@openclaw/matrix 2026.5.20 → 2026.5.24-beta.1

package/node_modules/oidc-client-ts/dist/browser/oidc-client-ts.min.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/index.ts", "../../src/utils/Logger.ts", "../../node_modules/jwt-decode/build/esm/index.js", "../../src/utils/JwtUtils.ts", "../../src/utils/CryptoUtils.ts", "../../src/utils/Event.ts", "../../src/utils/PopupUtils.ts", "../../src/utils/Timer.ts", "../../src/utils/UrlUtils.ts", "../../src/errors/ErrorResponse.ts", "../../src/errors/ErrorTimeout.ts", "../../src/AccessTokenEvents.ts", "../../src/CheckSessionIFrame.ts", "../../src/InMemoryWebStorage.ts", "../../src/errors/ErrorDPoPNonce.ts", "../../src/JsonService.ts", "../../src/MetadataService.ts", "../../src/WebStorageStateStore.ts", "../../src/OidcClientSettings.ts", "../../src/UserInfoService.ts", "../../src/TokenClient.ts", "../../src/ResponseValidator.ts", "../../src/State.ts", "../../src/SigninState.ts", "../../src/SigninRequest.ts", "../../src/SigninResponse.ts", "../../src/SignoutRequest.ts", "../../src/SignoutResponse.ts", "../../src/ClaimsService.ts", "../../src/DPoPStore.ts", "../../src/OidcClient.ts", "../../src/SessionMonitor.ts", "../../src/User.ts", "../../src/navigators/AbstractChildWindow.ts", "../../src/UserManagerSettings.ts", "../../src/navigators/IFrameWindow.ts", "../../src/navigators/IFrameNavigator.ts", "../../src/navigators/PopupWindow.ts", "../../src/navigators/PopupNavigator.ts", "../../src/navigators/RedirectNavigator.ts", "../../src/UserManagerEvents.ts", "../../src/SilentRenewService.ts", "../../src/RefreshState.ts", "../../src/UserManager.ts", "../../package.json", "../../src/Version.ts", "../../src/IndexedDbDPoPStore.ts"],
+  "sourcesContent": ["// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nexport { ErrorResponse, ErrorTimeout } from \"./errors\";\nexport type { INavigator, IFrameWindowParams, IWindow, NavigateParams, NavigateResponse, PopupWindowParams, RedirectParams } from \"./navigators\";\nexport { Log, Logger } from \"./utils\";\nexport type { ILogger, PopupWindowFeatures } from \"./utils\";\nexport type { OidcAddressClaim, OidcStandardClaims, IdTokenClaims, JwtClaims } from \"./Claims\";\n\nexport { AccessTokenEvents } from \"./AccessTokenEvents\";\nexport type { AccessTokenCallback } from \"./AccessTokenEvents\";\nexport { CheckSessionIFrame } from \"./CheckSessionIFrame\";\nexport { InMemoryWebStorage } from \"./InMemoryWebStorage\";\nexport type { AsyncStorage } from \"./AsyncStorage\";\nexport { MetadataService } from \"./MetadataService\";\nexport * from \"./OidcClient\";\nexport { OidcClientSettingsStore } from \"./OidcClientSettings\";\nexport type { OidcClientSettings, SigningKey, ExtraHeader } from \"./OidcClientSettings\";\nexport type { OidcMetadata } from \"./OidcMetadata\";\nexport { SessionMonitor } from \"./SessionMonitor\";\nexport type { SessionStatus } from \"./SessionStatus\";\nexport type { SigninRequest, SigninRequestCreateArgs } from \"./SigninRequest\";\nexport type { RefreshState } from \"./RefreshState\";\nexport { SigninResponse } from \"./SigninResponse\";\nexport { SigninState } from \"./SigninState\";\nexport type { SigninStateArgs, SigninStateCreateArgs } from \"./SigninState\";\nexport type { SignoutRequest, SignoutRequestArgs } from \"./SignoutRequest\";\nexport { SignoutResponse } from \"./SignoutResponse\";\nexport { State } from \"./State\";\nexport type { StateStore } from \"./StateStore\";\nexport { User } from \"./User\";\nexport type { UserProfile } from \"./User\";\nexport * from \"./UserManager\";\nexport type {\n    UserManagerEvents,\n    SilentRenewErrorCallback,\n    UserLoadedCallback,\n    UserSessionChangedCallback,\n    UserSignedInCallback,\n    UserSignedOutCallback,\n    UserUnloadedCallback,\n} from \"./UserManagerEvents\";\nexport { UserManagerSettingsStore } from \"./UserManagerSettings\";\nexport type { UserManagerSettings } from \"./UserManagerSettings\";\nexport { Version } from \"./Version\";\nexport { WebStorageStateStore } from \"./WebStorageStateStore\";\nexport { IndexedDbDPoPStore } from \"./IndexedDbDPoPStore\";\nexport { DPoPState } from \"./DPoPStore\";\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\n/**\n * Native interface\n *\n * @public\n */\nexport interface ILogger {\n    debug(...args: unknown[]): void;\n    info(...args: unknown[]): void;\n    warn(...args: unknown[]): void;\n    error(...args: unknown[]): void;\n}\n\nconst nopLogger: ILogger = {\n    debug: () => undefined,\n    info: () => undefined,\n    warn: () => undefined,\n    error: () => undefined,\n};\n\nlet level: number;\nlet logger: ILogger;\n\n/**\n * Log levels\n *\n * @public\n */\nexport enum Log {\n    NONE,\n    ERROR,\n    WARN,\n    INFO,\n    DEBUG\n}\n\n/**\n * Log manager\n *\n * @public\n */\nexport namespace Log { // eslint-disable-line @typescript-eslint/no-namespace\n    export function reset(): void {\n        level = Log.INFO;\n        logger = nopLogger;\n    }\n\n    export function setLevel(value: Log): void {\n        if (!(Log.NONE <= value && value <= Log.DEBUG)) {\n            throw new Error(\"Invalid log level\");\n        }\n        level = value;\n    }\n\n    export function setLogger(value: ILogger): void {\n        logger = value;\n    }\n}\n\n/**\n * Internal logger instance\n *\n * @public\n */\nexport class Logger {\n    private _method?: string;\n    public constructor(private _name: string) {}\n\n    /* eslint-disable @typescript-eslint/no-unsafe-enum-comparison */\n    public debug(...args: unknown[]): void {\n        if (level >= Log.DEBUG) {\n            logger.debug(Logger._format(this._name, this._method), ...args);\n        }\n    }\n    public info(...args: unknown[]): void {\n        if (level >= Log.INFO) {\n            logger.info(Logger._format(this._name, this._method), ...args);\n        }\n    }\n    public warn(...args: unknown[]): void {\n        if (level >= Log.WARN) {\n            logger.warn(Logger._format(this._name, this._method), ...args);\n        }\n    }\n    public error(...args: unknown[]): void {\n        if (level >= Log.ERROR) {\n            logger.error(Logger._format(this._name, this._method), ...args);\n        }\n    }\n    /* eslint-enable @typescript-eslint/no-unsafe-enum-comparison */\n\n    public throw(err: Error): never {\n        this.error(err);\n        throw err;\n    }\n\n    public create(method: string): Logger {\n        const methodLogger: Logger = Object.create(this);\n        methodLogger._method = method;\n        methodLogger.debug(\"begin\");\n        return methodLogger;\n    }\n\n    public static createStatic(name: string, staticMethod: string): Logger {\n        const staticLogger = new Logger(`${name}.