n        );\n      },\n      trustedHop(http2),\n    );\n  }\n  add(\"H-ip-spoof\", \"client-sent client-IP headers are ignored\", (o, b) =>\n    withBoot(o, b, {}, async (boot) => {\n      const response = await sendRaw(`${boot.url}${AUTH}/probe/ip`, {\n        headers: {\n          \"x-forwarded-for\": \"203.0.113.7\",\n          \"x-real-ip\": \"203.0.113.8\",\n          [`x-nestjs-kit-better-auth-ip-${\"0\".repeat(32)}`]: \"203.0.113.9\",\n        },\n      });\n      const ip = json(response).ip;\n      assert.ok(\n        ![\"203.0.113.7\", \"203.0.113.8\", \"203.0.113.9\"].includes(String(ip)),\n        `a spoofed IP reached Better Auth: ${String(ip)}`,\n      );\n    }),\n  );\n  add(\n    \"H-proxy-trust\",\n    \"proxyTrust() reports the effective setting before and after trusting one hop\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        const platform = resolvedPlatform(boot.app);\n        if (typeof platform.proxyTrust !== \"function\") {\n          return conformanceSkip(\n            \"the platform does not implement the optional proxyTrust()\",\n          );\n        }\n        const adapter = boot.app.getHttpAdapter() as AbstractHttpAdapter;\n        const before = platform.proxyTrust(adapter);\n        let after: ReturnType<typeof platform.proxyTrust>;\n        if (o.trustOneProxy) {\n          await o.trustOneProxy(boot.app);\n          after = platform.proxyTrust(adapter);\n        } else {\n          // Trust fixed at construction: compare with an app on the trusting adapter.\n          const trusted = await bootHttp(o, b, { trustProxy: true });\n          try {\n            after = resolvedPlatform(trusted.app).proxyTrust!(\n              trusted.app.getHttpAdapter() as AbstractHttpAdapter,\n            );\n          } finally {\n            await trusted.close();\n          }\n        }\n        if (before.mode === \"unknown\" || after.mode === \"unknown\") {\n          assert.equal(\n            before.mode,\n            after.mode,\n            \"a platform that cannot inspect proxy trust must report unknown consistently\",\n          );\n          return;\n        }\n        assert.notDeepEqual(\n          after,\n          before,\n          \"proxyTrust() did not reflect the trusted hop\",\n        );\n        assert.notEqual(after.mode, \"none\");\n      }),\n    () => noProxyTrust() ?? noTrustHook(),\n  );\n  const forwarded = {\n    \"x-forwarded-proto\": \"https\",\n    \"x-forwarded-host\": \"proxy.example\",\n  };\n  const derivedBaseUrl: BootConfig = {\n    auth: { baseURL: undefined },\n    module: { http: { allowRequestDerivedBaseURL: true } },\n  };\n  const probedUrl = async (boot: HttpBoot) =>\n    new URL(\n      String(\n        json(\n          await sendRaw(`${boot.url}${AUTH}/probe/url`, {\n            headers: forwarded,\n          }),\n        ).url,\n      ),\n    );\n  add(\n    \"H-url-trust-proxy\",\n    \"untrusted forwarding headers leave the request URL unchanged\",\n    (o, b) =>\n      withBoot(o, b, derivedBaseUrl, async (boot) => {\n        const url = await probedUrl(boot);\n        assert.notEqual(url.host, \"proxy.example\", \"untrusted forwarding\");\n        assert.notEqual(url.protocol, \"https:\", \"untrusted forwarding\");\n      }),\n  );\n  add(\n    \"H-url-trust-proxy\",\n    \"a trusted forwarding hop sets the request URL's protocol and host\",\n    (o, b) =>\n      withBoot(o, b, { ...derivedBaseUrl, trustProxy: true }, async (boot) => {\n        assert.equal((await probedUrl(boot)).origin, \"https://proxy.example\");\n      }),\n    () => noTrustHook(),\n  );\n  add(\n    \"H-h2-pseudo\",\n    \"HTTP/2 pseudo-headers never reach Better Auth\",\n    async (o, b) => {\n      const skip = await http2Ready(o);\n      if (skip) {\n        return skip;\n      }\n      await withBoot(o, b, { http2: true }, async (boot) => {\n        const response = await http2Request(\n          http2Origin(boot),\n          {\n            \":method\": \"POST\",\n            \":path\": `${AUTH}/probe/echo-raw`,\n            origin: KIT_BASE_URL,\n            \"content-type\": \"text/plain\",\n          },\n          \"h2 body\",\n        );\n        assert.equal(response.status, 200);\n        const value = JSON.parse(response.body.toString(\"utf8\")) as {\n          headers: [string, string][];\n          body: string;\n        };\n        assert.equal(Buffer.from(value.body, \"base64\").toString(), \"h2 body\");\n        assert.ok(\n          value.headers.every(([name]) => !name.startsWith(\":\")),\n          \"pseudo-headers reached Better Auth\",\n        );\n      });\n    },\n    noHttp2,\n  );\n  add(\n    \"H-resp-multicookie\",\n    \"three Set-Cookie values arrive on separate lines\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        const response = await sendRaw(`${boot.url}${AUTH}/probe/multi-cookie`);\n        const lines = setCookieLines(response.headers);\n        assert.equal(lines.length, 3, `Set-Cookie lines: ${lines.join(\" | \")}`);\n        assert.deepEqual(lines.map((line) => line.split(\"=\", 1)[0]).sort(), [\n          \"probe_a\",\n          \"probe_b\",\n          \"probe_c\",\n        ]);\n      }),\n  );\n  add(\n    \"H-resp-redirect\",\n    \"a 302 with Location and a cookie is not followed\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        const response = await sendRaw(`${boot.url}${AUTH}/probe/redirect`);\n        assert.equal(response.status, 302);\n        assert.equal(\n          response.headers.location,\n          \"https://probe-plugin.example/next\",\n        );\n        assert.ok(\n          setCookieLines(response.headers).some((line) =>\n            line.startsWith(\"probe_redirect=1\"),\n          ),\n        );\n      }),\n  );\n  add(\n    \"H-resp-stream\",\n    \"a three-chunk stream arrives in order and a client abort cancels it\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        const response = await sendRaw(`${boot.url}${AUTH}/probe/stream`);\n        assert.equal(\n          response.body.toString(\"utf8\"),\n          \"chunk-0;chunk-1;chunk-2;\",\n        );\n        boot.probe.streamCancelled = false;\n        await sendRaw(`${boot.url}${AUTH}/probe/stream`, {\n          abortAfterFirstChunk: true,\n        });\n        await waitFor(\n          () => boot.probe.streamCancelled,\n          \"a client abort did not cancel the response stream\",\n        );\n      }),\n  );\n  add(\"H-resp-head\", \"HEAD writes no body and never answers 500\", (o, b) =>\n    withBoot(o, b, {}, async (boot) => {\n      const response = await sendRaw(`${boot.url}${AUTH}/probe/html`, {\n        method: \"HEAD\",\n      });\n      assert.ok(response.status < 500, `HEAD answered ${response.status}`);\n      assert.equal(response.body.length, 0);\n    }),\n  );\n  add(\n    \"H-resp-status\",\n    \"status, HTML and merged Vary pass through; a before-hook APIError becomes its response\",\n    (o, b) =>\n      withBoot(o, b, { cors: true }, async (boot) => {\n        const html = await sendRaw(`${boot.url}${AUTH}/probe/html`, {\n          headers: { origin: CORS_ORIGIN },\n        });\n        assert.equal(html.status, 200);\n        assert.match(String(html.headers[\"content-type\"]), /^text\\/html/);\n        assert.equal(html.body.toString(\"utf8\"), \"<p>probe</p>\");\n        const tokens = (value: unknown) =>\n          String(value ?? \"\")\n            .toLowerCase()\n            .split(\",\")\n            .map((token) => token.trim())\n            .filter(Boolean);\n        const host = tokens(\n          (\n            await sendRaw(`${boot.url}/app/ping`, {\n              headers: { origin: CORS_ORIGIN },\n            })\n          ).headers.vary,\n        );\n        const vary = tokens(html.headers.vary);\n        for (const token of [...host, \"accept\"]) {\n          assert.ok(\n            vary.includes(token),\n            `Vary lost ${token}: ${vary.join(\", \")}`,\n          );\n        }\n        const apiError = await sendRaw(\n          `${boot.url}${AUTH}/probe/throw-api-error`,\n        );\n        assert.equal(apiError.status, 400);\n        assert.equal(json(apiError).code, \"PROBE_API_ERROR\");\n        boot.probe.fault = (path) =>\n          path === \"/probe/html\"\n            ? new APIError(\"FORBIDDEN\", {\n                code: \"PROBE_DENIED\",\n                message: \"denied\",\n              })\n            : undefined;\n        const denied = await sendRaw(`${boot.url}${AUTH}/probe/html`);\n        assert.equal(denied.status, 403);\n        assert.equal(json(denied).code, \"PROBE_DENIED\");\n      }),\n  );\n  add(\n    \"H-cors-preflight\",\n    \"host CORS answers the preflight before Better Auth\",\n    (o, b) =>\n      withBoot(o, b, { cors: true }, async (boot) => {\n        const response = await sendRaw(`${boot.url}${AUTH}/probe/put`, {\n          method: \"OPTIONS\",\n          headers: {\n            origin: CORS_ORIGIN,\n            \"access-control-request-method\": \"PUT\",\n          },\n        });\n        assert.ok(response.status >= 200 && response.status < 300);\n        assert.equal(\n          response.headers[\"access-control-allow-origin\"],\n          CORS_ORIGIN,\n        );\n        assert.ok(\n          !boot.around.some((entry) => entry.startsWith(\"OPTIONS\")),\n          \"the preflight reached Better Auth\",\n        );\n      }),\n  );\n  add(\"H-cors-actual\", \"host CORS adds its headers to auth responses\", (o, b) =>\n    withBoot(o, b, { cors: true }, async (boot) => {\n      const response = await sendRaw(`${boot.url}${AUTH}/probe/html`, {\n        headers: { origin: CORS_ORIGIN },\n      });\n      assert.equal(\n        response.headers[\"access-control-allow-origin\"],\n        CORS_ORIGIN,\n      );\n      assert.equal(\n        response.headers[\"access-control-allow-credentials\"],\n        \"true\",\n      );\n    }),\n  );\n  add(\n    \"H-accessor-key\",\n    \"requests.key() is one object for guards, interceptors and handlers\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        const response = await sendRaw(`${boot.url}/app/accessor`);\n        assert.equal(response.status, 200);\n        const { guardKey, interceptorKey, handlerKey } = boot.accessor;\n        assert.ok(guardKey && typeof guardKey === \"object\");\n        assert.equal(guardKey, interceptorKey);\n        assert.equal(guardKey, handlerKey);\n      }),\n  );\n  add(\n    \"H-accessor-is-request\",\n    \"isRequest() recognizes only platform requests and isLive() turns false after the response\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        await sendRaw(`${boot.url}/app/accessor`);\n        const observed = boot.accessor;\n        assert.equal(observed.isRequest, true);\n        assert.equal(\n          observed.rejectsPlain,\n          true,\n          \"a plain object was accepted\",\n        );\n        assert.equal(\n          observed.rejectsUpgrade,\n          true,\n          \"a bare IncomingMessage (upgrade request) was accepted\",\n        );\n        assert.equal(observed.liveInHandler, true);\n        await waitFor(\n          () => !boot.requests().isLive(observed.request),\n          \"isLive() stayed true after the response was sent\",\n        );\n      }),\n  );\n  add(\n    \"H-accessor-cookie-merge\",\n    \"cookieSink() cookies arrive with the handler's own, and session reads leak no cache headers\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        const response = await sendRaw(`${boot.url}/app/accessor`);\n        assert.equal(boot.accessor.sinkAppended, true);\n        const names = setCookieLines(response.headers).map(\n          (line) => line.split(\"=\", 1)[0],\n        );\n        assert.ok(names.includes(\"kit_sink\"), `cookies: ${names.join(\",\")}`);\n        assert.ok(names.includes(\"kit_handler\"), `cookies: ${names.join(\",\")}`);\n        const identity = await kitIdentity(boot.auth);\n        const me = await sendRaw(`${boot.url}/app/me`, {\n          headers: { cookie: identity.cookie },\n        });\n        assert.equal(me.status, 200);\n        assert.equal(json(me).userId, identity.userId);\n        assert.equal(me.headers.pragma, undefined);\n        assert.ok(\n          !String(me.headers[\"cache-control\"] ?? \"\").includes(\"no-store\"),\n          \"getSession cache headers leaked onto an app route\",\n        );\n      }),\n  );\n  add(\n    \"H-errors-infra\",\n    \"a non-APIError from the exchange reaches the host pipeline as a 5xx\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        const response = await sendRaw(`${boot.url}${AUTH}/probe/html`, {\n          headers: { [THROW_HEADER]: \"1\" },\n        });\n        assert.ok(response.status >= 500, `status ${response.status}`);\n        assert.ok(\n          boot.filtered.some(isInfrastructureError),\n          \"the global filter saw no infrastructure error\",\n        );\n        assert.ok(boot.logger.errors().length > 0, \"Nest logged no error\");\n      }),\n  );\n  add(\n    \"H-errors-filter-sees\",\n    \"the global filter sees exchange failures with a global prefix set\",\n    (o, b) =>\n      withBoot(o, b, { prefix: \"v1\" }, async (boot) => {\n        const response = await sendRaw(`${boot.url}${AUTH}/probe/html`, {\n          headers: { [THROW_HEADER]: \"1\" },\n        });\n        assert.ok(response.status >= 500);\n        assert.ok(boot.filtered.some(isInfrastructureError));\n      }),\n  );\n  add(\n    \"H-errors-apierror-throw\",\n    \"with onAPIError.throw the filter receives the original APIError\",\n    (o, b) =>\n      withBoot(\n        o,\n        b,\n        { auth: { onAPIError: { throw: true } } },\n        async (boot) => {\n          await sendRaw(`${boot.url}${AUTH}/probe/html`, {\n            headers: { [THROW_HEADER]: \"api-error\" },\n          });\n          const error = boot.filtered.find((value) => isAPIError(value)) as\n            | { body?: { code?: string } }\n            | undefined;\n          assert.ok(error, \"the filter did not receive the APIError\");\n          assert.equal(error.body?.code, \"CONFORMANCE_API_ERROR\");\n          const hidden = Reflect.get(error, SDK_HEADERS) as Headers | undefined;\n          assert.deepEqual(hidden?.getSetCookie(), [\n            \"conformance_cleared=; Max-Age=0\",\n          ]);\n        },\n      ),\n  );\n  add(\n    \"H-errors-no-hang\",\n    \"failing endpoints, exchanges and interceptors complete within a timeout\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        const results = await Promise.all([\n          sendRaw(`${boot.url}${AUTH}/probe/throw-error`, { timeoutMs: 3_000 }),\n          sendRaw(`${boot.url}${AUTH}/probe/throw-api-error`, {\n            timeoutMs: 3_000,\n          }),\n          sendRaw(`${boot.url}${AUTH}/probe/html`, {\n            timeoutMs: 3_000,\n            headers: { [THROW_HEADER]: \"1\" },\n          }),\n        ]);\n        assert.ok(results.every((response) => response.status >= 400));\n      }),\n  );\n  add(\n    \"H-middleware-order\",\n    \"MiddlewareConsumer middleware runs before the auth handler\",\n    (o, b) =>\n      withBoot(o, b, { middleware: true }, async (boot) => {\n        await echo(boot, \"{}\", {\n          \"content-type\": \"application/json\",\n          \"content-length\": \"2\",\n        });\n        assert.deepEqual(boot.probe.order, [\"middleware\", \"auth\"]);\n      }),\n  );\n  add(\n    \"H-async-options-factory\",\n    \"a forRootAsync factory behind an async dependency still captures exact bytes\",\n    (o, b) =>\n      withBoot(o, b, { async: true }, async (boot) => {\n        const raw = '{  \"spaced\" :  true }';\n        const result = await echo(boot, raw, {\n          \"content-type\": \"application/json\",\n          \"content-length\": String(raw.length),\n        });\n        assert.equal(result.bytes.toString(\"utf8\"), raw);\n      }),\n  );\n  add(\n    \"H-no-adapter\",\n    \"application contexts and module init boot without an HTTP adapter\",\n    async (o) => {\n      const auth = createConformanceAuth();\n      const bridge = await bridgeOf(auth);\n      const module = kitModule(\n        o,\n        auth,\n        await probeOf(auth),\n        {},\n        {\n          filtered: [],\n          around: [],\n          accessor: {},\n          requests: () => assert.fail(\"no HTTP platform expected\"),\n          adapter: () => assert.fail(\"no HTTP adapter expected\"),\n        },\n      );\n      const context = await NestFactory.createApplicationContext(module, {\n        logger: false,\n        abortOnError: false,\n      });\n      await context.init();\n      assert.equal(bridge.state, \"bound\");\n      await context.close();\n      assert.equal(bridge.state, \"closed\");\n      const moduleRef = await Test.createTestingModule({\n        imports: [module],\n      }).compile();\n      moduleRef.useLogger(false);\n      await moduleRef.init();\n      assert.equal(bridge.state, \"bound\");\n      await moduleRef.close();\n      assert.equal(bridge.state, \"closed\");\n    },\n  );\n  add(\n    \"H-no-adapter\",\n    \"a microservice boots once without an HTTP adapter, with listen() and with init() then listen()\",\n    async (o, b) => {\n      for (const initFirst of [false, true]) {\n        const label = `${b === \"factory\" ? \"NestFactory.createMicroservice()\" : \"Test.createNestMicroservice()\"} with ${initFirst ? \"init() then listen()\" : \"listen()\"}`;\n        const auth = createConformanceAuth();\n        const bridge = await bridgeOf(auth);\n        const logger = new CapturingLogger();\n        const module = kitModule(\n          o,\n          auth,\n          await probeOf(auth),\n          { module: { logSummary: true } },\n          {\n            filtered: [],\n            around: [],\n            accessor: {},\n            requests: () => assert.fail(\"no HTTP platform expected\"),\n            adapter: () => assert.fail(\"no HTTP adapter expected\"),\n          },\n        );\n        const microserviceOptions = {\n          ...o.microservice!(),\n          logger,\n          abortOnError: false,\n        };\n        const microservice: INestMicroservice =\n          b === \"factory\"\n            ? await NestFactory.createMicroservice(module, microserviceOptions)\n            : (\n                await Test.createTestingModule({ imports: [module] }).compile()\n              ).createNestMicroservice(microserviceOptions);\n        try {\n          if (initFirst) {\n            await microservice.init();\n          }\n          await microservice.listen();\n          assert.equal(\n            bridge.state,\n            \"bound\",\n            `${label}: the instance is not bound`,\n          );\n          const summaries = logger.entries.filter((entry) =>\n            entry.text.startsWith(\"'default': \"),\n          );\n          assert.equal(\n            summaries.length,\n            1,\n            `${label}: the lifecycle ran ${summaries.length} times\\n${logger.text()}`,\n          );\n          assert.match(summaries[0]!.text, /not mounted/, label);\n          assert.deepEqual(logger.errors(), [], `${label}: ${logger.text()}`);\n        } finally {\n          await microservice.close();\n        }\n        assert.equal(\n          bridge.state,\n          \"closed\",\n          `${label}: close() left the binding ${bridge.state}`,\n        );\n      }\n    },\n    () =>\n      options.microservice ? undefined : \"no microservice option was given\",\n  );\n  add(\n    \"H-late-adapter\",\n    \"module init followed by an application init fails with LATE_HTTP_ADAPTER\",\n    async (o) => {\n      const auth = createConformanceAuth();\n      const module = kitModule(\n        o,\n        auth,\n        await probeOf(auth),\n        {},\n        {\n          filtered: [],\n          around: [],\n          accessor: {},\n          requests: () => assert.fail(\"unused\"),\n          adapter: () => assert.fail(\"unused\"),\n        },\n      );\n      const moduleRef = await Test.createTestingModule({\n        imports: [module],\n      }).compile();\n      moduleRef.useLogger(false);\n      try {\n        await moduleRef.init();\n        const app = moduleRef.createNestApplication(o.createHttpAdapter(), {\n          logger: false,\n        });\n        const result = await settle(() => app.init());\n        assert.equal(result.ok, false, \"the late adapter was accepted\");\n        assert.ok(\n          bootIssueCodes(!result.ok && result.error).includes(\n            \"LATE_HTTP_ADAPTER\",\n          ) || String(!result.ok && result.error).includes(\"LATE_HTTP_ADAPTER\"),\n          String(!result.ok && result.error),\n        );\n      } finally {\n        await moduleRef.close();\n      }\n    },\n  );\n  add(\n    \"H-reused-testing-module\",\n    \"a second application from one compiled TestingModule follows capabilities.prepareAtInit\",\n    async (o) => {\n      const capabilities = await capabilitiesOf(o);\n      const auth = createConformanceAuth();\n      const around: string[] = [];\n      const hooks: string[] = [];\n      let current: INestApplication | undefined;\n      const module = kitModule(\n        o,\n        auth,\n        await probeOf(auth),\n        {},\n        {\n          filtered: [],\n          around,\n          accessor: {},\n          requests: () => resolvedPlatform(current!).requests,\n          adapter: () => current!.getHttpAdapter() as AbstractHttpAdapter,\n          hooks,\n        },\n      );\n      const moduleRef = await Test.createTestingModule({\n        imports: [module],\n      }).compile();\n      const first = moduleRef.createNestApplication(o.createHttpAdapter(), {\n        logger: false,\n      });\n      current = first;\n      await first.init();\n      await first.close();\n      const second = moduleRef.createNestApplication(o.createHttpAdapter(), {\n        logger: false,\n      });\n      current = second;\n      try {\n        const result = await settle(() => second.init());\n        if (!capabilities?.prepareAtInit) {\n          assert.equal(result.ok, false, \"the second application booted\");\n          assert.match(\n            String(!result.ok && result.error),\n            /APP_ADAPTER_CHANGED/,\n          );\n          return;\n        }\n        assert.equal(\n          result.ok,\n          true,\n          `prepareAtInit platform failed: ${String(!result.ok && result.error)}`,\n        );\n        const url = await baseUrl(o, second);\n        const before = hooks.length;\n        const response = await sendRaw(`${url}${AUTH}/probe/html`);\n        assert.equal(response.status, 200);\n        assert.equal(\n          hooks.length - before,\n          1,\n          \"the second application did not run the @BeforeAuth() hook once\",\n        );\n        const ping = await sendRaw(`${url}/app/ping`);\n        assert.equal(ping.status, 200);\n        const identity = await kitIdentity(auth);\n        const authoritative = await sendRaw(`${url}/app/authoritative`, {\n          headers: { cookie: identity.cookie },\n        });\n        assert.equal(\n          authoritative.status,\n          200,\n          `the second application denied an authoritative route: ${authoritative.body.toString(\"utf8\")}`,\n        );\n        assert.equal(json(authoritative).userId, identity.userId);\n      } finally {\n        await second.close().catch(() => undefined);\n      }\n    },\n  );\n  add(\n    \"H-double-forroot\",\n    \"a second forRoot for the same instance fails boot\",\n    async (o, b) => {\n      const result = await settle(() =>\n        bootHttp(o, b, { duplicateForRoot: true }),\n      );\n      if (result.ok) {\n        await result.value.close();\n        assert.fail(\"a duplicate forRoot booted\");\n      }\n      assert.ok(\n        bootIssueCodes(result.error).includes(\"DUPLICATE_INSTANCE\"),\n        String(result.error),\n      );\n    },\n  );\n  add(\n    \"H-close-keeps-hooks\",\n    \"app.close() closes the binding without unbinding its hooks, and the next application takes it over silently\",\n    async (o, b) => {\n      const auth = createConformanceAuth();\n      const bridge = await bridgeOf(auth);\n      const direct = async () =>\n        (await auth.handler(new Request(`${KIT_BASE_URL}${AUTH}/probe/html`)))\n          .status;\n      const closedHooks: string[] = [];\n      let duringShutdown: number | undefined;\n      const first = await bootHttp(o, b, {\n        instance: auth,\n        hooks: closedHooks,\n        onShutdown: async () => {\n          duringShutdown = await direct();\n        },\n      });\n      try {\n        const served = await sendRaw(`${first.url}${AUTH}/probe/html`);\n        assert.equal(served.status, 200);\n        assert.equal(\n          closedHooks.length,\n          1,\n          \"the @BeforeAuth() hook did not run\",\n        );\n      } finally {\n        await first.close();\n      }\n      const warns = (boot: HttpBoot) =>\n        boot.logger.entries\n          .filter((entry) => entry.level === \"warn\")\n          .map((entry) => entry.text);\n      const expected = new Set(warns(first));\n      assert.equal(duringShutdown, 200);\n      assert.equal(\n        closedHooks.length,\n        2,\n        \"a Better Auth call from another module's shutdown hook skipped the application's @BeforeAuth() hook\",\n      );\n      assert.equal(\n        bridge.state,\n        \"closed\",\n        `app.close() left the binding ${bridge.state}`,\n      );\n      assert.equal(await direct(), 200);\n      assert.equal(\n        closedHooks.length,\n        3,\n        \"a Better Auth call after app.close() skipped the closed application's @BeforeAuth() hook\",\n      );\n      const nextHooks: string[] = [];\n      await withBoot(\n        o,\n        b,\n        { instance: auth, hooks: nextHooks },\n        async (next) => {\n          assert.equal(bridge.state, \"bound\");\n          assert.deepEqual(\n            warns(next).filter((text) => !expected.has(text)),\n            [],\n            \"the next application warned while taking over the closed binding\",\n          );\n          const served = await sendRaw(`${next.url}${AUTH}/probe/html`);\n          assert.equal(served.status, 200);\n          assert.equal(\n            nextHooks.length,\n            1,\n            \"the next application's hook did not run\",\n          );\n          assert.equal(\n            closedHooks.length,\n            3,\n            \"the closed application's hook still ran after the next application bound\",\n          );\n        },\n      );\n    },\n  );\n  add(\n    \"H-diagnostics-404\",\n    \"an unknown auth path logs one WARN with a suggestion and keeps the 404\",\n    (o, b) =>\n      withBoot(\n        o,\n        b,\n        { module: { http: { diagnostics: true } } },\n        async (boot) => {\n          for (let index = 0; index < 2; index++) {\n            const response = await sendRaw(\n              `${boot.url}${AUTH}/sign-inn/email`,\n              {\n                method: \"POST\",\n                headers: {\n                  origin: KIT_BASE_URL,\n                  \"content-type\": \"application/json\",\n                },\n                body: \"{}\",\n              },\n            );\n            assert.equal(response.status, 404);\n          }\n          const warnings = boot.logger.entries.filter(\n            (entry) =>\n              entry.level === \"warn\" &&\n              entry.text.includes(`${AUTH}/sign-inn/email`),\n          );\n          assert.equal(warnings.length, 1, boot.logger.text());\n          assert.match(warnings[0]!.text, /Did you mean/);\n        },\n      ),\n  );\n  const proxyWarnings = (boot: HttpBoot) =>\n    warningsWith(boot, \"W_PROXY_UNTRUSTED\");\n  add(\n    \"H-proxy-untrusted-warning\",\n    \"in production with proxy trust off, the first forwarded auth request logs W_PROXY_UNTRUSTED once and changes no response\",\n    (o, b) =>\n      inProduction(() =>\n        withBoot(o, b, {}, async (boot) => {\n          const platform = resolvedPlatform(boot.app);\n          if (typeof platform.proxyTrust !== \"function\") {\n            return conformanceSkip(\n              \"the platform does not implement the optional proxyTrust()\",\n            );\n          }\n          const trust = platform.proxyTrust(\n            boot.app.getHttpAdapter() as AbstractHttpAdapter,\n          );\n          if (trust.mode !== \"none\") {\n            return conformanceSkip(\n              `a fresh adapter reports proxy trust '${trust.mode}', not 'none'`,\n            );\n          }\n          const html = async (headers: Record<string, string> = {}) => {\n            const response = await sendRaw(`${boot.url}${AUTH}/probe/html`, {\n              headers,\n            });\n            assert.equal(response.status, 200);\n            assert.equal(response.body.toString(\"utf8\"), \"<p>probe</p>\");\n          };\n          await html();\n          assert.deepEqual(\n            proxyWarnings(boot),\n            [],\n            \"a request without forwarding headers logged\",\n          );\n          const ping = await sendRaw(`${boot.url}/app/ping`, {\n            headers: { \"x-forwarded-for\": \"203.0.113.50\" },\n          });\n          assert.equal(ping.status, 200);\n          assert.deepEqual(proxyWarnings(boot), [], \"an app route logged\");\n          await html({ \"x-forwarded-for\": \"203.0.113.51\" });\n          const [warning, ...repeated] = proxyWarnings(boot);\n          assert.ok(\n            warning,\n            \"a forwarded auth request logged no W_PROXY_UNTRUSTED\",\n          );\n          assert.ok(\n            warning.includes(`socket IP ${LOOPBACK}.`),\n            `the warning did not name the platform's socket IP: ${warning}`,\n          );\n          assert.ok(\n            !warning.includes(\"203.0.113.51\"),\n            \"the warning named a client-sent address as the socket IP\",\n          );\n          assert.deepEqual(repeated, []);\n          await html({ forwarded: \"for=203.0.113.52\" });\n          await html({ \"x-real-ip\": \"203.0.113.53\" });\n          assert.equal(\n            proxyWarnings(boot).length,\n            1,\n            \"W_PROXY_UNTRUSTED was logged more than once per application\",\n          );\n        }),\n      ),\n    noProxyTrust,\n  );\n  add(\n    \"H-proxy-untrusted-warning\",\n    \"outside production, forwarded auth requests log no W_PROXY_UNTRUSTED\",\n    (o, b) =>\n      withNodeEnv(\"test\", () =>\n        withBoot(o, b, {}, async (boot) => {\n          await sendRaw(`${boot.url}${AUTH}/probe/html`, {\n            headers: { \"x-forwarded-for\": \"203.0.113.54\" },\n          });\n          assert.deepEqual(proxyWarnings(boot), []);\n        }),\n      ),\n    noProxyTrust,\n  );\n  // Behind a trusted hop no platform may cause the warning: one without proxyTrust() must not be taken for 'none'.\n  for (const http2 of [false, true]) {\n    add(\n      \"H-proxy-untrusted-warning\",\n      overHttp2(\n        http2,\n        \"in production behind a trusted hop, forwarded auth requests log no W_PROXY_UNTRUSTED\",\n      ),\n      async (o, b) => {\n        const skip = await trustedHopReady(o, http2);\n        if (skip) {\n          return skip;\n        }\n        return inProduction(() =>\n          withBoot(o, b, { trustProxy: true, http2 }, async (boot) => {\n            const headers = { \"x-forwarded-for\": \"203.0.113.55\" };\n            const response = boot.http2\n              ? await http2Request(http2Origin(boot), {\n                  \":method\": \"GET\",\n                  \":path\": `${AUTH}/probe/html`,\n                  ...headers,\n                })\n              : await sendRaw(`${boot.url}${AUTH}/probe/html`, { headers });\n            assert.equal(response.status, 200);\n            assert.deepEqual(proxyWarnings(boot), []);\n          }),\n        );\n      },\n      trustedHop(http2),\n    );\n  }\n  add(\n    \"H-log-hygiene\",\n    \"session and probe cookies never appear in captured logs\",\n    (o, b) =>\n      withBoot(o, b, {}, async (boot) => {\n        const identity = await kitIdentity(boot.auth);\n        const token = identity.cookie.split(\"=\")[1]!.split(\".\")[0]!;\n        await sendRaw(`${boot.url}${AUTH}/probe/multi-cookie`);\n        await sendRaw(`${boot.url}${AUTH}/probe/throw-error`, {\n          headers: { cookie: identity.cookie },\n        });\n        boot.probe.fault = () => new Error(`storage failed for ${token}`);\n        await sendRaw(`${boot.url}/app/me`, {\n          headers: { cookie: identity.cookie },\n        });\n        const text = boot.logger.text();\n        assert.ok(!text.includes(token), \"a session token reached the logs\");\n        assert.ok(!text.includes(\"gamma\"), \"a probe cookie reached the logs\");\n      }),\n  );\n  return cases;\n}\n\nasync function bridgeOf(auth: AuthLike): Promise<BridgeHandle> {\n  const context = (await auth.$context) as { getPlugin(id: string): unknown };\n  const plugin = context.getPlugin(\"@nestjs-kit/better-auth\") as object;\n  return Reflect.get(plugin, BRIDGE_HANDLE) as BridgeHandle;\n}\n","import {\n  Controller,\n  Get,\n  type ExecutionContext,\n  type INestApplication,\n  type LoggerService,\n  type Provider,\n} from \"@nestjs/common\";\nimport { Test, type TestingModule } from \"@nestjs/testing\";\nimport type { BetterAuthOptions } from \"better-auth\";\nimport type {\n  AuthorizationDecision,\n  AuthorizationPolicy,\n  AuthPrincipalBase,\n  AuthTransport,\n  CookieSink,\n  ExtensionRef,\n  PolicyInvoker,\n  PrincipalResolver,\n  PrincipalSource,\n  Requirement,\n  RequirementExpr,\n  RoutePlan,\n  SessionPrincipalOptions,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport { Require } from \"./auth-decorators.js\";\nimport {\n  type AuthFailure,\n  AuthFailures,\n  BetterAuthConfigurationError,\n} from \"./auth-errors.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport { BetterAuthModule } from \"./auth-module.js\";\nimport {\n  INSTANCE_REGISTRY,\n  POLICY_INVOKER,\n  POLICY_RESOLVER,\n  PRINCIPAL_RESOLVER,\n  REQUEST_SCOPE,\n  ROUTE_PLANNER,\n} from \"./auth-tokens.js\";\nimport type { AuthLike, AuthPrincipal, PrincipalKind } from \"./auth-types.js\";\nimport { AuthorizationEvaluator } from \"./authorization-evaluator.js\";\nimport {\n  CapturingLogger,\n  type ConformanceOutcome,\n  probeOf,\n  type ProbeState,\n  createConformanceAuth,\n  PROBE_TRUSTED_ORIGIN,\n  testHelpers,\n} from \"./conformance-fixtures.js\";\nimport type {\n  FixtureHandler,\n  TransportInvocationResult,\n} from \"./conformance-transport.js\";\nimport type { InstanceRegistry } from \"./instance-registry.js\";\nimport type { PolicyResolver } from \"./policy-resolver.js\";\nimport { absent, authenticated, rejected } from \"./principal-resolver.js\";\nimport type { RequestScope } from \"./request-scope.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport { authHeadersFor } from \"./testing.js\";\n\nexport interface PolicyConformanceOptions {\n  /**\n   * The requirement to judge. Its policies must be policy objects: the kit boots no application providers, so a class\n   * or token reference cannot resolve. For a DI policy, pass an instance built with its dependencies (new MyPolicy(deps)).\n   */\n  requirement: RequirementExpr;\n  /**\n   * The Better Auth instance the principals belong to. It must include conformanceProbePlugin(), testUtils(), the\n   * policy's plugins and nestjs(): createConformanceAuth({ plugins }) builds one. Session principals are judged with\n   * real session headers for their user (testUtils().getAuthHeaders). Unit-specific cases use the instance's plugins\n   * when present: session.cookieCache for the warm-cache variants, apiKey({ enableSessionForAPIKeys: true }) for the\n   * API-key session and quota cases; each states the reason when it skips.\n   */\n  auth: AuthLike;\n  allowingPrincipal(): Promise<AuthPrincipal>;\n  denyingPrincipal(): Promise<AuthPrincipal>;\n  delegatedPrincipal?(): Promise<AuthPrincipal>;\n  /**\n   * Principal sources the kit registers besides the built-in session source, for the requirement's other principal kinds\n   * (e.g. apiKeyPrincipal()). Cases that send a request through the guard resolve those kinds with them; without them\n   * the kit registers placeholder sources that resolve nothing.\n   */\n  sources?: readonly ExtensionRef<PrincipalSource>[];\n  /**\n   * Transports to deliver the transport-specific rows through, besides the kit's in-process request: each delivery adds\n   * its own variants of Z-admin-banned (connection deliveries with a principal TTL), Z-admin-rejects-api-key-session,\n   * Z-apikey-quota-per-request and Z-org-ref-types, titled with its name.\n   */\n  deliveries?: readonly PolicyDelivery[];\n  /**\n   * Builds the instances the kit needs in another configuration (adminUserIds, customSession shapes, a dynamic baseURL,\n   * an instance without apiKey()) with exactly the given overrides, on the storage under test. It must add what\n   * createConformanceAuth() adds (testUtils(), bearer(), conformanceProbePlugin(), nestjs(), an explicit\n   * advanced.disableOriginCheck: false and session.updateAge 0) and have its schema migrated. Default:\n   * createConformanceAuth(overrides), on the memory adapter.\n   */\n  variant?(\n    overrides: Omit<BetterAuthOptions, \"database\">,\n  ): AuthLike | Promise<AuthLike>;\n}\n\n/**\n * A transport the policy kit delivers its transport-specific rows through (design v7 §14.1). Build it from the harness\n * of a transportConformance run: it exposes the kit's handlers the way that harness exposes the transport kit's fixtures.\n */\nexport interface PolicyDelivery {\n  /** The transport's name in case titles, e.g. 'Socket.IO'. */\n  readonly name: string;\n  /**\n   * Boots an app with BetterAuthModule's globalGuard that exposes each handler under its name in the transport's shape:\n   * a gateway message with explicit coverage, a message pattern or a GraphQL query field, plus the subscription field\n   * that connect()'s operations select on a GraphQL socket. Apply the handler's decorators like transportConformance's\n   * createApp does. The kit's only named input is `orgId`: pass its value through with its JSON type (a GraphQL\n   * harness declares a JSON scalar argument), so ctx.param('orgId') reads it unchanged. Pass `principals` to\n   * BetterAuthModule and use `logger` from boot on. The kit closes the app.\n   */\n  createApp(\n    handlers: Readonly<Record<string, FixtureHandler>>,\n    auth: AuthLike,\n    options: {\n      readonly principals: readonly ExtensionRef<PrincipalSource>[];\n      readonly logger: LoggerService;\n    },\n  ): Promise<INestApplication>;\n  /**\n   * One logical request to a handler with the given headers: a message on its own connection, an RPC request, an\n   * operation. The kit's headers carry the probe plugin's trusted Origin, as a browser on a trusted page sends it.\n   */\n  invoke(\n    app: INestApplication,\n    handler: string,\n    headers: HeadersInit,\n    input?: Record<string, unknown>,\n  ): Promise<TransportInvocationResult>;\n  /**\n   * Connection deliveries (WebSocket gateways, graphql-ws): opens one connection whose handshake carries `headers`.\n   * Its invoke() sends one message, or one subscription operation for GraphQL, after the previous one answered.\n   */\n  connect?(\n    app: INestApplication,\n    headers: HeadersInit,\n  ): Promise<PolicyDeliveryConnection>;\n  /**\n   * The principal TTL of connect()'s connections: the transport's principalTtlMs or subscriptionPrincipalTtlMs. The\n   * connection variant of Z-admin-banned runs when it is positive, and checks that the connection reuses its principal.\n   */\n  readonly connectionPrincipalTtlMs?: number;\n}\n\n/** One connection of a PolicyDelivery. */\nexport interface PolicyDeliveryConnection {\n  invoke(\n    handler: string,\n    input?: Record<string, unknown>,\n  ): Promise<TransportInvocationResult>;\n  close(): Promise<void>;\n}\n\n/** An instance with the given overrides, built by options.variant() or createConformanceAuth(). */\nexport async function variantOf(\n  options: Pick<PolicyConformanceOptions, \"variant\">,\n  overrides: Omit<BetterAuthOptions, \"database\">,\n): Promise<AuthLike> {\n  return options.variant\n    ? await options.variant(overrides)\n    : createConformanceAuth(overrides);\n}\n\nexport function requirementsOf(expression: RequirementExpr): Requirement[] {\n  return \"anyOf\" in expression\n    ? expression.anyOf.flatMap(requirementsOf)\n    : \"allOf\" in expression\n      ? expression.allOf.flatMap(requirementsOf)\n      : [expression];\n}\n\nfunction isPolicyObject(value: unknown): value is AuthorizationPolicy<unknown> {\n  return (\n    !!value &&\n    typeof value === \"object\" &&\n    typeof (value as AuthorizationPolicy<unknown>).evaluate === \"function\"\n  );\n}\n\n/** The policy objects of a requirement; the kit rejects class and token references up front. */\nexport function staticPolicies(\n  expression: RequirementExpr,\n): AuthorizationPolicy<unknown>[] {\n  return requirementsOf(expression).map((item) => {\n    if (!isPolicyObject(item.policy)) {\n      throw new BetterAuthConfigurationError(\n        \"CONFORMANCE_POLICY_OBJECT_REQUIRED\",\n        `policyConformance received a requirement whose policy is a class or injection token (${String((item.policy as { name?: unknown })?.name ?? item.policy)}); the kit registers no application providers to resolve it.`,\n        \"Pass the policy object, e.g. requirement(new MyPolicy(dependencies), params).\",\n      );\n    }\n    return item.policy;\n  });\n}\n\nexport const KIT_ROUTE = \"handle\";\n\n/** A controller with one method per route, each carrying the given method decorators. */\nfunction controllerFor(\n  routes: Readonly<Record<string, readonly MethodDecorator[]>>,\n) {\n  @Controller(\"nestjs-kit-better-auth-policy-conformance\")\n  class PolicyConformanceController {}\n  for (const [name, decorators] of Object.entries(routes)) {\n    const method = function handle(): void {};\n    Object.defineProperty(method, \"name\", { value: name });\n    Object.defineProperty(PolicyConformanceController.prototype, name, {\n      value: method,\n      writable: true,\n      configurable: true,\n    });\n    const descriptor = Object.getOwnPropertyDescriptor(\n      PolicyConformanceController.prototype,\n      name,\n    )!;\n    for (const decorator of [Get(name), ...decorators].reverse()) {\n      decorator(PolicyConformanceController.prototype, name, descriptor);\n    }\n  }\n  return PolicyConformanceController;\n}\n\nexport const CONFORMANCE_KIND_SOURCE =\n  \"@nestjs-kit/better-auth:conformance-kind\";\n\n/**\n * Placeholder sources for the non-session kinds a requirement names that no given source produces, so boot validation\n * (B15) sees producers of every judged kind. They never resolve anything: the evaluator-level cases hand principals to\n * the evaluator directly.\n */\nfunction kindSources(\n  expressions: readonly RequirementExpr[],\n  produced: ReadonlySet<string>,\n): PrincipalSource[] {\n  const kinds = new Set<string>();\n  for (const item of expressions.flatMap(requirementsOf)) {\n    const policy = isPolicyObject(item.policy) ? item.policy : undefined;\n    for (const kind of item.principals ?? policy?.requires?.principals ?? []) {\n      kinds.add(kind);\n    }\n  }\n  kinds.delete(\"session\");\n  return [...kinds]\n    .filter((kind) => !produced.has(kind))\n    .map((kind) => ({\n      id: `${CONFORMANCE_KIND_SOURCE}:${kind}`,\n      kinds: [kind] as PrincipalSource[\"kinds\"],\n      acceptance: \"explicit\",\n      delegates: true,\n      resolve: async () => ({ outcome: \"absent\" }) as const,\n    }));\n}\n\nfunction kindsOf(source: ExtensionRef<PrincipalSource>): readonly string[] {\n  return typeof source === \"object\" &&\n    source !== null &&\n    Array.isArray((source as PrincipalSource).kinds)\n    ? (source as PrincipalSource).kinds\n    : [];\n}\n\nexport interface BootOptions {\n  /**\n   * Routes by method name, each with its method decorators. Default: one route requiring `expression`; with routes,\n   * `expression` only names the kinds that need placeholder sources.\n   */\n  routes?: Readonly<Record<string, readonly MethodDecorator[]>>;\n  sources?: readonly ExtensionRef<PrincipalSource>[];\n  providers?: readonly Provider[];\n  session?: SessionPrincipalOptions<unknown> | false;\n  transports?: readonly ExtensionRef<AuthTransport>[];\n  logger?: CapturingLogger;\n}\n\nexport interface Booted {\n  readonly moduleRef: TestingModule;\n  readonly controller: ReturnType<typeof controllerFor>;\n  readonly logger: CapturingLogger;\n}\n\n/** Boot a TestingModule with the kit's controller and the given requirement; failures close the module. */\nexport async function boot(\n  auth: AuthLike,\n  expression: RequirementExpr | undefined,\n  options: BootOptions = {},\n): Promise<Booted> {\n  const routes = options.routes ?? {\n    [KIT_ROUTE]: expression ? [Require(expression)] : [],\n  };\n  const expressions = expression ? [expression] : [];\n  const produced = new Set(\n    (options.sources ?? []).flatMap((source) => [...kindsOf(source)]),\n  );\n  const sources = [\n    ...(options.sources ?? []),\n    ...kindSources(expressions, produced),\n  ];\n  const controller = controllerFor(routes);\n  const logger = options.logger ?? new CapturingLogger();\n  const moduleRef = await Test.createTestingModule({\n    imports: [\n      BetterAuthModule.forRoot({\n        auth,\n        principals: sources,\n        http: { mount: false },\n        logSummary: false,\n        ...(options.transports ? { transports: options.transports } : {}),\n        ...(options.session === undefined ? {} : { session: options.session }),\n      } as never),\n    ],\n    controllers: [controller],\n    providers: [...(options.providers ?? [])],\n  }).compile();\n  moduleRef.useLogger(logger);\n  try {\n    await moduleRef.init();\n  } catch (error) {\n    await moduleRef.close().catch(() => undefined);\n    throw error;\n  }\n  return { moduleRef, controller, logger };\n}\n\nexport interface DecideCall {\n  key?: object;\n  invocation?: object;\n  /** The request's headers; default: fresh session headers for a non-delegated principal's user, none otherwise. */\n  headers?: Headers;\n  /** Runs after the principal's session headers exist, right before evaluation. */\n  beforeEvaluate?: () => void | Promise<void>;\n}\n\n/** The evaluator-level harness: principals go straight to the real AuthorizationEvaluator. */\nexport interface Harness {\n  readonly auth: AuthLike;\n  readonly probe: ProbeState;\n  readonly invocations: { count: number };\n  readonly policies: PolicyResolver;\n  readonly logger: CapturingLogger;\n  decide(\n    principal: AuthPrincipal,\n    call?: DecideCall,\n  ): Promise<AuthorizationDecision>;\n  close(): Promise<void>;\n}\n\nexport async function harness(\n  options: Pick<PolicyConformanceOptions, \"auth\" | \"requirement\" | \"sources\">,\n): Promise<Harness> {\n  const probe = await probeOf(options.auth);\n  const { moduleRef, controller, logger } = await boot(\n    options.auth,\n    options.requirement,\n    { sources: options.sources },\n  );\n  const real = moduleRef.get<PolicyInvoker>(POLICY_INVOKER);\n  const invocations = { count: 0 };\n  const counting: PolicyInvoker = {\n    invoke(policy, params, context) {\n      invocations.count++;\n      return real.invoke(policy, params, context);\n    },\n  };\n  const policies = moduleRef.get<PolicyResolver>(POLICY_RESOLVER);\n  const evaluator = new AuthorizationEvaluator(\n    policies,\n    counting,\n    moduleRef.get<PrincipalResolver>(PRINCIPAL_RESOLVER),\n    moduleRef.get<RequestScope>(REQUEST_SCOPE),\n  );\n  const plan: RoutePlan = moduleRef\n    .get<RoutePlanner>(ROUTE_PLANNER)\n    .plan(controller, KIT_ROUTE);\n  const entry = moduleRef\n    .get<InstanceRegistry>(INSTANCE_REGISTRY)\n    .get(\"default\");\n  const execution = {\n    getClass: () => controller,\n    getHandler: () => Reflect.get(controller.prototype, KIT_ROUTE),\n    getArgs: () => [],\n    getArgByIndex: () => undefined,\n    getType: () => \"@nestjs-kit/better-auth:conformance\",\n  } as unknown as ExecutionContext;\n  return {\n    auth: options.auth,\n    probe,\n    invocations,\n    policies,\n    logger,\n    async decide(principal, ids = {}) {\n      const headers =\n        ids.headers ??\n        (principal.userId && !principal.delegation\n          ? await authHeadersFor(options.auth, principal.userId)\n          : new Headers());\n      const key = ids.key ?? {};\n      const call: TransportCall = {\n        key,\n        invocation: ids.invocation ?? key,\n        headers: () => new Headers(headers),\n        clientIp: null,\n        cookies: null,\n        param: () => undefined,\n      };\n      await ids.beforeEvaluate?.();\n      return evaluator.evaluate(\n        plan,\n        principal,\n        call,\n        entry,\n        execution,\n        \"conformance\",\n      );\n    },\n    close: () => moduleRef.close(),\n  };\n}\n\nfunction resetFaults(probe: ProbeState): void {\n  probe.fault = undefined;\n  probe.storageFault = undefined;\n  probe.respond = undefined;\n}\n\nexport async function withHarness(\n  options: Pick<PolicyConformanceOptions, \"auth\" | \"requirement\" | \"sources\">,\n  fn: (harness: Harness) => Promise<ConformanceOutcome>,\n): Promise<ConformanceOutcome> {\n  const value = await harness(options);\n  try {\n    return await fn(value);\n  } finally {\n    resetFaults(value.probe);\n    await value.close();\n  }\n}\n\n/** Better Auth endpoints dispatched since `from`, without the session reads. */\nexport function betterAuthCalls(probe: ProbeState, from: number): string[] {\n  return probe.calls.slice(from).filter((path) => path !== \"/get-session\");\n}\n\nexport function sessionReads(probe: ProbeState, from: number): number {\n  return probe.calls.slice(from).filter((path) => path === \"/get-session\")\n    .length;\n}\n\n// ── Request harness: calls through the real BetterAuthGuard ─────────────────\n\nconst KIT_CONTEXT = \"@nestjs-kit/better-auth:policy-conformance\";\n\ninterface KitMessage {\n  readonly headers: Headers;\n  readonly input: Record<string, unknown>;\n  readonly key: object;\n  readonly invocation: object;\n  readonly sink: CookieSink;\n}\n\nclass KitDenial extends Error {\n  constructor(readonly failure: AuthFailure) {\n    super(failure.message);\n  }\n}\n\n/**\n * The kit's in-process transport: one message is one logical request with one invocation. It is cookie-capable\n * (a recording sink), carries no browser leg and reads `param(name)` from the message input.\n */\nclass PolicyKitTransport implements AuthTransport {\n  readonly id = \"@nestjs-kit/better-auth:conformance/policy-request\";\n\n  handles(context: ExecutionContext): boolean {\n    return context.getType<string>() === KIT_CONTEXT;\n  }\n\n  describe(context: ExecutionContext): TransportCall {\n    const [message] = context.getArgs() as [KitMessage];\n    return {\n      key: message.key,\n      invocation: message.invocation,\n      headers: () => new Headers(message.headers),\n      clientIp: null,\n      cookies: message.sink,\n      param: (name) => message.input[name],\n    };\n  }\n\n  toException(failure: AuthFailure): unknown {\n    return new KitDenial(failure);\n  }\n}\n\n/** What one request through the guard answered: allowed, a denial with its status, or a 5xx. */\nexport type RequestOutcome =\n  | { readonly ok: true; readonly status: 200 }\n  | {\n      readonly ok: false;\n      readonly status: number;\n      readonly code?: string;\n      readonly reason?: string;\n      readonly error?: unknown;\n    };\n\n/** One connection of a connection delivery: each request is one message or operation on it. */\nexport interface RequestConnection {\n  request(\n    route: string,\n    input?: Record<string, unknown>,\n  ): Promise<RequestOutcome>;\n  close(): Promise<void>;\n}\n\nexport interface RequestHarness {\n  readonly probe: ProbeState;\n  readonly logger: CapturingLogger;\n  request(\n    route: string,\n    headers: HeadersInit,\n    input?: Record<string, unknown>,\n  ): Promise<RequestOutcome>;\n  /** Connection deliveries only. */\n  connect?(headers: HeadersInit): Promise<RequestConnection>;\n  close(): Promise<void>;\n}\n\nexport type RequestOptions = Omit<BootOptions, \"transports\"> & {\n  routes: Readonly<Record<string, readonly MethodDecorator[]>>;\n};\n\nexport async function requestHarness(\n  auth: AuthLike,\n  options: RequestOptions,\n): Promise<RequestHarness> {\n  const probe = await probeOf(auth);\n  const { moduleRef, controller, logger } = await boot(auth, undefined, {\n    ...options,\n    transports: [new PolicyKitTransport()],\n  });\n  const guard = moduleRef.get(BetterAuthGuard, { strict: false });\n  return {\n    probe,\n    logger,\n    async request(route, headers, input = {}) {\n      const key = {};\n      const message: KitMessage = {\n        headers: new Headers(headers),\n        input,\n        key,\n        invocation: key,\n        sink: { append: () => true },\n      };\n      const args = [message];\n      const context = {\n        getClass: () => controller,\n        getHandler: () => Reflect.get(controller.prototype, route),\n        getArgs: () => args,\n        getArgByIndex: (index: number) => args[index],\n        getType: () => KIT_CONTEXT,\n      } as unknown as ExecutionContext;\n      try {\n        await guard.canActivate(context);\n        return { ok: true, status: 200 };\n      } catch (error) {\n        if (error instanceof KitDenial) {\n          return {\n            ok: false,\n            status: error.failure.status,\n            code: error.failure.code,\n            reason: error.failure.reason,\n          };\n        }\n        return { ok: false, status: 500, error };\n      }\n    },\n    close: () => moduleRef.close(),\n  };\n}\n\n/** A delivery's answer as a request outcome: its status code (500 when it carries none), code and reason. */\nfunction deliveredOutcome(result: TransportInvocationResult): RequestOutcome {\n  if (result.ok) {\n    return { ok: true, status: 200 };\n  }\n  return {\n    ok: false,\n    status: result.error?.statusCode ?? 500,\n    code: result.error?.code,\n    reason: result.error?.reason,\n    ...(result.error?.statusCode === undefined\n      ? { error: result.error?.message }\n      : {}),\n  };\n}\n\n/** The kit's routes as the delivery's handlers: no parameters, a safe operation, answering `{ ok: true }`. */\nfunction deliveryHandlers(\n  routes: Readonly<Record<string, readonly MethodDecorator[]>>,\n): Record<string, FixtureHandler> {\n  return Object.fromEntries(\n    Object.entries(routes).map(([name, decorators]) => [\n      name,\n      {\n        decorators,\n        params: [],\n        operation: \"read\",\n        handle: () => ({ ok: true }),\n      } satisfies FixtureHandler,\n    ]),\n  );\n}\n\n/** The request harness over a PolicyDelivery's real transport. */\nexport async function deliveryHarness(\n  delivery: PolicyDelivery,\n  auth: AuthLike,\n  options: RequestOptions,\n): Promise<RequestHarness> {\n  if (options.providers?.length || options.session !== undefined) {\n    throw new BetterAuthConfigurationError(\n      \"CONFORMANCE_DELIVERY_OPTIONS\",\n      \"A policy delivery boots its own application: it takes routes and principal sources only.\",\n    );\n  }\n  const probe = await probeOf(auth);\n  const logger = options.logger ?? new CapturingLogger();\n  const app = await delivery.createApp(deliveryHandlers(options.routes), auth, {\n    principals: options.sources ?? [],\n    logger,\n  });\n  const connect = delivery.connect?.bind(delivery);\n  // A browser on a trusted page: the probe plugin's origin is trusted on every kit instance.\n  const browser = (headers: HeadersInit) => {\n    const values = new Headers(headers);\n    if (!values.has(\"origin\")) {\n      values.set(\"origin\", PROBE_TRUSTED_ORIGIN);\n    }\n    return values;\n  };\n  return {\n    probe,\n    logger,\n    request: async (route, headers, input = {}) =>\n      deliveredOutcome(\n        await delivery.invoke(app, route, browser(headers), input),\n      ),\n    ...(connect\n      ? {\n          async connect(headers: HeadersInit): Promise<RequestConnection> {\n            const connection = await connect(app, browser(headers));\n            return {\n              request: async (route, input = {}) =>\n                deliveredOutcome(await connection.invoke(route, input)),\n              close: () => connection.close(),\n            };\n          },\n        }\n      : {}),\n    close: () => app.close(),\n  };\n}\n\n/** Runs `fn` with requests through the in-process guard, or through `delivery`'s transport when given. */\nexport async function withRequests(\n  auth: AuthLike,\n  options: RequestOptions,\n  fn: (harness: RequestHarness) => Promise<ConformanceOutcome>,\n  delivery?: PolicyDelivery,\n): Promise<ConformanceOutcome> {\n  const value = delivery\n    ? await deliveryHarness(delivery, auth, options)\n    : await requestHarness(auth, options);\n  try {\n    return await fn(value);\n  } finally {\n    resetFaults(value.probe);\n    await value.close();\n  }\n}\n\nexport function describeOutcome(outcome: RequestOutcome): string {\n  return outcome.ok\n    ? \"allowed\"\n    : `${outcome.status} ${outcome.code ?? \"\"} ${outcome.reason ?? \"\"} ${outcome.error ? String(outcome.error) : \"\"}`.trim();\n}\n\n// ── Kit identities and credentials ─────────────────────────────────────────\n\nconst API_KEY_KIND = \"api-key\" as PrincipalKind;\nexport const KIT_KEY_HEADER = \"x-conformance-key\";\nexport const KIT_KEY_SOURCE = \"@nestjs-kit/better-auth:conformance-policy-key\";\n\nexport interface KitKeys {\n  /** Key value → the user it acts for and its grant. */\n  readonly keys: Map<string, { userId: string; grant: GrantMap }>;\n  verifications: number;\n}\n\ntype GrantMap = Readonly<Record<string, readonly string[]>>;\n\nfunction grants(grant: GrantMap, requested: GrantMap): boolean {\n  return Object.entries(requested).every(([resource, actions]) =>\n    actions.every((action) => grant[resource]?.includes(action)),\n  );\n}\n\n/** A delegated principal of the kind 'api-key' for a user, whose own grant is `grant`. */\nexport function kitKeyPrincipal(\n  userId: string,\n  grant: GrantMap,\n): AuthPrincipal {\n  return {\n    kind: API_KEY_KIND,\n    source: KIT_KEY_SOURCE,\n    userId,\n    delegation: {\n      description: \"conformance key grant\",\n      allows: (requested: GrantMap) => grants(grant, requested),\n    },\n  } as unknown as AuthPrincipal;\n}\n\n/** The kit's API-key source: header x-conformance-key, explicit acceptance, delegated principals, counted verifications. */\nexport function kitKeySource(keys: KitKeys): PrincipalSource {\n  const source: PrincipalSource<AuthPrincipalBase> = {\n    id: KIT_KEY_SOURCE,\n    kinds: [API_KEY_KIND],\n    acceptance: \"explicit\",\n    delegates: true,\n    credentialHeaders: [KIT_KEY_HEADER],\n    appliesTo: (request) => request.headers.has(KIT_KEY_HEADER),\n    async resolve(request) {\n      const value = request.headers.get(KIT_KEY_HEADER);\n      if (!value) {\n        return absent();\n      }\n      keys.verifications++;\n      const key = keys.keys.get(value);\n      if (!key) {\n        return rejected(\n          AuthFailures.rejected({ status: 401, reason: \"INVALID_API_KEY\" }),\n        );\n      }\n      return authenticated(\n        kitKeyPrincipal(key.userId, key.grant) as unknown as AuthPrincipalBase,\n      );\n    },\n  };\n  return source as unknown as PrincipalSource;\n}\n\ninterface SdkContext {\n  options: {\n    plugins?: readonly { id: string }[];\n    session?: { cookieCache?: { enabled?: boolean } };\n  };\n  internalAdapter: {\n    deleteUserSessions(userId: string): Promise<void>;\n    deleteUser(userId: string): Promise<void>;\n    updateUser(userId: string, data: Record<string, unknown>): Promise<unknown>;\n  };\n  adapter: {\n    update(input: {\n      model: string;\n      where: { field: string; value: unknown }[];\n      update: Record<string, unknown>;\n    }): Promise<unknown>;\n    findOne<T>(input: {\n      model: string;\n      where: { field: string; value: unknown }[];\n    }): Promise<T | null>;\n  };\n}\n\nexport async function sdkContext(auth: AuthLike): Promise<SdkContext> {\n  return (await auth.$context) as unknown as SdkContext;\n}\n\nexport async function hasPlugin(auth: AuthLike, id: string): Promise<boolean> {\n  return !!(await sdkContext(auth)).options.plugins?.some(\n    (plugin) => plugin.id === id,\n  );\n}\n\nexport async function cookieCacheEnabled(auth: AuthLike): Promise<boolean> {\n  return (\n    (await sdkContext(auth)).options.session?.cookieCache?.enabled === true\n  );\n}\n\n/** A stored user with the given fields; `id` pins the user id. */\nexport async function kitUser(\n  auth: AuthLike,\n  fields: Record<string, unknown> = {},\n): Promise<string> {\n  const helpers = await testHelpers(auth);\n  return (\n    await helpers.saveUser(\n      helpers.createUser({\n        email: `${globalThis.crypto.randomUUID()}@conformance.example`,\n        name: \"Conformance\",\n        ...fields,\n      }),\n    )\n  ).id;\n}\n\nfunction mergeCookies(header: string, setCookies: readonly string[]): string {\n  const cookies = new Map<string, string>();\n  for (const part of header.split(\";\")) {\n    const trimmed = part.trim();\n    if (trimmed) {\n      cookies.set(trimmed.split(\"=\", 1)[0]!, trimmed);\n    }\n  }\n  for (const line of setCookies) {\n    const pair = line.split(\";\", 1)[0]!.trim();\n    cookies.set(pair.split(\"=\", 1)[0]!, pair);\n  }\n  return [...cookies.values()].join(\"; \");\n}\n\n/**\n * Fresh session headers for a user. `warmCache` adds the signed cookie-cache cookie a session read issues, or returns\n * null when the instance issued none (its session.cookieCache is off).\n */\nexport async function sessionHeaders(\n  auth: AuthLike,\n  userId: string,\n  options: { warmCache?: boolean } = {},\n): Promise<Headers | null> {\n  const headers = await authHeadersFor(auth, userId);\n  if (!options.warmCache) {\n    return headers;\n  }\n  const result = (await (\n    auth.api as unknown as {\n      getSession(input: {\n        headers: Headers;\n        returnHeaders: true;\n      }): Promise<{ headers: Headers }>;\n    }\n  ).getSession({ headers, returnHeaders: true })) as { headers: Headers };\n  const setCookies = result.headers.getSetCookie();\n  if (!setCookies.some((line) => /session_data=[^;]/.test(line))) {\n    return null;\n  }\n  headers.set(\"cookie\", mergeCookies(headers.get(\"cookie\") ?? \"\", setCookies));\n  return headers;\n}\n\n/** A session principal read through Better Auth's getSession for the given headers, as the session source builds it. */\nexport async function sessionPrincipalOf(\n  auth: AuthLike,\n  headers: Headers,\n): Promise<AuthPrincipal> {\n  const session = (await (\n    auth.api as unknown as {\n      getSession(input: { headers: Headers }): Promise<{\n        user: { id: string };\n      } | null>;\n    }\n  ).getSession({ headers })) as { user: { id: string } } | null;\n  if (!session) {\n    throw new BetterAuthConfigurationError(\n      \"CONFORMANCE_SESSION_MISSING\",\n      \"The kit could not read the session it created.\",\n    );\n  }\n  return {\n    kind: \"session\",\n    source: \"better-auth:session\",\n    userId: session.user.id,\n    session,\n  } as unknown as AuthPrincipal;\n}\n","import assert from \"node:assert/strict\";\nimport { isAPIError } from \"better-auth/api\";\nimport { admin, customSession, organization } from \"better-auth/plugins\";\nimport type {\n  AuthorizationPolicy,\n  Requirement,\n  RequirementExpr,\n} from \"./auth-contracts.js\";\nimport { Require, RequireAuth } from \"./auth-decorators.js\";\nimport { INVOCATION_VALUES } from \"./auth-tokens.js\";\nimport type { AuthLike, PrincipalKind } from \"./auth-types.js\";\nimport { allow } from \"./authorization-evaluator.js\";\nimport {\n  bootIssueCodes,\n  type ConformanceCase,\n  conformanceCase,\n  conformanceSkip,\n  type ConformanceOutcome,\n  KIT_BASE_URL,\n  settle,\n} from \"./conformance-fixtures.js\";\nimport {\n  betterAuthCalls,\n  boot,\n  cookieCacheEnabled,\n  describeOutcome,\n  hasPlugin,\n  KIT_KEY_HEADER,\n  type KitKeys,\n  kitKeyPrincipal,\n  kitKeySource,\n  kitUser,\n  type PolicyConformanceOptions,\n  type PolicyDelivery,\n  type RequestOutcome,\n  requirementsOf,\n  sdkContext,\n  sessionHeaders,\n  sessionPrincipalOf,\n  variantOf,\n  withHarness,\n  withRequests,\n} from \"./conformance-policy-harness.js\";\nimport {\n  ACTIVE_ORGANIZATION_ID,\n  activeOrganization,\n  fromParam,\n  orgMember,\n  type OrganizationRef,\n  organizationRef,\n  orgPermission,\n} from \"./organization.js\";\n\nconst ADMIN_POLICY = \"better-auth:admin/permission\";\nconst ORG_POLICIES = new Set([\n  \"better-auth:organization/permission\", // gitleaks:allow: public policy identifier\n  \"better-auth:organization/member\",\n]);\nconst API_KEY_POLICY = \"better-auth:api-key/permission\";\nconst SDK_KEY_HEADER = \"x-api-key\";\nconst MOCK_SESSION_HEADER = \"x-conformance-mock-session\";\nconst SESSION_KIND = \"session\" as PrincipalKind;\nconst API_KEY_KIND = \"api-key\" as PrincipalKind;\nconst BOTH_KINDS = [SESSION_KIND, API_KEY_KIND] as const;\nconst UNAUTHENTICATED = \"UNAUTHENTICATED\";\n\ntype Permissions = Readonly<Record<string, readonly string[]>>;\n\ninterface SdkApi {\n  getSession(input: { headers: Headers }): Promise<unknown>;\n  listUsers(input: { headers: Headers; query: object }): Promise<unknown>;\n  banUser(input: {\n    headers: Headers;\n    body: { userId: string };\n  }): Promise<unknown>;\n  createApiKey(input: {\n    body: {\n      userId: string;\n      permissions?: Permissions;\n      remaining?: number;\n      rateLimitEnabled?: boolean;\n    };\n  }): Promise<{ id: string; key: string }>;\n  createOrganization(input: {\n    headers: Headers;\n    body: { name: string; slug: string };\n  }): Promise<{ id: string }>;\n  setActiveOrganization(input: {\n    headers: Headers;\n    body: { organizationId: string };\n  }): Promise<unknown>;\n}\n\nfunction api(auth: AuthLike): SdkApi {\n  return auth.api as unknown as SdkApi;\n}\n\n/** Better Auth's own answer for a server call: 200, or the APIError status (500 for any other throw). */\nasync function sdkStatus(call: () => Promise<unknown>): Promise<number> {\n  const result = await settle(call);\n  if (result.ok) {\n    return 200;\n  }\n  return isAPIError(result.error) ? result.error.statusCode : 500;\n}\n\nfunction statusOf(outcome: RequestOutcome): number {\n  return outcome.ok ? 200 : outcome.status;\n}\n\nfunction leafWith(\n  expression: RequirementExpr,\n  match: (policy: AuthorizationPolicy<unknown>) => boolean,\n): Requirement | undefined {\n  return requirementsOf(expression).find((item) =>\n    match(item.policy as AuthorizationPolicy<unknown>),\n  );\n}\n\nfunction adminRequirement(\n  policy: AuthorizationPolicy<unknown>,\n  permissions: Permissions,\n  principals?: readonly PrincipalKind[],\n): Requirement {\n  return {\n    policy,\n    params: { permissions },\n    ...