${staticMethod}`);\n        staticLogger.debug(\"begin\");\n        return staticLogger;\n    }\n\n    private static _format(name: string, method?: string) {\n        const prefix = `[${name}]`;\n        return method ? `${prefix} ${method}:` : prefix;\n    }\n\n    /* eslint-disable @typescript-eslint/no-unsafe-enum-comparison */\n    // helpers for static class methods\n    public static debug(name: string, ...args: unknown[]): void {\n        if (level >= Log.DEBUG) {\n            logger.debug(Logger._format(name), ...args);\n        }\n    }\n    public static info(name: string, ...args: unknown[]): void {\n        if (level >= Log.INFO) {\n            logger.info(Logger._format(name), ...args);\n        }\n    }\n    public static warn(name: string, ...args: unknown[]): void {\n        if (level >= Log.WARN) {\n            logger.warn(Logger._format(name), ...args);\n        }\n    }\n    public static error(name: string, ...args: unknown[]): void {\n        if (level >= Log.ERROR) {\n            logger.error(Logger._format(name), ...args);\n        }\n    }\n    /* eslint-enable @typescript-eslint/no-unsafe-enum-comparison */\n}\n\nLog.reset();\n", "export class InvalidTokenError extends Error {\n}\nInvalidTokenError.prototype.name = \"InvalidTokenError\";\nfunction b64DecodeUnicode(str) {\n    return decodeURIComponent(atob(str).replace(/(.)/g, (m, p) => {\n        let code = p.charCodeAt(0).toString(16).toUpperCase();\n        if (code.length < 2) {\n            code = \"0\" + code;\n        }\n        return \"%\" + code;\n    }));\n}\nfunction base64UrlDecode(str) {\n    let output = str.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    switch (output.length % 4) {\n        case 0:\n            break;\n        case 2:\n            output += \"==\";\n            break;\n        case 3:\n            output += \"=\";\n            break;\n        default:\n            throw new Error(\"base64 string is not of the correct length\");\n    }\n    try {\n        return b64DecodeUnicode(output);\n    }\n    catch (err) {\n        return atob(output);\n    }\n}\nexport function jwtDecode(token, options) {\n    if (typeof token !== \"string\") {\n        throw new InvalidTokenError(\"Invalid token specified: must be a string\");\n    }\n    options || (options = {});\n    const pos = options.header === true ? 0 : 1;\n    const part = token.split(\".\")[pos];\n    if (typeof part !== \"string\") {\n        throw new InvalidTokenError(`Invalid token specified: missing part #${pos + 1}`);\n    }\n    let decoded;\n    try {\n        decoded = base64UrlDecode(part);\n    }\n    catch (e) {\n        throw new InvalidTokenError(`Invalid token specified: invalid base64 for part #${pos + 1} (${e.message})`);\n    }\n    try {\n        return JSON.parse(decoded);\n    }\n    catch (e) {\n        throw new InvalidTokenError(`Invalid token specified: invalid json for part #${pos + 1} (${e.message})`);\n    }\n}\n", "import { jwtDecode } from \"jwt-decode\";\n\nimport { Logger } from \"./Logger\";\nimport type { JwtClaims } from \"../Claims\";\nimport { CryptoUtils } from \"./CryptoUtils\";\n\n/**\n * @internal\n */\nexport class JwtUtils {\n    // IMPORTANT: doesn't validate the token\n    public static decode(token: string): JwtClaims {\n        try {\n            return jwtDecode<JwtClaims>(token);\n        }\n        catch (err) {\n            Logger.error(\"JwtUtils.decode\", err);\n            throw err;\n        }\n    }\n\n    public static async generateSignedJwt(header: object, payload: object, privateKey: CryptoKey) : Promise<string> {\n        const encodedHeader = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(header)));\n        const encodedPayload = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(payload)));\n        const encodedToken = `${encodedHeader}.${encodedPayload}`;\n\n        const signature = await window.crypto.subtle.sign(\n            {\n                name: \"ECDSA\",\n                hash: { name: \"SHA-256\" },\n            },\n            privateKey,\n            new TextEncoder().encode(encodedToken),\n        );\n\n        const encodedSignature = CryptoUtils.encodeBase64Url(new Uint8Array(signature));\n        return `${encodedToken}.${encodedSignature}`;\n    }\n\n    public static async generateSignedJwtWithHmac(header: object, payload: object, secretKey: CryptoKey): Promise<string> {\n        const encodedHeader = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(header)));\n        const encodedPayload = CryptoUtils.encodeBase64Url(new TextEncoder().encode(JSON.stringify(payload)));\n        const encodedToken = `${encodedHeader}.${encodedPayload}`;\n\n        const signature = await window.crypto.subtle.sign(\n            \"HMAC\",\n            secretKey,\n            new TextEncoder().encode(encodedToken),\n        );\n\n        const encodedSignature = CryptoUtils.encodeBase64Url(new Uint8Array(signature));\n        return `${encodedToken}.${encodedSignature}`;\n    }\n}\n", "import { Logger } from \"./Logger\";\nimport { JwtUtils } from \"./JwtUtils\";\n\nexport interface GenerateDPoPProofOpts {\n    url: string;\n    accessToken?: string;\n    httpMethod?: string;\n    keyPair: CryptoKeyPair;\n    nonce?: string;\n}\n\nconst UUID_V4_TEMPLATE = \"10000000-1000-4000-8000-100000000000\";\n\nconst toBase64 = (val: ArrayBuffer | Uint8Array): string =>\n    btoa([...new Uint8Array(val)]\n        .map((chr) => String.fromCharCode(chr))\n        .join(\"\"));\n\n/**\n * @internal\n */\nexport class CryptoUtils {\n    private static _randomWord(): number {\n        const arr = new Uint32Array(1);\n        crypto.getRandomValues(arr);\n        return arr[0];\n    }\n\n    /**\n     * Generates RFC4122 version 4 guid\n     */\n    public static generateUUIDv4(): string {\n        const uuid = UUID_V4_TEMPLATE.replace(/[018]/g, c =>\n            (+c ^ CryptoUtils._randomWord() & 15 >> +c / 4).toString(16),\n        );\n        return uuid.replace(/-/g, \"\");\n    }\n\n    /**\n     * PKCE: Generate a code verifier\n     */\n    public static generateCodeVerifier(): string {\n        return CryptoUtils.generateUUIDv4() + CryptoUtils.generateUUIDv4() + CryptoUtils.generateUUIDv4();\n    }\n\n    /**\n     * PKCE: Generate a code challenge\n     */\n    public static async generateCodeChallenge(code_verifier: string): Promise<string> {\n        if (!crypto.subtle) {\n            throw new Error(\"Crypto.subtle is available only in secure contexts (HTTPS).\");\n        }\n\n        try {\n            const encoder = new TextEncoder();\n            const data = encoder.encode(code_verifier);\n            const hashed = await crypto.subtle.digest(\"SHA-256\", data);\n            return toBase64(hashed).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n        }\n        catch (err) {\n            Logger.error(\"CryptoUtils.generateCodeChallenge\", err);\n            throw err;\n        }\n    }\n\n    /**\n     * Generates a base64-encoded string for a basic auth header\n     */\n    public static generateBasicAuth(client_id: string, client_secret: string): string {\n        const encoder = new TextEncoder();\n        const data = encoder.encode([client_id, client_secret].join(\":\"));\n        return toBase64(data);\n    }\n\n    /**\n     * Generates a hash of a string using a given algorithm\n     * @param alg\n     * @param message\n     */\n    public static async hash(alg: string, message: string) : Promise<Uint8Array> {\n        const msgUint8 = new TextEncoder().encode(message);\n        const hashBuffer = await crypto.subtle.digest(alg, msgUint8);\n        return new Uint8Array(hashBuffer);\n    }\n\n    /**\n     * Generates a base64url encoded string\n     */\n    public static encodeBase64Url = (input: Uint8Array) => {\n        return toBase64(input).replace(/=/g, \"\").replace(/\\+/g, \"-\").replace(/\\//g, \"_\");\n    };\n\n    /**\n     * Generates a rfc7638 compliant jwk thumbprint\n     * @param jwk\n     */\n    public static async customCalculateJwkThumbprint(jwk: JsonWebKey): Promise<string> {\n        let jsonObject: object;\n        switch (jwk.kty) {\n            case \"RSA\":\n                jsonObject = {\n                    \"e\": jwk.e,\n                    \"kty\": jwk.kty,\n                    \"n\": jwk.n,\n                };\n                break;\n            case \"EC\":\n                jsonObject = {\n                    \"crv\": jwk.crv,\n                    \"kty\": jwk.kty,\n                    \"x\": jwk.x,\n                    \"y\": jwk.y,\n                };\n                break;\n            case \"OKP\":\n                jsonObject = {\n                    \"crv\": jwk.crv,\n                    \"kty\": jwk.kty,\n                    \"x\": jwk.x,\n                };\n                break;\n            case \"oct\":\n                jsonObject = {\n                    \"crv\": jwk.k,\n                    \"kty\": jwk.kty,\n                };\n                break;\n            default:\n                throw new Error(\"Unknown jwk type\");\n        }\n        const utf8encodedAndHashed = await CryptoUtils.hash(\"SHA-256\", JSON.stringify(jsonObject));\n        return CryptoUtils.encodeBase64Url(utf8encodedAndHashed);\n    }\n\n    public static async generateDPoPProof({\n        url,\n        accessToken,\n        httpMethod,\n        keyPair,\n        nonce,\n    }: GenerateDPoPProofOpts): Promise<string> {\n        let hashedToken: Uint8Array;\n        let encodedHash: string;\n\n        const payload: Record<string, string | number> = {\n            \"jti\": window.crypto.randomUUID(),\n            \"htm\": httpMethod ?? \"GET\",\n            \"htu\": url,\n            \"iat\": Math.floor(Date.now() / 1000),\n        };\n\n        if (accessToken) {\n            hashedToken = await CryptoUtils.hash(\"SHA-256\", accessToken);\n            encodedHash = CryptoUtils.encodeBase64Url(hashedToken);\n            payload.ath = encodedHash;\n        }\n\n        if (nonce) {\n            payload.nonce = nonce;\n        }\n\n        try {\n            const publicJwk = await crypto.subtle.exportKey(\"jwk\", keyPair.publicKey);\n            const header = {\n                \"alg\": \"ES256\",\n                \"typ\": \"dpop+jwt\",\n                \"jwk\": {\n                    \"crv\": publicJwk.crv,\n                    \"kty\": publicJwk.kty,\n                    \"x\": publicJwk.x,\n                    \"y\": publicJwk.y,\n                },\n            };\n            return await JwtUtils.generateSignedJwt(header, payload, keyPair.privateKey);\n        } catch (err) {\n            if (err instanceof TypeError) {\n                throw new Error(`Error exporting dpop public key: ${err.message}`);\n            } else {\n                throw err;\n            }\n        }\n    }\n\n    public static async generateDPoPJkt(keyPair: CryptoKeyPair) : Promise<string> {\n        try {\n            const publicJwk = await crypto.subtle.exportKey(\"jwk\", keyPair.publicKey);\n            return await CryptoUtils.customCalculateJwkThumbprint(publicJwk);\n        } catch (err) {\n            if (err instanceof TypeError) {\n                throw new Error(`Could not retrieve dpop keys from storage: ${err.message}`);\n            } else {\n                throw err;\n            }\n        }\n    }\n\n    public static async generateDPoPKeys() : Promise<CryptoKeyPair> {\n        return await window.crypto.subtle.generateKey(\n            {\n                name: \"ECDSA\",\n                namedCurve: \"P-256\",\n            },\n            false,\n            [\"sign\", \"verify\"],\n        );\n    }\n\n    /**\n     * Generates a client assertion JWT for client_secret_jwt authentication\n     * @param client_id The client identifier\n     * @param client_secret The client secret\n     * @param audience The token endpoint URL (audience)\n     * @param algorithm The HMAC algorithm to use (HS256, HS384, HS512). Defaults to HS256\n     */\n    public static async generateClientAssertionJwt(client_id: string, client_secret: string, audience: string, algorithm: string = \"HS256\"): Promise<string> {\n        const now = Math.floor(Date.now() / 1000);\n\n        const header = {\n            \"alg\": algorithm,\n            \"typ\": \"JWT\",\n        };\n\n        const payload = {\n            \"iss\": client_id,\n            \"sub\": client_id,\n            \"aud\": audience,\n            \"jti\": CryptoUtils.generateUUIDv4(),\n            \"exp\": now + 300, // 5 minutes\n            \"iat\": now,\n        };\n\n        const hashMap: Record<string, string> = {\n            \"HS256\": \"SHA-256\",\n            \"HS384\": \"SHA-384\",\n            \"HS512\": \"SHA-512\",\n        };\n\n        const hashFunction = hashMap[algorithm];\n        if (!hashFunction) {\n            throw new Error(`Unsupported algorithm: ${algorithm}. Supported algorithms are: HS256, HS384, HS512`);\n        }\n\n        const encoder = new TextEncoder();\n        const secretKey = await crypto.subtle.importKey(\n            \"raw\",\n            encoder.encode(client_secret),\n            { name: \"HMAC\", hash: hashFunction },\n            false,\n            [\"sign\"],\n        );\n\n        return await JwtUtils.generateSignedJwtWithHmac(header, payload, secretKey);\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./Logger\";\n\n/**\n * @internal\n */\nexport type Callback<EventType extends unknown[]> = (...ev: EventType) => (Promise<void> | void);\n\n/**\n * @internal\n */\nexport class Event<EventType extends unknown[]> {\n    protected readonly _logger: Logger;\n\n    private readonly _callbacks: Array<Callback<EventType>> = [];\n\n    public constructor(protected readonly _name: string) {\n        this._logger = new Logger(`Event('${this._name}')`);\n    }\n\n    public addHandler(cb: Callback<EventType>): () => void {\n        this._callbacks.push(cb);\n        return () => this.removeHandler(cb);\n    }\n\n    public removeHandler(cb: Callback<EventType>): void {\n        const idx = this._callbacks.lastIndexOf(cb);\n        if (idx >= 0) {\n            this._callbacks.splice(idx, 1);\n        }\n    }\n\n    public async raise(...ev: EventType): Promise<void> {\n        this._logger.debug(\"raise:\", ...ev);\n        for (const cb of this._callbacks) {\n            await cb(...ev);\n        }\n    }\n}\n", "/**\n *\n * @public\n * @see https://developer.mozilla.org/en-US/docs/Web/API/Window/open#window_features\n */\nexport interface PopupWindowFeatures {\n    left?: number;\n    top?: number;\n    width?: number;\n    height?: number;\n    menubar?: boolean | string;\n    toolbar?: boolean | string;\n    location?: boolean | string;\n    status?: boolean | string;\n    resizable?: boolean | string;\n    scrollbars?: boolean | string;\n    /** Close popup window after time in seconds, by default it is -1. To enable this feature, set value greater than 0. */\n    closePopupWindowAfterInSeconds?: number;\n\n    [k: string]: boolean | string | number | undefined;\n}\n\nexport class PopupUtils {\n    /**\n     * Populates a map of window features with a placement centered in front of\n     * the current window. If no explicit width is given, a default value is\n     * binned into [800, 720, 600, 480, 360] based on the current window's width.