(principals ? { principals } : {}),\n  };\n}\n\nfunction withOrganization(\n  leaf: Requirement,\n  organization: OrganizationRef,\n): Requirement {\n  return {\n    ...leaf,\n    params: { ...(leaf.params as object), organization },\n  };\n}\n\nasync function createKey(\n  auth: AuthLike,\n  userId: string,\n  body: { permissions?: Permissions; remaining?: number } = {},\n): Promise<{ id: string; key: string }> {\n  return api(auth).createApiKey({\n    body: { userId, rateLimitEnabled: false, ...body },\n  });\n}\n\n/** Whether Better Auth turns the key into a session (apiKey({ enableSessionForAPIKeys: true })). */\nasync function keySessions(auth: AuthLike, key: string): Promise<boolean> {\n  const session = await settle(() =>\n    api(auth).getSession({ headers: new Headers({ [SDK_KEY_HEADER]: key }) }),\n  );\n  return session.ok && !!session.value;\n}\n\nasync function remainingOf(auth: AuthLike, keyId: string): Promise<number> {\n  const row = await (await sdkContext(auth)).adapter.findOne<{\n    remaining: number | null;\n  }>({ model: \"apikey\", where: [{ field: \"id\", value: keyId }] });\n  return row?.remaining ?? Number.NaN;\n}\n\nasync function createOrganizationFor(\n  auth: AuthLike,\n  headers: Headers,\n): Promise<string> {\n  return (\n    await api(auth).createOrganization({\n      headers,\n      body: {\n        name: \"Conformance\",\n        slug: `conformance-${globalThis.crypto.randomUUID()}`,\n      },\n    })\n  ).id;\n}\n\nasync function setRole(\n  auth: AuthLike,\n  userId: string,\n  role: string | null,\n): Promise<void> {\n  await (await sdkContext(auth)).adapter.update({\n    model: \"user\",\n    where: [{ field: \"id\", value: userId }],\n    update: { role },\n  });\n}\n\nfunction assertDenied(\n  outcome: RequestOutcome,\n  status: number,\n  reason: string | undefined,\n  message: string,\n): void {\n  assert.equal(outcome.ok, false, `${message}: allowed`);\n  assert.equal(\n    statusOf(outcome),\n    status,\n    `${message}: ${describeOutcome(outcome)}`,\n  );\n  if (reason !== undefined && !outcome.ok) {\n    assert.equal(\n      outcome.reason ?? outcome.code,\n      reason,\n      `${message}: ${describeOutcome(outcome)}`,\n    );\n  }\n}\n\n/**\n * The unit-specific rows of design §14.1 and the core class-policy row. Each unit's cases run when the requirement\n * contains that built-in policy, and skip with the reason otherwise; instances the case needs in another configuration\n * (customSession shapes, adminUserIds, a dynamic baseURL) are built by options.variant(), createConformanceAuth() by default.\n */\nexport function unitPolicyCases(\n  options: PolicyConformanceOptions,\n  known: readonly AuthorizationPolicy<unknown>[],\n): ConformanceCase[] {\n  const { auth } = options;\n  const adminPolicy = known.find((policy) => policy.id === ADMIN_POLICY);\n  const orgLeaf = leafWith(options.requirement, (policy) =>\n    ORG_POLICIES.has(policy.id),\n  );\n  const keyLeaf = leafWith(\n    options.requirement,\n    (policy) => policy.id === API_KEY_POLICY,\n  );\n  const noAdmin = adminPolicy\n    ? undefined\n    : `the requirement contains no built-in admin permission policy (${ADMIN_POLICY})`;\n  const noOrg = orgLeaf\n    ? undefined\n    : \"the requirement contains no built-in organization policy\";\n  const admin_ = adminPolicy!;\n  const adminCase = (\n    id: string,\n    title: string,\n    run: () => Promise<ConformanceOutcome>,\n    skip = noAdmin,\n  ) => conformanceCase(id, title, run, skip);\n\n  /** Z-admin-rejects-api-key-session through the in-process guard, or through `delivery`'s transport. */\n  const rejectsApiKeySession = async (\n    delivery?: PolicyDelivery,\n  ): Promise<ConformanceOutcome> => {\n    if (!(await hasPlugin(auth, \"api-key\"))) {\n      return conformanceSkip(\"the instance has no apiKey() plugin\");\n    }\n    const adminId = await kitUser(auth, { role: \"admin\" });\n    const otherId = await kitUser(auth, { role: \"user\" });\n    const key = await createKey(auth, adminId, {\n      permissions: { project: [\"read\"] },\n    });\n    if (!(await keySessions(auth, key.key))) {\n      return conformanceSkip(\n        \"the instance's apiKey() plugin does not set enableSessionForAPIKeys (or reads no x-api-key header)\",\n      );\n    }\n    const keyHeaders = new Headers({ [SDK_KEY_HEADER]: key.key });\n    assert.equal(\n      await sdkStatus(() =>\n        api(auth).listUsers({ headers: keyHeaders, query: {} }),\n      ),\n      401,\n      \"Better Auth's listUsers accepted an API-key session\",\n    );\n    assert.equal(\n      await sdkStatus(() =>\n        api(auth).banUser({\n          headers: keyHeaders,\n          body: { userId: otherId },\n        }),\n      ),\n      401,\n      \"Better Auth's banUser accepted an API-key session\",\n    );\n    const cookie = (await sessionHeaders(auth, adminId))!.get(\"cookie\")!;\n    return withRequests(\n      auth,\n      {\n        routes: {\n          ban: [Require(adminRequirement(admin_, { user: [\"ban\"] }))],\n          authoritative: [RequireAuth({ authoritative: true })],\n          ordinary: [RequireAuth()],\n        },\n      },\n      async ({ request }) => {\n        assertDenied(\n          await request(\"ban\", keyHeaders),\n          401,\n          undefined,\n          \"x-api-key alone on @RequirePermission({ user: ['ban'] })\",\n        );\n        assertDenied(\n          await request(\"authoritative\", keyHeaders),\n          401,\n          undefined,\n          \"x-api-key alone on @RequireAuth({ authoritative: true })\",\n        );\n        const ordinary = await request(\"ordinary\", keyHeaders);\n        assert.equal(\n          ordinary.ok,\n          true,\n          `a default-freshness route rejected the key session: ${describeOutcome(ordinary)}`,\n        );\n        assertDenied(\n          await request(\"authoritative\", {\n            cookie,\n            [SDK_KEY_HEADER]: key.key,\n          }),\n          401,\n          undefined,\n          \"the admin's cookie with the key on an authoritative route (RK27)\",\n        );\n      },\n      delivery,\n    );\n  };\n\n  /**\n   * Z-org-ref-types' input rows through the in-process guard, or through `delivery`'s transport: junk `orgId` values are\n   * denied ORGANIZATION_REQUIRED without a Better Auth call and without an error log, the owner's ID is allowed.\n   */\n  const orgRefInputs = async (\n    leaf: Requirement,\n    delivery?: PolicyDelivery,\n  ): Promise<{ headers: Headers; organizationId: string }> => {\n    const ownerId = await kitUser(auth);\n    const headers = (await sessionHeaders(auth, ownerId))!;\n    const organizationId = await createOrganizationFor(auth, headers);\n    await withRequests(\n      auth,\n      {\n        routes: {\n          org: [Require(withOrganization(leaf, fromParam(\"orgId\")))],\n        },\n      },\n      async ({ request, probe, logger }) => {\n        for (const value of [{ $ne: null }, 123, [\"a\"], \"\"]) {\n          const from = probe.calls.length;\n          assertDenied(\n            await request(\"org\", headers, { orgId: value }),\n            403,\n            \"ORGANIZATION_REQUIRED\",\n            `orgId ${JSON.stringify(value)}`,\n          );\n          assert.deepEqual(\n            betterAuthCalls(probe, from),\n            [],\n            `orgId ${JSON.stringify(value)} reached Better Auth`,\n          );\n        }\n        const valid = await request(\"org\", headers, {\n          orgId: organizationId,\n        });\n        assert.equal(\n          valid.ok,\n          true,\n          `the owner's organization ID was denied: ${describeOutcome(valid)}`,\n        );\n        assert.deepEqual(\n          logger.errors().map((entry) => entry.text),\n          [],\n          \"a rejected organization input was logged as an error\",\n        );\n      },\n      delivery,\n    );\n    return { headers, organizationId };\n  };\n\n  const quotaRoutes = () => {\n    const permission = orgPermission(\n      { organization: [\"update\"] },\n      { organization: fromParam(\"orgId\") },\n    );\n    const member = orgMember({ organization: fromParam(\"orgId\") });\n    return {\n      routes: { quota: [Require(permission, member)] },\n      permission,\n      member,\n    };\n  };\n\n  /**\n   * Z-apikey-quota-per-request's first setup through the in-process guard, or through `delivery`'s transport: an API-key\n   * session on two org policies spends the key's quota 3 times per request. Returns the skip when the instance cannot.\n   */\n  const quotaSpend = async (\n    delivery?: PolicyDelivery,\n  ): Promise<ConformanceOutcome> => {\n    if (!(await hasPlugin(auth, \"api-key\"))) {\n      return conformanceSkip(\"the instance has no apiKey() plugin\");\n    }\n    const ownerId = await kitUser(auth);\n    const headers = (await sessionHeaders(auth, ownerId))!;\n    const organizationId = await createOrganizationFor(auth, headers);\n    const key = await createKey(auth, ownerId, { remaining: 100 });\n    if (!(await keySessions(auth, key.key))) {\n      return conformanceSkip(\n        \"the instance's apiKey() plugin does not set enableSessionForAPIKeys (or reads no x-api-key header)\",\n      );\n    }\n    return withRequests(\n      auth,\n      { routes: quotaRoutes().routes },\n      async ({ request }) => {\n        const before = await remainingOf(auth, key.id);\n        const outcome = await request(\n          \"quota\",\n          { [SDK_KEY_HEADER]: key.key },\n          { orgId: organizationId },\n        );\n        assert.equal(\n          outcome.ok,\n          true,\n          `the key owner's organization route was denied: ${describeOutcome(outcome)}`,\n        );\n        assert.equal(\n          before - (await remainingOf(auth, key.id)),\n          3,\n          \"one request with two credential-presenting org policies must spend 3\",\n        );\n      },\n      delivery,\n    );\n  };\n\n  /**\n   * Z-admin-banned on one connection of `delivery`, whose connections reuse their principal for its declared TTL: the\n   * connection keeps a signed-out user's principal for a default-freshness handler, while the authoritative admin handler\n   * denies a banned or signed-out admin with a warm cookie cache on the connection's next message.\n   */\n  const bannedOnConnection = async (\n    delivery: PolicyDelivery,\n  ): Promise<ConformanceOutcome> => {\n    if (!(await cookieCacheEnabled(auth))) {\n      return conformanceSkip(\n        \"the instance's session.cookieCache is off; run the kit on an instance with session.cookieCache.enabled\",\n      );\n    }\n    const sdk = await sdkContext(auth);\n    const banning = (await sessionHeaders(\n      auth,\n      await kitUser(auth, { role: \"admin\" }),\n    ))!;\n    const ttl = delivery.connectionPrincipalTtlMs;\n    return withRequests(\n      auth,\n      {\n        routes: {\n          list: [Require(adminRequirement(admin_, { user: [\"list\"] }))],\n          ordinary: [RequireAuth()],\n        },\n      },\n      async ({ connect }) => {\n        // The case runs only for deliveries with connect().\n        const open = connect!;\n        const reusing = await kitUser(auth, { role: \"admin\" });\n        const connection = await open((await sessionHeaders(auth, reusing))!);\n        try {\n          const first = await connection.request(\"ordinary\");\n          assert.equal(\n            first.ok,\n            true,\n            `the connection's first message was denied: ${describeOutcome(first)}`,\n          );\n          await sdk.internalAdapter.deleteUserSessions(reusing);\n          const reused = await connection.request(\"ordinary\");\n          assert.equal(\n            reused.ok,\n            true,\n            `the connection did not reuse its principal within its declared ${ttl} ms TTL: ${describeOutcome(reused)}`,\n          );\n          assertDenied(\n            await connection.request(\"list\"),\n            401,\n            undefined,\n            \"an authoritative handler reused the connection's principal after sign-out\",\n          );\n        } finally {\n          await connection.close();\n        }\n        for (const variant of [\"banned\", \"signed out everywhere\"]) {\n          const userId = await kitUser(auth, { role: \"admin\" });\n          const headers = (await sessionHeaders(auth, userId, {\n            warmCache: true,\n          }))!;\n          const socket = await open(headers);\n          try {\n            for (const route of [\"list\", \"ordinary\"]) {\n              const before = await socket.request(route);\n              assert.equal(\n                before.ok,\n                true,\n                `${variant}: ${route} denied the admin before: ${describeOutcome(before)}`,\n              );\n            }\n            if (variant === \"banned\") {\n              await api(auth).banUser({ headers: banning, body: { userId } });\n            } else {\n              await sdk.internalAdapter.deleteUserSessions(userId);\n            }\n            assertDenied(\n              await socket.request(\"list\"),\n              401,\n              undefined,\n              `${variant}: the connection's next message still admitted the admin`,\n            );\n          } finally {\n            await socket.close();\n          }\n        }\n      },\n      delivery,\n    );\n  };\n\n  /** The delivery variants of the transport-specific rows, titled with the delivery's name. */\n  const deliveryCases = (delivery: PolicyDelivery): ConformanceCase[] => {\n    const title = (text: string) => `${delivery.name}: ${text}`;\n    return [\n      adminCase(\n        \"Z-admin-rejects-api-key-session\",\n        title(\n          \"an admin's API-key session is rejected on admin and authoritative handlers and accepted on default-freshness handlers\",\n        ),\n        () => rejectsApiKeySession(delivery),\n      ),\n      adminCase(\n        \"Z-admin-banned\",\n        title(\n          \"a banned or signed-out admin with a warm cookie cache is denied on the connection's next message despite its principal TTL\",\n        ),\n        () => bannedOnConnection(delivery),\n        noAdmin ??\n          (!delivery.connect\n            ? \"the delivery opens no connections (connect())\"\n            : !(delivery.connectionPrincipalTtlMs! > 0)\n              ? \"the delivery's connections reuse no principal (connectionPrincipalTtlMs); the row applies to a principal TTL\"\n              : undefined),\n      ),\n      conformanceCase(\n        \"Z-org-ref-types\",\n        title(\n          \"fromParam rejects non-string organization inputs without a Better Auth call\",\n        ),\n        async () => {\n          await orgRefInputs(orgLeaf!, delivery);\n        },\n        noOrg,\n      ),\n      conformanceCase(\n        \"Z-apikey-quota-per-request\",\n        title(\"an API-key session on org policies spends 3 per request\"),\n        () => quotaSpend(delivery),\n        noOrg,\n      ),\n    ];\n  };\n\n  return [\n    adminCase(\n      \"Z-admin-rejects-api-key\",\n      \"an admin-owned API-key principal is denied PRINCIPAL_NOT_SUPPORTED without a Better Auth call, and 401 on a request\",\n      async () => {\n        const principal = await options.delegatedPrincipal!();\n        const requirement = adminRequirement(admin_, { user: [\"ban\"] });\n        await withHarness({ auth, requirement }, async ({ decide, probe }) => {\n          const calls = probe.calls.length;\n          const storage = probe.storage.length;\n          const decision = await decide(principal);\n          assert.equal(decision.effect, \"deny\", JSON.stringify(decision));\n          assert.equal(\n            (decision as { reason?: string }).reason,\n            \"PRINCIPAL_NOT_SUPPORTED\",\n            JSON.stringify(decision),\n          );\n          assert.deepEqual(\n            probe.calls.slice(calls),\n            [],\n            \"the evaluator called Better Auth for an unsupported principal\",\n          );\n          assert.equal(\n            probe.storage.length,\n            storage,\n            \"the evaluator read storage for an unsupported principal\",\n          );\n        });\n        const keys: KitKeys = {\n          keys: new Map([\n            [\n              \"conformance-admin-key\",\n              { userId: principal.userId ?? \"\", grant: { user: [\"ban\"] } },\n            ],\n          ]),\n          verifications: 0,\n        };\n        return withRequests(\n          auth,\n          {\n            routes: { ban: [Require(requirement)] },\n            sources: [kitKeySource(keys)],\n          },\n          async ({ request }) => {\n            const outcome = await request(\"ban\", {\n              [KIT_KEY_HEADER]: \"conformance-admin-key\",\n            });\n            assertDenied(\n              outcome,\n              401,\n              UNAUTHENTICATED,\n              \"an API key on a session-only admin route\",\n            );\n            assert.equal(\n              keys.verifications,\n              0,\n              \"the route verified an API key it does not accept\",\n            );\n          },\n        );\n      },\n      noAdmin ??\n        (options.delegatedPrincipal\n          ? undefined\n          : \"the options give no delegatedPrincipal()\"),\n    ),\n    adminCase(\n      \"Z-admin-rejects-api-key-session\",\n      \"an admin's API-key session is rejected on admin and authoritative routes and accepted on default-freshness routes\",\n      () => rejectsApiKeySession(),\n    ),\n    adminCase(\n      \"Z-admin-banned\",\n      \"a banned or signed-out admin with a warm cookie cache is denied on the next request; a banned key owner until banExpires\",\n      async () => {\n        if (!(await cookieCacheEnabled(auth))) {\n          return conformanceSkip(\n            \"the instance's session.cookieCache is off; run the kit on an instance with session.cookieCache.enabled\",\n          );\n        }\n        const sdk = await sdkContext(auth);\n        const banning = await sessionHeaders(\n          auth,\n          await kitUser(auth, { role: \"admin\" }),\n        );\n        await withRequests(\n          auth,\n          {\n            routes: {\n              list: [Require(adminRequirement(admin_, { user: [\"list\"] }))],\n            },\n          },\n          async ({ request }) => {\n            for (const variant of [\"banned\", \"signed out everywhere\"]) {\n              const userId = await kitUser(auth, { role: \"admin\" });\n              const headers = (await sessionHeaders(auth, userId, {\n                warmCache: true,\n              }))!;\n              const before = await request(\"list\", headers);\n              assert.equal(\n                before.ok,\n                true,\n                `${variant}: the admin was denied before: ${describeOutcome(before)}`,\n              );\n              if (variant === \"banned\") {\n                await api(auth).banUser({\n                  headers: banning!,\n                  body: { userId },\n                });\n              } else {\n                await sdk.internalAdapter.deleteUserSessions(userId);\n              }\n              assertDenied(\n                await request(\"list\", headers),\n                401,\n                undefined,\n                `${variant}: the warm cookie cache still admitted the admin`,\n              );\n            }\n          },\n        );\n        return withHarness(\n          {\n            auth,\n            requirement: adminRequirement(\n              admin_,\n              { user: [\"set-role\"] },\n              BOTH_KINDS,\n            ),\n          },\n          async ({ decide }) => {\n            const ownerId = await kitUser(auth, { role: \"admin\" });\n            const principal = kitKeyPrincipal(ownerId, { user: [\"set-role\"] });\n            assert.equal(\n              (await decide(principal)).effect,\n              \"allow\",\n              \"the admin's key was denied before the ban\",\n            );\n            await sdk.internalAdapter.updateUser(ownerId, {\n              banned: true,\n              banExpires: new Date(Date.now() + 3_600_000),\n            });\n            assert.deepEqual(\n              await decide(principal),\n              { effect: \"deny\", status: 401, reason: \"USER_BANNED\" },\n              \"a banned owner's key was not denied USER_BANNED\",\n            );\n            await sdk.internalAdapter.updateUser(ownerId, {\n              banExpires: new Date(Date.now() - 1_000),\n            });\n            assert.equal(\n              (await decide(principal)).effect,\n              \"allow\",\n              \"the key stayed denied after banExpires passed\",\n            );\n          },\n        );\n      },\n    ),\n    adminCase(\n      \"Z-admin-custom-session-role\",\n      \"with customSession role shapes, @RequirePermission answers as Better Auth's listUsers, never a 500\",\n      async () => {\n        const computed = new Map<string, string>();\n        const shapes: [\n          string,\n          (user: { id: string; role?: unknown }) => unknown,\n        ][] = [\n          [\"an array role\", (user) => [user.role]],\n          [\n            \"a display label\",\n            (user) => (user.role === \"admin\" ? \"Administrator\" : \"Member\"),\n          ],\n          [\n            \"a role computed from app data\",\n            (user) => computed.get(user.id) ?? \"viewer\",\n          ],\n        ];\n        for (const [shape, roleOf] of shapes) {\n          const kitAuth = await variantOf(options, {\n            plugins: [\n              admin(),\n              customSession(async ({ user, session }) => ({\n                user: {\n                  ...user,\n                  role: roleOf(user as { id: string; role?: unknown }),\n                },\n                session,\n              })),\n            ],\n          });\n          const adminId = await kitUser(kitAuth, { role: \"admin\" });\n          const plainId = await kitUser(kitAuth, { role: \"user\" });\n          computed.set(adminId, \"user\");\n          computed.set(plainId, \"admin\");\n          await withRequests(\n            kitAuth,\n            {\n              routes: {\n                list: [Require(adminRequirement(admin_, { user: [\"list\"] }))],\n              },\n            },\n            async ({ request }) => {\n              for (const [name, userId] of [\n                [\"admin\", adminId],\n                [\"plain user\", plainId],\n              ] as const) {\n                const headers = (await sessionHeaders(kitAuth, userId))!;\n                const expected = await sdkStatus(() =>\n                  api(kitAuth).listUsers({ headers, query: {} }),\n                );\n                const outcome = await request(\"list\", headers);\n                assert.notEqual(\n                  statusOf(outcome),\n                  500,\n                  `${shape}, ${name}: ${describeOutcome(outcome)}`,\n                );\n                assert.equal(\n                  statusOf(outcome),\n                  expected,\n                  `${shape}, ${name}: the route answered ${describeOutcome(outcome)}, listUsers ${expected}`,\n                );\n              }\n            },\n          );\n        }\n      },\n    ),\n    adminCase(\n      \"Z-admin-deleted-user\",\n      \"a deleted key owner and a user deleted after the guard's read are denied 401 USER_NOT_FOUND, never 5xx\",\n      () =>\n        withHarness(\n          {\n            auth,\n            requirement: adminRequirement(\n              admin_,\n              { user: [\"list\"] },\n              BOTH_KINDS,\n            ),\n          },\n          async ({ decide, logger }) => {\n            const sdk = await sdkContext(auth);\n            const ownerId = await kitUser(auth, { role: \"admin\" });\n            await sdk.internalAdapter.deleteUser(ownerId);\n            const delegated = await settle(() =>\n              decide(kitKeyPrincipal(ownerId, { user: [\"list\"] })),\n            );\n            assert.deepEqual(\n              delegated.ok && delegated.value,\n              { effect: \"deny\", status: 401, reason: \"USER_NOT_FOUND\" },\n              `a key whose owner was deleted: ${String(!delegated.ok && delegated.error)}`,\n            );\n            const userId = await kitUser(auth, { role: \"admin\" });\n            const headers = (await sessionHeaders(auth, userId))!;\n            const principal = await sessionPrincipalOf(auth, headers);\n            const session = await settle(() =>\n              decide(principal, {\n                headers,\n                beforeEvaluate: () => sdk.internalAdapter.deleteUser(userId),\n              }),\n            );\n            assert.deepEqual(\n              session.ok && session.value,\n              { effect: \"deny\", status: 401, reason: \"USER_NOT_FOUND\" },\n              `a user deleted between the guard's read and the policy's call: ${String(!session.ok && session.error)}`,\n            );\n            assert.deepEqual(\n              logger.errors(),\n              [],\n              \"a deleted user was logged as an error\",\n            );\n          },\n        ),\n    ),\n    adminCase(\n      \"Z-admin-null-role\",\n      \"a NULL or empty stored role answers 403 MISSING_PERMISSION as listUsers does, adminUserIds allows, never a 500\",\n      async () => {\n        const listedId = `conformance-listed-${globalThis.crypto.randomUUID()}`;\n        const kitAuth = await variantOf(options, {\n          plugins: [admin({ adminUserIds: [listedId] })],\n        });\n        const nullId = await kitUser(kitAuth, { role: \"user\" });\n        await kitUser(kitAuth, { id: listedId, role: \"user\" });\n        const emptyId = await kitUser(kitAuth, { role: \"user\" });\n        await setRole(kitAuth, nullId, null);\n        await setRole(kitAuth, listedId, null);\n        await setRole(kitAuth, emptyId, \"\");\n        const rows = [\n          [\"a NULL role\", nullId, 403],\n          [\"a NULL role listed in adminUserIds\", listedId, 200],\n          [\"an empty-string role\", emptyId, 403],\n        ] as const;\n        await withRequests(\n          kitAuth,\n          {\n            routes: {\n              list: [Require(adminRequirement(admin_, { user: [\"list\"] }))],\n            },\n          },\n          async ({ request }) => {\n            for (const [name, userId, status] of rows) {\n              const headers = (await sessionHeaders(kitAuth, userId))!;\n              assert.equal(\n                await sdkStatus(() =>\n                  api(kitAuth).listUsers({ headers, query: {} }),\n                ),\n                status,\n                `${name}: Better Auth's listUsers answered otherwise`,\n              );\n              const outcome = await request(\"list\", headers);\n              if (status === 200) {\n                assert.equal(\n                  outcome.ok,\n                  true,\n                  `${name}, session: ${describeOutcome(outcome)}`,\n                );\n              } else {\n                assertDenied(\n                  outcome,\n                  403,\n                  \"MISSING_PERMISSION\",\n                  `${name}, session`,\n                );\n              }\n            }\n          },\n        );\n        return withHarness(\n          {\n            auth: kitAuth,\n            requirement: adminRequirement(\n              admin_,\n              { user: [\"list\"] },\n              BOTH_KINDS,\n            ),\n          },\n          async ({ decide }) => {\n            for (const [name, userId, status] of rows) {\n              const result = await settle(() =>\n                decide(kitKeyPrincipal(userId, { user: [\"list\"] })),\n              );\n              assert.ok(\n                result.ok,\n                `${name}, API key: the policy threw ${String(!result.ok && result.error)}`,\n              );\n              assert.deepEqual(\n                result.value,\n                status === 200\n                  ? { effect: \"allow\" }\n                  : { effect: \"deny\", reason: \"MISSING_PERMISSION\" },\n                `${name}, API key`,\n              );\n            }\n          },\n        );\n      },\n    ),\n    adminCase(\n      \"Z-admin-dynamic-base-url\",\n      \"a dynamic baseURL without fallback fails boot (B20); with fallback the admin route is decided\",\n      async () => {\n        const allowedHosts = [new URL(KIT_BASE_URL).host];\n        const requirement = adminRequirement(admin_, { user: [\"list\"] });\n        const without = await settle(async () =>\n          boot(\n            await variantOf(options, {\n              baseURL: { allowedHosts },\n              plugins: [admin()],\n            }),\n            requirement,\n          ),\n        );\n        if (without.ok) {\n          await without.value.moduleRef.close();\n          assert.fail(\"a dynamic baseURL without fallback booted\");\n        }\n        assert.ok(\n          bootIssueCodes(without.error).includes(\n            \"DYNAMIC_BASE_URL_WITHOUT_FALLBACK\",\n          ),\n          String(without.error),\n        );\n        const kitAuth = await variantOf(options, {\n          baseURL: { allowedHosts, fallback: KIT_BASE_URL },\n          plugins: [admin()],\n        });\n        const adminId = await kitUser(kitAuth, { role: \"admin\" });\n        const plainId = await kitUser(kitAuth, { role: \"user\" });\n        return withRequests(\n          kitAuth,\n          { routes: { list: [Require(requirement)] } },\n          async ({ request }) => {\n            const allowed = await request(\n              \"list\",\n              (await sessionHeaders(kitAuth, adminId))!,\n            );\n            assert.equal(\n              allowed.ok,\n              true,\n              `the admin was not allowed: ${describeOutcome(allowed)}`,\n            );\n            assertDenied(\n              await request(\"list\", (await sessionHeaders(kitAuth, plainId))!),\n              403,\n              \"MISSING_PERMISSION\",\n              \"a plain user\",\n            );\n          },\n        );\n      },\n    ),\n    conformanceCase(\n      \"Z-org-ref-types\",\n      \"fromParam rejects non-string organization inputs without a call; a literal 'active' is an ID; customSession shapes use getActiveMember\",\n      async () => {\n        const leaf = orgLeaf!;\n        const { headers, organizationId } = await orgRefInputs(leaf);\n        await api(auth).setActiveOrganization({\n          headers,\n          body: { organizationId },\n        });\n        const principal = await sessionPrincipalOf(auth, headers);\n        await withHarness(\n          {\n            auth,\n            requirement: {\n              anyOf: [\n                withOrganization(\n                  leaf,\n                  organizationRef(() => \"active\"),\n                ),\n                withOrganization(leaf, activeOrganization()),\n              ],\n            },\n          },\n          async ({ decide, probe }) => {\n            const from = probe.calls.length;\n            const decision = await decide(principal, { headers });\n            assert.equal(\n              decision.effect,\n              \"allow\",\n              `the default ref denied the active organization: ${JSON.stringify(decision)}`,\n            );\n            assert.equal(\n              betterAuthCalls(probe, from).length,\n              2,\n              `a literal 'active' and the default ref made ${betterAuthCalls(probe, from).length} calls`,\n            );\n          },\n        );\n        const shaped = await variantOf(options, {\n          plugins: [\n            organization(),\n            customSession(async ({ user, session }) => ({\n              user,\n              session: {\n                id: session.id,\n                userId: session.userId,\n                token: session.token,\n                createdAt: session.createdAt,\n                updatedAt: session.updatedAt,\n                expiresAt: session.expiresAt,\n              },\n            })),\n          ],\n        });\n        const shapedOwner = await kitUser(shaped);\n        const shapedHeaders = (await sessionHeaders(shaped, shapedOwner))!;\n        const shapedOrganization = await createOrganizationFor(\n          shaped,\n          shapedHeaders,\n        );\n        await api(shaped).setActiveOrganization({\n          headers: shapedHeaders,\n          body: { organizationId: shapedOrganization },\n        });\n        const shapedPrincipal = await sessionPrincipalOf(shaped, shapedHeaders);\n        return withHarness(\n          {\n            auth: shaped,\n            requirement: withOrganization(leaf, activeOrganization()),\n          },\n          async ({ decide, probe }) => {\n            const from = probe.calls.length;\n            const invocation = {};\n            const decision = await decide(shapedPrincipal, {\n              headers: shapedHeaders,\n              invocation,\n            });\n            assert.equal(decision.effect, \"allow\", JSON.stringify(decision));\n            assert.ok(\n              betterAuthCalls(probe, from).includes(\n                \"/organization/get-active-member\",\n              ),\n              `the default ref did not call getActiveMember: ${betterAuthCalls(probe, from).join(\", \")}`,\n            );\n            const published = (\n              Reflect.get(invocation, INVOCATION_VALUES) as\n                | Map<string, Map<symbol, unknown>>\n                | undefined\n            )\n              ?.get(\"default\")\n              ?.get(ACTIVE_ORGANIZATION_ID);\n            assert.equal(\n              published,\n              shapedOrganization,\n              \"the policy did not publish the active organization ID\",\n            );\n          },\n        );\n      },\n      noOrg,\n    ),\n    conformanceCase(\n      \"Z-apikey-quota-per-request\",\n      \"an API-key session on org policies spends 3 per request, with W_API_KEY_SESSION_MULTIPLIER naming them\",\n      async () => {\n        const spent = await quotaSpend();\n        if (spent) {\n          return spent;\n        }\n        const { routes, permission, member } = quotaRoutes();\n        const advice = async (\n          target: AuthLike,\n          session?: { apiKeySessions: boolean },\n        ) => {\n          const booted = await boot(target, undefined, {\n            routes,\n            ...(session ? { session } : {}),\n          });\n          await booted.moduleRef.close();\n          return booted.logger.entries\n            .filter((entry) => entry.level === \"warn\")\n            .map((entry) => entry.text);\n        };\n        const line = (lines: readonly string[], code: string) =>\n          lines.find((text) => text.startsWith(`${code}:`));\n        const conditional = \"If enableSessionForAPIKeys is enabled\";\n        for (const [label, lines, factual] of [\n          [\"by default\", await advice(auth), false],\n          [\n            \"with session.apiKeySessions: true\",\n            await advice(auth, { apiKeySessions: true }),\n            true,\n          ],\n        ] as const) {\n          const full = line(lines, \"W_API_KEY_FULL_SESSION\");\n          const multiplier = line(lines, \"W_API_KEY_SESSION_MULTIPLIER\");\n          assert.ok(full, `${label}: no W_API_KEY_FULL_SESSION`);\n          assert.ok(multiplier, `${label}: no W_API_KEY_SESSION_MULTIPLIER`);\n          for (const id of [permission.policy, member.policy].map(\n            (policy) => (policy as AuthorizationPolicy<unknown>).id,\n          )) {\n            assert.ok(\n              multiplier.includes(id),\n              `${label}: W_API_KEY_SESSION_MULTIPLIER does not name ${id}: ${multiplier}`,\n            );\n          }\n          for (const text of [full, multiplier]) {\n            assert.equal(\n              text.includes(conditional),\n              !factual,\n              `${label}: ${text}`,\n            );\n          }\n        }\n        for (const [label, lines] of [\n          [\n            \"with session.apiKeySessions: false\",\n            await advice(auth, { apiKeySessions: false }),\n          ],\n          [\n            \"without the api-key plugin\",\n            await advice(\n              await variantOf(options, { plugins: [organization()] }),\n            ),\n          ],\n        ] as const) {\n          assert.deepEqual(\n            lines.filter((text) => text.startsWith(\"W_API_KEY_\")),\n            [],\n            `${label}: API-key session advice was emitted`,\n          );\n        }\n      },\n      noOrg,\n    ),\n    conformanceCase(\n      \"Z-apikey-quota-per-request\",\n      \"a key resolved by an API-key source on @RequireApiKeyPermission spends 1 per request\",\n      async () => {\n        const leaf = keyLeaf!;\n        if (!(await hasPlugin(auth, \"api-key\"))) {\n          return conformanceSkip(\"the instance has no apiKey() plugin\");\n        }\n        const sources = options.sources ?? [];\n        if (\n          !sources.some(\n            (source) =>\n              typeof source === \"object\" &&\n              source !== null &&\n              \"kinds\" in source &&\n              (source.kinds as readonly string[]).includes(API_KEY_KIND),\n          )\n        ) {\n          return conformanceSkip(\n            \"the options give no source of the 'api-key' kind (sources: [apiKeyPrincipal()])\",\n          );\n        }\n        const ownerId = await kitUser(auth);\n        const key = await createKey(auth, ownerId, {\n          remaining: 100,\n          permissions: leaf.params as Permissions,\n        });\n        return withRequests(\n          auth,\n          { routes: { quota: [Require(options.requirement)] }, sources },\n          async ({ request }) => {\n            const before = await remainingOf(auth, key.id);\n            const outcome = await request(\"quota\", {\n              [SDK_KEY_HEADER]: key.key,\n            });\n            assert.equal(\n              outcome.ok,\n              true,\n              `a key granting the requirement was denied: ${describeOutcome(outcome)}`,\n            );\n            assert.equal(\n              before - (await remainingOf(auth, key.id)),\n              1,\n              \"one request on @RequireApiKeyPermission must spend 1\",\n            );\n          },\n        );\n      },\n      keyLeaf\n        ? undefined\n        : `the requirement contains no built-in API-key permission policy (${API_KEY_POLICY})`,\n    ),\n    conformanceCase(\n      \"Z-class-policy-requires\",\n      \"a class policy's instance requires field sets accepted kinds and freshness, by class and by string token\",\n      async () => {\n        const evaluations = { principals: 0, fresh: 0 };\n        class PrincipalsPolicy implements AuthorizationPolicy<object> {\n          readonly id = \"@nestjs-kit/better-auth:conformance/class-principals\";\n          readonly requires = { principals: BOTH_KINDS };\n\n          evaluate() {\n            evaluations.principals++;\n            return allow();\n          }\n        }\n        class FreshPolicy implements AuthorizationPolicy<object> {\n          readonly id = \"@nestjs-kit/better-auth:conformance/class-fresh\";\n          readonly requires = { freshIdentity: true };\n\n          evaluate() {\n            evaluations.fresh++;\n            return allow();\n          }\n        }\n        const principalsToken =\n          \"@nestjs-kit/better-auth:conformance/class-principals-token\";\n        const freshToken =\n          \"@nestjs-kit/better-auth:conformance/class-fresh-token\";\n        const userId = await kitUser(auth);\n        const user = await (await sdkContext(auth)).adapter.findOne<\n          Record<string, unknown>\n        >({ model: \"user\", where: [{ field: \"id\", value: userId }] });\n        const keys: KitKeys = {\n          keys: new Map([[\"conformance-class-key\", { userId, grant: {} }]]),\n          verifications: 0,\n        };\n        return withRequests(\n          auth,\n          {\n            routes: {\n              principalsClass: [\n                Require({ policy: PrincipalsPolicy as never, params: {} }),\n              ],\n              principalsToken: [\n                Require({ policy: principalsToken, params: {} }),\n              ],\n              freshClass: [\n                Require({ policy: FreshPolicy as never, params: {} }),\n              ],\n              freshToken: [Require({ policy: freshToken, params: {} })],\n              ordinary: [RequireAuth()],\n            },\n            sources: [kitKeySource(keys)],\n            providers: [\n              PrincipalsPolicy,\n              FreshPolicy,\n              { provide: principalsToken, useClass: PrincipalsPolicy },\n              { provide: freshToken, useClass: FreshPolicy },\n            ],\n          },\n          async ({ request, probe }) => {\n            for (const route of [\"principalsClass\", \"principalsToken\"]) {\n              const verifications = keys.verifications;\n              const count = evaluations.principals;\n              const outcome = await request(route, {\n                [KIT_KEY_HEADER]: \"conformance-class-key\",\n              });\n              assert.equal(\n                outcome.ok,\n                true,\n                `${route}: an API key was not admitted: ${describeOutcome(outcome)}`,\n              );\n              assert.equal(\n                keys.verifications,\n                verifications + 1,\n                `${route}: the key source did not run`,\n              );\n              assert.equal(evaluations.principals, count + 1);\n            }\n            // A session a plugin's before hook places for /get-session, as apiKey's enableSessionForAPIKeys does.\n            probe.respond = (path, headers) =>\n              path === \"/get-session\" && headers?.has(MOCK_SESSION_HEADER)\n                ? {\n                    user,\n                    session: {\n                      id: `conformance-mock-${userId}`,\n                      token: \"conformance-mock\",\n                      userId,\n                      createdAt: new Date(),\n                      updatedAt: new Date(),\n                      expiresAt: new Date(Date.now() + 3_600_000),\n                    },\n                  }\n                : undefined;\n            const mocked = { [MOCK_SESSION_HEADER]: \"1\" };\n            const ordinary = await request(\"ordinary\", mocked);\n            assert.equal(\n              ordinary.ok,\n              true,\n              `a default-freshness route rejected the hook-placed session: ${describeOutcome(ordinary)}`,\n            );\n            for (const route of [\"freshClass\", \"freshToken\"]) {\n              assertDenied(\n                await request(route, mocked),\n                401,\n                undefined,\n                `${route}: a hook-placed session on a freshIdentity route`,\n              );\n            }\n            assert.equal(\n              evaluations.fresh,\n              0,\n              \"a freshIdentity class policy was evaluated for a hook-placed session\",\n            );\n          },\n        );\n      },\n    ),\n    ...(options.deliveries ?? []).flatMap(deliveryCases),\n  ];\n}\n","import assert from \"node:assert/strict\";\nimport { Inject, Injectable, Scope } from \"@nestjs/common\";\nimport { APIError } from \"better-auth/api\";\nimport type {\n  AuthorizationContext,\n  AuthorizationDecision,\n  AuthorizationPolicy,\n  Requirement,\n} from \"./auth-contracts.js\";\nimport { Require } from \"./auth-decorators.js\";\nimport {\n  isAuthFailure,\n  isConfigurationError,\n  isInfrastructureError,\n} from \"./auth-errors.js\";\nimport type { AuthPrincipal } from \"./auth-types.js\";\nimport {\n  bootIssueCodes,\n  type ConformanceCase,\n  conformanceCase,\n  conformanceSkip,\n  type ConformanceOutcome,\n  settle,\n} from \"./conformance-fixtures.js\";\nimport {\n  betterAuthCalls,\n  boot,\n  type Harness,\n  hasPlugin,\n  KIT_ROUTE,\n  type PolicyConformanceOptions,\n  requirementsOf,\n  sdkContext,\n  sessionHeaders,\n  sessionReads,\n  staticPolicies,\n  variantOf,\n  withHarness,\n} from \"./conformance-policy-harness.js\";\nimport { unitPolicyCases } from \"./conformance-policy-units.js\";\n\nexport type {\n  PolicyConformanceOptions,\n  PolicyDelivery,\n  PolicyDeliveryConnection,\n} from \"./conformance-policy-harness.js\";\n\nconst noGrant = {\n  description: \"conformance: no grant\",\n  allows: () => false,\n};\n\n/**\n * The evaluator's answer to a session that ended between the guard's read and the policy's call: 401 (the guard's\n * UNAUTHENTICATED) with Better Auth's generic code as `reason`, or UNAUTHENTICATED when the 401 carried no code.\n */\nfunction isSessionLoss(decision: AuthorizationDecision): boolean {\n  return (\n    decision.effect === \"deny\" &&\n    decision.status === 401 &&\n    (decision.reason === \"UNAUTHORIZED\" ||\n      decision.reason === \"UNAUTHENTICATED\")\n  );\n}\n\n/** Storage operations on the session model since `from` (database reads and writes of sessions). */\nfunction sessionStorage(storage: readonly string[], from: number): number {\n  return storage.slice(from).filter((entry) => entry.endsWith(\":session\"))\n    .length;\n}\n\nconst SCOPED_DEPENDENCY =\n  \"@nestjs-kit/better-auth:conformance/request-scoped-dependency\";\n\n/**\n * The unit's first policy as a DI class policy with one injected dependency, whose provider scope the case chooses:\n * the same requirement then boots with a singleton dependency and fails B11 with a request-scoped one.\n */\nfunction classPolicyFor(policy: AuthorizationPolicy<unknown>) {\n  @Injectable()\n  class ConformanceClassPolicy implements AuthorizationPolicy<unknown> {\n    readonly id = `${policy.id}#conformance-class`;\n    readonly requires = policy.requires;\n\n    constructor(\n      @Inject(SCOPED_DEPENDENCY)\n      readonly dependency: { readonly scope: string },\n    ) {}\n\n    evaluate(\n      params: unknown,\n      context: AuthorizationContext,\n    ): AuthorizationDecision | Promise<AuthorizationDecision> {\n      return policy.evaluate(params, context as never);\n    }\n  }\n  return ConformanceClassPolicy;\n}\n\n/**\n * The authorization-policy kit (invariants Z1–Z6 and the unit-specific rows of design §14.1). Each principal is judged\n * through the real AuthorizationEvaluator, so the delegation gate, error normalization and the per-invocation\n * decision memo apply exactly as in the guard; an infrastructure error thrown here is the guard's 5xx. Cases that\n * need route planning, acceptance or principal resolution send an in-process request through the real\n * BetterAuthGuard. Storage outages are injected into the instance's database adapter, so an endpoint that swallows a\n * storage error into a 401 is exercised; APIError mapping uses the probe plugin's before hook. Requirements must name\n * policy objects (see PolicyConformanceOptions.requirement). Unit-specific cases run when the requirement contains\n * the built-in admin, organization or API-key policy and skip with the reason otherwise.\n */\nexport function policyConformance(\n  options: PolicyConformanceOptions,\n): ConformanceCase[] {\n  const add = (\n    id: string,\n    title: string,\n    run: (harness: Harness) => Promise<ConformanceOutcome>,\n    skip?: string,\n  ) => conformanceCase(id, title, () => withHarness(options, run), skip);\n  const known = staticPolicies(options.requirement);\n  // Z5 is about leaves that name no kinds; a leaf that names the delegated kind may allow it, so any naming leaf skips.\n  const kindsNamed = requirementsOf(options.requirement).some(\n    (item, index) =>\n      item.principals !== undefined ||\n      known[index]?.requires?.principals !== undefined,\n  );\n  const plugins = [\n    ...new Set(known.flatMap((policy) => policy.requires?.plugins ?? [])),\n  ];\n  const infraThrows =\n    (warmCache: boolean) =>\n    async ({ decide, probe, auth }: Harness): Promise<ConformanceOutcome> => {\n      const principal = await options.allowingPrincipal();\n      if (warmCache && (!principal.userId || principal.delegation)) {\n        return conformanceSkip(\n          \"the allowing principal carries no session cookie for a cookie cache\",\n        );\n      }\n      const headers = warmCache\n        ? await sessionHeaders(auth, principal.userId!, { warmCache: true })\n        : undefined;\n      if (headers === null) {\n        return conformanceSkip(\n          \"the instance's session.cookieCache is off; run the kit on an instance with session.cookieCache.enabled for this variant\",\n        );\n      }\n      const customSession = await hasPlugin(auth, \"custom-session\");\n      let calls = probe.calls.length;\n      let storage = probe.storage.length;\n      const result = await settle(() =>\n        decide(principal, {\n          ...(headers ? { headers } : {}),\n          beforeEvaluate: () => {\n            calls = probe.calls.length;\n            storage = probe.storage.length;\n            probe.storageFault = () => new Error(\"conformance storage outage\");\n          },\n        }),\n      );\n      probe.storageFault = undefined;\n      if (\n        betterAuthCalls(probe, calls).length === 0 &&\n        probe.storage.length === storage\n      ) {\n        return conformanceSkip(\n          \"the policy read no storage and called no Better Auth endpoint for the allowing principal\",\n        );\n      }\n      if (customSession && result.ok && isSessionLoss(result.value)) {\n        // RK2: customSession swallows the failure of its inner session read, the re-classification read included.\n        return;\n      }\n      assert.equal(\n        result.ok,\n        false,\n        `a storage outage was decided: ${JSON.stringify(result.ok && result.value)}`,\n      );\n      assert.ok(\n        isInfrastructureError(!result.ok && result.error),\n        String(!result.ok && result.error),\n      );\n    };\n  return [\n    add(\n      \"Z-deny-decision\",\n      \"the allowing principal is allowed and the denying principal gets a deny value, never a throw\",\n      async ({ decide }) => {\n        const allowed = await decide(await options.allowingPrincipal());\n        assert.equal(\n          allowed.effect,\n          \"allow\",\n          `the allowing principal was denied: ${JSON.stringify(allowed)}`,\n        );\n        const result = await settle(async () =>\n          decide(await options.denyingPrincipal()),\n        );\n        assert.equal(\n          result.ok,\n          true,\n          `the policy threw for a denial: ${String(!result.ok && result.error)}`,\n        );\n        const decision = result.ok ? result.value : undefined;\n        assert.equal(decision?.effect, \"deny\");\n        assert.equal(\n          typeof (decision as { reason?: unknown }).reason,\n          \"string\",\n        );\n      },\n    ),\n    add(\n      \"Z-infra-throws\",\n      \"a storage outage after the session read is infrastructure, never a denial (cookie cache off)\",\n      infraThrows(false),\n    ),\n    add(\n      \"Z-infra-throws\",\n      \"a storage outage after the session read is infrastructure, never a denial (warm cookie cache)\",\n      infraThrows(true),\n    ),\n    add(\n      \"Z-apierror-mapping\",\n      \"APIErrors escaping the policy map to re-classification, denials, 429, configuration and infrastructure errors\",\n      async ({ decide, probe }) => {\n        const principal = await options.allowingPrincipal();\n        const sessionBacked = principal.source === \"better-auth:session\";\n        const variants: {\n          error: () => unknown;\n          expect: (\n            result: Awaited<ReturnType<typeof settle<AuthorizationDecision>>>,\n          ) => void;\n        }[] = [\n          ...[\n            () => new APIError(\"UNAUTHORIZED\"),\n            () =>\n              new APIError(\"UNAUTHORIZED\", {\n                code: \"UNAUTHORIZED\",\n                message: \"Unauthorized\",\n              }),\n          ].map((error) => ({\n            error,\n            expect: (\n              result: Awaited<ReturnType<typeof settle<AuthorizationDecision>>>,\n            ) => {\n              if (sessionBacked) {\n                assert.ok(\n                  !result.ok && isInfrastructureError(result.error),\n                  `a generic 401 with a live session must be infrastructure: ${JSON.stringify(result.ok && result.value)}`,\n                );\n              } else {\n                assert.deepEqual(result.ok && result.value, {\n                  effect: \"deny\",\n                  status: 401,\n                  reason: \"UNAUTHENTICATED\",\n                });\n              }\n            },\n          })),\n          {\n            error: () =>\n              new APIError(\"UNAUTHORIZED\", {\n                code: \"CONFORMANCE_CODED\",\n                message: \"coded\",\n              }),\n            expect: (result) => {\n              assert.equal(result.ok && result.value.effect, \"deny\");\n              assert.equal(\n                result.ok && (result.value as { reason?: string }).reason,\n                \"CONFORMANCE_CODED\",\n              );\n              assert.equal(\n                result.ok && (result.value as { status?: number }).status,\n                403,\n              );\n            },\n          },\n          {\n            error: () =>\n              new APIError(\"FORBIDDEN\", {\n                code: \"CONFORMANCE_FORBIDDEN\",\n                message: \"forbidden\",\n              }),\n            expect: (result) => {\n              assert.equal(\n                result.ok && (result.value as { reason?: string }).reason,\n                \"CONFORMANCE_FORBIDDEN\",\n              );\n            },\n          },\n          {\n            error: () => new APIError(\"TOO_MANY_REQUESTS\"),\n            expect: (result) => {\n              assert.ok(\n                !result.ok &&\n                  isAuthFailure(result.error) &&\n                  result.error.status === 429,\n                \"a 429 must propagate as a rate-limit failure\",\n              );\n            },\n          },\n          {\n            error: () => new APIError(\"BAD_REQUEST\", { code: \"CONFORMANCE\" }),\n            expect: (result) => {\n              assert.ok(\n                !result.ok && isConfigurationError(result.error),\n                \"another 4xx must be a configuration error\",\n              );\n            },\n          },\n          {\n            error: () => new APIError(\"INTERNAL_SERVER_ERROR\"),\n            expect: (result) => {\n              assert.ok(\n                !result.ok && isInfrastructureError(result.error),\n                \"a 5xx must be infrastructure\",\n              );\n            },\n          },\n        ];\n        for (const variant of variants) {\n          const from = probe.calls.length;\n          probe.fault = (path) =>\n            path === \"/get-session\" ? undefined : variant.error();\n          const result = await settle(() => decide(principal));\n          probe.fault = undefined;\n          if (betterAuthCalls(probe, from).length === 0) {\n            return conformanceSkip(\n              \"the policy calls no Better Auth endpoint for the allowing principal\",\n            );\n          }\n          variant.expect(result);\n        }\n      },\n    ),\n    add(\n      \"Z-policy-session-lost\",\n      \"a session lost before the policy's call is 401, a storage failure there is 5xx, each with one re-read per request\",\n      async ({ decide, probe, auth }) => {\n        const principal = await options.allowingPrincipal();\n        if (principal.source !== \"better-auth:session\" || !principal.userId) {\n          return conformanceSkip(\n            \"the allowing principal is not a session principal of the built-in session source\",\n          );\n        }\n        const userId = principal.userId;\n        const sdk = await sdkContext(auth);\n        const customSession = await hasPlugin(auth, \"custom-session\");\n        // Revoked: both invocations of one request answer 401 and share one re-classification read.\n        const revoked = {\n          key: {},\n          headers: await sessionHeaders(auth, userId),\n        };\n        let reads = probe.calls.length;\n        let storage = probe.storage.length;\n        const first = await decide(principal, {\n          key: revoked.key,\n          invocation: {},\n          headers: revoked.headers!,\n          beforeEvaluate: async () => {\n            await sdk.internalAdapter.deleteUserSessions(userId);\n            reads = probe.calls.length;\n            storage = probe.storage.length;\n          },\n        });\n        if (\n          first.effect === \"allow\" &&\n          sessionStorage(probe.storage, storage) === 0\n        ) {\n          return conformanceSkip(\n            \"the policy's Better Auth calls do not read the principal's session\",\n          );\n        }\n        const second = await decide(principal, {\n          key: revoked.key,\n          invocation: {},\n          headers: revoked.headers!,\n        });\n        for (const decision of [first, second]) {\n          assert.ok(\n            isSessionLoss(decision),\n            `a session revoked before the policy's call must deny 401 UNAUTHENTICATED: ${JSON.stringify(decision)}`,\n          );\n        }\n        assert.equal(\n          sessionReads(probe, reads),\n          1,\n          `two invocations of one request re-read the session ${sessionReads(probe, reads)} times`,\n        );\n        // Storage failure at the same point: infrastructure (customSession: the documented 401, RK2).\n        const failing = {\n          key: {},\n          headers: await sessionHeaders(auth, userId),\n        };\n        const outcomes = [];\n        for (const index of [0, 1]) {\n          outcomes.push(\n            await settle(() =>\n              decide(principal, {\n                key: failing.key,\n                invocation: {},\n                headers: failing.headers!,\n                beforeEvaluate: () => {\n                  if (index === 0) {\n                    reads = probe.calls.length;\n                  }\n                  probe.storageFault = () =>\n                    new Error(\"conformance storage outage\");\n                },\n              }),\n            ),\n          );\n        }\n        probe.storageFault = undefined;\n        for (const outcome of outcomes) {\n          if (customSession) {\n            assert.ok(\n              outcome.ok && isSessionLoss(outcome.value),\n              `with customSession a storage failure must answer the documented 401: ${outcome.ok ? JSON.stringify(outcome.value) : String(outcome.error)}`,\n            );\n          } else {\n            assert.ok(\n              !outcome.ok && isInfrastructureError(outcome.error),\n              `a storage failure at the policy's call must be infrastructure: ${JSON.stringify(outcome.ok && outcome.value)}`,\n            );\n          }\n        }\n        assert.equal(\n          sessionReads(probe, reads),\n          1,\n          `two invocations of one request re-read the session ${sessionReads(probe, reads)} times during the outage`,\n        );\n      },\n    ),\n    add(\n      \"Z-delegation-scope\",\n      \"a delegated principal is never allowed beyond its own grant\",\n      async ({ decide }) => {\n        const principal = await options.delegatedPrincipal!();\n        assert.ok(\n          principal.delegation,\n          \"delegatedPrincipal() must carry delegation\",\n        );\n        const narrowed = { ...principal, delegation: noGrant } as AuthPrincipal;\n        const decision = await decide(narrowed);\n        assert.equal(\n          decision.effect,\n          \"deny\",\n          \"the policy widened a delegated principal beyond its grant\",\n        );\n      },\n      options.delegatedPrincipal\n        ? undefined\n        : \"the options give no delegatedPrincipal()\",\n    ),\n    add(\n      \"Z-delegation-unnamed-denied\",\n      \"a requirement that names no kinds never judges a delegated principal\",\n      async ({ decide }) => {\n        const principal = options.delegatedPrincipal\n          ? await options.delegatedPrincipal()\n          : ({\n              ...(await options.allowingPrincipal()),\n              delegation: { description: \"conformance\", allows: () => true },\n            } as AuthPrincipal);\n        const decision = await decide(principal);\n        // anyOf denials add a status and a joined message; the effect and reason are the invariant.\n        assert.equal(decision.effect, \"deny\", JSON.stringify(decision));\n        assert.equal(\n          (decision as { reason?: string }).reason,\n          \"PRINCIPAL_NOT_SUPPORTED\",\n          JSON.stringify(decision),\n        );\n      },\n      kindsNamed\n        ? \"a requirement leaf names the principal kinds it judges\"\n        : undefined,\n    ),\n    add(\n      \"Z-per-invocation\",\n      \"decisions are per invocation while identical inputs share one Better Auth call\",\n      async ({ decide, probe, invocations }) => {\n        const principal = await options.allowingPrincipal();\n        const key = {};\n        const first = {};\n        const from = probe.calls.length;\n        await decide(principal, { key, invocation: first });\n        const afterFirst = betterAuthCalls(probe, from).length;\n        const count = invocations.count;\n        await decide(principal, { key, invocation: {} });\n        assert.ok(\n          invocations.count > count,\n          \"a decision was reused for another invocation\",\n        );\n        assert.equal(\n          betterAuthCalls(probe, from).length,\n          afterFirst,\n          \"identical inputs in one request called Better Auth again\",\n        );\n        const reused = invocations.count;\n        await decide(principal, { key, invocation: first });\n        assert.equal(\n          invocations.count,\n          reused,\n          \"one invocation evaluated the same requirement twice\",\n        );\n      },\n    ),\n    conformanceCase(\n      \"Z-singleton\",\n      \"the policy as a class with a request-scoped dependency fails boot; with a singleton dependency it boots\",\n      async () => {\n        const leaf = requirementsOf(options.requirement)[0]!;\n        const policy = known[0]!;\n        const bootWith = (scope: Scope) => {\n          const ClassPolicy = classPolicyFor(policy);\n          const requirement: Requirement = {\n            ...leaf,\n            policy: ClassPolicy as never,\n          };\n          return settle(() =>\n            boot(options.auth, leaf, {\n              routes: { [KIT_ROUTE]: [Require(requirement)] },\n              sources: options.sources,\n              providers: [\n                ClassPolicy,\n                {\n                  provide: SCOPED_DEPENDENCY,\n                  useFactory: () => ({ scope: String(scope) }),\n                  scope,\n                },\n              ],\n            }),\n          );\n        };\n        const singleton = await bootWith(Scope.DEFAULT);\n        if (!singleton.ok) {\n          assert.fail(\n            `the class policy with a singleton dependency failed boot: ${String(singleton.error)}`,\n          );\n        }\n        await singleton.value.moduleRef.close();\n        const scoped = await bootWith(Scope.REQUEST);\n        if (scoped.ok) {\n          await scoped.value.moduleRef.close();\n          assert.fail(\"a class policy with a request-scoped dependency booted\");\n        }\n        assert.ok(\n          bootIssueCodes(scoped.error).includes(\"NON_SINGLETON_EXTENSION\"),\n          `boot did not report NON_SINGLETON_EXTENSION (B11): ${String(scoped.error)}`,\n        );\n      },\n    ),\n    conformanceCase(\n      \"Z-boot-prerequisite\",\n      \"an instance without the policy's plugin prerequisites fails boot\",\n      async () => {\n        const result = await settle(async () =>\n          boot(await variantOf(options, {}), options.requirement),\n        );\n        if (result.ok) {\n          await result.value.moduleRef.close();\n          assert.fail(\"an instance without the policy's plugins booted\");\n        }\n        assert.ok(\n          bootIssueCodes(result.error).includes(\"PLUGIN_PREREQUISITE\"),\n          String(result.error),\n        );\n      },\n      plugins.length\n        ? undefined\n        : \"the policy declares no plugin prerequisites\",\n    ),\n    ...unitPolicyCases(options, known),\n  ];\n}\n","import assert from \"node:assert/strict\";\nimport { inspect } from \"node:util\";\nimport {\n  Body,\n  ConsoleLogger,\n  Controller,\n  Inject,\n  type INestApplication,\n  Module,\n  Post,\n  Req,\n  type Type,\n} from \"@nestjs/common\";\nimport { type AbstractHttpAdapter, NestFactory } from \"@nestjs/core\";\nimport { Test, type TestingModule } from \"@nestjs/testing\";\nimport type { BetterAuthOptions } from \"better-auth\";\nimport { permission } from \"./admin.js\";\nimport type {\n  AuthHandle,\n  AuthorizationDecision,\n  CookieSink,\n  ExtensionRef,\n  HttpPlatform,\n  PrincipalRequest,\n  PrincipalResolver,\n  PrincipalResult,\n  PrincipalSource,\n  RequirementExpr,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AcceptPrincipals,\n  ForwardAuthCookies,\n  RequireAuth,\n} from \"./auth-decorators.js\";\nimport {\n  BetterAuthConfigurationError,\n  getRawCause,\n  isAuthFailure,\n  isInfrastructureError,\n} from \"./auth-errors.js\";\nimport { BetterAuthModule } from \"./auth-module.js\";\nimport { BetterAuthService } from \"./auth-service.js\";\nimport {\n  getBetterAuthHandleToken,\n  getExtensionToken,\n  PRINCIPAL_RESOLVER,\n} from \"./auth-tokens.js\";\nimport type {\n  AdminPermissions,\n  AuthLike,\n  AuthPrincipal,\n  PrincipalKind,\n} from \"./auth-types.js\";\nimport {\n  bootIssueCodes,\n  type ConformanceCase,\n  conformanceCase,\n  conformanceSkip,\n  type ConformanceOutcome,\n  createConformanceAuth,\n  KIT_BASE_URL,\n  kitIdentity,\n  PROBE_PLUGIN_ID,\n  probeOf,\n  type ProbeState,\n  type RawResponse,\n  sendRaw,\n  setCookieLines,\n  settle,\n} from \"./conformance-fixtures.js\";\nimport { harness as policyHarness } from \"./conformance-policy-harness.js\";\n\n/** An API key the kit's S-apikey-* cases created, and the request headers that present it. */\nexport interface ConformanceApiKey {\n  /** The key's record id, which the kit uses to disable or expire the key through the database adapter. */\n  readonly id: string;\n  readonly headers: Headers;\n}\n\n/** Real HTTP delivery for the HTTP-route rows of S-cookie-forwarded and S-infra-throws and the cookie-bridge cases (S-bridge-*). */\nexport interface PrincipalHttpConformanceOptions {\n  platform: ExtensionRef<HttpPlatform>;\n  /** Fresh Nest HTTP adapter per app, e.g. () => new ExpressAdapter(). */\n  createHttpAdapter(): AbstractHttpAdapter;\n  /** How to obtain a base URL. Default: app.listen(0, '127.0.0.1') + getUrl(). */\n  listen?