\n     */\n    static center({ ...features }: PopupWindowFeatures): PopupWindowFeatures {\n        if (features.width == null)\n            features.width = [800, 720, 600, 480].find(width => width <= window.outerWidth / 1.618) ?? 360;\n        features.left ??= Math.max(0, Math.round(window.screenX + (window.outerWidth - features.width) / 2));\n        if (features.height != null)\n            features.top ??= Math.max(0, Math.round(window.screenY + (window.outerHeight - features.height) / 2));\n        return features;\n    }\n\n    static serialize(features: PopupWindowFeatures): string {\n        return Object.entries(features)\n            .filter(([, value]) => value != null)\n            .map(([key, value]) => `${key}=${typeof value !== \"boolean\" ? value as string : value ? \"yes\" : \"no\"}`)\n            .join(\",\");\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Event } from \"./Event\";\nimport { Logger } from \"./Logger\";\n\n/**\n * @internal\n */\nexport class Timer extends Event<[void]> {\n    protected readonly _logger = new Logger(`Timer('${this._name}')`);\n    private _timerHandle: ReturnType<typeof setInterval> | null = null;\n    private _expiration = 0;\n\n    // get the time\n    public static getEpochTime(): number {\n        return Math.floor(Date.now() / 1000);\n    }\n\n    public init(durationInSeconds: number): void {\n        const logger = this._logger.create(\"init\");\n        durationInSeconds = Math.max(Math.floor(durationInSeconds), 1);\n        const expiration = Timer.getEpochTime() + durationInSeconds;\n        if (this.expiration === expiration && this._timerHandle) {\n            // no need to reinitialize to same expiration, so bail out\n            logger.debug(\"skipping since already initialized for expiration at\", this.expiration);\n            return;\n        }\n\n        this.cancel();\n\n        logger.debug(\"using duration\", durationInSeconds);\n        this._expiration = expiration;\n\n        // we're using a fairly short timer and then checking the expiration in the\n        // callback to handle scenarios where the browser device sleeps, and then\n        // the timers end up getting delayed.\n        const timerDurationInSeconds = Math.min(durationInSeconds, 5);\n        this._timerHandle = setInterval(this._callback, timerDurationInSeconds * 1000);\n    }\n\n    public get expiration(): number {\n        return this._expiration;\n    }\n\n    public cancel(): void {\n        this._logger.create(\"cancel\");\n        if (this._timerHandle) {\n            clearInterval(this._timerHandle);\n            this._timerHandle = null;\n        }\n    }\n\n    protected _callback = (): void => {\n        const diff = this._expiration - Timer.getEpochTime();\n        this._logger.debug(\"timer completes in\", diff);\n\n        if (this._expiration <= Timer.getEpochTime()) {\n            this.cancel();\n            void super.raise();\n        }\n    };\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\n/**\n * @internal\n */\nexport class UrlUtils {\n    public static readParams(url: string, responseMode: \"query\" | \"fragment\" = \"query\"): URLSearchParams {\n        if (!url) throw new TypeError(\"Invalid URL\");\n        // the base URL is irrelevant, it's just here to support relative url arguments\n        const parsedUrl = new URL(url, \"http://127.0.0.1\");\n        const params = parsedUrl[responseMode === \"fragment\" ? \"hash\" : \"search\"];\n        return new URLSearchParams(params.slice(1));\n    }\n}\n\n/**\n * @internal\n */\nexport const URL_STATE_DELIMITER = \";\";", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"../utils\";\n\n/**\n * Error class thrown in case of an authentication error.\n *\n * @public\n * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthError\n */\nexport class ErrorResponse extends Error {\n    /** Marker to detect class: \"ErrorResponse\" */\n    public readonly name: string = \"ErrorResponse\";\n\n    /** An error code string that can be used to classify the types of errors that occur and to respond to errors. */\n    public readonly error: string | null;\n    /** additional information that can help a developer identify the cause of the error.*/\n    public readonly error_description: string | null;\n    /**\n     * URI identifying a human-readable web page with information about the error, used to provide the client\n       developer with additional information about the error.\n    */\n    public readonly error_uri: string | null;\n\n    /** custom state data set during the initial signin request */\n    public state?: unknown;\n\n    public readonly session_state: string | null;\n\n    public url_state?: string;\n\n    public constructor(\n        args: {\n            error?: string | null; error_description?: string | null; error_uri?: string | null;\n            userState?: unknown; session_state?: string | null; url_state?: string;\n        },\n        /** The x-www-form-urlencoded request body sent to the authority server */\n        public readonly form?: URLSearchParams,\n    ) {\n        super(args.error_description || args.error || \"\");\n\n        if (!args.error) {\n            Logger.error(\"ErrorResponse\", \"No error passed\");\n            throw new Error(\"No error passed\");\n        }\n\n        this.error = args.error;\n        this.error_description = args.error_description ?? null;\n        this.error_uri = args.error_uri ?? null;\n\n        this.state = args.userState;\n        this.session_state = args.session_state ?? null;\n        this.url_state = args.url_state;\n    }\n}\n", "// Copyright (C) 2021 AuthTS Contributors\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\n/**\n * Error class thrown in case of network timeouts (e.g IFrame time out).\n *\n * @public\n */\nexport class ErrorTimeout extends Error {\n    /** Marker to detect class: \"ErrorTimeout\" */\n    public readonly name: string = \"ErrorTimeout\";\n\n    public constructor(message?: string) {\n        super(message);\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, Timer } from \"./utils\";\nimport type { User } from \"./User\";\n\n/**\n * @public\n */\nexport type AccessTokenCallback = (...ev: unknown[]) => (Promise<void> | void);\n\n/**\n * @public\n */\nexport class AccessTokenEvents {\n    protected readonly _logger = new Logger(\"AccessTokenEvents\");\n\n    private readonly _expiringTimer = new Timer(\"Access token expiring\");\n    private readonly _expiredTimer = new Timer(\"Access token expired\");\n    private readonly _expiringNotificationTimeInSeconds: number;\n\n    public constructor(args: { expiringNotificationTimeInSeconds: number }) {\n        this._expiringNotificationTimeInSeconds = args.expiringNotificationTimeInSeconds;\n    }\n\n    public async load(container: User): Promise<void> {\n        const logger = this._logger.create(\"load\");\n        // only register events if there's an access token and it has an expiration\n        if (container.access_token && container.expires_in !== undefined) {\n            const duration = container.expires_in;\n            logger.debug(\"access token present, remaining duration:\", duration);\n\n            if (duration > 0) {\n                // only register expiring if we still have time\n                let expiring = duration - this._expiringNotificationTimeInSeconds;\n                if (expiring <= 0) {\n                    expiring = 1;\n                }\n\n                logger.debug(\"registering expiring timer, raising in\", expiring, \"seconds\");\n                this._expiringTimer.init(expiring);\n            }\n            else {\n                logger.debug(\"canceling existing expiring timer because we're past expiration.\");\n                this._expiringTimer.cancel();\n            }\n\n            // if it's negative, it will still fire\n            const expired = duration + 1;\n            logger.debug(\"registering expired timer, raising in\", expired, \"seconds\");\n            this._expiredTimer.init(expired);\n        }\n        else {\n            this._expiringTimer.cancel();\n            this._expiredTimer.cancel();\n        }\n    }\n\n    public async unload(): Promise<void> {\n        this._logger.debug(\"unload: canceling existing access token timers\");\n        this._expiringTimer.cancel();\n        this._expiredTimer.cancel();\n    }\n\n    /**\n     * Add callback: Raised prior to the access token expiring.\n     */\n    public addAccessTokenExpiring(cb: AccessTokenCallback): () => void {\n        return this._expiringTimer.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised prior to the access token expiring.\n     */\n    public removeAccessTokenExpiring(cb: AccessTokenCallback): void {\n        this._expiringTimer.removeHandler(cb);\n    }\n\n    /**\n     * Add callback: Raised after the access token has expired.\n     */\n    public addAccessTokenExpired(cb: AccessTokenCallback): () => void {\n        return this._expiredTimer.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised after the access token has expired.\n     */\n    public removeAccessTokenExpired(cb: AccessTokenCallback): void {\n        this._expiredTimer.removeHandler(cb);\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./utils\";\n\n/**\n * @internal\n */\nexport class CheckSessionIFrame {\n    private readonly _logger = new Logger(\"CheckSessionIFrame\");\n    private _frame_origin: string;\n    private _frame: HTMLIFrameElement;\n    private _timer: ReturnType<typeof setInterval> | null = null;\n    private _session_state: string | null = null;\n\n    public constructor(\n        private _callback: () => Promise<void>,\n        private _client_id: string,\n        url: string,\n        private _intervalInSeconds: number,\n        private _stopOnError: boolean,\n    ) {\n        const parsedUrl = new URL(url);\n        this._frame_origin = parsedUrl.origin;\n\n        this._frame = window.document.createElement(\"iframe\");\n\n        // shotgun approach\n        this._frame.style.visibility = \"hidden\";\n        this._frame.style.position = \"fixed\";\n        this._frame.style.left = \"-1000px\";\n        this._frame.style.top = \"0\";\n        this._frame.width = \"0\";\n        this._frame.height = \"0\";\n        this._frame.src = parsedUrl.href;\n    }\n\n    public load(): Promise<void> {\n        return new Promise<void>((resolve) => {\n            this._frame.onload = () => {\n                resolve();\n            };\n\n            window.document.body.appendChild(this._frame);\n            window.addEventListener(\"message\", this._message, false);\n        });\n    }\n\n    private _message = (e: MessageEvent<string>): void => {\n        if (e.origin === this._frame_origin &&\n            e.source === this._frame.contentWindow\n        ) {\n            if (e.data === \"error\") {\n                this._logger.error(\"error message from check session op iframe\");\n                if (this._stopOnError) {\n                    this.stop();\n                }\n            }\n            else if (e.data === \"changed\") {\n                this._logger.debug(\"changed message from check session op iframe\");\n                this.stop();\n                void this._callback();\n            }\n            else {\n                this._logger.debug(e.data + \" message from check session op iframe\");\n            }\n        }\n    };\n\n    public start(session_state: string): void {\n        if (this._session_state === session_state) {\n            return;\n        }\n\n        this._logger.create(\"start\");\n\n        this.stop();\n\n        this._session_state = session_state;\n\n        const send = () => {\n            if (!this._frame.contentWindow || !this._session_state) {\n                return;\n            }\n\n            this._frame.contentWindow.postMessage(this._client_id + \" \" + this._session_state, this._frame_origin);\n        };\n\n        // trigger now\n        send();\n\n        // and setup timer\n        this._timer = setInterval(send, this._intervalInSeconds * 1000);\n    }\n\n    public stop(): void {\n        this._logger.create(\"stop\");\n        this._session_state = null;\n\n        if (this._timer) {\n\n            clearInterval(this._timer);\n            this._timer = null;\n        }\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./utils\";\n\n/**\n * @public\n */\nexport class InMemoryWebStorage implements Storage {\n    private readonly _logger = new Logger(\"InMemoryWebStorage\");\n    private _data: Record<string, string> = {};\n\n    public clear(): void {\n        this._logger.create(\"clear\");\n        this._data = {};\n    }\n\n    public getItem(key: string): string {\n        this._logger.create(`getItem('${key}')`);\n        return this._data[key];\n    }\n\n    public setItem(key: string, value: string): void {\n        this._logger.create(`setItem('${key}')`);\n        this._data[key] = value;\n    }\n\n    public removeItem(key: string): void {\n        this._logger.create(`removeItem('${key}')`);\n        delete this._data[key];\n    }\n\n    public get length(): number {\n        return Object.getOwnPropertyNames(this._data).length;\n    }\n\n    public key(index: number): string {\n        return Object.getOwnPropertyNames(this._data)[index];\n    }\n}\n", "export class ErrorDPoPNonce extends Error {\n    /** Marker to detect class: \"ErrorDPoPNonce\" */\n    public readonly name: string = \"ErrorDPoPNonce\";\n    public readonly nonce: string;\n\n    public constructor(nonce: string, message?: string) {\n        super(message);\n        this.nonce = nonce;\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { ErrorResponse, ErrorTimeout } from \"./errors\";\nimport type { ExtraHeader } from \"./OidcClientSettings\";\nimport { Logger } from \"./utils\";\nimport { ErrorDPoPNonce } from \"./errors/ErrorDPoPNonce\";\n\n/**\n * @internal\n */\nexport type JwtHandler = (text: string) => Promise<Record<string, unknown>>;\n\n/**\n * @internal\n */\nexport interface