(app: INestApplication): Promise<string>;\n}\n\nexport interface PrincipalSourceConformanceOptions {\n  /**\n   * The source under test. Pass a factory reference (defineExtension({ use: { useFactory } })) when the source keeps\n   * per-instance state across requests, such as the API-key outage probe or a JWT key cache: every case boots its\n   * own module, and a factory gives each case a fresh source.\n   */\n  source: ExtensionRef<PrincipalSource>;\n  /**\n   * The Better Auth instance the credentials belong to. It must include conformanceProbePlugin(), testUtils() and\n   * nestjs(), with session.updateAge 0 and session refresh enabled, so every session read produces a refresh\n   * Set-Cookie: createConformanceAuth({ plugins }) builds one. The kit fails with CONFORMANCE_SESSION_REFRESH otherwise.\n   */\n  auth: AuthLike;\n  credentials: {\n    /**\n     * A fresh valid credential of `auth`: the options' instance, or a variant() instance (S-dynamic-base-url). Variant\n     * instances have a dynamic baseURL without fallback that allows localhost:3000 (the kit base URL's host) and\n     * public.example, so an auth.api call that creates the credential must pass headers with one of those hosts.\n     */\n    valid(auth: AuthLike): Promise<Headers>;\n    invalid(): Headers;\n    rateLimited?(auth: AuthLike): Promise<Headers>;\n    /**\n     * S-apikey-*: creates a key with these extra createApiKey body fields (remaining, rateLimitEnabled, ...).\n     * Default: a key of a new kit user through auth.api.createApiKey, presented in the source's first credential header.\n     */\n    apiKey?(\n      auth: AuthLike,\n      fields: Readonly<Record<string, unknown>>,\n    ): Promise<ConformanceApiKey>;\n    /** S-apikey-org-key: an organization-owned key (references: 'organization'). The case skips without it. */\n    organizationKey?(auth: AuthLike): Promise<Headers>;\n  };\n  /**\n   * S-dynamic-base-url: another instance of the same configuration with the kit's overrides (a dynamic baseURL,\n   * trusted proxy headers). Default: createConformanceAuth({ ...overrides, plugins }) with the plugins of `auth`\n   * other than the kit's own; pass variant() when those plugin objects keep per-instance state.\n   */\n  variant?(overrides: Omit<BetterAuthOptions, \"database\">): AuthLike;\n  /**\n   * Boots a guarded route and the cookie-bridge routes on this HTTP platform for the HTTP-route rows of\n   * S-cookie-forwarded and S-infra-throws and for S-bridge-*. Those cases skip without it.\n   */\n  http?: PrincipalHttpConformanceOptions;\n}\n\ninterface ResolveInit {\n  freshness?: \"default\" | \"authoritative\";\n  /** Shared by the calls of one logical request, as the resolver's per-request memo is. */\n  memo?: Map<unknown, Promise<unknown>>;\n}\n\ninterface Harness {\n  readonly auth: AuthLike;\n  readonly source: PrincipalSource;\n  readonly handle: AuthHandle;\n  readonly probe: ProbeState;\n  /** The source alone, inside the resolver's chain scope. */\n  resolve(\n    headers: Headers,\n    cookies: CookieSink | null,\n    init?: ResolveInit,\n  ): Promise<PrincipalResult>;\n  /** The real principal resolver, with its error normalization and redaction. */\n  resolveChain(\n    headers: Headers,\n    cookies: CookieSink | null,\n  ): Promise<PrincipalResult>;\n  close(): Promise<void>;\n}\n\ninterface HarnessInit {\n  /** Another instance than options.auth (a variant). */\n  auth?: AuthLike;\n  /** Extra BetterAuthModule.forRoot options. */\n  module?: Record<string, unknown>;\n}\n\nclass RecordingSink implements CookieSink {\n  readonly values: string[] = [];\n\n  append(setCookies: readonly string[]): boolean {\n    this.values.push(...setCookies);\n    return true;\n  }\n}\n\nasync function assertKitInstance(auth: AuthLike): Promise<ProbeState> {\n  const probe = await probeOf(auth);\n  const session = (\n    (await auth.$context) as {\n      options: {\n        session?: { updateAge?: number; disableSessionRefresh?: boolean };\n      };\n    }\n  ).options.session;\n  if (session?.updateAge !== 0 || session.disableSessionRefresh) {\n    throw new BetterAuthConfigurationError(\n      \"CONFORMANCE_SESSION_REFRESH\",\n      \"The principal-source kit needs session.updateAge 0 with session refresh enabled, so that every session read produces a refresh Set-Cookie.\",\n      \"Create the instance with createConformanceAuth() or set session: { updateAge: 0 }.\",\n    );\n  }\n  return probe;\n}\n\nfunction kitModule(\n  auth: AuthLike,\n  source: ExtensionRef<PrincipalSource>,\n  module: Record<string, unknown> = {},\n) {\n  return BetterAuthModule.forRoot({\n    auth,\n    principals: [source],\n    session: false,\n    http: { mount: false },\n    logSummary: false,\n    ...module,\n  } as never);\n}\n\nasync function harness(\n  options: PrincipalSourceConformanceOptions,\n  init: HarnessInit = {},\n): Promise<Harness> {\n  const auth = init.auth ?? options.auth;\n  const probe = await assertKitInstance(auth);\n  const moduleRef: TestingModule = await Test.createTestingModule({\n    imports: [kitModule(auth, options.source, init.module)],\n  }).compile();\n  moduleRef.useLogger(false);\n  try {\n    await moduleRef.init();\n  } catch (error) {\n    await moduleRef.close().catch(() => undefined);\n    throw error;\n  }\n  const handle = moduleRef.get<AuthHandle>(getBetterAuthHandleToken());\n  const source = moduleRef.get<PrincipalSource>(\n    getExtensionToken(\"principals\", \"default\", 0),\n  );\n  const resolver = moduleRef.get<PrincipalResolver>(PRINCIPAL_RESOLVER);\n  return {\n    auth,\n    source,\n    handle,\n    probe,\n    resolve(headers, cookies, resolveInit = {}) {\n      const memo = resolveInit.memo ?? new Map<unknown, Promise<unknown>>();\n      const request: PrincipalRequest = {\n        headers,\n        cookies,\n        transport: \"conformance\",\n        freshness: resolveInit.freshness ?? \"default\",\n        auth: handle,\n        memo<T>(key: unknown, compute: () => Promise<T>): Promise<T> {\n          if (!memo.has(key)) {\n            memo.set(key, compute());\n          }\n          return memo.get(key) as Promise<T>;\n        },\n      };\n      // The same chain scope the resolver establishes: same-credential forwarding, library-internal calls.\n      return handle.run(\n        {\n          cookies,\n          forward: \"same-credential\",\n          inbound: () => headers,\n          internal: true,\n        },\n        async () => {\n          if (source.appliesTo && !source.appliesTo(request)) {\n            return { outcome: \"absent\" } as const;\n          }\n          return source.resolve(request);\n        },\n      );\n    },\n    resolveChain(headers, cookies) {\n      const key = {};\n      const call: TransportCall = {\n        key,\n        invocation: key,\n        headers: () => new Headers(headers),\n        clientIp: null,\n        cookies,\n        param: () => undefined,\n      };\n      return resolver.resolve(call, {\n        auth: handle,\n        freshness: \"default\",\n        accepts: new Set<string>(source.kinds),\n        sourceSet: \"@nestjs-kit/better-auth:principal-conformance\",\n      });\n    },\n    close: () => moduleRef.close(),\n  };\n}\n\nasync function withHarness(\n  options: PrincipalSourceConformanceOptions,\n  fn: (harness: Harness) => Promise<ConformanceOutcome>,\n  init: HarnessInit = {},\n): Promise<ConformanceOutcome> {\n  const value = await harness(options, init);\n  try {\n    return await fn(value);\n  } finally {\n    value.probe.fault = undefined;\n    value.probe.storageFault = undefined;\n    value.probe.storageDelay = undefined;\n    value.probe.respond = undefined;\n    await value.close();\n  }\n}\n\nfunction names(cookies: readonly string[]): string[] {\n  return cookies.map((line) => line.split(\"=\", 1)[0]!);\n}\n\nfunction cookieValue(header: string | null | undefined, name: string): string {\n  for (const part of (header ?? \"\").split(\";\")) {\n    const index = part.indexOf(\"=\");\n    if (index > 0 && part.slice(0, index).trim() === name) {\n      return part.slice(index + 1).trim();\n    }\n  }\n  return \"\";\n}\n\n/** The request's credential as the cookie bridge compares it: session cookie, Authorization and declared headers. */\nfunction credentialOf(\n  headers: Headers | undefined,\n  sessionCookie: string,\n  extra: readonly string[],\n): string {\n  return [\n    cookieValue(headers?.get(\"cookie\"), sessionCookie),\n    headers?.get(\"authorization\") ?? \"\",\n    ...extra.map((name) => headers?.get(name) ?? \"\"),\n  ].join(\"\\u0000\");\n}\n\n/** Set-Cookie lines that calls with the request's own credential, or with none, produced since `from`. */\nfunction ownCookies(\n  probe: ProbeState,\n  from: number,\n  request: Headers,\n  extra: readonly string[],\n): string[] {\n  return probe.produced.slice(from).flatMap((entry) => {\n    const call = credentialOf(entry.headers, entry.sessionCookie, extra);\n    return call === credentialOf(request, entry.sessionCookie, extra) ||\n      call === credentialOf(undefined, entry.sessionCookie, extra)\n      ? entry.setCookies\n      : [];\n  });\n}\n\nfunction occurrences(lines: readonly string[], line: string): number {\n  return lines.filter((value) => value === line).length;\n}\n\nconst KIT_HOST = new URL(KIT_BASE_URL).host;\nconst PUBLIC_HOST = \"public.example\";\n/** Hosts a variant instance's dynamic baseURL allows. */\nconst DYNAMIC_HOSTS = [KIT_HOST, PUBLIC_HOST];\n/** How long S-apikey-outage stalls the key's usage update, above apiKeyPrincipal()'s default slowMs of 500. */\nconst STALL_MS = 750;\nconst READ_ONLY = \"cannot execute UPDATE in a read-only transaction\";\nconst WRITES = new Set([\n  \"create\",\n  \"update\",\n  \"updateMany\",\n  \"delete\",\n  \"deleteMany\",\n]);\n/** The kit's own plugins, which createConformanceAuth() adds to every instance it builds. */\nconst KIT_PLUGINS = new Set([\n  \"test-utils\",\n  \"bearer\",\n  PROBE_PLUGIN_ID,\n  \"@nestjs-kit/better-auth\",\n]);\n\nfunction variantOf(\n  options: PrincipalSourceConformanceOptions,\n  overrides: Omit<BetterAuthOptions, \"database\">,\n): Promise<AuthLike> {\n  if (options.variant) {\n    return Promise.resolve(options.variant(overrides));\n  }\n  return (async () => {\n    const context = (await options.auth.$context) as {\n      options: { plugins?: { id: string }[] };\n    };\n    const plugins = (context.options.plugins ?? []).filter(\n      (plugin) => !KIT_PLUGINS.has(plugin.id),\n    );\n    return createConformanceAuth({\n      ...overrides,\n      plugins: plugins as never,\n    });\n  })();\n}\n\n/** Judges one principal against a requirement through the policy kit's real-evaluator harness. */\nasync function judgePrincipal(\n  auth: AuthLike,\n  requirement: RequirementExpr,\n  principal: AuthPrincipal,\n): Promise<{ decision: AuthorizationDecision; evaluations: number }> {\n  const value = await policyHarness({ auth, requirement });\n  try {\n    const decision = await value.decide(principal);\n    return { decision, evaluations: value.invocations.count };\n  } finally {\n    await value.close();\n  }\n}\n\n/** A source that verifies keys of the Better Auth api-key plugin (the S-apikey-* cases). */\nfunction verifiesApiKeys(source: PrincipalSource): boolean {\n  return (\n    (source.kinds as readonly string[]).includes(\"api-key\") &&\n    (source.requires?.plugins ?? []).includes(\"api-key\")\n  );\n}\n\nconst NOT_API_KEY = \"the source does not verify keys of the api-key plugin\";\n\ninterface KeyApi {\n  createApiKey(input: {\n    body: Record<string, unknown>;\n  }): Promise<{ id: string; key: string }>;\n  verifyApiKey(input: unknown): Promise<unknown>;\n}\n\nasync function createKey(\n  options: PrincipalSourceConformanceOptions,\n  harness: Harness,\n  fields: Readonly<Record<string, unknown>> = {},\n): Promise<ConformanceApiKey> {\n  if (options.credentials.apiKey) {\n    return options.credentials.apiKey(harness.auth, fields);\n  }\n  const owner = await kitIdentity(harness.auth);\n  const created = await (harness.auth.api as unknown as KeyApi).createApiKey({\n    body: { userId: owner.userId, ...fields },\n  });\n  return {\n    id: created.id,\n    headers: new Headers({\n      [harness.source.credentialHeaders?.[0] ?? \"x-api-key\"]: created.key,\n    }),\n  };\n}\n\nasync function updateKey(\n  harness: Harness,\n  id: string,\n  update: Record<string, unknown>,\n): Promise<void> {\n  const context = (await harness.auth.$context) as {\n    adapter: {\n      update(input: {\n        model: string;\n        where: { field: string; value: unknown }[];\n        update: Record<string, unknown>;\n      }): Promise<unknown>;\n    };\n  };\n  await context.adapter.update({\n    model: \"apikey\",\n    where: [{ field: \"id\", value: id }],\n    update,\n  });\n}\n\n/** An unknown key in the source's credential header, unique per call so no cache answers it. */\nfunction unknownKey(source: PrincipalSource): Headers {\n  return new Headers({\n    [source.credentialHeaders?.[0] ?? \"x-api-key\"]:\n      `conformance-unknown-${globalThis.crypto.randomUUID()}`,\n  });\n}\n\nfunction assertRejected(\n  result: PrincipalResult,\n  status: number,\n  reason: string,\n  label: string,\n): void {\n  assert.equal(\n    result.outcome,\n    \"rejected\",\n    `${label} resolved ${JSON.stringify(result)}`,\n  );\n  const failure = result.outcome === \"rejected\" ? result.failure : undefined;\n  assert.equal(failure?.status, status, `${label}: ${JSON.stringify(failure)}`);\n  assert.equal(failure?.reason, reason, `${label}: ${JSON.stringify(failure)}`);\n}\n\nasync function assertInfrastructure(\n  run: () => Promise<PrincipalResult>,\n  label: string,\n): Promise<void> {\n  const result = await settle(run);\n  assert.equal(\n    result.ok,\n    false,\n    `${label} resolved ${JSON.stringify(result.ok && result.value)} instead of an infrastructure error`,\n  );\n  assert.ok(\n    !isAuthFailure(!result.ok && result.error),\n    `${label} was thrown as a denial: ${String(!result.ok && result.error)}`,\n  );\n}\n\n/** Every form of the credentials a request presents: cookie values (signed, decoded, raw token), bearer, headers. */\nfunction credentialForms(\n  headers: Headers,\n  credentialHeaders: readonly string[],\n): string[] {\n  const forms = new Set<string>();\n  const add = (value: string | null | undefined) => {\n    if (value && value.length >= 8) {\n      forms.add(value);\n    }\n  };\n  for (const part of (headers.get(\"cookie\") ?? \"\").split(\";\")) {\n    const index = part.indexOf(\"=\");\n    if (index < 0) {\n      continue;\n    }\n    const value = part.slice(index + 1).trim();\n    add(value);\n    let decoded = value;\n    try {\n      decoded = decodeURIComponent(value);\n    } catch {\n      // Keep the raw form.\n    }\n    add(decoded);\n    const dot = decoded.lastIndexOf(\".\");\n    if (dot > 0) {\n      add(decoded.slice(0, dot));\n    }\n  }\n  const authorization = headers.get(\"authorization\");\n  add(authorization);\n  add(/^\\S+\\s+(.+)$/.exec(authorization ?? \"\")?.[1]);\n  for (const name of credentialHeaders) {\n    if (name !== \"cookie\" && name !== \"authorization\") {\n      add(headers.get(name));\n    }\n  }\n  return [...forms];\n}\n\n/** Raw session token of the instance's session cookie in a request, or undefined. */\nasync function sessionToken(\n  auth: AuthLike,\n  headers: Headers,\n): Promise<{ name: string; token: string } | undefined> {\n  const context = (await auth.$context) as {\n    authCookies: { sessionToken: { name: string } };\n  };\n  const name = context.authCookies.sessionToken.name;\n  const value = decodeURIComponent(cookieValue(headers.get(\"cookie\"), name));\n  const dot = value.lastIndexOf(\".\");\n  return dot > 0 ? { name, token: value.slice(0, dot) } : undefined;\n}\n\n/** A plain-object rendering of an error, as JSON loggers serialize one: own properties, message, stack and causes. */\nfunction serializeError(value: unknown, depth = 0): unknown {\n  if (!(value instanceof Error) || depth > 8) {\n    return value;\n  }\n  const output: Record<string, unknown> = {\n    ...Object.fromEntries(Object.entries(value)),\n    name: value.name,\n    message: value.message,\n    stack: value.stack,\n  };\n  if (value.cause !== undefined) {\n    output.cause = serializeError(value.cause, depth + 1);\n  }\n  return output;\n}\n\n/** What Nest's ConsoleLogger writes for an error, in text and JSON mode. */\nfunction consoleLogged(error: Error): string {\n  const chunks: string[] = [];\n  const stdout = process.stdout.write;\n  const stderr = process.stderr.write;\n  const record = (chunk: unknown) => {\n    chunks.push(String(chunk));\n    return true;\n  };\n  process.stdout.write = record as typeof process.stdout.write;\n  process.stderr.write = record as typeof process.stderr.write;\n  try {\n    const text = new ConsoleLogger(\"S-log-redaction\", { colors: false });\n    text.error(error);\n    text.error(error.message, error.stack);\n    new ConsoleLogger(\"S-log-redaction\", { json: true }).error(error);\n  } finally {\n    process.stdout.write = stdout;\n    process.stderr.write = stderr;\n  }\n  return chunks.join(\"\");\n}\n\nconst BRIDGE_PATH = \"nestjs-kit-better-auth-principal-conformance\";\n\ninterface BridgeBoot {\n  readonly url: string;\n  readonly origin: string;\n  post(\n    path: string,\n    headers: Headers,\n    body?: Record<string, unknown>,\n  ): Promise<RawResponse>;\n  close(): Promise<void>;\n}\n\nfunction bridgeController(kinds: readonly string[]): Type {\n  @Controller(BRIDGE_PATH)\n  class PrincipalBridgeController {\n    constructor(\n      @Inject(BetterAuthService) private readonly service: BetterAuthService,\n    ) {}\n\n    @Post(\"principal\")\n    principal() {\n      return { ok: true };\n    }\n\n    @Post(\"sign-up\")\n    signUp() {\n      return this.signUpAnother();\n    }\n\n    @ForwardAuthCookies()\n    @Post(\"sign-up-forwarded\")\n    signUpForwarded() {\n      return this.signUpAnother();\n    }\n\n    @ForwardAuthCookies()\n    @Post(\"foreign-session\")\n    async foreignSession(@Body() body: { token: string }) {\n      await this.foreignRead(body.token);\n      return { ok: true };\n    }\n\n    @ForwardAuthCookies()\n    @Post(\"foreign-forwarded\")\n    async foreignForwarded(@Body() body: { token: string }) {\n      await this.service.forwardForeignCookies(() =>\n        this.foreignRead(body.token),\n      );\n      return { ok: true };\n    }\n\n    @Post(\"foreign-undeclared\")\n    async foreignUndeclared(@Body() body: { token: string }) {\n      try {\n        await this.service.forwardForeignCookies(() =>\n          this.foreignRead(body.token),\n        );\n        return { code: null };\n      } catch (error) {\n        return { code: (error as { code?: unknown }).code ?? null };\n      }\n    }\n\n    @ForwardAuthCookies()\n    @Post(\"sign-out\")\n    async signOut(@Req() request: unknown) {\n      await (\n        this.service.api as unknown as {\n          signOut(input: { headers: Headers }): Promise<unknown>;\n        }\n      ).signOut({ headers: this.service.headersFrom(request) });\n      return { ok: true };\n    }\n\n    private async signUpAnother() {\n      const result = await (\n        this.service.api as unknown as {\n          signUpEmail(input: {\n            body: { email: string; password: string; name: string };\n          }): Promise<{ token: string | null }>;\n        }\n      ).signUpEmail({\n        body: {\n          email: `${globalThis.crypto.randomUUID()}@conformance.example`,\n          password: `pw-${globalThis.crypto.randomUUID()}`,\n          name: \"Conformance third party\",\n        },\n      });\n      return { token: result.token };\n    }\n\n    private foreignRead(token: string) {\n      return (\n        this.service.api as unknown as {\n          getSession(input: { headers: Headers }): Promise<unknown>;\n        }\n      ).getSession({\n        headers: new Headers({ authorization: `Bearer ${token}` }),\n      });\n    }\n  }\n  RequireAuth()(PrincipalBridgeController);\n  AcceptPrincipals(\n    ...(kinds as readonly string[] as [PrincipalKind, ...PrincipalKind[]]),\n  )(PrincipalBridgeController);\n  return PrincipalBridgeController;\n}\n\nasync function bootBridge(\n  options: PrincipalSourceConformanceOptions,\n  http: PrincipalHttpConformanceOptions,\n  kinds: readonly string[],\n): Promise<BridgeBoot> {\n  const controller = bridgeController(kinds);\n  const auth = options.auth;\n  const imports = [\n    BetterAuthModule.forRoot({\n      auth,\n      principals: [options.source],\n      session: false,\n      platforms: [http.platform],\n      http: { mount: false },\n      logSummary: false,\n    } as never),\n  ];\n  @Module({\n    imports,\n    controllers: [controller],\n  })\n  class PrincipalBridgeModule {}\n  const app = await NestFactory.create(\n    PrincipalBridgeModule,\n    http.createHttpAdapter(),\n    { logger: false, abortOnError: false },\n  );\n  try {\n    await app.init();\n    let url: string;\n    if (http.listen) {\n      url = await http.listen(app);\n    } else {\n      await app.listen(0, \"127.0.0.1\");\n      url = await app.getUrl();\n    }\n    url = url.replace(\"[::1]\", \"127.0.0.1\").replace(/\\/$/, \"\");\n    const context = (await auth.$context) as { baseURL: string };\n    const origin = new URL(context.baseURL || KIT_BASE_URL).origin;\n    return {\n      url,\n      origin,\n      post(path, headers, body = {}) {\n        const outgoing: Record<string, string> = {};\n        headers.forEach((value, name) => {\n          outgoing[name] = value;\n        });\n        return sendRaw(`${url}/${BRIDGE_PATH}/${path}`, {\n          method: \"POST\",\n          headers: {\n            ...outgoing,\n            origin,\n            \"content-type\": \"application/json\",\n          },\n          body: JSON.stringify(body),\n        });\n      },\n      close: () => app.close(),\n    };\n  } catch (error) {\n    await app.close().catch(() => undefined);\n    throw error;\n  }\n}\n\nfunction json(response: RawResponse): Record<string, unknown> {\n  return JSON.parse(response.body.toString(\"utf8\") || \"{}\") as Record<\n    string,\n    unknown\n  >;\n}\n\n/** Set-Cookie lines of a response that carry this raw session token. */\nfunction linesWithToken(response: RawResponse, token: string): string[] {\n  return setCookieLines(response.headers).filter((line) =>\n    decodeURIComponent(line.split(\";\", 1)[0]!).includes(`=${token}.`),\n  );\n}\n\n/**\n * The principal-source kit (invariants P1–P7 and the unit-specific rows of design v7 §14.1). It resolves the source\n * directly inside the resolver's chain scope, so a source that throws for invalid credentials fails\n * S-rejected-not-thrown although core would normalize the throw at runtime; S-log-redaction resolves through the real\n * principal resolver. Storage faults are injected into the instance's database adapter, below every endpoint and\n * every direct adapter read, so endpoints that swallow storage errors are exercised too. A case that does not apply to\n * the source (an API-key row for a session source, say) skips with the reason.\n */\nexport function principalSourceConformance(\n  options: PrincipalSourceConformanceOptions,\n): ConformanceCase[] {\n  const add = (\n    id: string,\n    title: string,\n    run: (harness: Harness) => Promise<ConformanceOutcome>,\n    skip?: string,\n  ) => conformanceCase(id, title, () => withHarness(options, run), skip);\n  const valid = (harness: Harness) => options.credentials.valid(harness.auth);\n  return [\n    add(\n      \"S-rejected-not-thrown\",\n      \"invalid credentials resolve rejected with 401, 403 or 429 and never throw\",\n      async ({ resolve, source }) => {\n        const result = await settle(() =>\n          resolve(options.credentials.invalid(), new RecordingSink()),\n        );\n        assert.equal(\n          result.ok,\n          true,\n          `resolve threw for an invalid credential: ${String(!result.ok && result.error)}`,\n        );\n        const value = result.ok ? result.value : undefined;\n        // Better Auth answers an unreadable session cookie as \"no session\"; session-backed sources mirror it.\n        if (value?.outcome === \"absent\" && source.sessionBacked) {\n          return;\n        }\n        assert.equal(value?.outcome, \"rejected\");\n        const failure =\n          value?.outcome === \"rejected\" ? value.failure : undefined;\n        assert.ok(\n          isAuthFailure(failure),\n          \"the rejection is not an AuthFailure\",\n        );\n        assert.ok([401, 403, 429].includes(failure.status));\n      },\n    ),\n    add(\n      \"S-infra-throws\",\n      \"a storage outage makes resolve throw instead of denying\",\n      async (harness) => {\n        const { resolve, probe } = harness;\n        const headers = await valid(harness);\n        const storage = probe.storage.length;\n        probe.storageFault = () => new Error(\"conformance storage outage\");\n        const result = await settle(() =>\n          resolve(headers, new RecordingSink()),\n        );\n        probe.storageFault = undefined;\n        // The fault fires only inside a storage operation; an endpoint served without storage sees no outage.\n        if (probe.storage.length === storage) {\n          return conformanceSkip(\n            \"the source ran no storage operation for a valid credential\",\n          );\n        }\n        assert.equal(\n          result.ok,\n          false,\n          `a storage outage resolved ${JSON.stringify(result.ok && result.value)}`,\n        );\n        assert.ok(\n          !isAuthFailure(!result.ok && result.error),\n          `a storage outage was thrown as a denial: ${String(!result.ok && result.error)}`,\n        );\n      },\n    ),\n    add(\n      \"S-cookie-forwarded\",\n      \"Set-Cookie lines of the source's own-credential calls reach the sink exactly once\",\n      async (harness) => {\n        const { resolve, probe, source } = harness;\n        const sink = new RecordingSink();\n        const headers = await valid(harness);\n        const from = probe.produced.length;\n        const result = await resolve(new Headers(headers), sink);\n        assert.equal(result.outcome, \"authenticated\");\n        const produced = ownCookies(\n          probe,\n          from,\n          headers,\n          source.credentialHeaders ?? [],\n        );\n        for (const line of new Set(produced)) {\n          assert.equal(\n            occurrences(sink.values, line),\n            occurrences(produced, line),\n            `the source's Better Auth calls produced ${occurrences(produced, line)} × ${names([line])[0]}, the sink received ${occurrences(sink.values, line)} (sink: ${names(sink.values).join(\", \") || \"nothing\"})`,\n          );\n        }\n        const seen = names(sink.values);\n        assert.deepEqual(\n          seen,\n          [...new Set(seen)],\n          `a cookie was delivered twice: ${seen.join(\", \")}`,\n        );\n      },\n    ),\n    add(\n      \"S-refresh-suppressed\",\n      \"resolving without a cookie sink refreshes nothing\",\n      async (harness) => {\n        const { resolve, probe } = harness;\n        const headers = await valid(harness);\n        const writes = probe.writes.length;\n        const refresh = probe.refresh.length;\n        const result = await resolve(headers, null);\n        assert.equal(result.outcome, \"authenticated\");\n        assert.ok(\n          !probe.writes.slice(writes).includes(\"session.update\"),\n          \"a session row was refreshed\",\n        );\n        assert.ok(\n          probe.refresh.slice(refresh).every((entry) => entry.skip),\n          \"a Better Auth call ran without refresh suppression\",\n        );\n      },\n    ),\n    add(\n      \"S-absent-clean\",\n      \"no credential resolves absent without cookies or writes\",\n      async ({ resolve, probe }) => {\n        const sink = new RecordingSink();\n        const writes = probe.writes.length;\n        const result = await resolve(new Headers(), sink);\n        assert.equal(result.outcome, \"absent\");\n        assert.deepEqual(sink.values, []);\n        assert.deepEqual(probe.writes.slice(writes), []);\n      },\n    ),\n    add(\n      \"S-shape\",\n      \"an authenticated principal names its kind, source and user\",\n      async (harness) => {\n        const { resolve, source } = harness;\n        const result = await resolve(await valid(harness), new RecordingSink());\n        assert.equal(result.outcome, \"authenticated\");\n        const principal =\n          result.outcome === \"authenticated\" ? result.principal : undefined;\n        assert.ok(principal);\n        assert.ok((source.kinds as readonly string[]).includes(principal.kind));\n        assert.equal(principal.source, source.id);\n        assert.ok(\n          principal.userId === null || typeof principal.userId === \"string\",\n        );\n      },\n    ),\n    add(\n      \"S-credential-headers\",\n      \"a valid credential without its declared headers resolves absent\",\n      async (harness) => {\n        const { resolve, source } = harness;\n        const headers = await valid(harness);\n        for (const name of source.credentialHeaders ?? []) {\n          headers.delete(name);\n        }\n        const result = await resolve(headers, new RecordingSink());\n        assert.equal(\n          result.outcome,\n          \"absent\",\n          \"the source read a credential from an undeclared header\",\n        );\n      },\n    ),\n    add(\n      \"S-session-backed\",\n      \"sessionBacked is declared exactly when the principal is Better Auth's session read\",\n      async (harness) => {\n        const { resolve, source, handle } = harness;\n        const getSession = (headers: Headers) =>\n          (\n            handle.api as {\n              getSession(input: { headers: Headers }): Promise<unknown>;\n            }\n          ).getSession({ headers });\n        for (const headers of [\n          await valid(harness),\n          options.credentials.invalid(),\n        ]) {\n          const session = await getSession(new Headers(headers)).catch(\n            () => null,\n          );\n          const result = await resolve(new Headers(headers), null);\n          if (source.sessionBacked) {\n            assert.equal(\n              result.outcome === \"authenticated\",\n              session !== null,\n              \"a sessionBacked source disagrees with getSession\",\n            );\n          } else if (result.outcome === \"authenticated\") {\n            assert.equal(\n              session,\n              null,\n              \"the credential is a Better Auth session; declare sessionBacked\",\n            );\n          }\n        }\n      },\n    ),\n    add(\n      \"S-delegation\",\n      \"delegation is present exactly when the source declares delegates\",\n      async (harness) => {\n        const { resolve, source } = harness;\n        const result = await resolve(await valid(harness), new RecordingSink());\n        assert.equal(result.outcome, \"authenticated\");\n        const principal =\n          result.outcome === \"authenticated\" ? result.principal : undefined;\n        assert.equal(\n          Boolean(principal?.delegation),\n          Boolean(source.delegates),\n          \"delegates does not match the produced principals\",\n        );\n        if (principal?.delegation) {\n          assert.equal(typeof principal.delegation.allows, \"function\");\n          assert.equal(typeof principal.delegation.description, \"string\");\n          assert.equal(\n            typeof principal.delegation.allows({ conformance: [\"probe\"] }),\n            \"boolean\",\n          );\n        }\n      },\n    ),\n    add(\n      \"S-rate-limited\",\n      \"a rate-limited credential resolves rejected 429\",\n      async (harness) => {\n        const result = await harness.resolve(\n          await options.credentials.rateLimited!(harness.auth),\n          new RecordingSink(),\n        );\n        assert.equal(result.outcome, \"rejected\");\n        const failure =\n          result.outcome === \"rejected\" ? result.failure : undefined;\n        assert.equal(failure?.status, 429);\n      },\n      options.credentials.rateLimited\n        ? undefined\n        : \"the options give no rateLimited() credential\",\n    ),\n    ...dynamicBaseUrlCases(options),\n    ...apiKeyCases(options, add),\n    add(\n      \"S-short-circuit-session\",\n      \"a before hook's short-circuited session is a default-freshness principal and never authoritative\",\n      async (harness) => {\n        const { resolve, probe, source } = harness;\n        if (!source.sessionBacked) {\n          return conformanceSkip(\"the source is not session-backed\");\n        }\n        const headers = await valid(harness);\n        const userId = `conformance-short-circuit-${globalThis.crypto.randomUUID()}`;\n        const now = new Date();\n        probe.respond = (path) =>\n          path === \"/get-session\"\n            ? {\n                user: {\n                  id: userId,\n                  email: `${userId}@conformance.example`,\n                  emailVerified: false,\n                  name: \"Conformance short-circuit\",\n                  createdAt: now,\n                  updatedAt: now,\n                },\n                session: {\n                  id: `${userId}-session`,\n                  userId,\n                  token: `${userId}-token`,\n                  expiresAt: new Date(now.getTime() + 3_600_000),\n                  createdAt: now,\n                  updatedAt: now,\n                },\n              }\n            : undefined;\n        const calls = probe.calls.length;\n        // A cookie sink: the transport is cookie-capable, as HTTP is.\n        const fresh = await settle(() =>\n          resolve(new Headers(headers), new RecordingSink()),\n        );\n        assert.ok(\n          probe.calls.slice(calls).includes(\"/get-session\"),\n          \"the source did not read the session through /get-session\",\n        );\n        assert.equal(\n          fresh.ok,\n          true,\n          `a short-circuited session read threw: ${String(!fresh.ok && fresh.error)}`,\n        );\n        const value = fresh.ok ? fresh.value : undefined;\n        assert.equal(\n          value?.outcome,\n          \"authenticated\",\n          `a default-freshness read of a short-circuited session resolved ${JSON.stringify(value)}`,\n        );\n        assert.equal(\n          value?.outcome === \"authenticated\" ? value.principal.userId : null,\n          userId,\n          \"the principal is not the short-circuited session's user\",\n        );\n        const authoritative = await settle(() =>\n          resolve(new Headers(headers), new RecordingSink(), {\n            freshness: \"authoritative\",\n          }),\n        );\n        assert.equal(\n          authoritative.ok,\n          true,\n          `an authoritative read threw: ${String(!authoritative.ok && authoritative.error)}`,\n        );\n        const decided = authoritative.ok ? authoritative.value : undefined;\n        assert.notEqual(\n          decided?.outcome,\n          \"authenticated\",\n          \"an authoritative route accepted a session no endpoint produced\",\n        );\n        if (decided?.outcome === \"rejected\") {\n          assert.equal(decided.failure.status, 401);\n        }\n      },\n    ),\n    ...bridgeCases(options),\n    ...httpRouteCases(options),\n    ...logRedactionCases(options),\n    ...jwtCases(options),\n  ];\n}\n\nfunction logRedactionCases(\n  options: PrincipalSourceConformanceOptions,\n): ConformanceCase[] {\n  /** One run: every credential form of the requests in the outage error, resolved through the real resolver. */\n  const run = (exposeRawCause: boolean) =>\n    withHarness(\n      options,\n      async (value) => {\n        const headers = await options.credentials.valid(value.auth);\n        const requests = [headers];\n        const session = await sessionToken(value.auth, headers);\n        if (value.source.sessionBacked && session) {\n          requests.push(\n            new Headers({ authorization: `Bearer ${session.token}` }),\n          );\n        }\n        let observed = false;\n        // Better Auth endpoints may swallow an adapter error into a generic one, so the error also comes from a\n        // before hook, which rethrows it unchanged: both reach the library's error path.\n        const modes = [\"storage\", \"endpoint\"] as const;\n        for (const request of requests) {\n          const secrets = credentialForms(\n            request,\n            value.source.credentialHeaders ?? [],\n          );\n          const outage = () => {\n            const error = new Error(\n              `conformance outage for ${secrets.join(\" \")}`,\n            );\n            Object.assign(error, { detail: secrets.join(\" \") });\n            error.cause = new Error(`nested ${secrets.join(\" \")}`);\n            return error;\n          };\n          for (const mode of modes) {\n            const inject = () => {\n              if (mode === \"storage\") {\n                value.probe.storageFault = outage;\n              } else {\n                value.probe.fault = outage;\n              }\n            };\n            inject();\n            const chained = await settle(() =>\n              value.resolveChain(new Headers(request), new RecordingSink()),\n            );\n            inject();\n            const direct = await settle(() =>\n              value.resolve(new Headers(request), new RecordingSink()),\n            );\n            value.probe.storageFault = undefined;\n            value.probe.fault = undefined;\n            if (chained.ok) {\n              continue;\n            }\n            observed = true;\n            const error = chained.error;\n            assert.ok(\n              isInfrastructureError(error),\n              `a ${mode} outage surfaced as ${String(error)}`,\n            );\n            const logs = [\n              consoleLogged(error),\n              JSON.stringify(serializeError(error)),\n              // The raw cause is a hidden property by design when the instance opts in.\n              inspect(error, { depth: 8, showHidden: !exposeRawCause }),\n            ].join(\"\\n\");\n            for (const secret of secrets) {\n              assert.ok(\n                !logs.includes(secret),\n                `a credential reached the logs after a ${mode} outage (exposeRawCause: ${exposeRawCause}): ${secret.slice(0, 6)}…`,\n              );\n            }\n            const raw = getRawCause(error);\n            if (!exposeRawCause) {\n              assert.equal(\n                raw,\n                undefined,\n                \"getRawCause exposed a cause without errors.exposeRawCause\",\n              );\n            } else if (!direct.ok && !isInfrastructureError(direct.error)) {\n              // The source let the error escape; the resolver wraps it and keeps it for the opt-in.\n              assert.ok(\n                raw instanceof Error &&\n                  raw.message === (direct.error as Error | undefined)?.message,\n                `errors.exposeRawCause did not keep the escaped raw cause: ${String(raw)}`,\n              );\n            }\n          }\n        }\n        return observed\n          ? undefined\n          : conformanceSkip(\n              \"the source read no storage and called no Better Auth endpoint for a valid credential, so no error reached it\",\n            );\n      },\n      { module: { errors: { exposeRawCause } } },\n    );\n  return [\n    conformanceCase(\n      \"S-log-redaction\",\n      \"a storage error carrying the request's credentials leaves none in Nest ConsoleLogger or JSON logs\",\n      () => run(false),\n    ),\n    conformanceCase(\n      \"S-log-redaction\",\n      \"with errors.exposeRawCause the logs stay redacted and getRawCause keeps an escaped raw cause\",\n      () => run(true),\n    ),\n  ];\n}\n\nfunction dynamicBaseUrlCases(\n  options: PrincipalSourceConformanceOptions,\n): ConformanceCase[] {\n  const dynamic = { baseURL: { allowedHosts: DYNAMIC_HOSTS } };\n  return [\n    conformanceCase(\n      \"S-dynamic-base-url\",\n      \"a dynamic baseURL without fallback fails boot for hostless sources and never answers 500 for the others\",\n      async () => {\n        const auth = await variantOf(options, dynamic as never);\n        // A misconfigured variant fails the case; only the source's boot errors skip it.\n        await assertKitInstance(auth);\n        const booted = await settle(() => harness(options, { auth }));\n        if (!booted.ok) {\n          const codes = bootIssueCodes(booted.error);\n          if (codes.includes(\"DYNAMIC_BASE_URL_WITHOUT_FALLBACK\")) {\n            return;\n          }\n          if (!codes.length) {\n            throw booted.error;\n          }\n          return conformanceSkip(\n            `the source rejects a dynamic baseURL without fallback at boot (${codes.filter((code) => code !== \"AUTH_BOOT_FAILED\").join(\", \")})`,\n          );\n        }\n        const value = booted.value;\n        try {\n          assert.ok(\n            !value.source.requires?.hostlessCalls,\n            \"a source that declares requires.hostlessCalls booted with a dynamic baseURL and no fallback\",\n          );\n          const host = { host: KIT_HOST };\n          const requests: [string, Headers][] = [\n            [\"valid\", await options.credentials.valid(auth)],\n            [\"invalid\", options.credentials.invalid()],\n          ];\n          for (const [label, credential] of requests) {\n            const headers = new Headers(credential);\n            headers.set(\"host\", host.host);\n            const result = await settle(() =>\n              value.resolve(headers, new RecordingSink()),\n            );\n            assert.equal(\n              result.ok,\n              true,\n              `the ${label} credential threw with a dynamic baseURL (a hostless call?): ${String(!result.ok && result.error)}`,\n            );\n          }\n        } finally {\n          await value.close();\n        }\n      },\n    ),\n    conformanceCase(\n      \"S-dynamic-base-url\",\n      \"behind a trusted proxy, the forwarded public host resolves the dynamic baseURL\",\n      async () => {\n        const auth = await variantOf(options, {\n          ...dynamic,\n          advanced: { trustedProxyHeaders: true },\n        } as never);\n        // A misconfigured variant fails the case; only the source's boot errors skip it.\n        await assertKitInstance(auth);\n        const booted = await settle(() => harness(options, { auth }));\n        if (!booted.ok) {\n          const codes = bootIssueCodes(booted.error);\n          if (!codes.length) {\n            throw booted.error;\n          }\n          return conformanceSkip(\n            `the source rejects a dynamic baseURL without fallback at boot (${codes.filter((code) => code !== \"AUTH_BOOT_FAILED\").join(\", \")})`,\n          );\n        }\n        const value = booted.value;\n        try {\n          const headers = new Headers(await options.credentials.valid(auth));\n          // The app's own host is not allowed; only the forwarded public host is.\n          headers.set(\"host\", \"nest-app:3000\");\n          headers.set(\"x-forwarded-host\", PUBLIC_HOST);\n          headers.set(\"x-forwarded-proto\", \"https\");\n          const result = await settle(() =>\n            value.resolve(headers, new RecordingSink()),\n          );\n          assert.equal(\n            result.ok,\n            true,\n            `a forwarded request threw with a dynamic baseURL: ${String(!result.ok && result.error)}`,\n          );\n        } finally {\n          await value.close();\n        }\n      },\n    ),\n  ];\n}\n\nfunction apiKeyCases(\n  options: PrincipalSourceConformanceOptions,\n  add: (\n    id: string,\n    title: string,\n    run: (harness: Harness) => Promise<ConformanceOutcome>,\n  ) => ConformanceCase,\n): ConformanceCase[] {\n  const apiKeyCase = (\n    id: string,\n    title: string,\n    run: (harness: Harness) => Promise<ConformanceOutcome>,\n  ) =>\n    add(id, title, (harness) =>\n      verifiesApiKeys(harness.source)\n        ? run(harness)\n        : Promise.resolve(conformanceSkip(NOT_API_KEY)),\n    );\n  return [\n    apiKeyCase(\n      \"S-apikey-results\",\n      \"rate-limited, exhausted, disabled, expired and unknown keys map to their statuses, one verification per request\",\n      async (harness) => {\n        const { resolve, source } = harness;\n        const limited = await createKey(options, harness, {\n          rateLimitEnabled: true,\n          rateLimitMax: 1,\n          rateLimitTimeWindow: 60_000,\n        });\n        assert.equal(\n          (await resolve(new Headers(limited.headers), null)).outcome,\n          \"authenticated\",\n          \"the rate-limited key's first request did not authenticate\",\n        );\n        const throttled = await resolve(new Headers(limited.headers), null);\n        assertRejected(throttled, 429, \"RATE_LIMITED\", \"a rate-limited key\");\n        const retryAfter = Number(\n          throttled.outcome === \"rejected\"\n            ? throttled.failure.headers?.get(\"retry-after\")\n            : undefined,\n        );\n        assert.ok(\n          retryAfter >= 50 && retryAfter <= 60,\n          `Retry-After ${retryAfter} does not come from the 60 s window's tryAgainIn`,\n        );\n        const exhausted = await createKey(options, harness, { remaining: 0 });\n        assertRejected(\n          await resolve(exhausted.headers, null),\n          429,\n          \"USAGE_EXCEEDED\",\n          \"an exhausted key\",\n        );\n        const disabled = await createKey(options, harness);\n        await updateKey(harness, disabled.id, { enabled: false });\n        assertRejected(\n          await resolve(disabled.headers, null),\n          401,\n          \"KEY_DISABLED\",\n          \"a disabled key\",\n        );\n        const expired = await createKey(options, harness);\n        await updateKey(harness, expired.id, {\n          expiresAt: new Date(Date.now() - 60_000),\n        });\n        assertRejected(\n          await resolve(expired.headers, null),\n          401,\n          \"KEY_EXPIRED\",\n          \"an expired key\",\n        );\n        assertRejected(\n          await resolve(unknownKey(source), null),\n          401,\n          \"INVALID_API_KEY\",\n          \"an unknown key\",\n        );\n        const api = harness.auth.api as unknown as KeyApi;\n        const verify = api.verifyApiKey;\n        let verifications = 0;\n        api.verifyApiKey = (input) => {\n          verifications++;\n          return verify.call(api, input);\n        };\n        try {\n          const key = await createKey(options, harness);\n          const memo = new Map<unknown, Promise<unknown>>();\n          for (const freshness of [\n            \"default\",\n            \"default\",\n            \"authoritative\",\n          ] as const) {\n            assert.equal(\n              (\n                await resolve(new Headers(key.headers), null, {\n                  freshness,\n                  memo,\n                })\n              ).outcome,\n              \"authenticated\",\n            );\n          }\n        } finally {\n          api.verifyApiKey = verify;\n        }\n        assert.equal(\n          verifications,\n          1,\n          `one request verified its key ${verifications} times`,\n        );\n      },\n    ),\n    apiKeyCase(\n      \"S-apikey-outage\",\n      \"a flood of invalid keys runs at most one outage probe\",\n      async ({ resolve, probe, source }) => {\n        const from = probe.storage.length;\n        const results = await Promise.all(\n          Array.from({ length: 12 }, () => resolve(unknownKey(source), null)),\n        );\n        for (const result of results) {\n          assertRejected(result, 401, \"INVALID_API_KEY\", \"an unknown key\");\n        }\n        const writes = probe.storage\n          .slice(from)\n          .filter((entry) => WRITES.has(entry.split(\":\", 1)[0]!));\n        assert.ok(\n          writes.length <= 1,\n          `a flood of 12 invalid keys wrote ${writes.length} times (${writes.join(\", \")}); the outage probe runs at most once per second`,\n        );\n      },\n    ),\n    apiKeyCase(\n      \"S-apikey-outage\",\n      \"with key reads failing, an API-key request answers 5xx instead of 401\",\n      async (harness) => {\n        const { resolve, probe, source } = harness;\n        const key = await createKey(options, harness);\n        probe.storageFault = (call) =>\n          call.method === \"findOne\"\n            ? new Error(\"conformance read outage\")\n            : undefined;\n        await assertInfrastructure(\n          () => resolve(unknownKey(source), null),\n          \"an unknown key during a read outage\",\n        );\n        await assertInfrastructure(\n          () => resolve(new Headers(key.headers), null),\n          \"a valid key during a read outage\",\n        );\n      },\n    ),\n    apiKeyCase(\n      \"S-apikey-outage\",\n      \"a stalled, failing usage update answers 5xx while an unknown key still answers a fast 401\",\n      async (harness) => {\n        const { resolve, probe, source } = harness;\n        const key = await createKey(options, harness);\n        const usage = (call: { method: string; model: string | undefined }) =>\n          call.method === \"update\" && call.model === \"apikey\";\n        probe.storageDelay = (call) => (usage(call) ? STALL_MS : undefined);\n        probe.storageFault = (call) =>\n          usage(call) ? new Error(\"conformance stalled update\") : undefined;\n        await assertInfrastructure(\n          () => resolve(new Headers(key.headers), null),\n          \"a valid key whose usage update stalled and failed\",\n        );\n        const started = performance.now();\n        const unknown = await resolve(unknownKey(source), null);\n        const elapsed = performance.now() - started;\n        assertRejected(unknown, 401, \"INVALID_API_KEY\", \"an unknown key\");\n        assert.ok(\n          elapsed < STALL_MS,\n          `an unknown key took ${Math.round(elapsed)} ms, no faster than the stalled update`,\n        );\n      },\n    ),\n    apiKeyCase(\n      \"S-apikey-write-outage\",\n      \"with reads succeeding and every write failing, a valid key answers 5xx, not 401\",\n      async (harness) => {\n        const { resolve, probe } = harness;\n        const key = await createKey(options, harness);\n        probe.storageFault = (call) =>\n          WRITES.has(call.method) ? new Error(READ_ONLY) : undefined;\n        await assertInfrastructure(\n          () => resolve(new Headers(key.headers), null),\n          \"a valid key during a write outage\",\n        );\n      },\n    ),\n    apiKeyCase(\n      \"S-apikey-write-outage\",\n      \"the outage probe's write changes no key row\",\n      async (harness) => {\n        const { resolve, source } = harness;\n        await createKey(options, harness);\n        const context = (await harness.auth.$context) as {\n          adapter: { findMany(input: { model: string }): Promise<unknown[]> };\n        };\n        const before = JSON.stringify(\n          await context.adapter.findMany({ model: \"apikey\" }),\n        );\n        assertRejected(\n          await resolve(unknownKey(source), null),\n          401,\n          \"INVALID_API_KEY\",\n          \"an unknown key\",\n        );\n        assert.equal(\n          JSON.stringify(await context.adapter.findMany({ model: \"apikey\" })),\n          before,\n          \"an invalid key changed a stored key\",\n        );\n      },\n    ),\n    conformanceCase(\n      \"S-apikey-org-key\",\n      \"an organization-owned key has no user and is denied by user-scoped admin permissions\",\n      async () => {\n        let principal: AuthPrincipal | undefined;\n        const outcome = await withHarness(options, async (harness) => {\n          if (!verifiesApiKeys(harness.source)) {\n            return conformanceSkip(NOT_API_KEY);\n          }\n          if (!(await harness.handle.hasPlugin(\"admin\"))) {\n            return conformanceSkip(\"the instance has no admin() plugin\");\n          }\n          const result = await harness.resolve(\n            await options.credentials.organizationKey!(harness.auth),\n            null,\n          );\n          assert.equal(\n            result.outcome,\n            \"authenticated\",\n            `the organization key resolved ${JSON.stringify(result)}`,\n          );\n          principal =\n            result.outcome === \"authenticated\" ? result.principal : undefined;\n          const key = principal as\n            | (AuthPrincipal & { organizationId?: unknown })\n            | undefined;\n          assert.equal(\n            key?.userId,\n            null,\n            \"an organization-owned key produced a user principal\",\n          );\n          assert.ok(\n            typeof key?.organizationId === \"string\" &&\n              key.organizationId.length > 0,\n            \"an organization-owned key carries no organizationId\",\n          );\n        });\n        if (outcome && typeof outcome.skipped === \"string\") {\n          return outcome;\n        }\n        // The kit judges the instance under test, not the program's registered instance, whose\n        // admin() statements type permission() and may name other resources.\n        const permissions = { user: [\"list\"] } as Readonly<\n          Record<string, readonly string[]>\n        > as AdminPermissions;\n        const optedIn = await judgePrincipal(\n          options.auth,\n          permission(permissions, { principals: [\"session\", \"api-key\"] }),\n          principal!,\n        );\n        assert.equal(optedIn.decision.effect, \"deny\");\n        assert.equal(\n          (optedIn.decision as { reason?: string }).reason,\n          \"USER_REQUIRED\",\n          JSON.stringify(optedIn.decision),\n        );\n        assert.equal(\n          (optedIn.decision as { status?: number }).status ?? 403,\n          403,\n        );\n        const gated = await judgePrincipal(\n          options.auth,\n          permission(permissions),\n          principal!,\n        );\n        assert.equal(gated.decision.effect, \"deny\");\n        assert.equal(\n          (gated.decision as { reason?: string }).reason,\n          \"PRINCIPAL_NOT_SUPPORTED\",\n          JSON.stringify(gated.decision),\n        );\n        assert.equal(\n          gated.evaluations,\n          0,\n          \"the default permission() ran its policy for an API-key principal\",\n        );\n      },\n      options.credentials.organizationKey\n        ? undefined\n        : \"the options give no organizationKey() credential\",\n    ),\n  ];\n}\n\nfunction bridgeCases(\n  options: PrincipalSourceConformanceOptions,\n): ConformanceCase[] {\n  const skip = options.http ? undefined : \"the options give no http harness\";\n  /** Boots the bridge app for a session-backed source whose credential carries the session cookie. */\n  const withBridge = async (\n    fn: (boot: BridgeBoot, caller: () => Promise<Headers>) => Promise<void>,\n  ): Promise<ConformanceOutcome> => {\n    const inspected = await harness(options);\n    const { source } = inspected;\n    let credential: Headers;\n    try {\n      credential = await options.credentials.valid(options.auth);\n    } finally {\n      await inspected.close();\n    }\n    if (!source.sessionBacked) {\n      return conformanceSkip(\"the source is not session-backed\");\n    }\n    if (!(await sessionToken(options.auth, credential))) {\n      return conformanceSkip(\n        \"the valid credential carries no session cookie of the instance\",\n      );\n    }\n    const boot = await bootBridge(options, options.http!, source.kinds);\n    try {\n      await fn(boot, () => options.credentials.valid(options.auth));\n    } finally {\n      await boot.close();\n    }\n  };\n  return [\n    conformanceCase(\n      \"S-bridge-third-party-signup\",\n      \"a direct sign-up for another user leaves the caller's cookies untouched unless the handler forwards\",\n      () =>\n        withBridge(async (boot, caller) => {\n          const headers = await caller();\n          const own = (await sessionToken(options.auth, headers))!;\n          const plain = await boot.post(\"sign-up\", headers);\n          assert.equal(plain.status, 201, plain.body.toString(\"utf8\"));\n          const token = String(json(plain).token);\n          assert.deepEqual(\n            linesWithToken(plain, token),\n            [],\n            \"a guarded handler's direct sign-up set the new user's session cookie on the caller\",\n          );\n          for (const line of setCookieLines(plain.headers)) {\n            if (line.startsWith(`${own.name}=`)) {\n              assert.ok(\n                decodeURIComponent(line).startsWith(\n                  `${own.name}=${own.token}.`,\n                ),\n                \"the caller's session cookie was replaced\",\n              );\n            }\n          }\n          const forwarded = await boot.post(\n            \"sign-up-forwarded\",\n            await caller(),\n          );\n          assert.equal(forwarded.status, 201, forwarded.body.toString(\"utf8\"));\n          const forwardedToken = String(json(forwarded).token);\n          assert.equal(\n            linesWithToken(forwarded, forwardedToken).length,\n            1,\n            \"@ForwardAuthCookies() did not forward the direct sign-up's session cookie\",\n          );\n        }),\n      skip,\n    ),\n    conformanceCase(\n      \"S-bridge-foreign-credentials\",\n      \"foreign-credential cookies are forwarded only through forwardForeignCookies in a forwarding handler\",\n      () =>\n        withBridge(async (boot, caller) => {\n          const foreign = await kitIdentity(options.auth);\n          const dropped = await boot.post(\"foreign-session\", await caller(), {\n            token: foreign.token,\n          });\n          assert.equal(dropped.status, 201, dropped.body.toString(\"utf8\"));\n          assert.deepEqual(\n            linesWithToken(dropped, foreign.token),\n            [],\n            \"a direct getSession with a foreign bearer token forwarded its refresh cookie\",\n          );\n          const headers = await caller();\n          const own = (await sessionToken(options.auth, headers))!;\n          const signOut = await boot.post(\"sign-out\", headers);\n          assert.equal(signOut.status, 201, signOut.body.toString(\"utf8\"));\n          assert.ok(\n            setCookieLines(signOut.headers).some(\n              (line) =>\n                line.startsWith(`${own.name}=`) &&\n                (line.startsWith(`${own.name}=;`) || /max-age=0/i.test(line)),\n            ),\n            `the caller's own sign-out did not forward its cookie deletion: ${setCookieLines(signOut.headers).join(\" | \")}`,\n          );\n          const explicit = await boot.post(\n            \"foreign-forwarded\",\n            await caller(),\n            {\n              token: foreign.token,\n            },\n          );\n          assert.equal(explicit.status, 201, explicit.body.toString(\"utf8\"));\n          assert.equal(\n            linesWithToken(explicit, foreign.token).length,\n            1,\n            \"forwardForeignCookies() in a forwarding handler did not forward the foreign refresh cookie\",\n          );\n          const undeclared = await boot.post(\n            \"foreign-undeclared\",\n            await caller(),\n            { token: foreign.token },\n          );\n          assert.equal(\n            json(undeclared).code,\n            \"FORWARDING_NOT_DECLARED\",\n            \"forwardForeignCookies() ran outside a forwarding handler\",\n          );\n          assert.deepEqual(linesWithToken(undeclared, foreign.token), []);\n        }),\n      skip,\n    ),\n  ];\n}\n\n/** A response header the probe sets on the source's own calls; it must never reach the client (S-cookie-forwarded). */\nconst CALL_HEADER = \"x-conformance-call-header\";\n\n/** S-cookie-forwarded and S-infra-throws through a guarded route of the http harness. */\nfunction httpRouteCases(\n  options: PrincipalSourceConformanceOptions,\n): ConformanceCase[] {\n  const skip = options.http ? undefined : \"the options give no http harness\";\n  const withRoute = async (\n    fn: (\n      boot: BridgeBoot,\n      source: PrincipalSource,\n      probe: ProbeState,\n    ) => Promise<ConformanceOutcome>,\n  ): Promise<ConformanceOutcome> => {\n    const inspected = await harness(options);\n    const { source, probe } = inspected;\n    await inspected.close();\n    const boot = await bootBridge(options, options.http!, source.kinds);\n    try {\n      return await fn(boot, source, probe);\n    } finally {\n      probe.storageFault = undefined;\n      probe.responseHeader = undefined;\n      await boot.close();\n    }\n  };\n  return [\n    conformanceCase(\n      \"S-infra-throws\",\n      \"through an HTTP route: a storage outage answers 5xx, never 401 or 403\",\n      () =>\n        withRoute(async (boot, _source, probe) => {\n          const headers = await options.credentials.valid(options.auth);\n          const storage = probe.storage.length;\n          probe.storageFault = () => new Error(\"conformance storage outage\");\n          const response = await boot.post(\"principal\", headers);\n          probe.storageFault = undefined;\n          // The fault fires only inside a storage operation; an endpoint served without storage sees no outage.\n          if (probe.storage.length === storage) {\n            return conformanceSkip(\n              \"the source ran no storage operation for a valid credential\",\n            );\n          }\n          assert.ok(\n            response.status >= 500 && response.status < 600,\n            `a guarded route answered ${response.status} for a storage outage instead of 5xx: ${response.body.toString(\"utf8\")}`,\n          );\n        }),\n      skip,\n    ),\n    conformanceCase(\n      \"S-cookie-forwarded\",\n      \"through an HTTP route: each Set-Cookie line of the source's own-credential calls reaches the client exactly once, and no other header of those calls does\",\n      () =>\n        withRoute(async (boot, source, probe) => {\n          const headers = await options.credentials.valid(options.auth);\n          const from = probe.produced.length;\n          const calls = probe.calls.length;\n          probe.responseHeader = () => [CALL_HEADER, \"leaked\"];\n          const response = await boot.post(\"principal\", headers);\n          probe.responseHeader = undefined;\n          assert.equal(\n            response.status,\n            201,\n            `the guarded route answered ${response.status}: ${response.body.toString(\"utf8\")}`,\n          );\n          const produced = ownCookies(\n            probe,\n            from,\n            headers,\n            source.credentialHeaders ?? [],\n          );\n          const delivered = setCookieLines(response.headers);\n          for (const line of new Set(produced)) {\n            assert.equal(\n              occurrences(delivered, line),\n              1,\n              `the source's Better Auth calls produced ${names([line])[0]}, the client received it ${occurrences(delivered, line)} times (received: ${names(delivered).join(\", \") || \"nothing\"})`,\n            );\n          }\n          for (const line of delivered) {\n            assert.ok(\n              produced.includes(line),\n              `the client received ${names([line])[0]}, which no call with the request's own credential produced`,\n            );\n          }\n          if (probe.calls.length > calls) {\n            assert.equal(\n              response.headers[CALL_HEADER],\n              undefined,\n              \"a header other than Set-Cookie that the source's Better Auth calls set reached the client\",\n            );\n          }\n        }),\n      skip,\n    ),\n  ];\n}\n\ninterface JwtApi {\n  signJWT(input: {\n    body: {\n      payload: Record<string, unknown>;\n      overrideOptions?: Record<string, unknown>;\n    };\n  }): Promise<{ token: string }>;\n}\n\nfunction jwtCases(\n  options: PrincipalSourceConformanceOptions,\n): ConformanceCase[] {\n  const NOT_JWT = \"the source does not require the jwt plugin\";\n  const jwtCase = (\n    title: string,\n    run: (\n      harness: Harness,\n      mint: JwtApi[\"signJWT\"],\n    ) => Promise<ConformanceOutcome>,\n  ) =>\n    conformanceCase(\"S-jwt-claims\", title, () =>\n      withHarness(options, async (harness) => {\n        if (!