GetJsonOpts {\n    token?: string;\n    credentials?: RequestCredentials;\n    timeoutInSeconds?: number;\n}\n\n/**\n * @internal\n */\nexport interface PostFormOpts {\n    body: URLSearchParams;\n    basicAuth?: string;\n    timeoutInSeconds?: number;\n    initCredentials?: \"same-origin\" | \"include\" | \"omit\";\n    extraHeaders?: Record<string, ExtraHeader>;\n}\n\n/**\n * @internal\n */\nexport class JsonService {\n    private readonly _logger = new Logger(\"JsonService\");\n\n    private _contentTypes: string[] = [];\n\n    public constructor(\n        additionalContentTypes: string[] = [],\n        private _jwtHandler: JwtHandler | null = null,\n        private _extraHeaders: Record<string, ExtraHeader> = {},\n    ) {\n        this._contentTypes.push(...additionalContentTypes, \"application/json\");\n        if (_jwtHandler) {\n            this._contentTypes.push(\"application/jwt\");\n        }\n    }\n\n    protected async fetchWithTimeout(input: RequestInfo, init: RequestInit & { timeoutInSeconds?: number } = {}) {\n        const { timeoutInSeconds, ...initFetch } = init;\n        if (!timeoutInSeconds) {\n            return await fetch(input, initFetch);\n        }\n\n        const controller = new AbortController();\n        const timeoutId = setTimeout(() => controller.abort(), timeoutInSeconds * 1000);\n\n        try {\n            const response = await fetch(input, {\n                ...init,\n                signal: controller.signal,\n            });\n            return response;\n        }\n        catch (err) {\n            if (err instanceof DOMException && err.name === \"AbortError\") {\n                throw new ErrorTimeout(\"Network timed out\");\n            }\n            throw err;\n        }\n        finally {\n            clearTimeout(timeoutId);\n        }\n    }\n\n    public async getJson(url: string, {\n        token,\n        credentials,\n        timeoutInSeconds,\n    }: GetJsonOpts = {}): Promise<Record<string, unknown>> {\n        const logger = this._logger.create(\"getJson\");\n        const headers: HeadersInit = {\n            \"Accept\": this._contentTypes.join(\", \"),\n        };\n        if (token) {\n            logger.debug(\"token passed, setting Authorization header\");\n            headers[\"Authorization\"] = \"Bearer \" + token;\n        }\n\n        this._appendExtraHeaders(headers);\n\n        let response: Response;\n        try {\n            logger.debug(\"url:\", url);\n            response = await this.fetchWithTimeout(url, { method: \"GET\", headers, timeoutInSeconds, credentials });\n        }\n        catch (err) {\n            logger.error(\"Network Error\");\n            throw err;\n        }\n\n        logger.debug(\"HTTP response received, status\", response.status);\n        const contentType = response.headers.get(\"Content-Type\");\n        if (contentType && !this._contentTypes.find(item => contentType.startsWith(item))) {\n            logger.throw(new Error(`Invalid response Content-Type: ${(contentType ?? \"undefined\")}, from URL: ${url}`));\n        }\n        if (response.ok && this._jwtHandler && contentType?.startsWith(\"application/jwt\")) {\n            return await this._jwtHandler(await response.text());\n        }\n        let json: Record<string, unknown>;\n        try {\n            json = await response.json();\n        }\n        catch (err) {\n            logger.error(\"Error parsing JSON response\", err);\n            if (response.ok) throw err;\n            throw new Error(`${response.statusText} (${response.status})`);\n        }\n        if (!response.ok) {\n            logger.error(\"Error from server:\", json);\n            if (json.error) {\n                throw new ErrorResponse(json);\n            }\n            throw new Error(`${response.statusText} (${response.status}): ${JSON.stringify(json)}`);\n        }\n        return json;\n    }\n\n    public async postForm(url: string, {\n        body,\n        basicAuth,\n        timeoutInSeconds,\n        initCredentials,\n        extraHeaders,\n    }: PostFormOpts): Promise<Record<string, unknown>> {\n        const logger = this._logger.create(\"postForm\");\n        const headers: HeadersInit = {\n            \"Accept\": this._contentTypes.join(\", \"),\n            \"Content-Type\": \"application/x-www-form-urlencoded\",\n            ...extraHeaders,\n        };\n        if (basicAuth !== undefined) {\n            headers[\"Authorization\"] = \"Basic \" + basicAuth;\n        }\n\n        this._appendExtraHeaders(headers);\n\n        let response: Response;\n        try {\n            logger.debug(\"url:\", url);\n            response = await this.fetchWithTimeout(url, { method: \"POST\", headers, body, timeoutInSeconds, credentials: initCredentials });\n        }\n        catch (err) {\n            logger.error(\"Network error\");\n            throw err;\n        }\n\n        logger.debug(\"HTTP response received, status\", response.status);\n        const contentType = response.headers.get(\"Content-Type\");\n        if (contentType && !this._contentTypes.find(item => contentType.startsWith(item))) {\n            throw new Error(`Invalid response Content-Type: ${(contentType ?? \"undefined\")}, from URL: ${url}`);\n        }\n\n        const responseText = await response.text();\n\n        let json: Record<string, unknown> = {};\n        if (responseText) {\n            try {\n                json = JSON.parse(responseText);\n            }\n            catch (err) {\n                logger.error(\"Error parsing JSON response\", err);\n                if (response.ok) throw err;\n                throw new Error(`${response.statusText} (${response.status})`);\n            }\n        }\n\n        if (!response.ok) {\n            logger.error(\"Error from server:\", json);\n            if (response.headers.has(\"dpop-nonce\")) {\n                const nonce = response.headers.get(\"dpop-nonce\") as string;\n                throw new ErrorDPoPNonce(nonce, `${JSON.stringify(json)}`);\n            }\n            if (json.error) {\n                throw new ErrorResponse(json, body);\n            }\n            throw new Error(`${response.statusText} (${response.status}): ${JSON.stringify(json)}`);\n        }\n\n        return json;\n    }\n\n    private _appendExtraHeaders(\n        headers: Record<string, string>,\n    ): void {\n        const logger = this._logger.create(\"appendExtraHeaders\");\n        const customKeys = Object.keys(this._extraHeaders);\n        const protectedHeaders = [\n            \"accept\",\n            \"content-type\",\n        ];\n        const preventOverride = [\n            \"authorization\",\n        ];\n        if (customKeys.length === 0) {\n            return;\n        }\n        customKeys.forEach((headerName) => {\n            if (protectedHeaders.includes(headerName.toLocaleLowerCase())) {\n                logger.warn(\"Protected header could not be set\", headerName, protectedHeaders);\n                return;\n            }\n            if (preventOverride.includes(headerName.toLocaleLowerCase()) &&\n                Object.keys(headers).includes(headerName)) {\n                logger.warn(\"Header could not be overridden\", headerName, preventOverride);\n                return;\n            }\n            const content = (typeof this._extraHeaders[headerName] === \"function\") ?