(harness.source.requires?.plugins ?? []).includes(\"jwt\")) {\n          return conformanceSkip(NOT_JWT);\n        }\n        const api = harness.auth.api as unknown as JwtApi;\n        return run(harness, (input) => api.signJWT(input));\n      }),\n    );\n  const bearer = (token: string) =>\n    new Headers({ authorization: `Bearer ${token}` });\n  return [\n    jwtCase(\n      \"a token signJWT minted verifies, and one minted under another issuer is rejected 401 INVALID_JWT\",\n      async ({ resolve }, mint) => {\n        const subject = `conformance-${globalThis.crypto.randomUUID()}`;\n        const { token } = await mint({ body: { payload: { sub: subject } } });\n        const verified = await resolve(bearer(token), null);\n        assert.equal(\n          verified.outcome,\n          \"authenticated\",\n          `a token signJWT minted did not verify (iss/aud must be the baseURL origin): ${JSON.stringify(verified)}`,\n        );\n        const foreign = await mint({\n          body: {\n            payload: { sub: subject },\n            overrideOptions: {\n              jwt: { issuer: \"https://conformance-foreign-issuer.example\" },\n            },\n          },\n        });\n        const result = await settle(() => resolve(bearer(foreign.token), null));\n        assert.equal(\n          result.ok,\n          true,\n          `a foreign-issuer token threw: ${String(!result.ok && result.error)}`,\n        );\n        assertRejected(\n          result.ok ? result.value : { outcome: \"absent\" },\n          401,\n          \"INVALID_JWT\",\n          \"a foreign-issuer token\",\n        );\n      },\n    ),\n    jwtCase(\n      \"with the key-set read failing, a valid token answers 5xx\",\n      async ({ resolve, probe }, mint) => {\n        const { token } = await mint({\n          body: { payload: { sub: \"conformance\" } },\n        });\n        const from = probe.storage.length;\n        probe.storageFault = (call) =>\n          call.model === \"jwks\"\n            ? new Error(\"conformance key-set outage\")\n            : undefined;\n        const result = await settle(() => resolve(bearer(token), null));\n        probe.storageFault = undefined;\n        if (\n          !probe.storage.slice(from).some((entry) => entry.endsWith(\":jwks\"))\n        ) {\n          return conformanceSkip(\n            \"the source served the key set from a cache; pass it as a factory reference so each case starts cold\",\n          );\n        }\n        assert.equal(\n          result.ok,\n          false,\n          `a key-set outage resolved ${JSON.stringify(result.ok && result.value)}`,\n        );\n        assert.ok(\n          !isAuthFailure(!result.ok && result.error),\n          `a key-set outage was thrown as a denial: ${String(!result.ok && result.error)}`,\n        );\n      },\n    ),\n  ];\n}\n","import assert from \"node:assert/strict\";\nimport {\n  type ExecutionContext,\n  type INestApplication,\n  type LoggerService,\n  SetMetadata,\n  type Type,\n  UseGuards,\n} from \"@nestjs/common\";\nimport {\n  DiscoveryService,\n  ExternalContextCreator,\n  MetadataScanner,\n  ModuleRef,\n  Reflector,\n} from \"@nestjs/core\";\nimport type { TestingModuleBuilder } from \"@nestjs/testing\";\nimport type { BetterAuthOptions } from \"better-auth\";\nimport { organization } from \"better-auth/plugins\";\nimport type {\n  AuthorizationPolicy,\n  AuthPrincipalBase,\n  AuthTransport,\n  ClaimOptions,\n  ExtensionRef,\n  GuardReach,\n  PrincipalSource,\n  RequirementExpr,\n  RoutePlan,\n  TransportCall,\n} from \"./auth-contracts.js\";\nimport {\n  AcceptPrincipals,\n  CurrentPrincipal,\n  ForwardAuthCookies,\n  OptionalAuth,\n  Public,\n  Require,\n  RequireAuth,\n  requirement,\n  SkipDefaultRequirements,\n  SkipOriginCheck,\n  UseBetterAuth,\n} from \"./auth-decorators.js\";\nimport { AuthFailures, BetterAuthConfigurationError } from \"./auth-errors.js\";\nimport { BetterAuthGuard } from \"./auth-guard.js\";\nimport type { BetterAuthService } from \"./auth-service.js\";\nimport {\n  MOUNT_COORDINATOR,\n  ROUTE_PLANNER,\n  TRANSPORT_REGISTRY,\n  WS_CONNECTION_AUTH,\n} from \"./auth-tokens.js\";\nimport type { AuthLike, AuthPrincipal, PrincipalKind } from \"./auth-types.js\";\nimport { allow, deny } from \"./authorization-evaluator.js\";\nimport { EXTENSION_DEFINITION } from \"./bridge-protocol.js\";\nimport {\n  bootIssueCodes,\n  CapturingLogger,\n  type ConformanceCase,\n  conformanceCase,\n  conformanceSkip,\n  type ConformanceOutcome,\n  type ConformanceSkip,\n  type ConformanceAuthSettings,\n  createConformanceAuth,\n  kitIdentity,\n  type KitIdentity,\n  PROBE_TRUSTED_ORIGIN,\n  KIT_BASE_URL,\n  probeOf,\n  type ProbeState,\n  settle,\n  UNTRUSTED_ORIGIN,\n} from \"./conformance-fixtures.js\";\nimport {\n  ACTIVE_ORGANIZATION_ID,\n  ActiveOrganizationId,\n  fromParam,\n  orgPermission,\n} from \"./organization.js\";\nimport { absent, authenticated, rejected } from \"./principal-resolver.js\";\nimport { CurrentSession } from \"./session-principal.js\";\nimport type { MountCoordinator } from \"./mount-coordinator.js\";\nimport type { RoutePlanner } from \"./route-planner.js\";\nimport { overrideAuthGuard } from \"./testing.js\";\nimport type { TransportRegistry } from \"./transport-registry.js\";\n\nexport type InvocationShape =\n  | \"aliases\"\n  | \"batched\"\n  | \"messages\"\n  | \"subscriptions\";\n\n/** One fixture handler the kit supplies; the harness exposes it as a controller route, resolver field, gateway message or message pattern. */\nexport interface FixtureHandler {\n  /** Method decorators to apply, in order (access, acceptance, requirements). */\n  readonly decorators: readonly MethodDecorator[];\n  /** Parameter decorators by parameter index, e.g. [CurrentSession()]. */\n  readonly params: readonly ParameterDecorator[];\n  /** 'read': HTTP GET, GraphQL query, RPC request. 'unsafe': HTTP POST, GraphQL mutation. WS messages are always enforced. */\n  readonly operation: \"read\" | \"unsafe\";\n  /** Handler body: receives the decorated parameter values, the invocation input and the harness context; its result is the response. */\n  handle(\n    params: readonly unknown[],\n    input: Record<string, unknown>,\n    context: FixtureContext,\n  ): unknown;\n}\n\n/** What the harness hands every fixture handler. */\nexport interface FixtureContext {\n  /** The default instance's service (BETTER_AUTH_SERVICE). */\n  readonly service: BetterAuthService;\n}\n\n/**\n * One method of an abstract base class, exposed through two subclasses that carry `subclasses.public` and\n * `subclasses.denied` as class decorators (T-inherited-handler). A harness without invokeInherited exposes it as a\n * plain handler.\n */\nexport interface InheritedFixture extends FixtureHandler {\n  readonly subclasses: {\n    readonly public: readonly ClassDecorator[];\n    readonly denied: readonly ClassDecorator[];\n  };\n}\n\n/**\n * GraphQL shapes only: one object type FixtureNode, returned by the root fields and carrying the field resolvers\n * below. invokeGraph selects `publicNested` as `publicNested { id reader }` and `guarded` as\n * `guarded { id principal nestedReader }`, so `reader` and `nestedReader` read the reading of their enclosing field.\n */\nexport interface GraphFixtures {\n  readonly roots: {\n    readonly public: FixtureHandler;\n    readonly sessionOnly: FixtureHandler;\n    readonly mixed: FixtureHandler;\n    /**\n     * A list root: its handler returns 20 FixtureNode items, so serve it as a list of FixtureNode (`[FixtureNode]`).\n     * Given only to the reader rows of T-internal-error-logged-once.\n     */\n    readonly items?: FixtureHandler;\n  };\n  readonly fields: {\n    readonly plain: FixtureHandler;\n    readonly publicNested: FixtureHandler;\n    readonly reader: FixtureHandler;\n    readonly guarded?: FixtureHandler;\n    readonly nestedReader?: FixtureHandler;\n    readonly sessionReader: FixtureHandler;\n    /** @ForwardAuthCookies() without access metadata: an inheriting form-mode field that signs a kit user in (T-csrf-login-proxy). */\n    readonly forwarding?: FixtureHandler;\n    /** A String field reading @ActiveOrganizationId() without a requirement that provides it (T-internal-error-logged-once). */\n    readonly organizationReader?: FixtureHandler;\n    /** A String field returning the user id of the zero-argument service.getSession() (T-internal-error-logged-once). */\n    readonly serviceSession?: FixtureHandler;\n  };\n  /** Federation shapes only: @ResolveReference() of FixtureNode, with the kit's per-representation requirement on `orgId`. */\n  readonly reference?: FixtureHandler;\n  /** Class decorators of the resolver class that serves the roots, the fields and the reference resolver. */\n  readonly classDecorators?: readonly ClassDecorator[];\n}\n\nexport interface GraphSelection {\n  readonly root: keyof GraphFixtures[\"roots\"];\n  readonly fields: readonly (keyof GraphFixtures[\"fields\"])[];\n}\n\n/**\n * The fixture handlers of transportConformance, by name (the `handler` argument of invoke()). Harnesses expose each\n * input field as the transport's named input, so ctx.param(name) reads input[name] (HTTP: route param or query).\n * `triple` and `tripleMixed` are three distinct handler methods; invoke() runs all three in one logical request when\n * the transport can, otherwise the first one.\n */\nexport interface TransportFixtures {\n  readonly required: FixtureHandler;\n  readonly optional: FixtureHandler;\n  readonly public: FixtureHandler;\n  readonly forbidden: FixtureHandler;\n  readonly triple: readonly [FixtureHandler, FixtureHandler, FixtureHandler];\n  readonly tripleMixed: readonly [\n    FixtureHandler,\n    FixtureHandler,\n    FixtureHandler,\n  ];\n  readonly readsSession: FixtureHandler;\n  /** @AcceptPrincipals('session', 'api-key'), returns service.getSession() (T-reads-session). */\n  readonly readsSessionService: FixtureHandler;\n  readonly unsafe: FixtureHandler;\n  readonly loginProxy: FixtureHandler;\n  /** @Public() @ForwardAuthCookies(), operation 'read' (HTTP GET), calls service.api.signInEmail (T-csrf-login-proxy, T-csrf-safe-methods). */\n  readonly loginProxyRead: FixtureHandler;\n  readonly loginProxyService: FixtureHandler;\n  readonly publicService: FixtureHandler;\n  readonly acceptsApiKey: FixtureHandler;\n  readonly org: FixtureHandler;\n  readonly inherited: InheritedFixture;\n  readonly unguarded: FixtureHandler;\n  /**\n   * Default access, operation 'read': a direct auth.api.getSession() call presenting the invocation's `cookie` input,\n   * the caller's own session cookie (T-csrf-safe-methods).\n   */\n  readonly callerSession: FixtureHandler;\n  /** Like callerSession, with @Public(). */\n  readonly publicCallerSession: FixtureHandler;\n  /** GraphQL shapes only; other harnesses ignore it. */\n  readonly graph: GraphFixtures;\n}\n\nexport interface TransportInvocationResult {\n  ok: boolean;\n  body?: unknown;\n  error?: {\n    code?: string;\n    statusCode?: number;\n    reason?: string;\n    message?: string;\n  };\n  setCookies: string[];\n}\n\nexport interface GraphResult {\n  /** The operation's data, keyed like the selection: data[root][field]. */\n  data: unknown;\n  errors: readonly {\n    path: readonly (string | number)[];\n    code?: string;\n    reason?: string;\n    message?: string;\n  }[];\n}\n\nexport interface TransportConformanceOptions {\n  transport: ExtensionRef<AuthTransport>;\n  /**\n   * Boots an app exposing the kit's fixture handlers in the transport's shape, with BetterAuthModule's globalGuard as\n   * given. Pass `principals` to BetterAuthModule (the kit's API-key source), and `defaultRequirements` and\n   * `globalScope` when set. With `override`, boot through Test.createTestingModule() and pass the builder through it\n   * before compile(). Apply every fixture decorator the kit supplies, including its SetMetadata() marker. The app is\n   * closed by the kit.\n   */\n  createApp(\n    fixtures: TransportFixtures,\n    auth: AuthLike,\n    options: {\n      globalGuard: boolean;\n      override?: (builder: TestingModuleBuilder) => TestingModuleBuilder;\n      defaultRequirements?: readonly RequirementExpr[];\n      /**\n       * GraphQL shapes: the fieldResolverEnhancers to serve 'graph' with. The kit boots GraphQL cases with [] and\n       * ['guards', 'interceptors'], and the reader rows of T-internal-error-logged-once with ['guards', 'interceptors',\n       * 'filters'] and ['guards', 'filters'].\n       */\n      fieldResolverEnhancers?: readonly (\n        | \"guards\"\n        | \"interceptors\"\n        | \"filters\"\n      )[];\n      /** GraphQL shapes: serve 'graph' from a federation subgraph (FixtureNode an entity keyed by id, with GraphFixtures.reference when given). */\n      federation?: boolean;\n      /** Principal sources for BetterAuthModule's `principals`: the kit's API-key source. */\n      principals?: readonly ExtensionRef<PrincipalSource>[];\n      /** BetterAuthModule's globalScope; unset keeps the module default (T-coverage-claims). */\n      globalScope?: boolean;\n      /** Register BetterAuthGuard as APP_GUARD and BetterAuthScopeInterceptor as APP_INTERCEPTOR yourself (with globalGuard: false; T-coverage-claims). */\n      appEnhancers?: boolean;\n      /** The logger the app uses from boot on (e.g. createNestApplication(adapter, { logger }) or moduleRef.useLogger(logger)): cases assert boot warnings. */\n      logger?: LoggerService;\n      /** BetterAuthModule's cookies.forwardDirectCalls (T-stamp-per-plan). */\n      forwardDirectCalls?: boolean;\n      /**\n       * BetterAuthModule's logSummary. The kit passes true where it asserts the boot summary (T-coverage-claims); unset\n       * leaves the harness's choice, such as false to keep other boots quiet.\n       */\n      logSummary?: boolean;\n      /** GraphQL shapes: the fieldResolverCoverage of the transport this boot registers (T-stamp-per-plan). */\n      fieldResolverCoverage?: \"warn\";\n      /** GraphQL shapes: the GraphQL module's `context` option, one of `graphqlContexts` (T-stale-context, T-subscription-origin). */\n      graphqlContext?: GraphqlContextShape;\n    },\n  ): Promise<INestApplication>;\n  /** Invokes a fixture handler with given credentials and browser headers; returns the transport-native outcome. */\n  invoke(\n    app: INestApplication,\n    handler: Exclude<keyof TransportFixtures, \"graph\">,\n    headers: HeadersInit,\n    input?: Record<string, unknown>,\n  ): Promise<TransportInvocationResult>;\n  /**\n   * Two invocations of the 'org' fixture in ONE logical request or connection, with different inputs. Required when\n   * the transport has a lineage: the multiple-invocation cases then fail without it, and are skipped with a reason\n   * for other transports.\n   */\n  invokeTwice?(\n    app: INestApplication,\n    shape: InvocationShape,\n    inputs: [Record<string, unknown>, Record<string, unknown>],\n    headers: HeadersInit,\n  ): Promise<\n    [\n      { ok: boolean; error?: { reason?: string } },\n      { ok: boolean; error?: { reason?: string } },\n    ]\n  >;\n  /** Shapes invokeTwice can produce; required with it. */\n  invocationShapes?: readonly InvocationShape[];\n  /**\n   * GraphQL shapes: one operation over HTTP selecting the given root fields of fixtures.graph, each with the given\n   * FixtureNode fields. `delays` states the order in which the kit's session and API-key sources settle; the kit\n   * applies it to its own sources, so a harness may ignore it. Required when the transport nests handlers\n   * (defaultAccessFor): the GraphQL cases then fail without it, and are skipped with a reason for other transports.\n   */\n  invokeGraph?(\n    app: INestApplication,\n    selection: readonly GraphSelection[],\n    headers: HeadersInit,\n    options?: {\n      delays?: { readonly session: number; readonly apiKey: number };\n    },\n  ): Promise<GraphResult>;\n  /**\n   * Federation shapes only: one `_entities` query for the given representations of FixtureNode. Required when the\n   * transport claims the kit's reference resolver in a federation boot: T-reference-resolver then fails without it,\n   * and is skipped with a reason for other transports.\n   */\n  invokeEntities?(\n    app: INestApplication,\n    representations: readonly Record<string, unknown>[],\n    fields: readonly (keyof GraphFixtures[\"fields\"])[],\n    headers: HeadersInit,\n  ): Promise<GraphResult>;\n  /**\n   * Connection shapes (WebSocket gateways): opens ONE connection whose handshake carries `headers`, sends one message to\n   * each given fixture handler on it in order, each after the previous one answered, closes the connection and returns\n   * every outcome once the server has observed the close (T-stale-context runs a later caller after it). Required when\n   * the transport's browser leg is its connection's handshake: the T-ws-origin-* cases then fail without it, and are\n   * skipped with a reason for other transports.\n   */\n  invokeConnection?(\n    app: INestApplication,\n    handlers: readonly Exclude<keyof TransportFixtures, \"graph\">[],\n    headers: HeadersInit,\n    options?: {\n      /**\n       * Values the connection sends in its init payload (graphql-ws connection_init) instead of the handshake's credential\n       * headers; given only when `invocationShapes` includes 'subscriptions'.\n       */\n      readonly connectionParams?: Readonly<Record<string, string>>;\n    },\n  ): Promise<TransportInvocationResult[]>;\n  /**\n   * Invokes `fixtures.inherited` through the subclass that carries `subclasses[subclass]`. Without it T-inherited-handler\n   * is skipped with a reason: a transport that addresses handlers by a name that one inherited method shares across\n   * subclasses (an RPC pattern, a GraphQL root field) cannot expose it twice.\n   */\n  invokeInherited?(\n    app: INestApplication,\n    subclass: \"public\" | \"denied\",\n    headers: HeadersInit,\n  ): Promise<TransportInvocationResult>;\n  /**\n   * GraphQL shapes: the `graphqlContext` values createApp honours. T-stale-context needs 'static' and 'cached' and fails\n   * without them when the transport nests handlers; the custom-context rows of T-subscription-origin run for 'fresh' and\n   * 'plain-request' when listed.\n   */\n  graphqlContexts?: readonly GraphqlContextShape[];\n  /**\n   * Connection shapes: authenticates one connection whose handshake carries `headers` through the app's connection-time\n   * authentication (WS_CONNECTION_AUTH), requiring a principal: `ok` when one authenticates, otherwise the failure\n   * (401 without credentials). Required when the app provides WS_CONNECTION_AUTH: the T-ws-origin-* cases then fail\n   * without it.\n   */\n  authenticateConnection?(\n    app: INestApplication,\n    headers: HeadersInit,\n  ): Promise<ConnectionAuthenticationResult>;\n  expectCookieCapable: boolean;\n  /**\n   * Whether the transport describes a browser leg (false for RPC; T-selection fails a false claim). A leg that follows each\n   * operation enables the T-csrf-* cases; a leg that is the connection's handshake, shared by the connection's messages and\n   * enforced on every one, enables the T-ws-origin-* cases instead. The kit reads which from the transport.\n   */\n  expectBrowserLeg: boolean;\n}\n\n/**\n * The GraphQL module's `context` option of a boot: 'fresh' is a function returning a new object that keeps what the driver\n * passes it (the native request, the graphql-ws context); 'plain-request' a function returning a new object whose `req` is a\n * plain object holding only the native request's cookie header; 'cached' a function returning the object it built on its\n * first call; 'static' an object.\n */\nexport type GraphqlContextShape =\n  | \"fresh\"\n  | \"plain-request\"\n  | \"cached\"\n  | \"static\";\n\n/** The outcome of connection-time authentication (authenticateConnection). */\nexport interface ConnectionAuthenticationResult {\n  ok: boolean;\n  error?: TransportInvocationResult[\"error\"];\n}\n\nconst KEY_SOURCE_ID = \"@nestjs-kit/better-auth:conformance-api-key\";\n/** An origin only a function-valued trustedOrigins returns (T-ws-origin-*). */\nconst FUNCTION_TRUSTED_ORIGIN = \"https://function-trusted.example\";\nconst ALLOWED_ORGS = new Set([\"org-a\", \"org-a2\"]);\nconst SESSION_KIND = \"session\" as PrincipalKind;\nconst API_KEY_KIND = \"api-key\" as PrincipalKind;\n\ninterface KitKeys {\n  readonly valid: string;\n  readonly limited: string;\n  verifications: number;\n  /** The user the valid key acts for. */\n  owner: string;\n  /** Milliseconds the source waits before answering (T-stamp-per-plan settle order). */\n  delayMs: number;\n}\n\nfunction keySource(keys: KitKeys): PrincipalSource<AuthPrincipalBase> {\n  return {\n    id: KEY_SOURCE_ID,\n    kinds: [API_KEY_KIND],\n    acceptance: \"explicit\",\n    delegates: true,\n    credentialHeaders: [\"x-api-key\"],\n    appliesTo: (request) => request.headers.has(\"x-api-key\"),\n    async resolve(request) {\n      const value = request.headers.get(\"x-api-key\");\n      if (!value) {\n        return absent();\n      }\n      keys.verifications++;\n      if (keys.delayMs) {\n        await new Promise((resolve) => setTimeout(resolve, keys.delayMs));\n      }\n      if (value === keys.limited) {\n        return rejected(\n          AuthFailures.rejected({\n            status: 429,\n            reason: \"RATE_LIMITED\",\n            retryAfterSeconds: 7,\n          }),\n        );\n      }\n      if (value !== keys.valid) {\n        return rejected(\n          AuthFailures.rejected({ status: 401, reason: \"INVALID_API_KEY\" }),\n        );\n      }\n      return authenticated({\n        kind: API_KEY_KIND,\n        source: KEY_SOURCE_ID,\n        userId: keys.owner,\n        delegation: {\n          description: \"conformance key grant\",\n          allows: () => false,\n        },\n      });\n    },\n  };\n}\n\nconst denyPolicy: AuthorizationPolicy<Record<string, never>> = {\n  id: \"@nestjs-kit/better-auth:conformance/deny\",\n  evaluate: () => deny({ reason: \"CONFORMANCE_DENIED\" }),\n};\n/**\n * The 'org' fixture's requirement: the organization unit's permission check on the invocation's orgId input. The kit\n * seeds org-a and org-a2, which the kit identity owns, and org-b, where it is a member without that permission.\n */\nconst orgFixturePermission = orgPermission(\n  { organization: [\"update\"] },\n  { organization: fromParam(\"orgId\") },\n);\n// The kit's per-representation policy for federation reference resolvers: it decides from the representation's orgId\n// alone, so reference boots need no organization data per representation.\nconst orgPolicy: AuthorizationPolicy<Record<string, never>> = {\n  id: \"@nestjs-kit/better-auth:conformance/organization\",\n  requires: { principals: [SESSION_KIND] },\n  async evaluate(_params, context) {\n    const organization = context.param(\"orgId\");\n    if (typeof organization !== \"string\" || !organization) {\n      return deny({ reason: \"ORGANIZATION_REQUIRED\" });\n    }\n    if (!ALLOWED_ORGS.has(organization)) {\n      return deny({ reason: \"MISSING_PERMISSION\" });\n    }\n    context.provide(ACTIVE_ORGANIZATION_ID, organization);\n    return allow();\n  },\n};\nconst kindsPolicy = (\n  id: string,\n  principals: readonly PrincipalKind[] | undefined,\n): AuthorizationPolicy<Record<string, never>> => ({\n  id: `@nestjs-kit/better-auth:conformance/${id}`,\n  ...(principals ? { requires: { principals } } : {}),\n  evaluate: () => allow(),\n});\nconst sessionOnly = requirement(\n  kindsPolicy(\"session-only\", [SESSION_KIND]),\n  {},\n);\nconst apiKeyOnly = requirement(kindsPolicy(\"api-key-only\", [API_KEY_KIND]), {});\nconst sessionOrKey = requirement(\n  kindsPolicy(\"session-or-key\", [SESSION_KIND, API_KEY_KIND]),\n  {},\n);\nconst unnamedKinds = requirement(kindsPolicy(\"unnamed-kinds\", undefined), {});\n\nfunction view(principal: unknown): unknown {\n  const value = principal as AuthPrincipal | null | undefined;\n  return value ? { kind: value.kind, userId: value.userId } : null;\n}\n\nfunction handler(\n  decorators: readonly MethodDecorator[],\n  params: readonly ParameterDecorator[],\n  operation: \"read\" | \"unsafe\",\n  handle: FixtureHandler[\"handle\"],\n): FixtureHandler {\n  return { decorators, params, operation, handle };\n}\n\nasync function signIn(\n  service: BetterAuthService,\n  input: Record<string, unknown>,\n): Promise<void> {\n  await (\n    service.api as unknown as {\n      signInEmail(input: {\n        body: { email: string; password: string };\n      }): Promise<unknown>;\n    }\n  ).signInEmail({\n    body: { email: String(input.email), password: String(input.password) },\n  });\n}\n\nfunction principalHandler(\n  decorators: readonly MethodDecorator[] = [],\n  operation: \"read\" | \"unsafe\" = \"read\",\n): FixtureHandler {\n  return handler(\n    decorators,\n    [CurrentPrincipal()],\n    operation,\n    ([principal]) => ({\n      principal: view(principal),\n    }),\n  );\n}\n\n/** Marks each fixture handler with its fixture name, so the kit can map claims and boot reports to fixtures. */\nconst FIXTURE_METADATA = \"@nestjs-kit/better-auth:conformance-fixture\";\n\ntype FixtureName = Exclude<keyof TransportFixtures, \"graph\">;\n\ninterface GraphBoot {\n  /** Include `guarded` and `nestedReader` (the ['guards', 'interceptors'] boots only). */\n  readonly guarded?: boolean;\n  /** Include the federation `reference` fixture; 'bare' leaves out its method-level requirement. */\n  readonly reference?: boolean | \"bare\";\n  /** Include the `forwarding` field, signing in with these credentials. */\n  readonly forwarding?: { readonly email: string; readonly password: string };\n  /** Class decorators of the graph resolver class. */\n  readonly classDecorators?: readonly ClassDecorator[];\n  /** Include the `items` root and the `organizationReader` and `serviceSession` fields (T-internal-error-logged-once). */\n  readonly readerErrors?: boolean;\n}\n\n/** How many FixtureNode items the `items` root returns. */\nconst ITEM_COUNT = 20;\n\n/** The fixture marker of a graph handler, for claims and plans of GraphQL boots. */\nconst graphMarker = (name: string) => `graph.${name}`;\n\n/**\n * The kit's fixture handlers; `extra` appends decorators to named handlers and `everyHandler` to all of them for boot\n * variants. `graph` selects the GraphQL fixtures a boot may serve: `guarded` fails a [] boot (FIELD_RESOLVER_UNGUARDED)\n * and `reference` belongs to federation boots, so both are left out unless asked for.\n */\nfunction kitFixtures(\n  extra: Partial<Record<FixtureName, MethodDecorator[]>> = {},\n  everyHandler: MethodDecorator[] = [],\n  graph: GraphBoot = {},\n): TransportFixtures {\n  const withExtra = <F extends FixtureHandler>(\n    name: FixtureName,\n    fixture: F,\n    marker: string = name,\n  ): F => ({\n    ...fixture,\n    decorators: [\n      SetMetadata(FIXTURE_METADATA, marker),\n      ...fixture.decorators,\n      ...(extra[name] ?? []),\n      ...everyHandler,\n    ],\n  });\n  const plain = () => handler([], [], \"read\", () => ({ ok: true }));\n  const marked = (name: string, fixture: FixtureHandler): FixtureHandler => ({\n    ...fixture,\n    decorators: [\n      SetMetadata(FIXTURE_METADATA, graphMarker(name)),\n      ...fixture.decorators,\n    ],\n  });\n  const reader = () =>\n    handler([], [CurrentPrincipal()], \"read\", ([principal]) => ({\n      principal: view(principal),\n    }));\n  // A direct call presenting the caller's own session cookie, which the invocation passes as its `cookie` input.\n  const callerSession = (decorators: MethodDecorator[]) =>\n    handler(decorators, [], \"read\", async (_params, input, { service }) => {\n      const session = (await (\n        service.api as unknown as {\n          getSession(input: { headers: Headers }): Promise<unknown>;\n        }\n      ).getSession({\n        headers: new Headers({ cookie: String(input.cookie ?? \"\") }),\n      })) as { user?: { id?: string } } | null;\n      return { userId: session?.user?.id ?? null };\n    });\n  const forwarding = graph.forwarding;\n  const loginProxy = (operation: \"read\" | \"unsafe\") =>\n    handler(\n      [Public(), ForwardAuthCookies()],\n      [],\n      operation,\n      async (_params, input, { service }) => {\n        await signIn(service, input);\n        return { signedIn: true };\n      },\n    );\n  return {\n    required: withExtra(\"required\", principalHandler()),\n    optional: withExtra(\"optional\", principalHandler([OptionalAuth()])),\n    public: withExtra(\n      \"public\",\n      handler([Public()], [], \"read\", () => ({ public: true })),\n    ),\n    forbidden: withExtra(\n      \"forbidden\",\n      handler([Require(requirement(denyPolicy, {}))], [], \"read\", () => ({\n        reached: true,\n      })),\n    ),\n    triple: [\n      withExtra(\"triple\", plain(), \"triple0\"),\n      withExtra(\"triple\", plain(), \"triple1\"),\n      withExtra(\"triple\", plain(), \"triple2\"),\n    ],\n    tripleMixed: [\n      withExtra(\"tripleMixed\", plain(), \"tripleMixed0\"),\n      withExtra(\n        \"tripleMixed\",\n        handler(\n          [AcceptPrincipals(SESSION_KIND, API_KEY_KIND)],\n          [],\n          \"read\",\n          () => ({\n            ok: true,\n          }),\n        ),\n        \"tripleMixed1\",\n      ),\n      withExtra(\"tripleMixed\", plain(), \"tripleMixed2\"),\n    ],\n    readsSession: withExtra(\n      \"readsSession\",\n      handler(\n        [],\n        [CurrentSession()],\n        \"read\",\n        async ([session], _input, { service }) => ({\n          userId:\n            (session as { user?: { id?: string } } | null)?.user?.id ?? null,\n          service: (await service.getPrincipal())?.userId ?? null,\n        }),\n      ),\n    ),\n    readsSessionService: withExtra(\n      \"readsSessionService\",\n      handler(\n        [AcceptPrincipals(SESSION_KIND, API_KEY_KIND)],\n        [],\n        \"read\",\n        async (_params, _input, { service }) => ({\n          userId:\n            (\n              (await service.getSession()) as {\n                user?: { id?: string };\n              } | null\n            )?.user?.id ?? null,\n        }),\n      ),\n    ),\n    unsafe: withExtra(\"unsafe\", principalHandler([], \"unsafe\")),\n    loginProxy: withExtra(\"loginProxy\", loginProxy(\"unsafe\")),\n    loginProxyRead: withExtra(\"loginProxyRead\", loginProxy(\"read\")),\n    loginProxyService: withExtra(\n      \"loginProxyService\",\n      handler([Public()], [], \"unsafe\", async (_params, input, { service }) => {\n        await service.forwardForeignCookies(() => signIn(service, input));\n        return { signedIn: true };\n      }),\n    ),\n    publicService: withExtra(\n      \"publicService\",\n      handler(\n        [Public()],\n        [],\n        \"unsafe\",\n        async (_params, _input, { service }) => ({\n          session: await service.getSession(),\n        }),\n      ),\n    ),\n    acceptsApiKey: withExtra(\n      \"acceptsApiKey\",\n      principalHandler([AcceptPrincipals(SESSION_KIND, API_KEY_KIND)]),\n    ),\n    org: withExtra(\n      \"org\",\n      handler(\n        [Require(orgFixturePermission)],\n        [ActiveOrganizationId()],\n        \"read\",\n        ([organization], input) => {\n          if (organization !== input.orgId) {\n            throw new Error(\n              `ActiveOrganizationId answered ${String(organization)} for ${String(input.orgId)}`,\n            );\n          }\n          return { organization };\n        },\n      ),\n    ),\n    inherited: withExtra(\"inherited\", {\n      ...plain(),\n      subclasses: {\n        public: [Public()],\n        denied: [Require(requirement(denyPolicy, {}))],\n      },\n    }),\n    callerSession: withExtra(\"callerSession\", callerSession([])),\n    publicCallerSession: withExtra(\n      \"publicCallerSession\",\n      callerSession([Public()]),\n    ),\n    unguarded: withExtra(\n      \"unguarded\",\n      handler([], [CurrentSession(), ActiveOrganizationId()], \"read\", () => ({\n        reached: true,\n      })),\n    ),\n    graph: {\n      roots: {\n        public: marked(\n          \"public\",\n          handler([Public()], [], \"read\", () => ({ id: \"public\" })),\n        ),\n        sessionOnly: marked(\n          \"sessionOnly\",\n          handler([], [CurrentPrincipal()], \"read\", ([p]) => ({\n            id: \"session\",\n            principal: view(p),\n          })),\n        ),\n        mixed: marked(\n          \"mixed\",\n          handler(\n            [AcceptPrincipals(SESSION_KIND, API_KEY_KIND)],\n            [CurrentPrincipal()],\n            \"read\",\n            ([p]) => ({ id: \"mixed\", principal: view(p) }),\n          ),\n        ),\n        ...(graph.readerErrors\n          ? {\n              items: marked(\n                \"items\",\n                handler(\n                  [AcceptPrincipals(SESSION_KIND, API_KEY_KIND)],\n                  [],\n                  \"read\",\n                  () =>\n                    Array.from({ length: ITEM_COUNT }, (_, index) => ({\n                      id: `item-${index}`,\n                    })),\n                ),\n              ),\n            }\n          : {}),\n      },\n      fields: {\n        plain: marked(\n          \"plain\",\n          handler([], [], \"read\", () => \"plain\"),\n        ),\n        publicNested: marked(\n          \"publicNested\",\n          handler([Public()], [], \"read\", () => ({ id: \"nested\" })),\n        ),\n        reader: marked(\"reader\", reader()),\n        ...(graph.guarded\n          ? {\n              guarded: marked(\n                \"guarded\",\n                handler(\n                  [RequireAuth()],\n                  [CurrentPrincipal()],\n                  \"read\",\n                  ([p]) => ({ id: \"guarded\", principal: view(p) }),\n                ),\n              ),\n              nestedReader: marked(\"nestedReader\", reader()),\n            }\n          : {}),\n        sessionReader: marked(\n          \"sessionReader\",\n          handler(\n            [],\n            [CurrentSession()],\n            \"read\",\n            ([session]) =>\n              (session as { user?: { id?: string } } | null)?.user?.id ?? null,\n          ),\n        ),\n        ...(graph.readerErrors\n          ? {\n              organizationReader: marked(\n                \"organizationReader\",\n                handler(\n                  [],\n                  [ActiveOrganizationId()],\n                  \"read\",\n                  ([organization]) =>\n                    typeof organization === \"string\" ? organization : null,\n                ),\n              ),\n              serviceSession: marked(\n                \"serviceSession\",\n                handler(\n                  [],\n                  [],\n                  \"read\",\n                  async (_params, _input, { service }) =>\n                    (\n                      (await service.getSession()) as {\n                        user?: { id?: string };\n                      } | null\n                    )?.user?.id ?? null,\n                ),\n              ),\n            }\n          : {}),\n        ...(forwarding\n          ? {\n              forwarding: marked(\n                \"forwarding\",\n                handler(\n                  [ForwardAuthCookies()],\n                  [],\n                  \"read\",\n                  async (_params, _input, { service }) => {\n                    await signIn(service, forwarding);\n                    return \"forwarded\";\n                  },\n                ),\n              ),\n            }\n          : {}),\n      },\n      ...(graph.reference\n        ? {\n            reference: handler(\n              [\n                SetMetadata(FIXTURE_METADATA, \"reference\"),\n                ...(graph.reference === \"bare\"\n                  ? []\n                  : [Require(requirement(orgPolicy, {}))]),\n              ],\n              [],\n              \"read\",\n              (_params, input) => ({ id: input.id, orgId: input.orgId }),\n            ),\n          }\n        : {}),\n      ...(graph.classDecorators\n        ? { classDecorators: graph.classDecorators }\n        : {}),\n    },\n  };\n}\n\n/** How a described call exposes its browser leg: none, one per operation, or its connection's handshake. */\ntype LegShape = \"none\" | \"operation\" | \"connection\";\n\ninterface Instrumentation {\n  readonly consumed: string[];\n  readonly contexts: ExecutionContext[];\n  /** The leg shape of each call described while `recordLegs` is set. */\n  readonly legs: LegShape[];\n  unavailable: boolean;\n  /**\n   * Read each described call's browser leg while its invocation runs. A transport may fail closed once the logical\n   * request has completed (GraphQL rejects a completed request), so the kit never reads a leg afterwards.\n   */\n  recordLegs: boolean;\n}\n\n/** Wraps the registry's describe() so request-dependent getters are counted and can be made unavailable. */\nfunction instrument(app: INestApplication): Instrumentation {\n  const registry = app.get<TransportRegistry>(TRANSPORT_REGISTRY, {\n    strict: false,\n  });\n  const state: Instrumentation = {\n    consumed: [],\n    contexts: [],\n    legs: [],\n    unavailable: false,\n    recordLegs: false,\n  };\n  const original = registry.describe.bind(registry);\n  registry.describe = (context, transport) => {\n    const call = original(context, transport);\n    state.contexts.push(context);\n    if (state.recordLegs) {\n      const browser = call.browser;\n      state.legs.push(\n        browser === undefined\n          ? \"none\"\n          : browser.key === call.key\n            ? \"operation\"\n            : \"connection\",\n      );\n    }\n    const read = <T>(name: string, get: () => T): T => {\n      state.consumed.push(name);\n      if (state.unavailable) {\n        throw BetterAuthConfigurationError.atRequest(\n          \"CONFORMANCE_EXTRACTION_UNAVAILABLE\",\n          \"The conformance kit made request extraction unavailable\",\n        );\n      }\n      return get();\n    };\n    const wrapped: TransportCall = {\n      key: call.key,\n      invocation: call.invocation,\n      connection: call.connection,\n      principalTtlMs: call.principalTtlMs,\n      lineage: call.lineage,\n      param: (name) => call.param(name),\n      headers: () => read(\"headers\", () => call.headers()),\n      get clientIp() {\n        return read(\"clientIp\", () => call.clientIp);\n      },\n      get cookies() {\n        return read(\"cookies\", () => call.cookies);\n      },\n      get request() {\n        return read(\"request\", () => call.request);\n      },\n      get browser() {\n        return read(\"browser\", () => call.browser);\n      },\n    };\n    return wrapped;\n  };\n  return state;\n}\n\nfunction resolvedTransport(\n  app: INestApplication,\n  ref: ExtensionRef<AuthTransport>,\n): AuthTransport {\n  const list = app\n    .get<TransportRegistry>(TRANSPORT_REGISTRY, { strict: false })\n    .list();\n  const id =\n    ref && typeof ref === \"object\" && !(EXTENSION_DEFINITION in ref)\n      ? (ref as AuthTransport).id\n      : undefined;\n  // Harnesses register the transport first; core appends the HTTP transport.\n  const found =\n    list.find((transport) => transport === ref) ??\n    (typeof ref === \"function\"\n      ? list.find((transport) => transport instanceof ref)\n      : undefined) ??\n    (id === undefined\n      ? undefined\n      : list.find((transport) => transport.id === id)) ??\n    list[0];\n  assert.ok(found, \"no transport is registered\");\n  return found;\n}\n\n/**\n * Whether a transport member is known without booting: a transport object answers for itself, a class only when its\n * prototype defines the member (instance fields are unknown), and a definition never. Undefined means unknown.\n */\nfunction staticMember(\n  ref: ExtensionRef<AuthTransport>,\n  name: keyof AuthTransport,\n): boolean | undefined {\n  if (typeof ref === \"function\") {\n    return typeof Reflect.get(ref.prototype as object, name) === \"function\"\n      ? true\n      : undefined;\n  }\n  if (ref && typeof ref === \"object\" && !(EXTENSION_DEFINITION in ref)) {\n    return typeof Reflect.get(ref, name) === \"function\";\n  }\n  return undefined;\n}\n\ninterface KitEnv {\n  readonly auth: AuthLike;\n  readonly probe: ProbeState;\n  readonly keys: KitKeys;\n  readonly identity: KitIdentity;\n  readonly source: PrincipalSource<AuthPrincipalBase>;\n  /**\n   * The transport's browser leg is its connection's handshake: a browser always sends Origin there, so the kit's cookie\n   * credential carries the trusted base URL as Origin, as a page of that origin does.\n   */\n  readonly connectionLeg: boolean;\n  sessionCookieName(): Promise<string>;\n}\n\n/** The organizations the 'org' fixture names: the identity owns org-a and org-a2 and is a plain member of org-b. */\nasync function seedOrganizations(\n  auth: AuthLike,\n  userId: string,\n): Promise<void> {\n  const context = (await auth.$context) as {\n    adapter: {\n      create(input: {\n        model: string;\n        data: Record<string, unknown>;\n        forceAllowId?: boolean;\n      }): Promise<unknown>;\n    };\n  };\n  for (const [id, role] of [\n    [\"org-a\", \"owner\"],\n    [\"org-a2\", \"owner\"],\n    [\"org-b\", \"member\"],\n  ] as const) {\n    await context.adapter.create({\n      model: \"organization\",\n      data: {\n        id,\n        name: id,\n        slug: `${id}-${globalThis.crypto.randomUUID()}`,\n        createdAt: new Date(),\n      },\n      forceAllowId: true,\n    });\n    await context.adapter.create({\n      model: \"member\",\n      data: { organizationId: id, userId, role, createdAt: new Date() },\n    });\n  }\n}\n\nasync function environment(\n  authOptions: Omit<BetterAuthOptions, \"database\"> = {},\n  connectionLeg = false,\n  settings: ConformanceAuthSettings = {},\n): Promise<KitEnv> {\n  const plugins = authOptions.plugins ?? [];\n  const auth = createConformanceAuth(\n    {\n      ...authOptions,\n      plugins: plugins.some((plugin) => plugin.id === \"organization\")\n        ? plugins\n        : [...plugins, organization()],\n    },\n    // Only the T-csrf-http-unsafe rows pass origin-check settings.\n    settings,\n  );\n  const probe = await probeOf(auth);\n  const identity = await kitIdentity(auth);\n  await seedOrganizations(auth, identity.userId);\n  const keys: KitKeys = {\n    valid: `key-${globalThis.crypto.randomUUID()}`,\n    limited: `limited-${globalThis.crypto.randomUUID()}`,\n    verifications: 0,\n    owner: identity.userId,\n    delayMs: 0,\n  };\n  return {\n    auth,\n    probe,\n    keys,\n    identity,\n    source: keySource(keys),\n    connectionLeg,\n    async sessionCookieName() {\n      const context = (await auth.$context) as {\n        authCookies: { sessionToken: { name: string } };\n      };\n      return context.authCookies.sessionToken.name;\n    },\n  };\n}\n\n/** An organization the kit identity of `env` owns (instances with the organization plugin); returns its id. */\nasync function createKitOrganization(env: KitEnv): Promise<string> {\n  const created = (await (\n    env.auth.api as unknown as {\n      createOrganization(input: {\n        headers: Headers;\n        body: { name: string; slug: string };\n      }): Promise<{ id: string }>;\n    }\n  ).createOrganization({\n    headers: new Headers({ cookie: env.identity.cookie }),\n    body: {\n      name: \"Conformance\",\n      slug: `conformance-${globalThis.crypto.randomUUID()}`,\n    },\n  })) as { id: string };\n  return created.id;\n}\n\ninterface Booted {\n  readonly app: INestApplication;\n  /** Everything the app logged, from boot on when the harness applies the `logger` option. */\n  readonly logger: CapturingLogger;\n  readonly instrumentation: Instrumentation;\n}\n\ntype GraphEnhancers = readonly (\"guards\" | \"interceptors\" | \"filters\")[];\n\ninterface BootOptions {\n  fixtures?: TransportFixtures;\n  forwardDirectCalls?: boolean;\n  fieldResolverCoverage?: \"warn\";\n  graphqlContext?: GraphqlContextShape;\n  globalGuard?: boolean;\n  override?: (builder: TestingModuleBuilder) => TestingModuleBuilder;\n  defaultRequirements?: readonly RequirementExpr[];\n  fieldResolverEnhancers?: GraphEnhancers;\n  federation?: boolean;\n  globalScope?: boolean;\n  appEnhancers?: boolean;\n  logSummary?: boolean;\n}\n\nasync function withApp(\n  options: TransportConformanceOptions,\n  env: KitEnv,\n  fn: (booted: Booted) => Promise<void>,\n  boot: BootOptions = {},\n  logger = new CapturingLogger(),\n): Promise<void> {\n  const app = await options.createApp(\n    boot.fixtures ?? kitFixtures(),\n    env.auth,\n    {\n      globalGuard: boot.globalGuard ?? true,\n      principals: [env.source as unknown as PrincipalSource],\n      logger,\n      ...(boot.override ? { override: boot.override } : {}),\n      ...(boot.defaultRequirements\n        ? { defaultRequirements: boot.defaultRequirements }\n        : {}),\n      ...(boot.fieldResolverEnhancers\n        ? { fieldResolverEnhancers: boot.fieldResolverEnhancers }\n        : {}),\n      ...(boot.federation ? { federation: true } : {}),\n      ...(boot.globalScope === undefined\n        ? {}\n        : { globalScope: boot.globalScope }),\n      ...(boot.appEnhancers ? { appEnhancers: true } : {}),\n      ...(boot.forwardDirectCalls ? { forwardDirectCalls: true } : {}),\n      ...(boot.fieldResolverCoverage\n        ? { fieldResolverCoverage: boot.fieldResolverCoverage }\n        : {}),\n      ...(boot.graphqlContext ? { graphqlContext: boot.graphqlContext } : {}),\n      ...(boot.logSummary ? { logSummary: true } : {}),\n    },\n  );\n  app.useLogger(logger);\n  try {\n    await fn({ app, logger, instrumentation: instrument(app) });\n  } finally {\n    await app.close();\n  }\n}\n\nasync function bootFailure(\n  options: TransportConformanceOptions,\n  env: KitEnv,\n  boot: BootOptions,\n): Promise<unknown> {\n  const result = await settle(() =>\n    withApp(options, env, async () => undefined, boot),\n  );\n  assert.equal(result.ok, false, \"the boot variant booted\");\n  return !result.ok && result.error;\n}\n\nasync function expectBootFailure(\n  options: TransportConformanceOptions,\n  env: KitEnv,\n  boot: BootOptions,\n  code: string | readonly string[],\n): Promise<void> {\n  const expected = typeof code === \"string\" ? [code] : code;\n  const error = await bootFailure(options, env, boot);\n  const codes = bootIssueCodes(error);\n  assert.ok(\n    expected.some(\n      (value) => codes.includes(value) || String(error).includes(value),\n    ),\n    `expected ${expected.join(\" or \")}, got ${codes.join(\", \")}: ${String(error)}`,\n  );\n}\n\n/** The default instance's boot summary line (BetterAuthModule's logSummary). */\nfunction summaryLine(logger: CapturingLogger): string {\n  const line = logger.entries.find(\n    (entry) =>\n      entry.level === \"log\" &&\n      entry.text.startsWith(\"'default': \") &&\n      entry.text.includes(\"; scope: \"),\n  )?.text;\n  assert.ok(\n    line,\n    `boot logged no summary (pass the logSummary and logger options to the app): ${logger.text().slice(0, 500)}`,\n  );\n  return line;\n}\n\n/** Stable codes of the WARN entries a logger captured (`CODE: message`). */\nfunction warningCodes(logger: CapturingLogger): Set<string> {\n  return new Set(\n    logger.entries\n      .filter((entry) => entry.level === \"warn\")\n      .map((entry) => /^([A-Z][A-Z0-9_]+):/.exec(entry.text)?.[1])\n      .filter((code): code is string => code !== undefined),\n  );\n}\n\ninterface RecordedClaim {\n  // biome-ignore lint/complexity/noBannedTypes: Nest metadata accepts class and function targets.\n  readonly target: Function;\n  readonly method: string | undefined;\n  readonly reach: GuardReach;\n  readonly options: ClaimOptions;\n  /** The kit fixture the claimed handler serves, from its SetMetadata() marker. */\n  readonly fixture: string | undefined;\n}\n\n/** Suffix the kit gives every Nest metadata key written while it runs validate() with renamed metadata (T-metadata-canary). */\nconst RENAMED_METADATA = \":nestjs-kit-better-auth-conformance-renamed\";\n\ninterface ClaimRecording {\n  /** Classes the validation context's discovery lists besides the app's controllers and providers. */\n  // biome-ignore lint/complexity/noBannedTypes: Nest metadata accepts class and function targets.\n  readonly classes?: readonly Function[];\n  /**\n   * Write every string metadata key under another name while validate() runs, as if the installed Nest wrote its\n   * decorators' metadata under keys the transport does not read.\n   */\n  readonly renameMetadata?: boolean;\n}\n\n/** The claims the transport makes for a booted app, recorded by running its validate() once more. */\nasync function recordClaims(\n  app: INestApplication,\n  ref: ExtensionRef<AuthTransport>,\n  recording: ClaimRecording = {},\n): Promise<RecordedClaim[]> {\n  const transport = resolvedTransport(app, ref);\n  const claims: RecordedClaim[] = [];\n  const planner = app.get<RoutePlanner>(ROUTE_PLANNER, { strict: false });\n  const discovery = app.get(DiscoveryService, { strict: false });\n  const extra = (recording.classes ?? []).map(\n    (metatype) =>\n      ({\n        metatype,\n        isAlias: false,\n        name: metatype.name,\n      }) as unknown as ReturnType<DiscoveryService[\"getProviders\"]>[number],\n  );\n  const define = Reflect.defineMetadata;\n  if (recording.renameMetadata) {\n    Reflect.defineMetadata = (\n      key: unknown,\n      value: unknown,\n      target: object,\n      property?: string | symbol,\n    ) =>\n      define(\n        typeof key === \"string\" && !key.startsWith(\"design:\")\n          ? `${key}${RENAMED_METADATA}`\n          : key,\n        value,\n        target,\n        property as string | symbol,\n      );\n  }\n  try {\n    await transport.validate?.({\n      discovery: {\n        getControllers: () => [...discovery.getControllers(), ...extra],\n        getProviders: () => [...discovery.getProviders(), ...extra],\n      } as unknown as DiscoveryService,\n      reflector: app.get(Reflector, { strict: false }),\n      moduleRef: app.get(ModuleRef, { strict: false }),\n      hasHttpAdapter:\n        app.get<MountCoordinator>(MOUNT_COORDINATOR, { strict: false })\n          .adapter !== null,\n      planOf: (target, method) => planner.plan(target as Type, method),\n      claim: (target, method, reach, options) => {\n        const handler: unknown =\n          method === undefined\n            ? undefined\n            : Reflect.get(target.prototype as object, method);\n        const fixture =\n          typeof handler === \"function\"\n            ? (Reflect.getMetadata(FIXTURE_METADATA, handler) as\n                | string\n                | undefined)\n            : undefined;\n        claims.push({ target, method, reach, options, fixture });\n      },\n      logger: new CapturingLogger(),\n    });\n  } finally {\n    Reflect.defineMetadata = define;\n  }\n  return claims;\n}\n\n/** A class with the own class-level metadata of `target` and no methods: a push-only gateway, a controller without routes. */\n// biome-ignore lint/complexity/noBannedTypes: Nest metadata accepts class and function targets.\nfunction withoutHandlers(target: Function): Function {\n  const clone = { [`${target.name}WithoutHandlers`]: class {} }[\n    `${target.name}WithoutHandlers`\n  ]!;\n  for (const key of Reflect.getOwnMetadataKeys(target)) {\n    Reflect.defineMetadata(key, Reflect.getOwnMetadata(key, target), clone);\n  }\n  return clone;\n}\n\n/** The booted instance and method name that serve a kit fixture, found by its SetMetadata() marker. */\nfunction fixtureInstance(\n  app: INestApplication,\n  fixture: string,\n): { instance: object; method: string } {\n  const discovery = app.get(DiscoveryService, { strict: false });\n  const scanner = new MetadataScanner();\n  for (const wrapper of [\n    ...discovery.getControllers(),\n    ...discovery.getProviders(),\n  ]) {\n    const instance: unknown = wrapper.instance;\n    if (!instance || typeof instance !== \"object\") {\n      continue;\n    }\n    for (const method of scanner.getAllMethodNames(\n      Object.getPrototypeOf(instance) as object,\n    )) {\n      const handler: unknown = Reflect.get(instance, method);\n      if (\n        typeof handler === \"function\" &&\n        Reflect.getMetadata(FIXTURE_METADATA, handler) === fixture\n      ) {\n        return { instance, method };\n      }\n    }\n  }\n  assert.fail(`no booted controller or provider serves the ${fixture} fixture`);\n}\n\n/**\n * Whether the transport has a member, resolved through one boot when a class or definition leaves it unknown. The\n * kit's multiple-invocation and GraphQL cases apply to transports with `lineage` and `defaultAccessFor`.\n */\nasync function transportHas(\n  options: TransportConformanceOptions,\n  env: KitEnv,\n  member: \"lineage\" | \"defaultAccessFor\",\n): Promise<boolean> {\n  const known = staticMember(options.transport, member);\n  if (known !== undefined) {\n    return known;\n  }\n  let found = false;\n  await withApp(options, env, async ({ app }) => {\n    found =\n      typeof resolvedTransport(app, options.transport)[member] === \"function\";\n  });\n  return found;\n}\n\n/**\n * Whether the transport's browser leg is its connection's handshake: the leg of an anonymous `optional` (read) invocation\n * outlives the invocation's logical request, as a WebSocket's handshake does. A cross-site page reads every reply on such\n * a connection, so the T-ws-origin-* cases expect every message enforced. Other legs follow each operation (HTTP\n * requests, GraphQL over HTTP).\n */\nasync function connectionShaped(\n  options: TransportConformanceOptions,\n): Promise<boolean> {\n  let shaped = false;\n  await withApp(\n    options,\n    await environment(),\n    async ({ app, instrumentation }) => {\n      instrumentation.recordLegs = true;\n      succeeded(\n        await options.invoke(app, \"optional\", {}),\n        \"an anonymous optional invocation\",\n      );\n      const [leg] = instrumentation.legs;\n      assert.ok(leg, \"the guard described no invocation\");\n      shaped = leg === \"connection\";\n    },\n  );\n  return shaped;\n}\n\nfunction sessionReads(probe: ProbeState, from: number): number {\n  return probe.calls.slice(from).filter((path) => path === \"/get-session\")\n    .length;\n}\n\nfunction denied(\n  result: Pick<TransportInvocationResult, \"ok\" | \"body\" | \"error\">,\n  status: number,\n  reason?: string,\n  label = \"\",\n): void {\n  const prefix = label ? `${label}: ` : \"\";\n  assert.equal(\n    result.ok,\n    false,\n    `${prefix}expected a ${status} denial, got success: ${JSON.stringify(result.body)}`,\n  );\n  assert.equal(\n    result.error?.statusCode,\n    status,\n    `${prefix}expected ${status}, got ${JSON.stringify(result.error)}`,\n  );\n  if (reason !== undefined) {\n    assert.equal(\n      result.error?.reason,\n      reason,\n      `${prefix}${JSON.stringify(result.error)}`,\n    );\n  }\n}\n\nfunction internal(\n  result: Pick<TransportInvocationResult, \"ok\" | \"error\">,\n  label = \"\",\n): void {\n  const prefix = label ? `${label}: ` : \"\";\n  assert.equal(result.ok, false, `${prefix}expected a generic internal error`);\n  const status = result.error?.statusCode;\n  assert.ok(\n    status === undefined || status >= 500,\n    `${prefix}expected a 5xx, got ${JSON.stringify(result.error)}`,\n  );\n}\n\nfunction succeeded(result: TransportInvocationResult, label = \"\"): void {\n  assert.equal(\n    result.ok,\n    true,\n    `${label ? `${label}: ` : \"\"}expected success, got ${JSON.stringify(result.error)}`,\n  );\n}\n\nfunction principalOf(result: TransportInvocationResult) {\n  return (result.body as { principal?: { kind?: string; userId?: string } })\n    ?.principal;\n}\n\n/** A context type no built-in transport handles (T-public-unclaimed-context). */\nconst UNCLAIMED_CONTEXT = \"@nestjs-kit/better-auth:conformance-unclaimed\";\n\nconst foreignContext = {\n  getType: () => \"@nestjs-kit/better-auth:conformance-foreign\",\n  getArgs: () => [{}],\n  getArgByIndex: () => ({}),\n  getClass: () => Object,\n  getHandler: () => function foreign() {},\n  switchToHttp: () => ({\n    getRequest: () => ({}),\n    getResponse: () => ({}),\n    getNext: () => undefined,\n  }),\n  switchToRpc: () => ({ getData: () => ({}), getContext: () => ({}) }),\n  switchToWs: () => ({\n    getData: () => ({}),\n    getClient: () => ({}),\n    getPattern: () => \"\",\n  }),\n} as unknown as ExecutionContext;\n\n/**\n * The transport kit (invariants T1–T11 and the core behavior every transport exposes). The kit owns the Better Auth\n * instance, a kit API-key source (passed as `principals`), kit policies and the fixture handlers; the harness exposes\n * the fixtures in its transport's shape. Applicability comes from the transport, not from the helpers a harness\n * passes: a transport with a lineage needs invokeTwice, one that nests handlers (defaultAccessFor) needs invokeGraph,\n * and one that claims the kit's federation reference resolver needs invokeEntities. The kit reads those members from\n * a transport object directly and boots once for a class or a definition.\n */\nexport function transportConformance(\n  options: TransportConformanceOptions,\n): ConformanceCase[] {\n  const cases: ConformanceCase[] = [];\n  let legShape: Promise<boolean> | undefined;\n  /** Whether the browser leg is the connection's handshake, read once per kit from the transport. */\n  const connectionLeg = async (): Promise<boolean> => {\n    if (!options.expectBrowserLeg) {\n      return false;\n    }\n    legShape ??= connectionShaped(options);\n    return legShape;\n  };\n  const kitEnvironment = async (\n    authOptions?: Omit<BetterAuthOptions, \"database\">,\n    settings?: ConformanceAuthSettings,\n  ): Promise<KitEnv> =>\n    environment(authOptions, await connectionLeg(), settings);\n  const addRun = (\n    id: string,\n    title: string,\n    run: () => Promise<ConformanceOutcome>,\n    skip?: string,\n  ) => cases.push(conformanceCase(id, title, run, skip));\n  const add = (\n    id: string,\n    title: string,\n    run: (env: KitEnv) => Promise<ConformanceOutcome>,\n    skip?: string,\n  ) => addRun(id, title, async () => run(await kitEnvironment()), skip);\n  const noBrowser = options.expectBrowserLeg\n    ? undefined\n    : \"the transport declares no browser leg\";\n  /** Undefined when the browser leg follows each operation; a skip when it is the connection's handshake. */\n  const operationLeg = async (): Promise<ConformanceSkip | undefined> =>\n    (await connectionLeg())\n      ? conformanceSkip(\n          \"the browser leg is the connection's handshake, enforced on every message (T-ws-origin-* cover it)\",\n        )\n      : undefined;\n  const noLineage = \"the transport has no lineage and gives no invokeTwice\";\n  const noNesting = \"the transport nests no handlers and gives no invokeGraph\";\n  const twiceSkip =\n    !options.invokeTwice && staticMember(options.transport, \"lineage\") === false\n      ? noLineage\n      : undefined;\n  const graphSkip =\n    !options.invokeGraph &&\n    staticMember(options.transport, \"defaultAccessFor\") === false\n      ? noNesting\n      : undefined;\n  /** Undefined when invokeTwice is given; fails when the transport has a lineage without it. */\n  const twiceReady = async (\n    env: KitEnv,\n  ): Promise<ConformanceSkip | undefined> => {\n    if (options.invokeTwice) {\n      assert.ok(\n        options.invocationShapes?.length,\n        \"invokeTwice requires invocationShapes\",\n      );\n      return undefined;\n    }\n    assert.equal(\n      await transportHas(options, env, \"lineage\"),\n      false,\n      \"the transport has a lineage, so invokeTwice and invocationShapes are required\",\n    );\n    return conformanceSkip(noLineage);\n  };\n  /** Undefined when invokeGraph is given; fails when the transport nests handlers without it. */\n  const graphReady = async (\n    env: KitEnv,\n  ): Promise<ConformanceSkip | undefined> => {\n    if (options.invokeGraph) {\n      return undefined;\n    }\n    assert.equal(\n      await transportHas(options, env, \"defaultAccessFor\"),\n      false,\n      \"the transport nests handlers (defaultAccessFor), so invokeGraph is required\",\n    );\n    return conformanceSkip(noNesting);\n  };\n  const enhancerBoots: readonly GraphEnhancers[] = [\n    [],\n    [\"guards\", \"interceptors\"],\n  ];\n  const graphOf = (result: GraphResult, root: string, field?: string) => {\n    const node = (result.data as Record<string, unknown> | null | undefined)?.[\n      root\n    ] as Record<string, unknown> | null | undefined;\n    return field === undefined ? node : node?.[field];\n  };\n  const userOf = (value: unknown) =>\n    (value as { principal?: { userId?: string } | null } | null | undefined)\n      ?.principal?.userId ?? null;\n  const host = new URL(KIT_BASE_URL).host;\n  const dynamicBaseURL = { allowedHosts: [host], fallback: KIT_BASE_URL };\n  const cookie = (env: KitEnv) => ({\n    cookie: env.identity.cookie,\n    ...(env.connectionLeg ? { origin: KIT_BASE_URL } : {}),\n  });\n\n  add(\n    \"T-selection\",\n    \"handles() accepts its contexts with and without credentials and rejects foreign ones\",\n    (env) =>\n      withApp(options, env, async ({ app, instrumentation }) => {\n        const transport = resolvedTransport(app, options.transport);\n        const registry = app.get<TransportRegistry>(TRANSPORT_REGISTRY, {\n          strict: false,\n        });\n        instrumentation.recordLegs = !options.expectBrowserLeg;\n        succeeded(await options.invoke(app, \"optional\", {}));\n        instrumentation.recordLegs = false;\n        for (const leg of instrumentation.legs) {\n          assert.equal(\n            leg,\n            \"none\",\n            \"the transport describes a browser leg, so expectBrowserLeg must be true\",\n          );\n        }\n        succeeded(await options.invoke(app, \"optional\", cookie(env)));\n        assert.ok(\n          instrumentation.contexts.length >= 2,\n          \"the guard described no invocation\",\n        );\n        for (const context of instrumentation.contexts) {\n          assert.equal(transport.handles(context), true);\n          assert.equal(\n            registry.find(context),\n            transport,\n            \"another registered transport claimed the context first\",\n          );\n        }\n        assert.equal(transport.handles(foreignContext), false);\n      }),\n  );\n  add(\n    \"T-public-unclaimed-context\",\n    \"in a context type no registered transport handles, a public handler runs without auth work and a required one answers NO_TRANSPORT\",\n    (env) =>\n      withApp(options, env, async ({ app, instrumentation }) => {\n        const creator = app.get(ExternalContextCreator, { strict: false });\n        const run = (fixture: FixtureName) => {\n          const { instance, method } = fixtureInstance(app, fixture);\n          const callback = Reflect.get(instance, method) as (\n            ...args: unknown[]\n          ) => unknown;\n          const handler = creator.create(\n            instance as Record<string, (...args: unknown[]) => unknown>,\n            callback,\n            method,\n            undefined,\n            undefined,\n            undefined,\n            undefined,\n            { guards: true, interceptors: true, filters: false },\n            UNCLAIMED_CONTEXT,\n          );\n          return settle(async () => handler({}));\n        };\n        const from = env.probe.calls.length;\n        const described = instrumentation.contexts.length;\n        const reached = await run(\"public\");\n        assert.ok(\n          reached.ok,\n          `the public handler did not run: ${String(!reached.ok && reached.error)}`,\n        );\n        assert.equal(\n          instrumentation.contexts.length,\n          described,\n          \"the guard described a context no transport handles\",\n        );\n        assert.equal(sessionReads(env.probe, from), 0, \"the session was read\");\n        const required = await run(\"required\");\n        assert.equal(required.ok, false, \"the required handler ran\");\n        assert.deepEqual(\n          bootIssueCodes(!required.ok && required.error),\n          [\"NO_TRANSPORT\"],\n          `expected NO_TRANSPORT, got ${String(!required.ok && required.error)}`,\n        );\n        assert.equal(sessionReads(env.probe, from), 0, \"the session was read\");\n      }),\n  );\n  add(\n    \"T-no-credentials\",\n    \"missing credentials answer 401 UNAUTHENTICATED without throwing from headers()\",\n    (env) =>\n      withApp(options, env, async ({ app }) => {\n        const result = await options.invoke(app, \"required\", {});\n        denied(result, 401);\n        assert.equal(result.error?.code, \"UNAUTHENTICATED\");\n        succeeded(await options.invoke(app, \"public\", {}));\n      }),\n  );\n  add(\n    \"T-credentials\",\n    \"cookie, bearer and x-api-key credentials are extracted\",\n    (env) =>\n      withApp(options, env, async ({ app }) => {\n        const byCookie = await options.invoke(app, \"required\", cookie(env));\n        succeeded(byCookie);\n        assert.deepEqual(principalOf(byCookie), {\n          kind: \"session\",\n          userId: env.identity.userId,\n        });\n        const byBearer = await options.invoke(app, \"required\", {\n          authorization: `Bearer ${env.identity.token}`,\n        });\n        succeeded(byBearer);\n        assert.equal(principalOf(byBearer)?.userId, env.identity.userId);\n        const byKey = await options.invoke(app, \"acceptsApiKey\", {\n          \"x-api-key\": env.keys.valid,\n        });\n        succeeded(byKey);\n        assert.equal(principalOf(byKey)?.kind, \"api-key\");\n      }),\n  );\n  add(\n    \"T-memo-once\",\n    \"one logical request resolves each accepted-kind set at most once\",\n    (env) =>\n      withApp(options, env, async ({ app }) => {\n        let from = env.probe.calls.length;\n        succeeded(await options.invoke(app, \"triple\", cookie(env)));\n        assert.ok(\n          sessionReads(env.probe, from) <= 1,\n          `triple read the session ${sessionReads(env.probe, from)} times`,\n        );\n        from = env.probe.calls.length;\n        succeeded(await options.invoke(app, \"tripleMixed\", cookie(env)));\n        assert.ok(sessionReads(env.probe, from) <= 2);\n        for (const shape of options.invocationShapes ?? []) {\n          if (shape !== \"aliases\" && shape !== \"batched\") {\n            continue;\n          }\n          from = env.probe.calls.length;\n          await options.invokeTwice!(\n            app,\n            shape,\n            [{ orgId: \"org-a\" }, { orgId: \"org-a2\" }],\n            cookie(env),\n          );\n          assert.equal(\n            sessionReads(env.probe, from),\n            1,\n            `two ${shape} invocations of one request resolved the principal ${sessionReads(env.probe, from)} times`,\n          );\n        }\n      }),\n  );\n  add(\n    \"T-invocation-decisions\",\n    \"two invocations in one request or connection are decided and valued independently\",\n    async (env) =>\n      (await twiceReady(env)) ??\n      withApp(options, env, async ({ app }) => {\n        for (const shape of options.invocationShapes!) {\n          const [first, second] = await options.invokeTwice!(\n            app,\n            shape,\n            [{ orgId: \"org-a\" }, { orgId: \"org-b\" }],\n            cookie(env),\n          );\n          assert.equal(first.ok, true, `${shape}: the allowed org was denied`);\n          assert.equal(\n            second.error?.reason,\n            \"MISSING_PERMISSION\",\n            `${shape}: the second invocation was not decided independently (${JSON.stringify(second)})`,\n          );\n          const [deniedFirst, allowedSecond] = await options.invokeTwice!(\n            app,\n            shape,\n            [{ orgId: \"org-b\" }, { orgId: \"org-a\" }],\n            cookie(env),\n          );\n          assert.equal(deniedFirst.error?.reason, \"MISSING_PERMISSION\");\n          assert.equal(\n            allowedSecond.ok,\n            true,\n            `${shape}: the second invocation was not decided independently (${JSON.stringify(allowedSecond)})`,\n          );\n          const values = await options.invokeTwice!