\n                (this._extraHeaders[headerName] as ()=>string)() :\n                this._extraHeaders[headerName];\n            if (content && content !== \"\") {\n                headers[headerName] = content;\n            }\n        });\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./utils\";\nimport { JsonService } from \"./JsonService\";\nimport type { OidcClientSettingsStore, SigningKey } from \"./OidcClientSettings\";\nimport type { OidcMetadata } from \"./OidcMetadata\";\n\n/**\n * @public\n * @see https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata\n */\nexport class MetadataService {\n    private readonly _logger = new Logger(\"MetadataService\");\n    private readonly _jsonService;\n\n    // cache\n    private _metadataUrl: string;\n    private _signingKeys: SigningKey[] | null = null;\n    private _metadata: Partial<OidcMetadata> | null = null;\n    private _fetchRequestCredentials: RequestCredentials | undefined;\n\n    public constructor(private readonly _settings: OidcClientSettingsStore) {\n        this._metadataUrl = this._settings.metadataUrl;\n        this._jsonService = new JsonService(\n            [\"application/jwk-set+json\"],\n            null,\n            this._settings.extraHeaders,\n        );\n        if (this._settings.signingKeys) {\n            this._logger.debug(\"using signingKeys from settings\");\n            this._signingKeys = this._settings.signingKeys;\n        }\n\n        if (this._settings.metadata) {\n            this._logger.debug(\"using metadata from settings\");\n            this._metadata = this._settings.metadata;\n        }\n\n        if (this._settings.fetchRequestCredentials) {\n            this._logger.debug(\"using fetchRequestCredentials from settings\");\n            this._fetchRequestCredentials = this._settings.fetchRequestCredentials;\n        }\n    }\n\n    public resetSigningKeys(): void {\n        this._signingKeys = null;\n    }\n\n    public async getMetadata(): Promise<Partial<OidcMetadata>> {\n        const logger = this._logger.create(\"getMetadata\");\n        if (this._metadata) {\n            logger.debug(\"using cached values\");\n            return this._metadata;\n        }\n\n        if (!this._metadataUrl) {\n            logger.throw(new Error(\"No authority or metadataUrl configured on settings\"));\n            // eslint-disable-next-line @typescript-eslint/only-throw-error\n            throw null; // https://github.com/microsoft/TypeScript/issues/46972\n        }\n\n        logger.debug(\"getting metadata from\", this._metadataUrl);\n        const metadata = await this._jsonService.getJson(this._metadataUrl, { credentials: this._fetchRequestCredentials, timeoutInSeconds: this._settings.requestTimeoutInSeconds });\n\n        logger.debug(\"merging remote JSON with seed metadata\");\n        this._metadata = Object.assign({}, metadata, this._settings.metadataSeed);\n        return this._metadata;\n    }\n\n    public getIssuer(): Promise<string> {\n        return this._getMetadataProperty(\"issuer\") as Promise<string>;\n    }\n\n    public getAuthorizationEndpoint(): Promise<string> {\n        return this._getMetadataProperty(\"authorization_endpoint\") as Promise<string>;\n    }\n\n    public getUserInfoEndpoint(): Promise<string> {\n        return this._getMetadataProperty(\"userinfo_endpoint\") as Promise<string>;\n    }\n\n    public getTokenEndpoint(optional: false): Promise<string>;\n    public getTokenEndpoint(optional?: true): Promise<string | undefined>;\n    public getTokenEndpoint(optional = true): Promise<string | undefined> {\n        return this._getMetadataProperty(\"token_endpoint\", optional) as Promise<string | undefined>;\n    }\n\n    public getCheckSessionIframe(): Promise<string | undefined> {\n        return this._getMetadataProperty(\"check_session_iframe\", true) as Promise<string | undefined>;\n    }\n\n    public getEndSessionEndpoint(): Promise<string | undefined> {\n        return this._getMetadataProperty(\"end_session_endpoint\", true) as Promise<string | undefined>;\n    }\n\n    public getRevocationEndpoint(optional: false): Promise<string>;\n    public getRevocationEndpoint(optional?: true): Promise<string | undefined>;\n    public getRevocationEndpoint(optional = true): Promise<string | undefined> {\n        return this._getMetadataProperty(\"revocation_endpoint\", optional) as Promise<string | undefined>;\n    }\n\n    public getKeysEndpoint(optional: false): Promise<string>;\n    public getKeysEndpoint(optional?: true): Promise<string | undefined>;\n    public getKeysEndpoint(optional = true): Promise<string | undefined> {\n        return this._getMetadataProperty(\"jwks_uri\", optional) as Promise<string | undefined>;\n    }\n\n    protected async _getMetadataProperty(name: keyof OidcMetadata, optional=false): Promise<string | boolean | string[] | undefined> {\n        const logger = this._logger.create(`_getMetadataProperty('${name}')`);\n\n        const metadata = await this.getMetadata();\n        logger.debug(\"resolved\");\n\n        if (metadata[name] === undefined) {\n            if (optional === true) {\n                logger.warn(\"Metadata does not contain optional property\");\n                return undefined;\n            }\n\n            logger.throw(new Error(\"Metadata does not contain property \" + name));\n        }\n\n        return metadata[name];\n    }\n\n    public async getSigningKeys(): Promise<SigningKey[] | null> {\n        const logger = this._logger.create(\"getSigningKeys\");\n        if (this._signingKeys) {\n            logger.debug(\"returning signingKeys from cache\");\n            return this._signingKeys;\n        }\n\n        const jwks_uri = await this.getKeysEndpoint(false);\n        logger.debug(\"got jwks_uri\", jwks_uri);\n\n        const keySet = await this._jsonService.getJson(jwks_uri, { timeoutInSeconds: this._settings.requestTimeoutInSeconds });\n        logger.debug(\"got key set\", keySet);\n\n        if (!Array.isArray(keySet.keys)) {\n            logger.throw(new Error(\"Missing keys on keyset\"));\n            // eslint-disable-next-line @typescript-eslint/only-throw-error\n            throw null; // https://github.com/microsoft/TypeScript/issues/46972\n        }\n\n        this._signingKeys = keySet.keys;\n        return this._signingKeys;\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./utils\";\nimport type { StateStore } from \"./StateStore\";\nimport type { AsyncStorage } from \"./AsyncStorage\";\n\n/**\n * @public\n */\nexport class WebStorageStateStore implements StateStore {\n    private readonly _logger = new Logger(\"WebStorageStateStore\");\n\n    private readonly _store: AsyncStorage | Storage;\n    private readonly _prefix: string;\n\n    public constructor({\n        prefix = \"oidc.