(\n            app,\n            shape,\n            [{ orgId: \"org-a\" }, { orgId: \"org-a2\" }],\n            cookie(env),\n          );\n          assert.deepEqual(\n            values.map((value) => value.ok),\n            [true, true],\n            `${shape}: @ActiveOrganizationId() did not return each invocation's own organization`,\n          );\n        }\n      }),\n    twiceSkip,\n  );\n  add(\n    \"T-acceptance\",\n    \"an x-api-key on a route that does not accept api keys is never verified\",\n    (env) =>\n      withApp(options, env, async ({ app }) => {\n        const withCookie = await options.invoke(app, \"required\", {\n          ...cookie(env),\n          \"x-api-key\": env.keys.valid,\n        });\n        succeeded(withCookie);\n        assert.equal(principalOf(withCookie)?.kind, \"session\");\n        denied(\n          await options.invoke(app, \"required\", {\n            \"x-api-key\": env.keys.valid,\n          }),\n          401,\n        );\n        assert.equal(env.keys.verifications, 0, \"the key was verified\");\n        succeeded(\n          await options.invoke(app, \"acceptsApiKey\", {\n            \"x-api-key\": env.keys.valid,\n          }),\n        );\n        assert.equal(env.keys.verifications, 1);\n      }),\n  );\n  add(\n    \"T-cookie-forwarded\",\n    \"a refreshed session cookie is forwarded exactly once\",\n    (env) =>\n      withApp(options, env, async ({ app }) => {\n        const name = await env.sessionCookieName();\n        const result = await options.invoke(app, \"required\", cookie(env));\n        succeeded(result);\n        const lines = result.setCookies.filter((line) =>\n          line.startsWith(`${name}=`),\n        );\n        assert.equal(\n          lines.length,\n          1,\n          `refresh cookies: ${result.setCookies.join(\" | \")}`,\n        );\n      }),\n    options.expectCookieCapable\n      ? undefined\n      : \"the transport cannot deliver Set-Cookie (see T-refresh-suppressed)\",\n  );\n  add(\n    \"T-refresh-suppressed\",\n    \"a cookie-less transport moves no session expiry and writes no cookie\",\n    (env) =>\n      withApp(options, env, async ({ app }) => {\n        const context = (await env.auth.$context) as {\n          internalAdapter: {\n            findSession(token: string): Promise<{\n              session: { expiresAt: Date };\n            } | null>;\n          };\n        };\n        const before = await context.internalAdapter.findSession(\n          env.identity.token,\n        );\n        const writes = env.probe.writes.length;\n        const result = await options.invoke(app, \"required\", cookie(env));\n        succeeded(result);\n        const after = await context.internalAdapter.findSession(\n          env.identity.token,\n        );\n        assert.deepEqual(result.setCookies, []);\n        assert.equal(\n          new Date(after!.session.expiresAt).getTime(),\n          new Date(before!.session.expiresAt).getTime(),\n          \"the session expiry moved\",\n        );\n        assert.ok(\n          !env.probe.writes.slice(writes).includes(\"session.update\"),\n          \"the session row was refreshed\",\n        );\n        assert.ok(\n          env.probe.refresh\n            .filter((entry) => entry.path === \"/get-session\")\n            .slice(-1)\n            .every((entry) => entry.skip),\n          \"getShouldSkipSessionRefresh() was not true inside the scope\",\n        );\n      }),\n    options.expectCookieCapable\n      ? \"the transport delivers Set-Cookie (see T-cookie-forwarded)\"\n      : undefined,\n  );\n  add(\n    \"T-csrf-http-unsafe\",\n    \"an unsafe cookie operation needs a trusted origin, checked before any session read, unless an explicit opt-out applies; Better Auth's boolean origin skip is not one\",\n    async (env) => {\n      const skip = await operationLeg();\n      if (skip) {\n        return skip;\n      }\n      await withApp(options, env, async ({ app }) => {\n        const from = env.probe.calls.length;\n        denied(\n          await options.invoke(app, \"unsafe\", {\n            ...cookie(env),\n            origin: UNTRUSTED_ORIGIN,\n          }),\n          403,\n          \"INVALID_ORIGIN\",\n        );\n        assert.equal(sessionReads(env.probe, from), 0, \"the session was read\");\n        denied(\n          await options.invoke(app, \"unsafe\", cookie(env)),\n          403,\n          \"MISSING_OR_NULL_ORIGIN\",\n        );\n        for (const origin of [PROBE_TRUSTED_ORIGIN, KIT_BASE_URL]) {\n          succeeded(\n            await options.invoke(app, \"unsafe\", { ...cookie(env), origin }),\n            `trusted origin ${origin}`,\n          );\n        }\n        succeeded(\n          await options.invoke(app, \"unsafe\", {\n            ...cookie(env),\n            // A same-origin page of the trusted base URL: the leg's own host is that origin.\n            host: new URL(KIT_BASE_URL).host,\n            origin: \"null\",\n            \"sec-fetch-site\": \"same-origin\",\n          }),\n          \"Origin: null with Sec-Fetch-Site: same-origin\",\n        );\n        succeeded(\n          await options.invoke(app, \"unsafe\", {\n            authorization: `Bearer ${env.identity.token}`,\n            origin: UNTRUSTED_ORIGIN,\n          }),\n          \"a bearer token without a cookie\",\n        );\n      });\n      // Explicit opt-outs: @SkipOriginCheck() on the handler, and Better Auth's own advanced.disableCSRFCheck.\n      const untrusted = async (\n        app: INestApplication,\n        kit: KitEnv,\n        label: string,\n      ) => {\n        const result = await options.invoke(app, \"unsafe\", {\n          ...cookie(kit),\n          origin: UNTRUSTED_ORIGIN,\n        });\n        succeeded(result, `${label}: a cookie from an untrusted Origin`);\n        assert.equal(principalOf(result)?.userId, kit.identity.userId, label);\n      };\n      await withApp(\n        options,\n        env,\n        ({ app }) => untrusted(app, env, \"@SkipOriginCheck()\"),\n        { fixtures: kitFixtures({ unsafe: [SkipOriginCheck()] }) },\n      );\n      const disabled = await kitEnvironment({}, { disableCSRFCheck: true });\n      await withApp(options, disabled, ({ app }) =>\n        untrusted(app, disabled, \"advanced.disableCSRFCheck\"),\n      );\n      // Better Auth's boolean origin skip with an explicit disableCSRFCheck: false opens only Better Auth's own\n      // routes; application operations stay checked, a deliberate divergence that B19 names. [R6:BA-r6-01]\n      const sdkSkip = await kitEnvironment(\n        {},\n        { disableOriginCheck: true, disableCSRFCheck: false },\n      );\n      const skipLogger = new CapturingLogger();\n      await withApp(\n        options,\n        sdkSkip,\n        async ({ app }) => {\n          const from = sdkSkip.probe.calls.length;\n          denied(\n            await options.invoke(app, \"unsafe\", {\n              ...cookie(sdkSkip),\n              origin: UNTRUSTED_ORIGIN,\n            }),\n            403,\n            \"INVALID_ORIGIN\",\n          );\n          assert.equal(\n            sessionReads(sdkSkip.probe, from),\n            0,\n            \"disableOriginCheck: true with disableCSRFCheck: false: the session was read\",\n          );\n          succeeded(\n            await options.invoke(app, \"unsafe\", {\n              ...cookie(sdkSkip),\n              origin: KIT_BASE_URL,\n            }),\n            \"disableOriginCheck: true with disableCSRFCheck: false: the trusted base URL\",\n          );\n        },\n        {},\n        skipLogger,\n      );\n      assert.ok(\n        skipLogger.entries.some(\n          (entry) =>\n            entry.level === \"warn\" &&\n            entry.text.startsWith(\"W_ORIGIN_CHECK:\") &&\n            entry.text.includes(\"app-route checks remain on\"),\n        ),\n        `boot did not warn W_ORIGIN_CHECK that app-route checks remain on (pass the logger option to the app): ${skipLogger.text().slice(0, 500)}`,\n      );\n    },\n    noBrowser,\n  );\n  add(\n    \"T-csrf-http-cookie-plus-token\",\n    \"a cookie plus a bearer token from an untrusted origin is still denied\",\n    async (env) =>\n      (await operationLeg()) ??\n      withApp(options, env, async ({ app }) => {\n        for (const token of [\"a.b\", env.identity.token]) {\n          denied(\n            await options.invoke(app, \"unsafe\", {\n              ...cookie(env),\n              authorization: `Bearer ${token}`,\n              origin: UNTRUSTED_ORIGIN,\n            }),\n            403,\n            \"INVALID_ORIGIN\",\n          );\n        }\n      }),\n    noBrowser,\n  );\n  add(\n    \"T-csrf-login-proxy\",\n    \"a forwarding login proxy follows Better Auth's form rule, and service forwarding needs a declaration\",\n    async (env) => {\n      const skip = await operationLeg();\n      if (skip) {\n        return skip;\n      }\n      const user = await kitIdentity(env.auth, { password: true });\n      const credentials = { email: user.email, password: user.password! };\n      await withApp(options, env, async ({ app }) => {\n        const name = await env.sessionCookieName();\n        let signIns = env.probe.calls.filter(\n          (path) => path === \"/sign-in/email\",\n        ).length;\n        const navigation = await options.invoke(\n          app,\n          \"loginProxy\",\n          {\n            \"sec-fetch-site\": \"cross-site\",\n            \"sec-fetch-mode\": \"navigate\",\n            \"sec-fetch-dest\": \"document\",\n          },\n          credentials,\n        );\n        denied(navigation, 403, \"CROSS_SITE_NAVIGATION_LOGIN_BLOCKED\");\n        assert.deepEqual(navigation.setCookies, []);\n        assert.equal(\n          env.probe.calls.filter((path) => path === \"/sign-in/email\").length,\n          signIns,\n          \"the proxy called Better Auth before the form check\",\n        );\n        denied(\n          await options.invoke(\n            app,\n            \"loginProxy\",\n            {\n              origin: UNTRUSTED_ORIGIN,\n              \"sec-fetch-site\": \"cross-site\",\n              \"sec-fetch-mode\": \"cors\",\n            },\n            credentials,\n          ),\n          403,\n          \"INVALID_ORIGIN\",\n        );\n        const trusted = await options.invoke(\n          app,\n          \"loginProxy\",\n          { origin: KIT_BASE_URL },\n          credentials,\n        );\n        succeeded(trusted);\n        assert.ok(\n          trusted.setCookies.some((line) => line.startsWith(`${name}=`)),\n          \"the trusted sign-in forwarded no session cookie\",\n        );\n        succeeded(await options.invoke(app, \"loginProxy\", {}, credentials));\n        // A public forwarding proxy on a safe operation (HTTP GET) is in form mode too: cross-site input causes no\n        // Better Auth call, no session write and no cookie. [R7:SEC-r7-01]\n        signIns = env.probe.calls.filter(\n          (path) => path === \"/sign-in/email\",\n        ).length;\n        const writes = env.probe.writes.length;\n        const readNavigation = await options.invoke(\n          app,\n          \"loginProxyRead\",\n          {\n            \"sec-fetch-site\": \"cross-site\",\n            \"sec-fetch-mode\": \"navigate\",\n            \"sec-fetch-dest\": \"document\",\n          },\n          credentials,\n        );\n        denied(readNavigation, 403, \"CROSS_SITE_NAVIGATION_LOGIN_BLOCKED\");\n        assert.deepEqual(readNavigation.setCookies, []);\n        assert.equal(\n          env.probe.calls.filter((path) => path === \"/sign-in/email\").length,\n          signIns,\n          \"a cross-site navigation reached Better Auth through the safe forwarding proxy\",\n        );\n        assert.deepEqual(\n          env.probe.writes.slice(writes),\n          [],\n          \"a cross-site navigation wrote a session through the safe forwarding proxy\",\n        );\n        const trustedRead = await options.invoke(\n          app,\n          \"loginProxyRead\",\n          { origin: KIT_BASE_URL },\n          credentials,\n        );\n        succeeded(trustedRead, \"a trusted fetch of the safe forwarding proxy\");\n        assert.ok(\n          trustedRead.setCookies.some((line) => line.startsWith(`${name}=`)),\n          \"the trusted safe forwarding proxy forwarded no session cookie\",\n        );\n        succeeded(\n          await options.invoke(app, \"loginProxyRead\", {}, credentials),\n          \"a headerless non-browser call of the safe forwarding proxy\",\n        );\n        signIns = env.probe.calls.filter(\n          (path) => path === \"/sign-in/email\",\n        ).length;\n        const attempts: Record<string, string>[] = [\n          { origin: KIT_BASE_URL },\n          { origin: UNTRUSTED_ORIGIN, \"sec-fetch-site\": \"cross-site\" },\n        ];\n        for (const headers of attempts) {\n          const result = await options.invoke(\n            app,\n            \"loginProxyService\",\n            headers,\n            credentials,\n          );\n          internal(result);\n          assert.deepEqual(result.setCookies, []);\n        }\n        assert.equal(\n          env.probe.calls.filter((path) => path === \"/sign-in/email\").length,\n          signIns,\n          \"forwardForeignCookies ran its callback without a declaration\",\n        );\n      });\n      // An inheriting forwarding field under a safe query is in form mode: boot needs field guards to reach it, and a\n      // cross-site request is denied before the field calls Better Auth. [R7:SEC-r7-01]\n      if (await graphReady(env)) {\n        return;\n      }\n      const forwarding = (guarded: boolean) =>\n        kitFixtures({}, [], { guarded, forwarding: credentials });\n      await expectBootFailure(\n        options,\n        env,\n        { fieldResolverEnhancers: [], fixtures: forwarding(false) },\n        \"FIELD_RESOLVER_UNGUARDED\",\n      );\n      await withApp(\n        options,\n        env,\n        async ({ app }) => {\n          const signIns = env.probe.calls.filter(\n            (path) => path === \"/sign-in/email\",\n          ).length;\n          const writes = env.probe.writes.length;\n          const selection: GraphSelection[] = [\n            { root: \"public\", fields: [\"forwarding\", \"reader\"] },\n          ];\n          const navigation = await options.invokeGraph!(app, selection, {\n            \"sec-fetch-site\": \"cross-site\",\n            \"sec-fetch-mode\": \"navigate\",\n            \"sec-fetch-dest\": \"document\",\n          });\n          assert.ok(\n            navigation.errors.some(\n              (error) =>\n                error.path.includes(\"forwarding\") &&\n                error.reason === \"CROSS_SITE_NAVIGATION_LOGIN_BLOCKED\",\n            ),\n            `a cross-site navigation reached the inherited forwarding field: ${JSON.stringify(navigation)}`,\n          );\n          assert.equal(\n            env.probe.calls.filter((path) => path === \"/sign-in/email\").length,\n            signIns,\n            \"a cross-site navigation reached Better Auth through the inherited forwarding field\",\n          );\n          assert.deepEqual(\n            env.probe.writes.slice(writes),\n            [],\n            \"a cross-site navigation wrote a session through the inherited forwarding field\",\n          );\n          for (const [headers, label] of [\n            [{ origin: KIT_BASE_URL }, \"a trusted fetch\"],\n            [{}, \"a headerless non-browser request\"],\n          ] as const) {\n            const result = await options.invokeGraph!(app, selection, headers);\n            assert.deepEqual(\n              result.errors,\n              [],\n              `${label} of the inherited forwarding field: ${JSON.stringify(result.errors)}`,\n            );\n            assert.equal(graphOf(result, \"public\", \"forwarding\"), \"forwarded\");\n            assert.equal(\n              userOf(graphOf(result, \"public\", \"reader\")),\n              null,\n              `${label}: the forwarding field changed the inherited reading`,\n            );\n          }\n        },\n        {\n          fieldResolverEnhancers: [\"guards\", \"interceptors\"],\n          fixtures: forwarding(true),\n        },\n      );\n    },\n    noBrowser,\n  );\n  add(\n    \"T-csrf-safe-methods\",\n    \"safe cookie reads are not denied by origin validation, while forwarding enforces form mode without cookies\",\n    async (env) => {\n      const skip = await operationLeg();\n      if (skip) {\n        return skip;\n      }\n      const user = await kitIdentity(env.auth, { password: true });\n      await withApp(options, env, async ({ app, logger }) => {\n        for (const headers of [\n          { ...cookie(env), origin: UNTRUSTED_ORIGIN },\n          cookie(env),\n        ]) {\n          const result = await options.invoke(app, \"readsSession\", headers);\n          succeeded(result);\n          assert.equal(\n            (result.body as { userId?: string }).userId,\n            env.identity.userId,\n          );\n        }\n        const signIns = env.probe.calls.filter(\n          (path) => path === \"/sign-in/email\",\n        ).length;\n        const result = await options.invoke(\n          app,\n          \"loginProxyRead\",\n          {\n            origin: UNTRUSTED_ORIGIN,\n            \"sec-fetch-site\": \"cross-site\",\n            \"sec-fetch-mode\": \"cors\",\n          },\n          { email: user.email, password: user.password },\n        );\n        denied(result, 403, \"INVALID_ORIGIN\");\n        assert.deepEqual(result.setCookies, []);\n        assert.equal(\n          env.probe.calls.filter((path) => path === \"/sign-in/email\").length,\n          signIns,\n          \"a cross-site safe operation of a forwarding handler reached Better Auth\",\n        );\n        // A direct call presenting the caller's session needs a passing verdict for this leg: the guarded safe\n        // operation computes an advisory one, a public handler none. [R5:SEC-r5-01]\n        const direct = { cookie: env.identity.cookie };\n        const callerSession = async (\n          handler: \"callerSession\" | \"publicCallerSession\",\n          origin: string | undefined,\n        ) =>\n          options.invoke(\n            app,\n            handler,\n            { ...cookie(env), ...(origin === undefined ? {} : { origin }) },\n            direct,\n          );\n        for (const origin of [UNTRUSTED_ORIGIN, undefined]) {\n          const label = `a guarded safe operation's direct caller-session call ${origin ? \"from an untrusted Origin\" : \"without Origin\"}`;\n          const errors = logger.errors().length;\n          internal(await callerSession(\"callerSession\", origin), label);\n          assert.match(\n            logger\n              .errors()\n              .slice(errors)\n              .map((entry) => entry.text)\n              .join(\"\\n\"),\n            /PUBLIC_HANDLER_USED_CALLER_SESSION/,\n            label,\n          );\n        }\n        const trusted = await callerSession(\"callerSession\", KIT_BASE_URL);\n        succeeded(\n          trusted,\n          \"a guarded safe operation's direct caller-session call from a trusted Origin\",\n        );\n        assert.equal(\n          (trusted.body as { userId?: string }).userId,\n          env.identity.userId,\n        );\n        for (const origin of [KIT_BASE_URL, UNTRUSTED_ORIGIN]) {\n          internal(\n            await callerSession(\"publicCallerSession\", origin),\n            `a public handler's direct caller-session call from ${origin}`,\n          );\n        }\n      });\n    },\n    noBrowser,\n  );\n  /** Guarded fixtures a connection case sends, one message each, on one connection. */\n  const guardedMessages: readonly FixtureName[] = [\n    \"required\",\n    \"optional\",\n    \"acceptsApiKey\",\n  ];\n  /** Undefined when the browser leg is the connection's handshake and invokeConnection is given; fails without it. */\n  const connectionReady = async (): Promise<ConformanceSkip | undefined> => {\n    if (!(await connectionLeg())) {\n      return conformanceSkip(\n        \"the browser leg follows each operation (T-csrf-* cover it)\",\n      );\n    }\n    assert.ok(\n      options.invokeConnection,\n      \"the transport's browser leg is its connection's handshake, so invokeConnection is required\",\n    );\n    return undefined;\n  };\n  /** Whether the kit checks connection-time authentication: required when the app provides WS_CONNECTION_AUTH. */\n  const authenticatesConnections = (app: INestApplication): boolean => {\n    let provided: boolean;\n    try {\n      app.get(WS_CONNECTION_AUTH, { strict: false });\n      provided = true;\n    } catch {\n      provided = false;\n    }\n    assert.ok(\n      !provided || options.authenticateConnection,\n      \"the app provides WS_CONNECTION_AUTH, so authenticateConnection is required\",\n    );\n    return options.authenticateConnection !== undefined;\n  };\n  /** Every guarded message of one connection, and connection-time authentication, answer the denial. */\n  const deniedOnConnection = async (\n    app: INestApplication,\n    headers: Record<string, string>,\n    status: number,\n    reason: string,\n    label: string,\n  ) => {\n    const results = await options.invokeConnection!(\n      app,\n      guardedMessages,\n      headers,\n    );\n    assert.equal(results.length, guardedMessages.length, label);\n    for (const [index, result] of results.entries()) {\n      denied(result, status, reason, `${label}, ${guardedMessages[index]}`);\n    }\n    if (authenticatesConnections(app)) {\n      denied(\n        await options.authenticateConnection!(app, headers),\n        status,\n        reason,\n        `${label}, connection-time authentication`,\n      );\n    }\n  };\n  /** Every guarded message of one connection reads the user, and connection-time authentication succeeds. */\n  const allowedOnConnection = async (\n    app: INestApplication,\n    headers: Record<string, string>,\n    userId: string,\n    label: string,\n  ) => {\n    const results = await options.invokeConnection!(\n      app,\n      guardedMessages,\n      headers,\n    );\n    assert.equal(results.length, guardedMessages.length, label);\n    for (const [index, result] of results.entries()) {\n      succeeded(result, `${label}, ${guardedMessages[index]}`);\n      assert.equal(principalOf(result)?.userId, userId, label);\n    }\n    if (authenticatesConnections(app)) {\n      const connection = await options.authenticateConnection!(app, headers);\n      assert.equal(\n        connection.ok,\n        true,\n        `${label}, connection-time authentication: ${JSON.stringify(connection.error)}`,\n      );\n    }\n  };\n  addRun(\n    \"T-ws-origin-untrusted\",\n    \"a handshake with a cookie and an untrusted or missing Origin is denied on every message and at connection time, a token-only handshake is allowed, and a function-valued trustedOrigins runs once per connection\",\n    async () => {\n      const skip = await connectionReady();\n      if (skip) {\n        return skip;\n      }\n      const requests: (Request | undefined)[] = [];\n      const env = await kitEnvironment({\n        trustedOrigins: (request?: Request) => {\n          requests.push(request);\n          return [FUNCTION_TRUSTED_ORIGIN];\n        },\n      });\n      await withApp(options, env, async ({ app }) => {\n        const session = env.identity.cookie;\n        await deniedOnConnection(\n          app,\n          { cookie: session, origin: UNTRUSTED_ORIGIN },\n          403,\n          \"INVALID_ORIGIN\",\n          \"a cookie handshake from an untrusted Origin\",\n        );\n        await deniedOnConnection(\n          app,\n          { cookie: session },\n          403,\n          \"MISSING_OR_NULL_ORIGIN\",\n          \"a cookie handshake without Origin\",\n        );\n        for (const origin of [KIT_BASE_URL, UNTRUSTED_ORIGIN]) {\n          await allowedOnConnection(\n            app,\n            { authorization: `Bearer ${env.identity.token}`, origin },\n            env.identity.userId,\n            `a token-only handshake from ${origin}`,\n          );\n        }\n        const from = requests.length;\n        const results = await options.invokeConnection!(app, guardedMessages, {\n          cookie: session,\n          origin: FUNCTION_TRUSTED_ORIGIN,\n        });\n        for (const result of results) {\n          succeeded(\n            result,\n            \"a cookie handshake from a function-trusted Origin\",\n          );\n        }\n        assert.equal(\n          requests.length - from,\n          1,\n          `trustedOrigins() ran ${requests.length - from} times for one connection of ${guardedMessages.length} messages`,\n        );\n      });\n    },\n    noBrowser,\n  );\n  add(\n    \"T-ws-origin-junk-token\",\n    \"a cookie plus a junk or valid bearer token from an untrusted Origin is denied on every message and at connection time\",\n    async (env) =>\n      (await connectionReady()) ??\n      withApp(options, env, async ({ app }) => {\n        for (const [token, kind] of [\n          [\"a.b\", \"junk\"],\n          [env.identity.token, \"valid\"],\n        ] as const) {\n          await deniedOnConnection(\n            app,\n            {\n              cookie: env.identity.cookie,\n              authorization: `Bearer ${token}`,\n              origin: UNTRUSTED_ORIGIN,\n            },\n            403,\n            \"INVALID_ORIGIN\",\n            `a cookie plus a ${kind} bearer token from an untrusted Origin`,\n          );\n        }\n      }),\n    noBrowser,\n  );\n  addRun(\n    \"T-ws-origin-dynamic-baseurl\",\n    \"with a dynamic baseURL, a same-origin cookie handshake is allowed without a 500 and a cross-site one is denied\",\n    async () => {\n      const skip = await connectionReady();\n      if (skip) {\n        return skip;\n      }\n      const env = await kitEnvironment({ baseURL: dynamicBaseURL });\n      await withApp(options, env, async ({ app }) => {\n        await allowedOnConnection(\n          app,\n          { cookie: env.identity.cookie, host, origin: KIT_BASE_URL },\n          env.identity.userId,\n          \"a same-origin cookie handshake\",\n        );\n        await deniedOnConnection(\n          app,\n          { cookie: env.identity.cookie, host, origin: UNTRUSTED_ORIGIN },\n          403,\n          \"INVALID_ORIGIN\",\n          \"a cross-site cookie handshake\",\n        );\n      });\n    },\n    noBrowser,\n  );\n  addRun(\n    \"T-ws-origin-forwarded-host\",\n    \"forwarded host and protocol headers never make an untrusted Origin the handshake's own, with a dynamic or unset baseURL and either trustedProxyHeaders\",\n    async () => {\n      const skip = await connectionReady();\n      if (skip) {\n        return skip;\n      }\n      const spoof = {\n        host,\n        origin: UNTRUSTED_ORIGIN,\n        \"x-forwarded-host\": new URL(UNTRUSTED_ORIGIN).host,\n        \"x-forwarded-proto\": \"https\",\n      };\n      for (const baseURL of [dynamicBaseURL, undefined]) {\n        for (const trustedProxyHeaders of [false, true]) {\n          const env = await kitEnvironment({\n            baseURL,\n            advanced: { trustedProxyHeaders },\n          });\n          const label = `${baseURL ? \"dynamic\" : \"unset\"} baseURL, trustedProxyHeaders ${trustedProxyHeaders}`;\n          await withApp(options, env, async ({ app }) => {\n            await deniedOnConnection(\n              app,\n              { cookie: env.identity.cookie, ...spoof },\n              403,\n              \"INVALID_ORIGIN\",\n              `${label}: a forwarded-host spoof`,\n            );\n            await allowedOnConnection(\n              app,\n              { cookie: env.identity.cookie, host, origin: KIT_BASE_URL },\n              env.identity.userId,\n              `${label}: a same-origin handshake`,\n            );\n          });\n        }\n      }\n    },\n    noBrowser,\n  );\n  addRun(\n    \"T-ws-origin-function-trusted-origins\",\n    \"a function-valued trustedOrigins receives the handshake's absolute URL, and a throwing one answers the generic internal error\",\n    async () => {\n      const skip = await connectionReady();\n      if (skip) {\n        return skip;\n      }\n      const requests: (Request | undefined)[] = [];\n      let outage: Error | undefined;\n      const env = await kitEnvironment({\n        trustedOrigins: (request?: Request) => {\n          requests.push(request);\n          if (outage) {\n            throw outage;\n          }\n          return [FUNCTION_TRUSTED_ORIGIN];\n        },\n      });\n      await withApp(options, env, async ({ app }) => {\n        const headers = {\n          cookie: env.identity.cookie,\n          host,\n          origin: FUNCTION_TRUSTED_ORIGIN,\n        };\n        const from = requests.length;\n        await allowedOnConnection(\n          app,\n          headers,\n          env.identity.userId,\n          \"a cookie handshake from a function-trusted Origin\",\n        );\n        const received = requests.slice(from);\n        assert.ok(received.length > 0, \"trustedOrigins() was not called\");\n        for (const request of received) {\n          assert.ok(\n            request instanceof Request,\n            \"trustedOrigins() received no Request\",\n          );\n          assert.equal(\n            new URL(request.url).origin,\n            KIT_BASE_URL,\n            `trustedOrigins() received ${request.url}, not the handshake's absolute URL`,\n          );\n        }\n        const secret = `trusted-origins-outage-${globalThis.crypto.randomUUID()}`;\n        outage = new Error(secret);\n        try {\n          const results = await options.invokeConnection!(\n            app,\n            guardedMessages,\n            headers,\n          );\n          for (const [index, result] of results.entries()) {\n            internal(\n              result,\n              `a throwing trustedOrigins(), ${guardedMessages[index]}`,\n            );\n            assert.ok(\n              !JSON.stringify(result.error ?? {}).includes(secret),\n              \"the client saw the trustedOrigins() error\",\n            );\n          }\n          if (authenticatesConnections(app)) {\n            const connection = await options.authenticateConnection!(\n              app,\n              headers,\n            );\n            internal(\n              connection,\n              \"a throwing trustedOrigins(), connection-time authentication\",\n            );\n            assert.ok(\n              !JSON.stringify(connection.error ?? {}).includes(secret),\n              \"the client saw the trustedOrigins() error at connection time\",\n            );\n          }\n        } finally {\n          outage = undefined;\n        }\n      });\n    },\n    noBrowser,\n  );\n  const subscriptions = options.invocationShapes?.includes(\"subscriptions\")\n    ? undefined\n    : \"the harness serves no subscriptions (invocationShapes lacks 'subscriptions')\";\n  const subscribe = (app: INestApplication, headers: HeadersInit) =>\n    options.invokeTwice!(\n      app,\n      \"subscriptions\",\n      [{ orgId: \"org-a\" }, { orgId: \"org-a2\" }],\n      headers,\n    );\n  const subscriptionDenied = async (\n    app: INestApplication,\n    headers: Record<string, string>,\n    label: string,\n    connectionParams?: Record<string, string>,\n  ) => {\n    for (const [index, result] of (await subscribe(app, headers)).entries()) {\n      assert.equal(result.ok, false, `${label}, subscription ${index + 1}`);\n      assert.equal(\n        result.error?.reason,\n        \"INVALID_ORIGIN\",\n        `${label}, subscription ${index + 1}: ${JSON.stringify(result.error)}`,\n      );\n    }\n    const messages: FixtureName[] = [\"required\", \"unsafe\"];\n    const results = await options.invokeConnection!(\n      app,\n      messages,\n      headers,\n      connectionParams ? { connectionParams } : undefined,\n    );\n    for (const [index, result] of results.entries()) {\n      denied(result, 403, \"INVALID_ORIGIN\", `${label}, ${messages[index]}`);\n    }\n  };\n  add(\n    \"T-subscription-credentials\",\n    \"subscriptions extract credentials from the upgrade cookie and from connectionParams, and deny anonymous connections\",\n    async (env) => {\n      assert.ok(\n        options.invokeConnection,\n        \"the harness serves subscriptions, so invokeConnection is required\",\n      );\n      const other = await kitIdentity(env.auth);\n      await withApp(options, env, async ({ app }) => {\n        for (const [headers, label] of [\n          [cookie(env), \"an upgrade cookie\"],\n          [\n            { authorization: `Bearer ${env.identity.token}` },\n            \"a connectionParams bearer token\",\n          ],\n        ] as const) {\n          assert.deepEqual(\n            (await subscribe(app, headers)).map((result) => result.ok),\n            [true, true],\n            `${label} did not authenticate its subscriptions`,\n          );\n        }\n        assert.deepEqual(\n          (await subscribe(app, {})).map((result) => result.ok),\n          [false, false],\n          \"an anonymous connection's subscriptions were allowed\",\n        );\n        // A connectionParams cookie replaces the upgrade cookie in the credentials.\n        const [replaced] = await options.invokeConnection!(\n          app,\n          [\"required\"],\n          cookie(env),\n          { connectionParams: { cookie: other.cookie } },\n        );\n        succeeded(replaced!, \"a connectionParams cookie\");\n        assert.equal(\n          principalOf(replaced!)?.userId,\n          other.userId,\n          \"the connectionParams cookie did not replace the upgrade cookie in the credentials\",\n        );\n      });\n    },\n    subscriptions,\n  );\n  add(\n    \"T-subscription-origin\",\n    \"subscriptions, queries and mutations on a socket whose upgrade carries a cookie and an untrusted Origin are denied, whatever connectionParams carry\",\n    async (env) => {\n      assert.ok(\n        options.invokeConnection,\n        \"the harness serves subscriptions, so invokeConnection is required\",\n      );\n      const other = await kitIdentity(env.auth);\n      const hostile = { cookie: env.identity.cookie, origin: UNTRUSTED_ORIGIN };\n      const contexts = options.graphqlContexts ?? [];\n      for (const graphqlContext of [\n        undefined,\n        ...(contexts.includes(\"fresh\") ? ([\"fresh\"] as const) : []),\n      ]) {\n        const label = graphqlContext\n          ? `a ${graphqlContext} GraphQL context`\n          : \"the driver's context\";\n        await withApp(\n          options,\n          env,\n          async ({ app }) => {\n            await subscriptionDenied(\n              app,\n              hostile,\n              `${label}: an untrusted Origin`,\n            );\n            // The browser leg keeps the upgrade cookie when connectionParams replace it in the credentials.\n            await subscriptionDenied(\n              app,\n              hostile,\n              `${label}: an untrusted Origin with a connectionParams cookie`,\n              { cookie: other.cookie },\n            );\n            await allowedOnConnection(\n              app,\n              cookie(env),\n              env.identity.userId,\n              `${label}: a trusted Origin`,\n            );\n          },\n          graphqlContext ? { graphqlContext } : {},\n        );\n      }\n      if (contexts.includes(\"plain-request\")) {\n        await withApp(\n          options,\n          env,\n          async ({ app, logger }) => {\n            const results = await options.invokeConnection!(\n              app,\n              [\"required\", \"unsafe\"],\n              cookie(env),\n            );\n            for (const result of results) {\n              internal(\n                result,\n                \"a context holding only the cookie in a plain req\",\n              );\n            }\n            assert.match(logger.text(), /GRAPHQL_CONTEXT_UNRECOGNIZED/);\n          },\n          { graphqlContext: \"plain-request\" },\n        );\n      }\n    },\n    subscriptions,\n  );\n  add(\n    \"T-subscription-origin-junk-connection-params\",\n    \"a junk connectionParams bearer token beside the victim's upgrade cookie from an untrusted Origin is denied for subscriptions and queries\",\n    async (env) => {\n      assert.ok(\n        options.invokeConnection,\n        \"the harness serves subscriptions, so invokeConnection is required\",\n      );\n      await withApp(options, env, async ({ app }) => {\n        // The harness carries a bearer token of a connection in connectionParams, where graphql-ws clients put it.\n        await subscriptionDenied(\n          app,\n          {\n            cookie: env.identity.cookie,\n            origin: UNTRUSTED_ORIGIN,\n            authorization: \"Bearer a.b\",\n          },\n          \"a junk connectionParams bearer token\",\n          { authorization: \"Bearer a.b\" },\n        );\n      });\n    },\n    subscriptions,\n  );\n  add(\"T-error-shape\", \"401, 403 and 429 carry code and reason\", (env) =>\n    withApp(options, env, async ({ app }) => {\n      const unauthenticated = await options.invoke(app, \"required\", {});\n      denied(unauthenticated, 401);\n      assert.equal(unauthenticated.error?.code, \"UNAUTHENTICATED\");\n      const forbidden = await options.invoke(app, \"forbidden\", cookie(env));\n      denied(forbidden, 403, \"CONFORMANCE_DENIED\");\n      assert.equal(forbidden.error?.code, \"FORBIDDEN\");\n      const limited = await options.invoke(app, \"acceptsApiKey\", {\n        \"x-api-key\": env.keys.limited,\n      });\n      denied(limited, 429, \"RATE_LIMITED\");\n      assert.equal(limited.error?.code, \"RATE_LIMITED\");\n      const invalid = await options.invoke(app, \"acceptsApiKey\", {\n        \"x-api-key\": \"unknown\",\n      });\n      denied(invalid, 401, \"INVALID_API_KEY\");\n    }),\n  );\n  add(\"T-no-error-log\", \"denials are not logged at ERROR\", (env) =>\n    withApp(options, env, async ({ app, logger }) => {\n      await options.invoke(app, \"required\", {});\n      await options.invoke(app, \"forbidden\", cookie(env));\n      await options.invoke(app, \"acceptsApiKey\", {\n        \"x-api-key\": env.keys.limited,\n      });\n      assert.deepEqual(\n        logger.errors().map((entry) => entry.text.slice(0, 200)),\n        [],\n      );\n    }),\n  );\n  add(\n    \"T-infra-5xx\",\n    \"a failing session store answers 5xx on protected handlers\",\n    (env) =>\n      withApp(options, env, async ({ app }) => {\n        env.probe.storageFault = () => new Error(\"conformance outage\");\n        const result = await options.invoke(app, \"required\", cookie(env));\n        env.probe.storageFault = undefined;\n        internal(result);\n        assert.notEqual(result.error?.statusCode, 401);\n        assert.notEqual(result.error?.statusCode, 403);\n      }),\n  );\n  add(\n    \"T-internal-error-generic\",\n    \"infrastructure and reader misconfiguration reach the client without detail\",\n    async (env) => {\n      await withApp(options, env, async ({ app, logger }) => {\n        const secret = `outage-${globalThis.crypto.randomUUID()}`;\n        env.probe.fault = (path) =>\n          path === \"/get-session\" ? new Error(secret) : undefined;\n        const result = await options.invoke(app, \"required\", cookie(env));\n        internal(result);\n        assert.ok(\n          !JSON.stringify(result.error).includes(secret),\n          \"the client saw the infrastructure detail\",\n        );\n        assert.ok(logger.errors().length > 0, \"nothing was logged at ERROR\");\n      });\n      env.probe.fault = undefined;\n      await withApp(\n        options,\n        env,\n        async ({ app, logger }) => {\n          const result = await options.invoke(app, \"unguarded\", cookie(env));\n          internal(result);\n          const client = JSON.stringify(result.error ?? {});\n          assert.ok(!client.includes(\"unguarded\"), `client saw ${client}`);\n          assert.ok(!client.includes(\"stampPrincipal\"), `client saw ${client}`);\n          assert.match(logger.text(), /NO_AUTH_RESULT/);\n        },\n        {\n          override: (builder) =>\n            overrideAuthGuard(builder, { canActivate: () => true }),\n        },\n      );\n    },\n  );\n  add(\n    \"T-internal-error-logged-once\",\n    \"one failing logical request logs one ERROR entry for all its invocations\",\n    async (env) =>\n      (await twiceReady(env)) ??\n      withApp(options, env, async ({ app, logger }) => {\n        const shapes = (options.invocationShapes ?? []).filter(\n          (shape) => shape === \"aliases\" || shape === \"batched\",\n        );\n        for (const shape of shapes) {\n          const errors = logger.errors().length;\n          env.probe.fault = (path) =>\n            path === \"/get-session\"\n              ? new Error(\"conformance outage\")\n              : undefined;\n          const results = await options.invokeTwice!(\n            app,\n            shape,\n            [{ orgId: \"org-a\" }, { orgId: \"org-a2\" }],\n            cookie(env),\n          );\n          env.probe.fault = undefined;\n          assert.deepEqual(\n            results.map((value) => value.ok),\n            [false, false],\n          );\n          assert.equal(\n            logger.errors().length - errors,\n            1,\n            `${shape}: ${logger.errors().length - errors} ERROR entries for one request`,\n          );\n        }\n      }),\n    twiceSkip &&\n      \"the transport has no lineage, so each error is logged once by construction\",\n  );\n  add(\n    \"T-internal-error-logged-once\",\n    \"reader configuration errors under 20 list items log one ERROR entry per request and distinct error, with field interceptors and with lineage alone\",\n    async (env) => {\n      const skip = await graphReady(env);\n      if (skip) {\n        return skip;\n      }\n      const apiKey = { \"x-api-key\": env.keys.valid };\n      /** One `items` operation: asserts 20 failed `field` values and returns the ERROR entries it logged. */\n      const items = async (\n        app: INestApplication,\n        logger: CapturingLogger,\n        fields: readonly (keyof GraphFixtures[\"fields\"])[],\n        headers: HeadersInit,\n        label: string,\n      ): Promise<string[]> => {\n        const from = logger.errors().length;\n        const result = await options.invokeGraph!(\n          app,\n          [{ root: \"items\", fields }],\n          headers,\n        );\n        const list = (result.data as Record<string, unknown> | null)?.items as\n          | readonly Record<string, unknown>[]\n          | null\n          | undefined;\n        assert.equal(\n          list?.length,\n          ITEM_COUNT,\n          `${label}: the items root did not return ${ITEM_COUNT} items: ${JSON.stringify(result).slice(0, 500)}`,\n        );\n        for (const field of fields) {\n          const failed = result.errors.filter(\n            (error) => error.path.at(-1) === field,\n          );\n          assert.equal(\n            failed.length,\n            ITEM_COUNT,\n            `${label}: ${failed.length} ${field} errors instead of one per item: ${JSON.stringify(result.errors).slice(0, 500)}`,\n          );\n          assert.ok(\n            list!.every((item) => item[field] === null),\n            `${label}: a ${field} value resolved`,\n          );\n          for (const error of failed) {\n            assert.ok(\n              !/[A-Z]+_[A-Z_]+/.test(error.message ?? \"\"),\n              `${label}: the client saw the configuration detail ${error.message}`,\n            );\n          }\n        }\n        assert.equal(\n          result.errors.length,\n          ITEM_COUNT * fields.length,\n          `${label}: ${JSON.stringify(result.errors).slice(0, 500)}`,\n        );\n        return logger\n          .errors()\n          .slice(from)\n          .map((entry) => entry.text);\n      };\n      const once = (entries: readonly string[], code: string, label: string) =>\n        assert.ok(\n          entries.length === 1 && entries[0]!.includes(code),\n          `${label}: expected one ERROR entry with ${code}, got ${entries.length}: ${entries.join(\" | \").slice(0, 500)}`,\n        );\n      // Readers throw configuration errors that share the guard's surfaced-error record. [R6:NEST-r6-02] [R7:NEST-r7-02]\n      for (const enhancers of [\n        [\"guards\", \"interceptors\", \"filters\"],\n        [\"guards\", \"filters\"],\n      ] as const) {\n        const scoped = enhancers.includes(\"interceptors\" as never);\n        const boot = `[${enhancers.join(\", \")}]`;\n        await withApp(\n          options,\n          env,\n          async ({ app, logger }) => {\n            // A second request logs again: the bound is per request, not per process.\n            for (const round of [1, 2]) {\n              const label = `${boot}, request ${round}`;\n              once(\n                await items(\n                  app,\n                  logger,\n                  [\"sessionReader\"],\n                  apiKey,\n                  `${label}: an API key's session readers`,\n                ),\n                \"SESSION_REQUIRED\",\n                `${label}: an API key's session readers`,\n              );\n              once(\n                await items(\n                  app,\n                  logger,\n                  [\"organizationReader\"],\n                  cookie(env),\n                  `${label}: organization readers without a providing requirement`,\n                ),\n                \"NO_INVOCATION_VALUE\",\n                `${label}: organization readers without a providing requirement`,\n              );\n              const service = await items(\n                app,\n                logger,\n                [\"serviceSession\"],\n                apiKey,\n                `${label}: service getSession() for an API key`,\n              );\n              // A field scope bounds service reads by the request; without one each fresh NO_AUTH_SCOPE is logged.\n              const code = scoped ? \"SESSION_REQUIRED\" : \"NO_AUTH_SCOPE\";\n              assert.equal(\n                service.length,\n                scoped ? 1 : ITEM_COUNT,\n                `${label}: service getSession() logged ${service.length} ERROR entries`,\n              );\n              assert.ok(\n                service.every((entry) => entry.includes(code)),\n                `${label}: service getSession() did not log ${code}: ${service.join(\" | \").slice(0, 500)}`,\n              );\n            }\n            // Distinct reasons of one request are not suppressed.\n            const distinct = await items(\n              app,\n              logger,\n              [\"sessionReader\", \"organizationReader\"],\n              apiKey,\n              `${boot}: session and organization readers together`,\n            );\n            assert.equal(\n              distinct.length,\n              2,\n              `${boot}: two reasons logged ${distinct.length} ERROR entries: ${distinct.join(\" | \").slice(0, 500)}`,\n            );\n            for (const code of [\"SESSION_REQUIRED\", \"NO_INVOCATION_VALUE\"]) {\n              assert.ok(\n                distinct.some((entry) => entry.includes(code)),\n                `${boot}: ${code} was suppressed by another reason`,\n              );\n            }\n          },\n          {\n            fieldResolverEnhancers: enhancers,\n            fixtures: kitFixtures({}, [], { readerErrors: true }),\n          },\n        );\n        // A guard that records no result leaves every nested reader without one. Without field interceptors such a\n        // guard also records no lineage, so a reader has no request key to share and each fresh error is logged.\n        if (!scoped) {\n          continue;\n        }\n        await withApp(\n          options,\n          env,\n          async ({ app, logger }) => {\n            once(\n              await items(\n                app,\n                logger,\n                [\"reader\"],\n                cookie(env),\n                `${boot}: readers without an authentication result`,\n              ),\n              \"NO_AUTH_RESULT\",\n              `${boot}: readers without an authentication result`,\n            );\n          },\n          {\n            fieldResolverEnhancers: enhancers,\n            fixtures: kitFixtures({}, [], { readerErrors: true }),\n            override: (builder) =>\n              overrideAuthGuard(builder, { canActivate: () => true }),\n          },\n        );\n      }\n    },\n    graphSkip,\n  );\n  add(\"T-public-no-lookup\", \"public handlers never read the session\", (env) =>\n    withApp(options, env, async ({ app }) => {\n      const from = env.probe.calls.length;\n      succeeded(await options.invoke(app, \"public\", cookie(env)));\n      assert.equal(sessionReads(env.probe, from), 0);\n    }),\n  );\n  add(\n    \"T-reads-session\",\n    \"session readers return the session, mixed-kind service reads throw SESSION_REQUIRED, and mixed-kind boots fail PRINCIPAL_PARAM_CONFLICT\",\n    async (env) => {\n      await withApp(options, env, async ({ app, logger }) => {\n        const result = await options.invoke(app, \"readsSession\", cookie(env));\n        succeeded(result);\n        assert.equal(\n          (result.body as { userId?: string }).userId,\n          env.identity.userId,\n        );\n        // Boot cannot see a service getSession() call in a mixed-kind handler: it warns, and the read throws.\n        assert.ok(\n          warningCodes(logger).has(\"W_MIXED_KIND_SESSION_READER\"),\n          `boot did not warn W_MIXED_KIND_SESSION_READER: ${logger.text().slice(0, 500)}`,\n        );\n        const session = await options.invoke(\n          app,\n          \"readsSessionService\",\n          cookie(env),\n        );\n        succeeded(session, \"a session caller of a mixed-kind getSession()\");\n        assert.equal(\n          (session.body as { userId?: string }).userId,\n          env.identity.userId,\n        );\n        const key = await options.invoke(app, \"readsSessionService\", {\n          \"x-api-key\": env.keys.valid,\n        });\n        internal(key);\n        assert.match(logger.text(), /SESSION_REQUIRED/);\n      });\n      await expectBootFailure(\n        options,\n        env,\n        {\n          fixtures: kitFixtures({\n            readsSession: [AcceptPrincipals(SESSION_KIND, API_KEY_KIND)],\n          }),\n        },\n        \"PRINCIPAL_PARAM_CONFLICT\",\n      );\n      await expectBootFailure(\n        options,\n        env,\n        { defaultRequirements: [sessionOrKey] },\n        \"PRINCIPAL_PARAM_CONFLICT\",\n      );\n    },\n  );\n  add(\n    \"T-scope\",\n    \"param decorators and the service see the same reading\",\n    (env) =>\n      withApp(options, env, async ({ app }) => {\n        const result = await options.invoke(app, \"readsSession\", cookie(env));\n        succeeded(result);\n        assert.deepEqual(result.body, {\n          userId: env.identity.userId,\n          service: env.identity.userId,\n        });\n      }),\n  );\n  add(\n    \"T-carrier\",\n    \"param decorators read the guard's reading with and without the scope interceptor, one value per invocation\",\n    async (env) => {\n      for (const globalScope of [true, false]) {\n        const label = globalScope\n          ? \"with the scope interceptor\"\n          : \"with globalScope: false\";\n        await withApp(\n          options,\n          env,\n          async ({ app }) => {\n            const byCookie = await options.invoke(app, \"required\", cookie(env));\n            succeeded(byCookie, `${label}: a cookie`);\n            assert.deepEqual(principalOf(byCookie), {\n              kind: \"session\",\n              userId: env.identity.userId,\n            });\n            const byKey = await options.invoke(app, \"acceptsApiKey\", {\n              \"x-api-key\": env.keys.valid,\n            });\n            succeeded(byKey, `${label}: an API key`);\n            assert.equal(principalOf(byKey)?.kind, \"api-key\", label);\n            const org = await options.invoke(app, \"org\", cookie(env), {\n              orgId: \"org-a\",\n            });\n            succeeded(org, `${label}: @ActiveOrganizationId()`);\n            assert.deepEqual(org.body, { organization: \"org-a\" }, label);\n            // The org fixture fails when @ActiveOrganizationId() answers another invocation's organization.\n            for (const shape of options.invocationShapes ?? []) {\n              const values = await options.invokeTwice!(\n                app,\n                shape,\n                [{ orgId: \"org-a\" }, { orgId: \"org-a2\" }],\n                cookie(env),\n              );\n              assert.deepEqual(\n                values.map((value) => value.ok),\n                [true, true],\n                `${label}, ${shape}: ${JSON.stringify(values)}`,\n              );\n            }\n          },\n          globalScope ? {} : { globalScope: false },\n        );\n      }\n    },\n  );\n  add(\n    \"T-coverage-claims\",\n    \"unguarded boots report exactly the claimed fixtures, and explicit enhancers, app enhancers, global stand-ins and globalScope: false boot\",\n    async (env) => {\n      let claims: RecordedClaim[] = [];\n      const expected = new Map<string, string>();\n      const defaults = new CapturingLogger();\n      await withApp(\n        options,\n        env,\n        async ({ app }) => {\n          claims = await recordClaims(app, options.transport);\n          const planner = app.get<RoutePlanner>(ROUTE_PLANNER, {\n            strict: false,\n          });\n          for (const claim of claims) {\n            if (\n              !claim.fixture ||\n              claim.method === undefined ||\n              (claim.options.coverage ?? \"error\") !== \"error\"\n            ) {\n              continue;\n            }\n            const plan: RoutePlan = planner.plan(\n              claim.target as Type,\n              claim.method,\n            );\n            const accessCovered =\n              (plan.access === \"public\" || plan.access === \"inherit\") &&\n              plan.originCheck !== \"form\";\n            if (\n              !accessCovered &&\n              (claim.options.everyHandler || plan.declares)\n            ) {\n              expected.set(claim.fixture, claim.options.code);\n            }\n          }\n        },\n        { logSummary: true },\n        defaults,\n      );\n      assert.ok(\n        claims.some((claim) => claim.fixture),\n        \"the transport claimed none of the kit's fixture handlers\",\n      );\n      assert.match(\n        summaryLine(defaults),\n        /; scope: global;/,\n        \"the default boot's summary does not report the global scope interceptor\",\n      );\n      // Boot 3: the bare fixtures fail with exactly the handlers B16 reports, each with its claim's code, and boot\n      // when no claim calls for a report.\n      const bare = await settle(() =>\n        withApp(options, env, async () => undefined, { globalGuard: false }),\n      );\n      assert.equal(\n        bare.ok,\n        expected.size === 0,\n        bare.ok\n          ? `the bare fixtures booted, but the claims call for reports of ${JSON.stringify([...expected])}`\n          : `no claim calls for a coverage report, but boot failed: ${String(bare.error)}`,\n      );\n      const issues = ((!bare.ok &&\n        (bare.error as { issues?: unknown } | undefined)?.issues) ||\n        []) as readonly { code?: string; detail?: string }[];\n      const reported = new Map<string, string>();\n      for (const claim of claims) {\n        if (!claim.fixture || claim.method === undefined) {\n          continue;\n        }\n        const site = `${claim.target.name}.${claim.method} `;\n        const issue = issues.find((value) =>\n          String(value.detail ?? \"\").startsWith(site),\n        );\n        if (issue?.code) {\n          reported.set(claim.fixture, issue.code);\n        }\n      }\n      assert.deepEqual(\n        [...reported].sort(),\n        [...expected].sort(),\n        `B16 reported ${JSON.stringify([...reported])}, the claims call for ${JSON.stringify([...expected])}`,\n      );\n      if (\n        claims.some(\n          (claim) =>\n            claim.fixture === \"loginProxy\" &&\n            (claim.options.coverage ?? \"error\") === \"error\",\n        )\n      ) {\n        assert.ok(\n          reported.has(\"loginProxy\"),\n          \"@Public() must not cover a form-mode forwarding handler\",\n        );\n      }\n      for (const name of [\"public\", \"publicService\"]) {\n        assert.ok(!reported.has(name), `${name} was reported`);\n      }\n      if (claims.some((claim) => claim.fixture && claim.reach === \"explicit\")) {\n        await expectBootFailure(\n          options,\n          env,\n          {\n            globalGuard: false,\n            fixtures: kitFixtures({}, [UseGuards(BetterAuthGuard)]),\n          },\n          \"AUTH_BOOT_FAILED\",\n        );\n      }\n      await withApp(options, env, async () => undefined, {\n        globalGuard: false,\n        fixtures: kitFixtures({}, [UseBetterAuth()]),\n      });\n      const global = claims.some(\n        (claim) => claim.fixture && claim.reach === \"global\",\n      );\n      if (global) {\n        await withApp(options, env, async () => undefined, {\n          globalGuard: false,\n          appEnhancers: true,\n        });\n      }\n      // Boot 4: a replaced global guard is still the global guard.\n      const standIn = { canActivate: async () => true };\n      await withApp(options, env, async () => undefined, {\n        override: (builder) =>\n          builder.overrideProvider(BetterAuthGuard).useValue(standIn),\n      });\n      class StandInGuard {\n        canActivate(): boolean {\n          return true;\n        }\n      }\n      await withApp(options, env, async () => undefined, {\n        override: (builder) =>\n          builder.overrideProvider(BetterAuthGuard).useClass(StandInGuard),\n      });\n      if (global) {\n        const unscoped = new CapturingLogger();\n        await withApp(\n          options,\n          env,\n          async () => undefined,\n          { globalScope: false, logSummary: true },\n          unscoped,\n        );\n        const added = [...warningCodes(unscoped)].filter(\n          (code) => !warningCodes(defaults).has(code),\n        );\n        assert.deepEqual(\n          added,\n          [\"W_NO_GLOBAL_SCOPE\"],\n          `globalScope: false must boot global claims with W_NO_GLOBAL_SCOPE only (pass the logger option to the app): ${unscoped.text().slice(0, 500)}`,\n        );\n        // The summary reports the missing interceptor too. [R6:SEC-r6-03]\n        assert.match(\n          summaryLine(unscoped),\n          /; scope: off — see W_NO_GLOBAL_SCOPE;/,\n          \"globalScope: false: the boot summary does not report scope: off\",\n        );\n      }\n    },\n  );\n  add(\n    \"T-metadata-canary\",\n    \"validate() fails NEST_METADATA_KEY_CHANGED when Nest writes its metadata under other keys, and claims no class without handlers\",\n    (env) =>\n      withApp(options, env, async ({ app }) => {\n        // The boot ran the transport's canaries against the installed Nest.\n        const claims = await recordClaims(app, options.transport);\n        assert.ok(\n          claims.some((claim) => claim.fixture),\n          \"the transport claimed none of the kit's fixture handlers\",\n        );\n        const clones = [...new Set(claims.map((claim) => claim.target))].map(\n          withoutHandlers,\n        );\n        const extra = await recordClaims(app, options.transport, {\n          classes: clones,\n        });\n        assert.deepEqual(\n          extra\n            .filter((claim) => clones.includes(claim.target))\n            .map((claim) => `${claim.target.name}.${String(claim.method)}`),\n          [],\n          \"the transport claimed a class without handlers\",\n        );\n        const renamed = await settle(() =>\n          recordClaims(app, options.transport, { renameMetadata: true }),\n        );\n        assert.equal(\n          renamed.ok,\n          false,\n          \"validate() passed while Nest wrote its metadata under other keys: the transport runs no metadata canary\",\n        );\n        assert.ok(\n          bootIssueCodes(!renamed.ok && renamed.error).includes(\n            \"NEST_METADATA_KEY_CHANGED\",\n          ),\n          `expected NEST_METADATA_KEY_CHANGED, got ${String(!renamed.ok && renamed.error)}`,\n        );\n      }),\n  );\n  add(\n    \"T-unsatisfiable-kinds\",\n    \"default requirements that admit no common kind fail boot unless skipped\",\n    async (env) => {\n      await expectBootFailure(\n        options,\n        env,\n        {\n          defaultRequirements: [sessionOnly],\n          fixtures: kitFixtures({ acceptsApiKey: [Require(apiKeyOnly)] }),\n        },\n        \"UNSATISFIABLE_PRINCIPAL_KINDS\",\n      );\n      await expectBootFailure(\n        options,\n        env,\n        {\n          defaultRequirements: [unnamedKinds],\n          fixtures: kitFixtures({ acceptsApiKey: [Require(apiKeyOnly)] }),\n        },\n        \"UNSATISFIABLE_PRINCIPAL_KINDS\",\n      );\n      await withApp(\n        options,\n        env,\n        async ({ app }) => {\n          const result = await options.invoke(app, \"acceptsApiKey\", {\n            \"x-api-key\": env.keys.valid,\n          });\n          succeeded(result);\n          assert.equal(principalOf(result)?.kind, \"api-key\");\n        },\n        {\n          defaultRequirements: [sessionOnly],\n          fixtures: kitFixtures({\n            acceptsApiKey: [Require(apiKeyOnly), SkipDefaultRequirements()],\n          }),\n        },\n      );\n    },\n  );\n  add(\n    \"T-public-service-null\",\n    \"a public unsafe handler's service reads null without a session read\",\n    (env) =>\n      withApp(options, env, async ({ app }) => {\n        const from = env.probe.calls.length;\n        const result = await options.invoke(app, \"publicService\", {\n          ...cookie(env),\n          origin: UNTRUSTED_ORIGIN,\n        });\n        succeeded(result);\n        assert.deepEqual(result.body, { session: null });\n        assert.equal(sessionReads(env.probe, from), 0);\n      }),\n  );\n  addRun(\n    \"T-dynamic-base-url\",\n    \"with a dynamic baseURL without fallback, a transport with hostless calls fails boot and any other resolves every credential shape\",\n    async () => {\n      let hostless = false;\n      await withApp(\n        options,\n        await kitEnvironment({ baseURL: dynamicBaseURL }),\n        async ({ app }) => {\n          hostless =\n            resolvedTransport(app, options.transport).requires\n              ?.hostlessCalls === true;\n        },\n      );\n      const env = await kitEnvironment({ baseURL: { allowedHosts: [host] } });\n      if (hostless) {\n        await expectBootFailure(\n          options,\n          env,\n          {},\n          \"DYNAMIC_BASE_URL_WITHOUT_FALLBACK\",\n        );\n        return;\n      }\n      await withApp(options, env, async ({ app }) => {\n        for (const [handler, headers, kind] of [\n          [\"required\", cookie(env), \"session\"],\n          [\n            \"required\",\n            { authorization: `Bearer ${env.identity.token}` },\n            \"session\",\n          ],\n          [\"acceptsApiKey\", { \"x-api-key\": env.keys.valid }, \"api-key\"],\n        ] as const) {\n          const result = await options.invoke(app, handler, {\n            ...headers,\n            host,\n          });\n          succeeded(result, `a ${kind} credential (${Object.keys(headers)})`);\n          assert.deepEqual(principalOf(result), {\n            kind,\n            userId: env.identity.userId,\n          });\n        }\n      });\n    },\n  );\n  add(\n    \"T-public-direct-invalid-context\",\n    \"public work runs without extraction; guarded and forwarding work fails closed before side effects\",\n    async (env) => {\n      const user = await kitIdentity(env.auth, { password: true });\n      await withApp(options, env, async ({ app, instrumentation }) => {\n        instrumentation.consumed.length = 0;\n        succeeded(await options.invoke(app, \"public\", cookie(env)));\n        succeeded(await options.invoke(app, \"publicService\", cookie(env)));\n        assert.deepEqual(\n          instrumentation.consumed,\n          [],\n          \"public scope construction consumed request-dependent capabilities\",\n        );\n        instrumentation.unavailable = true;\n        succeeded(await options.invoke(app, \"public\", cookie(env)));\n        const guarded = await options.invoke(app, \"required\", cookie(env));\n        internal(guarded);\n        const signIns = env.probe.calls.filter(\n          (path) => path === \"/sign-in/email\",\n        ).length;\n        const proxy = await options.invoke(\n          app,\n          \"loginProxy\",\n          { origin: KIT_BASE_URL },\n          { email: user.email, password: user.password },\n        );\n        internal(proxy);\n        assert.deepEqual(proxy.setCookies, []);\n        assert.equal(\n          env.probe.calls.filter((path) => path === \"/sign-in/email\").length,\n          signIns,\n          \"a forwarding handler reached Better Auth without extraction\",\n        );\n      });\n    },\n  );\n  const noInherited =\n    \"the harness exposes no inherited handler through two subclasses (invokeInherited)\";\n  addRun(\n    \"T-inherited-handler\",\n    \"one inherited method answers per subclass, public then protected and the other way round\",\n    async () => {\n      for (const order of [\n        [\"public\", \"denied\"],\n        [\"denied\", \"public\"],\n      ] as const) {\n        // A fresh boot per order: the first request of a boot fills the plan cache.\n        const env = await kitEnvironment();\n        await withApp(options, env, async ({ app }) => {\n          for (let round = 0; round < 2; round++) {\n            for (const subclass of order) {\n              const label = `${order.join(\" first, then \")}, round ${round + 1}: the ${subclass} subclass`;\n              const result = await options.invokeInherited!(\n                app,\n                subclass,\n                cookie(env),\n              );\n              if (subclass === \"public\") {\n                succeeded(result, label);\n              } else {\n                denied(result, 403, \"CONFORMANCE_DENIED\", label);\n              }\n            }\n          }\n        });\n      }\n    },\n    options.invokeInherited ? undefined : noInherited,\n  );\n  addRun(\n    \"T-stale-context\",\n    \"a static GraphQL context fails boot, and a cached one never answers a later caller with an earlier caller's principal\",\n    async () => {\n      const env = await kitEnvironment();\n      if (!(await transportHas(options, env, \"defaultAccessFor\"))) {\n        return conformanceSkip(\n          \"the transport nests no handlers, so it serves no GraphQL context\",\n        );\n      }\n      const contexts = options.graphqlContexts ?? [];\n      assert.ok(\n        contexts.includes(\"static\") && contexts.includes(\"cached\"),\n        \"the transport nests handlers, so graphqlContexts must include 'static' and 'cached'\",\n      );\n      await expectBootFailure(\n        options,\n        env,\n        { graphqlContext: \"static\" },\n        \"GRAPHQL_STATIC_CONTEXT\",\n      );\n      // The first caller finishes before a later caller runs: its request completes, or, where the browser leg is the\n      // connection's handshake, its connection closes; invokeConnection resolves after the server observed the close.\n      const connection = await connectionLeg();\n      assert.ok(\n        !connection || options.invokeConnection,\n        \"the transport's browser leg is its connection's handshake, so invokeConnection is required\",\n      );\n      const invokeAlone = async (\n        app: INestApplication,\n        handler: \"required\" | \"optional\" | \"public\" | \"publicService\",\n        headers: HeadersInit,\n      ): Promise<TransportInvocationResult> =>\n        connection\n          ? (await options.invokeConnection!(app, [handler], headers))[0]!\n          : options.invoke(app, handler, headers);\n      const later = await kitIdentity(env.auth);\n      const laterCookie = { ...cookie(env), cookie: later.cookie };\n      await withApp(\n        options,\n        env,\n        async ({ app, logger }) => {\n          const first = await invokeAlone(app, \"required\", cookie(env));\n          succeeded(first, \"the first caller of a cached context\");\n          assert.equal(principalOf(first)?.userId, env.identity.userId);\n          for (const handler of [\"required\", \"optional\"] as const) {\n            const result = await invokeAlone(app, handler, laterCookie);\n            const label = `a later caller of ${handler}`;\n            if (connection) {\n              // A connection that is closed when an operation starts lends it no credential: the operation runs\n              // anonymously, or with the later caller's own principal where the driver rebuilds its context.\n              assert.notEqual(\n                principalOf(result)?.userId,\n                env.identity.userId,\n                `${label} read the first caller's principal`,\n              );\n              if (result.ok) {\n                const principal = principalOf(result);\n                assert.ok(\n                  principal === null || principal?.userId === later.userId,\n                  `${label} read neither its own principal nor none: ${JSON.stringify(result.body)}`,\n                );\n              } else {\n                denied(result, 401, undefined, label);\n              }\n              continue;\n            }\n            // A driver that rebuilds its context around the cached object answers with the later caller's own principal.\n            if (result.ok) {\n              assert.equal(\n                principalOf(result)?.userId,\n                later.userId,\n                `${label} did not read its own principal`,\n              );\n            } else {\n              internal(result, label);\n              assert.match(logger.text(), /GRAPHQL_CONTEXT_STALE_REQUEST/);\n            }\n          }\n          // Public work reads no credential of the completed request or closed connection.\n          succeeded(\n            await invokeAlone(app, \"public\", laterCookie),\n            \"a later caller of a public handler\",\n          );\n          const service = await invokeAlone(app, \"publicService\", laterCookie);\n          succeeded(service, \"a later caller of a public service read\");\n          assert.deepEqual(service.body, { session: null });\n          if (connection) {\n            // A closed connection is an ordinary client outcome, not a configuration error.\n            assert.deepEqual(\n              logger.errors().map((entry) => entry.text.slice(0, 200)),\n              [],\n              \"a later caller of a closed connection's context logged at ERROR\",\n            );\n            assert.doesNotMatch(\n              logger.text(),\n              /AUTH_MISCONFIGURED|GRAPHQL_CONTEXT_STALE_REQUEST/,\n            );\n          }\n        },\n        { graphqlContext: \"cached\" },\n      );\n    },\n  );\n  /** The claimed site of each graph fixture handler of a booted app, by fixture name. */\n  const graphSites = async (app: INestApplication) => {\n    const sites = new Map<string, { target: Type; method: string }>();\n    for (const claim of await recordClaims(app, options.transport)) {\n      if (claim.fixture?.startsWith(\"graph.\") && claim.method !== undefined) {\n        sites.set(claim.fixture.slice(\"graph.\".length), {\n          target: claim.target as Type,\n          method: claim.method,\n        });\n      }\n    }\n    return sites;\n  };\n  const graphSite = (\n    sites: Map<string, { target: Type; method: string }>,\n    name: string,\n  ) => {\n    const site = sites.get(name);\n    assert.ok(site, `the transport claimed no ${name} graph handler`);\n    return site;\n  };\n  const planAt = (\n    app: INestApplication,\n    site: { target: Type; method: string },\n  ): RoutePlan =>\n    app\n      .get<RoutePlanner>(ROUTE_PLANNER, { strict: false })\n      .plan(site.target, site.method);\n  /** The boot advice lines a logger captured for one code. */\n  const adviceLines = (logger: CapturingLogger, code: string) =>\n    logger.entries\n      .map((entry) => entry.text)\n      .filter((text) => text.startsWith(`${code}:`));\n  add(\n    \"T-inherit-no-lookup\",\n    \"an anonymous public operation with an inheriting field reads no session, a guarded field is still enforced, and class-level metadata reaches operations only\",\n    async (env) => {\n      const skip = await graphReady(env);\n      if (skip) {\n        return skip;\n      }\n      for (const enhancers of enhancerBoots) {\n        const guarded = enhancers.length > 0;\n        const logger = new CapturingLogger();\n        await withApp(\n          options,\n          env,\n          async ({ app }) => {\n            const from = env.probe.calls.length;\n            const result = await options.invokeGraph!(\n              app,\n              [{ root: \"public\", fields: [\"plain\"] }],\n              {},\n            );\n            assert.deepEqual(\n              result.errors,\n              [],\n              `[${enhancers.join(\", \")}]: ${JSON.stringify(result.errors)}`,\n            );\n            assert.equal(\n              sessionReads(env.probe, from),\n              0,\n              `[${enhancers.join(\", \")}]: an inheriting field read the session`,\n            );\n            if (guarded) {\n              const field = await options.invokeGraph!(\n                app,\n                [{ root: \"public\", fields: [\"guarded\"] }],\n                {},\n              );\n              assert.ok(\n                field.errors.length > 0 &&\n                  field.errors.every(\n                    (error) => error.code === \"UNAUTHENTICATED\",\n                  ),\n                `a guarded field under a public root was not denied: ${JSON.stringify(field.errors)}`,\n              );\n            }\n            const sites = await graphSites(app);\n            const [warning] = adviceLines(logger, \"W_FIELD_RESOLVER_INHERITS\");\n            assert.ok(\n              warning,\n              `[${enhancers.join(\", \")}]: boot did not warn W_FIELD_RESOLVER_INHERITS`,\n            );\n            const inheriting = warning.slice(\n              0,\n              warning.indexOf(\" inherit readings\"),\n            );\n            for (const field of [\"plain\", \"reader\"]) {\n              const site = graphSite(sites, field);\n              assert.ok(\n                inheriting.includes(`${site.target.name}.${site.method}`),\n                `W_FIELD_RESOLVER_INHERITS does not list ${field}: ${warning}`,\n              );\n            }\n          },\n          {\n            fieldResolverEnhancers: enhancers,\n            fixtures: kitFixtures({}, [], { guarded }),\n          },\n          logger,\n        );\n      }\n      // Class-level acceptance reaches the operations of the resolver class, never its field resolvers. [R3:NEST-r3-05]\n      for (const enhancers of enhancerBoots) {\n        const logger = new CapturingLogger();\n        const label = `class-level @AcceptPrincipals, [${enhancers.join(\", \")}]`;\n        await withApp(\n          options,\n          env,\n          async ({ app }) => {\n            const sites = await graphSites(app);\n            for (const field of [\"plain\", \"reader\", \"sessionReader\"]) {\n              assert.equal(\n                planAt(app, graphSite(sites, field)).access,\n                \"inherit\",\n                `${label}: the ${field} field resolver lost its inherit plan`,\n              );\n            }\n            const root = graphSite(sites, \"sessionOnly\");\n            assert.deepEqual(\n              [...planAt(app, root).accepts].sort(),\n              [API_KEY_KIND, SESSION_KIND],\n              `${label}: the class-level acceptance did not reach the root field`,\n            );\n            const from = env.probe.calls.length;\n            const result = await options.invokeGraph!(\n              app,\n              [{ root: \"public\", fields: [\"plain\", \"reader\"] }],\n              {},\n            );\n            assert.deepEqual(\n              result.errors,\n              [],\n              `${label}: ${JSON.stringify(result.errors)}`,\n            );\n            assert.equal(sessionReads(env.probe, from), 0, label);\n            const [info] = adviceLines(\n              logger,\n              \"I_CLASS_METADATA_OPERATIONS_ONLY\",\n            );\n            assert.ok(\n              info?.includes(root.target.name),\n              `${label}: I_CLASS_METADATA_OPERATIONS_ONLY does not name ${root.target.name}: ${info}`,\n            );\n            for (const field of [\"plain\", \"reader\"]) {\n              assert.ok(\n                info.includes(graphSite(sites, field).method),\n                `${label}: I_CLASS_METADATA_OPERATIONS_ONLY does not name the ${field} field: ${info}`,\n              );\n            }\n          },\n          {\n            fieldResolverEnhancers: enhancers,\n            fixtures: kitFixtures({}, [], {\n              guarded: enhancers.length > 0,\n              classDecorators: [AcceptPrincipals(SESSION_KIND, API_KEY_KIND)],\n            }),\n          },\n          logger,\n        );\n      }\n    },\n    graphSkip,\n  );\n  add(\n    \"T-stamp-per-plan\",\n    \"a nested reader reads its own enclosing field's reading, whichever source settles first\",\n    async (env) => {\n      const skip = await graphReady(env);\n      if (skip) {\n        return skip;\n      }\n      // User Y's cookie and user X's key in one operation.\n      env.keys.owner = (await kitIdentity(env.auth)).userId;\n      const userY = env.identity.userId;\n      const headers = { ...cookie(env), \"x-api-key\": env.keys.valid };\n      for (const enhancers of enhancerBoots) {\n        const guarded = enhancers.length > 0;\n        const logger = new CapturingLogger();\n        await withApp(\n          options,\n          env,\n          async ({ app }) => {\n            for (const delays of [\n              { session: 0, apiKey: 30 },\n              { session: 30, apiKey: 0 },\n            ]) {\n              env.probe.delay = (path) =>\n                path === \"/get-session\" ? delays.session : undefined;\n              env.keys.delayMs = delays.apiKey;\n              const label = `[${enhancers.join(\", \")}] session ${delays.session} ms, key ${delays.apiKey} ms`;\n              try {\n                const result = await options.invokeGraph!(\n                  app,\n                  [\n                    { root: \"sessionOnly\", fields: [\"reader\", \"publicNested\"] },\n                    {\n                      root: \"mixed\",\n                      fields: guarded ? [\"reader\", \"guarded\"] : [\"reader\"],\n                    },\n                    { root: \"public\", fields: [\"reader\"] },\n                  ],\n                  headers,\n                  { delays },\n                );\n                assert.ok(\n                  result.errors.every(\n                    (error) => error.reason !== \"NO_AUTH_RESULT\",\n                  ),\n                  `${label}: ${JSON.stringify(result.errors)}`,\n                );\n                assert.deepEqual(\n                  result.errors,\n                  [],\n                  `${label}: ${JSON.stringify(result.errors)}`,\n                );\n                assert.equal(\n                  userOf(graphOf(result, \"sessionOnly\", \"reader\")),\n                  userY,\n                  `${label}: reader under sessionOnly`,\n                );\n                assert.equal(\n                  userOf(\n                    (\n                      graphOf(result, \"sessionOnly\", \"publicNested\") as {\n                        reader?: unknown;\n                      } | null\n                    )?.reader,\n                  ),\n                  userY,\n                  `${label}: reader under publicNested under sessionOnly`,\n                );\n                assert.equal(\n                  userOf(graphOf(result, \"mixed\", \"reader\")),\n                  userOf(graphOf(result, \"mixed\")),\n                  `${label}: reader under mixed must read mixed's own principal`,\n                );\n                assert.equal(\n                  userOf(graphOf(result, \"public\", \"reader\")),\n                  null,\n                  `${label}: reader under public`,\n                );\n                if (guarded) {\n                  const node = graphOf(result, \"mixed\", \"guarded\") as {\n                    principal?: { userId?: string };\n                    nestedReader?: unknown;\n                  } | null;\n                  assert.equal(\n                    node?.principal?.userId,\n                    userY,\n                    `${label}: guarded under mixed accepts sessions only`,\n                  );\n                  assert.equal(\n                    userOf(node?.nestedReader),\n                    userY,\n                    `${label}: nestedReader under guarded must read guarded's own principal`,\n                  );\n                }\n              } finally {\n                env.probe.delay = undefined;\n                env.keys.delayMs = 0;\n              }\n            }\n            const alone = await options.invokeGraph!(\n              app,\n              [{ root: \"public\", fields: [\"reader\"] }],\n              headers,\n            );\n            assert.deepEqual(alone.errors, [], JSON.stringify(alone.errors));\n            assert.equal(\n              userOf(graphOf(alone, \"public\", \"reader\")),\n              null,\n              \"reader under a public root without a guarded sibling\",\n            );\n            // A nested session reader under a root that accepts API keys. [R5:NEST-r5-03]\n            const sessionReader: GraphSelection[] = [\n              { root: \"mixed\", fields: [\"sessionReader\"] },\n            ];\n            const bySession = await options.invokeGraph!(\n              app,\n              sessionReader,\n              cookie(env),\n            );\n            assert.deepEqual(\n              bySession.errors,\n              [],\n              JSON.stringify(bySession.errors),\n            );\n            assert.equal(graphOf(bySession, \"mixed\", \"sessionReader\"), userY);\n            const byKey = await options.invokeGraph!(app, sessionReader, {\n              \"x-api-key\": env.keys.valid,\n            });\n            assert.ok(\n              byKey.errors.length === 1 &&\n                byKey.errors[0]!.path.includes(\"sessionReader\"),\n              `an API key's nested session read did not fail at the field: ${JSON.stringify(byKey)}`,\n            );\n            assert.equal(graphOf(byKey, \"mixed\", \"sessionReader\"), null);\n            assert.match(logger.text(), /SESSION_REQUIRED/);\n            const sessionSite = graphSite(\n              await graphSites(app),\n              \"sessionReader\",\n            );\n            assert.ok(\n              adviceLines(logger, \"W_NESTED_PRINCIPAL_PARAM\").some((line) =>\n                line.includes(\n                  `${sessionSite.target.name}.${sessionSite.method}`,\n                ),\n              ),\n              \"boot did not list sessionReader in W_NESTED_PRINCIPAL_PARAM\",\n            );\n          },\n          {\n            fieldResolverEnhancers: enhancers,\n            fixtures: kitFixtures({}, [], { guarded }),\n          },\n          logger,\n        );\n      }\n      // Instance-wide forwarding puts publicNested in form mode; the reading below it stays the root's. [R5:NEST-r5-05]\n      for (const enhancers of enhancerBoots) {\n        await withApp(\n          options,\n          env,\n          async ({ app }) => {\n            const result = await options.invokeGraph!(\n              app,\n              [{ root: \"sessionOnly\", fields: [\"publicNested\"] }],\n              { ...cookie(env), origin: KIT_BASE_URL },\n            );\n            const label = `cookies.forwardDirectCalls, [${enhancers.join(\", \")}]`;\n            assert.deepEqual(\n              result.errors,\n              [],\n              `${label}: ${JSON.stringify(result.errors)}`,\n            );\n            assert.equal(\n              userOf(\n                (\n                  graphOf(result, \"sessionOnly\", \"publicNested\") as {\n                    reader?: unknown;\n                  } | null\n                )?.reader,\n              ),\n              userY,\n              `${label}: reader under publicNested under sessionOnly`,\n            );\n          },\n          {\n            fieldResolverEnhancers: enhancers,\n            forwardDirectCalls: true,\n            fieldResolverCoverage: \"warn\",\n            fixtures: kitFixtures(),\n          },\n        );\n      }\n    },\n    graphSkip,\n  );\n  const federation = (graph: GraphBoot = {}): BootOptions => ({\n    federation: true,\n    fieldResolverEnhancers: [\"guards\", \"interceptors\"],\n    fixtures: kitFixtures({}, [], { guarded: true, reference: true, ...graph }),\n  });\n  add(\n    \"T-reference-resolver\",\n    \"federation reference resolvers need field guards and decide each entity, and inheriting entity fields need one\",\n    async (env) => {\n      if (!options.invokeEntities) {\n        if (!(await transportHas(options, env, \"defaultAccessFor\"))) {\n          return conformanceSkip(\n            \"the transport nests no handlers, so it serves no federation reference resolvers\",\n          );\n        }\n        let claimed = false;\n        await withApp(\n          options,\n          env,\n          async ({ app }) => {\n            claimed = (await recordClaims(app, options.transport)).some(\n              (claim) => claim.fixture === \"reference\",\n            );\n          },\n          federation(),\n        );\n        assert.equal(\n          claimed,\n          false,\n          \"the transport claims the federation reference resolver, so invokeEntities is required\",\n        );\n        return conformanceSkip(\n          \"the transport claims no reference resolver and gives no invokeEntities\",\n        );\n      }\n      await expectBootFailure(\n        options,\n        env,\n        { ...federation(), fieldResolverEnhancers: undefined },\n        [\"REFERENCE_RESOLVER_UNGUARDED\", \"FEDERATION_FIELD_GUARDS_REQUIRED\"],\n      );\n      const representations = [\n        { __typename: \"FixtureNode\", id: \"1\", orgId: \"org-a\" },\n        { __typename: \"FixtureNode\", id: \"2\", orgId: \"org-b\" },\n      ];\n      await withApp(\n        options,\n        env,\n        async ({ app }) => {\n          const anonymous = await options.invokeEntities!(\n            app,\n            representations,\n            [\"plain\"],\n            {},\n          );\n          assert.ok(\n            anonymous.errors.length >= 2 &&\n              anonymous.errors.every(\n                (error) => error.code === \"UNAUTHENTICATED\",\n              ),\n            JSON.stringify(anonymous.errors),\n          );\n          const decided = await options.invokeEntities!(\n            app,\n            representations,\n            [\"plain\", \"reader\"],\n            cookie(env),\n          );\n          assert.equal(\n            decided.errors.length,\n            1,\n            `two representations were not decided independently: ${JSON.stringify(decided.errors)}`,\n          );\n          assert.equal(decided.errors[0]!.reason, \"MISSING_PERMISSION\");\n          assert.ok(\n            decided.errors[0]!.path.includes(1),\n            JSON.stringify(decided.errors),\n          );\n          const [entity] =\n            (decided.data as { _entities?: unknown[] } | null)?._entities ?? [];\n          assert.equal(\n            userOf((entity as { reader?: unknown } | undefined)?.reader),\n            env.identity.userId,\n            `reader under _entities.0 must read the reference resolver's reading: ${JSON.stringify(decided.data)}`,\n          );\n        },\n        federation(),\n      );\n      // Without a reference resolver no guard decides the entity, so its inheriting fields answer the generic 500 of\n      // NO_ENCLOSING_DECISION.\n      await withApp(\n        options,\n        env,\n        async ({ app }) => {\n          const result = await options.invokeEntities!(\n            app,\n            representations.slice(0, 1),\n            [\"plain\", \"reader\"],\n            cookie(env),\n          );\n          const [entity] = ((result.data as { _entities?: unknown[] } | null)\n            ?._entities ?? []) as ({\n            plain?: unknown;\n            reader?: unknown;\n          } | null)[];\n          assert.ok(\n            entity?.plain == null && entity?.reader == null,\n            `an entity without a reference resolver answered data: ${JSON.stringify(result.data)}`,\n          );\n          for (const field of [\"plain\", \"reader\"]) {\n            assert.ok(\n              result.errors.some(\n                (error) =>\n                  error.path.includes(field) &&\n                  error.code !== \"UNAUTHENTICATED\" &&\n                  error.code !== \"FORBIDDEN\",\n              ),\n              `${field} did not answer the generic internal error: ${JSON.stringify(result.errors)}`,\n            );\n          }\n        },\n        federation({ reference: false }),\n      );\n      // A class-level organization requirement reaches the reference resolver, whose representation carries orgId.\n      // [R5:NEST-r5-02]\n      const orgEnv = await kitEnvironment({ plugins: [organization()] });\n      const member = await createKitOrganization(orgEnv);\n      await withApp(\n        options,\n        orgEnv,\n        async ({ app, logger }) => {\n          const reference = (await recordClaims(app, options.transport)).find(\n            (claim) => claim.fixture === \"reference\",\n          );\n          assert.ok(reference, \"the transport claimed no reference resolver\");\n          const site = `${reference.target.name}.${String(reference.method)}`;\n          assert.ok(\n            adviceLines(logger, \"W_ORG_PARAM_MISSING\").some((line) =>\n              line.includes(site),\n            ),\n            `boot did not name ${site} in W_ORG_PARAM_MISSING: ${logger.text().slice(0, 800)}`,\n          );\n          const [info] = adviceLines(\n            logger,\n            \"I_CLASS_METADATA_OPERATIONS_ONLY\",\n          );\n          assert.ok(\n            info?.includes(reference.target.name) &&\n              info.includes(String(reference.method)),\n            `I_CLASS_METADATA_OPERATIONS_ONLY does not name ${site} as reached: ${info}`,\n          );\n          const decided = await options.invokeEntities!(\n            app,\n            [\n              { __typename: \"FixtureNode\", id: \"1\", orgId: member },\n              { __typename: \"FixtureNode\", id: \"2\", orgId: \"org-b\" },\n            ],\n            [\"plain\"],\n            cookie(orgEnv),\n          );\n          assert.equal(\n            decided.errors.length,\n            1,\n            `the class-level requirement did not decide each representation: ${JSON.stringify(decided.errors)}`,\n          );\n          assert.equal(decided.errors[0]!.code, \"FORBIDDEN\");\n          assert.ok(\n            decided.errors[0]!.path.includes(1),\n            JSON.stringify(decided.errors),\n          );\n          const own = await options.invokeGraph!(\n            app,\n            [{ root: \"public\", fields: [\"plain\"] }],\n            {},\n          );\n          assert.deepEqual(\n            own.errors,\n            [],\n            `the class's own public query failed: ${JSON.stringify(own.errors)}`,\n          );\n        },\n        federation({\n          reference: \"bare\",\n          classDecorators: [\n            Require(\n              orgPermission(\n                { member: [\"create\"] },\n                { organization: fromParam(\"orgId\") },\n              ),\n            ),\n          ],\n        }),\n      );\n    },\n    staticMember(options.transport, \"defaultAccessFor\") === false &&\n      !options.invokeEntities\n      ? \"the transport nests no handlers, so it serves no federation reference resolvers\"\n      : undefined,\n  );\n  return cases;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBA,SAAgB,0BACd,YACA,cACiD;CACjD,SAAS,UAAwC,QAAW;EAC1D,MAAM,SAAS,OACb,GAAG,CAAC,MAAM,SACmC;GAC7C,MAAM,UAAU,WAAW;GAC3B,IAAI,CAAC,SAAS;IACZ,aAAa;IACb;GACF;GACA,MAAM,QAAQ,QAAQ,SAAS,OAAO,CAAC;GACvC,IAAI,cAAuC,CAAC;GAC5C,IAAI,UAAU;GACd,KAAK,MAAM,QAAQ,OAAO;IACxB,MAAM,SAAS,MAAM,KAClB,OAAO,SAAS,SAAS,IACtB;KAAE,GAAG;KAAM,GAAG;IAAY,IAC1B,MACJ,GACF;IACA,IAAI,WAAW,OACb,OAAO;IAET,IACE,CAAC,OAAO,SAAS,SAAS,KAC1B,UACA,OAAO,WAAW,YAClB,UAAU,QACV;KACA,cAAc;MAAE,GAAG;MAAa,GAAG,OAAO;KAAK;KAC/C,UAAU;IACZ;GACF;GAGA,OACE,UAAU,EAAE,MAAM,YAAY,IAAI,KAAA;EAEtC;EACA,MAAM,QAAQ,OACZ,GAAG,CAAC,MAAM,SACQ;GAClB,MAAM,UAAU,WAAW;GAC3B,IAAI,CAAC,SAAS;IACZ,aAAa;IACb;GACF;GACA,KAAK,MAAM,QAAQ,QAAQ,SAAS,OAAO,CAAC,OAC1C,MAAM,KAAK,MAAsC,GAAG;EAExD;EACA,OAAO;GAAE;GAAQ;EAAM;CACzB;CACA,OAAO;EACL,MAAM;GACJ,QAAQ,UAAU,aAAa;GAC/B,QAAQ,UAAU,aAAa;GAC/B,QAAQ,UAAU,aAAa;EACjC;EACA,SAAS;GACP,QAAQ,UAAU,gBAAgB;GAClC,QAAQ,UAAU,gBAAgB;GAClC,QAAQ,UAAU,gBAAgB;EACpC;EACA,SAAS;GACP,QAAQ,UAAU,gBAAgB;GAClC,QAAQ,UAAU,gBAAgB;GAClC,QAAQ,UAAU,gBAAgB;EACpC;EACA,cAAc;GACZ,QAAQ,UAAU,qBAAqB;GACvC,QAAQ,UAAU,qBAAqB;GACvC,QAAQ,UAAU,qBAAqB;EACzC;CACF;AACF;;;AC1FA,MAAM,oBAAoB,OAAO,IAAI,+BAA+B;AACpE,MAAM,eAAe,YAAY,QAAQ,KAAK,UAAU;CACtD,IAAI,MAAM,QAAQ,OAAO,IAAI,KAAK,MAAM,QAAQ,KAAK,GAAG;EACtD,OAAO,OAAO;EACd,OAAO;CACT;AACF,CAAC;AAED,SAAS,aACP,QACA,QACM;CACN,QAAQ,SAAS,OAAO,QAAQ;EAC9B,IAAI,QAAQ,cACV,OAAO,OAAO,KAAK,KAAK;OAExB,OAAO,IAAI,KAAK,KAAK;CAEzB,CAAC;AACH;AAEA,SAAS,aAAa,OAAsC;CAC1D,MAAM,WAAY,MAChB;CAEF,IAAI,CAAC,YAAY,CAAC,MAAM,SACtB;CAEF,MAAM,UAAU,IAAI,QAAQ,QAAQ;CACpC,IAAI,MAAM,WAAW,MAAM,YAAY,UACrC,aAAa,SAAS,IAAI,QAAQ,MAAM,OAAO,CAAC;CAElD,OAAO;AACT;;AAGA,eAAsB,UACpB,SACA,KACA,OACkB;CAClB,IAAI,cAAuC,CAAC;CAC5C,KAAK,MAAM,QAAQ,QAAQ,QAAQ;EACjC,IAAI;EACJ,IAAI;GACF,UAAU,KAAK,QAAQ,KAAK,KAAK;EACnC,SAAS,OAAO;GACd,IAAI,QAAQ,OAAO,MACjB,yDACA,KACF;GACA,MAAM,IAAI,SAAS,yBAAyB,EAC1C,SACE,oFACJ,CAAC;EACH;EACA,IAAI,CAAC,SACH;EAEF,IAAI;EACJ,IAAI;GACF,SAAU,MAAM,qBAAqB,KAAK,GAAG,CAAC,CAAC;IAC7C,GAAG;IACH,eAAe;GACjB,CAAC;EACH,SAAS,OAAO;GACd,IAAI,WAAW,KAAK,GAGlB,IAAI,kBACD,MACC,sBACG,IAAI,QAAQ;GAErB,MAAM;EACR;EACA,IAAI,QAAQ,oBAAoB,IAAI,QAAQ;EAC5C,aAAa,IAAI,QAAQ,iBAAiB,OAAO,OAAO;EACxD,MAAM,QAAQ,OAAO;EACrB,IAAI,SAAS,OAAO,UAAU,UAAU;GACtC,IAAI,aAAa,SAAS,OAAO,MAAM,YAAY,UAAU;IAC3D,MAAM,EAAE,SAAS,GAAG,SAAS,MAAM;IACnC,IAAI,mBAAmB,SAAS;KAC9B,MAAM,iBACJ,YAAY,mBAAmB,UAC3B,YAAY,UACZ,IAAI,QAAQ;KAClB,QAAQ,SAAS,QAAQ,QAAQ;MAC/B,eAAe,IAAI,KAAK,MAAM;KAChC,CAAC;KACD,YAAY,UAAU;IACxB;IACA,cAAc,aAAa,MAAM,WAAW;GAC9C,OACE,OAAO;EAEX;CACF;CACA,OAAO,OAAO,KAAK,WAAW,CAAC,CAAC,SAAS,EAAE,SAAS,YAAY,IAAI,KAAA;AACtE;AAEA,eAAsB,SACpB,SACA,KACA,OACA,mBACkB;CAClB,KAAK,MAAM,QAAQ,QAAQ,OAAO;EAChC,IAAI;EACJ,IAAI;GACF,UAAU,KAAK,QAAQ,KAAK,KAAK;EACnC,SAAS,OAAO;GACd,IAAI,CAAC,mBACH,MAAM;GAIR,kBAAkB,KAAK;GACvB;EACF;EACA,IAAI,CAAC,SACH;EAEF,IAAI;EACJ,IAAI;GACF,SAAU,MAAM,qBAAqB,KAAK,GAAG,CAAC,CAAC;IAC7C,GAAG;IACH,eAAe;GACjB,CAAC;EACH,SAAS,OAAO;GACd,IAAI,CAAC,WAAW,KAAK,GACnB,MAAM;GAER,SAAS;IAAE,UAAU;IAAO,SAAS,aAAa,KAAK;GAAE;EAC3D;EACA,IAAI,OAAO,SAAS;GAClB,IAAI,QAAQ,oBAAoB,IAAI,QAAQ;GAC5C,aAAa,IAAI,QAAQ,iBAAiB,OAAO,OAAO;EAC1D;EACA,IAAI,OAAO,aAAa,KAAA,GACtB,IAAI,QAAQ,WAAW,OAAO;CAElC;CACA,OAAO,IAAI,QAAQ;AACrB;;;ACpIA,MAAa,mBAAmB;AAEhC,MAAM,YAAY,QAChB,WAAW,OAAO,IAAI,UAAU;AAClC,MAAM,YAAY;AAElB,SAASA,eACP,SACA,KACQ;CACR,OACE,aAAa,SAAS,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,IACzC,IAAI,QAAQ,YAAY,aAAa,IACvC,KAAK;AAET;AAEA,SAAS,WACP,SACA,KACA,OACQ;CACR,OAAO;EACLA,eAAa,SAAS,GAAG;EACzB,SAAS,IAAI,eAAe,KAAK;EACjC,GAAG,MAAM,KAAK,SAAS,SAAS,IAAI,IAAI,KAAK,EAAE;CACjD,CAAC,CAAC,KAAK,SAAS;AAClB;AAEA,SAAS,eACP,KACA,OACA,OACS;CACT,MAAM,OAAO,WAAW,IAAI,SAAS,KAAK,KAAK;CAC/C,OACE,SAAS,UAAU,OAAO,MAAM,SAAS,CAAC,KAC1C,SAAS,WAAW,MAAM,UAAU,GAAG,KAAK,KAAK;AAErD;;AAGA,SAAgB,OACd,UAA+B,CAAC,GACoB;CACpD,IAAI,UAAgC;CACpC,IAAI;CACJ,IAAI,oBAAoB;CACxB,MAAM,kCAAkB,IAAI,QAAgB;CAC5C,MAAM,qCAAqB,IAAI,QAAyB;CACxD,MAAM,cAAc,SAAS,QAAQ;CACrC,MAAM,iBACJ,QAAQ,mBAAmB,QACvB,OACC,QAAQ,kBACT,+BAA+B,WAAW,OAAO,WAAW,CAAC,CAAC,WAAW,KAAK,EAAE;CACtF,MAAM,SAAuB;EAC3B,UAAU;EACV;EACA,IAAI,QAAQ;GACV,OAAO,YAAY,OACf,YACA,QAAQ,UAAU,WAChB,WACA;EACR;EACA,IAAI,oBAAoB;GACtB,OAAO;EACT;EACA,KAAK,MAAM;GACT,IAAI,WAAW,QAAQ,aAAa,KAAK,UACvC,MAAM,IAAI,MACR,qCAAqC,QAAQ,SAAS,SAAS,KAAK,SAAS,EAC/E;GAEF,IAAI,SAAS,UAAU,KAAK,SAAS,cACnC,OAAO;GAET,IAAI,SAAS,UAAU,gBACrB,MAAM,IAAI,MACR,oCAAoC,QAAQ,MAAM,aACpD;GAEF,IAAI;GACJ,IAAI,SAAS,UAAU,eAAe;IACpC,eAAe,QAAQ,MAAM;IAE7B,QAAQ,QAAQ;GAClB;GACA,UAAU;GACV,oBAAoB;GACpB,eAAe;IACb;IACA,aAAa;KACX,KAAK,QAAQ;IACf;GACF;GACA,OAAO;EACT;EACA,mBAAmB,OAAO;GACxB,OACE,OAAO,UAAU,YACjB,UAAU,QACV,gBAAgB,IAAI,KAAK;EAE7B;CACF;CAqHA,OAAO;EAnHL,IAAI;GACH,gBAAgB;EACjB,aAAa,EACX,SAAS;GACP,eAAe,gCACP,eACA;IACJ;GACF,CACF;GACA,GAAI,iBACA,EAAE,UAAU,EAAE,WAAW,EAAE,kBAAkB,CAAC,cAAc,EAAE,EAAE,EAAE,IAClE,CAAC;EACP,EACF;EACA,OAAO;GACL,QAAQ;IACN;KACE,UAAU,QAAQ;MAChB,IAAI,CAAC,SAAS;OACZ;OACA,OAAO;MACT;MACA,OAAO,CAAC,SAAS,GAAG,KAAK,MAAM,CAAC,EAAE,YAAY;KAChD;KACA,SAAS,qBAAqB,YAAY;MACxC,MAAM,4BAA4B,IAAI;KACxC,CAAC;IACH;IACA;KACE,UAAU,QAAQ;MAChB,IAAI,CAAC,WAAW,SAAS,GAAG,GAC1B,OAAO;MAET,MAAM,UAAU,MAAM;MACtB,IAAI,CAAC,WAAW,QAAQ,UACtB,OAAO;MAIT,MAAM,QAAQ,QAAQ;MACtB,QAAQ,UAAU;MAClB,MAAM,UAAU,QAAQ,iBAAiB;MACzC,MAAM,QAAQA,eAAa,IAAI,SAAS,GAAG;MAI3C,OACE,CAAC,CAAC,SAAS,UAAU,MAAM,UAAUA,eAAa,SAAS,GAAG;KAElE;KACA,SAAS,qBAAqB,OAAO,QAAQ;MAC3C,MAAM,CAAC,EAAE,qBAAqB,IAAI,MAAM,QAAS,QAAQ;KAC3D,CAAC;IACH;IACA;KACE,eAAe,YAAY,QAAQ,QAAQ,OAAO,SAAS;KAC3D,SAAS,sBAAsB,QAC7B,UAAU,SAAU,KAAK,MAAM,CAAC,CAClC;IACF;GACF;GACA,OAAO;IACL;KACE,eAAe,YAAY,QAAQ,QAAQ,MAAM,SAAS;KAC1D,SAAS,sBAAsB,QAC7B,SAAS,SAAU,KAAK,MAAM,IAAI,UAAU;MAC1C,mBAAmB,IAAI,IAAI,SAAS,KAAK;KAC3C,CAAC,CACH;IACF;IACA;KACE,UAAU,QAAQ;MAGhB,IAAI,mBAAmB,IAAI,IAAI,OAAO,GAAG;OACvC,MAAM,QAAQ,mBAAmB,IAAI,IAAI,OAAO;OAChD,mBAAmB,OAAO,IAAI,OAAO;OACrC,MAAM;MACR;MACA,OAAO,YAAY,QAAQ,CAAC,SAAS,GAAG;KAC1C;KACA,SAAS,qBAAqB,OAAO,QAAQ;MAC3C,MAAM,QAAQ,IAAI,QAAQ;MAC1B,IAAI,OAAO,UAAU,YAAY,UAAU,MACzC,gBAAgB,IAAI,KAAK;KAE7B,CAAC;IACH;IACA;KACE,UAAU,QAAQ;MAChB,IAAI,SAAS,GAAG,GACd,OAAO;MAET,MAAM,UAAU,MAAM;MACtB,OAAO,CAAC,CAAC,SAAS,WAAW,QAAQ,YAAY;KACnD;KACA,SAAS,qBAAqB,OAAO,QAAQ;MAC3C,MAAM,UAAU,MAAM;MACtB,IACE,QAAQ,YAAY,qBACpB,CAAC,eAAe,KAAK,SAAS,QAAS,iBAAiB,GACxD;OACA,QAAS,UAAU,IAAI,IAAI;OAC3B;MACF;MACA,MAAM,UAAU,IAAI,QAAQ,iBAAiB,aAAa,KAAK,CAAC;MAChE,IAAI,QAAQ,QACV,QAAQ,QAAS,OAAO,OAAO;KAEnC,CAAC;IACH;GACF;EACF;CAEU;AACd;;;AC3MA,MAAa,kBAAkB;;AAE/B,MAAa,uBAAuB;AACpC,MAAa,eAAe;AAC5B,MAAa,mBAAmB;AAChC,MAAM,cAAc,OAAO,IAAI,2CAA2C;AAmD1E,SAAgB,mBAA+B;CAC7C,OAAO;EACL,OAAO,CAAC;EACR,QAAQ,CAAC;EACT,SAAS,CAAC;EACV,UAAU,CAAC;EACX,SAAS,CAAC;EACV,OAAO,CAAC;EACR,OAAO,KAAA;EACP,cAAc,KAAA;EACd,cAAc,KAAA;EACd,SAAS,KAAA;EACT,OAAO,KAAA;EACP,gBAAgB,KAAA;EAChB,iBAAiB;CACnB;AACF;;AAGA,SAAgB,gBAAgB,QAAiC;CAC/D,OAAO,EAAE,SAAS,OAAO;AAC3B;AAEA,MAAM,kBAAkB;CACtB;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;AACA,MAAM,eAAe,OAAO,6CAA6C;;AAGzE,SAAS,kBAAkB,SAAkB,OAAyB;CACpE,IACE,CAAC,WACD,OAAO,YAAY,YACnB,QAAQ,IAAI,SAAS,YAAY,GAEjC;CAEF,MAAM,SAAS;CACf,OAAO,eAAe,QAAQ,cAAc,EAAE,OAAO,KAAK,CAAC;CAC3D,KAAK,MAAM,UAAU,iBAAiB;EACpC,MAAM,WAAW,OAAO;EACxB,IAAI,OAAO,aAAa,YACtB;EAEF,OAAO,UAAU,OAAO,GAAG,SAAoB;GAC7C,MAAM,QAAS,KAAK,EAAE,EAAsC;GAC5D,MAAM,OAAO;IACX;IACA,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;GAC7C;GACA,MAAM,QAAQ,KAAK,GAAG,OAAO,GAAG,KAAK,SAAS,IAAI;GAClD,MAAM,QAAQ,MAAM,eAAe,IAAI;GACvC,IAAI,OACF,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,KAAK,CAAC;GAE3D,MAAM,QAAQ,MAAM,eAAe,IAAI;GACvC,IAAI,UAAU,KAAA,GACZ,MAAM;GAER,OAAQ,SAA+C,MACrD,QACA,IACF;EACF;CACF;CACA,MAAM,cAAc,OAAO;CAC3B,IAAI,OAAO,gBAAgB,YACzB,OAAO,eAAe,aACnB,YAA+D,KAC9D,SACC,UAAmB;EAClB,kBAAkB,OAAO,KAAK;EAC9B,OAAO,SAAS,KAAK;CACvB,CACF;AAEN;AAEA,SAAS,OAAO,OAA2B;CACzC,OAAO,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;AAC7C;AAEA,SAAS,OAAO,OAAmB;CACjC,MAAM,UAAU,UAAkB,YAAY;EAC5C,MAAM,OAAO,KAAK,KAAK;CACzB;CACA,OAAO,OAAO,YACZ;EAAC;EAAQ;EAAW;EAAW;CAAc,CAAC,CAAC,KAAK,UAAU,CAC5D,OACA;EACE,QAAQ,EAAE,OAAO,OAAO,GAAG,MAAM,QAAQ,EAAE;EAC3C,QAAQ,EAAE,OAAO,OAAO,GAAG,MAAM,QAAQ,EAAE;EAC3C,QAAQ,EAAE,OAAO,OAAO,GAAG,MAAM,QAAQ,EAAE;CAC7C,CACF,CAAC,CACH;AACF;;;;;;;;AASA,SAAgB,yBAA2C;CACzD,OAAO,YAAY;AACrB;AAEA,SAAS,YACP,UAAwD,CAAC,GACvC;CAClB,MAAM,QAAQ,iBAAiB;CAC/B,MAAM,SAAS;EACb,IAAI;EACJ,KAAK,SAAgD;GACnD,IAAI,QAAQ,cACV,KAAK,MAAM,SAAS,OAAO,OAAO,QAAQ,UAAU,CAAC,CAAC,GAGpD,QAAQ,aAAa,MAAM,eAAe,CAAC;GAG/C,kBAAkB,QAAQ,SAAS,KAAK;GACxC,OAAO,EACL,SAAS;IACP,gBAAgB,CAAC,oBAAoB;IACrC,eAAe,OAAO,KAAK;GAC7B,EACF;EACF;EACA,WAAW;GACT,cAAc,mBACZ,mBACA;IACE,QAAQ;KAAC;KAAO;KAAQ;KAAO;KAAS;IAAQ;IAChD,aAAa;IACb,gBAAgB;GAClB,GACA,OAAO,QAAQ;IACb,MAAM,MAAM,KAAK,MAAM;IACvB,MAAM,QAAQ,IAAI,WAAW,MAAM,IAAI,QAAQ,YAAY,CAAC;IAC5D,OAAO,SAAS,KAAK;KACnB,QAAQ,IAAI,QAAQ;KACpB,KAAK,IAAI,QAAQ;KACjB,SAAS,CAAC,GAAG,IAAI,QAAQ,OAAO;KAChC,MAAM,OAAO,KAAK;IACpB,CAAC;GACH,CACF;GACA,kBAAkB,mBAChB,uBACA,EAAE,QAAQ,MAAM,GAChB,OAAO,QAAQ;IACb,IAAI,UAAU,WAAW,SAAS,EAAE,MAAM,IAAI,CAAC;IAC/C,IAAI,UAAU,WAAW,QAAQ,EAAE,MAAM,IAAI,CAAC;IAC9C,IAAI,UAAU,WAAW,gBAAgB,EAAE,MAAM,IAAI,CAAC;IACtD,OAAO,IAAI,KAAK,EAAE,SAAS,EAAE,CAAC;GAChC,CACF;GACA,eAAe,mBACb,mBACA,EAAE,QAAQ,MAAM,GAChB,YACE,IAAI,SAAS,MAAM;IACjB,QAAQ;IACR,SAAS,CACP,CAAC,YAAY,GAAG,qBAAqB,MAAM,GAC3C,CAAC,cAAc,0BAA0B,CAC3C;GACF,CAAC,CACL;GACA,aAAa,mBACX,iBACA,EAAE,QAAQ,MAAM,GAChB,YAAY;IACV,IAAI,QAAQ;IACZ,IAAI;IACJ,MAAM,SAAS,IAAI,eAA2B;KAC5C,KAAK,YAAY;MACf,OAAO,IAAI,SAAe,YAAY;OACpC,QAAQ,iBAAiB;QACvB,IAAI,UAAU,GACZ,WAAW,MAAM;aAEjB,WAAW,QACT,IAAI,YAAY,CAAC,CAAC,OAAO,SAAS,QAAQ,EAAE,CAC9C;QAEF,QAAQ;OACV,GAAG,EAAE;MACP,CAAC;KACH;KACA,SAAS;MACP,aAAa,KAAK;MAClB,MAAM,kBAAkB;KAC1B;IACF,CAAC;IACD,OAAO,IAAI,SAAS,QAAQ,EAC1B,SAAS,EAAE,gBAAgB,aAAa,EAC1C,CAAC;GACH,CACF;GACA,WAAW,mBACT,eACA,EAAE,QAAQ,MAAM,GAChB,YACE,IAAI,SAAS,gBAAgB,EAC3B,SAAS;IACP,gBAAgB;IAChB,MAAM;GACR,EACF,CAAC,CACL;GACA,UAAU,mBACR,cACA,EAAE,QAAQ,MAAM,GAChB,OAAO,QAAQ,IAAI,KAAK,EAAE,QAAQ,MAAM,CAAC,CAC3C;GACA,YAAY,mBACV,gBACA,EAAE,QAAQ,QAAQ,GAClB,OAAO,QAAQ,IAAI,KAAK,EAAE,QAAQ,QAAQ,CAAC,CAC7C;GACA,aAAa,mBACX,iBACA,EAAE,QAAQ,SAAS,GACnB,OAAO,QAAQ,IAAI,KAAK,EAAE,QAAQ,SAAS,CAAC,CAC9C;GACA,UAAU,mBACR,cACA;IAAE,QAAQ;IAAO,gBAAgB;GAAK,GACtC,OAAO,QAAQ,IAAI,KAAK,EAAE,KAAK,IAAI,QAAQ,IAAI,CAAC,CAClD;GACA,SAAS,mBACP,aACA;IAAE,QAAQ;IAAO,gBAAgB;GAAK,GACtC,OAAO,QACL,IAAI,KAAK;IACP,IAAI,MAAM,IAAI,SAAS,IAAI,QAAQ,OAAO;IAC1C,UAAU,WAAW,IAAI,SAAS,IAAI,QAAQ,OAAO;GACvD,CAAC,CACL;GACA,oBAAoB,mBAClB,0BACA,EAAE,QAAQ,MAAM,GAChB,YAAY;IACV,MAAM,IAAI,SAAS,eAAe;KAChC,MAAM;KACN,SAAS;IACX,CAAC;GACH,CACF;GACA,iBAAiB,mBACf,sBACA,EAAE,QAAQ,MAAM,GAChB,YAAY;IACV,MAAM,IAAI,MAAM,8BAA8B;GAChD,CACF;EACF;EACA,OAAO;GACL,QAAQ,CACN;IACE,eAAe;IACf,SAAS,qBAAqB,OAAO,QAAQ;KAC3C,MAAM,MAAM,KAAK,IAAI,IAAI;KACzB,MAAM,OAAO,MAAM,QAAQ,IAAI,IAAI;KACnC,IAAI,MACF,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,IAAI,CAAC;KAE1D,MAAM,QAAQ,MAAM,QAAQ,IAAI,IAAI;KACpC,IAAI,UAAU,KAAA,GACZ,MAAM;KAER,MAAM,WAAW,MAAM,UAAU,IAAI,MAAM,IAAI,OAAO;KACtD,IAAI,aAAa,KAAA,GACf,OAAO;IAEX,CAAC;GACH,CACF;GACA,OAAO,CACL;IACE,eAAe;IACf,SAAS,qBAAqB,OAAO,QAAQ;KAC3C,MAAM,QAAQ,KAAK;MACjB,MAAM,IAAI;MACV,MAAO,MAAM,4BAA4B,MAAO;KAClD,CAAC;KACD,MAAM,SAAS,MAAM,iBAAiB,IAAI,IAAI;KAC9C,IAAI,QACF,IAAI,UAAU,OAAO,IAAI,OAAO,EAAE;KAEpC,MAAM,aACJ,IAAI,QAAQ,iBAAiB,aAAa,KAAK,CAAC;KAClD,IAAI,WAAW,QACb,MAAM,SAAS,KAAK;MAClB,MAAM,IAAI;MACV;MACA,SAAS,IAAI,UAAU,IAAI,QAAQ,IAAI,OAAO,IAAI,KAAA;MAClD,eAAe,IAAI,QAAQ,YAAY,aAAa;KACtD,CAAC;IAEL,CAAC;GACH,CACF;EACF;CACF;CACA,OAAO,eAAe,QAAQ,aAAa,EAAE,OAAO,MAAM,CAAC;CAC3D,OAAO;AACT;;AAGA,MAAM,cAAc;AACpB,MAAM,qBAAqB;;;;;;AAO3B,SAAS,WAAW,SAAkB,SAA4B;CAChE,MAAM,YAAY,QAAQ,UAAU;CACpC,MAAM,UAAU,IAAI,QAAQ,QAAQ,OAAO;CAC3C,QAAQ,IAAI,oBAAoB,WAAW;CAC3C,MAAM,KAAK,MAAM,SAAS;EACxB,GAAG;EACH,UAAU;GACR,GAAG,QAAQ;GACX,WAAW;IACT,GAAG;IACH,kBAAkB,CAChB,GAAI,WAAW,oBAAoB,CAAC,iBAAiB,GACrD,kBACF;GACF;EACF;CACF,CAAC;CACD,OAAO,OAAO,cAAc,OAAO;AACrC;;AAGA,eAAsB,QAAQ,MAAqC;CAEjE,MAAM,UAAS,MADQ,KAAK,SAAA,CACL,UAAU,eAAe;CAChD,MAAM,QACJ,UAAU,OAAO,WAAW,WACvB,QAAQ,IAAI,QAAQ,WAAW,IAChC,KAAA;CACN,IAAI,CAAC,OACH,MAAM,IAAI,6BACR,6BACA,mFACA,mGACF;CAEF,OAAO;AACT;;;;;;;;AAuBA,SAAgB,sBACd,UAA+C,CAAC,GAChD,WAAoC,CAAC,GAC3B;CAEV,MAAM,SAAoC,CAAC;CAC3C,MAAM,WAAW;EACf,QAAQ,WAAW,OAAO,WAAW,IAAI,WAAW,OAAO,WAAW;EACtE,SAAS;EACT,kBAAkB,EAAE,SAAS,KAAK;EAClC,QAAQ,EAAE,UAAU,KAAK;EACzB,GAAG;EACH,SAAS;GAAE,GAAG,QAAQ;GAAS,WAAW;EAAE;EAC5C,UAAU;GACR,GAAG,QAAQ;GACX,oBAAoB,SAAS,uBAAuB;GACpD,kBAAkB,SAAS,qBAAqB;EAClD;EACA,SAAS;GACP,UAAU;GACV,OAAO;GACP,YAAY,EAAE,cAAc,OAAO,CAAC;GACpC,GAAI,QAAQ,WAAW,CAAC;GACxB,OAAO;EACT;CACF;CACA,OAAO,WAA8B;EACnC,GAAG;EACH,UAAU,cAAc,MAAM;CAChC,CAAC;AACH;AAsBA,eAAsB,YAAY,MAAsC;CACtE,MAAM,UAAW,MAAM,KAAK;CAC5B,IAAI,CAAC,QAAQ,MACX,MAAM,IAAI,6BACR,sBACA,+EACA,sEACF;CAEF,OAAO,QAAQ;AACjB;;AAGA,eAAsB,YACpB,MACA,UAAiD,CAAC,GAC5B;CACtB,MAAM,UAAU,MAAM,YAAY,IAAI;CACtC,MAAM,QAAQ,GAAG,WAAW,OAAO,WAAW,EAAE;CAChD,IAAI;CACJ,IAAI;CACJ,IAAI,QAAQ,UAAU;EACpB,WAAW,MAAM,WAAW,OAAO,WAAW;EAU9C,UAAS,MARP,KAAK,IAKL,YAAY,EAAE,MAAM;GAAE;GAAO;GAAU,MAAM;EAAc,EAAE,CAAC,EAAA,CAGhD,KAAK;CACvB,OACE,UACE,MAAM,QAAQ,SACZ,QAAQ,WAAW;EACjB;EACA,MAAM;EACN,GAAI,QAAQ,OAAO,EAAE,MAAM,QAAQ,KAAK,IAAI,CAAC;CAC/C,CAAC,CACH,EAAA,CACA;CAEJ,MAAM,QAAQ,MAAM,QAAQ,MAAM,EAAE,OAAO,CAAC;CAC5C,OAAO;EACL;EACA;EACA;EACA,QAAQ,MAAM,QAAQ,IAAI,QAAQ,KAAK;EACvC,OAAO,MAAM;CACf;AACF;;AAGA,SAAgB,gBACd,IACA,OACA,KACA,MACiB;CACjB,OAAO,SAAS,KAAA,IAAY;EAAE;EAAI;EAAO;CAAI,IAAI;EAAE;EAAI;EAAO;EAAM;CAAI;AAC1E;;;;;;;AAQA,SAAgB,eACd,OACA,QACM;CACN,MAAM,yBAAS,IAAI,IAA+B;CAClD,KAAK,MAAM,QAAQ,OACjB,OAAO,IAAI,KAAK,IAAI,CAAC,GAAI,OAAO,IAAI,KAAK,EAAE,KAAK,CAAC,GAAI,IAAI,CAAC;CAE5D,KAAK,MAAM,CAAC,IAAI,UAAU,QACxB,OAAO,SAAS,UAAU;EACxB,KAAK,MAAM,QAAQ,OACjB,IAAI,KAAK,SAAS,KAAA,GAChB,OAAO,GAAG,GAAG,KAAK,MAAM,aAAa,KAAK,KAAK,IAAI,YAAY,CAAC,CAAC;OAGjE,OAAO,GAAG,KAAK,OAAO,iBAAkB;GAEtC,MAAM,UAAU,UAAU;GAG1B,MAAM,SAAS,MAAM,KAAK,IAAI;GAC9B,IAAI,UAAU,OAAO,OAAO,YAAY,UACtC,SAAS,OAAO,OAAO,OAAO;EAElC,CAAC;CAGP,CAAC;AAEL;AAOA,SAAS,OAAO,OAAwB;CACtC,IAAI,iBAAiB,OACnB,OAAO,QAAQ,OAAO,EAAE,OAAO,EAAE,CAAC;CAEpC,IAAI,OAAO,UAAU,UACnB,OAAO;CAET,IAAI;EACF,OAAO,KAAK,UAAU,KAAK;CAC7B,QAAQ;EACN,OAAO,OAAO,KAAK;CACrB;AACF;;AAGA,IAAa,kBAAb,MAAsD;CACpD,UAA+B,CAAC;CAEhC,OAAe,OAA0B,QAAyB;EAChE,KAAK,QAAQ,KAAK;GAAE;GAAO,MAAM,OAAO,IAAI,MAAM,CAAC,CAAC,KAAK,GAAG;EAAE,CAAC;CACjE;CAEA,IAAI,GAAG,QAAyB;EAC9B,KAAK,OAAO,OAAO,MAAM;CAC3B;CAEA,MAAM,GAAG,QAAyB;EAChC,KAAK,OAAO,SAAS,MAAM;CAC7B;CAEA,KAAK,GAAG,QAAyB;EAC/B,KAAK,OAAO,QAAQ,MAAM;CAC5B;CAEA,MAAM,GAAG,QAAyB;EAChC,KAAK,OAAO,SAAS,MAAM;CAC7B;CAEA,QAAQ,GAAG,QAAyB;EAClC,KAAK,OAAO,WAAW,MAAM;CAC/B;CAEA,MAAM,GAAG,QAAyB;EAChC,KAAK,OAAO,SAAS,MAAM;CAC7B;CAEA,SAAqB;EACnB,OAAO,KAAK,QAAQ,QACjB,UAAU,MAAM,UAAU,WAAW,MAAM,UAAU,OACxD;CACF;CAEA,OAAe;EACb,OAAO,KAAK,QAAQ,KAAK,UAAU,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI;CAC1D;AACF;;;;;AAYA,SAAgB,QACd,KACA,UAOI,CAAC,GACiB;CACtB,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAMC,YAAUC,QACd,KACA;GACE,QAAQ,QAAQ,UAAU;GAC1B,SAAS,QAAQ;GACjB,OAAO;EACT,IACC,aAAa;GACZ,MAAM,SAAmB,CAAC;GAC1B,SAAS,GAAG,SAAS,UAAkB;IACrC,OAAO,KAAK,KAAK;IACjB,IAAI,QAAQ,sBAAsB;KAChC,SAAS,QAAQ;KACjB,QAAQ;MACN,QAAQ,SAAS,cAAc;MAC/B,SAAS,SAAS;MAClB,MAAM,OAAO,OAAO,MAAM;KAC5B,CAAC;IACH;GACF,CAAC;GACD,SAAS,KAAK,SAAS,MAAM;GAC7B,SAAS,KAAK,aACZ,QAAQ;IACN,QAAQ,SAAS,cAAc;IAC/B,SAAS,SAAS;IAClB,MAAM,OAAO,OAAO,MAAM;GAC5B,CAAC,CACH;EACF,CACF;EACA,UAAQ,WAAW,QAAQ,aAAa,WAAa;GACnD,UAAQ,wBAAQ,IAAI,MAAM,cAAc,IAAI,WAAW,CAAC;EAC1D,CAAC;EACD,UAAQ,KAAK,SAAS,MAAM;EAC5B,IAAI,QAAQ,QACV,KAAK,MAAM,SAAS,QAAQ,QAC1B,UAAQ,MAAM,KAAK;OAEhB,IAAI,QAAQ,SAAS,KAAA,GAC1B,UAAQ,MAAM,QAAQ,IAAI;EAE5B,UAAQ,IAAI;CACd,CAAC;AACH;AAEA,SAAgB,eAAe,SAAwC;CACrE,MAAM,QAAQ,QAAQ;CACtB,OAAO,UAAU,KAAA,IAAY,CAAC,IAAI,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AACzE;AAEA,eAAsB,OACpB,IACiE;CACjE,IAAI;EACF,OAAO;GAAE,IAAI;GAAM,OAAO,MAAM,GAAG;EAAE;CACvC,SAAS,OAAO;EACd,OAAO;GAAE,IAAI;GAAO;EAAM;CAC5B;AACF;;AAGA,SAAgB,eAAe,OAA0B;CACvD,MAAM,QAAkB,CAAC;CACzB,MAAM,SAAS,UAAmB;EAChC,IAAI,CAAC,SAAS,OAAO,UAAU,UAC7B;EAEF,MAAM,OAAO,QAAQ,IAAI,OAAO,MAAM;EACtC,IAAI,OAAO,SAAS,UAClB,MAAM,KAAK,IAAI;EAEjB,MAAM,SAAS,QAAQ,IAAI,OAAO,QAAQ;EAC1C,IAAI,MAAM,QAAQ,MAAM,GACtB,OAAO,QAAQ,KAAK;CAExB;CACA,MAAM,KAAK;CACX,OAAO;AACT;;;AC9pBA,MAAM,OAAO;AACb,MAAM,eAAe;;AAErB,MAAM,WAAW;AACjB,MAAM,cAAc;;AAEpB,MAAM,eAAe;AACrB,MAAM,cAAc,OAAO,IAAI,+BAA+B;AAC9D,MAAM,gBAAgB,KAAK,UAAU;CACnC,MAAM;CACN,SAAS;AACX,CAAC;AAgDD,SAAS,iBAAiB,KAAqC;CAI7D,MAAM,WAHc,IAAI,IAAsB,mBAAmB,EAC/D,QAAQ,MACV,CAC2B,CAAC,CAAC;CAC7B,OAAO,GAAG,UAAU,2CAA2C;CAC/D,OAAO;AACT;;;;;AAMA,SAAS,qBACP,KAC0C;CAC1C,IAAI,OAAO,QAAQ,YACjB,IAAI;EACF,OAAQ,IAA+C,WACnD;CACN,QAAQ;EACN;CACF;CAEF,IAAI,OAAO,OAAO,QAAQ,YAAY,EAAE,wBAAwB,MAC9D,OAAQ,IAA8B,gBAAgB,CAAC;AAG3D;;AAGA,SAASC,eACP,KACA,MACqB;CACrB,IAAI,OAAO,QAAQ,YACjB,OAAO,OAAO,QAAQ,IAAI,IAAI,WAAqB,IAAI,MAAM,aACzD,OACA,KAAA;CAEN,IAAI,OAAO,OAAO,QAAQ,YAAY,EAAE,wBAAwB,MAC9D,OAAO,OAAO,QAAQ,IAAI,KAAK,IAAI,MAAM;AAG7C;AAEA,eAAe,eACb,SACuC;CACvC,MAAM,WAAW,qBAAqB,QAAQ,QAAQ;CACtD,IAAI,UACF,OAAO;CAET,MAAM,OAAO,MAAM,SAAS,SAAS,WAAW,CAAC,CAAC;CAClD,IAAI;EACF,OAAO,iBAAiB,KAAK,GAAG,CAAC,CAAC;CACpC,UAAU;EACR,MAAM,KAAK,MAAM;CACnB;AACF;AAEA,SAASC,YACP,SACA,MACA,OACA,QACA,OASM;CACN,MAAM,QAAQ,MAAM,SAAS,OAAO;CACpC,MAAM,SAAiC,OAAO,MAAM,SAAS;EAC3D,MAAM,OAAO,KACX,GAAG,KAAK,QAAQ,OAAO,YAAY,EAAE,GAAG,IAAI,IAAI,KAAK,QAAQ,GAAG,CAAC,CAAC,UACpE;EACA,MAAM,UAAU,KAAK,QAAQ,QAAQ,IAAI,YAAY;EACrD,IAAI,YAAY,aAAa;GAC3B,MAAM,QAAQ,IAAI,SAAS,eAAe;IACxC,MAAM;IACN,SAAS;GACX,CAAC;GACD,OAAO,eAAe,OAAO,aAAa,EACxC,OAAO,IAAI,QAAQ,EAAE,cAAc,kCAAkC,CAAC,EACxE,CAAC;GACD,MAAM;EACR;EACA,IAAI,SACF,MAAM,IAAI,MAAM,8BAA8B;EAEhD,OAAO,KAAK;CACd;CACA,MAAM,EAAE,MAAM,GAAG,YAAY,OAAO,UAAU,CAAC;CAC/C,MAAM,gBAAgB;EACpB,YAAY;EACZ,GAAG;EACH,MAAM;GAAE,GAAG;GAAM,QAAQ,CAAC,QAAQ,GAAI,MAAM,UAAU,CAAC,CAAE;EAAE;CAC7D;CACA,MAAM,UAA2B,CAAC;CAClC,IAAI,OAAO,OAAO;EAChB,MAAM,aAAa,OAAO,8BAA8B;EACxD,IAYM,wBAZN,MAYM,sBAAsB,CAAC;EAZ5B,wBAAA,WAAA,CAAA,OAAO;GACN,WAAW,CACT;IACE,SAAS;IACT,YAAY,YAAY;KACtB,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;KACtD,OAAO,EAAE,KAAK;IAChB;GACF,CACF;GACA,SAAS,CAAC,UAAU;EACtB,CAAC,CAAA,GAAA,qBAAA;EAED,QAAQ,KACN,iBAAiB,aAAa;GAC5B,WAAW,CAAC,QAAQ,QAAQ;GAC5B,SAAS,CAAC,qBAAqB;GAC/B,QAAQ,CAAC,UAAU;GACnB,YAAY,OAAO,gBAAoC;IACrD,GAAG;IACH,MAAM,WAAW;GACnB;EACF,CAAC,CACH;CACF,OACE,QAAQ,KACN,iBAAiB,QAAQ;EACvB,GAAG;EACH;EACA,WAAW,CAAC,QAAQ,QAAQ;CAC9B,CAAU,CACZ;CAEF,IAAI,OAAO,kBACT,QAAQ,KACN,iBAAiB,QAAQ;EAAE;EAAM,YAAY;CAAM,CAAU,CAC/D;CAEF,MAAM,QAAqB,EACzB,YAAY,SAA2B;EACrC,MAAM,SAAS,WAAW,MACvB,SAAS,CAAC,CACV,IAAI,QAAQ,aAAa,CAAC,CAAC,WAAW,CAAC;EAC1C,OAAO;CACT,EACF;CACA,MAAM,cAA+B,EACnC,UACE,SACA,MACqB;EACrB,MAAM,SAAS,iBAAiB,MAC7B,SAAS,CAAC,CACV,IAAI,QAAQ,aAAa,CAAC,CAAC,WAAW,CAAC;EAC1C,OAAO,KAAK,OAAO;CACrB,EACF;CAEA,IACM,2BADN,MACM,yBAAyB;EAC7B,KAEK,MAAuB,SAAsC;GAChE,OAAO;IACL;IACA,SAAS,QAAQ,UACb,OAAO,KAAK,QAAQ,OAAO,CAAC,CAAC,SAAS,MAAM,IAC5C;GACN;EACF;EAEA,OAEO;GACL,OAAO,EAAE,MAAM,KAAK;EACtB;EAEA,QAEQ;GACN,OAAO,EAAE,OAAO,MAAM;EACxB;EAEA,GACG,WAAqD;GACtD,OAAO,EAAE,QAAQ,WAAW,UAAU,KAAK;EAC7C;EAEA,cAEc,WAAqD;GACjE,OAAO,EAAE,QAAQ,WAAW,UAAU,KAAK;EAC7C;EAEA,SAKE,SACA,UACA;GACA,MAAM,WAAW,MAAM,SAAS;GAChC,MAAM,WAAW,MAAM;GACvB,SAAS,aAAa,SAAS,IAAI,OAAO;GAC1C,SAAS,YAAY,SAAS,UAAU,OAAO;GAC/C,SAAS,eAAe,CAAC,SAAS,UAAU;IAC1C,SAAS,EAAE,MAAM,YAAY;IAC7B,KAAK;IACL,QAAQ;GACV,CAAC;GACD,SAAS,iBAAiB,CAAC,SAAS,UAClC,IAAI,gBAAgB,IAAI,OAAO,CAAC,CAClC;GACA,SAAS,gBAAgB,SAAS,OAAO,OAAO;GAChD,SAAS,UAAU;GACnB,SAAS,eACP,SACG,WAAW,SAAS,QAAQ,CAAC,EAC5B,OAAO,CAAC,oBAAoB,CAAC,KAAK;GACxC,MACG,QAAQ,CAAC,CACT,aAAa,UAAU,cAAc,uBAAuB;GAC/D,OAAO,EAAE,IAAI,KAAK;EACpB;CACF;;EAjEG,OAAO;EACP,KAAK,UAAU;EACV,gBAAA,GAAA,KAAK,CAAA;EAAkB,gBAAA,GAAA,IAAI,CAAA;;;;;;EAShC,OAAO;EACP,IAAI,UAAU;;;;;;EAKd,OAAO;EACP,IAAI,oBAAoB;;;;;;EAKxB,IAAI,QAAQ;EACT,gBAAA,GAAA,iBAAiB,CAAA;;;;;;EAIpB,YAAY,EAAE,eAAe,KAAK,CAAC;EACnC,IAAI,mBAAmB;EACT,gBAAA,GAAA,iBAAiB,CAAA;;;;;;EAI/B,OAAO;EACP,UAAU,KAAK;EACf,gBAAgB,WAAW;EAC3B,IAAI,cAAc;EAEhB,gBAAA,GAAA,IAAI,CAAA;EACJ,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;CA1C7B,2BAAA,WAAA,CAAA,WAAW,CAAA,GAAA,wBAAA;CAqEZ,IACM,0BADN,MACM,wBAAwB;EAC5B,OACO,UAAgD;GACrD,OAAO,KAAK,aAAa;EAC3B;CACF;;EAJG,WAAW,aAAa;;;;;CAF1B,0BAAA,WAAA,CAAA,WAAW,CAAA,GAAA,uBAAA;CAQZ,IACM,6BADN,MACM,mCAAmC,oBAAoB;EAC3D,MAAe,WAAoB,MAA2B;GAC5D,MAAM,SAAS,KAAK,SAAS;GAC7B,MAAM,MAAM,WAAW,IAAI;EAC7B;CACF;CANC,6BAAA,WAAA,CAAA,MAAM,CAAA,GAAA,0BAAA;CAQP,IAQM,wBARN,MAQM,sBAAmE;EACvE,UAAU,UAAoC;GAC5C,IAAI,OAAO,YACT,SACG,OAAO,UAAmB,WAAoB,SAAqB;IAClE,MAAM,MAAM,KAAK,YAAY;IAC7B,KAAK;GACP,CAAC,CAAC,CACD,UAAU;IAAE,MAAM;IAAS,QAAQ,cAAc;GAAI,CAAC;EAE7D;EAEA,MAAM,wBAAuC;GAC3C,MAAM,OAAO,aAAa;EAC5B;CACF;CAvBC,wBAAA,WAAA,CAAA,OAAO;EACN;EACA,aAAa,CAAC,wBAAwB;EACtC,WAAW,CACT,yBACA;GAAE,SAAS;GAAY,UAAU;EAA2B,CAC9D;CACF,CAAC,CAAA,GAAA,qBAAA;CAiBD,OAAO;AACT;;AAGA,SAAS,kBACP,SACA,OACyC;CACzC,MAAM,SAAS,QAAQ,QAAQ,QAAQ;CACvC,OAAO,QAAQ,kCACL,OAAO,0BAA2B,IACxC,KAAA;AACN;;AAGA,SAAS,cACP,SACA,QACqB;CACrB,MAAM,WAAW,OAAO,aACpB,kBAAkB,SAAS,OAAO,KAAK,IACvC,KAAA;CACJ,IAAI,UACF,OAAO,SAAS;CAElB,OAAO,OAAO,QACV,QAAQ,MAAO,kBAAkB,IACjC,QAAQ,kBAAkB;AAChC;AAEA,eAAe,SACb,SACA,WACA,QACmB;CACnB,MAAM,OAAO,OAAO,YAAY,sBAAsB,OAAO,IAAI;CACjE,MAAM,QAAQ,MAAM,QAAQ,IAAI;CAChC,MAAM,SAAS,IAAI,gBAAgB;CACnC,MAAM,WAAsB,CAAC;CAC7B,MAAM,SAAmB,CAAC;CAC1B,MAAM,WAAgC,CAAC;CACvC,IAAI;CACJ,MAAM,UAAU,cAAc,SAAS,MAAM;CAC7C,MAAM,iBAAiB,iBAAiB,WAAY,CAAC,CAAC;CACtD,MAAM,SAASA,YAAU,SAAS,MAAM,OAAO,QAAQ;EACrD;EACA;EACA;EACA;EACA,eAAe;CACjB,CAAC;CACD,MAAM,aAAa;EAAE;EAAQ,SAAS;EAAM,cAAc;CAAM;CAChE,IAAI;CACJ,IAAI,cAAc,WAChB,MAAM,MAAM,YAAY,OAAO,QAAQ,SAAS,UAAU;MAK1D,OAAM,MAHkB,KAAK,oBAAoB,EAC/C,SAAS,CAAC,MAAM,EAClB,CAAC,CAAC,CAAC,QAAQ,EAAA,CACK,sBAAsB,SAAS,UAAU;CAE3D,cAAc;CACd,IAAI;EACF,IAAI,OAAO,MAAM;GACf,IAAI,QAAQ,gBACV,MAAM,QAAQ,eAAe,KAAK,WAAW;QAE7C,IAAI,WAAW;IAAE,QAAQ;IAAa,aAAa;GAAK,CAAC;EAE7D;EACA,IAAI,OAAO,QACT,IAAI,gBAAgB,OAAO,MAAM;EAEnC,IAAI,OAAO,YACT,IAAI,iBAAiB,EAAE,MAAM,eAAe,IAAI,CAAC;EAEnD,IAAI,OAAO,cAAc,CAAC,kBAAkB,SAAS,OAAO,KAAK,GAAG;GAClE,OAAO,GACL,QAAQ,eACR,6DACF;GACA,MAAM,QAAQ,cAAc,GAAG;EACjC;EACA,MAAM,IAAI,KAAK;EACf,MAAM,MAAM,MAAM,QAAQ,SAAS,GAAG;EACtC,OAAO;GACL;GACA;GACA,OAAO,OAAO,UAAU;GACxB;GACA;GACA;GACA;GACA;GACA;GACA;GACA,aAAa,IAAI,MAAM;EACzB;CACF,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EACvC,MAAM;CACR;AACF;;AAGA,eAAe,QACb,SACA,KACiB;CACjB,IAAI;CACJ,IAAI,QAAQ,QACV,MAAM,MAAM,QAAQ,OAAO,GAAG;MACzB;EACL,MAAM,IAAI,OAAO,GAAG,WAAW;EAC/B,MAAM,MAAM,IAAI,OAAO;CACzB;CACA,OAAO,IAAI,QAAQ,SAAS,WAAW,CAAC,CAAC,QAAQ,OAAO,EAAE;AAC5D;AAEA,eAAe,SACb,SACA,WACA,QACA,IAC6B;CAC7B,MAAM,OAAO,MAAM,SAAS,SAAS,WAAW,MAAM;CACtD,IAAI;EACF,OAAO,MAAM,GAAG,IAAI;CACtB,UAAU;EACR,MAAM,KAAK,MAAM;CACnB;AACF;AAEA,SAASC,OAAK,UAAgD;CAC5D,OAAO,KAAK,MAAM,SAAS,KAAK,SAAS,MAAM,CAAC;AAClD;AAEA,eAAe,KACb,MACA,MACA,SACA,QAC0E;CAC1E,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,kBAAkB;EAClE,QAAQ;EACR,SAAS;GAAE,QAAQ;GAAc,GAAG;EAAQ;EAC5C;EACA;CACF,CAAC;CACD,OAAO,MACL,SAAS,QACT,KACA,qBAAqB,SAAS,OAAO,IAAI,SAAS,KAAK,SAAS,MAAM,GACxE;CACA,MAAM,QAAQA,OAAK,QAAQ;CAI3B,OAAO;EACL,QAAQ,SAAS;EACjB,OAAO,OAAO,KAAK,MAAM,MAAM,QAAQ;EACvC,SAAS,IAAI,IAAI,MAAM,OAAO;CAChC;AACF;AAEA,SAAS,SACP,IACA,OACA,MAMA;CACA,OAAO,OAAO,SAAiC,cAC7C,SAAS,SAAS,WAAW,CAAC,GAAG,OAAO,SAAS;EAC/C,MAAM,QAAQ,KAAK;EACnB,MAAM,WAAW,OAAO,QACrB,MAAM,WAAW,MAAM,UAAU,KAAA,IAAY,CAAC,IAAI,CAAC,MAAM,KAAK,GAAA,CAAI,KAChE,UAAU,OAAO,KAAK,KAAK,CAC9B,CACF;EACA,MAAM,UAAkC,EAAE,GAAG,MAAM,QAAQ;EAC3D,IAAI,MAAM,aACR,QAAQ,kBAAkB,MAAM;EAElC,IAAI,CAAC,MAAM,QACT,QAAQ,oBAAoB,OAAO,SAAS,MAAM;EAEpD,MAAM,SAAS,MAAM,KAAK,MAAM,MAAM,OAAO,SAAS,MAAM,MAAM;EAClE,OAAO,UACL,CAAC,GAAG,OAAO,KAAK,GAChB,CAAC,GAAG,QAAQ,GACZ,GAAG,GAAG,IAAI,MAAM,eAClB;EACA,OAAO,MACL,OAAO,QAAQ,IAAI,cAAc,KAAK,MACtC,MAAM,eAAe,MACrB,GAAG,GAAG,uBACR;CACF,CAAC;AACL;AAEA,eAAe,QACb,WACA,SACA,YAAY,KACG;CACf,MAAM,UAAU,KAAK,IAAI;CACzB,OAAO,CAAC,UAAU,GAAG;EACnB,IAAI,KAAK,IAAI,IAAI,UAAU,WACzB,OAAO,KAAK,OAAO;EAErB,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,EAAE,CAAC;CACxD;AACF;;;;;AAMA,eAAe,YAAe,OAAe,IAAkC;CAC7E,MAAM,WAAW,QAAQ,IAAI;CAC7B,QAAQ,IAAI,WAAW;CACvB,IAAI;EACF,OAAO,MAAM,GAAG;CAClB,UAAU;EACR,IAAI,aAAa,KAAA,GACf,QAAQ,eAAe,QAAQ,KAAK,UAAU;OAE9C,QAAQ,IAAI,WAAW;CAE3B;AACF;AAEA,MAAM,gBAAmB,OAAyB,YAAY,cAAc,EAAE;;AAG9E,MAAM,UAAU;CAAE,QAAQ;CAAI,KAAK;AAAE;AAErC,SAAS,YAAY,MAA4B;CAC/C,MAAM,yBAAS,IAAI,IAAoB;CACvC,OAAO,EACL,MAAM,EACJ,WAAW;EACT,SAAS;EACT,aAAa,EAAE,aAAa,QAAQ;EACpC,eAAe,EACb,MAAM,QAAQ,KAAK,MAAM;GACvB,KAAK,KAAK,GAAG;GACb,MAAM,SAAS,OAAO,IAAI,GAAG,KAAK,KAAK;GACvC,OAAO,IAAI,KAAK,KAAK;GACrB,OAAO,QAAQ,KAAK,MAChB;IAAE,SAAS;IAAO,YAAY,KAAK;GAAO,IAC1C;IAAE,SAAS;IAAM,YAAY;GAAK;EACxC,EACF;CACF,EACF,EACF;AACF;;AAGA,MAAM,kBAA8B,EAClC,MAAM,EACJ,UAAU,EAAE,WAAW,EAAE,gBAAgB,CAAC,eAAe,SAAS,EAAE,EAAE,EACxE,EACF;AAEA,SAAS,aAAa,MAAgB,GAAG,OAA2B;CAClE,OAAO,KAAK,OAAO,QAChB,QACE,UACC,MAAM,UAAU,UAChB,MAAM,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,CAAC,CACnD,CAAC,CACA,KAAK,UAAU,MAAM,IAAI;AAC9B;AAEA,SAAS,YAAY,MAAwB;CAC3C,OAAO,KAAK,IAAI,QAAQ,YAAY,OAAO;AAC7C;AAEA,SAAS,aACP,QACA,SACA,MAC2C;CAC3C,OAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,UAAU,QAAQ,MAAM;EAC9B,MAAM,SAAmB,CAAC;EAC1B,IAAI,SAAS;EACb,MAAM,QAAQ,UAAiB;GAC7B,QAAQ,MAAM;GACd,OAAO,KAAK;EACd;EACA,QAAQ,KAAK,SAAS,IAAI;EAC1B,MAAM,SAAS,QAAQ,QAAQ,OAAO;EACtC,OAAO,KAAK,SAAS,IAAI;EACzB,OAAO,KAAK,aAAa,aAAa;GACpC,SAAS,OAAO,SAAS,cAAc,CAAC;EAC1C,CAAC;EACD,OAAO,GAAG,SAAS,UAAkB,OAAO,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC;EACpE,OAAO,KAAK,aAAa;GACvB,QAAQ,MAAM;GACd,QAAQ;IAAE;IAAQ,MAAM,OAAO,OAAO,MAAM;GAAE,CAAC;EACjD,CAAC;EACD,OAAO,IAAI,IAAI;CACjB,CAAC;AACH;AAEA,MAAM,oBAAoB;AAC1B,MAAM,gBAAgB;CACpB,KAAK,kBAAkB;CACvB;CACA;CACA,KAAK,kBAAkB;CACvB;CACA;CACA;CACA,KAAK,kBAAkB;AACzB,CAAC,CAAC,KAAK,EAAE;;;;;;;;;;;AAiBT,SAAgB,wBACd,SACmB;CACnB,MAAM,aAAa,QAAQ,aAAa,CAAC,WAAW,SAAS;CAC7D,MAAM,QAA2B,CAAC;CAClC,MAAM,OACJ,IACA,OACA,KACA,SACG;EACH,KAAK,MAAM,aAAa,YACtB,MAAM,KACJ,gBACE,IACA,GAAG,MAAM,IAAI,UAAU,UACjB,IAAI,SAAS,SAAS,GAC5B,OAAO,SAAS,CAClB,CACF;CAEJ;CACA,MAAM,gBACJ,qBAAqB,QAAQ,QAAQ,MAAM,KAAA,KAC3C,CAAC,qBAAqB,QAAQ,QAAQ,CAAC,EAAE,QACrC,8CACA,KAAA;;CAEN,MAAM,aAAa,OACjB,MACyC;EAEzC,IAAI,EAAC,MADsB,eAAe,CAAC,EAAA,EACxB,OACjB,OAAO,gBAAgB,2CAA2C;EAEpE,OAAO,GACL,EAAE,OACF,gFACF;CAEF;CACA,MAAM,qBACJF,eAAa,QAAQ,UAAU,YAAY,MAAM,QAC7C,8DACA,KAAA;;CAEN,MAAM,eAAe,QAAQ,UAC3B,QAAQ,iBAAiB,kBAAkB,SAAS,KAAK,IACrD,KAAA,IACA,QACE,wEACA;;CAER,MAAM,cAAc,iBACjB,QAAQ,QAAQ,IAAI,KAAA,MAAc,YAAY,KAAK;;CAEtD,MAAM,kBAAkB,OACtB,GACA,UAEA,QAAQ,WAAW,CAAC,IAAI,KAAA;CAC1B,MAAM,aAAa,OAAgB,UACjC,QAAQ,gBAAgB,UAAU;CAEpC,IACE,mBACA,yDACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,KAAK,MAAM,UAAU;GACnB;GACA;GACA;GACA;GACA;GACA;GACA;EACF,GAAG;GACD,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,kBAAkB;IACjD;IACA,SAAS;KAAE,QAAQ;KAAc,kBAAkB;IAAI;GACzD,CAAC;GACD,OAAO,GACL,KAAK,OAAO,SAAS,GAAG,OAAO,GAAG,KAAK,gBAAgB,GACvD,GAAG,OAAO,wCAAwC,KAAK,OAAO,KAAK,IAAI,EAAE,EAC3E;EACF;CACF,CAAC,CACL;CACA,IACE,oBACA,wFACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,QAAQ,GAAG,KAAK,MAAM,MAAM;EAClC,OAAO,GACL,KAAK,OAAO,SAAS,OAAO,MAAM,GAClC,8CACF;EACA,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,IAAI,WAAW;EACtD,OAAO,MAAM,SAAS,QAAQ,GAAG;EACjC,OAAO,GACL,CAAC,KAAK,OAAO,MAAM,UAAU,MAAM,SAAS,YAAY,CAAC,GACzD,gCACF;EACA,MAAM,OAAO,MAAM,QAAQ,GAAG,KAAK,IAAI,UAAU;EACjD,OAAO,MAAM,KAAK,QAAQ,GAAG;EAC7B,OAAO,UAAUE,OAAK,IAAI,GAAG,EAAE,MAAM,KAAK,CAAC;CAC7C,CAAC,CACL;CACA,IACE,uBACA,4FACA,OAAO,GAAG,MAAM;EACd,MAAM,SACJ,GACA,GACA;GACE,MAAM,EAAE,UAAU,eAAe;GACjC,QAAQ;GACR,YAAY;EACd,GACA,OAAO,SAAS;GACd,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,IAAI,wBAAwB;GACnE,OAAO,MAAM,SAAS,QAAQ,GAAG;GACjC,OAAO,MAAM,SAAS,KAAK,SAAS,MAAM,GAAG,cAAc;GAC3D,MAAM,OAAO,MAAM,QAAQ,GAAG,KAAK,IAAI,aAAa;GACpD,OAAO,MAAM,KAAK,QAAQ,GAAG;GAC7B,MAAM,WAAW,MAAM,QACrB,GAAG,KAAK,IAAI,2BACd;GACA,OAAO,SAAS,SAAS,QAAQ,GAAG;EACtC,CACF;EACA,MAAM,SACJ,GACA,GACA,EAAE,MAAM,EAAE,SAAS,GAAG,aAAa,YAAY,EAAE,GACjD,OAAO,SAAS;GACd,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,IAAI,sBAAsB;GACjE,OAAO,MAAM,SAAS,QAAQ,GAAG;EACnC,CACF;CACF,CACF;CACA,MAAM,eAAe,CAAC,IAAI,IAAI,YAAY,CAAC,CAAC,MAAM,gBAAgB;CAClE,MAAM,eAA2B;EAC/B,MAAM;GACJ,SAAS;IAAE,cAAc;IAAc,UAAU;GAAa;GAC9D,UAAU;EACZ;EACA,QAAQ;EACR,YAAY;CACd;CACA,MAAM,oBAAoB,OAAgB,SAAiB;EACzD,MAAM,MAAM,IAAI,IAAI,OAAO,KAAK,CAAC;EACjC,OAAO,MACL,IAAI,MACJ,MACA,yCAAyC,MAC3C;EACA,OAAO,MAAM,IAAI,UAAU,GAAG,aAAa,WAAW;CACxD;CACA,IACE,uBACA,+HACC,GAAG,MACF,SAAS,GAAG,GAAG,cAAc,OAAO,SAAS;EAC3C,KAAK,MAAM,QAAQ,cAAc;GAC/B,MAAM,WAAW,MAAM,QACrB,GAAG,KAAK,MAAM,aAAa,aAC3B,EACE,SAAS,EAAE,KAAK,EAClB,CACF;GACA,OAAO,MACL,SAAS,QACT,KACA,GAAG,KAAK,IAAI,SAAS,KAAK,SAAS,MAAM,CAAC,CAAC,MAAM,GAAG,GAAG,GACzD;GACA,iBAAiBA,OAAK,QAAQ,CAAC,CAAC,KAAK,IAAI;EAC3C;EACA,MAAM,OAAO,MAAM,QAAQ,GAAG,KAAK,IAAI,aAAa;EACpD,OAAO,MAAM,KAAK,QAAQ,GAAG;EAC7B,MAAM,WAAW,MAAM,QACrB,GAAG,KAAK,IAAI,KAAK,aAAa,YAChC;EACA,OAAO,SAAS,SAAS,QAAQ,GAAG;EACpC,MAAM,cAAc,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,YAAY;EACjE,OAAO,MAAM,YAAY,QAAQ,GAAG;EACpC,OAAO,GACL,CAAC,KAAK,OAAO,MAAM,UAAU,MAAM,SAAS,IAAI,CAAC,GACjD,8CAA8C,KAAK,OAAO,KAAK,IAAI,GACrE;CACF,CAAC,CACL;CACA,IACE,uBACA,sFACA,OAAO,GAAG,MAAM;EACd,MAAM,OAAO,MAAM,WAAW,CAAC;EAC/B,IAAI,MACF,OAAO;EAET,MAAM,SAAS,GAAG,GAAG;GAAE,GAAG;GAAc,OAAO;EAAK,GAAG,OAAO,SAAS;GACrE,MAAM,WAAW,MAAM,aAAa,YAAY,IAAI,GAAG;IACrD,WAAW;IACX,SAAS,GAAG,aAAa;IACzB,cAAc;GAChB,CAAC;GACD,OAAO,MAAM,SAAS,QAAQ,KAAK,SAAS,KAAK,SAAS,MAAM,CAAC;GACjE,iBACG,KAAK,MAAM,SAAS,KAAK,SAAS,MAAM,CAAC,CAAC,CAAqB,KAChE,gBACF;EACF,CAAC;CACH,GACA,OACF;CACA,IACE,0BACA,6DACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,WAAW;EAC7D,OAAO,MAAM,SAAS,QAAQ,GAAG;EACjC,OAAO,UAAUA,OAAK,QAAQ,GAAG,EAAE,OAAO,MAAM,CAAC;EACjD,OAAO,GACL,CAAC,KAAK,OAAO,MAAM,UAAU,MAAM,SAAS,YAAY,CAAC,GACzD,2CACF;CACF,CAAC,CACL;CAEA,MAAM,SAA6D;EACjE;GACE;GACA;UACO;IACL,OAAO;IACP,aAAa;GACf;EACF;EACA;GACE;GACA;UACO;IACL,OAAO;IACP,aAAa;GACf;EACF;EACA;GACE;GACA;UACO;IACL,OAAO;IACP,aAAa;GACf;EACF;EACA;GACE;GACA;UACO;IAAE,OAAO;IAAmB,aAAa;GAAa;EAC/D;EACA;GACE;GACA;UACO;IACL,OAAO;IACP,aAAa;GACf;EACF;EACA;GACE;GACA;UACO;IACL,OAAO;IACP,aAAa,iCAAiC;GAChD;EACF;EACA;GACE;GACA;UACO;IACL,OAAO,WAAW,KAAK,EAAE,QAAQ,IAAI,IAAI,GAAG,UAAU,KAAK;IAC3D,aAAa;GACf;EACF;EACA;GACE;GACA;UACO;IACL,QAAQ;KAAC;KAAY;KAAU;IAAU;IACzC,aAAa;GACf;EACF;EACA;GACE;GACA;UACO;IAAE,OAAO;IAAI,aAAa;GAAmB;EACtD;EACA;GACE;GACA;UACO,EAAE,OAAO,YAAY;EAC9B;CACF;CACA,KAAK,MAAM,CAAC,IAAI,OAAO,UAAU,QAC/B,IAAI,IAAI,GAAG,MAAM,sBAAsB,SAAS,IAAI,OAAO,KAAK,CAAC;CAEnE,IAAI,uBAAuB,kCAAkC,GAAG,MAC9D,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,WAAW,MAAM,YAAY,KAAK,MAAM,EAAE,UAAU,KAAK,CAAC;EAChE,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,iBAAiB;GACjE,QAAQ;GACR,SAAS;IACP,QAAQ;IACR,gBAAgB;GAClB;GACA,MAAM,IAAI,gBAAgB;IACxB,OAAO,SAAS;IAChB,UAAU,SAAS;GACrB,CAAC,CAAC,CAAC,SAAS;EACd,CAAC;EACD,OAAO,MACL,SAAS,QACT,KACA,SAAS,KAAK,SAAS,MAAM,CAAC,CAAC,MAAM,GAAG,GAAG,CAC7C;EACA,OAAO,GACL,eAAe,SAAS,OAAO,CAAC,CAAC,MAAM,SACrC,KAAK,SAAS,gBAAgB,CAChC,GACA,mCACF;CACF,CAAC,CACH;CAEA,MAAM,UAAsB;EAC1B,QAAQ,EAAE,MAAM,EAAE,WAAW,GAAG,EAAE;EAClC,MAAM;CACR;CACA,IACE,oBACA,kEACC,GAAG,MACF,SAAS,GAAG,GAAG,SAAS,OAAO,SAAS;EACtC,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,kBAAkB;GAClE,QAAQ;GACR,SAAS;IACP,QAAQ;IACR,gBAAgB;IAChB,kBAAkB;GACpB;GACA,MAAM,IAAI,OAAO,EAAE;EACrB,CAAC;EACD,OAAO,MAAM,SAAS,QAAQ,GAAG;EACjC,OAAO,MACL,SAAS,QAAQ,gCACjB,WACF;EACA,OAAO,MAAM,SAAS,KAAK,SAAS,MAAM,GAAG,aAAa;EAC1D,OAAO,MAAM,KAAK,MAAM,MAAM,QAAQ,GAAG,wBAAwB;CACnE,CAAC,CACL;CACA,IACE,mBACA,iEACC,GAAG,MACF,SAAS,GAAG,GAAG,SAAS,OAAO,SAAS;EACtC,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,kBAAkB;GAClE,QAAQ;GACR,SAAS;IAAE,QAAQ;IAAa,gBAAgB;GAAa;GAC7D,QAAQ,CAAC,IAAI,OAAO,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC;EACzC,CAAC;EACD,OAAO,MAAM,SAAS,QAAQ,GAAG;EACjC,OAAO,MACL,SAAS,QAAQ,gCACjB,WACF;EACA,OAAO,MAAM,SAAS,KAAK,SAAS,MAAM,GAAG,aAAa;EAC1D,OAAO,MAAM,KAAK,MAAM,MAAM,QAAQ,GAAG,wBAAwB;CACnE,CAAC,CACL;CACA,IACE,0BACA,qDACC,GAAG,MACF,SAAS,GAAG,GAAG,SAAS,OAAO,SAAS;EACtC,MAAM,QAAQ,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,kBAAkB;GAC/D,QAAQ;GACR,SAAS;IACP,QAAQ;IACR,gBAAgB;IAChB,kBAAkB;GACpB;GACA,MAAM,IAAI,OAAO,EAAE;EACrB,CAAC;EACD,OAAO,MAAM,MAAM,QAAQ,KAAK,kCAAkC;EAClE,MAAM,OAAO,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,kBAAkB;GAC9D,QAAQ;GACR,SAAS;IACP,QAAQ;IACR,gBAAgB;IAChB,kBAAkB;GACpB;GACA,MAAM,IAAI,OAAO,EAAE;EACrB,CAAC;EACD,OAAO,MAAM,KAAK,QAAQ,GAAG;EAC7B,OAAO,MAAM,KAAK,KAAK,SAAS,MAAM,GAAG,aAAa;CACxD,CAAC,CACL;CACA,IAAI,iBAAiB,sCAAsC,GAAG,MAC5D,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,IAAI,YAAY;GACrD,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM;EACR,CAAC;EACD,OAAO,MAAM,SAAS,QAAQ,GAAG;EACjC,OAAO,UAAUA,OAAK,QAAQ,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;CACpD,CAAC,CACH;CACA,IAAI,iBAAiB,4BAA4B,GAAG,MAClD,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,MAAM;EACZ,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,IAAI,YAAY;GACrD,QAAQ;GACR,SAAS,EAAE,gBAAgB,mBAAmB;GAC9C,MAAM;EACR,CAAC;EACD,OAAO,MAAMA,OAAK,QAAQ,CAAC,CAAC,SAAS,GAAG;CAC1C,CAAC,CACH;CACA,IAAI,eAAe,mDAAmD,GAAG,MACvE,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,OAAO,GAAG,KAAK;EACrB,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,MAAM;EACnD,OAAO,MAAMA,OAAK,QAAQ,CAAC,CAAC,KAAK,GAAG,eAAe,MAAM;CAC3D,CAAC,CACH;CACA,IAAI,iBAAiB,kCAAkC,GAAG,MACxD,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,OAAO,GAAG,KAAK;EACrB,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,MAAM;EACnD,OAAO,MAAMA,OAAK,QAAQ,CAAC,CAAC,KAAK,GAAG,eAAe,MAAM;CAC3D,CAAC,CACH;CACA,IACE,yBACA,8DACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,UAAU;GACd,QAAQ;GACR,SAAS,GAAG,aAAa;GACzB,kBAAkB;GAClB,kBAAkB;GAClB,kBAAkB;GAClB,QAAQ;GACR,eAAe;GACf,gBAAgB;EAClB;EACA,MAAM,SAAS,MAAM,KAAK,MAAM,MAAM;GACpC,GAAG;GACH,kBAAkB;EACpB,CAAC;EACD,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,OAAO,GAChD,OAAO,MAAM,OAAO,QAAQ,IAAI,IAAI,GAAG,OAAO,GAAG,KAAK,SAAS;CAEnE,CAAC,CACL;;CAEA,MAAM,UAAU,OACd,MACA,UAAkC,CAAC,MAC+B;EAClE,MAAM,WAAW,KAAK,QAClB,MAAM,aAAa,YAAY,IAAI,GAAG;GACpC,WAAW;GACX,SAAS,GAAG,KAAK;GACjB,GAAG;EACL,CAAC,IACD,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,YAAY,EAAE,QAAQ,CAAC;EAC5D,OAAO,SAAS,WAAW,MACvB;GACE,QAAQ,SAAS;GACjB,GAAI,KAAK,MAAM,SAAS,KAAK,SAAS,MAAM,CAAC;EAC/C,IACA,EAAE,QAAQ,SAAS,OAAO;CAChC;CACA,IACE,iBACA,oDACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,QAAQ,MAAM,QAAQ,IAAI;EAChC,OAAO,MACL,MAAM,UACN,UACA,6EACF;EACA,OAAO,MAAM,MAAM,IAAI,QAAQ;CACjC,CAAC,CACL;CACA,IACE,iBACA,gEACA,OAAO,GAAG,MAAM;EACd,MAAM,OAAO,MAAM,WAAW,CAAC;EAC/B,IAAI,MACF,OAAO;EAET,MAAM,SAAS,GAAG,GAAG,EAAE,OAAO,KAAK,GAAG,OAAO,SAAS;GACpD,MAAM,WAAW,MAAM,aAAa,YAAY,IAAI,GAAG;IACrD,WAAW;IACX,SAAS,GAAG,KAAK;GACnB,CAAC;GACD,OAAO,MAAM,SAAS,QAAQ,KAAK,SAAS,KAAK,SAAS,MAAM,CAAC;GACjE,MAAM,QAAQ,KAAK,MAAM,SAAS,KAAK,SAAS,MAAM,CAAC;GAGvD,OAAO,MACL,MAAM,UACN,UACA,+CACF;EACF,CAAC;CACH,GACA,OACF;CACA,MAAM,YAAY;EAChB,mBAAmB;EACnB,aAAa;GACZ,+BAA+B,IAAI,OAAO,EAAE,MAAM;CACrD;CACA,IACE,iBACA,iHACC,GAAG,MAAM;EACR,MAAM,OAAiB,CAAC;EACxB,OAAO,mBACL,SAAS,GAAG,GAAG,YAAY,IAAI,GAAG,OAAO,SAAS;GAChD,MAAM,QAAQ,MAAM,QAAQ,IAAI;GAChC,OAAO,MAAM,MAAM,UAAU,QAAQ;GACrC,MAAM,WAAW,CAAC,MAAM,MAAM;GAC9B,KAAK,IAAI,QAAQ,GAAG,SAAS,QAAQ,KAAK,SACxC,SAAS,MAAM,MAAM,QAAQ,IAAI,EAAA,CAAG,MAAM;GAE5C,OAAO,UACL,UACA;IAAC;IAAK;IAAK;GAAG,GACd,wBAAwB,QAAQ,IAAI,aAAa,SAAS,KAAK,IAAI,GACrE;GACA,OAAO,OACJ,MAAM,QAAQ,MAAM,SAAS,EAAA,CAAG,QACjC,KACA,0EACF;GACA,OAAO,UACL,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,GACjB,CAAC,GAAG,SAAS,WAAW,GACxB,mDACF;EACF,CAAC,CACH;CACF,CACF;CACA,KAAK,MAAM,SAAS,CAAC,OAAO,IAAI,GAC9B,IACE,iBACA,UACE,OACA,gGACF,GACA,OAAO,GAAG,MAAM;EACd,MAAM,OAAO,MAAM,gBAAgB,GAAG,KAAK;EAC3C,IAAI,MACF,OAAO;EAET,MAAM,OAAiB,CAAC;EACxB,MAAM,CAAC,MAAM,SAAS,CAAC,gBAAgB,cAAc;EACrD,OAAO,mBACL,SACE,GACA,GACA;GAAE,GAAG,YAAY,IAAI;GAAG,YAAY;GAAM;EAAM,GAChD,OAAO,SAAS;GACd,MAAM,WAAqB,CAAC;GAC5B,KAAK,IAAI,QAAQ,GAAG,SAAS,QAAQ,KAAK,SACxC,SAAS,MACN,MAAM,QAAQ,MAAM,EAAE,mBAAmB,KAAK,CAAC,EAAA,CAAG,MACrD;GAEF,OAAO,UAAU,UAAU;IAAC;IAAK;IAAK;GAAG,CAAC;GAC1C,MAAM,QAAQ,MAAM,QAAQ,MAAM,EAAE,mBAAmB,MAAM,CAAC;GAC9D,OAAO,MACL,MAAM,QACN,KACA,kDACF;GACA,OAAO,MAAM,MAAM,UAAU,KAAK;GAClC,OAAO,UAAU,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAC1C,GAAG,KAAK,aACR,GAAG,MAAM,WACX,CAAC;EACH,CACF,CACF;CACF,GACA,WAAW,KAAK,CAClB;CAEF,IACE,iBACA,2IACC,GAAG,MACF,mBACE,SAAS,GAAG,GAAG,iBAAiB,OAAO,SAAS;EAC9C,MAAM,QAAQ,MAAM,QAAQ,MAAM,EAChC,mBAAmB,eACrB,CAAC;EACD,OAAO,MACL,MAAM,UACN,MACA,wBAAwB,OAAO,MAAM,QAAQ,EAAE,8CACjD;EAEA,MAAM,QADW,iBAAiB,KAAK,GAClB,CAAC,CAAC,aACrB,KAAK,IAAI,eAAe,CAC1B;EACA,MAAM,MAAM,aAAa,MAAM,eAAe,gBAAgB;EAC9D,IAAI,OAAO,SAAS,QAClB,OAAO,MAAM,IAAI,QAAQ,GAAG,KAAK,OAAO,KAAK,CAAC;CAElD,CAAC,CACH,CACJ;CACA,KAAK,MAAM,SAAS,CAAC,OAAO,IAAI,GAC9B,IACE,iBACA,UACE,OACA,+GACF,GACA,OAAO,GAAG,MAAM;EACd,MAAM,OAAO,MAAM,gBAAgB,GAAG,KAAK;EAC3C,IAAI,MACF,OAAO;EAET,OAAO,mBACL,SACE,GACA,GACA;GAAE,GAAG;GAAiB,YAAY;GAAM;EAAM,GAC9C,OAAO,SAAS;GACd,MAAM,QAAQ,MAAM,QAAQ,MAAM,EAChC,mBAAmB,eACrB,CAAC;GACD,OAAO,MACL,MAAM,UACN,gBACA,kEACF;GACA,OAAO,UACL,aAAa,MAAM,eAAe,gBAAgB,GAClD,CAAC,CACH;EACF,CACF,CACF;CACF,GACA,WAAW,KAAK,CAClB;CAEF,IAAI,cAAc,8CAA8C,GAAG,MACjE,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EAQjC,MAAM,KAAKA,OAAK,MAPO,QAAQ,GAAG,KAAK,MAAM,KAAK,YAAY,EAC5D,SAAS;GACP,mBAAmB;GACnB,aAAa;IACZ,+BAA+B,IAAI,OAAO,EAAE,MAAM;EACrD,EACF,CAAC,CACuB,CAAC,CAAC;EAC1B,OAAO,GACL,CAAC;GAAC;GAAe;GAAe;EAAa,CAAC,CAAC,SAAS,OAAO,EAAE,CAAC,GAClE,qCAAqC,OAAO,EAAE,GAChD;CACF,CAAC,CACH;CACA,IACE,iBACA,iFACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,WAAW,iBAAiB,KAAK,GAAG;EAC1C,IAAI,OAAO,SAAS,eAAe,YACjC,OAAO,gBACL,2DACF;EAEF,MAAM,UAAU,KAAK,IAAI,eAAe;EACxC,MAAM,SAAS,SAAS,WAAW,OAAO;EAC1C,IAAI;EACJ,IAAI,EAAE,eAAe;GACnB,MAAM,EAAE,cAAc,KAAK,GAAG;GAC9B,QAAQ,SAAS,WAAW,OAAO;EACrC,OAAO;GAEL,MAAM,UAAU,MAAM,SAAS,GAAG,GAAG,EAAE,YAAY,KAAK,CAAC;GACzD,IAAI;IACF,QAAQ,iBAAiB,QAAQ,GAAG,CAAC,CAAC,WACpC,QAAQ,IAAI,eAAe,CAC7B;GACF,UAAU;IACR,MAAM,QAAQ,MAAM;GACtB;EACF;EACA,IAAI,OAAO,SAAS,aAAa,MAAM,SAAS,WAAW;GACzD,OAAO,MACL,OAAO,MACP,MAAM,MACN,6EACF;GACA;EACF;EACA,OAAO,aACL,OACA,QACA,8CACF;EACA,OAAO,SAAS,MAAM,MAAM,MAAM;CACpC,CAAC,SACG,aAAa,KAAK,YAAY,CACtC;CACA,MAAM,YAAY;EAChB,qBAAqB;EACrB,oBAAoB;CACtB;CACA,MAAM,iBAA6B;EACjC,MAAM,EAAE,SAAS,KAAA,EAAU;EAC3B,QAAQ,EAAE,MAAM,EAAE,4BAA4B,KAAK,EAAE;CACvD;CACA,MAAM,YAAY,OAAO,SACvB,IAAI,IACF,OACEA,OACE,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,aAAa,EAC5C,SAAS,UACX,CAAC,CACH,CAAC,CAAC,GACJ,CACF;CACF,IACE,qBACA,iEACC,GAAG,MACF,SAAS,GAAG,GAAG,gBAAgB,OAAO,SAAS;EAC7C,MAAM,MAAM,MAAM,UAAU,IAAI;EAChC,OAAO,SAAS,IAAI,MAAM,iBAAiB,sBAAsB;EACjE,OAAO,SAAS,IAAI,UAAU,UAAU,sBAAsB;CAChE,CAAC,CACL;CACA,IACE,qBACA,sEACC,GAAG,MACF,SAAS,GAAG,GAAG;EAAE,GAAG;EAAgB,YAAY;CAAK,GAAG,OAAO,SAAS;EACtE,OAAO,OAAO,MAAM,UAAU,IAAI,EAAA,CAAG,QAAQ,uBAAuB;CACtE,CAAC,SACG,YAAY,CACpB;CACA,IACE,eACA,iDACA,OAAO,GAAG,MAAM;EACd,MAAM,OAAO,MAAM,WAAW,CAAC;EAC/B,IAAI,MACF,OAAO;EAET,MAAM,SAAS,GAAG,GAAG,EAAE,OAAO,KAAK,GAAG,OAAO,SAAS;GACpD,MAAM,WAAW,MAAM,aACrB,YAAY,IAAI,GAChB;IACE,WAAW;IACX,SAAS,GAAG,KAAK;IACjB,QAAQ;IACR,gBAAgB;GAClB,GACA,SACF;GACA,OAAO,MAAM,SAAS,QAAQ,GAAG;GACjC,MAAM,QAAQ,KAAK,MAAM,SAAS,KAAK,SAAS,MAAM,CAAC;GAIvD,OAAO,MAAM,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,GAAG,SAAS;GACpE,OAAO,GACL,MAAM,QAAQ,OAAO,CAAC,UAAU,CAAC,KAAK,WAAW,GAAG,CAAC,GACrD,oCACF;EACF,CAAC;CACH,GACA,OACF;CACA,IACE,sBACA,qDACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EAEjC,MAAM,QAAQ,gBAAe,MADN,QAAQ,GAAG,KAAK,MAAM,KAAK,oBAAoB,EACzC,CAAS,OAAO;EAC7C,OAAO,MAAM,MAAM,QAAQ,GAAG,qBAAqB,MAAM,KAAK,KAAK,GAAG;EACtE,OAAO,UAAU,MAAM,KAAK,SAAS,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG;GAClE;GACA;GACA;EACF,CAAC;CACH,CAAC,CACL;CACA,IACE,mBACA,qDACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,gBAAgB;EAClE,OAAO,MAAM,SAAS,QAAQ,GAAG;EACjC,OAAO,MACL,SAAS,QAAQ,UACjB,mCACF;EACA,OAAO,GACL,eAAe,SAAS,OAAO,CAAC,CAAC,MAAM,SACrC,KAAK,WAAW,kBAAkB,CACpC,CACF;CACF,CAAC,CACL;CACA,IACE,iBACA,wEACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,cAAc;EAChE,OAAO,MACL,SAAS,KAAK,SAAS,MAAM,GAC7B,0BACF;EACA,KAAK,MAAM,kBAAkB;EAC7B,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,gBAAgB,EAC/C,sBAAsB,KACxB,CAAC;EACD,MAAM,cACE,KAAK,MAAM,iBACjB,mDACF;CACF,CAAC,CACL;CACA,IAAI,eAAe,8CAA8C,GAAG,MAClE,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,cAAc,EAC9D,QAAQ,OACV,CAAC;EACD,OAAO,GAAG,SAAS,SAAS,KAAK,iBAAiB,SAAS,QAAQ;EACnE,OAAO,MAAM,SAAS,KAAK,QAAQ,CAAC;CACtC,CAAC,CACH;CACA,IACE,iBACA,2FACC,GAAG,MACF,SAAS,GAAG,GAAG,EAAE,MAAM,KAAK,GAAG,OAAO,SAAS;EAC7C,MAAM,OAAO,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,cAAc,EAC1D,SAAS,EAAE,QAAQ,YAAY,EACjC,CAAC;EACD,OAAO,MAAM,KAAK,QAAQ,GAAG;EAC7B,OAAO,MAAM,OAAO,KAAK,QAAQ,eAAe,GAAG,aAAa;EAChE,OAAO,MAAM,KAAK,KAAK,SAAS,MAAM,GAAG,cAAc;EACvD,MAAM,UAAU,UACd,OAAO,SAAS,EAAE,CAAC,CAChB,YAAY,CAAC,CACb,MAAM,GAAG,CAAC,CACV,KAAK,UAAU,MAAM,KAAK,CAAC,CAAC,CAC5B,OAAO,OAAO;EACnB,MAAM,OAAO,QAET,MAAM,QAAQ,GAAG,KAAK,IAAI,YAAY,EACpC,SAAS,EAAE,QAAQ,YAAY,EACjC,CAAC,EAAA,CACD,QAAQ,IACZ;EACA,MAAM,OAAO,OAAO,KAAK,QAAQ,IAAI;EACrC,KAAK,MAAM,SAAS,CAAC,GAAG,MAAM,QAAQ,GACpC,OAAO,GACL,KAAK,SAAS,KAAK,GACnB,aAAa,MAAM,IAAI,KAAK,KAAK,IAAI,GACvC;EAEF,MAAM,WAAW,MAAM,QACrB,GAAG,KAAK,MAAM,KAAK,uBACrB;EACA,OAAO,MAAM,SAAS,QAAQ,GAAG;EACjC,OAAO,MAAMA,OAAK,QAAQ,CAAC,CAAC,MAAM,iBAAiB;EACnD,KAAK,MAAM,SAAS,SAClB,SAAS,gBACL,IAAI,SAAS,aAAa;GACxB,MAAM;GACN,SAAS;EACX,CAAC,IACD,KAAA;EACN,MAAM,SAAS,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,YAAY;EAC5D,OAAO,MAAM,OAAO,QAAQ,GAAG;EAC/B,OAAO,MAAMA,OAAK,MAAM,CAAC,CAAC,MAAM,cAAc;CAChD,CAAC,CACL;CACA,IACE,oBACA,uDACC,GAAG,MACF,SAAS,GAAG,GAAG,EAAE,MAAM,KAAK,GAAG,OAAO,SAAS;EAC7C,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,aAAa;GAC7D,QAAQ;GACR,SAAS;IACP,QAAQ;IACR,iCAAiC;GACnC;EACF,CAAC;EACD,OAAO,GAAG,SAAS,UAAU,OAAO,SAAS,SAAS,GAAG;EACzD,OAAO,MACL,SAAS,QAAQ,gCACjB,WACF;EACA,OAAO,GACL,CAAC,KAAK,OAAO,MAAM,UAAU,MAAM,WAAW,SAAS,CAAC,GACxD,mCACF;CACF,CAAC,CACL;CACA,IAAI,iBAAiB,iDAAiD,GAAG,MACvE,SAAS,GAAG,GAAG,EAAE,MAAM,KAAK,GAAG,OAAO,SAAS;EAC7C,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,cAAc,EAC9D,SAAS,EAAE,QAAQ,YAAY,EACjC,CAAC;EACD,OAAO,MACL,SAAS,QAAQ,gCACjB,WACF;EACA,OAAO,MACL,SAAS,QAAQ,qCACjB,MACF;CACF,CAAC,CACH;CACA,IACE,kBACA,uEACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,IAAI,cAAc;EACzD,OAAO,MAAM,SAAS,QAAQ,GAAG;EACjC,MAAM,EAAE,UAAU,gBAAgB,eAAe,KAAK;EACtD,OAAO,GAAG,YAAY,OAAO,aAAa,QAAQ;EAClD,OAAO,MAAM,UAAU,cAAc;EACrC,OAAO,MAAM,UAAU,UAAU;CACnC,CAAC,CACL;CACA,IACE,yBACA,8FACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,QAAQ,GAAG,KAAK,IAAI,cAAc;EACxC,MAAM,WAAW,KAAK;EACtB,OAAO,MAAM,SAAS,WAAW,IAAI;EACrC,OAAO,MACL,SAAS,cACT,MACA,6BACF;EACA,OAAO,MACL,SAAS,gBACT,MACA,uDACF;EACA,OAAO,MAAM,SAAS,eAAe,IAAI;EACzC,MAAM,cACE,CAAC,KAAK,SAAS,CAAC,CAAC,OAAO,SAAS,OAAO,GAC9C,kDACF;CACF,CAAC,CACL;CACA,IACE,2BACA,gGACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,IAAI,cAAc;EACzD,OAAO,MAAM,KAAK,SAAS,cAAc,IAAI;EAC7C,MAAM,QAAQ,eAAe,SAAS,OAAO,CAAC,CAAC,KAC5C,SAAS,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,EAC/B;EACA,OAAO,GAAG,MAAM,SAAS,UAAU,GAAG,YAAY,MAAM,KAAK,GAAG,GAAG;EACnE,OAAO,GAAG,MAAM,SAAS,aAAa,GAAG,YAAY,MAAM,KAAK,GAAG,GAAG;EACtE,MAAM,WAAW,MAAM,YAAY,KAAK,IAAI;EAC5C,MAAM,KAAK,MAAM,QAAQ,GAAG,KAAK,IAAI,UAAU,EAC7C,SAAS,EAAE,QAAQ,SAAS,OAAO,EACrC,CAAC;EACD,OAAO,MAAM,GAAG,QAAQ,GAAG;EAC3B,OAAO,MAAMA,OAAK,EAAE,CAAC,CAAC,QAAQ,SAAS,MAAM;EAC7C,OAAO,MAAM,GAAG,QAAQ,QAAQ,KAAA,CAAS;EACzC,OAAO,GACL,CAAC,OAAO,GAAG,QAAQ,oBAAoB,EAAE,CAAC,CAAC,SAAS,UAAU,GAC9D,mDACF;CACF,CAAC,CACL;CACA,IACE,kBACA,wEACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,cAAc,EAC9D,SAAS,GAAG,eAAe,IAAI,EACjC,CAAC;EACD,OAAO,GAAG,SAAS,UAAU,KAAK,UAAU,SAAS,QAAQ;EAC7D,OAAO,GACL,KAAK,SAAS,KAAK,qBAAqB,GACxC,+CACF;EACA,OAAO,GAAG,KAAK,OAAO,OAAO,CAAC,CAAC,SAAS,GAAG,sBAAsB;CACnE,CAAC,CACL;CACA,IACE,wBACA,sEACC,GAAG,MACF,SAAS,GAAG,GAAG,EAAE,QAAQ,KAAK,GAAG,OAAO,SAAS;EAC/C,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,cAAc,EAC9D,SAAS,GAAG,eAAe,IAAI,EACjC,CAAC;EACD,OAAO,GAAG,SAAS,UAAU,GAAG;EAChC,OAAO,GAAG,KAAK,SAAS,KAAK,qBAAqB,CAAC;CACrD,CAAC,CACL;CACA,IACE,2BACA,oEACC,GAAG,MACF,SACE,GACA,GACA,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,KAAK,EAAE,EAAE,GACxC,OAAO,SAAS;EACd,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,cAAc,EAC7C,SAAS,GAAG,eAAe,YAAY,EACzC,CAAC;EACD,MAAM,QAAQ,KAAK,SAAS,MAAM,UAAU,WAAW,KAAK,CAAC;EAG7D,OAAO,GAAG,OAAO,yCAAyC;EAC1D,OAAO,MAAM,MAAM,MAAM,MAAM,uBAAuB;EACtD,MAAM,SAAS,QAAQ,IAAI,OAAO,WAAW;EAC7C,OAAO,UAAU,QAAQ,aAAa,GAAG,CACvC,iCACF,CAAC;CACH,CACF,CACJ;CACA,IACE,oBACA,4EACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,UAAU,MAAM,QAAQ,IAAI;GAChC,QAAQ,GAAG,KAAK,MAAM,KAAK,qBAAqB,EAAE,WAAW,IAAM,CAAC;GACpE,QAAQ,GAAG,KAAK,MAAM,KAAK,yBAAyB,EAClD,WAAW,IACb,CAAC;GACD,QAAQ,GAAG,KAAK,MAAM,KAAK,cAAc;IACvC,WAAW;IACX,SAAS,GAAG,eAAe,IAAI;GACjC,CAAC;EACH,CAAC;EACD,OAAO,GAAG,QAAQ,OAAO,aAAa,SAAS,UAAU,GAAG,CAAC;CAC/D,CAAC,CACL;CACA,IACE,sBACA,+DACC,GAAG,MACF,SAAS,GAAG,GAAG,EAAE,YAAY,KAAK,GAAG,OAAO,SAAS;EACnD,MAAM,KAAK,MAAM,MAAM;GACrB,gBAAgB;GAChB,kBAAkB;EACpB,CAAC;EACD,OAAO,UAAU,KAAK,MAAM,OAAO,CAAC,cAAc,MAAM,CAAC;CAC3D,CAAC,CACL;CACA,IACE,2BACA,iFACC,GAAG,MACF,SAAS,GAAG,GAAG,EAAE,OAAO,KAAK,GAAG,OAAO,SAAS;EAC9C,MAAM,MAAM;EACZ,MAAM,SAAS,MAAM,KAAK,MAAM,KAAK;GACnC,gBAAgB;GAChB,kBAAkB,OAAO,EAAU;EACrC,CAAC;EACD,OAAO,MAAM,OAAO,MAAM,SAAS,MAAM,GAAG,GAAG;CACjD,CAAC,CACL;CACA,IACE,gBACA,qEACA,OAAO,MAAM;EACX,MAAM,OAAO,sBAAsB;EACnC,MAAM,SAAS,MAAM,SAAS,IAAI;EAClC,MAAM,SAASD,YACb,GACA,MACA,MAAM,QAAQ,IAAI,GAClB,CAAC,GACD;GACE,UAAU,CAAC;GACX,QAAQ,CAAC;GACT,UAAU,CAAC;GACX,gBAAgB,OAAO,KAAK,2BAA2B;GACvD,eAAe,OAAO,KAAK,0BAA0B;EACvD,CACF;EACA,MAAM,UAAU,MAAM,YAAY,yBAAyB,QAAQ;GACjE,QAAQ;GACR,cAAc;EAChB,CAAC;EACD,MAAM,QAAQ,KAAK;EACnB,OAAO,MAAM,OAAO,OAAO,OAAO;EAClC,MAAM,QAAQ,MAAM;EACpB,OAAO,MAAM,OAAO,OAAO,QAAQ;EACnC,MAAM,YAAY,MAAM,KAAK,oBAAoB,EAC/C,SAAS,CAAC,MAAM,EAClB,CAAC,CAAC,CAAC,QAAQ;EACX,UAAU,UAAU,KAAK;EACzB,MAAM,UAAU,KAAK;EACrB,OAAO,MAAM,OAAO,OAAO,OAAO;EAClC,MAAM,UAAU,MAAM;EACtB,OAAO,MAAM,OAAO,OAAO,QAAQ;CACrC,CACF;CACA,IACE,gBACA,kGACA,OAAO,GAAG,MAAM;EACd,KAAK,MAAM,aAAa,CAAC,OAAO,IAAI,GAAG;GACrC,MAAM,QAAQ,GAAG,MAAM,YAAY,qCAAqC,gCAAgC,QAAQ,YAAY,yBAAyB;GACrJ,MAAM,OAAO,sBAAsB;GACnC,MAAM,SAAS,MAAM,SAAS,IAAI;GAClC,MAAM,SAAS,IAAI,gBAAgB;GACnC,MAAM,SAASA,YACb,GACA,MACA,MAAM,QAAQ,IAAI,GAClB,EAAE,QAAQ,EAAE,YAAY,KAAK,EAAE,GAC/B;IACE,UAAU,CAAC;IACX,QAAQ,CAAC;IACT,UAAU,CAAC;IACX,gBAAgB,OAAO,KAAK,2BAA2B;IACvD,eAAe,OAAO,KAAK,0BAA0B;GACvD,CACF;GACA,MAAM,sBAAsB;IAC1B,GAAG,EAAE,aAAc;IACnB;IACA,cAAc;GAChB;GACA,MAAM,eACJ,MAAM,YACF,MAAM,YAAY,mBAAmB,QAAQ,mBAAmB,KAE9D,MAAM,KAAK,oBAAoB,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAA,CAC9D,uBAAuB,mBAAmB;GAClD,IAAI;IACF,IAAI,WACF,MAAM,aAAa,KAAK;IAE1B,MAAM,aAAa,OAAO;IAC1B,OAAO,MACL,OAAO,OACP,SACA,GAAG,MAAM,4BACX;IACA,MAAM,YAAY,OAAO,QAAQ,QAAQ,UACvC,MAAM,KAAK,WAAW,aAAa,CACrC;IACA,OAAO,MACL,UAAU,QACV,GACA,GAAG,MAAM,sBAAsB,UAAU,OAAO,UAAU,OAAO,KAAK,GACxE;IACA,OAAO,MAAM,UAAU,EAAE,CAAE,MAAM,eAAe,KAAK;IACrD,OAAO,UAAU,OAAO,OAAO,GAAG,CAAC,GAAG,GAAG,MAAM,IAAI,OAAO,KAAK,GAAG;GACpE,UAAU;IACR,MAAM,aAAa,MAAM;GAC3B;GACA,OAAO,MACL,OAAO,OACP,UACA,GAAG,MAAM,6BAA6B,OAAO,OAC/C;EACF;CACF,SAEE,QAAQ,eAAe,KAAA,IAAY,kCACvC;CACA,IACE,kBACA,4EACA,OAAO,MAAM;EACX,MAAM,OAAO,sBAAsB;EACnC,MAAM,SAASA,YACb,GACA,MACA,MAAM,QAAQ,IAAI,GAClB,CAAC,GACD;GACE,UAAU,CAAC;GACX,QAAQ,CAAC;GACT,UAAU,CAAC;GACX,gBAAgB,OAAO,KAAK,QAAQ;GACpC,eAAe,OAAO,KAAK,QAAQ;EACrC,CACF;EACA,MAAM,YAAY,MAAM,KAAK,oBAAoB,EAC/C,SAAS,CAAC,MAAM,EAClB,CAAC,CAAC,CAAC,QAAQ;EACX,UAAU,UAAU,KAAK;EACzB,IAAI;GACF,MAAM,UAAU,KAAK;GACrB,MAAM,MAAM,UAAU,sBAAsB,EAAE,kBAAkB,GAAG,EACjE,QAAQ,MACV,CAAC;GACD,MAAM,SAAS,MAAM,aAAa,IAAI,KAAK,CAAC;GAC5C,OAAO,MAAM,OAAO,IAAI,OAAO,+BAA+B;GAC9D,OAAO,GACL,eAAe,CAAC,OAAO,MAAM,OAAO,KAAK,CAAC,CAAC,SACzC,mBACF,KAAK,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,CAAC,CAAC,SAAS,mBAAmB,GACpE,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,CACnC;EACF,UAAU;GACR,MAAM,UAAU,MAAM;EACxB;CACF,CACF;CACA,IACE,2BACA,2FACA,OAAO,MAAM;EACX,MAAM,eAAe,MAAM,eAAe,CAAC;EAC3C,MAAM,OAAO,sBAAsB;EACnC,MAAM,SAAmB,CAAC;EAC1B,MAAM,QAAkB,CAAC;EACzB,IAAI;EACJ,MAAM,SAASA,YACb,GACA,MACA,MAAM,QAAQ,IAAI,GAClB,CAAC,GACD;GACE,UAAU,CAAC;GACX;GACA,UAAU,CAAC;GACX,gBAAgB,iBAAiB,OAAQ,CAAC,CAAC;GAC3C,eAAe,QAAS,eAAe;GACvC;EACF,CACF;EACA,MAAM,YAAY,MAAM,KAAK,oBAAoB,EAC/C,SAAS,CAAC,MAAM,EAClB,CAAC,CAAC,CAAC,QAAQ;EACX,MAAM,QAAQ,UAAU,sBAAsB,EAAE,kBAAkB,GAAG,EACnE,QAAQ,MACV,CAAC;EACD,UAAU;EACV,MAAM,MAAM,KAAK;EACjB,MAAM,MAAM,MAAM;EAClB,MAAM,SAAS,UAAU,sBAAsB,EAAE,kBAAkB,GAAG,EACpE,QAAQ,MACV,CAAC;EACD,UAAU;EACV,IAAI;GACF,MAAM,SAAS,MAAM,aAAa,OAAO,KAAK,CAAC;GAC/C,IAAI,CAAC,cAAc,eAAe;IAChC,OAAO,MAAM,OAAO,IAAI,OAAO,+BAA+B;IAC9D,OAAO,MACL,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,GACjC,qBACF;IACA;GACF;GACA,OAAO,MACL,OAAO,IACP,MACA,kCAAkC,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,GACrE;GACA,MAAM,MAAM,MAAM,QAAQ,GAAG,MAAM;GACnC,MAAM,SAAS,MAAM;GACrB,MAAM,WAAW,MAAM,QAAQ,GAAG,MAAM,KAAK,YAAY;GACzD,OAAO,MAAM,SAAS,QAAQ,GAAG;GACjC,OAAO,MACL,MAAM,SAAS,QACf,GACA,gEACF;GACA,MAAM,OAAO,MAAM,QAAQ,GAAG,IAAI,UAAU;GAC5C,OAAO,MAAM,KAAK,QAAQ,GAAG;GAC7B,MAAM,WAAW,MAAM,YAAY,IAAI;GACvC,MAAM,gBAAgB,MAAM,QAAQ,GAAG,IAAI,qBAAqB,EAC9D,SAAS,EAAE,QAAQ,SAAS,OAAO,EACrC,CAAC;GACD,OAAO,MACL,cAAc,QACd,KACA,yDAAyD,cAAc,KAAK,SAAS,MAAM,GAC7F;GACA,OAAO,MAAMC,OAAK,aAAa,CAAC,CAAC,QAAQ,SAAS,MAAM;EAC1D,UAAU;GACR,MAAM,OAAO,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EAC5C;CACF,CACF;CACA,IACE,oBACA,qDACA,OAAO,GAAG,MAAM;EACd,MAAM,SAAS,MAAM,aACnB,SAAS,GAAG,GAAG,EAAE,kBAAkB,KAAK,CAAC,CAC3C;EACA,IAAI,OAAO,IAAI;GACb,MAAM,OAAO,MAAM,MAAM;GACzB,OAAO,KAAK,4BAA4B;EAC1C;EACA,OAAO,GACL,eAAe,OAAO,KAAK,CAAC,CAAC,SAAS,oBAAoB,GAC1D,OAAO,OAAO,KAAK,CACrB;CACF,CACF;CACA,IACE,uBACA,+GACA,OAAO,GAAG,MAAM;EACd,MAAM,OAAO,sBAAsB;EACnC,MAAM,SAAS,MAAM,SAAS,IAAI;EAClC,MAAM,SAAS,aACZ,MAAM,KAAK,QAAQ,IAAI,QAAQ,GAAG,eAAe,KAAK,YAAY,CAAC,EAAA,CACjE;EACL,MAAM,cAAwB,CAAC;EAC/B,IAAI;EACJ,MAAM,QAAQ,MAAM,SAAS,GAAG,GAAG;GACjC,UAAU;GACV,OAAO;GACP,YAAY,YAAY;IACtB,iBAAiB,MAAM,OAAO;GAChC;EACF,CAAC;EACD,IAAI;GACF,MAAM,SAAS,MAAM,QAAQ,GAAG,MAAM,MAAM,KAAK,YAAY;GAC7D,OAAO,MAAM,OAAO,QAAQ,GAAG;GAC/B,OAAO,MACL,YAAY,QACZ,GACA,oCACF;EACF,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;EACA,MAAM,SAAS,SACb,KAAK,OAAO,QACT,QAAQ,UAAU,MAAM,UAAU,MAAM,CAAC,CACzC,KAAK,UAAU,MAAM,IAAI;EAC9B,MAAM,WAAW,IAAI,IAAI,MAAM,KAAK,CAAC;EACrC,OAAO,MAAM,gBAAgB,GAAG;EAChC,OAAO,MACL,YAAY,QACZ,GACA,qGACF;EACA,OAAO,MACL,OAAO,OACP,UACA,gCAAgC,OAAO,OACzC;EACA,OAAO,MAAM,MAAM,OAAO,GAAG,GAAG;EAChC,OAAO,MACL,YAAY,QACZ,GACA,0FACF;EACA,MAAM,YAAsB,CAAC;EAC7B,MAAM,SACJ,GACA,GACA;GAAE,UAAU;GAAM,OAAO;EAAU,GACnC,OAAO,SAAS;GACd,OAAO,MAAM,OAAO,OAAO,OAAO;GAClC,OAAO,UACL,MAAM,IAAI,CAAC,CAAC,QAAQ,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,GAChD,CAAC,GACD,kEACF;GACA,MAAM,SAAS,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,YAAY;GAC5D,OAAO,MAAM,OAAO,QAAQ,GAAG;GAC/B,OAAO,MACL,UAAU,QACV,GACA,yCACF;GACA,OAAO,MACL,YAAY,QACZ,GACA,0EACF;EACF,CACF;CACF,CACF;CACA,IACE,qBACA,2EACC,GAAG,MACF,SACE,GACA,GACA,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,KAAK,EAAE,EAAE,GAC1C,OAAO,SAAS;EACd,KAAK,IAAI,QAAQ,GAAG,QAAQ,GAAG,SAAS;GACtC,MAAM,WAAW,MAAM,QACrB,GAAG,KAAK,MAAM,KAAK,kBACnB;IACE,QAAQ;IACR,SAAS;KACP,QAAQ;KACR,gBAAgB;IAClB;IACA,MAAM;GACR,CACF;GACA,OAAO,MAAM,SAAS,QAAQ,GAAG;EACnC;EACA,MAAM,WAAW,KAAK,OAAO,QAAQ,QAClC,UACC,MAAM,UAAU,UAChB,MAAM,KAAK,SAAS,GAAG,KAAK,gBAAgB,CAChD;EACA,OAAO,MAAM,SAAS,QAAQ,GAAG,KAAK,OAAO,KAAK,CAAC;EACnD,OAAO,MAAM,SAAS,EAAE,CAAE,MAAM,cAAc;CAChD,CACF,CACJ;CACA,MAAM,iBAAiB,SACrB,aAAa,MAAM,mBAAmB;CACxC,IACE,6BACA,6HACC,GAAG,MACF,mBACE,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,WAAW,iBAAiB,KAAK,GAAG;EAC1C,IAAI,OAAO,SAAS,eAAe,YACjC,OAAO,gBACL,2DACF;EAEF,MAAM,QAAQ,SAAS,WACrB,KAAK,IAAI,eAAe,CAC1B;EACA,IAAI,MAAM,SAAS,QACjB,OAAO,gBACL,wCAAwC,MAAM,KAAK,cACrD;EAEF,MAAM,OAAO,OAAO,UAAkC,CAAC,MAAM;GAC3D,MAAM,WAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,cAAc,EAC9D,QACF,CAAC;GACD,OAAO,MAAM,SAAS,QAAQ,GAAG;GACjC,OAAO,MAAM,SAAS,KAAK,SAAS,MAAM,GAAG,cAAc;EAC7D;EACA,MAAM,KAAK;EACX,OAAO,UACL,cAAc,IAAI,GAClB,CAAC,GACD,6CACF;EACA,MAAM,OAAO,MAAM,QAAQ,GAAG,KAAK,IAAI,YAAY,EACjD,SAAS,EAAE,mBAAmB,eAAe,EAC/C,CAAC;EACD,OAAO,MAAM,KAAK,QAAQ,GAAG;EAC7B,OAAO,UAAU,cAAc,IAAI,GAAG,CAAC,GAAG,qBAAqB;EAC/D,MAAM,KAAK,EAAE,mBAAmB,eAAe,CAAC;EAChD,MAAM,CAAC,SAAS,GAAG,YAAY,cAAc,IAAI;EACjD,OAAO,GACL,SACA,sDACF;EACA,OAAO,GACL,QAAQ,SAAS,aAAa,SAAS,EAAE,GACzC,sDAAsD,SACxD;EACA,OAAO,GACL,CAAC,QAAQ,SAAS,cAAc,GAChC,0DACF;EACA,OAAO,UAAU,UAAU,CAAC,CAAC;EAC7B,MAAM,KAAK,EAAE,WAAW,mBAAmB,CAAC;EAC5C,MAAM,KAAK,EAAE,aAAa,eAAe,CAAC;EAC1C,OAAO,MACL,cAAc,IAAI,CAAC,CAAC,QACpB,GACA,6DACF;CACF,CAAC,CACH,GACF,YACF;CACA,IACE,6BACA,yEACC,GAAG,MACF,YAAY,cACV,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,cAAc,EAC7C,SAAS,EAAE,mBAAmB,eAAe,EAC/C,CAAC;EACD,OAAO,UAAU,cAAc,IAAI,GAAG,CAAC,CAAC;CAC1C,CAAC,CACH,GACF,YACF;CAEA,KAAK,MAAM,SAAS,CAAC,OAAO,IAAI,GAC9B,IACE,6BACA,UACE,OACA,sFACF,GACA,OAAO,GAAG,MAAM;EACd,MAAM,OAAO,MAAM,gBAAgB,GAAG,KAAK;EAC3C,IAAI,MACF,OAAO;EAET,OAAO,mBACL,SAAS,GAAG,GAAG;GAAE,YAAY;GAAM;EAAM,GAAG,OAAO,SAAS;GAC1D,MAAM,UAAU,EAAE,mBAAmB,eAAe;GACpD,MAAM,WAAW,KAAK,QAClB,MAAM,aAAa,YAAY,IAAI,GAAG;IACpC,WAAW;IACX,SAAS,GAAG,KAAK;IACjB,GAAG;GACL,CAAC,IACD,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,cAAc,EAAE,QAAQ,CAAC;GAC9D,OAAO,MAAM,SAAS,QAAQ,GAAG;GACjC,OAAO,UAAU,cAAc,IAAI,GAAG,CAAC,CAAC;EAC1C,CAAC,CACH;CACF,GACA,WAAW,KAAK,CAClB;CAEF,IACE,iBACA,4DACC,GAAG,MACF,SAAS,GAAG,GAAG,CAAC,GAAG,OAAO,SAAS;EACjC,MAAM,WAAW,MAAM,YAAY,KAAK,IAAI;EAC5C,MAAM,QAAQ,SAAS,OAAO,MAAM,GAAG,CAAC,CAAC,EAAE,CAAE,MAAM,GAAG,CAAC,CAAC;EACxD,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,oBAAoB;EACrD,MAAM,QAAQ,GAAG,KAAK,MAAM,KAAK,qBAAqB,EACpD,SAAS,EAAE,QAAQ,SAAS,OAAO,EACrC,CAAC;EACD,KAAK,MAAM,8BAAc,IAAI,MAAM,sBAAsB,OAAO;EAChE,MAAM,QAAQ,GAAG,KAAK,IAAI,UAAU,EAClC,SAAS,EAAE,QAAQ,SAAS,OAAO,EACrC,CAAC;EACD,MAAM,OAAO,KAAK,OAAO,KAAK;EAC9B,OAAO,GAAG,CAAC,KAAK,SAAS,KAAK,GAAG,kCAAkC;EACnE,OAAO,GAAG,CAAC,KAAK,SAAS,OAAO,GAAG,iCAAiC;CACtE,CAAC,CACL;CACA,OAAO;AACT;AAEA,eAAe,SAAS,MAAuC;CAE7D,MAAM,UAAS,MADQ,KAAK,SAAA,CACL,UAAU,yBAAyB;CAC1D,OAAO,QAAQ,IAAI,QAAQ,aAAa;AAC1C;;;;AC3rEA,eAAsBC,YACpB,SACA,WACmB;CACnB,OAAO,QAAQ,UACX,MAAM,QAAQ,QAAQ,SAAS,IAC/B,sBAAsB,SAAS;AACrC;AAEA,SAAgB,eAAe,YAA4C;CACzE,OAAO,WAAW,aACd,WAAW,MAAM,QAAQ,cAAc,IACvC,WAAW,aACT,WAAW,MAAM,QAAQ,cAAc,IACvC,CAAC,UAAU;AACnB;AAEA,SAAS,eAAe,OAAuD;CAC7E,OACE,CAAC,CAAC,SACF,OAAO,UAAU,YACjB,OAAQ,MAAuC,aAAa;AAEhE;;AAGA,SAAgB,eACd,YACgC;CAChC,OAAO,eAAe,UAAU,CAAC,CAAC,KAAK,SAAS;EAC9C,IAAI,CAAC,eAAe,KAAK,MAAM,GAC7B,MAAM,IAAI,6BACR,sCACA,wFAAwF,OAAQ,KAAK,QAA+B,QAAQ,KAAK,MAAM,EAAE,+DACzJ,+EACF;EAEF,OAAO,KAAK;CACd,CAAC;AACH;AAEA,MAAa,YAAY;;AAGzB,SAAS,cACP,QACA;CACA,IACM,8BADN,MACM,4BAA4B,CAAC;CADlC,8BAAA,WAAA,CAAA,WAAW,2CAA2C,CAAA,GAAA,2BAAA;CAEvD,KAAK,MAAM,CAAC,MAAM,eAAe,OAAO,QAAQ,MAAM,GAAG;EACvD,MAAM,SAAS,SAAS,SAAe,CAAC;EACxC,OAAO,eAAe,QAAQ,QAAQ,EAAE,OAAO,KAAK,CAAC;EACrD,OAAO,eAAe,4BAA4B,WAAW,MAAM;GACjE,OAAO;GACP,UAAU;GACV,cAAc;EAChB,CAAC;EACD,MAAM,aAAa,OAAO,yBACxB,4BAA4B,WAC5B,IACF;EACA,KAAK,MAAM,aAAa,CAAC,IAAI,IAAI,GAAG,GAAG,UAAU,CAAC,CAAC,QAAQ,GACzD,UAAU,4BAA4B,WAAW,MAAM,UAAU;CAErE;CACA,OAAO;AACT;AAEA,MAAa,0BACX;;;;;;AAOF,SAAS,YACP,aACA,UACmB;CACnB,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,QAAQ,YAAY,QAAQ,cAAc,GAAG;EACtD,MAAM,SAAS,eAAe,KAAK,MAAM,IAAI,KAAK,SAAS,KAAA;EAC3D,KAAK,MAAM,QAAQ,KAAK,cAAc,QAAQ,UAAU,cAAc,CAAC,GACrE,MAAM,IAAI,IAAI;CAElB;CACA,MAAM,OAAO,SAAS;CACtB,OAAO,CAAC,GAAG,KAAK,CAAC,CACd,QAAQ,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CACrC,KAAK,UAAU;EACd,IAAI,GAAG,wBAAwB,GAAG;EAClC,OAAO,CAAC,IAAI;EACZ,YAAY;EACZ,WAAW;EACX,SAAS,aAAa,EAAE,SAAS,SAAS;CAC5C,EAAE;AACN;AAEA,SAAS,QAAQ,QAA0D;CACzE,OAAO,OAAO,WAAW,YACvB,WAAW,QACX,MAAM,QAAS,OAA2B,KAAK,IAC5C,OAA2B,QAC5B,CAAC;AACP;;AAsBA,eAAsB,KACpB,MACA,YACA,UAAuB,CAAC,GACP;CACjB,MAAM,SAAS,QAAQ,UAAU,GAAA,WAClB,aAAa,CAAC,QAAQ,UAAU,CAAC,IAAI,CAAC,EACrD;CACA,MAAM,cAAc,aAAa,CAAC,UAAU,IAAI,CAAC;CACjD,MAAM,WAAW,IAAI,KAClB,QAAQ,WAAW,CAAC,EAAA,CAAG,SAAS,WAAW,CAAC,GAAG,QAAQ,MAAM,CAAC,CAAC,CAClE;CACA,MAAM,UAAU,CACd,GAAI,QAAQ,WAAW,CAAC,GACxB,GAAG,YAAY,aAAa,QAAQ,CACtC;CACA,MAAM,aAAa,cAAc,MAAM;CACvC,MAAM,SAAS,QAAQ,UAAU,IAAI,gBAAgB;CACrD,MAAM,YAAY,MAAM,KAAK,oBAAoB;EAC/C,SAAS,CACP,iBAAiB,QAAQ;GACvB;GACA,YAAY;GACZ,MAAM,EAAE,OAAO,MAAM;GACrB,YAAY;GACZ,GAAI,QAAQ,aAAa,EAAE,YAAY,QAAQ,WAAW,IAAI,CAAC;GAC/D,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;EACtE,CAAU,CACZ;EACA,aAAa,CAAC,UAAU;EACxB,WAAW,CAAC,GAAI,QAAQ,aAAa,CAAC,CAAE;CAC1C,CAAC,CAAC,CAAC,QAAQ;CACX,UAAU,UAAU,MAAM;CAC1B,IAAI;EACF,MAAM,UAAU,KAAK;CACvB,SAAS,OAAO;EACd,MAAM,UAAU,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EAC7C,MAAM;CACR;CACA,OAAO;EAAE;EAAW;EAAY;CAAO;AACzC;AAyBA,eAAsBC,UACpB,SACkB;CAClB,MAAM,QAAQ,MAAM,QAAQ,QAAQ,IAAI;CACxC,MAAM,EAAE,WAAW,YAAY,WAAW,MAAM,KAC9C,QAAQ,MACR,QAAQ,aACR,EAAE,SAAS,QAAQ,QAAQ,CAC7B;CACA,MAAM,OAAO,UAAU,IAAmB,cAAc;CACxD,MAAM,cAAc,EAAE,OAAO,EAAE;CAC/B,MAAM,WAA0B,EAC9B,OAAO,QAAQ,QAAQ,SAAS;EAC9B,YAAY;EACZ,OAAO,KAAK,OAAO,QAAQ,QAAQ,OAAO;CAC5C,EACF;CACA,MAAM,WAAW,UAAU,IAAoB,eAAe;CAC9D,MAAM,YAAY,IAAI,uBACpB,UACA,UACA,UAAU,IAAuB,kBAAkB,GACnD,UAAU,IAAkB,aAAa,CAC3C;CACA,MAAM,OAAkB,UACrB,IAAkB,aAAa,CAAC,CAChC,KAAK,YAAY,SAAS;CAC7B,MAAM,QAAQ,UACX,IAAsB,iBAAiB,CAAC,CACxC,IAAI,SAAS;CAChB,MAAM,YAAY;EAChB,gBAAgB;EAChB,kBAAkB,QAAQ,IAAI,WAAW,WAAW,SAAS;EAC7D,eAAe,CAAC;EAChB,qBAAqB,KAAA;EACrB,eAAe;CACjB;CACA,OAAO;EACL,MAAM,QAAQ;EACd;EACA;EACA;EACA;EACA,MAAM,OAAO,WAAW,MAAM,CAAC,GAAG;GAChC,MAAM,UACJ,IAAI,YACH,UAAU,UAAU,CAAC,UAAU,aAC5B,MAAM,eAAe,QAAQ,MAAM,UAAU,MAAM,IACnD,IAAI,QAAQ;GAClB,MAAM,MAAM,IAAI,OAAO,CAAC;GACxB,MAAM,OAAsB;IAC1B;IACA,YAAY,IAAI,cAAc;IAC9B,eAAe,IAAI,QAAQ,OAAO;IAClC,UAAU;IACV,SAAS;IACT,aAAa,KAAA;GACf;GACA,MAAM,IAAI,iBAAiB;GAC3B,OAAO,UAAU,SACf,MACA,WACA,MACA,OACA,WACA,aACF;EACF;EACA,aAAa,UAAU,MAAM;CAC/B;AACF;AAEA,SAAS,YAAY,OAAyB;CAC5C,MAAM,QAAQ,KAAA;CACd,MAAM,eAAe,KAAA;CACrB,MAAM,UAAU,KAAA;AAClB;AAEA,eAAsBC,cACpB,SACA,IAC6B;CAC7B,MAAM,QAAQ,MAAMD,UAAQ,OAAO;CACnC,IAAI;EACF,OAAO,MAAM,GAAG,KAAK;CACvB,UAAU;EACR,YAAY,MAAM,KAAK;EACvB,MAAM,MAAM,MAAM;CACpB;AACF;;AAGA,SAAgB,gBAAgB,OAAmB,MAAwB;CACzE,OAAO,MAAM,MAAM,MAAM,IAAI,CAAC,CAAC,QAAQ,SAAS,SAAS,cAAc;AACzE;AAEA,SAAgBE,eAAa,OAAmB,MAAsB;CACpE,OAAO,MAAM,MAAM,MAAM,IAAI,CAAC,CAAC,QAAQ,SAAS,SAAS,cAAc,CAAC,CACrE;AACL;AAIA,MAAM,cAAc;AAUpB,IAAM,YAAN,cAAwB,MAAM;CACP;CAArB,YAAY,SAA+B;EACzC,MAAM,QAAQ,OAAO;EADF,KAAA,UAAA;CAErB;AACF;;;;;AAMA,IAAM,qBAAN,MAAkD;CAChD,KAAc;CAEd,QAAQ,SAAoC;EAC1C,OAAO,QAAQ,QAAgB,MAAM;CACvC;CAEA,SAAS,SAA0C;EACjD,MAAM,CAAC,WAAW,QAAQ,QAAQ;EAClC,OAAO;GACL,KAAK,QAAQ;GACb,YAAY,QAAQ;GACpB,eAAe,IAAI,QAAQ,QAAQ,OAAO;GAC1C,UAAU;GACV,SAAS,QAAQ;GACjB,QAAQ,SAAS,QAAQ,MAAM;EACjC;CACF;CAEA,YAAY,SAA+B;EACzC,OAAO,IAAI,UAAU,OAAO;CAC9B;AACF;AAuCA,eAAsB,eACpB,MACA,SACyB;CACzB,MAAM,QAAQ,MAAM,QAAQ,IAAI;CAChC,MAAM,EAAE,WAAW,YAAY,WAAW,MAAM,KAAK,MAAM,KAAA,GAAW;EACpE,GAAG;EACH,YAAY,CAAC,IAAI,mBAAmB,CAAC;CACvC,CAAC;CACD,MAAM,QAAQ,UAAU,IAAI,iBAAiB,EAAE,QAAQ,MAAM,CAAC;CAC9D,OAAO;EACL;EACA;EACA,MAAM,QAAQ,OAAO,SAAS,QAAQ,CAAC,GAAG;GACxC,MAAM,MAAM,CAAC;GAQb,MAAM,OAAO,CAAC;IANZ,SAAS,IAAI,QAAQ,OAAO;IAC5B;IACA;IACA,YAAY;IACZ,MAAM,EAAE,cAAc,KAAK;GAET,CAAC;GACrB,MAAM,UAAU;IACd,gBAAgB;IAChB,kBAAkB,QAAQ,IAAI,WAAW,WAAW,KAAK;IACzD,eAAe;IACf,gBAAgB,UAAkB,KAAK;IACvC,eAAe;GACjB;GACA,IAAI;IACF,MAAM,MAAM,YAAY,OAAO;IAC/B,OAAO;KAAE,IAAI;KAAM,QAAQ;IAAI;GACjC,SAAS,OAAO;IACd,IAAI,iBAAiB,WACnB,OAAO;KACL,IAAI;KACJ,QAAQ,MAAM,QAAQ;KACtB,MAAM,MAAM,QAAQ;KACpB,QAAQ,MAAM,QAAQ;IACxB;IAEF,OAAO;KAAE,IAAI;KAAO,QAAQ;KAAK;IAAM;GACzC;EACF;EACA,aAAa,UAAU,MAAM;CAC/B;AACF;;AAGA,SAAS,iBAAiB,QAAmD;CAC3E,IAAI,OAAO,IACT,OAAO;EAAE,IAAI;EAAM,QAAQ;CAAI;CAEjC,OAAO;EACL,IAAI;EACJ,QAAQ,OAAO,OAAO,cAAc;EACpC,MAAM,OAAO,OAAO;EACpB,QAAQ,OAAO,OAAO;EACtB,GAAI,OAAO,OAAO,eAAe,KAAA,IAC7B,EAAE,OAAO,OAAO,OAAO,QAAQ,IAC/B,CAAC;CACP;AACF;;AAGA,SAAS,iBACP,QACgC;CAChC,OAAO,OAAO,YACZ,OAAO,QAAQ,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,gBAAgB,CACjD,MACA;EACE;EACA,QAAQ,CAAC;EACT,WAAW;EACX,eAAe,EAAE,IAAI,KAAK;CAC5B,CACF,CAAC,CACH;AACF;;AAGA,eAAsB,gBACpB,UACA,MACA,SACyB;CACzB,IAAI,QAAQ,WAAW,UAAU,QAAQ,YAAY,KAAA,GACnD,MAAM,IAAI,6BACR,gCACA,0FACF;CAEF,MAAM,QAAQ,MAAM,QAAQ,IAAI;CAChC,MAAM,SAAS,QAAQ,UAAU,IAAI,gBAAgB;CACrD,MAAM,MAAM,MAAM,SAAS,UAAU,iBAAiB,QAAQ,MAAM,GAAG,MAAM;EAC3E,YAAY,QAAQ,WAAW,CAAC;EAChC;CACF,CAAC;CACD,MAAM,UAAU,SAAS,SAAS,KAAK,QAAQ;CAE/C,MAAM,WAAW,YAAyB;EACxC,MAAM,SAAS,IAAI,QAAQ,OAAO;EAClC,IAAI,CAAC,OAAO,IAAI,QAAQ,GACtB,OAAO,IAAI,UAAU,oBAAoB;EAE3C,OAAO;CACT;CACA,OAAO;EACL;EACA;EACA,SAAS,OAAO,OAAO,SAAS,QAAQ,CAAC,MACvC,iBACE,MAAM,SAAS,OAAO,KAAK,OAAO,QAAQ,OAAO,GAAG,KAAK,CAC3D;EACF,GAAI,UACA,EACE,MAAM,QAAQ,SAAkD;GAC9D,MAAM,aAAa,MAAM,QAAQ,KAAK,QAAQ,OAAO,CAAC;GACtD,OAAO;IACL,SAAS,OAAO,OAAO,QAAQ,CAAC,MAC9B,iBAAiB,MAAM,WAAW,OAAO,OAAO,KAAK,CAAC;IACxD,aAAa,WAAW,MAAM;GAChC;EACF,EACF,IACA,CAAC;EACL,aAAa,IAAI,MAAM;CACzB;AACF;;AAGA,eAAsB,aACpB,MACA,SACA,IACA,UAC6B;CAC7B,MAAM,QAAQ,WACV,MAAM,gBAAgB,UAAU,MAAM,OAAO,IAC7C,MAAM,eAAe,MAAM,OAAO;CACtC,IAAI;EACF,OAAO,MAAM,GAAG,KAAK;CACvB,UAAU;EACR,YAAY,MAAM,KAAK;EACvB,MAAM,MAAM,MAAM;CACpB;AACF;AAEA,SAAgB,gBAAgB,SAAiC;CAC/D,OAAO,QAAQ,KACX,YACA,GAAG,QAAQ,OAAO,GAAG,QAAQ,QAAQ,GAAG,GAAG,QAAQ,UAAU,GAAG,GAAG,QAAQ,QAAQ,OAAO,QAAQ,KAAK,IAAI,KAAK,KAAK;AAC3H;AAIA,MAAMC,iBAAe;AACrB,MAAa,iBAAiB;AAC9B,MAAa,iBAAiB;AAU9B,SAAS,OAAO,OAAiB,WAA8B;CAC7D,OAAO,OAAO,QAAQ,SAAS,CAAC,CAAC,OAAO,CAAC,UAAU,aACjD,QAAQ,OAAO,WAAW,MAAM,SAAS,EAAE,SAAS,MAAM,CAAC,CAC7D;AACF;;AAGA,SAAgB,gBACd,QACA,OACe;CACf,OAAO;EACL,MAAMA;EACN,QAAQ;EACR;EACA,YAAY;GACV,aAAa;GACb,SAAS,cAAwB,OAAO,OAAO,SAAS;EAC1D;CACF;AACF;;AAGA,SAAgB,aAAa,MAAgC;CAyB3D,OAAO;EAvBL,IAAI;EACJ,OAAO,CAACA,cAAY;EACpB,YAAY;EACZ,WAAW;EACX,mBAAmB,CAAC,cAAc;EAClC,YAAY,YAAY,QAAQ,QAAQ,IAAI,cAAc;EAC1D,MAAM,QAAQ,SAAS;GACrB,MAAM,QAAQ,QAAQ,QAAQ,IAAI,cAAc;GAChD,IAAI,CAAC,OACH,OAAO,OAAO;GAEhB,KAAK;GACL,MAAM,MAAM,KAAK,KAAK,IAAI,KAAK;GAC/B,IAAI,CAAC,KACH,OAAO,SACL,aAAa,SAAS;IAAE,QAAQ;IAAK,QAAQ;GAAkB,CAAC,CAClE;GAEF,OAAO,cACL,gBAAgB,IAAI,QAAQ,IAAI,KAAK,CACvC;EACF;CAEU;AACd;AAyBA,eAAsB,WAAW,MAAqC;CACpE,OAAQ,MAAM,KAAK;AACrB;AAEA,eAAsB,UAAU,MAAgB,IAA8B;CAC5E,OAAO,CAAC,EAAE,MAAM,WAAW,IAAI,EAAA,CAAG,QAAQ,SAAS,MAChD,WAAW,OAAO,OAAO,EAC5B;AACF;AAEA,eAAsB,mBAAmB,MAAkC;CACzE,QACG,MAAM,WAAW,IAAI,EAAA,CAAG,QAAQ,SAAS,aAAa,YAAY;AAEvE;;AAGA,eAAsB,QACpB,MACA,SAAkC,CAAC,GAClB;CACjB,MAAM,UAAU,MAAM,YAAY,IAAI;CACtC,QACE,MAAM,QAAQ,SACZ,QAAQ,WAAW;EACjB,OAAO,GAAG,WAAW,OAAO,WAAW,EAAE;EACzC,MAAM;EACN,GAAG;CACL,CAAC,CACH,EAAA,CACA;AACJ;AAEA,SAAS,aAAa,QAAgB,YAAuC;CAC3E,MAAM,0BAAU,IAAI,IAAoB;CACxC,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;EACpC,MAAM,UAAU,KAAK,KAAK;EAC1B,IAAI,SACF,QAAQ,IAAI,QAAQ,MAAM,KAAK,CAAC,CAAC,CAAC,IAAK,OAAO;CAElD;CACA,KAAK,MAAM,QAAQ,YAAY;EAC7B,MAAM,OAAO,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,EAAE,CAAE,KAAK;EACzC,QAAQ,IAAI,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,IAAK,IAAI;CAC1C;CACA,OAAO,CAAC,GAAG,QAAQ,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;AACxC;;;;;AAMA,eAAsB,eACpB,MACA,QACA,UAAmC,CAAC,GACX;CACzB,MAAM,UAAU,MAAM,eAAe,MAAM,MAAM;CACjD,IAAI,CAAC,QAAQ,WACX,OAAO;CAUT,MAAM,cAAa,MAPjB,KAAK,IAML,WAAW;EAAE;EAAS,eAAe;CAAK,CAAC,EAAA,CACnB,QAAQ,aAAa;CAC/C,IAAI,CAAC,WAAW,MAAM,SAAS,oBAAoB,KAAK,IAAI,CAAC,GAC3D,OAAO;CAET,QAAQ,IAAI,UAAU,aAAa,QAAQ,IAAI,QAAQ,KAAK,IAAI,UAAU,CAAC;CAC3E,OAAO;AACT;;AAGA,eAAsB,mBACpB,MACA,SACwB;CACxB,MAAM,UAAW,MACf,KAAK,IAKL,WAAW,EAAE,QAAQ,CAAC;CACxB,IAAI,CAAC,SACH,MAAM,IAAI,6BACR,+BACA,gDACF;CAEF,OAAO;EACL,MAAM;EACN,QAAQ;EACR,QAAQ,QAAQ,KAAK;EACrB;CACF;AACF;;;AC/zBA,MAAM,eAAe;AACrB,MAAM,+BAAe,IAAI,IAAI,CAC3B,uCACA,iCACF,CAAC;AACD,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;AACvB,MAAM,sBAAsB;AAC5B,MAAMC,iBAAe;AACrB,MAAMC,iBAAe;AACrB,MAAM,aAAa,CAACD,gBAAcC,cAAY;AAC9C,MAAM,kBAAkB;AA6BxB,SAAS,IAAI,MAAwB;CACnC,OAAO,KAAK;AACd;;AAGA,eAAe,UAAU,MAA+C;CACtE,MAAM,SAAS,MAAM,OAAO,IAAI;CAChC,IAAI,OAAO,IACT,OAAO;CAET,OAAO,WAAW,OAAO,KAAK,IAAI,OAAO,MAAM,aAAa;AAC9D;AAEA,SAAS,SAAS,SAAiC;CACjD,OAAO,QAAQ,KAAK,MAAM,QAAQ;AACpC;AAEA,SAAS,SACP,YACA,OACyB;CACzB,OAAO,eAAe,UAAU,CAAC,CAAC,MAAM,SACtC,MAAM,KAAK,MAAsC,CACnD;AACF;AAEA,SAAS,iBACP,QACA,aACA,YACa;CACb,OAAO;EACL;EACA,QAAQ,EAAE,YAAY;EACtB,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;CACrC;AACF;AAEA,SAAS,iBACP,MACA,cACa;CACb,OAAO;EACL,GAAG;EACH,QAAQ;GAAE,GAAI,KAAK;GAAmB;EAAa;CACrD;AACF;AAEA,eAAeC,YACb,MACA,QACA,OAA0D,CAAC,GACrB;CACtC,OAAO,IAAI,IAAI,CAAC,CAAC,aAAa,EAC5B,MAAM;EAAE;EAAQ,kBAAkB;EAAO,GAAG;CAAK,EACnD,CAAC;AACH;;AAGA,eAAe,YAAY,MAAgB,KAA+B;CACxE,MAAM,UAAU,MAAM,aACpB,IAAI,IAAI,CAAC,CAAC,WAAW,EAAE,SAAS,IAAI,QAAQ,GAAG,iBAAiB,IAAI,CAAC,EAAE,CAAC,CAC1E;CACA,OAAO,QAAQ,MAAM,CAAC,CAAC,QAAQ;AACjC;AAEA,eAAe,YAAY,MAAgB,OAAgC;CAIzE,QAAO,OAHY,MAAM,WAAW,IAAI,EAAA,CAAG,QAAQ,QAEhD;EAAE,OAAO;EAAU,OAAO,CAAC;GAAE,OAAO;GAAM,OAAO;EAAM,CAAC;CAAE,CAAC,EAAA,EAClD,aAAa;AAC3B;AAEA,eAAe,sBACb,MACA,SACiB;CACjB,QACE,MAAM,IAAI,IAAI,CAAC,CAAC,mBAAmB;EACjC;EACA,MAAM;GACJ,MAAM;GACN,MAAM,eAAe,WAAW,OAAO,WAAW;EACpD;CACF,CAAC,EAAA,CACD;AACJ;AAEA,eAAe,QACb,MACA,QACA,MACe;CACf,OAAO,MAAM,WAAW,IAAI,EAAA,CAAG,QAAQ,OAAO;EAC5C,OAAO;EACP,OAAO,CAAC;GAAE,OAAO;GAAM,OAAO;EAAO,CAAC;EACtC,QAAQ,EAAE,KAAK;CACjB,CAAC;AACH;AAEA,SAAS,aACP,SACA,QACA,QACA,SACM;CACN,OAAO,MAAM,QAAQ,IAAI,OAAO,GAAG,QAAQ,UAAU;CACrD,OAAO,MACL,SAAS,OAAO,GAChB,QACA,GAAG,QAAQ,IAAI,gBAAgB,OAAO,GACxC;CACA,IAAI,WAAW,KAAA,KAAa,CAAC,QAAQ,IACnC,OAAO,MACL,QAAQ,UAAU,QAAQ,MAC1B,QACA,GAAG,QAAQ,IAAI,gBAAgB,OAAO,GACxC;AAEJ;;;;;;AAOA,SAAgB,gBACd,SACA,OACmB;CACnB,MAAM,EAAE,SAAS;CACjB,MAAM,cAAc,MAAM,MAAM,WAAW,OAAO,OAAO,YAAY;CACrE,MAAM,UAAU,SAAS,QAAQ,cAAc,WAC7C,aAAa,IAAI,OAAO,EAAE,CAC5B;CACA,MAAM,UAAU,SACd,QAAQ,cACP,WAAW,OAAO,OAAO,cAC5B;CACA,MAAM,UAAU,cACZ,KAAA,IACA,iEAAiE,aAAa;CAClF,MAAM,QAAQ,UACV,KAAA,IACA;CACJ,MAAM,SAAS;CACf,MAAM,aACJ,IACA,OACA,KACA,OAAO,YACJ,gBAAgB,IAAI,OAAO,KAAK,IAAI;;CAGzC,MAAM,uBAAuB,OAC3B,aACgC;EAChC,IAAI,CAAE,MAAM,UAAU,MAAM,SAAS,GACnC,OAAO,gBAAgB,qCAAqC;EAE9D,MAAM,UAAU,MAAM,QAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC;EACrD,MAAM,UAAU,MAAM,QAAQ,MAAM,EAAE,MAAM,OAAO,CAAC;EACpD,MAAM,MAAM,MAAMA,YAAU,MAAM,SAAS,EACzC,aAAa,EAAE,SAAS,CAAC,MAAM,EAAE,EACnC,CAAC;EACD,IAAI,CAAE,MAAM,YAAY,MAAM,IAAI,GAAG,GACnC,OAAO,gBACL,oGACF;EAEF,MAAM,aAAa,IAAI,QAAQ,GAAG,iBAAiB,IAAI,IAAI,CAAC;EAC5D,OAAO,MACL,MAAM,gBACJ,IAAI,IAAI,CAAC,CAAC,UAAU;GAAE,SAAS;GAAY,OAAO,CAAC;EAAE,CAAC,CACxD,GACA,KACA,qDACF;EACA,OAAO,MACL,MAAM,gBACJ,IAAI,IAAI,CAAC,CAAC,QAAQ;GAChB,SAAS;GACT,MAAM,EAAE,QAAQ,QAAQ;EAC1B,CAAC,CACH,GACA,KACA,mDACF;EACA,MAAM,UAAU,MAAM,eAAe,MAAM,OAAO,EAAA,CAAI,IAAI,QAAQ;EAClE,OAAO,aACL,MACA,EACE,QAAQ;GACN,KAAK,CAAC,QAAQ,iBAAiB,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;GAC1D,eAAe,CAAC,YAAY,EAAE,eAAe,KAAK,CAAC,CAAC;GACpD,UAAU,CAAC,YAAY,CAAC;EAC1B,EACF,GACA,OAAO,EAAE,cAAc;GACrB,aACE,MAAM,QAAQ,OAAO,UAAU,GAC/B,KACA,KAAA,GACA,0DACF;GACA,aACE,MAAM,QAAQ,iBAAiB,UAAU,GACzC,KACA,KAAA,GACA,0DACF;GACA,MAAM,WAAW,MAAM,QAAQ,YAAY,UAAU;GACrD,OAAO,MACL,SAAS,IACT,MACA,uDAAuD,gBAAgB,QAAQ,GACjF;GACA,aACE,MAAM,QAAQ,iBAAiB;IAC7B;KACC,iBAAiB,IAAI;GACxB,CAAC,GACD,KACA,KAAA,GACA,kEACF;EACF,GACA,QACF;CACF;;;;;CAMA,MAAM,eAAe,OACnB,MACA,aAC0D;EAC1D,MAAM,UAAU,MAAM,QAAQ,IAAI;EAClC,MAAM,UAAW,MAAM,eAAe,MAAM,OAAO;EACnD,MAAM,iBAAiB,MAAM,sBAAsB,MAAM,OAAO;EAChE,MAAM,aACJ,MACA,EACE,QAAQ,EACN,KAAK,CAAC,QAAQ,iBAAiB,MAAM,UAAU,OAAO,CAAC,CAAC,CAAC,EAC3D,EACF,GACA,OAAO,EAAE,SAAS,OAAO,aAAa;GACpC,KAAK,MAAM,SAAS;IAAC,EAAE,KAAK,KAAK;IAAG;IAAK,CAAC,GAAG;IAAG;GAAE,GAAG;IACnD,MAAM,OAAO,MAAM,MAAM;IACzB,aACE,MAAM,QAAQ,OAAO,SAAS,EAAE,OAAO,MAAM,CAAC,GAC9C,KACA,yBACA,SAAS,KAAK,UAAU,KAAK,GAC/B;IACA,OAAO,UACL,gBAAgB,OAAO,IAAI,GAC3B,CAAC,GACD,SAAS,KAAK,UAAU,KAAK,EAAE,qBACjC;GACF;GACA,MAAM,QAAQ,MAAM,QAAQ,OAAO,SAAS,EAC1C,OAAO,eACT,CAAC;GACD,OAAO,MACL,MAAM,IACN,MACA,2CAA2C,gBAAgB,KAAK,GAClE;GACA,OAAO,UACL,OAAO,OAAO,CAAC,CAAC,KAAK,UAAU,MAAM,IAAI,GACzC,CAAC,GACD,sDACF;EACF,GACA,QACF;EACA,OAAO;GAAE;GAAS;EAAe;CACnC;CAEA,MAAM,oBAAoB;EACxB,MAAM,aAAa,cACjB,EAAE,cAAc,CAAC,QAAQ,EAAE,GAC3B,EAAE,cAAc,UAAU,OAAO,EAAE,CACrC;EACA,MAAM,SAAS,UAAU,EAAE,cAAc,UAAU,OAAO,EAAE,CAAC;EAC7D,OAAO;GACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,YAAY,MAAM,CAAC,EAAE;GAC/C;GACA;EACF;CACF;;;;;CAMA,MAAM,aAAa,OACjB,aACgC;EAChC,IAAI,CAAE,MAAM,UAAU,MAAM,SAAS,GACnC,OAAO,gBAAgB,qCAAqC;EAE9D,MAAM,UAAU,MAAM,QAAQ,IAAI;EAClC,MAAM,UAAW,MAAM,eAAe,MAAM,OAAO;EACnD,MAAM,iBAAiB,MAAM,sBAAsB,MAAM,OAAO;EAChE,MAAM,MAAM,MAAMA,YAAU,MAAM,SAAS,EAAE,WAAW,IAAI,CAAC;EAC7D,IAAI,CAAE,MAAM,YAAY,MAAM,IAAI,GAAG,GACnC,OAAO,gBACL,oGACF;EAEF,OAAO,aACL,MACA,EAAE,QAAQ,YAAY,CAAC,CAAC,OAAO,GAC/B,OAAO,EAAE,cAAc;GACrB,MAAM,SAAS,MAAM,YAAY,MAAM,IAAI,EAAE;GAC7C,MAAM,UAAU,MAAM,QACpB,SACA,GAAG,iBAAiB,IAAI,IAAI,GAC5B,EAAE,OAAO,eAAe,CAC1B;GACA,OAAO,MACL,QAAQ,IACR,MACA,kDAAkD,gBAAgB,OAAO,GAC3E;GACA,OAAO,MACL,SAAU,MAAM,YAAY,MAAM,IAAI,EAAE,GACxC,GACA,sEACF;EACF,GACA,QACF;CACF;;;;;;CAOA,MAAM,qBAAqB,OACzB,aACgC;EAChC,IAAI,CAAE,MAAM,mBAAmB,IAAI,GACjC,OAAO,gBACL,wGACF;EAEF,MAAM,MAAM,MAAM,WAAW,IAAI;EACjC,MAAM,UAAW,MAAM,eACrB,MACA,MAAM,QAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC,CACvC;EACA,MAAM,MAAM,SAAS;EACrB,OAAO,aACL,MACA,EACE,QAAQ;GACN,MAAM,CAAC,QAAQ,iBAAiB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;GAC5D,UAAU,CAAC,YAAY,CAAC;EAC1B,EACF,GACA,OAAO,EAAE,cAAc;GAErB,MAAM,OAAO;GACb,MAAM,UAAU,MAAM,QAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC;GACrD,MAAM,aAAa,MAAM,KAAM,MAAM,eAAe,MAAM,OAAO,CAAG;GACpE,IAAI;IACF,MAAM,QAAQ,MAAM,WAAW,QAAQ,UAAU;IACjD,OAAO,MACL,MAAM,IACN,MACA,8CAA8C,gBAAgB,KAAK,GACrE;IACA,MAAM,IAAI,gBAAgB,mBAAmB,OAAO;IACpD,MAAM,SAAS,MAAM,WAAW,QAAQ,UAAU;IAClD,OAAO,MACL,OAAO,IACP,MACA,kEAAkE,IAAI,WAAW,gBAAgB,MAAM,GACzG;IACA,aACE,MAAM,WAAW,QAAQ,MAAM,GAC/B,KACA,KAAA,GACA,2EACF;GACF,UAAU;IACR,MAAM,WAAW,MAAM;GACzB;GACA,KAAK,MAAM,WAAW,CAAC,UAAU,uBAAuB,GAAG;IACzD,MAAM,SAAS,MAAM,QAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC;IAIpD,MAAM,SAAS,MAAM,KAAK,MAHH,eAAe,MAAM,QAAQ,EAClD,WAAW,KACb,CAAC,CACgC;IACjC,IAAI;KACF,KAAK,MAAM,SAAS,CAAC,QAAQ,UAAU,GAAG;MACxC,MAAM,SAAS,MAAM,OAAO,QAAQ,KAAK;MACzC,OAAO,MACL,OAAO,IACP,MACA,GAAG,QAAQ,IAAI,MAAM,4BAA4B,gBAAgB,MAAM,GACzE;KACF;KACA,IAAI,YAAY,UACd,MAAM,IAAI,IAAI,CAAC,CAAC,QAAQ;MAAE,SAAS;MAAS,MAAM,EAAE,OAAO;KAAE,CAAC;UAE9D,MAAM,IAAI,gBAAgB,mBAAmB,MAAM;KAErD,aACE,MAAM,OAAO,QAAQ,MAAM,GAC3B,KACA,KAAA,GACA,GAAG,QAAQ,yDACb;IACF,UAAU;KACR,MAAM,OAAO,MAAM;IACrB;GACF;EACF,GACA,QACF;CACF;;CAGA,MAAM,iBAAiB,aAAgD;EACrE,MAAM,SAAS,SAAiB,GAAG,SAAS,KAAK,IAAI;EACrD,OAAO;GACL,UACE,mCACA,MACE,uHACF,SACM,qBAAqB,QAAQ,CACrC;GACA,UACE,kBACA,MACE,4HACF,SACM,mBAAmB,QAAQ,GACjC,YACG,CAAC,SAAS,UACP,kDACA,EAAE,SAAS,2BAA4B,KACrC,iHACA,KAAA,EACV;GACA,gBACE,mBACA,MACE,6EACF,GACA,YAAY;IACV,MAAM,aAAa,SAAU,QAAQ;GACvC,GACA,KACF;GACA,gBACE,8BACA,MAAM,yDAAyD,SACzD,WAAW,QAAQ,GACzB,KACF;EACF;CACF;CAEA,OAAO;EACL,UACE,2BACA,uHACA,YAAY;GACV,MAAM,YAAY,MAAM,QAAQ,mBAAoB;GACpD,MAAM,cAAc,iBAAiB,QAAQ,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;GAC9D,MAAMC,cAAY;IAAE;IAAM;GAAY,GAAG,OAAO,EAAE,QAAQ,YAAY;IACpE,MAAM,QAAQ,MAAM,MAAM;IAC1B,MAAM,UAAU,MAAM,QAAQ;IAC9B,MAAM,WAAW,MAAM,OAAO,SAAS;IACvC,OAAO,MAAM,SAAS,QAAQ,QAAQ,KAAK,UAAU,QAAQ,CAAC;IAC9D,OAAO,MACJ,SAAiC,QAClC,2BACA,KAAK,UAAU,QAAQ,CACzB;IACA,OAAO,UACL,MAAM,MAAM,MAAM,KAAK,GACvB,CAAC,GACD,+DACF;IACA,OAAO,MACL,MAAM,QAAQ,QACd,SACA,yDACF;GACF,CAAC;GACD,MAAM,OAAgB;IACpB,sBAAM,IAAI,IAAI,CACZ,CACE,yBACA;KAAE,QAAQ,UAAU,UAAU;KAAI,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE;IAAE,CAC7D,CACF,CAAC;IACD,eAAe;GACjB;GACA,OAAO,aACL,MACA;IACE,QAAQ,EAAE,KAAK,CAAC,QAAQ,WAAW,CAAC,EAAE;IACtC,SAAS,CAAC,aAAa,IAAI,CAAC;GAC9B,GACA,OAAO,EAAE,cAAc;IAIrB,aACE,MAJoB,QAAQ,OAAO,GAClC,iBAAiB,wBACpB,CAAC,GAGC,KACA,iBACA,0CACF;IACA,OAAO,MACL,KAAK,eACL,GACA,kDACF;GACF,CACF;EACF,GACA,YACG,QAAQ,qBACL,KAAA,IACA,2CACR;EACA,UACE,mCACA,2HACM,qBAAqB,CAC7B;EACA,UACE,kBACA,4HACA,YAAY;GACV,IAAI,CAAE,MAAM,mBAAmB,IAAI,GACjC,OAAO,gBACL,wGACF;GAEF,MAAM,MAAM,MAAM,WAAW,IAAI;GACjC,MAAM,UAAU,MAAM,eACpB,MACA,MAAM,QAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC,CACvC;GACA,MAAM,aACJ,MACA,EACE,QAAQ,EACN,MAAM,CAAC,QAAQ,iBAAiB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAC9D,EACF,GACA,OAAO,EAAE,cAAc;IACrB,KAAK,MAAM,WAAW,CAAC,UAAU,uBAAuB,GAAG;KACzD,MAAM,SAAS,MAAM,QAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC;KACpD,MAAM,UAAW,MAAM,eAAe,MAAM,QAAQ,EAClD,WAAW,KACb,CAAC;KACD,MAAM,SAAS,MAAM,QAAQ,QAAQ,OAAO;KAC5C,OAAO,MACL,OAAO,IACP,MACA,GAAG,QAAQ,iCAAiC,gBAAgB,MAAM,GACpE;KACA,IAAI,YAAY,UACd,MAAM,IAAI,IAAI,CAAC,CAAC,QAAQ;MACtB,SAAS;MACT,MAAM,EAAE,OAAO;KACjB,CAAC;UAED,MAAM,IAAI,gBAAgB,mBAAmB,MAAM;KAErD,aACE,MAAM,QAAQ,QAAQ,OAAO,GAC7B,KACA,KAAA,GACA,GAAG,QAAQ,iDACb;IACF;GACF,CACF;GACA,OAAOA,cACL;IACE;IACA,aAAa,iBACX,QACA,EAAE,MAAM,CAAC,UAAU,EAAE,GACrB,UACF;GACF,GACA,OAAO,EAAE,aAAa;IACpB,MAAM,UAAU,MAAM,QAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC;IACrD,MAAM,YAAY,gBAAgB,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;IACjE,OAAO,OACJ,MAAM,OAAO,SAAS,EAAA,CAAG,QAC1B,SACA,2CACF;IACA,MAAM,IAAI,gBAAgB,WAAW,SAAS;KAC5C,QAAQ;KACR,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,IAAS;IAC7C,CAAC;IACD,OAAO,UACL,MAAM,OAAO,SAAS,GACtB;KAAE,QAAQ;KAAQ,QAAQ;KAAK,QAAQ;IAAc,GACrD,iDACF;IACA,MAAM,IAAI,gBAAgB,WAAW,SAAS,EAC5C,4BAAY,IAAI,KAAK,KAAK,IAAI,IAAI,GAAK,EACzC,CAAC;IACD,OAAO,OACJ,MAAM,OAAO,SAAS,EAAA,CAAG,QAC1B,SACA,+CACF;GACF,CACF;EACF,CACF;EACA,UACE,+BACA,sGACA,YAAY;GACV,MAAM,2BAAW,IAAI,IAAoB;GACzC,MAAM,SAGA;IACJ,CAAC,kBAAkB,SAAS,CAAC,KAAK,IAAI,CAAC;IACvC,CACE,oBACC,SAAU,KAAK,SAAS,UAAU,kBAAkB,QACvD;IACA,CACE,kCACC,SAAS,SAAS,IAAI,KAAK,EAAE,KAAK,QACrC;GACF;GACA,KAAK,MAAM,CAAC,OAAO,WAAW,QAAQ;IACpC,MAAM,UAAU,MAAMC,YAAU,SAAS,EACvC,SAAS,CACP,MAAM,GACN,cAAc,OAAO,EAAE,MAAM,eAAe;KAC1C,MAAM;MACJ,GAAG;MACH,MAAM,OAAO,IAAsC;KACrD;KACA;IACF,EAAE,CACJ,EACF,CAAC;IACD,MAAM,UAAU,MAAM,QAAQ,SAAS,EAAE,MAAM,QAAQ,CAAC;IACxD,MAAM,UAAU,MAAM,QAAQ,SAAS,EAAE,MAAM,OAAO,CAAC;IACvD,SAAS,IAAI,SAAS,MAAM;IAC5B,SAAS,IAAI,SAAS,OAAO;IAC7B,MAAM,aACJ,SACA,EACE,QAAQ,EACN,MAAM,CAAC,QAAQ,iBAAiB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAC9D,EACF,GACA,OAAO,EAAE,cAAc;KACrB,KAAK,MAAM,CAAC,MAAM,WAAW,CAC3B,CAAC,SAAS,OAAO,GACjB,CAAC,cAAc,OAAO,CACxB,GAAY;MACV,MAAM,UAAW,MAAM,eAAe,SAAS,MAAM;MACrD,MAAM,WAAW,MAAM,gBACrB,IAAI,OAAO,CAAC,CAAC,UAAU;OAAE;OAAS,OAAO,CAAC;MAAE,CAAC,CAC/C;MACA,MAAM,UAAU,MAAM,QAAQ,QAAQ,OAAO;MAC7C,OAAO,SACL,SAAS,OAAO,GAChB,KACA,GAAG,MAAM,IAAI,KAAK,IAAI,gBAAgB,OAAO,GAC/C;MACA,OAAO,MACL,SAAS,OAAO,GAChB,UACA,GAAG,MAAM,IAAI,KAAK,uBAAuB,gBAAgB,OAAO,EAAE,cAAc,UAClF;KACF;IACF,CACF;GACF;EACF,CACF;EACA,UACE,wBACA,gHAEED,cACE;GACE;GACA,aAAa,iBACX,QACA,EAAE,MAAM,CAAC,MAAM,EAAE,GACjB,UACF;EACF,GACA,OAAO,EAAE,QAAQ,aAAa;GAC5B,MAAM,MAAM,MAAM,WAAW,IAAI;GACjC,MAAM,UAAU,MAAM,QAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC;GACrD,MAAM,IAAI,gBAAgB,WAAW,OAAO;GAC5C,MAAM,YAAY,MAAM,aACtB,OAAO,gBAAgB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CACrD;GACA,OAAO,UACL,UAAU,MAAM,UAAU,OAC1B;IAAE,QAAQ;IAAQ,QAAQ;IAAK,QAAQ;GAAiB,GACxD,kCAAkC,OAAO,CAAC,UAAU,MAAM,UAAU,KAAK,GAC3E;GACA,MAAM,SAAS,MAAM,QAAQ,MAAM,EAAE,MAAM,QAAQ,CAAC;GACpD,MAAM,UAAW,MAAM,eAAe,MAAM,MAAM;GAClD,MAAM,YAAY,MAAM,mBAAmB,MAAM,OAAO;GACxD,MAAM,UAAU,MAAM,aACpB,OAAO,WAAW;IAChB;IACA,sBAAsB,IAAI,gBAAgB,WAAW,MAAM;GAC7D,CAAC,CACH;GACA,OAAO,UACL,QAAQ,MAAM,QAAQ,OACtB;IAAE,QAAQ;IAAQ,QAAQ;IAAK,QAAQ;GAAiB,GACxD,kEAAkE,OAAO,CAAC,QAAQ,MAAM,QAAQ,KAAK,GACvG;GACA,OAAO,UACL,OAAO,OAAO,GACd,CAAC,GACD,uCACF;EACF,CACF,CACJ;EACA,UACE,qBACA,kHACA,YAAY;GACV,MAAM,WAAW,sBAAsB,WAAW,OAAO,WAAW;GACpE,MAAM,UAAU,MAAMC,YAAU,SAAS,EACvC,SAAS,CAAC,MAAM,EAAE,cAAc,CAAC,QAAQ,EAAE,CAAC,CAAC,EAC/C,CAAC;GACD,MAAM,SAAS,MAAM,QAAQ,SAAS,EAAE,MAAM,OAAO,CAAC;GACtD,MAAM,QAAQ,SAAS;IAAE,IAAI;IAAU,MAAM;GAAO,CAAC;GACrD,MAAM,UAAU,MAAM,QAAQ,SAAS,EAAE,MAAM,OAAO,CAAC;GACvD,MAAM,QAAQ,SAAS,QAAQ,IAAI;GACnC,MAAM,QAAQ,SAAS,UAAU,IAAI;GACrC,MAAM,QAAQ,SAAS,SAAS,EAAE;GAClC,MAAM,OAAO;IACX;KAAC;KAAe;KAAQ;IAAG;IAC3B;KAAC;KAAsC;KAAU;IAAG;IACpD;KAAC;KAAwB;KAAS;IAAG;GACvC;GACA,MAAM,aACJ,SACA,EACE,QAAQ,EACN,MAAM,CAAC,QAAQ,iBAAiB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAC9D,EACF,GACA,OAAO,EAAE,cAAc;IACrB,KAAK,MAAM,CAAC,MAAM,QAAQ,WAAW,MAAM;KACzC,MAAM,UAAW,MAAM,eAAe,SAAS,MAAM;KACrD,OAAO,MACL,MAAM,gBACJ,IAAI,OAAO,CAAC,CAAC,UAAU;MAAE;MAAS,OAAO,CAAC;KAAE,CAAC,CAC/C,GACA,QACA,GAAG,KAAK,6CACV;KACA,MAAM,UAAU,MAAM,QAAQ,QAAQ,OAAO;KAC7C,IAAI,WAAW,KACb,OAAO,MACL,QAAQ,IACR,MACA,GAAG,KAAK,aAAa,gBAAgB,OAAO,GAC9C;UAEA,aACE,SACA,KACA,sBACA,GAAG,KAAK,UACV;IAEJ;GACF,CACF;GACA,OAAOD,cACL;IACE,MAAM;IACN,aAAa,iBACX,QACA,EAAE,MAAM,CAAC,MAAM,EAAE,GACjB,UACF;GACF,GACA,OAAO,EAAE,aAAa;IACpB,KAAK,MAAM,CAAC,MAAM,QAAQ,WAAW,MAAM;KACzC,MAAM,SAAS,MAAM,aACnB,OAAO,gBAAgB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CACpD;KACA,OAAO,GACL,OAAO,IACP,GAAG,KAAK,8BAA8B,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,GACzE;KACA,OAAO,UACL,OAAO,OACP,WAAW,MACP,EAAE,QAAQ,QAAQ,IAClB;MAAE,QAAQ;MAAQ,QAAQ;KAAqB,GACnD,GAAG,KAAK,UACV;IACF;GACF,CACF;EACF,CACF;EACA,UACE,4BACA,iGACA,YAAY;GACV,MAAM,eAAe,CAAC,IAAI,IAAI,YAAY,CAAC,CAAC,IAAI;GAChD,MAAM,cAAc,iBAAiB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;GAC/D,MAAM,UAAU,MAAM,OAAO,YAC3B,KACE,MAAMC,YAAU,SAAS;IACvB,SAAS,EAAE,aAAa;IACxB,SAAS,CAAC,MAAM,CAAC;GACnB,CAAC,GACD,WACF,CACF;GACA,IAAI,QAAQ,IAAI;IACd,MAAM,QAAQ,MAAM,UAAU,MAAM;IACpC,OAAO,KAAK,2CAA2C;GACzD;GACA,OAAO,GACL,eAAe,QAAQ,KAAK,CAAC,CAAC,SAC5B,mCACF,GACA,OAAO,QAAQ,KAAK,CACtB;GACA,MAAM,UAAU,MAAMA,YAAU,SAAS;IACvC,SAAS;KAAE;KAAc,UAAU;IAAa;IAChD,SAAS,CAAC,MAAM,CAAC;GACnB,CAAC;GACD,MAAM,UAAU,MAAM,QAAQ,SAAS,EAAE,MAAM,QAAQ,CAAC;GACxD,MAAM,UAAU,MAAM,QAAQ,SAAS,EAAE,MAAM,OAAO,CAAC;GACvD,OAAO,aACL,SACA,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,WAAW,CAAC,EAAE,EAAE,GAC3C,OAAO,EAAE,cAAc;IACrB,MAAM,UAAU,MAAM,QACpB,QACC,MAAM,eAAe,SAAS,OAAO,CACxC;IACA,OAAO,MACL,QAAQ,IACR,MACA,8BAA8B,gBAAgB,OAAO,GACvD;IACA,aACE,MAAM,QAAQ,QAAS,MAAM,eAAe,SAAS,OAAO,CAAG,GAC/D,KACA,sBACA,cACF;GACF,CACF;EACF,CACF;EACA,gBACE,mBACA,0IACA,YAAY;GACV,MAAM,OAAO;GACb,MAAM,EAAE,SAAS,mBAAmB,MAAM,aAAa,IAAI;GAC3D,MAAM,IAAI,IAAI,CAAC,CAAC,sBAAsB;IACpC;IACA,MAAM,EAAE,eAAe;GACzB,CAAC;GACD,MAAM,YAAY,MAAM,mBAAmB,MAAM,OAAO;GACxD,MAAMD,cACJ;IACE;IACA,aAAa,EACX,OAAO,CACL,iBACE,MACA,sBAAsB,QAAQ,CAChC,GACA,iBAAiB,MAAM,mBAAmB,CAAC,CAC7C,EACF;GACF,GACA,OAAO,EAAE,QAAQ,YAAY;IAC3B,MAAM,OAAO,MAAM,MAAM;IACzB,MAAM,WAAW,MAAM,OAAO,WAAW,EAAE,QAAQ,CAAC;IACpD,OAAO,MACL,SAAS,QACT,SACA,mDAAmD,KAAK,UAAU,QAAQ,GAC5E;IACA,OAAO,MACL,gBAAgB,OAAO,IAAI,CAAC,CAAC,QAC7B,GACA,+CAA+C,gBAAgB,OAAO,IAAI,CAAC,CAAC,OAAO,OACrF;GACF,CACF;GACA,MAAM,SAAS,MAAMC,YAAU,SAAS,EACtC,SAAS,CACP,aAAa,GACb,cAAc,OAAO,EAAE,MAAM,eAAe;IAC1C;IACA,SAAS;KACP,IAAI,QAAQ;KACZ,QAAQ,QAAQ;KAChB,OAAO,QAAQ;KACf,WAAW,QAAQ;KACnB,WAAW,QAAQ;KACnB,WAAW,QAAQ;IACrB;GACF,EAAE,CACJ,EACF,CAAC;GAED,MAAM,gBAAiB,MAAM,eAAe,QAAQ,MAD1B,QAAQ,MAAM,CACuB;GAC/D,MAAM,qBAAqB,MAAM,sBAC/B,QACA,aACF;GACA,MAAM,IAAI,MAAM,CAAC,CAAC,sBAAsB;IACtC,SAAS;IACT,MAAM,EAAE,gBAAgB,mBAAmB;GAC7C,CAAC;GACD,MAAM,kBAAkB,MAAM,mBAAmB,QAAQ,aAAa;GACtE,OAAOD,cACL;IACE,MAAM;IACN,aAAa,iBAAiB,MAAM,mBAAmB,CAAC;GAC1D,GACA,OAAO,EAAE,QAAQ,YAAY;IAC3B,MAAM,OAAO,MAAM,MAAM;IACzB,MAAM,aAAa,CAAC;IACpB,MAAM,WAAW,MAAM,OAAO,iBAAiB;KAC7C,SAAS;KACT;IACF,CAAC;IACD,OAAO,MAAM,SAAS,QAAQ,SAAS,KAAK,UAAU,QAAQ,CAAC;IAC/D,OAAO,GACL,gBAAgB,OAAO,IAAI,CAAC,CAAC,SAC3B,iCACF,GACA,iDAAiD,gBAAgB,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,GACzF;IACA,MAAM,YACJ,QAAQ,IAAI,YAAY,iBAAiB,CAAC,EAIxC,IAAI,SAAS,CAAC,EACd,IAAI,sBAAsB;IAC9B,OAAO,MACL,WACA,oBACA,uDACF;GACF,CACF;EACF,GACA,KACF;EACA,gBACE,8BACA,0GACA,YAAY;GACV,MAAM,QAAQ,MAAM,WAAW;GAC/B,IAAI,OACF,OAAO;GAET,MAAM,EAAE,QAAQ,YAAY,WAAW,YAAY;GACnD,MAAM,SAAS,OACb,QACA,YACG;IACH,MAAM,SAAS,MAAM,KAAK,QAAQ,KAAA,GAAW;KAC3C;KACA,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;IAC/B,CAAC;IACD,MAAM,OAAO,UAAU,MAAM;IAC7B,OAAO,OAAO,OAAO,QAClB,QAAQ,UAAU,MAAM,UAAU,MAAM,CAAC,CACzC,KAAK,UAAU,MAAM,IAAI;GAC9B;GACA,MAAM,QAAQ,OAA0B,SACtC,MAAM,MAAM,SAAS,KAAK,WAAW,GAAG,KAAK,EAAE,CAAC;GAClD,MAAM,cAAc;GACpB,KAAK,MAAM,CAAC,OAAO,OAAO,YAAY,CACpC;IAAC;IAAc,MAAM,OAAO,IAAI;IAAG;GAAK,GACxC;IACE;IACA,MAAM,OAAO,MAAM,EAAE,gBAAgB,KAAK,CAAC;IAC3C;GACF,CACF,GAAY;IACV,MAAM,OAAO,KAAK,OAAO,wBAAwB;IACjD,MAAM,aAAa,KAAK,OAAO,8BAA8B;IAC7D,OAAO,GAAG,MAAM,GAAG,MAAM,4BAA4B;IACrD,OAAO,GAAG,YAAY,GAAG,MAAM,kCAAkC;IACjE,KAAK,MAAM,MAAM,CAAC,WAAW,QAAQ,OAAO,MAAM,CAAC,CAAC,KACjD,WAAY,OAAwC,EACvD,GACE,OAAO,GACL,WAAW,SAAS,EAAE,GACtB,GAAG,MAAM,+CAA+C,GAAG,IAAI,YACjE;IAEF,KAAK,MAAM,QAAQ,CAAC,MAAM,UAAU,GAClC,OAAO,MACL,KAAK,SAAS,WAAW,GACzB,CAAC,SACD,GAAG,MAAM,IAAI,MACf;GAEJ;GACA,KAAK,MAAM,CAAC,OAAO,UAAU,CAC3B,CACE,sCACA,MAAM,OAAO,MAAM,EAAE,gBAAgB,MAAM,CAAC,CAC9C,GACA,CACE,8BACA,MAAM,OACJ,MAAMC,YAAU,SAAS,EAAE,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC,CACxD,CACF,CACF,GACE,OAAO,UACL,MAAM,QAAQ,SAAS,KAAK,WAAW,YAAY,CAAC,GACpD,CAAC,GACD,GAAG,MAAM,qCACX;EAEJ,GACA,KACF;EACA,gBACE,8BACA,wFACA,YAAY;GACV,MAAM,OAAO;GACb,IAAI,CAAE,MAAM,UAAU,MAAM,SAAS,GACnC,OAAO,gBAAgB,qCAAqC;GAE9D,MAAM,UAAU,QAAQ,WAAW,CAAC;GACpC,IACE,CAAC,QAAQ,MACN,WACC,OAAO,WAAW,YAClB,WAAW,QACX,WAAW,UACV,OAAO,MAA4B,SAASH,cAAY,CAC7D,GAEA,OAAO,gBACL,iFACF;GAEF,MAAM,UAAU,MAAM,QAAQ,IAAI;GAClC,MAAM,MAAM,MAAMC,YAAU,MAAM,SAAS;IACzC,WAAW;IACX,aAAa,KAAK;GACpB,CAAC;GACD,OAAO,aACL,MACA;IAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,QAAQ,WAAW,CAAC,EAAE;IAAG;GAAQ,GAC7D,OAAO,EAAE,cAAc;IACrB,MAAM,SAAS,MAAM,YAAY,MAAM,IAAI,EAAE;IAC7C,MAAM,UAAU,MAAM,QAAQ,SAAS,GACpC,iBAAiB,IAAI,IACxB,CAAC;IACD,OAAO,MACL,QAAQ,IACR,MACA,8CAA8C,gBAAgB,OAAO,GACvE;IACA,OAAO,MACL,SAAU,MAAM,YAAY,MAAM,IAAI,EAAE,GACxC,GACA,sDACF;GACF,CACF;EACF,GACA,UACI,KAAA,IACA,mEAAmE,eAAe,EACxF;EACA,gBACE,2BACA,4GACA,YAAY;GACV,MAAM,cAAc;IAAE,YAAY;IAAG,OAAO;GAAE;GAC9C,MAAM,iBAAwD;IAC5D,KAAc;IACd,WAAoB,EAAE,YAAY,WAAW;IAE7C,WAAW;KACT,YAAY;KACZ,OAAO,MAAM;IACf;GACF;GACA,MAAM,YAAmD;IACvD,KAAc;IACd,WAAoB,EAAE,eAAe,KAAK;IAE1C,WAAW;KACT,YAAY;KACZ,OAAO,MAAM;IACf;GACF;GACA,MAAM,kBACJ;GACF,MAAM,aACJ;GACF,MAAM,SAAS,MAAM,QAAQ,IAAI;GACjC,MAAM,OAAO,OAAO,MAAM,WAAW,IAAI,EAAA,CAAG,QAAQ,QAElD;IAAE,OAAO;IAAQ,OAAO,CAAC;KAAE,OAAO;KAAM,OAAO;IAAO,CAAC;GAAE,CAAC;GAC5D,MAAM,OAAgB;IACpB,sBAAM,IAAI,IAAI,CAAC,CAAC,yBAAyB;KAAE;KAAQ,OAAO,CAAC;IAAE,CAAC,CAAC,CAAC;IAChE,eAAe;GACjB;GACA,OAAO,aACL,MACA;IACE,QAAQ;KACN,iBAAiB,CACf,QAAQ;MAAE,QAAQ;MAA2B,QAAQ,CAAC;KAAE,CAAC,CAC3D;KACA,iBAAiB,CACf,QAAQ;MAAE,QAAQ;MAAiB,QAAQ,CAAC;KAAE,CAAC,CACjD;KACA,YAAY,CACV,QAAQ;MAAE,QAAQ;MAAsB,QAAQ,CAAC;KAAE,CAAC,CACtD;KACA,YAAY,CAAC,QAAQ;MAAE,QAAQ;MAAY,QAAQ,CAAC;KAAE,CAAC,CAAC;KACxD,UAAU,CAAC,YAAY,CAAC;IAC1B;IACA,SAAS,CAAC,aAAa,IAAI,CAAC;IAC5B,WAAW;KACT;KACA;KACA;MAAE,SAAS;MAAiB,UAAU;KAAiB;KACvD;MAAE,SAAS;MAAY,UAAU;KAAY;IAC/C;GACF,GACA,OAAO,EAAE,SAAS,YAAY;IAC5B,KAAK,MAAM,SAAS,CAAC,mBAAmB,iBAAiB,GAAG;KAC1D,MAAM,gBAAgB,KAAK;KAC3B,MAAM,QAAQ,YAAY;KAC1B,MAAM,UAAU,MAAM,QAAQ,OAAO,GAClC,iBAAiB,wBACpB,CAAC;KACD,OAAO,MACL,QAAQ,IACR,MACA,GAAG,MAAM,iCAAiC,gBAAgB,OAAO,GACnE;KACA,OAAO,MACL,KAAK,eACL,gBAAgB,GAChB,GAAG,MAAM,6BACX;KACA,OAAO,MAAM,YAAY,YAAY,QAAQ,CAAC;IAChD;IAEA,MAAM,WAAW,MAAM,YACrB,SAAS,kBAAkB,SAAS,IAAI,mBAAmB,IACvD;KACE;KACA,SAAS;MACP,IAAI,oBAAoB;MACxB,OAAO;MACP;MACA,2BAAW,IAAI,KAAK;MACpB,2BAAW,IAAI,KAAK;MACpB,WAAW,IAAI,KAAK,KAAK,IAAI,IAAI,IAAS;KAC5C;IACF,IACA,KAAA;IACN,MAAM,SAAS,GAAG,sBAAsB,IAAI;IAC5C,MAAM,WAAW,MAAM,QAAQ,YAAY,MAAM;IACjD,OAAO,MACL,SAAS,IACT,MACA,+DAA+D,gBAAgB,QAAQ,GACzF;IACA,KAAK,MAAM,SAAS,CAAC,cAAc,YAAY,GAC7C,aACE,MAAM,QAAQ,OAAO,MAAM,GAC3B,KACA,KAAA,GACA,GAAG,MAAM,iDACX;IAEF,OAAO,MACL,YAAY,OACZ,GACA,sEACF;GACF,CACF;EACF,CACF;EACA,IAAI,QAAQ,cAAc,CAAC,EAAA,CAAG,QAAQ,aAAa;CACrD;AACF;;;AC/vCA,MAAM,UAAU;CACd,aAAa;CACb,cAAc;AAChB;;;;;AAMA,SAAS,cAAc,UAA0C;CAC/D,OACE,SAAS,WAAW,UACpB,SAAS,WAAW,QACnB,SAAS,WAAW,kBACnB,SAAS,WAAW;AAE1B;;AAGA,SAAS,eAAe,SAA4B,MAAsB;CACxE,OAAO,QAAQ,MAAM,IAAI,CAAC,CAAC,QAAQ,UAAU,MAAM,SAAS,UAAU,CAAC,CAAC,CACrE;AACL;AAEA,MAAM,oBACJ;;;;;AAMF,SAAS,eAAe,QAAsC;CAC5D,IACM,yBADN,MACM,uBAA+D;EAMxD;EALX,KAAc,GAAG,OAAO,GAAG;EAC3B,WAAoB,OAAO;EAE3B,YACE,YAEA;GADS,KAAA,aAAA;EACR;EAEH,SACE,QACA,SACwD;GACxD,OAAO,OAAO,SAAS,QAAQ,OAAgB;EACjD;CACF;;EAhBC,WAAW;EAMP,gBAAA,GAAA,OAAO,iBAAiB,CAAA;;;CAW7B,OAAO;AACT;;;;;;;;;;;AAYA,SAAgB,kBACd,SACmB;CACnB,MAAM,OACJ,IACA,OACA,KACA,SACG,gBAAgB,IAAI,aAAaG,cAAY,SAAS,GAAG,GAAG,IAAI;CACrE,MAAM,QAAQ,eAAe,QAAQ,WAAW;CAEhD,MAAM,aAAa,eAAe,QAAQ,WAAW,CAAC,CAAC,MACpD,MAAM,UACL,KAAK,eAAe,KAAA,KACpB,MAAM,MAAM,EAAE,UAAU,eAAe,KAAA,CAC3C;CACA,MAAM,UAAU,CACd,GAAG,IAAI,IAAI,MAAM,SAAS,WAAW,OAAO,UAAU,WAAW,CAAC,CAAC,CAAC,CACtE;CACA,MAAM,eACH,cACD,OAAO,EAAE,QAAQ,OAAO,WAAiD;EACvE,MAAM,YAAY,MAAM,QAAQ,kBAAkB;EAClD,IAAI,cAAc,CAAC,UAAU,UAAU,UAAU,aAC/C,OAAO,gBACL,qEACF;EAEF,MAAM,UAAU,YACZ,MAAM,eAAe,MAAM,UAAU,QAAS,EAAE,WAAW,KAAK,CAAC,IACjE,KAAA;EACJ,IAAI,YAAY,MACd,OAAO,gBACL,yHACF;EAEF,MAAM,gBAAgB,MAAM,UAAU,MAAM,gBAAgB;EAC5D,IAAI,QAAQ,MAAM,MAAM;EACxB,IAAI,UAAU,MAAM,QAAQ;EAC5B,MAAM,SAAS,MAAM,aACnB,OAAO,WAAW;GAChB,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;GAC7B,sBAAsB;IACpB,QAAQ,MAAM,MAAM;IACpB,UAAU,MAAM,QAAQ;IACxB,MAAM,qCAAqB,IAAI,MAAM,4BAA4B;GACnE;EACF,CAAC,CACH;EACA,MAAM,eAAe,KAAA;EACrB,IACE,gBAAgB,OAAO,KAAK,CAAC,CAAC,WAAW,KACzC,MAAM,QAAQ,WAAW,SAEzB,OAAO,gBACL,0FACF;EAEF,IAAI,iBAAiB,OAAO,MAAM,cAAc,OAAO,KAAK,GAE1D;EAEF,OAAO,MACL,OAAO,IACP,OACA,iCAAiC,KAAK,UAAU,OAAO,MAAM,OAAO,KAAK,GAC3E;EACA,OAAO,GACL,sBAAsB,CAAC,OAAO,MAAM,OAAO,KAAK,GAChD,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,CACnC;CACF;CACF,OAAO;EACL,IACE,mBACA,gGACA,OAAO,EAAE,aAAa;GACpB,MAAM,UAAU,MAAM,OAAO,MAAM,QAAQ,kBAAkB,CAAC;GAC9D,OAAO,MACL,QAAQ,QACR,SACA,sCAAsC,KAAK,UAAU,OAAO,GAC9D;GACA,MAAM,SAAS,MAAM,OAAO,YAC1B,OAAO,MAAM,QAAQ,iBAAiB,CAAC,CACzC;GACA,OAAO,MACL,OAAO,IACP,MACA,kCAAkC,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,GACrE;GACA,MAAM,WAAW,OAAO,KAAK,OAAO,QAAQ,KAAA;GAC5C,OAAO,MAAM,UAAU,QAAQ,MAAM;GACrC,OAAO,MACL,OAAQ,SAAkC,QAC1C,QACF;EACF,CACF;EACA,IACE,kBACA,gGACA,YAAY,KAAK,CACnB;EACA,IACE,kBACA,iGACA,YAAY,IAAI,CAClB;EACA,IACE,sBACA,iHACA,OAAO,EAAE,QAAQ,YAAY;GAC3B,MAAM,YAAY,MAAM,QAAQ,kBAAkB;GAClD,MAAM,gBAAgB,UAAU,WAAW;GAC3C,MAAM,WAKA;IACJ,GAAG,OACK,IAAI,SAAS,cAAc,SAE/B,IAAI,SAAS,gBAAgB;KAC3B,MAAM;KACN,SAAS;IACX,CAAC,CACL,CAAC,CAAC,KAAK,WAAW;KAChB;KACA,SACE,WACG;MACH,IAAI,eACF,OAAO,GACL,CAAC,OAAO,MAAM,sBAAsB,OAAO,KAAK,GAChD,6DAA6D,KAAK,UAAU,OAAO,MAAM,OAAO,KAAK,GACvG;WAEA,OAAO,UAAU,OAAO,MAAM,OAAO,OAAO;OAC1C,QAAQ;OACR,QAAQ;OACR,QAAQ;MACV,CAAC;KAEL;IACF,EAAE;IACF;KACE,aACE,IAAI,SAAS,gBAAgB;MAC3B,MAAM;MACN,SAAS;KACX,CAAC;KACH,SAAS,WAAW;MAClB,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,QAAQ,MAAM;MACrD,OAAO,MACL,OAAO,MAAO,OAAO,MAA8B,QACnD,mBACF;MACA,OAAO,MACL,OAAO,MAAO,OAAO,MAA8B,QACnD,GACF;KACF;IACF;IACA;KACE,aACE,IAAI,SAAS,aAAa;MACxB,MAAM;MACN,SAAS;KACX,CAAC;KACH,SAAS,WAAW;MAClB,OAAO,MACL,OAAO,MAAO,OAAO,MAA8B,QACnD,uBACF;KACF;IACF;IACA;KACE,aAAa,IAAI,SAAS,mBAAmB;KAC7C,SAAS,WAAW;MAClB,OAAO,GACL,CAAC,OAAO,MACN,cAAc,OAAO,KAAK,KAC1B,OAAO,MAAM,WAAW,KAC1B,8CACF;KACF;IACF;IACA;KACE,aAAa,IAAI,SAAS,eAAe,EAAE,MAAM,cAAc,CAAC;KAChE,SAAS,WAAW;MAClB,OAAO,GACL,CAAC,OAAO,MAAM,qBAAqB,OAAO,KAAK,GAC/C,2CACF;KACF;IACF;IACA;KACE,aAAa,IAAI,SAAS,uBAAuB;KACjD,SAAS,WAAW;MAClB,OAAO,GACL,CAAC,OAAO,MAAM,sBAAsB,OAAO,KAAK,GAChD,8BACF;KACF;IACF;GACF;GACA,KAAK,MAAM,WAAW,UAAU;IAC9B,MAAM,OAAO,MAAM,MAAM;IACzB,MAAM,SAAS,SACb,SAAS,iBAAiB,KAAA,IAAY,QAAQ,MAAM;IACtD,MAAM,SAAS,MAAM,aAAa,OAAO,SAAS,CAAC;IACnD,MAAM,QAAQ,KAAA;IACd,IAAI,gBAAgB,OAAO,IAAI,CAAC,CAAC,WAAW,GAC1C,OAAO,gBACL,qEACF;IAEF,QAAQ,OAAO,MAAM;GACvB;EACF,CACF;EACA,IACE,yBACA,qHACA,OAAO,EAAE,QAAQ,OAAO,WAAW;GACjC,MAAM,YAAY,MAAM,QAAQ,kBAAkB;GAClD,IAAI,UAAU,WAAW,yBAAyB,CAAC,UAAU,QAC3D,OAAO,gBACL,kFACF;GAEF,MAAM,SAAS,UAAU;GACzB,MAAM,MAAM,MAAM,WAAW,IAAI;GACjC,MAAM,gBAAgB,MAAM,UAAU,MAAM,gBAAgB;GAE5D,MAAM,UAAU;IACd,KAAK,CAAC;IACN,SAAS,MAAM,eAAe,MAAM,MAAM;GAC5C;GACA,IAAI,QAAQ,MAAM,MAAM;GACxB,IAAI,UAAU,MAAM,QAAQ;GAC5B,MAAM,QAAQ,MAAM,OAAO,WAAW;IACpC,KAAK,QAAQ;IACb,YAAY,CAAC;IACb,SAAS,QAAQ;IACjB,gBAAgB,YAAY;KAC1B,MAAM,IAAI,gBAAgB,mBAAmB,MAAM;KACnD,QAAQ,MAAM,MAAM;KACpB,UAAU,MAAM,QAAQ;IAC1B;GACF,CAAC;GACD,IACE,MAAM,WAAW,WACjB,eAAe,MAAM,SAAS,OAAO,MAAM,GAE3C,OAAO,gBACL,oEACF;GAEF,MAAM,SAAS,MAAM,OAAO,WAAW;IACrC,KAAK,QAAQ;IACb,YAAY,CAAC;IACb,SAAS,QAAQ;GACnB,CAAC;GACD,KAAK,MAAM,YAAY,CAAC,OAAO,MAAM,GACnC,OAAO,GACL,cAAc,QAAQ,GACtB,6EAA6E,KAAK,UAAU,QAAQ,GACtG;GAEF,OAAO,MACLC,eAAa,OAAO,KAAK,GACzB,GACA,sDAAsDA,eAAa,OAAO,KAAK,EAAE,OACnF;GAEA,MAAM,UAAU;IACd,KAAK,CAAC;IACN,SAAS,MAAM,eAAe,MAAM,MAAM;GAC5C;GACA,MAAM,WAAW,CAAC;GAClB,KAAK,MAAM,SAAS,CAAC,GAAG,CAAC,GACvB,SAAS,KACP,MAAM,aACJ,OAAO,WAAW;IAChB,KAAK,QAAQ;IACb,YAAY,CAAC;IACb,SAAS,QAAQ;IACjB,sBAAsB;KACpB,IAAI,UAAU,GACZ,QAAQ,MAAM,MAAM;KAEtB,MAAM,qCACJ,IAAI,MAAM,4BAA4B;IAC1C;GACF,CAAC,CACH,CACF;GAEF,MAAM,eAAe,KAAA;GACrB,KAAK,MAAM,WAAW,UACpB,IAAI,eACF,OAAO,GACL,QAAQ,MAAM,cAAc,QAAQ,KAAK,GACzC,wEAAwE,QAAQ,KAAK,KAAK,UAAU,QAAQ,KAAK,IAAI,OAAO,QAAQ,KAAK,GAC3I;QAEA,OAAO,GACL,CAAC,QAAQ,MAAM,sBAAsB,QAAQ,KAAK,GAClD,kEAAkE,KAAK,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAC9G;GAGJ,OAAO,MACLA,eAAa,OAAO,KAAK,GACzB,GACA,sDAAsDA,eAAa,OAAO,KAAK,EAAE,yBACnF;EACF,CACF;EACA,IACE,sBACA,+DACA,OAAO,EAAE,aAAa;GACpB,MAAM,YAAY,MAAM,QAAQ,mBAAoB;GACpD,OAAO,GACL,UAAU,YACV,4CACF;GAEA,MAAM,WAAW,MAAM,OAAO;IADX,GAAG;IAAW,YAAY;GACR,CAAC;GACtC,OAAO,MACL,SAAS,QACT,QACA,2DACF;EACF,GACA,QAAQ,qBACJ,KAAA,IACA,0CACN;EACA,IACE,+BACA,wEACA,OAAO,EAAE,aAAa;GAOpB,MAAM,WAAW,MAAM,OANL,QAAQ,qBACtB,MAAM,QAAQ,mBAAmB,IAChC;IACC,GAAI,MAAM,QAAQ,kBAAkB;IACpC,YAAY;KAAE,aAAa;KAAe,cAAc;IAAK;GAC/D,CACmC;GAEvC,OAAO,MAAM,SAAS,QAAQ,QAAQ,KAAK,UAAU,QAAQ,CAAC;GAC9D,OAAO,MACJ,SAAiC,QAClC,2BACA,KAAK,UAAU,QAAQ,CACzB;EACF,GACA,aACI,2DACA,KAAA,CACN;EACA,IACE,oBACA,kFACA,OAAO,EAAE,QAAQ,OAAO,kBAAkB;GACxC,MAAM,YAAY,MAAM,QAAQ,kBAAkB;GAClD,MAAM,MAAM,CAAC;GACb,MAAM,QAAQ,CAAC;GACf,MAAM,OAAO,MAAM,MAAM;GACzB,MAAM,OAAO,WAAW;IAAE;IAAK,YAAY;GAAM,CAAC;GAClD,MAAM,aAAa,gBAAgB,OAAO,IAAI,CAAC,CAAC;GAChD,MAAM,QAAQ,YAAY;GAC1B,MAAM,OAAO,WAAW;IAAE;IAAK,YAAY,CAAC;GAAE,CAAC;GAC/C,OAAO,GACL,YAAY,QAAQ,OACpB,8CACF;GACA,OAAO,MACL,gBAAgB,OAAO,IAAI,CAAC,CAAC,QAC7B,YACA,0DACF;GACA,MAAM,SAAS,YAAY;GAC3B,MAAM,OAAO,WAAW;IAAE;IAAK,YAAY;GAAM,CAAC;GAClD,OAAO,MACL,YAAY,OACZ,QACA,qDACF;EACF,CACF;EACA,gBACE,eACA,2GACA,YAAY;GACV,MAAM,OAAO,eAAe,QAAQ,WAAW,CAAC,CAAC;GACjD,MAAM,SAAS,MAAM;GACrB,MAAM,YAAY,UAAiB;IACjC,MAAM,cAAc,eAAe,MAAM;IACzC,MAAM,cAA2B;KAC/B,GAAG;KACH,QAAQ;IACV;IACA,OAAO,aACL,KAAK,QAAQ,MAAM,MAAM;KACvB,QAAQ,GAAG,YAAY,CAAC,QAAQ,WAAW,CAAC,EAAE;KAC9C,SAAS,QAAQ;KACjB,WAAW,CACT,aACA;MACE,SAAS;MACT,mBAAmB,EAAE,OAAO,OAAO,KAAK,EAAE;MAC1C;KACF,CACF;IACF,CAAC,CACH;GACF;GACA,MAAM,YAAY,MAAM,SAAS,MAAM,OAAO;GAC9C,IAAI,CAAC,UAAU,IACb,OAAO,KACL,6DAA6D,OAAO,UAAU,KAAK,GACrF;GAEF,MAAM,UAAU,MAAM,UAAU,MAAM;GACtC,MAAM,SAAS,MAAM,SAAS,MAAM,OAAO;GAC3C,IAAI,OAAO,IAAI;IACb,MAAM,OAAO,MAAM,UAAU,MAAM;IACnC,OAAO,KAAK,wDAAwD;GACtE;GACA,OAAO,GACL,eAAe,OAAO,KAAK,CAAC,CAAC,SAAS,yBAAyB,GAC/D,sDAAsD,OAAO,OAAO,KAAK,GAC3E;EACF,CACF;EACA,gBACE,uBACA,oEACA,YAAY;GACV,MAAM,SAAS,MAAM,OAAO,YAC1B,KAAK,MAAMC,YAAU,SAAS,CAAC,CAAC,GAAG,QAAQ,WAAW,CACxD;GACA,IAAI,OAAO,IAAI;IACb,MAAM,OAAO,MAAM,UAAU,MAAM;IACnC,OAAO,KAAK,iDAAiD;GAC/D;GACA,OAAO,GACL,eAAe,OAAO,KAAK,CAAC,CAAC,SAAS,qBAAqB,GAC3D,OAAO,OAAO,KAAK,CACrB;EACF,GACA,QAAQ,SACJ,KAAA,IACA,6CACN;EACA,GAAG,gBAAgB,SAAS,KAAK;CACnC;AACF;;;ACrZA,IAAM,gBAAN,MAA0C;CACxC,SAA4B,CAAC;CAE7B,OAAO,YAAwC;EAC7C,KAAK,OAAO,KAAK,GAAG,UAAU;EAC9B,OAAO;CACT;AACF;AAEA,eAAe,kBAAkB,MAAqC;CACpE,MAAM,QAAQ,MAAM,QAAQ,IAAI;CAChC,MAAM,WACH,MAAM,KAAK,SAAA,CAKZ,QAAQ;CACV,IAAI,SAAS,cAAc,KAAK,QAAQ,uBACtC,MAAM,IAAI,6BACR,+BACA,8IACA,oFACF;CAEF,OAAO;AACT;AAEA,SAAS,UACP,MACA,QACA,SAAkC,CAAC,GACnC;CACA,OAAO,iBAAiB,QAAQ;EAC9B;EACA,YAAY,CAAC,MAAM;EACnB,SAAS;EACT,MAAM,EAAE,OAAO,MAAM;EACrB,YAAY;EACZ,GAAG;CACL,CAAU;AACZ;AAEA,eAAe,QACb,SACA,OAAoB,CAAC,GACH;CAClB,MAAM,OAAO,KAAK,QAAQ,QAAQ;CAClC,MAAM,QAAQ,MAAM,kBAAkB,IAAI;CAC1C,MAAM,YAA2B,MAAM,KAAK,oBAAoB,EAC9D,SAAS,CAAC,UAAU,MAAM,QAAQ,QAAQ,KAAK,MAAM,CAAC,EACxD,CAAC,CAAC,CAAC,QAAQ;CACX,UAAU,UAAU,KAAK;CACzB,IAAI;EACF,MAAM,UAAU,KAAK;CACvB,SAAS,OAAO;EACd,MAAM,UAAU,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EAC7C,MAAM;CACR;CACA,MAAM,SAAS,UAAU,IAAgB,yBAAyB,CAAC;CACnE,MAAM,SAAS,UAAU,IACvB,kBAAkB,cAAc,WAAW,CAAC,CAC9C;CACA,MAAM,WAAW,UAAU,IAAuB,kBAAkB;CACpE,OAAO;EACL;EACA;EACA;EACA;EACA,QAAQ,SAAS,SAAS,cAAc,CAAC,GAAG;GAC1C,MAAM,OAAO,YAAY,wBAAQ,IAAI,IAA+B;GACpE,MAAM,UAA4B;IAChC;IACA;IACA,WAAW;IACX,WAAW,YAAY,aAAa;IACpC,MAAM;IACN,KAAQ,KAAc,SAAuC;KAC3D,IAAI,CAAC,KAAK,IAAI,GAAG,GACf,KAAK,IAAI,KAAK,QAAQ,CAAC;KAEzB,OAAO,KAAK,IAAI,GAAG;IACrB;GACF;GAEA,OAAO,OAAO,IACZ;IACE;IACA,SAAS;IACT,eAAe;IACf,UAAU;GACZ,GACA,YAAY;IACV,IAAI,OAAO,aAAa,CAAC,OAAO,UAAU,OAAO,GAC/C,OAAO,EAAE,SAAS,SAAS;IAE7B,OAAO,OAAO,QAAQ,OAAO;GAC/B,CACF;EACF;EACA,aAAa,SAAS,SAAS;GAC7B,MAAM,MAAM,CAAC;GACb,MAAM,OAAsB;IAC1B;IACA,YAAY;IACZ,eAAe,IAAI,QAAQ,OAAO;IAClC,UAAU;IACV;IACA,aAAa,KAAA;GACf;GACA,OAAO,SAAS,QAAQ,MAAM;IAC5B,MAAM;IACN,WAAW;IACX,SAAS,IAAI,IAAY,OAAO,KAAK;IACrC,WAAW;GACb,CAAC;EACH;EACA,aAAa,UAAU,MAAM;CAC/B;AACF;AAEA,eAAe,YACb,SACA,IACA,OAAoB,CAAC,GACQ;CAC7B,MAAM,QAAQ,MAAM,QAAQ,SAAS,IAAI;CACzC,IAAI;EACF,OAAO,MAAM,GAAG,KAAK;CACvB,UAAU;EACR,MAAM,MAAM,QAAQ,KAAA;EACpB,MAAM,MAAM,eAAe,KAAA;EAC3B,MAAM,MAAM,eAAe,KAAA;EAC3B,MAAM,MAAM,UAAU,KAAA;EACtB,MAAM,MAAM,MAAM;CACpB;AACF;AAEA,SAAS,MAAM,SAAsC;CACnD,OAAO,QAAQ,KAAK,SAAS,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,EAAG;AACrD;AAEA,SAAS,YAAY,QAAmC,MAAsB;CAC5E,KAAK,MAAM,SAAS,UAAU,GAAA,CAAI,MAAM,GAAG,GAAG;EAC5C,MAAM,QAAQ,KAAK,QAAQ,GAAG;EAC9B,IAAI,QAAQ,KAAK,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,KAAK,MAAM,MAC/C,OAAO,KAAK,MAAM,QAAQ,CAAC,CAAC,CAAC,KAAK;CAEtC;CACA,OAAO;AACT;;AAGA,SAAS,aACP,SACA,eACA,OACQ;CACR,OAAO;EACL,YAAY,SAAS,IAAI,QAAQ,GAAG,aAAa;EACjD,SAAS,IAAI,eAAe,KAAK;EACjC,GAAG,MAAM,KAAK,SAAS,SAAS,IAAI,IAAI,KAAK,EAAE;CACjD,CAAC,CAAC,KAAK,IAAQ;AACjB;;AAGA,SAAS,WACP,OACA,MACA,SACA,OACU;CACV,OAAO,MAAM,SAAS,MAAM,IAAI,CAAC,CAAC,SAAS,UAAU;EACnD,MAAM,OAAO,aAAa,MAAM,SAAS,MAAM,eAAe,KAAK;EACnE,OAAO,SAAS,aAAa,SAAS,MAAM,eAAe,KAAK,KAC9D,SAAS,aAAa,KAAA,GAAW,MAAM,eAAe,KAAK,IACzD,MAAM,aACN,CAAC;CACP,CAAC;AACH;AAEA,SAAS,YAAY,OAA0B,MAAsB;CACnE,OAAO,MAAM,QAAQ,UAAU,UAAU,IAAI,CAAC,CAAC;AACjD;AAEA,MAAM,WAAW,IAAI,IAAI,YAAY,CAAC,CAAC;AACvC,MAAM,cAAc;;AAEpB,MAAM,gBAAgB,CAAC,UAAU,WAAW;;AAE5C,MAAM,WAAW;AACjB,MAAM,YAAY;AAClB,MAAM,yBAAS,IAAI,IAAI;CACrB;CACA;CACA;CACA;CACA;AACF,CAAC;;AAED,MAAM,8BAAc,IAAI,IAAI;CAC1B;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,UACP,SACA,WACmB;CACnB,IAAI,QAAQ,SACV,OAAO,QAAQ,QAAQ,QAAQ,QAAQ,SAAS,CAAC;CAEnD,QAAQ,YAAY;EAIlB,MAAM,YAAW,MAHM,QAAQ,KAAK,SAAA,CAGX,QAAQ,WAAW,CAAC,EAAA,CAAG,QAC7C,WAAW,CAAC,YAAY,IAAI,OAAO,EAAE,CACxC;EACA,OAAO,sBAAsB;GAC3B,GAAG;GACM;EACX,CAAC;CACH,EAAA,CAAG;AACL;;AAGA,eAAe,eACb,MACA,aACA,WACmE;CACnE,MAAM,QAAQ,MAAMC,UAAc;EAAE;EAAM;CAAY,CAAC;CACvD,IAAI;EAEF,OAAO;GAAE,UAAA,MADc,MAAM,OAAO,SAAS;GAC1B,aAAa,MAAM,YAAY;EAAM;CAC1D,UAAU;EACR,MAAM,MAAM,MAAM;CACpB;AACF;;AAGA,SAAS,gBAAgB,QAAkC;CACzD,OACG,OAAO,MAA4B,SAAS,SAAS,MACrD,OAAO,UAAU,WAAW,CAAC,EAAA,CAAG,SAAS,SAAS;AAEvD;AAEA,MAAM,cAAc;AASpB,eAAe,UACb,SACA,SACA,SAA4C,CAAC,GACjB;CAC5B,IAAI,QAAQ,YAAY,QACtB,OAAO,QAAQ,YAAY,OAAO,QAAQ,MAAM,MAAM;CAExD,MAAM,QAAQ,MAAM,YAAY,QAAQ,IAAI;CAC5C,MAAM,UAAU,MAAO,QAAQ,KAAK,IAA0B,aAAa,EACzE,MAAM;EAAE,QAAQ,MAAM;EAAQ,GAAG;CAAO,EAC1C,CAAC;CACD,OAAO;EACL,IAAI,QAAQ;EACZ,SAAS,IAAI,QAAQ,GAClB,QAAQ,OAAO,oBAAoB,MAAM,cAAc,QAAQ,IAClE,CAAC;CACH;AACF;AAEA,eAAe,UACb,SACA,IACA,QACe;CAUf,OAAM,MATiB,QAAQ,KAAK,SAAA,CAStB,QAAQ,OAAO;EAC3B,OAAO;EACP,OAAO,CAAC;GAAE,OAAO;GAAM,OAAO;EAAG,CAAC;EAClC;CACF,CAAC;AACH;;AAGA,SAAS,WAAW,QAAkC;CACpD,OAAO,IAAI,QAAQ,GAChB,OAAO,oBAAoB,MAAM,cAChC,uBAAuB,WAAW,OAAO,WAAW,IACxD,CAAC;AACH;AAEA,SAAS,eACP,QACA,QACA,QACA,OACM;CACN,OAAO,MACL,OAAO,SACP,YACA,GAAG,MAAM,YAAY,KAAK,UAAU,MAAM,GAC5C;CACA,MAAM,UAAU,OAAO,YAAY,aAAa,OAAO,UAAU,KAAA;CACjE,OAAO,MAAM,SAAS,QAAQ,QAAQ,GAAG,MAAM,IAAI,KAAK,UAAU,OAAO,GAAG;CAC5E,OAAO,MAAM,SAAS,QAAQ,QAAQ,GAAG,MAAM,IAAI,KAAK,UAAU,OAAO,GAAG;AAC9E;AAEA,eAAe,qBACb,KACA,OACe;CACf,MAAM,SAAS,MAAM,OAAO,GAAG;CAC/B,OAAO,MACL,OAAO,IACP,OACA,GAAG,MAAM,YAAY,KAAK,UAAU,OAAO,MAAM,OAAO,KAAK,EAAE,oCACjE;CACA,OAAO,GACL,CAAC,cAAc,CAAC,OAAO,MAAM,OAAO,KAAK,GACzC,GAAG,MAAM,2BAA2B,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,GACvE;AACF;;AAGA,SAAS,gBACP,SACA,mBACU;CACV,MAAM,wBAAQ,IAAI,IAAY;CAC9B,MAAM,OAAO,UAAqC;EAChD,IAAI,SAAS,MAAM,UAAU,GAC3B,MAAM,IAAI,KAAK;CAEnB;CACA,KAAK,MAAM,SAAS,QAAQ,IAAI,QAAQ,KAAK,GAAA,CAAI,MAAM,GAAG,GAAG;EAC3D,MAAM,QAAQ,KAAK,QAAQ,GAAG;EAC9B,IAAI,QAAQ,GACV;EAEF,MAAM,QAAQ,KAAK,MAAM,QAAQ,CAAC,CAAC,CAAC,KAAK;EACzC,IAAI,KAAK;EACT,IAAI,UAAU;EACd,IAAI;GACF,UAAU,mBAAmB,KAAK;EACpC,QAAQ,CAER;EACA,IAAI,OAAO;EACX,MAAM,MAAM,QAAQ,YAAY,GAAG;EACnC,IAAI,MAAM,GACR,IAAI,QAAQ,MAAM,GAAG,GAAG,CAAC;CAE7B;CACA,MAAM,gBAAgB,QAAQ,IAAI,eAAe;CACjD,IAAI,aAAa;CACjB,IAAI,eAAe,KAAK,iBAAiB,EAAE,CAAC,GAAG,EAAE;CACjD,KAAK,MAAM,QAAQ,mBACjB,IAAI,SAAS,YAAY,SAAS,iBAChC,IAAI,QAAQ,IAAI,IAAI,CAAC;CAGzB,OAAO,CAAC,GAAG,KAAK;AAClB;;AAGA,eAAe,aACb,MACA,SACsD;CAItD,MAAM,QAAO,MAHU,KAAK,SAAA,CAGP,YAAY,aAAa;CAC9C,MAAM,QAAQ,mBAAmB,YAAY,QAAQ,IAAI,QAAQ,GAAG,IAAI,CAAC;CACzE,MAAM,MAAM,MAAM,YAAY,GAAG;CACjC,OAAO,MAAM,IAAI;EAAE;EAAM,OAAO,MAAM,MAAM,GAAG,GAAG;CAAE,IAAI,KAAA;AAC1D;;AAGA,SAAS,eAAe,OAAgB,QAAQ,GAAY;CAC1D,IAAI,EAAE,iBAAiB,UAAU,QAAQ,GACvC,OAAO;CAET,MAAM,SAAkC;EACtC,GAAG,OAAO,YAAY,OAAO,QAAQ,KAAK,CAAC;EAC3C,MAAM,MAAM;EACZ,SAAS,MAAM;EACf,OAAO,MAAM;CACf;CACA,IAAI,MAAM,UAAU,KAAA,GAClB,OAAO,QAAQ,eAAe,MAAM,OAAO,QAAQ,CAAC;CAEtD,OAAO;AACT;;AAGA,SAAS,cAAc,OAAsB;CAC3C,MAAM,SAAmB,CAAC;CAC1B,MAAM,SAAS,QAAQ,OAAO;CAC9B,MAAM,SAAS,QAAQ,OAAO;CAC9B,MAAM,UAAU,UAAmB;EACjC,OAAO,KAAK,OAAO,KAAK,CAAC;EACzB,OAAO;CACT;CACA,QAAQ,OAAO,QAAQ;CACvB,QAAQ,OAAO,QAAQ;CACvB,IAAI;EACF,MAAM,OAAO,IAAI,cAAc,mBAAmB,EAAE,QAAQ,MAAM,CAAC;EACnE,KAAK,MAAM,KAAK;EAChB,KAAK,MAAM,MAAM,SAAS,MAAM,KAAK;EACrC,IAAI,cAAc,mBAAmB,EAAE,MAAM,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK;CAClE,UAAU;EACR,QAAQ,OAAO,QAAQ;EACvB,QAAQ,OAAO,QAAQ;CACzB;CACA,OAAO,OAAO,KAAK,EAAE;AACvB;AAEA,MAAM,cAAc;AAapB,SAAS,iBAAiB,OAAgC;CACxD,IACM,4BADN,MACM,0BAA0B;EAEgB;EAD9C,YACE,SACA;GAD4C,KAAA,UAAA;EAC3C;EAEH,YACY;GACV,OAAO,EAAE,IAAI,KAAK;EACpB;EAEA,SACS;GACP,OAAO,KAAK,cAAc;EAC5B;EAEA,kBAEkB;GAChB,OAAO,KAAK,cAAc;EAC5B;EAEA,MAEM,eAAe,MAAiC;GACpD,MAAM,KAAK,YAAY,KAAK,KAAK;GACjC,OAAO,EAAE,IAAI,KAAK;EACpB;EAEA,MAEM,iBAAiB,MAAiC;GACtD,MAAM,KAAK,QAAQ,4BACjB,KAAK,YAAY,KAAK,KAAK,CAC7B;GACA,OAAO,EAAE,IAAI,KAAK;EACpB;EAEA,MACM,kBAAkB,MAAiC;GACvD,IAAI;IACF,MAAM,KAAK,QAAQ,4BACjB,KAAK,YAAY,KAAK,KAAK,CAC7B;IACA,OAAO,EAAE,MAAM,KAAK;GACtB,SAAS,OAAO;IACd,OAAO,EAAE,MAAO,MAA6B,QAAQ,KAAK;GAC5D;EACF;EAEA,MAEM,QAAQ,SAAyB;GACrC,MACE,KAAK,QAAQ,IAGb,QAAQ,EAAE,SAAS,KAAK,QAAQ,YAAY,OAAO,EAAE,CAAC;GACxD,OAAO,EAAE,IAAI,KAAK;EACpB;EAEA,MAAc,gBAAgB;GAc5B,OAAO,EAAE,QAAO,MAZd,KAAK,QAAQ,IAKb,YAAY,EACZ,MAAM;IACJ,OAAO,GAAG,WAAW,OAAO,WAAW,EAAE;IACzC,UAAU,MAAM,WAAW,OAAO,WAAW;IAC7C,MAAM;GACR,EACF,CAAC,EAAA,CACsB,MAAM;EAC/B;EAEA,YAAoB,OAAe;GACjC,OACE,KAAK,QAAQ,IAGb,WAAW,EACX,SAAS,IAAI,QAAQ,EAAE,eAAe,UAAU,QAAQ,CAAC,EAC3D,CAAC;EACH;CACF;;EAjFG,KAAK,WAAW;;;;;;EAKhB,KAAK,SAAS;;;;;;EAKd,mBAAmB;EACnB,KAAK,mBAAmB;;;;;;EAKxB,mBAAmB;EACnB,KAAK,iBAAiB;EACD,gBAAA,GAAA,KAAK,CAAA;;;;;;EAK1B,mBAAmB;EACnB,KAAK,mBAAmB;EACD,gBAAA,GAAA,KAAK,CAAA;;;;;;EAO5B,KAAK,oBAAoB;EACD,gBAAA,GAAA,KAAK,CAAA;;;;;;EAW7B,mBAAmB;EACnB,KAAK,UAAU;EACD,gBAAA,GAAA,IAAI,CAAA;;;;;;EApDpB,WAAW,WAAW;EAGlB,gBAAA,GAAA,OAAO,iBAAiB,CAAA;;;CAqF7B,YAAY,CAAC,CAAC,yBAAyB;CACvC,iBACE,GAAI,KACN,CAAC,CAAC,yBAAyB;CAC3B,OAAO;AACT;AAEA,eAAe,WACb,SACA,MACA,OACqB;CACrB,MAAM,aAAa,iBAAiB,KAAK;CACzC,MAAM,OAAO,QAAQ;CACrB,MAAM,UAAU,CACd,iBAAiB,QAAQ;EACvB;EACA,YAAY,CAAC,QAAQ,MAAM;EAC3B,SAAS;EACT,WAAW,CAAC,KAAK,QAAQ;EACzB,MAAM,EAAE,OAAO,MAAM;EACrB,YAAY;CACd,CAAU,CACZ;CACA,IAIM,wBAJN,MAIM,sBAAsB,CAAC;CAJ5B,wBAAA,WAAA,CAAA,OAAO;EACN;EACA,aAAa,CAAC,UAAU;CAC1B,CAAC,CAAA,GAAA,qBAAA;CAED,MAAM,MAAM,MAAM,YAAY,OAC5B,uBACA,KAAK,kBAAkB,GACvB;EAAE,QAAQ;EAAO,cAAc;CAAM,CACvC;CACA,IAAI;EACF,MAAM,IAAI,KAAK;EACf,IAAI;EACJ,IAAI,KAAK,QACP,MAAM,MAAM,KAAK,OAAO,GAAG;OACtB;GACL,MAAM,IAAI,OAAO,GAAG,WAAW;GAC/B,MAAM,MAAM,IAAI,OAAO;EACzB;EACA,MAAM,IAAI,QAAQ,SAAS,WAAW,CAAC,CAAC,QAAQ,OAAO,EAAE;EACzD,MAAM,UAAW,MAAM,KAAK;EAC5B,MAAM,SAAS,IAAI,IAAI,QAAQ,WAAA,uBAAuB,CAAC,CAAC;EACxD,OAAO;GACL;GACA;GACA,KAAK,MAAM,SAAS,OAAO,CAAC,GAAG;IAC7B,MAAM,WAAmC,CAAC;IAC1C,QAAQ,SAAS,OAAO,SAAS;KAC/B,SAAS,QAAQ;IACnB,CAAC;IACD,OAAO,QAAQ,GAAG,IAAI,GAAG,YAAY,GAAG,QAAQ;KAC9C,QAAQ;KACR,SAAS;MACP,GAAG;MACH;MACA,gBAAgB;KAClB;KACA,MAAM,KAAK,UAAU,IAAI;IAC3B,CAAC;GACH;GACA,aAAa,IAAI,MAAM;EACzB;CACF,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EACvC,MAAM;CACR;AACF;AAEA,SAAS,KAAK,UAAgD;CAC5D,OAAO,KAAK,MAAM,SAAS,KAAK,SAAS,MAAM,KAAK,IAAI;AAI1D;;AAGA,SAAS,eAAe,UAAuB,OAAyB;CACtE,OAAO,eAAe,SAAS,OAAO,CAAC,CAAC,QAAQ,SAC9C,mBAAmB,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,EAAG,CAAC,CAAC,SAAS,IAAI,MAAM,EAAE,CAClE;AACF;;;;;;;;;AAUA,SAAgB,2BACd,SACmB;CACnB,MAAM,OACJ,IACA,OACA,KACA,SACG,gBAAgB,IAAI,aAAa,YAAY,SAAS,GAAG,GAAG,IAAI;CACrE,MAAM,SAAS,YAAqB,QAAQ,YAAY,MAAM,QAAQ,IAAI;CAC1E,OAAO;EACL,IACE,yBACA,6EACA,OAAO,EAAE,SAAS,aAAa;GAC7B,MAAM,SAAS,MAAM,aACnB,QAAQ,QAAQ,YAAY,QAAQ,GAAG,IAAI,cAAc,CAAC,CAC5D;GACA,OAAO,MACL,OAAO,IACP,MACA,4CAA4C,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,GAC/E;GACA,MAAM,QAAQ,OAAO,KAAK,OAAO,QAAQ,KAAA;GAEzC,IAAI,OAAO,YAAY,YAAY,OAAO,eACxC;GAEF,OAAO,MAAM,OAAO,SAAS,UAAU;GACvC,MAAM,UACJ,OAAO,YAAY,aAAa,MAAM,UAAU,KAAA;GAClD,OAAO,GACL,cAAc,OAAO,GACrB,qCACF;GACA,OAAO,GAAG;IAAC;IAAK;IAAK;GAAG,CAAC,CAAC,SAAS,QAAQ,MAAM,CAAC;EACpD,CACF;EACA,IACE,kBACA,2DACA,OAAO,YAAY;GACjB,MAAM,EAAE,SAAS,UAAU;GAC3B,MAAM,UAAU,MAAM,MAAM,OAAO;GACnC,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,qCAAqB,IAAI,MAAM,4BAA4B;GACjE,MAAM,SAAS,MAAM,aACnB,QAAQ,SAAS,IAAI,cAAc,CAAC,CACtC;GACA,MAAM,eAAe,KAAA;GAErB,IAAI,MAAM,QAAQ,WAAW,SAC3B,OAAO,gBACL,4DACF;GAEF,OAAO,MACL,OAAO,IACP,OACA,6BAA6B,KAAK,UAAU,OAAO,MAAM,OAAO,KAAK,GACvE;GACA,OAAO,GACL,CAAC,cAAc,CAAC,OAAO,MAAM,OAAO,KAAK,GACzC,4CAA4C,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,GAC/E;EACF,CACF;EACA,IACE,sBACA,qFACA,OAAO,YAAY;GACjB,MAAM,EAAE,SAAS,OAAO,WAAW;GACnC,MAAM,OAAO,IAAI,cAAc;GAC/B,MAAM,UAAU,MAAM,MAAM,OAAO;GACnC,MAAM,OAAO,MAAM,SAAS;GAC5B,MAAM,SAAS,MAAM,QAAQ,IAAI,QAAQ,OAAO,GAAG,IAAI;GACvD,OAAO,MAAM,OAAO,SAAS,eAAe;GAC5C,MAAM,WAAW,WACf,OACA,MACA,SACA,OAAO,qBAAqB,CAAC,CAC/B;GACA,KAAK,MAAM,QAAQ,IAAI,IAAI,QAAQ,GACjC,OAAO,MACL,YAAY,KAAK,QAAQ,IAAI,GAC7B,YAAY,UAAU,IAAI,GAC1B,2CAA2C,YAAY,UAAU,IAAI,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,sBAAsB,YAAY,KAAK,QAAQ,IAAI,EAAE,UAAU,MAAM,KAAK,MAAM,CAAC,CAAC,KAAK,IAAI,KAAK,UAAU,EACzM;GAEF,MAAM,OAAO,MAAM,KAAK,MAAM;GAC9B,OAAO,UACL,MACA,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,GACjB,iCAAiC,KAAK,KAAK,IAAI,GACjD;EACF,CACF;EACA,IACE,wBACA,qDACA,OAAO,YAAY;GACjB,MAAM,EAAE,SAAS,UAAU;GAC3B,MAAM,UAAU,MAAM,MAAM,OAAO;GACnC,MAAM,SAAS,MAAM,OAAO;GAC5B,MAAM,UAAU,MAAM,QAAQ;GAC9B,MAAM,SAAS,MAAM,QAAQ,SAAS,IAAI;GAC1C,OAAO,MAAM,OAAO,SAAS,eAAe;GAC5C,OAAO,GACL,CAAC,MAAM,OAAO,MAAM,MAAM,CAAC,CAAC,SAAS,gBAAgB,GACrD,6BACF;GACA,OAAO,GACL,MAAM,QAAQ,MAAM,OAAO,CAAC,CAAC,OAAO,UAAU,MAAM,IAAI,GACxD,oDACF;EACF,CACF;EACA,IACE,kBACA,2DACA,OAAO,EAAE,SAAS,YAAY;GAC5B,MAAM,OAAO,IAAI,cAAc;GAC/B,MAAM,SAAS,MAAM,OAAO;GAC5B,MAAM,SAAS,MAAM,QAAQ,IAAI,QAAQ,GAAG,IAAI;GAChD,OAAO,MAAM,OAAO,SAAS,QAAQ;GACrC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC;GAChC,OAAO,UAAU,MAAM,OAAO,MAAM,MAAM,GAAG,CAAC,CAAC;EACjD,CACF;EACA,IACE,WACA,8DACA,OAAO,YAAY;GACjB,MAAM,EAAE,SAAS,WAAW;GAC5B,MAAM,SAAS,MAAM,QAAQ,MAAM,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC;GACtE,OAAO,MAAM,OAAO,SAAS,eAAe;GAC5C,MAAM,YACJ,OAAO,YAAY,kBAAkB,OAAO,YAAY,KAAA;GAC1D,OAAO,GAAG,SAAS;GACnB,OAAO,GAAI,OAAO,MAA4B,SAAS,UAAU,IAAI,CAAC;GACtE,OAAO,MAAM,UAAU,QAAQ,OAAO,EAAE;GACxC,OAAO,GACL,UAAU,WAAW,QAAQ,OAAO,UAAU,WAAW,QAC3D;EACF,CACF;EACA,IACE,wBACA,mEACA,OAAO,YAAY;GACjB,MAAM,EAAE,SAAS,WAAW;GAC5B,MAAM,UAAU,MAAM,MAAM,OAAO;GACnC,KAAK,MAAM,QAAQ,OAAO,qBAAqB,CAAC,GAC9C,QAAQ,OAAO,IAAI;GAErB,MAAM,SAAS,MAAM,QAAQ,SAAS,IAAI,cAAc,CAAC;GACzD,OAAO,MACL,OAAO,SACP,UACA,wDACF;EACF,CACF;EACA,IACE,oBACA,sFACA,OAAO,YAAY;GACjB,MAAM,EAAE,SAAS,QAAQ,WAAW;GACpC,MAAM,cAAc,YAEhB,OAAO,IAGP,WAAW,EAAE,QAAQ,CAAC;GAC1B,KAAK,MAAM,WAAW,CACpB,MAAM,MAAM,OAAO,GACnB,QAAQ,YAAY,QAAQ,CAC9B,GAAG;IACD,MAAM,UAAU,MAAM,WAAW,IAAI,QAAQ,OAAO,CAAC,CAAC,CAAC,YAC/C,IACR;IACA,MAAM,SAAS,MAAM,QAAQ,IAAI,QAAQ,OAAO,GAAG,IAAI;IACvD,IAAI,OAAO,eACT,OAAO,MACL,OAAO,YAAY,iBACnB,YAAY,MACZ,kDACF;SACK,IAAI,OAAO,YAAY,iBAC5B,OAAO,MACL,SACA,MACA,gEACF;GAEJ;EACF,CACF;EACA,IACE,gBACA,oEACA,OAAO,YAAY;GACjB,MAAM,EAAE,SAAS,WAAW;GAC5B,MAAM,SAAS,MAAM,QAAQ,MAAM,MAAM,OAAO,GAAG,IAAI,cAAc,CAAC;GACtE,OAAO,MAAM,OAAO,SAAS,eAAe;GAC5C,MAAM,YACJ,OAAO,YAAY,kBAAkB,OAAO,YAAY,KAAA;GAC1D,OAAO,MACL,QAAQ,WAAW,UAAU,GAC7B,QAAQ,OAAO,SAAS,GACxB,kDACF;GACA,IAAI,WAAW,YAAY;IACzB,OAAO,MAAM,OAAO,UAAU,WAAW,QAAQ,UAAU;IAC3D,OAAO,MAAM,OAAO,UAAU,WAAW,aAAa,QAAQ;IAC9D,OAAO,MACL,OAAO,UAAU,WAAW,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,CAAC,GAC7D,SACF;GACF;EACF,CACF;EACA,IACE,kBACA,mDACA,OAAO,YAAY;GACjB,MAAM,SAAS,MAAM,QAAQ,QAC3B,MAAM,QAAQ,YAAY,YAAa,QAAQ,IAAI,GACnD,IAAI,cAAc,CACpB;GACA,OAAO,MAAM,OAAO,SAAS,UAAU;GACvC,MAAM,UACJ,OAAO,YAAY,aAAa,OAAO,UAAU,KAAA;GACnD,OAAO,MAAM,SAAS,QAAQ,GAAG;EACnC,GACA,QAAQ,YAAY,cAChB,KAAA,IACA,8CACN;EACA,GAAG,oBAAoB,OAAO;EAC9B,GAAG,YAAY,SAAS,GAAG;EAC3B,IACE,2BACA,oGACA,OAAO,YAAY;GACjB,MAAM,EAAE,SAAS,OAAO,WAAW;GACnC,IAAI,CAAC,OAAO,eACV,OAAO,gBAAgB,kCAAkC;GAE3D,MAAM,UAAU,MAAM,MAAM,OAAO;GACnC,MAAM,SAAS,6BAA6B,WAAW,OAAO,WAAW;GACzE,MAAM,sBAAM,IAAI,KAAK;GACrB,MAAM,WAAW,SACf,SAAS,iBACL;IACE,MAAM;KACJ,IAAI;KACJ,OAAO,GAAG,OAAO;KACjB,eAAe;KACf,MAAM;KACN,WAAW;KACX,WAAW;IACb;IACA,SAAS;KACP,IAAI,GAAG,OAAO;KACd;KACA,OAAO,GAAG,OAAO;KACjB,WAAW,IAAI,KAAK,IAAI,QAAQ,IAAI,IAAS;KAC7C,WAAW;KACX,WAAW;IACb;GACF,IACA,KAAA;GACN,MAAM,QAAQ,MAAM,MAAM;GAE1B,MAAM,QAAQ,MAAM,aAClB,QAAQ,IAAI,QAAQ,OAAO,GAAG,IAAI,cAAc,CAAC,CACnD;GACA,OAAO,GACL,MAAM,MAAM,MAAM,KAAK,CAAC,CAAC,SAAS,cAAc,GAChD,0DACF;GACA,OAAO,MACL,MAAM,IACN,MACA,yCAAyC,OAAO,CAAC,MAAM,MAAM,MAAM,KAAK,GAC1E;GACA,MAAM,QAAQ,MAAM,KAAK,MAAM,QAAQ,KAAA;GACvC,OAAO,MACL,OAAO,SACP,iBACA,kEAAkE,KAAK,UAAU,KAAK,GACxF;GACA,OAAO,MACL,OAAO,YAAY,kBAAkB,MAAM,UAAU,SAAS,MAC9D,QACA,yDACF;GACA,MAAM,gBAAgB,MAAM,aAC1B,QAAQ,IAAI,QAAQ,OAAO,GAAG,IAAI,cAAc,GAAG,EACjD,WAAW,gBACb,CAAC,CACH;GACA,OAAO,MACL,cAAc,IACd,MACA,gCAAgC,OAAO,CAAC,cAAc,MAAM,cAAc,KAAK,GACjF;GACA,MAAM,UAAU,cAAc,KAAK,cAAc,QAAQ,KAAA;GACzD,OAAO,SACL,SAAS,SACT,iBACA,gEACF;GACA,IAAI,SAAS,YAAY,YACvB,OAAO,MAAM,QAAQ,QAAQ,QAAQ,GAAG;EAE5C,CACF;EACA,GAAG,YAAY,OAAO;EACtB,GAAG,eAAe,OAAO;EACzB,GAAG,kBAAkB,OAAO;EAC5B,GAAG,SAAS,OAAO;CACrB;AACF;AAEA,SAAS,kBACP,SACmB;;CAEnB,MAAM,OAAO,mBACX,YACE,SACA,OAAO,UAAU;EACf,MAAM,UAAU,MAAM,QAAQ,YAAY,MAAM,MAAM,IAAI;EAC1D,MAAM,WAAW,CAAC,OAAO;EACzB,MAAM,UAAU,MAAM,aAAa,MAAM,MAAM,OAAO;EACtD,IAAI,MAAM,OAAO,iBAAiB,SAChC,SAAS,KACP,IAAI,QAAQ,EAAE,eAAe,UAAU,QAAQ,QAAQ,CAAC,CAC1D;EAEF,IAAI,WAAW;EAGf,MAAM,QAAQ,CAAC,WAAW,UAAU;EACpC,KAAK,MAAM,WAAW,UAAU;GAC9B,MAAM,UAAU,gBACd,SACA,MAAM,OAAO,qBAAqB,CAAC,CACrC;GACA,MAAM,eAAe;IACnB,MAAM,wBAAQ,IAAI,MAChB,0BAA0B,QAAQ,KAAK,GAAG,GAC5C;IACA,OAAO,OAAO,OAAO,EAAE,QAAQ,QAAQ,KAAK,GAAG,EAAE,CAAC;IAClD,MAAM,wBAAQ,IAAI,MAAM,UAAU,QAAQ,KAAK,GAAG,GAAG;IACrD,OAAO;GACT;GACA,KAAK,MAAM,QAAQ,OAAO;IACxB,MAAM,eAAe;KACnB,IAAI,SAAS,WACX,MAAM,MAAM,eAAe;UAE3B,MAAM,MAAM,QAAQ;IAExB;IACA,OAAO;IACP,MAAM,UAAU,MAAM,aACpB,MAAM,aAAa,IAAI,QAAQ,OAAO,GAAG,IAAI,cAAc,CAAC,CAC9D;IACA,OAAO;IACP,MAAM,SAAS,MAAM,aACnB,MAAM,QAAQ,IAAI,QAAQ,OAAO,GAAG,IAAI,cAAc,CAAC,CACzD;IACA,MAAM,MAAM,eAAe,KAAA;IAC3B,MAAM,MAAM,QAAQ,KAAA;IACpB,IAAI,QAAQ,IACV;IAEF,WAAW;IACX,MAAM,QAAQ,QAAQ;IACtB,OAAO,GACL,sBAAsB,KAAK,GAC3B,KAAK,KAAK,sBAAsB,OAAO,KAAK,GAC9C;IACA,MAAM,OAAO;KACX,cAAc,KAAK;KACnB,KAAK,UAAU,eAAe,KAAK,CAAC;KAEpC,QAAQ,OAAO;MAAE,OAAO;MAAG,YAAY,CAAC;KAAe,CAAC;IAC1D,CAAC,CAAC,KAAK,IAAI;IACX,KAAK,MAAM,UAAU,SACnB,OAAO,GACL,CAAC,KAAK,SAAS,MAAM,GACrB,yCAAyC,KAAK,2BAA2B,eAAe,KAAK,OAAO,MAAM,GAAG,CAAC,EAAE,EAClH;IAEF,MAAM,MAAM,YAAY,KAAK;IAC7B,IAAI,CAAC,gBACH,OAAO,MACL,KACA,KAAA,GACA,2DACF;SACK,IAAI,CAAC,OAAO,MAAM,CAAC,sBAAsB,OAAO,KAAK,GAE1D,OAAO,GACL,eAAe,SACb,IAAI,YAAa,OAAO,OAA6B,SACvD,6DAA6D,OAAO,GAAG,GACzE;GAEJ;EACF;EACA,OAAO,WACH,KAAA,IACA,gBACE,8GACF;CACN,GACA,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,EAAE,CAC3C;CACF,OAAO,CACL,gBACE,mBACA,2GACM,IAAI,KAAK,CACjB,GACA,gBACE,mBACA,sGACM,IAAI,IAAI,CAChB,CACF;AACF;AAEA,SAAS,oBACP,SACmB;CACnB,MAAM,UAAU,EAAE,SAAS,EAAE,cAAc,cAAc,EAAE;CAC3D,OAAO,CACL,gBACE,sBACA,2GACA,YAAY;EACV,MAAM,OAAO,MAAM,UAAU,SAAS,OAAgB;EAEtD,MAAM,kBAAkB,IAAI;EAC5B,MAAM,SAAS,MAAM,aAAa,QAAQ,SAAS,EAAE,KAAK,CAAC,CAAC;EAC5D,IAAI,CAAC,OAAO,IAAI;GACd,MAAM,QAAQ,eAAe,OAAO,KAAK;GACzC,IAAI,MAAM,SAAS,mCAAmC,GACpD;GAEF,IAAI,CAAC,MAAM,QACT,MAAM,OAAO;GAEf,OAAO,gBACL,kEAAkE,MAAM,QAAQ,SAAS,SAAS,kBAAkB,CAAC,CAAC,KAAK,IAAI,EAAE,EACnI;EACF;EACA,MAAM,QAAQ,OAAO;EACrB,IAAI;GACF,OAAO,GACL,CAAC,MAAM,OAAO,UAAU,eACxB,6FACF;GACA,MAAM,OAAO,EAAE,MAAM,SAAS;GAC9B,MAAM,WAAgC,CACpC,CAAC,SAAS,MAAM,QAAQ,YAAY,MAAM,IAAI,CAAC,GAC/C,CAAC,WAAW,QAAQ,YAAY,QAAQ,CAAC,CAC3C;GACA,KAAK,MAAM,CAAC,OAAO,eAAe,UAAU;IAC1C,MAAM,UAAU,IAAI,QAAQ,UAAU;IACtC,QAAQ,IAAI,QAAQ,KAAK,IAAI;IAC7B,MAAM,SAAS,MAAM,aACnB,MAAM,QAAQ,SAAS,IAAI,cAAc,CAAC,CAC5C;IACA,OAAO,MACL,OAAO,IACP,MACA,OAAO,MAAM,+DAA+D,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,GAC/G;GACF;EACF,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF,CACF,GACA,gBACE,sBACA,kFACA,YAAY;EACV,MAAM,OAAO,MAAM,UAAU,SAAS;GACpC,GAAG;GACH,UAAU,EAAE,qBAAqB,KAAK;EACxC,CAAU;EAEV,MAAM,kBAAkB,IAAI;EAC5B,MAAM,SAAS,MAAM,aAAa,QAAQ,SAAS,EAAE,KAAK,CAAC,CAAC;EAC5D,IAAI,CAAC,OAAO,IAAI;GACd,MAAM,QAAQ,eAAe,OAAO,KAAK;GACzC,IAAI,CAAC,MAAM,QACT,MAAM,OAAO;GAEf,OAAO,gBACL,kEAAkE,MAAM,QAAQ,SAAS,SAAS,kBAAkB,CAAC,CAAC,KAAK,IAAI,EAAE,EACnI;EACF;EACA,MAAM,QAAQ,OAAO;EACrB,IAAI;GACF,MAAM,UAAU,IAAI,QAAQ,MAAM,QAAQ,YAAY,MAAM,IAAI,CAAC;GAEjE,QAAQ,IAAI,QAAQ,eAAe;GACnC,QAAQ,IAAI,oBAAoB,WAAW;GAC3C,QAAQ,IAAI,qBAAqB,OAAO;GACxC,MAAM,SAAS,MAAM,aACnB,MAAM,QAAQ,SAAS,IAAI,cAAc,CAAC,CAC5C;GACA,OAAO,MACL,OAAO,IACP,MACA,qDAAqD,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,GACxF;EACF,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF,CACF,CACF;AACF;AAEA,SAAS,YACP,SACA,KAKmB;CACnB,MAAM,cACJ,IACA,OACA,QAEA,IAAI,IAAI,QAAQ,YACd,gBAAgB,QAAQ,MAAM,IAC1B,IAAI,OAAO,IACX,QAAQ,QAAQ,gBAAgB,WAAW,CAAC,CAClD;CACF,OAAO;EACL,WACE,oBACA,mHACA,OAAO,YAAY;GACjB,MAAM,EAAE,SAAS,WAAW;GAC5B,MAAM,UAAU,MAAM,UAAU,SAAS,SAAS;IAChD,kBAAkB;IAClB,cAAc;IACd,qBAAqB;GACvB,CAAC;GACD,OAAO,OACJ,MAAM,QAAQ,IAAI,QAAQ,QAAQ,OAAO,GAAG,IAAI,EAAA,CAAG,SACpD,iBACA,2DACF;GACA,MAAM,YAAY,MAAM,QAAQ,IAAI,QAAQ,QAAQ,OAAO,GAAG,IAAI;GAClE,eAAe,WAAW,KAAK,gBAAgB,oBAAoB;GACnE,MAAM,aAAa,OACjB,UAAU,YAAY,aAClB,UAAU,QAAQ,SAAS,IAAI,aAAa,IAC5C,KAAA,CACN;GACA,OAAO,GACL,cAAc,MAAM,cAAc,IAClC,eAAe,WAAW,iDAC5B;GAEA,eACE,MAAM,SAAQ,MAFQ,UAAU,SAAS,SAAS,EAAE,WAAW,EAAE,CAAC,EAAA,CAE1C,SAAS,IAAI,GACrC,KACA,kBACA,kBACF;GACA,MAAM,WAAW,MAAM,UAAU,SAAS,OAAO;GACjD,MAAM,UAAU,SAAS,SAAS,IAAI,EAAE,SAAS,MAAM,CAAC;GACxD,eACE,MAAM,QAAQ,SAAS,SAAS,IAAI,GACpC,KACA,gBACA,gBACF;GACA,MAAM,UAAU,MAAM,UAAU,SAAS,OAAO;GAChD,MAAM,UAAU,SAAS,QAAQ,IAAI,EACnC,2BAAW,IAAI,KAAK,KAAK,IAAI,IAAI,GAAM,EACzC,CAAC;GACD,eACE,MAAM,QAAQ,QAAQ,SAAS,IAAI,GACnC,KACA,eACA,gBACF;GACA,eACE,MAAM,QAAQ,WAAW,MAAM,GAAG,IAAI,GACtC,KACA,mBACA,gBACF;GACA,MAAM,MAAM,QAAQ,KAAK;GACzB,MAAM,SAAS,IAAI;GACnB,IAAI,gBAAgB;GACpB,IAAI,gBAAgB,UAAU;IAC5B;IACA,OAAO,OAAO,KAAK,KAAK,KAAK;GAC/B;GACA,IAAI;IACF,MAAM,MAAM,MAAM,UAAU,SAAS,OAAO;IAC5C,MAAM,uBAAO,IAAI,IAA+B;IAChD,KAAK,MAAM,aAAa;KACtB;KACA;KACA;IACF,GACE,OAAO,OAEH,MAAM,QAAQ,IAAI,QAAQ,IAAI,OAAO,GAAG,MAAM;KAC5C;KACA;IACF,CAAC,EAAA,CACD,SACF,eACF;GAEJ,UAAU;IACR,IAAI,eAAe;GACrB;GACA,OAAO,MACL,eACA,GACA,gCAAgC,cAAc,OAChD;EACF,CACF;EACA,WACE,mBACA,yDACA,OAAO,EAAE,SAAS,OAAO,aAAa;GACpC,MAAM,OAAO,MAAM,QAAQ;GAC3B,MAAM,UAAU,MAAM,QAAQ,IAC5B,MAAM,KAAK,EAAE,QAAQ,GAAG,SAAS,QAAQ,WAAW,MAAM,GAAG,IAAI,CAAC,CACpE;GACA,KAAK,MAAM,UAAU,SACnB,eAAe,QAAQ,KAAK,mBAAmB,gBAAgB;GAEjE,MAAM,SAAS,MAAM,QAClB,MAAM,IAAI,CAAC,CACX,QAAQ,UAAU,OAAO,IAAI,MAAM,MAAM,KAAK,CAAC,CAAC,CAAC,EAAG,CAAC;GACxD,OAAO,GACL,OAAO,UAAU,GACjB,oCAAoC,OAAO,OAAO,UAAU,OAAO,KAAK,IAAI,EAAE,iDAChF;EACF,CACF;EACA,WACE,mBACA,yEACA,OAAO,YAAY;GACjB,MAAM,EAAE,SAAS,OAAO,WAAW;GACnC,MAAM,MAAM,MAAM,UAAU,SAAS,OAAO;GAC5C,MAAM,gBAAgB,SACpB,KAAK,WAAW,4BACZ,IAAI,MAAM,yBAAyB,IACnC,KAAA;GACN,MAAM,2BACE,QAAQ,WAAW,MAAM,GAAG,IAAI,GACtC,qCACF;GACA,MAAM,2BACE,QAAQ,IAAI,QAAQ,IAAI,OAAO,GAAG,IAAI,GAC5C,kCACF;EACF,CACF;EACA,WACE,mBACA,6FACA,OAAO,YAAY;GACjB,MAAM,EAAE,SAAS,OAAO,WAAW;GACnC,MAAM,MAAM,MAAM,UAAU,SAAS,OAAO;GAC5C,MAAM,SAAS,SACb,KAAK,WAAW,YAAY,KAAK,UAAU;GAC7C,MAAM,gBAAgB,SAAU,MAAM,IAAI,IAAI,WAAW,KAAA;GACzD,MAAM,gBAAgB,SACpB,MAAM,IAAI,oBAAI,IAAI,MAAM,4BAA4B,IAAI,KAAA;GAC1D,MAAM,2BACE,QAAQ,IAAI,QAAQ,IAAI,OAAO,GAAG,IAAI,GAC5C,mDACF;GACA,MAAM,UAAU,YAAY,IAAI;GAChC,MAAM,UAAU,MAAM,QAAQ,WAAW,MAAM,GAAG,IAAI;GACtD,MAAM,UAAU,YAAY,IAAI,IAAI;GACpC,eAAe,SAAS,KAAK,mBAAmB,gBAAgB;GAChE,OAAO,GACL,UAAU,UACV,uBAAuB,KAAK,MAAM,OAAO,EAAE,uCAC7C;EACF,CACF;EACA,WACE,yBACA,mFACA,OAAO,YAAY;GACjB,MAAM,EAAE,SAAS,UAAU;GAC3B,MAAM,MAAM,MAAM,UAAU,SAAS,OAAO;GAC5C,MAAM,gBAAgB,SACpB,OAAO,IAAI,KAAK,MAAM,oBAAI,IAAI,MAAM,SAAS,IAAI,KAAA;GACnD,MAAM,2BACE,QAAQ,IAAI,QAAQ,IAAI,OAAO,GAAG,IAAI,GAC5C,mCACF;EACF,CACF;EACA,WACE,yBACA,+CACA,OAAO,YAAY;GACjB,MAAM,EAAE,SAAS,WAAW;GAC5B,MAAM,UAAU,SAAS,OAAO;GAChC,MAAM,UAAW,MAAM,QAAQ,KAAK;GAGpC,MAAM,SAAS,KAAK,UAClB,MAAM,QAAQ,QAAQ,SAAS,EAAE,OAAO,SAAS,CAAC,CACpD;GACA,eACE,MAAM,QAAQ,WAAW,MAAM,GAAG,IAAI,GACtC,KACA,mBACA,gBACF;GACA,OAAO,MACL,KAAK,UAAU,MAAM,QAAQ,QAAQ,SAAS,EAAE,OAAO,SAAS,CAAC,CAAC,GAClE,QACA,qCACF;EACF,CACF;EACA,gBACE,oBACA,wFACA,YAAY;GACV,IAAI;GACJ,MAAM,UAAU,MAAM,YAAY,SAAS,OAAO,YAAY;IAC5D,IAAI,CAAC,gBAAgB,QAAQ,MAAM,GACjC,OAAO,gBAAgB,WAAW;IAEpC,IAAI,CAAE,MAAM,QAAQ,OAAO,UAAU,OAAO,GAC1C,OAAO,gBAAgB,oCAAoC;IAE7D,MAAM,SAAS,MAAM,QAAQ,QAC3B,MAAM,QAAQ,YAAY,gBAAiB,QAAQ,IAAI,GACvD,IACF;IACA,OAAO,MACL,OAAO,SACP,iBACA,iCAAiC,KAAK,UAAU,MAAM,GACxD;IACA,YACE,OAAO,YAAY,kBAAkB,OAAO,YAAY,KAAA;IAC1D,MAAM,MAAM;IAGZ,OAAO,MACL,KAAK,QACL,MACA,qDACF;IACA,OAAO,GACL,OAAO,KAAK,mBAAmB,YAC7B,IAAI,eAAe,SAAS,GAC9B,qDACF;GACF,CAAC;GACD,IAAI,WAAW,OAAO,QAAQ,YAAY,UACxC,OAAO;GAIT,MAAM,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE;GAGrC,MAAM,UAAU,MAAM,eACpB,QAAQ,MACR,WAAW,aAAa,EAAE,YAAY,CAAC,WAAW,SAAS,EAAE,CAAC,GAC9D,SACF;GACA,OAAO,MAAM,QAAQ,SAAS,QAAQ,MAAM;GAC5C,OAAO,MACJ,QAAQ,SAAiC,QAC1C,iBACA,KAAK,UAAU,QAAQ,QAAQ,CACjC;GACA,OAAO,MACJ,QAAQ,SAAiC,UAAU,KACpD,GACF;GACA,MAAM,QAAQ,MAAM,eAClB,QAAQ,MACR,WAAW,WAAW,GACtB,SACF;GACA,OAAO,MAAM,MAAM,SAAS,QAAQ,MAAM;GAC1C,OAAO,MACJ,MAAM,SAAiC,QACxC,2BACA,KAAK,UAAU,MAAM,QAAQ,CAC/B;GACA,OAAO,MACL,MAAM,aACN,GACA,kEACF;EACF,GACA,QAAQ,YAAY,kBAChB,KAAA,IACA,kDACN;CACF;AACF;AAEA,SAAS,YACP,SACmB;CACnB,MAAM,OAAO,QAAQ,OAAO,KAAA,IAAY;;CAExC,MAAM,aAAa,OACjB,OACgC;EAChC,MAAM,YAAY,MAAM,QAAQ,OAAO;EACvC,MAAM,EAAE,WAAW;EACnB,IAAI;EACJ,IAAI;GACF,aAAa,MAAM,QAAQ,YAAY,MAAM,QAAQ,IAAI;EAC3D,UAAU;GACR,MAAM,UAAU,MAAM;EACxB;EACA,IAAI,CAAC,OAAO,eACV,OAAO,gBAAgB,kCAAkC;EAE3D,IAAI,CAAE,MAAM,aAAa,QAAQ,MAAM,UAAU,GAC/C,OAAO,gBACL,gEACF;EAEF,MAAM,OAAO,MAAM,WAAW,SAAS,QAAQ,MAAO,OAAO,KAAK;EAClE,IAAI;GACF,MAAM,GAAG,YAAY,QAAQ,YAAY,MAAM,QAAQ,IAAI,CAAC;EAC9D,UAAU;GACR,MAAM,KAAK,MAAM;EACnB;CACF;CACA,OAAO,CACL,gBACE,+BACA,6GAEE,WAAW,OAAO,MAAM,WAAW;EACjC,MAAM,UAAU,MAAM,OAAO;EAC7B,MAAM,MAAO,MAAM,aAAa,QAAQ,MAAM,OAAO;EACrD,MAAM,QAAQ,MAAM,KAAK,KAAK,WAAW,OAAO;EAChD,OAAO,MAAM,MAAM,QAAQ,KAAK,MAAM,KAAK,SAAS,MAAM,CAAC;EAC3D,MAAM,QAAQ,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK;EACtC,OAAO,UACL,eAAe,OAAO,KAAK,GAC3B,CAAC,GACD,oFACF;EACA,KAAK,MAAM,QAAQ,eAAe,MAAM,OAAO,GAC7C,IAAI,KAAK,WAAW,GAAG,IAAI,KAAK,EAAE,GAChC,OAAO,GACL,mBAAmB,IAAI,CAAC,CAAC,WACvB,GAAG,IAAI,KAAK,GAAG,IAAI,MAAM,EAC3B,GACA,0CACF;EAGJ,MAAM,YAAY,MAAM,KAAK,KAC3B,qBACA,MAAM,OAAO,CACf;EACA,OAAO,MAAM,UAAU,QAAQ,KAAK,UAAU,KAAK,SAAS,MAAM,CAAC;EACnE,MAAM,iBAAiB,OAAO,KAAK,SAAS,CAAC,CAAC,KAAK;EACnD,OAAO,MACL,eAAe,WAAW,cAAc,CAAC,CAAC,QAC1C,GACA,2EACF;CACF,CAAC,GACH,IACF,GACA,gBACE,gCACA,6GAEE,WAAW,OAAO,MAAM,WAAW;EACjC,MAAM,UAAU,MAAM,YAAY,QAAQ,IAAI;EAC9C,MAAM,UAAU,MAAM,KAAK,KAAK,mBAAmB,MAAM,OAAO,GAAG,EACjE,OAAO,QAAQ,MACjB,CAAC;EACD,OAAO,MAAM,QAAQ,QAAQ,KAAK,QAAQ,KAAK,SAAS,MAAM,CAAC;EAC/D,OAAO,UACL,eAAe,SAAS,QAAQ,KAAK,GACrC,CAAC,GACD,8EACF;EACA,MAAM,UAAU,MAAM,OAAO;EAC7B,MAAM,MAAO,MAAM,aAAa,QAAQ,MAAM,OAAO;EACrD,MAAM,UAAU,MAAM,KAAK,KAAK,YAAY,OAAO;EACnD,OAAO,MAAM,QAAQ,QAAQ,KAAK,QAAQ,KAAK,SAAS,MAAM,CAAC;EAC/D,OAAO,GACL,eAAe,QAAQ,OAAO,CAAC,CAAC,MAC7B,SACC,KAAK,WAAW,GAAG,IAAI,KAAK,EAAE,MAC7B,KAAK,WAAW,GAAG,IAAI,KAAK,GAAG,KAAK,aAAa,KAAK,IAAI,EAC/D,GACA,kEAAkE,eAAe,QAAQ,OAAO,CAAC,CAAC,KAAK,KAAK,GAC9G;EACA,MAAM,WAAW,MAAM,KAAK,KAC1B,qBACA,MAAM,OAAO,GACb,EACE,OAAO,QAAQ,MACjB,CACF;EACA,OAAO,MAAM,SAAS,QAAQ,KAAK,SAAS,KAAK,SAAS,MAAM,CAAC;EACjE,OAAO,MACL,eAAe,UAAU,QAAQ,KAAK,CAAC,CAAC,QACxC,GACA,4FACF;EACA,MAAM,aAAa,MAAM,KAAK,KAC5B,sBACA,MAAM,OAAO,GACb,EAAE,OAAO,QAAQ,MAAM,CACzB;EACA,OAAO,MACL,KAAK,UAAU,CAAC,CAAC,MACjB,2BACA,0DACF;EACA,OAAO,UAAU,eAAe,YAAY,QAAQ,KAAK,GAAG,CAAC,CAAC;CAChE,CAAC,GACH,IACF,CACF;AACF;;AAGA,MAAM,cAAc;;AAGpB,SAAS,eACP,SACmB;CACnB,MAAM,OAAO,QAAQ,OAAO,KAAA,IAAY;CACxC,MAAM,YAAY,OAChB,OAKgC;EAChC,MAAM,YAAY,MAAM,QAAQ,OAAO;EACvC,MAAM,EAAE,QAAQ,UAAU;EAC1B,MAAM,UAAU,MAAM;EACtB,MAAM,OAAO,MAAM,WAAW,SAAS,QAAQ,MAAO,OAAO,KAAK;EAClE,IAAI;GACF,OAAO,MAAM,GAAG,MAAM,QAAQ,KAAK;EACrC,UAAU;GACR,MAAM,eAAe,KAAA;GACrB,MAAM,iBAAiB,KAAA;GACvB,MAAM,KAAK,MAAM;EACnB;CACF;CACA,OAAO,CACL,gBACE,kBACA,+EAEE,UAAU,OAAO,MAAM,SAAS,UAAU;EACxC,MAAM,UAAU,MAAM,QAAQ,YAAY,MAAM,QAAQ,IAAI;EAC5D,MAAM,UAAU,MAAM,QAAQ;EAC9B,MAAM,qCAAqB,IAAI,MAAM,4BAA4B;EACjE,MAAM,WAAW,MAAM,KAAK,KAAK,aAAa,OAAO;EACrD,MAAM,eAAe,KAAA;EAErB,IAAI,MAAM,QAAQ,WAAW,SAC3B,OAAO,gBACL,4DACF;EAEF,OAAO,GACL,SAAS,UAAU,OAAO,SAAS,SAAS,KAC5C,4BAA4B,SAAS,OAAO,wCAAwC,SAAS,KAAK,SAAS,MAAM,GACnH;CACF,CAAC,GACH,IACF,GACA,gBACE,sBACA,mKAEE,UAAU,OAAO,MAAM,QAAQ,UAAU;EACvC,MAAM,UAAU,MAAM,QAAQ,YAAY,MAAM,QAAQ,IAAI;EAC5D,MAAM,OAAO,MAAM,SAAS;EAC5B,MAAM,QAAQ,MAAM,MAAM;EAC1B,MAAM,uBAAuB,CAAC,aAAa,QAAQ;EACnD,MAAM,WAAW,MAAM,KAAK,KAAK,aAAa,OAAO;EACrD,MAAM,iBAAiB,KAAA;EACvB,OAAO,MACL,SAAS,QACT,KACA,8BAA8B,SAAS,OAAO,IAAI,SAAS,KAAK,SAAS,MAAM,GACjF;EACA,MAAM,WAAW,WACf,OACA,MACA,SACA,OAAO,qBAAqB,CAAC,CAC/B;EACA,MAAM,YAAY,eAAe,SAAS,OAAO;EACjD,KAAK,MAAM,QAAQ,IAAI,IAAI,QAAQ,GACjC,OAAO,MACL,YAAY,WAAW,IAAI,GAC3B,GACA,2CAA2C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,2BAA2B,YAAY,WAAW,IAAI,EAAE,oBAAoB,MAAM,SAAS,CAAC,CAAC,KAAK,IAAI,KAAK,UAAU,EACnL;EAEF,KAAK,MAAM,QAAQ,WACjB,OAAO,GACL,SAAS,SAAS,IAAI,GACtB,uBAAuB,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,2DAC1C;EAEF,IAAI,MAAM,MAAM,SAAS,OACvB,OAAO,MACL,SAAS,QAAQ,cACjB,KAAA,GACA,2FACF;CAEJ,CAAC,GACH,IACF,CACF;AACF;AAWA,SAAS,SACP,SACmB;CACnB,MAAM,UAAU;CAChB,MAAM,WACJ,OACA,QAKA,gBAAgB,gBAAgB,aAC9B,YAAY,SAAS,OAAO,YAAY;EACtC,IAAI,EAAE,QAAQ,OAAO,UAAU,WAAW,CAAC,EAAA,CAAG,SAAS,KAAK,GAC1D,OAAO,gBAAgB,OAAO;EAEhC,MAAM,MAAM,QAAQ,KAAK;EACzB,OAAO,IAAI,UAAU,UAAU,IAAI,QAAQ,KAAK,CAAC;CACnD,CAAC,CACH;CACF,MAAM,UAAU,UACd,IAAI,QAAQ,EAAE,eAAe,UAAU,QAAQ,CAAC;CAClD,OAAO,CACL,QACE,oGACA,OAAO,EAAE,WAAW,SAAS;EAC3B,MAAM,UAAU,eAAe,WAAW,OAAO,WAAW;EAC5D,MAAM,EAAE,UAAU,MAAM,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,QAAQ,EAAE,EAAE,CAAC;EACpE,MAAM,WAAW,MAAM,QAAQ,OAAO,KAAK,GAAG,IAAI;EAClD,OAAO,MACL,SAAS,SACT,iBACA,+EAA+E,KAAK,UAAU,QAAQ,GACxG;EACA,MAAM,UAAU,MAAM,KAAK,EACzB,MAAM;GACJ,SAAS,EAAE,KAAK,QAAQ;GACxB,iBAAiB,EACf,KAAK,EAAE,QAAQ,6CAA6C,EAC9D;EACF,EACF,CAAC;EACD,MAAM,SAAS,MAAM,aAAa,QAAQ,OAAO,QAAQ,KAAK,GAAG,IAAI,CAAC;EACtE,OAAO,MACL,OAAO,IACP,MACA,iCAAiC,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,GACpE;EACA,eACE,OAAO,KAAK,OAAO,QAAQ,EAAE,SAAS,SAAS,GAC/C,KACA,eACA,wBACF;CACF,CACF,GACA,QACE,4DACA,OAAO,EAAE,SAAS,SAAS,SAAS;EAClC,MAAM,EAAE,UAAU,MAAM,KAAK,EAC3B,MAAM,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,EAC1C,CAAC;EACD,MAAM,OAAO,MAAM,QAAQ;EAC3B,MAAM,gBAAgB,SACpB,KAAK,UAAU,yBACX,IAAI,MAAM,4BAA4B,IACtC,KAAA;EACN,MAAM,SAAS,MAAM,aAAa,QAAQ,OAAO,KAAK,GAAG,IAAI,CAAC;EAC9D,MAAM,eAAe,KAAA;EACrB,IACE,CAAC,MAAM,QAAQ,MAAM,IAAI,CAAC,CAAC,MAAM,UAAU,MAAM,SAAS,OAAO,CAAC,GAElE,OAAO,gBACL,qGACF;EAEF,OAAO,MACL,OAAO,IACP,OACA,6BAA6B,KAAK,UAAU,OAAO,MAAM,OAAO,KAAK,GACvE;EACA,OAAO,GACL,CAAC,cAAc,CAAC,OAAO,MAAM,OAAO,KAAK,GACzC,4CAA4C,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,GAC/E;CACF,CACF,CACF;AACF;;;ACjhDA,MAAM,gBAAgB;;AAEtB,MAAM,0BAA0B;AAChC,MAAM,+BAAe,IAAI,IAAI,CAAC,SAAS,QAAQ,CAAC;AAChD,MAAM,eAAe;AACrB,MAAM,eAAe;AAYrB,SAAS,UAAU,MAAmD;CACpE,OAAO;EACL,IAAI;EACJ,OAAO,CAAC,YAAY;EACpB,YAAY;EACZ,WAAW;EACX,mBAAmB,CAAC,WAAW;EAC/B,YAAY,YAAY,QAAQ,QAAQ,IAAI,WAAW;EACvD,MAAM,QAAQ,SAAS;GACrB,MAAM,QAAQ,QAAQ,QAAQ,IAAI,WAAW;GAC7C,IAAI,CAAC,OACH,OAAO,OAAO;GAEhB,KAAK;GACL,IAAI,KAAK,SACP,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,KAAK,OAAO,CAAC;GAElE,IAAI,UAAU,KAAK,SACjB,OAAO,SACL,aAAa,SAAS;IACpB,QAAQ;IACR,QAAQ;IACR,mBAAmB;GACrB,CAAC,CACH;GAEF,IAAI,UAAU,KAAK,OACjB,OAAO,SACL,aAAa,SAAS;IAAE,QAAQ;IAAK,QAAQ;GAAkB,CAAC,CAClE;GAEF,OAAO,cAAc;IACnB,MAAM;IACN,QAAQ;IACR,QAAQ,KAAK;IACb,YAAY;KACV,aAAa;KACb,cAAc;IAChB;GACF,CAAC;EACH;CACF;AACF;AAEA,MAAM,aAAyD;CAC7D,IAAI;CACJ,gBAAgB,KAAK,EAAE,QAAQ,qBAAqB,CAAC;AACvD;;;;;AAKA,MAAM,uBAAuB,cAC3B,EAAE,cAAc,CAAC,QAAQ,EAAE,GAC3B,EAAE,cAAc,UAAU,OAAO,EAAE,CACrC;AAGA,MAAM,YAAwD;CAC5D,IAAI;CACJ,UAAU,EAAE,YAAY,CAAC,YAAY,EAAE;CACvC,MAAM,SAAS,SAAS,SAAS;EAC/B,MAAM,eAAe,QAAQ,MAAM,OAAO;EAC1C,IAAI,OAAO,iBAAiB,YAAY,CAAC,cACvC,OAAO,KAAK,EAAE,QAAQ,wBAAwB,CAAC;EAEjD,IAAI,CAAC,aAAa,IAAI,YAAY,GAChC,OAAO,KAAK,EAAE,QAAQ,qBAAqB,CAAC;EAE9C,QAAQ,QAAQ,wBAAwB,YAAY;EACpD,OAAO,MAAM;CACf;AACF;AACA,MAAM,eACJ,IACA,gBACgD;CAChD,IAAI,uCAAuC;CAC3C,GAAI,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,IAAI,CAAC;CACjD,gBAAgB,MAAM;AACxB;AACA,MAAM,cAAc,YAClB,YAAY,gBAAgB,CAAC,YAAY,CAAC,GAC1C,CAAC,CACH;AACA,MAAM,aAAa,YAAY,YAAY,gBAAgB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;AAC9E,MAAM,eAAe,YACnB,YAAY,kBAAkB,CAAC,cAAc,YAAY,CAAC,GAC1D,CAAC,CACH;AACA,MAAM,eAAe,YAAY,YAAY,iBAAiB,KAAA,CAAS,GAAG,CAAC,CAAC;AAE5E,SAAS,KAAK,WAA6B;CACzC,MAAM,QAAQ;CACd,OAAO,QAAQ;EAAE,MAAM,MAAM;EAAM,QAAQ,MAAM;CAAO,IAAI;AAC9D;AAEA,SAAS,QACP,YACA,QACA,WACA,QACgB;CAChB,OAAO;EAAE;EAAY;EAAQ;EAAW;CAAO;AACjD;AAEA,eAAe,OACb,SACA,OACe;CACf,MACE,QAAQ,IAKR,YAAY,EACZ,MAAM;EAAE,OAAO,OAAO,MAAM,KAAK;EAAG,UAAU,OAAO,MAAM,QAAQ;CAAE,EACvE,CAAC;AACH;AAEA,SAAS,iBACP,aAAyC,CAAC,GAC1C,YAA+B,QACf;CAChB,OAAO,QACL,YACA,CAAC,iBAAiB,CAAC,GACnB,YACC,CAAC,gBAAgB,EAChB,WAAW,KAAK,SAAS,EAC3B,EACF;AACF;;AAGA,MAAM,mBAAmB;;AAkBzB,MAAM,aAAa;;AAGnB,MAAM,eAAe,SAAiB,SAAS;;;;;;AAO/C,SAAS,YACP,QAAyD,CAAC,GAC1D,eAAkC,CAAC,GACnC,QAAmB,CAAC,GACD;CACnB,MAAM,aACJ,MACA,SACA,SAAiB,UACV;EACP,GAAG;EACH,YAAY;GACV,YAAY,kBAAkB,MAAM;GACpC,GAAG,QAAQ;GACX,GAAI,MAAM,SAAS,CAAC;GACpB,GAAG;EACL;CACF;CACA,MAAM,cAAc,QAAQ,CAAC,GAAG,CAAC,GAAG,eAAe,EAAE,IAAI,KAAK,EAAE;CAChE,MAAM,UAAU,MAAc,aAA6C;EACzE,GAAG;EACH,YAAY,CACV,YAAY,kBAAkB,YAAY,IAAI,CAAC,GAC/C,GAAG,QAAQ,UACb;CACF;CACA,MAAM,eACJ,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC,gBAAgB,EAC1D,WAAW,KAAK,SAAS,EAC3B,EAAE;CAEJ,MAAM,iBAAiB,eACrB,QAAQ,YAAY,CAAC,GAAG,QAAQ,OAAO,SAAS,OAAO,EAAE,cAAc;EAQrE,OAAO,EAAE,SAAQ,MANf,QAAQ,IAGR,WAAW,EACX,SAAS,IAAI,QAAQ,EAAE,QAAQ,OAAO,MAAM,UAAU,EAAE,EAAE,CAAC,EAC7D,CAAC,EAAA,EACyB,MAAM,MAAM,KAAK;CAC7C,CAAC;CACH,MAAM,aAAa,MAAM;CACzB,MAAM,cAAc,cAClB,QACE,CAAC,OAAO,GAAG,mBAAmB,CAAC,GAC/B,CAAC,GACD,WACA,OAAO,SAAS,OAAO,EAAE,cAAc;EACrC,MAAM,OAAO,SAAS,KAAK;EAC3B,OAAO,EAAE,UAAU,KAAK;CAC1B,CACF;CACF,OAAO;EACL,UAAU,UAAU,YAAY,iBAAiB,CAAC;EAClD,UAAU,UAAU,YAAY,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC;EAClE,QAAQ,UACN,UACA,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,eAAe,EAAE,QAAQ,KAAK,EAAE,CAC1D;EACA,WAAW,UACT,aACA,QAAQ,CAAC,QAAQ,YAAY,YAAY,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,eAAe,EACjE,SAAS,KACX,EAAE,CACJ;EACA,QAAQ;GACN,UAAU,UAAU,MAAM,GAAG,SAAS;GACtC,UAAU,UAAU,MAAM,GAAG,SAAS;GACtC,UAAU,UAAU,MAAM,GAAG,SAAS;EACxC;EACA,aAAa;GACX,UAAU,eAAe,MAAM,GAAG,cAAc;GAChD,UACE,eACA,QACE,CAAC,iBAAiB,cAAc,YAAY,CAAC,GAC7C,CAAC,GACD,eACO,EACL,IAAI,KACN,EACF,GACA,cACF;GACA,UAAU,eAAe,MAAM,GAAG,cAAc;EAClD;EACA,cAAc,UACZ,gBACA,QACE,CAAC,GACD,CAAC,eAAe,CAAC,GACjB,QACA,OAAO,CAAC,UAAU,QAAQ,EAAE,eAAe;GACzC,QACG,SAA+C,MAAM,MAAM;GAC9D,UAAU,MAAM,QAAQ,aAAa,EAAA,EAAI,UAAU;EACrD,EACF,CACF;EACA,qBAAqB,UACnB,uBACA,QACE,CAAC,iBAAiB,cAAc,YAAY,CAAC,GAC7C,CAAC,GACD,QACA,OAAO,SAAS,QAAQ,EAAE,eAAe,EACvC,SAEK,MAAM,QAAQ,WAAW,EAAA,EAGzB,MAAM,MAAM,KACnB,EACF,CACF;EACA,QAAQ,UAAU,UAAU,iBAAiB,CAAC,GAAG,QAAQ,CAAC;EAC1D,YAAY,UAAU,cAAc,WAAW,QAAQ,CAAC;EACxD,gBAAgB,UAAU,kBAAkB,WAAW,MAAM,CAAC;EAC9D,mBAAmB,UACjB,qBACA,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,OAAO,SAAS,OAAO,EAAE,cAAc;GACvE,MAAM,QAAQ,4BAA4B,OAAO,SAAS,KAAK,CAAC;GAChE,OAAO,EAAE,UAAU,KAAK;EAC1B,CAAC,CACH;EACA,eAAe,UACb,iBACA,QACE,CAAC,OAAO,CAAC,GACT,CAAC,GACD,UACA,OAAO,SAAS,QAAQ,EAAE,eAAe,EACvC,SAAS,MAAM,QAAQ,WAAW,EACpC,EACF,CACF;EACA,eAAe,UACb,iBACA,iBAAiB,CAAC,iBAAiB,cAAc,YAAY,CAAC,CAAC,CACjE;EACA,KAAK,UACH,OACA,QACE,CAAC,QAAQ,oBAAoB,CAAC,GAC9B,CAAC,qBAAqB,CAAC,GACvB,SACC,CAAC,eAAe,UAAU;GACzB,IAAI,iBAAiB,MAAM,OACzB,MAAM,IAAI,MACR,iCAAiC,OAAO,YAAY,EAAE,OAAO,OAAO,MAAM,KAAK,GACjF;GAEF,OAAO,EAAE,aAAa;EACxB,CACF,CACF;EACA,WAAW,UAAU,aAAa;GAChC,GAAG,MAAM;GACT,YAAY;IACV,QAAQ,CAAC,OAAO,CAAC;IACjB,QAAQ,CAAC,QAAQ,YAAY,YAAY,CAAC,CAAC,CAAC,CAAC;GAC/C;EACF,CAAC;EACD,eAAe,UAAU,iBAAiB,cAAc,CAAC,CAAC,CAAC;EAC3D,qBAAqB,UACnB,uBACA,cAAc,CAAC,OAAO,CAAC,CAAC,CAC1B;EACA,WAAW,UACT,aACA,QAAQ,CAAC,GAAG,CAAC,eAAe,GAAG,qBAAqB,CAAC,GAAG,eAAe,EACrE,SAAS,KACX,EAAE,CACJ;EACA,OAAO;GACL,OAAO;IACL,QAAQ,OACN,UACA,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,eAAe,EAAE,IAAI,SAAS,EAAE,CAC1D;IACA,aAAa,OACX,eACA,QAAQ,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,SAAS,CAAC,QAAQ;KAClD,IAAI;KACJ,WAAW,KAAK,CAAC;IACnB,EAAE,CACJ;IACA,OAAO,OACL,SACA,QACE,CAAC,iBAAiB,cAAc,YAAY,CAAC,GAC7C,CAAC,iBAAiB,CAAC,GACnB,SACC,CAAC,QAAQ;KAAE,IAAI;KAAS,WAAW,KAAK,CAAC;IAAE,EAC9C,CACF;IACA,GAAI,MAAM,eACN,EACE,OAAO,OACL,SACA,QACE,CAAC,iBAAiB,cAAc,YAAY,CAAC,GAC7C,CAAC,GACD,cAEE,MAAM,KAAK,EAAE,QAAQ,WAAW,IAAI,GAAG,WAAW,EAChD,IAAI,QAAQ,QACd,EAAE,CACN,CACF,EACF,IACA,CAAC;GACP;GACA,QAAQ;IACN,OAAO,OACL,SACA,QAAQ,CAAC,GAAG,CAAC,GAAG,cAAc,OAAO,CACvC;IACA,cAAc,OACZ,gBACA,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,eAAe,EAAE,IAAI,SAAS,EAAE,CAC1D;IACA,QAAQ,OAAO,UAAU,OAAO,CAAC;IACjC,GAAI,MAAM,UACN;KACE,SAAS,OACP,WACA,QACE,CAAC,YAAY,CAAC,GACd,CAAC,iBAAiB,CAAC,GACnB,SACC,CAAC,QAAQ;MAAE,IAAI;MAAW,WAAW,KAAK,CAAC;KAAE,EAChD,CACF;KACA,cAAc,OAAO,gBAAgB,OAAO,CAAC;IAC/C,IACA,CAAC;IACL,eAAe,OACb,iBACA,QACE,CAAC,GACD,CAAC,eAAe,CAAC,GACjB,SACC,CAAC,aACC,SAA+C,MAAM,MAAM,IAChE,CACF;IACA,GAAI,MAAM,eACN;KACE,oBAAoB,OAClB,sBACA,QACE,CAAC,GACD,CAAC,qBAAqB,CAAC,GACvB,SACC,CAAC,kBACA,OAAO,iBAAiB,WAAW,eAAe,IACtD,CACF;KACA,gBAAgB,OACd,kBACA,QACE,CAAC,GACD,CAAC,GACD,QACA,OAAO,SAAS,QAAQ,EAAE,eAErB,MAAM,QAAQ,WAAW,EAAA,EAGzB,MAAM,MAAM,IACnB,CACF;IACF,IACA,CAAC;IACL,GAAI,aACA,EACE,YAAY,OACV,cACA,QACE,CAAC,mBAAmB,CAAC,GACrB,CAAC,GACD,QACA,OAAO,SAAS,QAAQ,EAAE,cAAc;KACtC,MAAM,OAAO,SAAS,UAAU;KAChC,OAAO;IACT,CACF,CACF,EACF,IACA,CAAC;GACP;GACA,GAAI,MAAM,YACN,EACE,WAAW,QACT,CACE,YAAY,kBAAkB,WAAW,GACzC,GAAI,MAAM,cAAc,SACpB,CAAC,IACD,CAAC,QAAQ,YAAY,WAAW,CAAC,CAAC,CAAC,CAAC,CAC1C,GACA,CAAC,GACD,SACC,SAAS,WAAW;IAAE,IAAI,MAAM;IAAI,OAAO,MAAM;GAAM,EAC1D,EACF,IACA,CAAC;GACL,GAAI,MAAM,kBACN,EAAE,iBAAiB,MAAM,gBAAgB,IACzC,CAAC;EACP;CACF;AACF;;AAmBA,SAAS,WAAW,KAAwC;CAC1D,MAAM,WAAW,IAAI,IAAuB,oBAAoB,EAC9D,QAAQ,MACV,CAAC;CACD,MAAM,QAAyB;EAC7B,UAAU,CAAC;EACX,UAAU,CAAC;EACX,MAAM,CAAC;EACP,aAAa;EACb,YAAY;CACd;CACA,MAAM,WAAW,SAAS,SAAS,KAAK,QAAQ;CAChD,SAAS,YAAY,SAAS,cAAc;EAC1C,MAAM,OAAO,SAAS,SAAS,SAAS;EACxC,MAAM,SAAS,KAAK,OAAO;EAC3B,IAAI,MAAM,YAAY;GACpB,MAAM,UAAU,KAAK;GACrB,MAAM,KAAK,KACT,YAAY,KAAA,IACR,SACA,QAAQ,QAAQ,KAAK,MACnB,cACA,YACR;EACF;EACA,MAAM,QAAW,MAAc,QAAoB;GACjD,MAAM,SAAS,KAAK,IAAI;GACxB,IAAI,MAAM,aACR,MAAM,6BAA6B,UACjC,sCACA,yDACF;GAEF,OAAO,IAAI;EACb;EAsBA,OAAO;GApBL,KAAK,KAAK;GACV,YAAY,KAAK;GACjB,YAAY,KAAK;GACjB,gBAAgB,KAAK;GACrB,SAAS,KAAK;GACd,QAAQ,SAAS,KAAK,MAAM,IAAI;GAChC,eAAe,KAAK,iBAAiB,KAAK,QAAQ,CAAC;GACnD,IAAI,WAAW;IACb,OAAO,KAAK,kBAAkB,KAAK,QAAQ;GAC7C;GACA,IAAI,UAAU;IACZ,OAAO,KAAK,iBAAiB,KAAK,OAAO;GAC3C;GACA,IAAI,UAAU;IACZ,OAAO,KAAK,iBAAiB,KAAK,OAAO;GAC3C;GACA,IAAI,UAAU;IACZ,OAAO,KAAK,iBAAiB,KAAK,OAAO;GAC3C;EAEW;CACf;CACA,OAAO;AACT;AAEA,SAAS,kBACP,KACA,KACe;CACf,MAAM,OAAO,IACV,IAAuB,oBAAoB,EAAE,QAAQ,MAAM,CAAC,CAAC,CAC7D,KAAK;CACR,MAAM,KACJ,OAAO,OAAO,QAAQ,YAAY,EAAE,wBAAwB,OACvD,IAAsB,KACvB,KAAA;CAEN,MAAM,QACJ,KAAK,MAAM,cAAc,cAAc,GAAG,MACzC,OAAO,QAAQ,aACZ,KAAK,MAAM,cAAc,qBAAqB,GAAG,IACjD,KAAA,OACH,OAAO,KAAA,IACJ,KAAA,IACA,KAAK,MAAM,cAAc,UAAU,OAAO,EAAE,MAChD,KAAK;CACP,OAAO,GAAG,OAAO,4BAA4B;CAC7C,OAAO;AACT;;;;;AAMA,SAAS,aACP,KACA,MACqB;CACrB,IAAI,OAAO,QAAQ,YACjB,OAAO,OAAO,QAAQ,IAAI,IAAI,WAAqB,IAAI,MAAM,aACzD,OACA,KAAA;CAEN,IAAI,OAAO,OAAO,QAAQ,YAAY,EAAE,wBAAwB,MAC9D,OAAO,OAAO,QAAQ,IAAI,KAAK,IAAI,MAAM;AAG7C;;AAiBA,eAAe,kBACb,MACA,QACe;CACf,MAAM,UAAW,MAAM,KAAK;CAS5B,KAAK,MAAM,CAAC,IAAI,SAAS;EACvB,CAAC,SAAS,OAAO;EACjB,CAAC,UAAU,OAAO;EAClB,CAAC,SAAS,QAAQ;CACpB,GAAY;EACV,MAAM,QAAQ,QAAQ,OAAO;GAC3B,OAAO;GACP,MAAM;IACJ;IACA,MAAM;IACN,MAAM,GAAG,GAAG,GAAG,WAAW,OAAO,WAAW;IAC5C,2BAAW,IAAI,KAAK;GACtB;GACA,cAAc;EAChB,CAAC;EACD,MAAM,QAAQ,QAAQ,OAAO;GAC3B,OAAO;GACP,MAAM;IAAE,gBAAgB;IAAI;IAAQ;IAAM,2BAAW,IAAI,KAAK;GAAE;EAClE,CAAC;CACH;AACF;AAEA,eAAe,YACb,cAAmD,CAAC,GACpD,gBAAgB,OAChB,WAAoC,CAAC,GACpB;CACjB,MAAM,UAAU,YAAY,WAAW,CAAC;CACxC,MAAM,OAAO,sBACX;EACE,GAAG;EACH,SAAS,QAAQ,MAAM,WAAW,OAAO,OAAO,cAAc,IAC1D,UACA,CAAC,GAAG,SAAS,aAAa,CAAC;CACjC,GAEA,QACF;CACA,MAAM,QAAQ,MAAM,QAAQ,IAAI;CAChC,MAAM,WAAW,MAAM,YAAY,IAAI;CACvC,MAAM,kBAAkB,MAAM,SAAS,MAAM;CAC7C,MAAM,OAAgB;EACpB,OAAO,OAAO,WAAW,OAAO,WAAW;EAC3C,SAAS,WAAW,WAAW,OAAO,WAAW;EACjD,eAAe;EACf,OAAO,SAAS;EAChB,SAAS;CACX;CACA,OAAO;EACL;EACA;EACA;EACA;EACA,QAAQ,UAAU,IAAI;EACtB;EACA,MAAM,oBAAoB;GAIxB,QAAO,MAHgB,KAAK,SAAA,CAGb,YAAY,aAAa;EAC1C;CACF;AACF;;AAGA,eAAe,sBAAsB,KAA8B;CAejE,QAAO,MAbL,IAAI,KAAK,IAMT,mBAAmB;EACnB,SAAS,IAAI,QAAQ,EAAE,QAAQ,IAAI,SAAS,OAAO,CAAC;EACpD,MAAM;GACJ,MAAM;GACN,MAAM,eAAe,WAAW,OAAO,WAAW;EACpD;CACF,CAAC,EAAA,CACc;AACjB;AA0BA,eAAe,QACb,SACA,KACA,IACA,OAAoB,CAAC,GACrB,SAAS,IAAI,gBAAgB,GACd;CACf,MAAM,MAAM,MAAM,QAAQ,UACxB,KAAK,YAAY,YAAY,GAC7B,IAAI,MACJ;EACE,aAAa,KAAK,eAAe;EACjC,YAAY,CAAC,IAAI,MAAoC;EACrD;EACA,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,SAAS,IAAI,CAAC;EACnD,GAAI,KAAK,sBACL,EAAE,qBAAqB,KAAK,oBAAoB,IAChD,CAAC;EACL,GAAI,KAAK,yBACL,EAAE,wBAAwB,KAAK,uBAAuB,IACtD,CAAC;EACL,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,IAAI,CAAC;EAC9C,GAAI,KAAK,gBAAgB,KAAA,IACrB,CAAC,IACD,EAAE,aAAa,KAAK,YAAY;EACpC,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,IAAI,CAAC;EAClD,GAAI,KAAK,qBAAqB,EAAE,oBAAoB,KAAK,IAAI,CAAC;EAC9D,GAAI,KAAK,wBACL,EAAE,uBAAuB,KAAK,sBAAsB,IACpD,CAAC;EACL,GAAI,KAAK,iBAAiB,EAAE,gBAAgB,KAAK,eAAe,IAAI,CAAC;EACrE,GAAI,KAAK,aAAa,EAAE,YAAY,KAAK,IAAI,CAAC;CAChD,CACF;CACA,IAAI,UAAU,MAAM;CACpB,IAAI;EACF,MAAM,GAAG;GAAE;GAAK;GAAQ,iBAAiB,WAAW,GAAG;EAAE,CAAC;CAC5D,UAAU;EACR,MAAM,IAAI,MAAM;CAClB;AACF;AAEA,eAAe,YACb,SACA,KACA,MACkB;CAClB,MAAM,SAAS,MAAM,aACnB,QAAQ,SAAS,KAAK,YAAY,KAAA,GAAW,IAAI,CACnD;CACA,OAAO,MAAM,OAAO,IAAI,OAAO,yBAAyB;CACxD,OAAO,CAAC,OAAO,MAAM,OAAO;AAC9B;AAEA,eAAe,kBACb,SACA,KACA,MACA,MACe;CACf,MAAM,WAAW,OAAO,SAAS,WAAW,CAAC,IAAI,IAAI;CACrD,MAAM,QAAQ,MAAM,YAAY,SAAS,KAAK,IAAI;CAClD,MAAM,QAAQ,eAAe,KAAK;CAClC,OAAO,GACL,SAAS,MACN,UAAU,MAAM,SAAS,KAAK,KAAK,OAAO,KAAK,CAAC,CAAC,SAAS,KAAK,CAClE,GACA,YAAY,SAAS,KAAK,MAAM,EAAE,QAAQ,MAAM,KAAK,IAAI,EAAE,IAAI,OAAO,KAAK,GAC7E;AACF;;AAGA,SAAS,YAAY,QAAiC;CACpD,MAAM,OAAO,OAAO,QAAQ,MACzB,UACC,MAAM,UAAU,SAChB,MAAM,KAAK,WAAW,aAAa,KACnC,MAAM,KAAK,SAAS,WAAW,CACnC,CAAC,EAAE;CACH,OAAO,GACL,MACA,+EAA+E,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,GAC3G;CACA,OAAO;AACT;;AAGA,SAAS,aAAa,QAAsC;CAC1D,OAAO,IAAI,IACT,OAAO,QACJ,QAAQ,UAAU,MAAM,UAAU,MAAM,CAAC,CACzC,KAAK,UAAU,sBAAsB,KAAK,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,CAC3D,QAAQ,SAAyB,SAAS,KAAA,CAAS,CACxD;AACF;;AAaA,MAAM,mBAAmB;;AAczB,eAAe,aACb,KACA,KACA,YAA4B,CAAC,GACH;CAC1B,MAAM,YAAY,kBAAkB,KAAK,GAAG;CAC5C,MAAM,SAA0B,CAAC;CACjC,MAAM,UAAU,IAAI,IAAkB,eAAe,EAAE,QAAQ,MAAM,CAAC;CACtE,MAAM,YAAY,IAAI,IAAI,kBAAkB,EAAE,QAAQ,MAAM,CAAC;CAC7D,MAAM,SAAS,UAAU,WAAW,CAAC,EAAA,CAAG,KACrC,cACE;EACC;EACA,SAAS;EACT,MAAM,SAAS;CACjB,EACJ;CACA,MAAM,SAAS,QAAQ;CACvB,IAAI,UAAU,gBACZ,QAAQ,kBACN,KACA,OACA,QACA,aAEA,OACE,OAAO,QAAQ,YAAY,CAAC,IAAI,WAAW,SAAS,IAChD,GAAG,MAAM,qBACT,KACJ,OACA,QACA,QACF;CAEJ,IAAI;EACF,MAAM,UAAU,WAAW;GACzB,WAAW;IACT,sBAAsB,CAAC,GAAG,UAAU,eAAe,GAAG,GAAG,KAAK;IAC9D,oBAAoB,CAAC,GAAG,UAAU,aAAa,GAAG,GAAG,KAAK;GAC5D;GACA,WAAW,IAAI,IAAI,WAAW,EAAE,QAAQ,MAAM,CAAC;GAC/C,WAAW,IAAI,IAAI,WAAW,EAAE,QAAQ,MAAM,CAAC;GAC/C,gBACE,IAAI,IAAsB,mBAAmB,EAAE,QAAQ,MAAM,CAAC,CAAC,CAC5D,YAAY;GACjB,SAAS,QAAQ,WAAW,QAAQ,KAAK,QAAgB,MAAM;GAC/D,QAAQ,QAAQ,QAAQ,OAAO,YAAY;IACzC,MAAM,UACJ,WAAW,KAAA,IACP,KAAA,IACA,QAAQ,IAAI,OAAO,WAAqB,MAAM;IACpD,MAAM,UACJ,OAAO,YAAY,aACd,QAAQ,YAAY,kBAAkB,OAAO,IAG9C,KAAA;IACN,OAAO,KAAK;KAAE;KAAQ;KAAQ;KAAO;KAAS;IAAQ,CAAC;GACzD;GACA,QAAQ,IAAI,gBAAgB;EAC9B,CAAC;CACH,UAAU;EACR,QAAQ,iBAAiB;CAC3B;CACA,OAAO;AACT;;AAIA,SAAS,gBAAgB,QAA4B;CACnD,MAAM,QAAQ,GAAG,GAAG,OAAO,KAAK,mBAAmB,MAAM,CAAC,EAAE,EAC1D,GAAG,OAAO,KAAK;CAEjB,KAAK,MAAM,OAAO,QAAQ,mBAAmB,MAAM,GACjD,QAAQ,eAAe,KAAK,QAAQ,eAAe,KAAK,MAAM,GAAG,KAAK;CAExE,OAAO;AACT;;AAGA,SAAS,gBACP,KACA,SACsC;CACtC,MAAM,YAAY,IAAI,IAAI,kBAAkB,EAAE,QAAQ,MAAM,CAAC;CAC7D,MAAM,UAAU,IAAI,gBAAgB;CACpC,KAAK,MAAM,WAAW,CACpB,GAAG,UAAU,eAAe,GAC5B,GAAG,UAAU,aAAa,CAC5B,GAAG;EACD,MAAM,WAAoB,QAAQ;EAClC,IAAI,CAAC,YAAY,OAAO,aAAa,UACnC;EAEF,KAAK,MAAM,UAAU,QAAQ,kBAC3B,OAAO,eAAe,QAAQ,CAChC,GAAG;GACD,MAAM,UAAmB,QAAQ,IAAI,UAAU,MAAM;GACrD,IACE,OAAO,YAAY,cACnB,QAAQ,YAAY,kBAAkB,OAAO,MAAM,SAEnD,OAAO;IAAE;IAAU;GAAO;EAE9B;CACF;CACA,OAAO,KAAK,+CAA+C,QAAQ,SAAS;AAC9E;;;;;AAMA,eAAe,aACb,SACA,KACA,QACkB;CAClB,MAAM,QAAQ,aAAa,QAAQ,WAAW,MAAM;CACpD,IAAI,UAAU,KAAA,GACZ,OAAO;CAET,IAAI,QAAQ;CACZ,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EAC7C,QACE,OAAO,kBAAkB,KAAK,QAAQ,SAAS,CAAC,CAAC,YAAY;CACjE,CAAC;CACD,OAAO;AACT;;;;;;;AAQA,eAAe,iBACb,SACkB;CAClB,IAAI,SAAS;CACb,MAAM,QACJ,SACA,MAAM,YAAY,GAClB,OAAO,EAAE,KAAK,sBAAsB;EAClC,gBAAgB,aAAa;EAC7B,UACE,MAAM,QAAQ,OAAO,KAAK,YAAY,CAAC,CAAC,GACxC,kCACF;EACA,MAAM,CAAC,OAAO,gBAAgB;EAC9B,OAAO,GAAG,KAAK,mCAAmC;EAClD,SAAS,QAAQ;CACnB,CACF;CACA,OAAO;AACT;AAEA,SAAS,aAAa,OAAmB,MAAsB;CAC7D,OAAO,MAAM,MAAM,MAAM,IAAI,CAAC,CAAC,QAAQ,SAAS,SAAS,cAAc,CAAC,CACrE;AACL;AAEA,SAAS,OACP,QACA,QACA,QACA,QAAQ,IACF;CACN,MAAM,SAAS,QAAQ,GAAG,MAAM,MAAM;CACtC,OAAO,MACL,OAAO,IACP,OACA,GAAG,OAAO,aAAa,OAAO,wBAAwB,KAAK,UAAU,OAAO,IAAI,GAClF;CACA,OAAO,MACL,OAAO,OAAO,YACd,QACA,GAAG,OAAO,WAAW,OAAO,QAAQ,KAAK,UAAU,OAAO,KAAK,GACjE;CACA,IAAI,WAAW,KAAA,GACb,OAAO,MACL,OAAO,OAAO,QACd,QACA,GAAG,SAAS,KAAK,UAAU,OAAO,KAAK,GACzC;AAEJ;AAEA,SAAS,SACP,QACA,QAAQ,IACF;CACN,MAAM,SAAS,QAAQ,GAAG,MAAM,MAAM;CACtC,OAAO,MAAM,OAAO,IAAI,OAAO,GAAG,OAAO,kCAAkC;CAC3E,MAAM,SAAS,OAAO,OAAO;CAC7B,OAAO,GACL,WAAW,KAAA,KAAa,UAAU,KAClC,GAAG,OAAO,sBAAsB,KAAK,UAAU,OAAO,KAAK,GAC7D;AACF;AAEA,SAAS,UAAU,QAAmC,QAAQ,IAAU;CACtE,OAAO,MACL,OAAO,IACP,MACA,GAAG,QAAQ,GAAG,MAAM,MAAM,GAAG,wBAAwB,KAAK,UAAU,OAAO,KAAK,GAClF;AACF;AAEA,SAAS,YAAY,QAAmC;CACtD,OAAQ,OAAO,MACX;AACN;;AAGA,MAAM,oBAAoB;AAE1B,MAAM,iBAAiB;CACrB,eAAe;CACf,eAAe,CAAC,CAAC,CAAC;CAClB,sBAAsB,CAAC;CACvB,gBAAgB;CAChB,kBAAkB,SAAS,UAAU,CAAC;CACtC,qBAAqB;EACnB,mBAAmB,CAAC;EACpB,oBAAoB,CAAC;EACrB,eAAe,KAAA;CACjB;CACA,oBAAoB;EAAE,gBAAgB,CAAC;EAAI,mBAAmB,CAAC;CAAG;CAClE,mBAAmB;EACjB,gBAAgB,CAAC;EACjB,kBAAkB,CAAC;EACnB,kBAAkB;CACpB;AACF;;;;;;;;;AAUA,SAAgB,qBACd,SACmB;CACnB,MAAM,QAA2B,CAAC;CAClC,IAAI;;CAEJ,MAAM,gBAAgB,YAA8B;EAClD,IAAI,CAAC,QAAQ,kBACX,OAAO;EAET,aAAa,iBAAiB,OAAO;EACrC,OAAO;CACT;CACA,MAAM,iBAAiB,OACrB,aACA,aAEA,YAAY,aAAa,MAAM,cAAc,GAAG,QAAQ;CAC1D,MAAM,UACJ,IACA,OACA,KACA,SACG,MAAM,KAAK,gBAAgB,IAAI,OAAO,KAAK,IAAI,CAAC;CACrD,MAAM,OACJ,IACA,OACA,KACA,SACG,OAAO,IAAI,OAAO,YAAY,IAAI,MAAM,eAAe,CAAC,GAAG,IAAI;CACpE,MAAM,YAAY,QAAQ,mBACtB,KAAA,IACA;;CAEJ,MAAM,eAAe,YAClB,MAAM,cAAc,IACjB,gBACE,mGACF,IACA,KAAA;CACN,MAAM,YAAY;CAClB,MAAM,YAAY;CAClB,MAAM,YACJ,CAAC,QAAQ,eAAe,aAAa,QAAQ,WAAW,SAAS,MAAM,QACnE,YACA,KAAA;CACN,MAAM,YACJ,CAAC,QAAQ,eACT,aAAa,QAAQ,WAAW,kBAAkB,MAAM,QACpD,YACA,KAAA;;CAEN,MAAM,aAAa,OACjB,QACyC;EACzC,IAAI,QAAQ,aAAa;GACvB,OAAO,GACL,QAAQ,kBAAkB,QAC1B,uCACF;GACA;EACF;EACA,OAAO,MACL,MAAM,aAAa,SAAS,KAAK,SAAS,GAC1C,OACA,+EACF;EACA,OAAO,gBAAgB,SAAS;CAClC;;CAEA,MAAM,aAAa,OACjB,QACyC;EACzC,IAAI,QAAQ,aACV;EAEF,OAAO,MACL,MAAM,aAAa,SAAS,KAAK,kBAAkB,GACnD,OACA,6EACF;EACA,OAAO,gBAAgB,SAAS;CAClC;CACA,MAAM,gBAA2C,CAC/C,CAAC,GACD,CAAC,UAAU,cAAc,CAC3B;CACA,MAAM,WAAW,QAAqB,MAAc,UAAmB;EACrE,MAAM,OAAQ,OAAO,OACnB;EAEF,OAAO,UAAU,KAAA,IAAY,OAAO,OAAO;CAC7C;CACA,MAAM,UAAU,UACb,OACG,WAAW,UAAU;CAC3B,MAAM,OAAO,IAAI,IAAI,YAAY,CAAC,CAAC;CACnC,MAAM,iBAAiB;EAAE,cAAc,CAAC,IAAI;EAAG,UAAU;CAAa;CACtE,MAAM,UAAU,SAAiB;EAC/B,QAAQ,IAAI,SAAS;EACrB,GAAI,IAAI,gBAAgB,EAAE,QAAQ,aAAa,IAAI,CAAC;CACtD;CAEA,IACE,eACA,yFACC,QACC,QAAQ,SAAS,KAAK,OAAO,EAAE,KAAK,sBAAsB;EACxD,MAAM,YAAY,kBAAkB,KAAK,QAAQ,SAAS;EAC1D,MAAM,WAAW,IAAI,IAAuB,oBAAoB,EAC9D,QAAQ,MACV,CAAC;EACD,gBAAgB,aAAa,CAAC,QAAQ;EACtC,UAAU,MAAM,QAAQ,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC;EACnD,gBAAgB,aAAa;EAC7B,KAAK,MAAM,OAAO,gBAAgB,MAChC,OAAO,MACL,KACA,QACA,yEACF;EAEF,UAAU,MAAM,QAAQ,OAAO,KAAK,YAAY,OAAO,GAAG,CAAC,CAAC;EAC5D,OAAO,GACL,gBAAgB,SAAS,UAAU,GACnC,mCACF;EACA,KAAK,MAAM,WAAW,gBAAgB,UAAU;GAC9C,OAAO,MAAM,UAAU,QAAQ,OAAO,GAAG,IAAI;GAC7C,OAAO,MACL,SAAS,KAAK,OAAO,GACrB,WACA,wDACF;EACF;EACA,OAAO,MAAM,UAAU,QAAQ,cAAc,GAAG,KAAK;CACvD,CAAC,CACL;CACA,IACE,8BACA,uIACC,QACC,QAAQ,SAAS,KAAK,OAAO,EAAE,KAAK,sBAAsB;EACxD,MAAM,UAAU,IAAI,IAAI,wBAAwB,EAAE,QAAQ,MAAM,CAAC;EACjE,MAAM,OAAO,YAAyB;GACpC,MAAM,EAAE,UAAU,WAAW,gBAAgB,KAAK,OAAO;GACzD,MAAM,WAAW,QAAQ,IAAI,UAAU,MAAM;GAG7C,MAAM,UAAU,QAAQ,OACtB,UACA,UACA,QACA,KAAA,GACA,KAAA,GACA,KAAA,GACA,KAAA,GACA;IAAE,QAAQ;IAAM,cAAc;IAAM,SAAS;GAAM,GACnD,iBACF;GACA,OAAO,OAAO,YAAY,QAAQ,CAAC,CAAC,CAAC;EACvC;EACA,MAAM,OAAO,IAAI,MAAM,MAAM;EAC7B,MAAM,YAAY,gBAAgB,SAAS;EAC3C,MAAM,UAAU,MAAM,IAAI,QAAQ;EAClC,OAAO,GACL,QAAQ,IACR,mCAAmC,OAAO,CAAC,QAAQ,MAAM,QAAQ,KAAK,GACxE;EACA,OAAO,MACL,gBAAgB,SAAS,QACzB,WACA,oDACF;EACA,OAAO,MAAM,aAAa,IAAI,OAAO,IAAI,GAAG,GAAG,sBAAsB;EACrE,MAAM,WAAW,MAAM,IAAI,UAAU;EACrC,OAAO,MAAM,SAAS,IAAI,OAAO,0BAA0B;EAC3D,OAAO,UACL,eAAe,CAAC,SAAS,MAAM,SAAS,KAAK,GAC7C,CAAC,cAAc,GACf,8BAA8B,OAAO,CAAC,SAAS,MAAM,SAAS,KAAK,GACrE;EACA,OAAO,MAAM,aAAa,IAAI,OAAO,IAAI,GAAG,GAAG,sBAAsB;CACvE,CAAC,CACL;CACA,IACE,oBACA,mFACC,QACC,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EACvC,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,YAAY,CAAC,CAAC;EACvD,OAAO,QAAQ,GAAG;EAClB,OAAO,MAAM,OAAO,OAAO,MAAM,iBAAiB;EAClD,UAAU,MAAM,QAAQ,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC;CACnD,CAAC,CACL;CACA,IACE,iBACA,2DACC,QACC,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EACvC,MAAM,WAAW,MAAM,QAAQ,OAAO,KAAK,YAAY,OAAO,GAAG,CAAC;EAClE,UAAU,QAAQ;EAClB,OAAO,UAAU,YAAY,QAAQ,GAAG;GACtC,MAAM;GACN,QAAQ,IAAI,SAAS;EACvB,CAAC;EACD,MAAM,WAAW,MAAM,QAAQ,OAAO,KAAK,YAAY,EACrD,eAAe,UAAU,IAAI,SAAS,QACxC,CAAC;EACD,UAAU,QAAQ;EAClB,OAAO,MAAM,YAAY,QAAQ,CAAC,EAAE,QAAQ,IAAI,SAAS,MAAM;EAC/D,MAAM,QAAQ,MAAM,QAAQ,OAAO,KAAK,iBAAiB,EACvD,aAAa,IAAI,KAAK,MACxB,CAAC;EACD,UAAU,KAAK;EACf,OAAO,MAAM,YAAY,KAAK,CAAC,EAAE,MAAM,SAAS;CAClD,CAAC,CACL;CACA,IACE,eACA,qEACC,QACC,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EACvC,IAAI,OAAO,IAAI,MAAM,MAAM;EAC3B,UAAU,MAAM,QAAQ,OAAO,KAAK,UAAU,OAAO,GAAG,CAAC,CAAC;EAC1D,OAAO,GACL,aAAa,IAAI,OAAO,IAAI,KAAK,GACjC,2BAA2B,aAAa,IAAI,OAAO,IAAI,EAAE,OAC3D;EACA,OAAO,IAAI,MAAM,MAAM;EACvB,UAAU,MAAM,QAAQ,OAAO,KAAK,eAAe,OAAO,GAAG,CAAC,CAAC;EAC/D,OAAO,GAAG,aAAa,IAAI,OAAO,IAAI,KAAK,CAAC;EAC5C,KAAK,MAAM,SAAS,QAAQ,oBAAoB,CAAC,GAAG;GAClD,IAAI,UAAU,aAAa,UAAU,WACnC;GAEF,OAAO,IAAI,MAAM,MAAM;GACvB,MAAM,QAAQ,YACZ,KACA,OACA,CAAC,EAAE,OAAO,QAAQ,GAAG,EAAE,OAAO,SAAS,CAAC,GACxC,OAAO,GAAG,CACZ;GACA,OAAO,MACL,aAAa,IAAI,OAAO,IAAI,GAC5B,GACA,OAAO,MAAM,qDAAqD,aAAa,IAAI,OAAO,IAAI,EAAE,OAClG;EACF;CACF,CAAC,CACL;CACA,IACE,0BACA,qFACA,OAAO,QACJ,MAAM,WAAW,GAAG,KACrB,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EACvC,KAAK,MAAM,SAAS,QAAQ,kBAAmB;GAC7C,MAAM,CAAC,OAAO,UAAU,MAAM,QAAQ,YACpC,KACA,OACA,CAAC,EAAE,OAAO,QAAQ,GAAG,EAAE,OAAO,QAAQ,CAAC,GACvC,OAAO,GAAG,CACZ;GACA,OAAO,MAAM,MAAM,IAAI,MAAM,GAAG,MAAM,6BAA6B;GACnE,OAAO,MACL,OAAO,OAAO,QACd,sBACA,GAAG,MAAM,yDAAyD,KAAK,UAAU,MAAM,EAAE,EAC3F;GACA,MAAM,CAAC,aAAa,iBAAiB,MAAM,QAAQ,YACjD,KACA,OACA,CAAC,EAAE,OAAO,QAAQ,GAAG,EAAE,OAAO,QAAQ,CAAC,GACvC,OAAO,GAAG,CACZ;GACA,OAAO,MAAM,YAAY,OAAO,QAAQ,oBAAoB;GAC5D,OAAO,MACL,cAAc,IACd,MACA,GAAG,MAAM,yDAAyD,KAAK,UAAU,aAAa,EAAE,EAClG;GACA,MAAM,SAAS,MAAM,QAAQ,YAC3B,KACA,OACA,CAAC,EAAE,OAAO,QAAQ,GAAG,EAAE,OAAO,SAAS,CAAC,GACxC,OAAO,GAAG,CACZ;GACA,OAAO,UACL,OAAO,KAAK,UAAU,MAAM,EAAE,GAC9B,CAAC,MAAM,IAAI,GACX,GAAG,MAAM,4EACX;EACF;CACF,CAAC,GACH,SACF;CACA,IACE,gBACA,4EACC,QACC,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EACvC,MAAM,aAAa,MAAM,QAAQ,OAAO,KAAK,YAAY;GACvD,GAAG,OAAO,GAAG;GACb,aAAa,IAAI,KAAK;EACxB,CAAC;EACD,UAAU,UAAU;EACpB,OAAO,MAAM,YAAY,UAAU,CAAC,EAAE,MAAM,SAAS;EACrD,OACE,MAAM,QAAQ,OAAO,KAAK,YAAY,EACpC,aAAa,IAAI,KAAK,MACxB,CAAC,GACD,GACF;EACA,OAAO,MAAM,IAAI,KAAK,eAAe,GAAG,sBAAsB;EAC9D,UACE,MAAM,QAAQ,OAAO,KAAK,iBAAiB,EACzC,aAAa,IAAI,KAAK,MACxB,CAAC,CACH;EACA,OAAO,MAAM,IAAI,KAAK,eAAe,CAAC;CACxC,CAAC,CACL;CACA,IACE,sBACA,yDACC,QACC,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EACvC,MAAM,OAAO,MAAM,IAAI,kBAAkB;EACzC,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,YAAY,OAAO,GAAG,CAAC;EAChE,UAAU,MAAM;EAChB,MAAM,QAAQ,OAAO,WAAW,QAAQ,SACtC,KAAK,WAAW,GAAG,KAAK,EAAE,CAC5B;EACA,OAAO,MACL,MAAM,QACN,GACA,oBAAoB,OAAO,WAAW,KAAK,KAAK,GAClD;CACF,CAAC,GACH,QAAQ,sBACJ,KAAA,IACA,oEACN;CACA,IACE,wBACA,yEACC,QACC,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EACvC,MAAM,UAAW,MAAM,IAAI,KAAK;EAOhC,MAAM,SAAS,MAAM,QAAQ,gBAAgB,YAC3C,IAAI,SAAS,KACf;EACA,MAAM,SAAS,IAAI,MAAM,OAAO;EAChC,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,YAAY,OAAO,GAAG,CAAC;EAChE,UAAU,MAAM;EAChB,MAAM,QAAQ,MAAM,QAAQ,gBAAgB,YAC1C,IAAI,SAAS,KACf;EACA,OAAO,UAAU,OAAO,YAAY,CAAC,CAAC;EACtC,OAAO,MACL,IAAI,KAAK,MAAO,QAAQ,SAAS,CAAC,CAAC,QAAQ,GAC3C,IAAI,KAAK,OAAQ,QAAQ,SAAS,CAAC,CAAC,QAAQ,GAC5C,0BACF;EACA,OAAO,GACL,CAAC,IAAI,MAAM,OAAO,MAAM,MAAM,CAAC,CAAC,SAAS,gBAAgB,GACzD,+BACF;EACA,OAAO,GACL,IAAI,MAAM,QACP,QAAQ,UAAU,MAAM,SAAS,cAAc,CAAC,CAChD,MAAM,EAAE,CAAC,CACT,OAAO,UAAU,MAAM,IAAI,GAC9B,6DACF;CACF,CAAC,GACH,QAAQ,sBACJ,+DACA,KAAA,CACN;CACA,IACE,sBACA,wKACA,OAAO,QAAQ;EACb,MAAM,OAAO,MAAM,aAAa;EAChC,IAAI,MACF,OAAO;EAET,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;GAC7C,MAAM,OAAO,IAAI,MAAM,MAAM;GAC7B,OACE,MAAM,QAAQ,OAAO,KAAK,UAAU;IAClC,GAAG,OAAO,GAAG;IACb,QAAQ;GACV,CAAC,GACD,KACA,gBACF;GACA,OAAO,MAAM,aAAa,IAAI,OAAO,IAAI,GAAG,GAAG,sBAAsB;GACrE,OACE,MAAM,QAAQ,OAAO,KAAK,UAAU,OAAO,GAAG,CAAC,GAC/C,KACA,wBACF;GACA,KAAK,MAAM,UAAU,CAAC,sBAAsB,YAAY,GACtD,UACE,MAAM,QAAQ,OAAO,KAAK,UAAU;IAAE,GAAG,OAAO,GAAG;IAAG;GAAO,CAAC,GAC9D,kBAAkB,QACpB;GAEF,UACE,MAAM,QAAQ,OAAO,KAAK,UAAU;IAClC,GAAG,OAAO,GAAG;IAEb,MAAM,IAAI,IAAI,YAAY,CAAC,CAAC;IAC5B,QAAQ;IACR,kBAAkB;GACpB,CAAC,GACD,+CACF;GACA,UACE,MAAM,QAAQ,OAAO,KAAK,UAAU;IAClC,eAAe,UAAU,IAAI,SAAS;IACtC,QAAQ;GACV,CAAC,GACD,iCACF;EACF,CAAC;EAED,MAAM,YAAY,OAChB,KACA,KACA,UACG;GACH,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,UAAU;IACjD,GAAG,OAAO,GAAG;IACb,QAAQ;GACV,CAAC;GACD,UAAU,QAAQ,GAAG,MAAM,oCAAoC;GAC/D,OAAO,MAAM,YAAY,MAAM,CAAC,EAAE,QAAQ,IAAI,SAAS,QAAQ,KAAK;EACtE;EACA,MAAM,QACJ,SACA,MACC,EAAE,UAAU,UAAU,KAAK,KAAK,oBAAoB,GACrD,EAAE,UAAU,YAAY,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,EAAE,CAC3D;EACA,MAAM,WAAW,MAAM,eAAe,CAAC,GAAG,EAAE,kBAAkB,KAAK,CAAC;EACpE,MAAM,QAAQ,SAAS,WAAW,EAAE,UAClC,UAAU,KAAK,UAAU,2BAA2B,CACtD;EAGA,MAAM,UAAU,MAAM,eACpB,CAAC,GACD;GAAE,oBAAoB;GAAM,kBAAkB;EAAM,CACtD;EACA,MAAM,aAAa,IAAI,gBAAgB;EACvC,MAAM,QACJ,SACA,SACA,OAAO,EAAE,UAAU;GACjB,MAAM,OAAO,QAAQ,MAAM,MAAM;GACjC,OACE,MAAM,QAAQ,OAAO,KAAK,UAAU;IAClC,GAAG,OAAO,OAAO;IACjB,QAAQ;GACV,CAAC,GACD,KACA,gBACF;GACA,OAAO,MACL,aAAa,QAAQ,OAAO,IAAI,GAChC,GACA,6EACF;GACA,UACE,MAAM,QAAQ,OAAO,KAAK,UAAU;IAClC,GAAG,OAAO,OAAO;IACjB,QAAQ;GACV,CAAC,GACD,6EACF;EACF,GACA,CAAC,GACD,UACF;EACA,OAAO,GACL,WAAW,QAAQ,MAChB,UACC,MAAM,UAAU,UAChB,MAAM,KAAK,WAAW,iBAAiB,KACvC,MAAM,KAAK,SAAS,4BAA4B,CACpD,GACA,yGAAyG,WAAW,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,GACzI;CACF,GACA,SACF;CACA,IACE,iCACA,yEACA,OAAO,QACJ,MAAM,aAAa,KACpB,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EACvC,KAAK,MAAM,SAAS,CAAC,OAAO,IAAI,SAAS,KAAK,GAC5C,OACE,MAAM,QAAQ,OAAO,KAAK,UAAU;GAClC,GAAG,OAAO,GAAG;GACb,eAAe,UAAU;GACzB,QAAA;EACF,CAAC,GACD,KACA,gBACF;CAEJ,CAAC,GACH,SACF;CACA,IACE,sBACA,wGACA,OAAO,QAAQ;EACb,MAAM,OAAO,MAAM,aAAa;EAChC,IAAI,MACF,OAAO;EAET,MAAM,OAAO,MAAM,YAAY,IAAI,MAAM,EAAE,UAAU,KAAK,CAAC;EAC3D,MAAM,cAAc;GAAE,OAAO,KAAK;GAAO,UAAU,KAAK;EAAU;EAClE,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;GAC7C,MAAM,OAAO,MAAM,IAAI,kBAAkB;GACzC,IAAI,UAAU,IAAI,MAAM,MAAM,QAC3B,SAAS,SAAS,gBACrB,CAAC,CAAC;GACF,MAAM,aAAa,MAAM,QAAQ,OAC/B,KACA,cACA;IACE,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;GACpB,GACA,WACF;GACA,OAAO,YAAY,KAAK,qCAAqC;GAC7D,OAAO,UAAU,WAAW,YAAY,CAAC,CAAC;GAC1C,OAAO,MACL,IAAI,MAAM,MAAM,QAAQ,SAAS,SAAS,gBAAgB,CAAC,CAAC,QAC5D,SACA,oDACF;GACA,OACE,MAAM,QAAQ,OACZ,KACA,cACA;IACE,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;GACpB,GACA,WACF,GACA,KACA,gBACF;GACA,MAAM,UAAU,MAAM,QAAQ,OAC5B,KACA,cACA,EAAE,QAAQ,aAAa,GACvB,WACF;GACA,UAAU,OAAO;GACjB,OAAO,GACL,QAAQ,WAAW,MAAM,SAAS,KAAK,WAAW,GAAG,KAAK,EAAE,CAAC,GAC7D,iDACF;GACA,UAAU,MAAM,QAAQ,OAAO,KAAK,cAAc,CAAC,GAAG,WAAW,CAAC;GAGlE,UAAU,IAAI,MAAM,MAAM,QACvB,SAAS,SAAS,gBACrB,CAAC,CAAC;GACF,MAAM,SAAS,IAAI,MAAM,OAAO;GAChC,MAAM,iBAAiB,MAAM,QAAQ,OACnC,KACA,kBACA;IACE,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;GACpB,GACA,WACF;GACA,OAAO,gBAAgB,KAAK,qCAAqC;GACjE,OAAO,UAAU,eAAe,YAAY,CAAC,CAAC;GAC9C,OAAO,MACL,IAAI,MAAM,MAAM,QAAQ,SAAS,SAAS,gBAAgB,CAAC,CAAC,QAC5D,SACA,+EACF;GACA,OAAO,UACL,IAAI,MAAM,OAAO,MAAM,MAAM,GAC7B,CAAC,GACD,2EACF;GACA,MAAM,cAAc,MAAM,QAAQ,OAChC,KACA,kBACA,EAAE,QAAQ,aAAa,GACvB,WACF;GACA,UAAU,aAAa,8CAA8C;GACrE,OAAO,GACL,YAAY,WAAW,MAAM,SAAS,KAAK,WAAW,GAAG,KAAK,EAAE,CAAC,GACjE,+DACF;GACA,UACE,MAAM,QAAQ,OAAO,KAAK,kBAAkB,CAAC,GAAG,WAAW,GAC3D,4DACF;GACA,UAAU,IAAI,MAAM,MAAM,QACvB,SAAS,SAAS,gBACrB,CAAC,CAAC;GACF,MAAM,WAAqC,CACzC,EAAE,QAAQ,aAAa,GACvB;IAAE,QAAQ;IAAkB,kBAAkB;GAAa,CAC7D;GACA,KAAK,MAAM,WAAW,UAAU;IAC9B,MAAM,SAAS,MAAM,QAAQ,OAC3B,KACA,qBACA,SACA,WACF;IACA,SAAS,MAAM;IACf,OAAO,UAAU,OAAO,YAAY,CAAC,CAAC;GACxC;GACA,OAAO,MACL,IAAI,MAAM,MAAM,QAAQ,SAAS,SAAS,gBAAgB,CAAC,CAAC,QAC5D,SACA,8DACF;EACF,CAAC;EAGD,IAAI,MAAM,WAAW,GAAG,GACtB;EAEF,MAAM,cAAc,YAClB,YAAY,CAAC,GAAG,CAAC,GAAG;GAAE;GAAS,YAAY;EAAY,CAAC;EAC1D,MAAM,kBACJ,SACA,KACA;GAAE,wBAAwB,CAAC;GAAG,UAAU,WAAW,KAAK;EAAE,GAC1D,0BACF;EACA,MAAM,QACJ,SACA,KACA,OAAO,EAAE,UAAU;GACjB,MAAM,UAAU,IAAI,MAAM,MAAM,QAC7B,SAAS,SAAS,gBACrB,CAAC,CAAC;GACF,MAAM,SAAS,IAAI,MAAM,OAAO;GAChC,MAAM,YAA8B,CAClC;IAAE,MAAM;IAAU,QAAQ,CAAC,cAAc,QAAQ;GAAE,CACrD;GACA,MAAM,aAAa,MAAM,QAAQ,YAAa,KAAK,WAAW;IAC5D,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;GACpB,CAAC;GACD,OAAO,GACL,WAAW,OAAO,MACf,UACC,MAAM,KAAK,SAAS,YAAY,KAChC,MAAM,WAAW,qCACrB,GACA,mEAAmE,KAAK,UAAU,UAAU,GAC9F;GACA,OAAO,MACL,IAAI,MAAM,MAAM,QAAQ,SAAS,SAAS,gBAAgB,CAAC,CAAC,QAC5D,SACA,oFACF;GACA,OAAO,UACL,IAAI,MAAM,OAAO,MAAM,MAAM,GAC7B,CAAC,GACD,gFACF;GACA,KAAK,MAAM,CAAC,SAAS,UAAU,CAC7B,CAAC,EAAE,QAAQ,aAAa,GAAG,iBAAiB,GAC5C,CAAC,CAAC,GAAG,kCAAkC,CACzC,GAAY;IACV,MAAM,SAAS,MAAM,QAAQ,YAAa,KAAK,WAAW,OAAO;IACjE,OAAO,UACL,OAAO,QACP,CAAC,GACD,GAAG,MAAM,sCAAsC,KAAK,UAAU,OAAO,MAAM,GAC7E;IACA,OAAO,MAAM,QAAQ,QAAQ,UAAU,YAAY,GAAG,WAAW;IACjE,OAAO,MACL,OAAO,QAAQ,QAAQ,UAAU,QAAQ,CAAC,GAC1C,MACA,GAAG,MAAM,qDACX;GACF;EACF,GACA;GACE,wBAAwB,CAAC,UAAU,cAAc;GACjD,UAAU,WAAW,IAAI;EAC3B,CACF;CACF,GACA,SACF;CACA,IACE,uBACA,8GACA,OAAO,QAAQ;EACb,MAAM,OAAO,MAAM,aAAa;EAChC,IAAI,MACF,OAAO;EAET,MAAM,OAAO,MAAM,YAAY,IAAI,MAAM,EAAE,UAAU,KAAK,CAAC;EAC3D,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,KAAK,aAAa;GACrD,KAAK,MAAM,WAAW,CACpB;IAAE,GAAG,OAAO,GAAG;IAAG,QAAQ;GAAiB,GAC3C,OAAO,GAAG,CACZ,GAAG;IACD,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,gBAAgB,OAAO;IAChE,UAAU,MAAM;IAChB,OAAO,MACJ,OAAO,KAA6B,QACrC,IAAI,SAAS,MACf;GACF;GACA,MAAM,UAAU,IAAI,MAAM,MAAM,QAC7B,SAAS,SAAS,gBACrB,CAAC,CAAC;GACF,MAAM,SAAS,MAAM,QAAQ,OAC3B,KACA,kBACA;IACE,QAAQ;IACR,kBAAkB;IAClB,kBAAkB;GACpB,GACA;IAAE,OAAO,KAAK;IAAO,UAAU,KAAK;GAAS,CAC/C;GACA,OAAO,QAAQ,KAAK,gBAAgB;GACpC,OAAO,UAAU,OAAO,YAAY,CAAC,CAAC;GACtC,OAAO,MACL,IAAI,MAAM,MAAM,QAAQ,SAAS,SAAS,gBAAgB,CAAC,CAAC,QAC5D,SACA,yEACF;GAGA,MAAM,SAAS,EAAE,QAAQ,IAAI,SAAS,OAAO;GAC7C,MAAM,gBAAgB,OACpB,SACA,WAEA,QAAQ,OACN,KACA,SACA;IAAE,GAAG,OAAO,GAAG;IAAG,GAAI,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO;GAAG,GAC9D,MACF;GACF,KAAK,MAAM,UAAU,CAAC,kBAAkB,KAAA,CAAS,GAAG;IAClD,MAAM,QAAQ,yDAAyD,SAAS,6BAA6B;IAC7G,MAAM,SAAS,OAAO,OAAO,CAAC,CAAC;IAC/B,SAAS,MAAM,cAAc,iBAAiB,MAAM,GAAG,KAAK;IAC5D,OAAO,MACL,OACG,OAAO,CAAC,CACR,MAAM,MAAM,CAAC,CACb,KAAK,UAAU,MAAM,IAAI,CAAC,CAC1B,KAAK,IAAI,GACZ,sCACA,KACF;GACF;GACA,MAAM,UAAU,MAAM,cAAc,iBAAiB,YAAY;GACjE,UACE,SACA,6EACF;GACA,OAAO,MACJ,QAAQ,KAA6B,QACtC,IAAI,SAAS,MACf;GACA,KAAK,MAAM,UAAU,CAAC,cAAc,gBAAgB,GAClD,SACE,MAAM,cAAc,uBAAuB,MAAM,GACjD,sDAAsD,QACxD;EAEJ,CAAC;CACH,GACA,SACF;;CAEA,MAAM,kBAA0C;EAC9C;EACA;EACA;CACF;;CAEA,MAAM,kBAAkB,YAAkD;EACxE,IAAI,CAAE,MAAM,cAAc,GACxB,OAAO,gBACL,4DACF;EAEF,OAAO,GACL,QAAQ,kBACR,4FACF;CAEF;;CAEA,MAAM,4BAA4B,QAAmC;EACnE,IAAI;EACJ,IAAI;GACF,IAAI,IAAI,oBAAoB,EAAE,QAAQ,MAAM,CAAC;GAC7C,WAAW;EACb,QAAQ;GACN,WAAW;EACb;EACA,OAAO,GACL,CAAC,YAAY,QAAQ,wBACrB,4EACF;EACA,OAAO,QAAQ,2BAA2B,KAAA;CAC5C;;CAEA,MAAM,qBAAqB,OACzB,KACA,SACA,QACA,QACA,UACG;EACH,MAAM,UAAU,MAAM,QAAQ,iBAC5B,KACA,iBACA,OACF;EACA,OAAO,MAAM,QAAQ,QAAQ,gBAAgB,QAAQ,KAAK;EAC1D,KAAK,MAAM,CAAC,OAAO,WAAW,QAAQ,QAAQ,GAC5C,OAAO,QAAQ,QAAQ,QAAQ,GAAG,MAAM,IAAI,gBAAgB,QAAQ;EAEtE,IAAI,yBAAyB,GAAG,GAC9B,OACE,MAAM,QAAQ,uBAAwB,KAAK,OAAO,GAClD,QACA,QACA,GAAG,MAAM,iCACX;CAEJ;;CAEA,MAAM,sBAAsB,OAC1B,KACA,SACA,QACA,UACG;EACH,MAAM,UAAU,MAAM,QAAQ,iBAC5B,KACA,iBACA,OACF;EACA,OAAO,MAAM,QAAQ,QAAQ,gBAAgB,QAAQ,KAAK;EAC1D,KAAK,MAAM,CAAC,OAAO,WAAW,QAAQ,QAAQ,GAAG;GAC/C,UAAU,QAAQ,GAAG,MAAM,IAAI,gBAAgB,QAAQ;GACvD,OAAO,MAAM,YAAY,MAAM,CAAC,EAAE,QAAQ,QAAQ,KAAK;EACzD;EACA,IAAI,yBAAyB,GAAG,GAAG;GACjC,MAAM,aAAa,MAAM,QAAQ,uBAAwB,KAAK,OAAO;GACrE,OAAO,MACL,WAAW,IACX,MACA,GAAG,MAAM,oCAAoC,KAAK,UAAU,WAAW,KAAK,GAC9E;EACF;CACF;CACA,OACE,yBACA,oNACA,YAAY;EACV,MAAM,OAAO,MAAM,gBAAgB;EACnC,IAAI,MACF,OAAO;EAET,MAAM,WAAoC,CAAC;EAC3C,MAAM,MAAM,MAAM,eAAe,EAC/B,iBAAiB,YAAsB;GACrC,SAAS,KAAK,OAAO;GACrB,OAAO,CAAC,uBAAuB;EACjC,EACF,CAAC;EACD,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;GAC7C,MAAM,UAAU,IAAI,SAAS;GAC7B,MAAM,mBACJ,KACA;IAAE,QAAQ;IAAS,QAAQ;GAAiB,GAC5C,KACA,kBACA,6CACF;GACA,MAAM,mBACJ,KACA,EAAE,QAAQ,QAAQ,GAClB,KACA,0BACA,mCACF;GACA,KAAK,MAAM,UAAU,CAAC,cAAc,gBAAgB,GAClD,MAAM,oBACJ,KACA;IAAE,eAAe,UAAU,IAAI,SAAS;IAAS;GAAO,GACxD,IAAI,SAAS,QACb,+BAA+B,QACjC;GAEF,MAAM,OAAO,SAAS;GACtB,MAAM,UAAU,MAAM,QAAQ,iBAAkB,KAAK,iBAAiB;IACpE,QAAQ;IACR,QAAQ;GACV,CAAC;GACD,KAAK,MAAM,UAAU,SACnB,UACE,QACA,mDACF;GAEF,OAAO,MACL,SAAS,SAAS,MAClB,GACA,wBAAwB,SAAS,SAAS,KAAK,+BAA+B,gBAAgB,OAAO,UACvG;EACF,CAAC;CACH,GACA,SACF;CACA,IACE,0BACA,yHACA,OAAO,QACJ,MAAM,gBAAgB,KACvB,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EACvC,KAAK,MAAM,CAAC,OAAO,SAAS,CAC1B,CAAC,OAAO,MAAM,GACd,CAAC,IAAI,SAAS,OAAO,OAAO,CAC9B,GACE,MAAM,mBACJ,KACA;GACE,QAAQ,IAAI,SAAS;GACrB,eAAe,UAAU;GACzB,QAAA;EACF,GACA,KACA,kBACA,mBAAmB,KAAK,uCAC1B;CAEJ,CAAC,GACH,SACF;CACA,OACE,+BACA,kHACA,YAAY;EACV,MAAM,OAAO,MAAM,gBAAgB;EACnC,IAAI,MACF,OAAO;EAET,MAAM,MAAM,MAAM,eAAe,EAAE,SAAS,eAAe,CAAC;EAC5D,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;GAC7C,MAAM,oBACJ,KACA;IAAE,QAAQ,IAAI,SAAS;IAAQ;IAAM,QAAQ;GAAa,GAC1D,IAAI,SAAS,QACb,gCACF;GACA,MAAM,mBACJ,KACA;IAAE,QAAQ,IAAI,SAAS;IAAQ;IAAM,QAAQ;GAAiB,GAC9D,KACA,kBACA,+BACF;EACF,CAAC;CACH,GACA,SACF;CACA,OACE,8BACA,0JACA,YAAY;EACV,MAAM,OAAO,MAAM,gBAAgB;EACnC,IAAI,MACF,OAAO;EAET,MAAM,QAAQ;GACZ;GACA,QAAQ;GACR,oBAAoB,IAAI,IAAI,gBAAgB,CAAC,CAAC;GAC9C,qBAAqB;EACvB;EACA,KAAK,MAAM,WAAW,CAAC,gBAAgB,KAAA,CAAS,GAC9C,KAAK,MAAM,uBAAuB,CAAC,OAAO,IAAI,GAAG;GAC/C,MAAM,MAAM,MAAM,eAAe;IAC/B;IACA,UAAU,EAAE,oBAAoB;GAClC,CAAC;GACD,MAAM,QAAQ,GAAG,UAAU,YAAY,QAAQ,gCAAgC;GAC/E,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;IAC7C,MAAM,mBACJ,KACA;KAAE,QAAQ,IAAI,SAAS;KAAQ,GAAG;IAAM,GACxC,KACA,kBACA,GAAG,MAAM,yBACX;IACA,MAAM,oBACJ,KACA;KAAE,QAAQ,IAAI,SAAS;KAAQ;KAAM,QAAQ;IAAa,GAC1D,IAAI,SAAS,QACb,GAAG,MAAM,0BACX;GACF,CAAC;EACH;CAEJ,GACA,SACF;CACA,OACE,wCACA,iIACA,YAAY;EACV,MAAM,OAAO,MAAM,gBAAgB;EACnC,IAAI,MACF,OAAO;EAET,MAAM,WAAoC,CAAC;EAC3C,IAAI;EACJ,MAAM,MAAM,MAAM,eAAe,EAC/B,iBAAiB,YAAsB;GACrC,SAAS,KAAK,OAAO;GACrB,IAAI,QACF,MAAM;GAER,OAAO,CAAC,uBAAuB;EACjC,EACF,CAAC;EACD,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;GAC7C,MAAM,UAAU;IACd,QAAQ,IAAI,SAAS;IACrB;IACA,QAAQ;GACV;GACA,MAAM,OAAO,SAAS;GACtB,MAAM,oBACJ,KACA,SACA,IAAI,SAAS,QACb,mDACF;GACA,MAAM,WAAW,SAAS,MAAM,IAAI;GACpC,OAAO,GAAG,SAAS,SAAS,GAAG,iCAAiC;GAChE,KAAK,MAAM,WAAW,UAAU;IAC9B,OAAO,GACL,mBAAmB,SACnB,sCACF;IACA,OAAO,MACL,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,QACrB,cACA,6BAA6B,QAAQ,IAAI,mCAC3C;GACF;GACA,MAAM,SAAS,0BAA0B,WAAW,OAAO,WAAW;GACtE,SAAS,IAAI,MAAM,MAAM;GACzB,IAAI;IACF,MAAM,UAAU,MAAM,QAAQ,iBAC5B,KACA,iBACA,OACF;IACA,KAAK,MAAM,CAAC,OAAO,WAAW,QAAQ,QAAQ,GAAG;KAC/C,SACE,QACA,gCAAgC,gBAAgB,QAClD;KACA,OAAO,GACL,CAAC,KAAK,UAAU,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,GACnD,2CACF;IACF;IACA,IAAI,yBAAyB,GAAG,GAAG;KACjC,MAAM,aAAa,MAAM,QAAQ,uBAC/B,KACA,OACF;KACA,SACE,YACA,6DACF;KACA,OAAO,GACL,CAAC,KAAK,UAAU,WAAW,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,GACvD,8DACF;IACF;GACF,UAAU;IACR,SAAS,KAAA;GACX;EACF,CAAC;CACH,GACA,SACF;CACA,MAAM,gBAAgB,QAAQ,kBAAkB,SAAS,eAAe,IACpE,KAAA,IACA;CACJ,MAAM,aAAa,KAAuB,YACxC,QAAQ,YACN,KACA,iBACA,CAAC,EAAE,OAAO,QAAQ,GAAG,EAAE,OAAO,SAAS,CAAC,GACxC,OACF;CACF,MAAM,qBAAqB,OACzB,KACA,SACA,OACA,qBACG;EACH,KAAK,MAAM,CAAC,OAAO,YAAY,MAAM,UAAU,KAAK,OAAO,EAAA,CAAG,QAAQ,GAAG;GACvE,OAAO,MAAM,OAAO,IAAI,OAAO,GAAG,MAAM,iBAAiB,QAAQ,GAAG;GACpE,OAAO,MACL,OAAO,OAAO,QACd,kBACA,GAAG,MAAM,iBAAiB,QAAQ,EAAE,IAAI,KAAK,UAAU,OAAO,KAAK,GACrE;EACF;EACA,MAAM,WAA0B,CAAC,YAAY,QAAQ;EACrD,MAAM,UAAU,MAAM,QAAQ,iBAC5B,KACA,UACA,SACA,mBAAmB,EAAE,iBAAiB,IAAI,KAAA,CAC5C;EACA,KAAK,MAAM,CAAC,OAAO,WAAW,QAAQ,QAAQ,GAC5C,OAAO,QAAQ,KAAK,kBAAkB,GAAG,MAAM,IAAI,SAAS,QAAQ;CAExE;CACA,IACE,8BACA,uHACA,OAAO,QAAQ;EACb,OAAO,GACL,QAAQ,kBACR,mEACF;EACA,MAAM,QAAQ,MAAM,YAAY,IAAI,IAAI;EACxC,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;GAC7C,KAAK,MAAM,CAAC,SAAS,UAAU,CAC7B,CAAC,OAAO,GAAG,GAAG,mBAAmB,GACjC,CACE,EAAE,eAAe,UAAU,IAAI,SAAS,QAAQ,GAChD,iCACF,CACF,GACE,OAAO,WACJ,MAAM,UAAU,KAAK,OAAO,EAAA,CAAG,KAAK,WAAW,OAAO,EAAE,GACzD,CAAC,MAAM,IAAI,GACX,GAAG,MAAM,wCACX;GAEF,OAAO,WACJ,MAAM,UAAU,KAAK,CAAC,CAAC,EAAA,CAAG,KAAK,WAAW,OAAO,EAAE,GACpD,CAAC,OAAO,KAAK,GACb,sDACF;GAEA,MAAM,CAAC,YAAY,MAAM,QAAQ,iBAC/B,KACA,CAAC,UAAU,GACX,OAAO,GAAG,GACV,EAAE,kBAAkB,EAAE,QAAQ,MAAM,OAAO,EAAE,CAC/C;GACA,UAAU,UAAW,2BAA2B;GAChD,OAAO,MACL,YAAY,QAAS,CAAC,EAAE,QACxB,MAAM,QACN,mFACF;EACF,CAAC;CACH,GACA,aACF;CACA,IACE,yBACA,uJACA,OAAO,QAAQ;EACb,OAAO,GACL,QAAQ,kBACR,mEACF;EACA,MAAM,QAAQ,MAAM,YAAY,IAAI,IAAI;EACxC,MAAM,UAAU;GAAE,QAAQ,IAAI,SAAS;GAAQ,QAAQ;EAAiB;EACxE,MAAM,WAAW,QAAQ,mBAAmB,CAAC;EAC7C,KAAK,MAAM,kBAAkB,CAC3B,KAAA,GACA,GAAI,SAAS,SAAS,OAAO,IAAK,CAAC,OAAO,IAAc,CAAC,CAC3D,GAAG;GACD,MAAM,QAAQ,iBACV,KAAK,eAAe,oBACpB;GACJ,MAAM,QACJ,SACA,KACA,OAAO,EAAE,UAAU;IACjB,MAAM,mBACJ,KACA,SACA,GAAG,MAAM,sBACX;IAEA,MAAM,mBACJ,KACA,SACA,GAAG,MAAM,uDACT,EAAE,QAAQ,MAAM,OAAO,CACzB;IACA,MAAM,oBACJ,KACA,OAAO,GAAG,GACV,IAAI,SAAS,QACb,GAAG,MAAM,mBACX;GACF,GACA,iBAAiB,EAAE,eAAe,IAAI,CAAC,CACzC;EACF;EACA,IAAI,SAAS,SAAS,eAAe,GACnC,MAAM,QACJ,SACA,KACA,OAAO,EAAE,KAAK,aAAa;GACzB,MAAM,UAAU,MAAM,QAAQ,iBAC5B,KACA,CAAC,YAAY,QAAQ,GACrB,OAAO,GAAG,CACZ;GACA,KAAK,MAAM,UAAU,SACnB,SACE,QACA,kDACF;GAEF,OAAO,MAAM,OAAO,KAAK,GAAG,8BAA8B;EAC5D,GACA,EAAE,gBAAgB,gBAAgB,CACpC;CAEJ,GACA,aACF;CACA,IACE,gDACA,4IACA,OAAO,QAAQ;EACb,OAAO,GACL,QAAQ,kBACR,mEACF;EACA,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;GAE7C,MAAM,mBACJ,KACA;IACE,QAAQ,IAAI,SAAS;IACrB,QAAQ;IACR,eAAe;GACjB,GACA,wCACA,EAAE,eAAe,aAAa,CAChC;EACF,CAAC;CACH,GACA,aACF;CACA,IAAI,iBAAiB,2CAA2C,QAC9D,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EACvC,MAAM,kBAAkB,MAAM,QAAQ,OAAO,KAAK,YAAY,CAAC,CAAC;EAChE,OAAO,iBAAiB,GAAG;EAC3B,OAAO,MAAM,gBAAgB,OAAO,MAAM,iBAAiB;EAC3D,MAAM,YAAY,MAAM,QAAQ,OAAO,KAAK,aAAa,OAAO,GAAG,CAAC;EACpE,OAAO,WAAW,KAAK,oBAAoB;EAC3C,OAAO,MAAM,UAAU,OAAO,MAAM,WAAW;EAC/C,MAAM,UAAU,MAAM,QAAQ,OAAO,KAAK,iBAAiB,EACzD,aAAa,IAAI,KAAK,QACxB,CAAC;EACD,OAAO,SAAS,KAAK,cAAc;EACnC,OAAO,MAAM,QAAQ,OAAO,MAAM,cAAc;EAIhD,OAAO,MAHe,QAAQ,OAAO,KAAK,iBAAiB,EACzD,aAAa,UACf,CAAC,GACe,KAAK,iBAAiB;CACxC,CAAC,CACH;CACA,IAAI,kBAAkB,oCAAoC,QACxD,QAAQ,SAAS,KAAK,OAAO,EAAE,KAAK,aAAa;EAC/C,MAAM,QAAQ,OAAO,KAAK,YAAY,CAAC,CAAC;EACxC,MAAM,QAAQ,OAAO,KAAK,aAAa,OAAO,GAAG,CAAC;EAClD,MAAM,QAAQ,OAAO,KAAK,iBAAiB,EACzC,aAAa,IAAI,KAAK,QACxB,CAAC;EACD,OAAO,UACL,OAAO,OAAO,CAAC,CAAC,KAAK,UAAU,MAAM,KAAK,MAAM,GAAG,GAAG,CAAC,GACvD,CAAC,CACH;CACF,CAAC,CACH;CACA,IACE,eACA,8DACC,QACC,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EACvC,IAAI,MAAM,qCAAqB,IAAI,MAAM,oBAAoB;EAC7D,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,YAAY,OAAO,GAAG,CAAC;EAChE,IAAI,MAAM,eAAe,KAAA;EACzB,SAAS,MAAM;EACf,OAAO,SAAS,OAAO,OAAO,YAAY,GAAG;EAC7C,OAAO,SAAS,OAAO,OAAO,YAAY,GAAG;CAC/C,CAAC,CACL;CACA,IACE,4BACA,8EACA,OAAO,QAAQ;EACb,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,KAAK,aAAa;GACrD,MAAM,SAAS,UAAU,WAAW,OAAO,WAAW;GACtD,IAAI,MAAM,SAAS,SACjB,SAAS,iBAAiB,IAAI,MAAM,MAAM,IAAI,KAAA;GAChD,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,YAAY,OAAO,GAAG,CAAC;GAChE,SAAS,MAAM;GACf,OAAO,GACL,CAAC,KAAK,UAAU,OAAO,KAAK,CAAC,CAAC,SAAS,MAAM,GAC7C,0CACF;GACA,OAAO,GAAG,OAAO,OAAO,CAAC,CAAC,SAAS,GAAG,6BAA6B;EACrE,CAAC;EACD,IAAI,MAAM,QAAQ,KAAA;EAClB,MAAM,QACJ,SACA,KACA,OAAO,EAAE,KAAK,aAAa;GACzB,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,aAAa,OAAO,GAAG,CAAC;GACjE,SAAS,MAAM;GACf,MAAM,SAAS,KAAK,UAAU,OAAO,SAAS,CAAC,CAAC;GAChD,OAAO,GAAG,CAAC,OAAO,SAAS,WAAW,GAAG,cAAc,QAAQ;GAC/D,OAAO,GAAG,CAAC,OAAO,SAAS,gBAAgB,GAAG,cAAc,QAAQ;GACpE,OAAO,MAAM,OAAO,KAAK,GAAG,gBAAgB;EAC9C,GACA,EACE,WAAW,YACT,kBAAkB,SAAS,EAAE,mBAAmB,KAAK,CAAC,EAC1D,CACF;CACF,CACF;CACA,IACE,gCACA,4EACA,OAAO,QACJ,MAAM,WAAW,GAAG,KACrB,QAAQ,SAAS,KAAK,OAAO,EAAE,KAAK,aAAa;EAC/C,MAAM,UAAU,QAAQ,oBAAoB,CAAC,EAAA,CAAG,QAC7C,UAAU,UAAU,aAAa,UAAU,SAC9C;EACA,KAAK,MAAM,SAAS,QAAQ;GAC1B,MAAM,SAAS,OAAO,OAAO,CAAC,CAAC;GAC/B,IAAI,MAAM,SAAS,SACjB,SAAS,iCACL,IAAI,MAAM,oBAAoB,IAC9B,KAAA;GACN,MAAM,UAAU,MAAM,QAAQ,YAC5B,KACA,OACA,CAAC,EAAE,OAAO,QAAQ,GAAG,EAAE,OAAO,SAAS,CAAC,GACxC,OAAO,GAAG,CACZ;GACA,IAAI,MAAM,QAAQ,KAAA;GAClB,OAAO,UACL,QAAQ,KAAK,UAAU,MAAM,EAAE,GAC/B,CAAC,OAAO,KAAK,CACf;GACA,OAAO,MACL,OAAO,OAAO,CAAC,CAAC,SAAS,QACzB,GACA,GAAG,MAAM,IAAI,OAAO,OAAO,CAAC,CAAC,SAAS,OAAO,+BAC/C;EACF;CACF,CAAC,GACH,aACE,4EACJ;CACA,IACE,gCACA,sJACA,OAAO,QAAQ;EACb,MAAM,OAAO,MAAM,WAAW,GAAG;EACjC,IAAI,MACF,OAAO;EAET,MAAM,SAAS,EAAE,aAAa,IAAI,KAAK,MAAM;;EAE7C,MAAM,QAAQ,OACZ,KACA,QACA,QACA,SACA,UACsB;GACtB,MAAM,OAAO,OAAO,OAAO,CAAC,CAAC;GAC7B,MAAM,SAAS,MAAM,QAAQ,YAC3B,KACA,CAAC;IAAE,MAAM;IAAS;GAAO,CAAC,GAC1B,OACF;GACA,MAAM,OAAQ,OAAO,MAAyC;GAI9D,OAAO,MACL,MAAM,QACN,YACA,GAAG,MAAM,kCAAkC,WAAW,UAAU,KAAK,UAAU,MAAM,CAAC,CAAC,MAAM,GAAG,GAAG,GACrG;GACA,KAAK,MAAM,SAAS,QAAQ;IAC1B,MAAM,SAAS,OAAO,OAAO,QAC1B,UAAU,MAAM,KAAK,GAAG,EAAE,MAAM,KACnC;IACA,OAAO,MACL,OAAO,QACP,YACA,GAAG,MAAM,IAAI,OAAO,OAAO,GAAG,MAAM,mCAAmC,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC,MAAM,GAAG,GAAG,GACnH;IACA,OAAO,GACL,KAAM,OAAO,SAAS,KAAK,WAAW,IAAI,GAC1C,GAAG,MAAM,MAAM,MAAM,gBACvB;IACA,KAAK,MAAM,SAAS,QAClB,OAAO,GACL,CAAC,iBAAiB,KAAK,MAAM,WAAW,EAAE,GAC1C,GAAG,MAAM,4CAA4C,MAAM,SAC7D;GAEJ;GACA,OAAO,MACL,OAAO,OAAO,QACd,aAAa,OAAO,QACpB,GAAG,MAAM,IAAI,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC,MAAM,GAAG,GAAG,GACzD;GACA,OAAO,OACJ,OAAO,CAAC,CACR,MAAM,IAAI,CAAC,CACX,KAAK,UAAU,MAAM,IAAI;EAC9B;EACA,MAAM,QAAQ,SAA4B,MAAc,UACtD,OAAO,GACL,QAAQ,WAAW,KAAK,QAAQ,EAAE,CAAE,SAAS,IAAI,GACjD,GAAG,MAAM,kCAAkC,KAAK,QAAQ,QAAQ,OAAO,IAAI,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,GAC7G;EAEF,KAAK,MAAM,aAAa,CACtB;GAAC;GAAU;GAAgB;EAAS,GACpC,CAAC,UAAU,SAAS,CACtB,GAAY;GACV,MAAM,SAAS,UAAU,SAAS,cAAuB;GACzD,MAAM,OAAO,IAAI,UAAU,KAAK,IAAI,EAAE;GACtC,MAAM,QACJ,SACA,KACA,OAAO,EAAE,KAAK,aAAa;IAEzB,KAAK,MAAM,SAAS,CAAC,GAAG,CAAC,GAAG;KAC1B,MAAM,QAAQ,GAAG,KAAK,YAAY;KAClC,KACE,MAAM,MACJ,KACA,QACA,CAAC,eAAe,GAChB,QACA,GAAG,MAAM,+BACX,GACA,oBACA,GAAG,MAAM,+BACX;KACA,KACE,MAAM,MACJ,KACA,QACA,CAAC,oBAAoB,GACrB,OAAO,GAAG,GACV,GAAG,MAAM,uDACX,GACA,uBACA,GAAG,MAAM,uDACX;KACA,MAAM,UAAU,MAAM,MACpB,KACA,QACA,CAAC,gBAAgB,GACjB,QACA,GAAG,MAAM,sCACX;KAEA,MAAM,OAAO,SAAS,qBAAqB;KAC3C,OAAO,MACL,QAAQ,QACR,SAAS,IAAI,YACb,GAAG,MAAM,gCAAgC,QAAQ,OAAO,eAC1D;KACA,OAAO,GACL,QAAQ,OAAO,UAAU,MAAM,SAAS,IAAI,CAAC,GAC7C,GAAG,MAAM,qCAAqC,KAAK,IAAI,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,GACzF;IACF;IAEA,MAAM,WAAW,MAAM,MACrB,KACA,QACA,CAAC,iBAAiB,oBAAoB,GACtC,QACA,GAAG,KAAK,4CACV;IACA,OAAO,MACL,SAAS,QACT,GACA,GAAG,KAAK,uBAAuB,SAAS,OAAO,kBAAkB,SAAS,KAAK,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,GACpG;IACA,KAAK,MAAM,QAAQ,CAAC,oBAAoB,qBAAqB,GAC3D,OAAO,GACL,SAAS,MAAM,UAAU,MAAM,SAAS,IAAI,CAAC,GAC7C,GAAG,KAAK,IAAI,KAAK,kCACnB;GAEJ,GACA;IACE,wBAAwB;IACxB,UAAU,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,CAAC;GACtD,CACF;GAGA,IAAI,CAAC,QACH;GAEF,MAAM,QACJ,SACA,KACA,OAAO,EAAE,KAAK,aAAa;IACzB,KACE,MAAM,MACJ,KACA,QACA,CAAC,QAAQ,GACT,OAAO,GAAG,GACV,GAAG,KAAK,2CACV,GACA,kBACA,GAAG,KAAK,2CACV;GACF,GACA;IACE,wBAAwB;IACxB,UAAU,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,KAAK,CAAC;IACpD,WAAW,YACT,kBAAkB,SAAS,EAAE,mBAAmB,KAAK,CAAC;GAC1D,CACF;EACF;CACF,GACA,SACF;CACA,IAAI,sBAAsB,2CAA2C,QACnE,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EACvC,MAAM,OAAO,IAAI,MAAM,MAAM;EAC7B,UAAU,MAAM,QAAQ,OAAO,KAAK,UAAU,OAAO,GAAG,CAAC,CAAC;EAC1D,OAAO,MAAM,aAAa,IAAI,OAAO,IAAI,GAAG,CAAC;CAC/C,CAAC,CACH;CACA,IACE,mBACA,2IACA,OAAO,QAAQ;EACb,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,KAAK,aAAa;GACrD,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,gBAAgB,OAAO,GAAG,CAAC;GACpE,UAAU,MAAM;GAChB,OAAO,MACJ,OAAO,KAA6B,QACrC,IAAI,SAAS,MACf;GAEA,OAAO,GACL,aAAa,MAAM,CAAC,CAAC,IAAI,6BAA6B,GACtD,kDAAkD,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,GAC9E;GACA,MAAM,UAAU,MAAM,QAAQ,OAC5B,KACA,uBACA,OAAO,GAAG,CACZ;GACA,UAAU,SAAS,+CAA+C;GAClE,OAAO,MACJ,QAAQ,KAA6B,QACtC,IAAI,SAAS,MACf;GAIA,SAAS,MAHS,QAAQ,OAAO,KAAK,uBAAuB,EAC3D,aAAa,IAAI,KAAK,MACxB,CAAC,CACW;GACZ,OAAO,MAAM,OAAO,KAAK,GAAG,kBAAkB;EAChD,CAAC;EACD,MAAM,kBACJ,SACA,KACA,EACE,UAAU,YAAY,EACpB,cAAc,CAAC,iBAAiB,cAAc,YAAY,CAAC,EAC7D,CAAC,EACH,GACA,0BACF;EACA,MAAM,kBACJ,SACA,KACA,EAAE,qBAAqB,CAAC,YAAY,EAAE,GACtC,0BACF;CACF,CACF;CACA,IACE,WACA,0DACC,QACC,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EACvC,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,gBAAgB,OAAO,GAAG,CAAC;EACpE,UAAU,MAAM;EAChB,OAAO,UAAU,OAAO,MAAM;GAC5B,QAAQ,IAAI,SAAS;GACrB,SAAS,IAAI,SAAS;EACxB,CAAC;CACH,CAAC,CACL;CACA,IACE,aACA,8GACA,OAAO,QAAQ;EACb,KAAK,MAAM,eAAe,CAAC,MAAM,KAAK,GAAG;GACvC,MAAM,QAAQ,cACV,+BACA;GACJ,MAAM,QACJ,SACA,KACA,OAAO,EAAE,UAAU;IACjB,MAAM,WAAW,MAAM,QAAQ,OAAO,KAAK,YAAY,OAAO,GAAG,CAAC;IAClE,UAAU,UAAU,GAAG,MAAM,WAAW;IACxC,OAAO,UAAU,YAAY,QAAQ,GAAG;KACtC,MAAM;KACN,QAAQ,IAAI,SAAS;IACvB,CAAC;IACD,MAAM,QAAQ,MAAM,QAAQ,OAAO,KAAK,iBAAiB,EACvD,aAAa,IAAI,KAAK,MACxB,CAAC;IACD,UAAU,OAAO,GAAG,MAAM,aAAa;IACvC,OAAO,MAAM,YAAY,KAAK,CAAC,EAAE,MAAM,WAAW,KAAK;IACvD,MAAM,MAAM,MAAM,QAAQ,OAAO,KAAK,OAAO,OAAO,GAAG,GAAG,EACxD,OAAO,QACT,CAAC;IACD,UAAU,KAAK,GAAG,MAAM,0BAA0B;IAClD,OAAO,UAAU,IAAI,MAAM,EAAE,cAAc,QAAQ,GAAG,KAAK;IAE3D,KAAK,MAAM,SAAS,QAAQ,oBAAoB,CAAC,GAAG;KAClD,MAAM,SAAS,MAAM,QAAQ,YAC3B,KACA,OACA,CAAC,EAAE,OAAO,QAAQ,GAAG,EAAE,OAAO,SAAS,CAAC,GACxC,OAAO,GAAG,CACZ;KACA,OAAO,UACL,OAAO,KAAK,UAAU,MAAM,EAAE,GAC9B,CAAC,MAAM,IAAI,GACX,GAAG,MAAM,IAAI,MAAM,IAAI,KAAK,UAAU,MAAM,GAC9C;IACF;GACF,GACA,cAAc,CAAC,IAAI,EAAE,aAAa,MAAM,CAC1C;EACF;CACF,CACF;CACA,IACE,qBACA,4IACA,OAAO,QAAQ;EACb,IAAI,SAA0B,CAAC;EAC/B,MAAM,2BAAW,IAAI,IAAoB;EACzC,MAAM,WAAW,IAAI,gBAAgB;EACrC,MAAM,QACJ,SACA,KACA,OAAO,EAAE,UAAU;GACjB,SAAS,MAAM,aAAa,KAAK,QAAQ,SAAS;GAClD,MAAM,UAAU,IAAI,IAAkB,eAAe,EACnD,QAAQ,MACV,CAAC;GACD,KAAK,MAAM,SAAS,QAAQ;IAC1B,IACE,CAAC,MAAM,WACP,MAAM,WAAW,KAAA,MAChB,MAAM,QAAQ,YAAY,aAAa,SAExC;IAEF,MAAM,OAAkB,QAAQ,KAC9B,MAAM,QACN,MAAM,MACR;IAIA,IACE,GAHC,KAAK,WAAW,YAAY,KAAK,WAAW,cAC7C,KAAK,gBAAgB,YAGpB,MAAM,QAAQ,gBAAgB,KAAK,WAEpC,SAAS,IAAI,MAAM,SAAS,MAAM,QAAQ,IAAI;GAElD;EACF,GACA,EAAE,YAAY,KAAK,GACnB,QACF;EACA,OAAO,GACL,OAAO,MAAM,UAAU,MAAM,OAAO,GACpC,0DACF;EACA,OAAO,MACL,YAAY,QAAQ,GACpB,oBACA,yEACF;EAGA,MAAM,OAAO,MAAM,aACjB,QAAQ,SAAS,KAAK,YAAY,KAAA,GAAW,EAAE,aAAa,MAAM,CAAC,CACrE;EACA,OAAO,MACL,KAAK,IACL,SAAS,SAAS,GAClB,KAAK,KACD,gEAAgE,KAAK,UAAU,CAAC,GAAG,QAAQ,CAAC,MAC5F,0DAA0D,OAAO,KAAK,KAAK,GACjF;EACA,MAAM,SAAW,CAAC,KAAK,MACpB,KAAK,OAA4C,UAClD,CAAC;EACH,MAAM,2BAAW,IAAI,IAAoB;EACzC,KAAK,MAAM,SAAS,QAAQ;GAC1B,IAAI,CAAC,MAAM,WAAW,MAAM,WAAW,KAAA,GACrC;GAEF,MAAM,OAAO,GAAG,MAAM,OAAO,KAAK,GAAG,MAAM,OAAO;GAClD,MAAM,QAAQ,OAAO,MAAM,UACzB,OAAO,MAAM,UAAU,EAAE,CAAC,CAAC,WAAW,IAAI,CAC5C;GACA,IAAI,OAAO,MACT,SAAS,IAAI,MAAM,SAAS,MAAM,IAAI;EAE1C;EACA,OAAO,UACL,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,GACnB,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,GACnB,gBAAgB,KAAK,UAAU,CAAC,GAAG,QAAQ,CAAC,EAAE,wBAAwB,KAAK,UAAU,CAAC,GAAG,QAAQ,CAAC,GACpG;EACA,IACE,OAAO,MACJ,UACC,MAAM,YAAY,iBACjB,MAAM,QAAQ,YAAY,aAAa,OAC5C,GAEA,OAAO,GACL,SAAS,IAAI,YAAY,GACzB,yDACF;EAEF,KAAK,MAAM,QAAQ,CAAC,UAAU,eAAe,GAC3C,OAAO,GAAG,CAAC,SAAS,IAAI,IAAI,GAAG,GAAG,KAAK,cAAc;EAEvD,IAAI,OAAO,MAAM,UAAU,MAAM,WAAW,MAAM,UAAU,UAAU,GACpE,MAAM,kBACJ,SACA,KACA;GACE,aAAa;GACb,UAAU,YAAY,CAAC,GAAG,CAAC,UAAU,eAAe,CAAC,CAAC;EACxD,GACA,kBACF;EAEF,MAAM,QAAQ,SAAS,KAAK,YAAY,KAAA,GAAW;GACjD,aAAa;GACb,UAAU,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;EAC7C,CAAC;EACD,MAAM,SAAS,OAAO,MACnB,UAAU,MAAM,WAAW,MAAM,UAAU,QAC9C;EACA,IAAI,QACF,MAAM,QAAQ,SAAS,KAAK,YAAY,KAAA,GAAW;GACjD,aAAa;GACb,cAAc;EAChB,CAAC;EAGH,MAAM,UAAU,EAAE,aAAa,YAAY,KAAK;EAChD,MAAM,QAAQ,SAAS,KAAK,YAAY,KAAA,GAAW,EACjD,WAAW,YACT,QAAQ,iBAAiB,eAAe,CAAC,CAAC,SAAS,OAAO,EAC9D,CAAC;EACD,MAAM,aAAa;GACjB,cAAuB;IACrB,OAAO;GACT;EACF;EACA,MAAM,QAAQ,SAAS,KAAK,YAAY,KAAA,GAAW,EACjD,WAAW,YACT,QAAQ,iBAAiB,eAAe,CAAC,CAAC,SAAS,YAAY,EACnE,CAAC;EACD,IAAI,QAAQ;GACV,MAAM,WAAW,IAAI,gBAAgB;GACrC,MAAM,QACJ,SACA,KACA,YAAY,KAAA,GACZ;IAAE,aAAa;IAAO,YAAY;GAAK,GACvC,QACF;GACA,MAAM,QAAQ,CAAC,GAAG,aAAa,QAAQ,CAAC,CAAC,CAAC,QACvC,SAAS,CAAC,aAAa,QAAQ,CAAC,CAAC,IAAI,IAAI,CAC5C;GACA,OAAO,UACL,OACA,CAAC,mBAAmB,GACpB,+GAA+G,SAAS,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,GAC7I;GAEA,OAAO,MACL,YAAY,QAAQ,GACpB,yCACA,iEACF;EACF;CACF,CACF;CACA,IACE,qBACA,oIACC,QACC,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EAEvC,MAAM,SAAS,MAAM,aAAa,KAAK,QAAQ,SAAS;EACxD,OAAO,GACL,OAAO,MAAM,UAAU,MAAM,OAAO,GACpC,0DACF;EACA,MAAM,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC,IAC/D,eACF;EACA,MAAM,QAAQ,MAAM,aAAa,KAAK,QAAQ,WAAW,EACvD,SAAS,OACX,CAAC;EACD,OAAO,UACL,MACG,QAAQ,UAAU,OAAO,SAAS,MAAM,MAAM,CAAC,CAAC,CAChD,KAAK,UAAU,GAAG,MAAM,OAAO,KAAK,GAAG,OAAO,MAAM,MAAM,GAAG,GAChE,CAAC,GACD,gDACF;EACA,MAAM,UAAU,MAAM,aACpB,aAAa,KAAK,QAAQ,WAAW,EAAE,gBAAgB,KAAK,CAAC,CAC/D;EACA,OAAO,MACL,QAAQ,IACR,OACA,yGACF;EACA,OAAO,GACL,eAAe,CAAC,QAAQ,MAAM,QAAQ,KAAK,CAAC,CAAC,SAC3C,2BACF,GACA,2CAA2C,OAAO,CAAC,QAAQ,MAAM,QAAQ,KAAK,GAChF;CACF,CAAC,CACL;CACA,IACE,yBACA,2EACA,OAAO,QAAQ;EACb,MAAM,kBACJ,SACA,KACA;GACE,qBAAqB,CAAC,WAAW;GACjC,UAAU,YAAY,EAAE,eAAe,CAAC,QAAQ,UAAU,CAAC,EAAE,CAAC;EAChE,GACA,+BACF;EACA,MAAM,kBACJ,SACA,KACA;GACE,qBAAqB,CAAC,YAAY;GAClC,UAAU,YAAY,EAAE,eAAe,CAAC,QAAQ,UAAU,CAAC,EAAE,CAAC;EAChE,GACA,+BACF;EACA,MAAM,QACJ,SACA,KACA,OAAO,EAAE,UAAU;GACjB,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,iBAAiB,EACxD,aAAa,IAAI,KAAK,MACxB,CAAC;GACD,UAAU,MAAM;GAChB,OAAO,MAAM,YAAY,MAAM,CAAC,EAAE,MAAM,SAAS;EACnD,GACA;GACE,qBAAqB,CAAC,WAAW;GACjC,UAAU,YAAY,EACpB,eAAe,CAAC,QAAQ,UAAU,GAAG,wBAAwB,CAAC,EAChE,CAAC;EACH,CACF;CACF,CACF;CACA,IACE,yBACA,wEACC,QACC,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;EACvC,MAAM,OAAO,IAAI,MAAM,MAAM;EAC7B,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,iBAAiB;GACxD,GAAG,OAAO,GAAG;GACb,QAAQ;EACV,CAAC;EACD,UAAU,MAAM;EAChB,OAAO,UAAU,OAAO,MAAM,EAAE,SAAS,KAAK,CAAC;EAC/C,OAAO,MAAM,aAAa,IAAI,OAAO,IAAI,GAAG,CAAC;CAC/C,CAAC,CACL;CACA,OACE,sBACA,qIACA,YAAY;EACV,IAAI,WAAW;EACf,MAAM,QACJ,SACA,MAAM,eAAe,EAAE,SAAS,eAAe,CAAC,GAChD,OAAO,EAAE,UAAU;GACjB,WACE,kBAAkB,KAAK,QAAQ,SAAS,CAAC,CAAC,UACtC,kBAAkB;EAC1B,CACF;EACA,MAAM,MAAM,MAAM,eAAe,EAAE,SAAS,EAAE,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;EACtE,IAAI,UAAU;GACZ,MAAM,kBACJ,SACA,KACA,CAAC,GACD,mCACF;GACA;EACF;EACA,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;GAC7C,KAAK,MAAM,CAAC,SAAS,SAAS,SAAS;IACrC;KAAC;KAAY,OAAO,GAAG;KAAG;IAAS;IACnC;KACE;KACA,EAAE,eAAe,UAAU,IAAI,SAAS,QAAQ;KAChD;IACF;IACA;KAAC;KAAiB,EAAE,aAAa,IAAI,KAAK,MAAM;KAAG;IAAS;GAC9D,GAAY;IACV,MAAM,SAAS,MAAM,QAAQ,OAAO,KAAK,SAAS;KAChD,GAAG;KACH;IACF,CAAC;IACD,UAAU,QAAQ,KAAK,KAAK,eAAe,OAAO,KAAK,OAAO,EAAE,EAAE;IAClE,OAAO,UAAU,YAAY,MAAM,GAAG;KACpC;KACA,QAAQ,IAAI,SAAS;IACvB,CAAC;GACH;EACF,CAAC;CACH,CACF;CACA,IACE,mCACA,qGACA,OAAO,QAAQ;EACb,MAAM,OAAO,MAAM,YAAY,IAAI,MAAM,EAAE,UAAU,KAAK,CAAC;EAC3D,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,KAAK,sBAAsB;GAC9D,gBAAgB,SAAS,SAAS;GAClC,UAAU,MAAM,QAAQ,OAAO,KAAK,UAAU,OAAO,GAAG,CAAC,CAAC;GAC1D,UAAU,MAAM,QAAQ,OAAO,KAAK,iBAAiB,OAAO,GAAG,CAAC,CAAC;GACjE,OAAO,UACL,gBAAgB,UAChB,CAAC,GACD,mEACF;GACA,gBAAgB,cAAc;GAC9B,UAAU,MAAM,QAAQ,OAAO,KAAK,UAAU,OAAO,GAAG,CAAC,CAAC;GAE1D,SAAS,MADa,QAAQ,OAAO,KAAK,YAAY,OAAO,GAAG,CAAC,CACjD;GAChB,MAAM,UAAU,IAAI,MAAM,MAAM,QAC7B,SAAS,SAAS,gBACrB,CAAC,CAAC;GACF,MAAM,QAAQ,MAAM,QAAQ,OAC1B,KACA,cACA,EAAE,QAAQ,aAAa,GACvB;IAAE,OAAO,KAAK;IAAO,UAAU,KAAK;GAAS,CAC/C;GACA,SAAS,KAAK;GACd,OAAO,UAAU,MAAM,YAAY,CAAC,CAAC;GACrC,OAAO,MACL,IAAI,MAAM,MAAM,QAAQ,SAAS,SAAS,gBAAgB,CAAC,CAAC,QAC5D,SACA,6DACF;EACF,CAAC;CACH,CACF;CAGA,OACE,uBACA,4FACA,YAAY;EACV,KAAK,MAAM,SAAS,CAClB,CAAC,UAAU,QAAQ,GACnB,CAAC,UAAU,QAAQ,CACrB,GAAY;GAEV,MAAM,MAAM,MAAM,eAAe;GACjC,MAAM,QAAQ,SAAS,KAAK,OAAO,EAAE,UAAU;IAC7C,KAAK,IAAI,QAAQ,GAAG,QAAQ,GAAG,SAC7B,KAAK,MAAM,YAAY,OAAO;KAC5B,MAAM,QAAQ,GAAG,MAAM,KAAK,eAAe,EAAE,UAAU,QAAQ,EAAE,QAAQ,SAAS;KAClF,MAAM,SAAS,MAAM,QAAQ,gBAC3B,KACA,UACA,OAAO,GAAG,CACZ;KACA,IAAI,aAAa,UACf,UAAU,QAAQ,KAAK;UAEvB,OAAO,QAAQ,KAAK,sBAAsB,KAAK;IAEnD;GAEJ,CAAC;EACH;CACF,GACA,QAAQ,kBAAkB,KAAA,IAAY,mFACxC;CACA,OACE,mBACA,yHACA,YAAY;EACV,MAAM,MAAM,MAAM,eAAe;EACjC,IAAI,CAAE,MAAM,aAAa,SAAS,KAAK,kBAAkB,GACvD,OAAO,gBACL,kEACF;EAEF,MAAM,WAAW,QAAQ,mBAAmB,CAAC;EAC7C,OAAO,GACL,SAAS,SAAS,QAAQ,KAAK,SAAS,SAAS,QAAQ,GACzD,qFACF;EACA,MAAM,kBACJ,SACA,KACA,EAAE,gBAAgB,SAAS,GAC3B,wBACF;EAGA,MAAM,aAAa,MAAM,cAAc;EACvC,OAAO,GACL,CAAC,cAAc,QAAQ,kBACvB,4FACF;EACA,MAAM,cAAc,OAClB,KACA,SACA,YAEA,cACK,MAAM,QAAQ,iBAAkB,KAAK,CAAC,OAAO,GAAG,OAAO,EAAA,CAAG,KAC3D,QAAQ,OAAO,KAAK,SAAS,OAAO;EAC1C,MAAM,QAAQ,MAAM,YAAY,IAAI,IAAI;EACxC,MAAM,cAAc;GAAE,GAAG,OAAO,GAAG;GAAG,QAAQ,MAAM;EAAO;EAC3D,MAAM,QACJ,SACA,KACA,OAAO,EAAE,KAAK,aAAa;GACzB,MAAM,QAAQ,MAAM,YAAY,KAAK,YAAY,OAAO,GAAG,CAAC;GAC5D,UAAU,OAAO,sCAAsC;GACvD,OAAO,MAAM,YAAY,KAAK,CAAC,EAAE,QAAQ,IAAI,SAAS,MAAM;GAC5D,KAAK,MAAM,WAAW,CAAC,YAAY,UAAU,GAAY;IACvD,MAAM,SAAS,MAAM,YAAY,KAAK,SAAS,WAAW;IAC1D,MAAM,QAAQ,qBAAqB;IACnC,IAAI,YAAY;KAGd,OAAO,SACL,YAAY,MAAM,CAAC,EAAE,QACrB,IAAI,SAAS,QACb,GAAG,MAAM,mCACX;KACA,IAAI,OAAO,IAAI;MACb,MAAM,YAAY,YAAY,MAAM;MACpC,OAAO,GACL,cAAc,QAAQ,WAAW,WAAW,MAAM,QAClD,GAAG,MAAM,4CAA4C,KAAK,UAAU,OAAO,IAAI,GACjF;KACF,OACE,OAAO,QAAQ,KAAK,KAAA,GAAW,KAAK;KAEtC;IACF;IAEA,IAAI,OAAO,IACT,OAAO,MACL,YAAY,MAAM,CAAC,EAAE,QACrB,MAAM,QACN,GAAG,MAAM,gCACX;SACK;KACL,SAAS,QAAQ,KAAK;KACtB,OAAO,MAAM,OAAO,KAAK,GAAG,+BAA+B;IAC7D;GACF;GAEA,UACE,MAAM,YAAY,KAAK,UAAU,WAAW,GAC5C,oCACF;GACA,MAAM,UAAU,MAAM,YAAY,KAAK,iBAAiB,WAAW;GACnE,UAAU,SAAS,yCAAyC;GAC5D,OAAO,UAAU,QAAQ,MAAM,EAAE,SAAS,KAAK,CAAC;GAChD,IAAI,YAAY;IAEd,OAAO,UACL,OAAO,OAAO,CAAC,CAAC,KAAK,UAAU,MAAM,KAAK,MAAM,GAAG,GAAG,CAAC,GACvD,CAAC,GACD,iEACF;IACA,OAAO,aACL,OAAO,KAAK,GACZ,kDACF;GACF;EACF,GACA,EAAE,gBAAgB,SAAS,CAC7B;CACF,CACF;;CAEA,MAAM,aAAa,OAAO,QAA0B;EAClD,MAAM,wBAAQ,IAAI,IAA8C;EAChE,KAAK,MAAM,SAAS,MAAM,aAAa,KAAK,QAAQ,SAAS,GAC3D,IAAI,MAAM,SAAS,WAAW,QAAQ,KAAK,MAAM,WAAW,KAAA,GAC1D,MAAM,IAAI,MAAM,QAAQ,MAAM,CAAe,GAAG;GAC9C,QAAQ,MAAM;GACd,QAAQ,MAAM;EAChB,CAAC;EAGL,OAAO;CACT;CACA,MAAM,aACJ,OACA,SACG;EACH,MAAM,OAAO,MAAM,IAAI,IAAI;EAC3B,OAAO,GAAG,MAAM,4BAA4B,KAAK,eAAe;EAChE,OAAO;CACT;CACA,MAAM,UACJ,KACA,SAEA,IACG,IAAkB,eAAe,EAAE,QAAQ,MAAM,CAAC,CAAC,CACnD,KAAK,KAAK,QAAQ,KAAK,MAAM;;CAElC,MAAM,eAAe,QAAyB,SAC5C,OAAO,QACJ,KAAK,UAAU,MAAM,IAAI,CAAC,CAC1B,QAAQ,SAAS,KAAK,WAAW,GAAG,KAAK,EAAE,CAAC;CACjD,IACE,uBACA,gKACA,OAAO,QAAQ;EACb,MAAM,OAAO,MAAM,WAAW,GAAG;EACjC,IAAI,MACF,OAAO;EAET,KAAK,MAAM,aAAa,eAAe;GACrC,MAAM,UAAU,UAAU,SAAS;GACnC,MAAM,SAAS,IAAI,gBAAgB;GACnC,MAAM,QACJ,SACA,KACA,OAAO,EAAE,UAAU;IACjB,MAAM,OAAO,IAAI,MAAM,MAAM;IAC7B,MAAM,SAAS,MAAM,QAAQ,YAC3B,KACA,CAAC;KAAE,MAAM;KAAU,QAAQ,CAAC,OAAO;IAAE,CAAC,GACtC,CAAC,CACH;IACA,OAAO,UACL,OAAO,QACP,CAAC,GACD,IAAI,UAAU,KAAK,IAAI,EAAE,KAAK,KAAK,UAAU,OAAO,MAAM,GAC5D;IACA,OAAO,MACL,aAAa,IAAI,OAAO,IAAI,GAC5B,GACA,IAAI,UAAU,KAAK,IAAI,EAAE,wCAC3B;IACA,IAAI,SAAS;KACX,MAAM,QAAQ,MAAM,QAAQ,YAC1B,KACA,CAAC;MAAE,MAAM;MAAU,QAAQ,CAAC,SAAS;KAAE,CAAC,GACxC,CAAC,CACH;KACA,OAAO,GACL,MAAM,OAAO,SAAS,KACpB,MAAM,OAAO,OACV,UAAU,MAAM,SAAS,iBAC5B,GACF,uDAAuD,KAAK,UAAU,MAAM,MAAM,GACpF;IACF;IACA,MAAM,QAAQ,MAAM,WAAW,GAAG;IAClC,MAAM,CAAC,WAAW,YAAY,QAAQ,2BAA2B;IACjE,OAAO,GACL,SACA,IAAI,UAAU,KAAK,IAAI,EAAE,+CAC3B;IACA,MAAM,aAAa,QAAQ,MACzB,GACA,QAAQ,QAAQ,mBAAmB,CACrC;IACA,KAAK,MAAM,SAAS,CAAC,SAAS,QAAQ,GAAG;KACvC,MAAM,OAAO,UAAU,OAAO,KAAK;KACnC,OAAO,GACL,WAAW,SAAS,GAAG,KAAK,OAAO,KAAK,GAAG,KAAK,QAAQ,GACxD,2CAA2C,MAAM,IAAI,SACvD;IACF;GACF,GACA;IACE,wBAAwB;IACxB,UAAU,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC;GAC3C,GACA,MACF;EACF;EAEA,KAAK,MAAM,aAAa,eAAe;GACrC,MAAM,SAAS,IAAI,gBAAgB;GACnC,MAAM,QAAQ,mCAAmC,UAAU,KAAK,IAAI,EAAE;GACtE,MAAM,QACJ,SACA,KACA,OAAO,EAAE,UAAU;IACjB,MAAM,QAAQ,MAAM,WAAW,GAAG;IAClC,KAAK,MAAM,SAAS;KAAC;KAAS;KAAU;IAAe,GACrD,OAAO,MACL,OAAO,KAAK,UAAU,OAAO,KAAK,CAAC,CAAC,CAAC,QACrC,WACA,GAAG,MAAM,QAAQ,MAAM,sCACzB;IAEF,MAAM,OAAO,UAAU,OAAO,aAAa;IAC3C,OAAO,UACL,CAAC,GAAG,OAAO,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,GACpC,CAAC,cAAc,YAAY,GAC3B,GAAG,MAAM,0DACX;IACA,MAAM,OAAO,IAAI,MAAM,MAAM;IAC7B,MAAM,SAAS,MAAM,QAAQ,YAC3B,KACA,CAAC;KAAE,MAAM;KAAU,QAAQ,CAAC,SAAS,QAAQ;IAAE,CAAC,GAChD,CAAC,CACH;IACA,OAAO,UACL,OAAO,QACP,CAAC,GACD,GAAG,MAAM,IAAI,KAAK,UAAU,OAAO,MAAM,GAC3C;IACA,OAAO,MAAM,aAAa,IAAI,OAAO,IAAI,GAAG,GAAG,KAAK;IACpD,MAAM,CAAC,QAAQ,YACb,QACA,kCACF;IACA,OAAO,GACL,MAAM,SAAS,KAAK,OAAO,IAAI,GAC/B,GAAG,MAAM,mDAAmD,KAAK,OAAO,KAAK,IAAI,MACnF;IACA,KAAK,MAAM,SAAS,CAAC,SAAS,QAAQ,GACpC,OAAO,GACL,KAAK,SAAS,UAAU,OAAO,KAAK,CAAC,CAAC,MAAM,GAC5C,GAAG,MAAM,uDAAuD,MAAM,UAAU,MAClF;GAEJ,GACA;IACE,wBAAwB;IACxB,UAAU,YAAY,CAAC,GAAG,CAAC,GAAG;KAC5B,SAAS,UAAU,SAAS;KAC5B,iBAAiB,CAAC,iBAAiB,cAAc,YAAY,CAAC;IAChE,CAAC;GACH,GACA,MACF;EACF;CACF,GACA,SACF;CACA,IACE,oBACA,2FACA,OAAO,QAAQ;EACb,MAAM,OAAO,MAAM,WAAW,GAAG;EACjC,IAAI,MACF,OAAO;EAGT,IAAI,KAAK,SAAS,MAAM,YAAY,IAAI,IAAI,EAAA,CAAG;EAC/C,MAAM,QAAQ,IAAI,SAAS;EAC3B,MAAM,UAAU;GAAE,GAAG,OAAO,GAAG;GAAG,aAAa,IAAI,KAAK;EAAM;EAC9D,KAAK,MAAM,aAAa,eAAe;GACrC,MAAM,UAAU,UAAU,SAAS;GACnC,MAAM,SAAS,IAAI,gBAAgB;GACnC,MAAM,QACJ,SACA,KACA,OAAO,EAAE,UAAU;IACjB,KAAK,MAAM,UAAU,CACnB;KAAE,SAAS;KAAG,QAAQ;IAAG,GACzB;KAAE,SAAS;KAAI,QAAQ;IAAE,CAC3B,GAAG;KACD,IAAI,MAAM,SAAS,SACjB,SAAS,iBAAiB,OAAO,UAAU,KAAA;KAC7C,IAAI,KAAK,UAAU,OAAO;KAC1B,MAAM,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,YAAY,OAAO,QAAQ,WAAW,OAAO,OAAO;KAC3F,IAAI;MACF,MAAM,SAAS,MAAM,QAAQ,YAC3B,KACA;OACE;QAAE,MAAM;QAAe,QAAQ,CAAC,UAAU,cAAc;OAAE;OAC1D;QACE,MAAM;QACN,QAAQ,UAAU,CAAC,UAAU,SAAS,IAAI,CAAC,QAAQ;OACrD;OACA;QAAE,MAAM;QAAU,QAAQ,CAAC,QAAQ;OAAE;MACvC,GACA,SACA,EAAE,OAAO,CACX;MACA,OAAO,GACL,OAAO,OAAO,OACX,UAAU,MAAM,WAAW,gBAC9B,GACA,GAAG,MAAM,IAAI,KAAK,UAAU,OAAO,MAAM,GAC3C;MACA,OAAO,UACL,OAAO,QACP,CAAC,GACD,GAAG,MAAM,IAAI,KAAK,UAAU,OAAO,MAAM,GAC3C;MACA,OAAO,MACL,OAAO,QAAQ,QAAQ,eAAe,QAAQ,CAAC,GAC/C,OACA,GAAG,MAAM,2BACX;MACA,OAAO,MACL,OAEI,QAAQ,QAAQ,eAAe,cAAc,CAAC,EAG7C,MACL,GACA,OACA,GAAG,MAAM,8CACX;MACA,OAAO,MACL,OAAO,QAAQ,QAAQ,SAAS,QAAQ,CAAC,GACzC,OAAO,QAAQ,QAAQ,OAAO,CAAC,GAC/B,GAAG,MAAM,qDACX;MACA,OAAO,MACL,OAAO,QAAQ,QAAQ,UAAU,QAAQ,CAAC,GAC1C,MACA,GAAG,MAAM,sBACX;MACA,IAAI,SAAS;OACX,MAAM,OAAO,QAAQ,QAAQ,SAAS,SAAS;OAI/C,OAAO,MACL,MAAM,WAAW,QACjB,OACA,GAAG,MAAM,4CACX;OACA,OAAO,MACL,OAAO,MAAM,YAAY,GACzB,OACA,GAAG,MAAM,+DACX;MACF;KACF,UAAU;MACR,IAAI,MAAM,QAAQ,KAAA;MAClB,IAAI,KAAK,UAAU;KACrB;IACF;IACA,MAAM,QAAQ,MAAM,QAAQ,YAC1B,KACA,CAAC;KAAE,MAAM;KAAU,QAAQ,CAAC,QAAQ;IAAE,CAAC,GACvC,OACF;IACA,OAAO,UAAU,MAAM,QAAQ,CAAC,GAAG,KAAK,UAAU,MAAM,MAAM,CAAC;IAC/D,OAAO,MACL,OAAO,QAAQ,OAAO,UAAU,QAAQ,CAAC,GACzC,MACA,sDACF;IAEA,MAAM,gBAAkC,CACtC;KAAE,MAAM;KAAS,QAAQ,CAAC,eAAe;IAAE,CAC7C;IACA,MAAM,YAAY,MAAM,QAAQ,YAC9B,KACA,eACA,OAAO,GAAG,CACZ;IACA,OAAO,UACL,UAAU,QACV,CAAC,GACD,KAAK,UAAU,UAAU,MAAM,CACjC;IACA,OAAO,MAAM,QAAQ,WAAW,SAAS,eAAe,GAAG,KAAK;IAChE,MAAM,QAAQ,MAAM,QAAQ,YAAa,KAAK,eAAe,EAC3D,aAAa,IAAI,KAAK,MACxB,CAAC;IACD,OAAO,GACL,MAAM,OAAO,WAAW,KACtB,MAAM,OAAO,EAAE,CAAE,KAAK,SAAS,eAAe,GAChD,+DAA+D,KAAK,UAAU,KAAK,GACrF;IACA,OAAO,MAAM,QAAQ,OAAO,SAAS,eAAe,GAAG,IAAI;IAC3D,OAAO,MAAM,OAAO,KAAK,GAAG,kBAAkB;IAC9C,MAAM,cAAc,UAClB,MAAM,WAAW,GAAG,GACpB,eACF;IACA,OAAO,GACL,YAAY,QAAQ,0BAA0B,CAAC,CAAC,MAAM,SACpD,KAAK,SACH,GAAG,YAAY,OAAO,KAAK,GAAG,YAAY,QAC5C,CACF,GACA,6DACF;GACF,GACA;IACE,wBAAwB;IACxB,UAAU,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC;GAC3C,GACA,MACF;EACF;EAEA,KAAK,MAAM,aAAa,eACtB,MAAM,QACJ,SACA,KACA,OAAO,EAAE,UAAU;GACjB,MAAM,SAAS,MAAM,QAAQ,YAC3B,KACA,CAAC;IAAE,MAAM;IAAe,QAAQ,CAAC,cAAc;GAAE,CAAC,GAClD;IAAE,GAAG,OAAO,GAAG;IAAG,QAAQ;GAAa,CACzC;GACA,MAAM,QAAQ,gCAAgC,UAAU,KAAK,IAAI,EAAE;GACnE,OAAO,UACL,OAAO,QACP,CAAC,GACD,GAAG,MAAM,IAAI,KAAK,UAAU,OAAO,MAAM,GAC3C;GACA,OAAO,MACL,OAEI,QAAQ,QAAQ,eAAe,cAAc,CAAC,EAG7C,MACL,GACA,OACA,GAAG,MAAM,8CACX;EACF,GACA;GACE,wBAAwB;GACxB,oBAAoB;GACpB,uBAAuB;GACvB,UAAU,YAAY;EACxB,CACF;CAEJ,GACA,SACF;CACA,MAAM,cAAc,QAAmB,CAAC,OAAoB;EAC1D,YAAY;EACZ,wBAAwB,CAAC,UAAU,cAAc;EACjD,UAAU,YAAY,CAAC,GAAG,CAAC,GAAG;GAAE,SAAS;GAAM,WAAW;GAAM,GAAG;EAAM,CAAC;CAC5E;CACA,IACE,wBACA,kHACA,OAAO,QAAQ;EACb,IAAI,CAAC,QAAQ,gBAAgB;GAC3B,IAAI,CAAE,MAAM,aAAa,SAAS,KAAK,kBAAkB,GACvD,OAAO,gBACL,iFACF;GAEF,IAAI,UAAU;GACd,MAAM,QACJ,SACA,KACA,OAAO,EAAE,UAAU;IACjB,WAAW,MAAM,aAAa,KAAK,QAAQ,SAAS,EAAA,CAAG,MACpD,UAAU,MAAM,YAAY,WAC/B;GACF,GACA,WAAW,CACb;GACA,OAAO,MACL,SACA,OACA,uFACF;GACA,OAAO,gBACL,wEACF;EACF;EACA,MAAM,kBACJ,SACA,KACA;GAAE,GAAG,WAAW;GAAG,wBAAwB,KAAA;EAAU,GACrD,CAAC,gCAAgC,kCAAkC,CACrE;EACA,MAAM,kBAAkB,CACtB;GAAE,YAAY;GAAe,IAAI;GAAK,OAAO;EAAQ,GACrD;GAAE,YAAY;GAAe,IAAI;GAAK,OAAO;EAAQ,CACvD;EACA,MAAM,QACJ,SACA,KACA,OAAO,EAAE,UAAU;GACjB,MAAM,YAAY,MAAM,QAAQ,eAC9B,KACA,iBACA,CAAC,OAAO,GACR,CAAC,CACH;GACA,OAAO,GACL,UAAU,OAAO,UAAU,KACzB,UAAU,OAAO,OACd,UAAU,MAAM,SAAS,iBAC5B,GACF,KAAK,UAAU,UAAU,MAAM,CACjC;GACA,MAAM,UAAU,MAAM,QAAQ,eAC5B,KACA,iBACA,CAAC,SAAS,QAAQ,GAClB,OAAO,GAAG,CACZ;GACA,OAAO,MACL,QAAQ,OAAO,QACf,GACA,uDAAuD,KAAK,UAAU,QAAQ,MAAM,GACtF;GACA,OAAO,MAAM,QAAQ,OAAO,EAAE,CAAE,QAAQ,oBAAoB;GAC5D,OAAO,GACL,QAAQ,OAAO,EAAE,CAAE,KAAK,SAAS,CAAC,GAClC,KAAK,UAAU,QAAQ,MAAM,CAC/B;GACA,MAAM,CAAC,UACJ,QAAQ,MAA2C,aAAa,CAAC;GACpE,OAAO,MACL,OAAQ,QAA6C,MAAM,GAC3D,IAAI,SAAS,QACb,wEAAwE,KAAK,UAAU,QAAQ,IAAI,GACrG;EACF,GACA,WAAW,CACb;EAGA,MAAM,QACJ,SACA,KACA,OAAO,EAAE,UAAU;GACjB,MAAM,SAAS,MAAM,QAAQ,eAC3B,KACA,gBAAgB,MAAM,GAAG,CAAC,GAC1B,CAAC,SAAS,QAAQ,GAClB,OAAO,GAAG,CACZ;GACA,MAAM,CAAC,UAAY,OAAO,MACtB,aAAa,CAAC;GAIlB,OAAO,GACL,QAAQ,SAAS,QAAQ,QAAQ,UAAU,MAC3C,yDAAyD,KAAK,UAAU,OAAO,IAAI,GACrF;GACA,KAAK,MAAM,SAAS,CAAC,SAAS,QAAQ,GACpC,OAAO,GACL,OAAO,OAAO,MACX,UACC,MAAM,KAAK,SAAS,KAAK,KACzB,MAAM,SAAS,qBACf,MAAM,SAAS,WACnB,GACA,GAAG,MAAM,8CAA8C,KAAK,UAAU,OAAO,MAAM,GACrF;EAEJ,GACA,WAAW,EAAE,WAAW,MAAM,CAAC,CACjC;EAGA,MAAM,SAAS,MAAM,eAAe,EAAE,SAAS,CAAC,aAAa,CAAC,EAAE,CAAC;EACjE,MAAM,SAAS,MAAM,sBAAsB,MAAM;EACjD,MAAM,QACJ,SACA,QACA,OAAO,EAAE,KAAK,aAAa;GACzB,MAAM,aAAa,MAAM,aAAa,KAAK,QAAQ,SAAS,EAAA,CAAG,MAC5D,UAAU,MAAM,YAAY,WAC/B;GACA,OAAO,GAAG,WAAW,6CAA6C;GAClE,MAAM,OAAO,GAAG,UAAU,OAAO,KAAK,GAAG,OAAO,UAAU,MAAM;GAChE,OAAO,GACL,YAAY,QAAQ,qBAAqB,CAAC,CAAC,MAAM,SAC/C,KAAK,SAAS,IAAI,CACpB,GACA,qBAAqB,KAAK,2BAA2B,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,GAAG,GACjF;GACA,MAAM,CAAC,QAAQ,YACb,QACA,kCACF;GACA,OAAO,GACL,MAAM,SAAS,UAAU,OAAO,IAAI,KAClC,KAAK,SAAS,OAAO,UAAU,MAAM,CAAC,GACxC,kDAAkD,KAAK,eAAe,MACxE;GACA,MAAM,UAAU,MAAM,QAAQ,eAC5B,KACA,CACE;IAAE,YAAY;IAAe,IAAI;IAAK,OAAO;GAAO,GACpD;IAAE,YAAY;IAAe,IAAI;IAAK,OAAO;GAAQ,CACvD,GACA,CAAC,OAAO,GACR,OAAO,MAAM,CACf;GACA,OAAO,MACL,QAAQ,OAAO,QACf,GACA,mEAAmE,KAAK,UAAU,QAAQ,MAAM,GAClG;GACA,OAAO,MAAM,QAAQ,OAAO,EAAE,CAAE,MAAM,WAAW;GACjD,OAAO,GACL,QAAQ,OAAO,EAAE,CAAE,KAAK,SAAS,CAAC,GAClC,KAAK,UAAU,QAAQ,MAAM,CAC/B;GACA,MAAM,MAAM,MAAM,QAAQ,YACxB,KACA,CAAC;IAAE,MAAM;IAAU,QAAQ,CAAC,OAAO;GAAE,CAAC,GACtC,CAAC,CACH;GACA,OAAO,UACL,IAAI,QACJ,CAAC,GACD,wCAAwC,KAAK,UAAU,IAAI,MAAM,GACnE;EACF,GACA,WAAW;GACT,WAAW;GACX,iBAAiB,CACf,QACE,cACE,EAAE,QAAQ,CAAC,QAAQ,EAAE,GACrB,EAAE,cAAc,UAAU,OAAO,EAAE,CACrC,CACF,CACF;EACF,CAAC,CACH;CACF,GACA,aAAa,QAAQ,WAAW,kBAAkB,MAAM,SACtD,CAAC,QAAQ,iBACP,oFACA,KAAA,CACN;CACA,OAAO;AACT"}