\",\n        store = localStorage,\n    }: { prefix?: string; store?: AsyncStorage | Storage } = {}) {\n        this._store = store;\n        this._prefix = prefix;\n    }\n\n    public async set(key: string, value: string): Promise<void> {\n        this._logger.create(`set('${key}')`);\n\n        key = this._prefix + key;\n        await this._store.setItem(key, value);\n    }\n\n    public async get(key: string): Promise<string | null> {\n        this._logger.create(`get('${key}')`);\n\n        key = this._prefix + key;\n        const item = await this._store.getItem(key);\n        return item;\n    }\n\n    public async remove(key: string): Promise<string | null> {\n        this._logger.create(`remove('${key}')`);\n\n        key = this._prefix + key;\n        const item = await this._store.getItem(key);\n        await this._store.removeItem(key);\n        return item;\n    }\n\n    public async getAllKeys(): Promise<string[]> {\n        this._logger.create(\"getAllKeys\");\n        const len = await this._store.length;\n\n        const keys = [];\n        for (let index = 0; index < len; index++) {\n            const key = await this._store.key(index);\n            if (key && key.indexOf(this._prefix) === 0) {\n                keys.push(key.substr(this._prefix.length));\n            }\n        }\n        return keys;\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { WebStorageStateStore } from \"./WebStorageStateStore\";\nimport type { OidcMetadata } from \"./OidcMetadata\";\nimport type { StateStore } from \"./StateStore\";\nimport { InMemoryWebStorage } from \"./InMemoryWebStorage\";\nimport type { DPoPStore } from \"./DPoPStore\";\n\nconst DefaultResponseType = \"code\";\nconst DefaultScope = \"openid\";\nconst DefaultClientAuthentication = \"client_secret_post\";\nconst DefaultStaleStateAgeInSeconds = 60 * 15;\n\n/**\n * @public\n */\nexport type SigningKey = Record<string, string | string[]>;\n\n/**\n * @public\n */\nexport type ExtraHeader = string | (() => string);\n\n/**\n * Optional DPoP settings\n * @public\n */\nexport interface DPoPSettings {\n    bind_authorization_code?: boolean;\n    store: DPoPStore;\n}\n\n/**\n * The settings used to configure the {@link OidcClient}.\n *\n * @public\n */\nexport interface OidcClientSettings {\n    /** The URL of the OIDC/OAuth2 provider */\n    authority: string;\n    metadataUrl?: string;\n    /** Provide metadata when authority server does not allow CORS on the metadata endpoint */\n    metadata?: Partial<OidcMetadata>;\n    /** Can be used to seed or add additional values to the results of the discovery request */\n    metadataSeed?: Partial<OidcMetadata>;\n    /** Provide signingKeys when authority server does not allow CORS on the jwks uri */\n    signingKeys?: SigningKey[];\n\n    /** Your client application's identifier as registered with the OIDC/OAuth2 */\n    client_id: string;\n    client_secret?: string;\n    /** The type of response desired from the OIDC/OAuth2 provider (default: \"code\") */\n    response_type?: string;\n    /** The scope being requested from the OIDC/OAuth2 provider (default: \"openid\") */\n    scope?: string;\n    /** The redirect URI of your client application to receive a response from the OIDC/OAuth2 provider */\n    redirect_uri: string;\n    /** The OIDC/OAuth2 post-logout redirect URI */\n    post_logout_redirect_uri?: string;\n\n    /**\n     * Client authentication method that is used to authenticate when using the token endpoint (default: \"client_secret_post\")\n     * - \"client_secret_basic\": using the HTTP Basic authentication scheme\n     * - \"client_secret_post\": including the client credentials in the request body\n     * - \"client_secret_jwt\": using a JWT signed with the client secret\n     *\n     * See https://openid.net/specs/openid-connect-core-1_0.html#ClientAuthentication\n     */\n    client_authentication?: \"client_secret_basic\" | \"client_secret_post\" | \"client_secret_jwt\";\n\n    /**\n     * The signature algorithm to use for client_secret_jwt authentication (default: \"HS256\")\n     * Supported algorithms: HS256, HS384, HS512\n     */\n    token_endpoint_auth_signing_alg?: \"HS256\" | \"HS384\" | \"HS512\";\n\n    /** optional protocol param */\n    prompt?: string;\n    /** optional protocol param */\n    display?: string;\n    /** optional protocol param */\n    max_age?: number;\n    /** optional protocol param */\n    ui_locales?: string;\n    /** optional protocol param */\n    acr_values?: string;\n    /** optional protocol param */\n    resource?: string | string[];\n\n    /**\n     * Optional protocol param\n     * The response mode used by the authority server is defined by the response_type unless explicitly specified:\n     * - Response mode for the OAuth 2.0 response type \"code\" is the \"query\" encoding\n     * - Response mode for the OAuth 2.0 response type \"token\" is the \"fragment\" encoding\n     *\n     * @see https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html#ResponseModes\n     */\n    response_mode?: \"query\" | \"fragment\";\n\n    /**\n     * Should optional OIDC protocol claims be removed from profile or specify the ones to be removed (default: true)\n     * When true, the following claims are removed by default: [\"nbf\", \"jti\", \"auth_time\", \"nonce\", \"acr\", \"amr\", \"azp\", \"at_hash\"]\n     * When specifying claims, the following claims are not allowed: [\"sub\", \"iss\", \"aud\", \"exp\", \"iat\"]\n    */\n    filterProtocolClaims?: boolean | string[];\n    /** Flag to control if additional identity data is loaded from the user info endpoint in order to populate the user's profile (default: false) */\n    loadUserInfo?: boolean;\n    /** Number (in seconds) indicating the age of state entries in storage for authorize requests that are considered abandoned and thus can be cleaned up (default: 900) */\n    staleStateAgeInSeconds?: number;\n\n    /**\n     * Indicates how objects returned from the user info endpoint as claims (e.g. `address`) are merged into the claims from the\n     * id token as a single object.  (default: `{ array: \"replace\" }`)\n     * - array: \"replace\": natives (string, int, float) and arrays are replaced, objects are merged as distinct objects\n     * - array: \"merge\": natives (string, int, float) are replaced, arrays and objects are merged as distinct objects\n     */\n    mergeClaimsStrategy?: { array: \"replace\" | \"merge\" };\n\n    /**\n     * Storage object used to persist interaction state (default: window.localStorage, InMemoryWebStorage iff no window).\n     * E.g. `stateStore: new WebStorageStateStore({ store: window.localStorage })`\n     */\n    stateStore?: StateStore;\n\n    /**\n     * An object containing additional query string parameters to be including in the authorization request.\n     * E.g, when using Azure AD to obtain an access token an additional resource parameter is required. extraQueryParams: `{resource:\"some_identifier\"}`\n     */\n    extraQueryParams?: Record<string, string | number | boolean>;\n\n    extraTokenParams?: Record<string, unknown>;\n\n    /**\n     * An object containing additional header to be including in request.\n     */\n    extraHeaders?: Record<string, ExtraHeader>;\n\n    /**\n     * DPoP enabled or disabled\n     */\n    dpop?: DPoPSettings | undefined;\n\n    /**\n     * Will check the content type header of the response of the revocation endpoint to match these passed values (default: [])\n     */\n    revokeTokenAdditionalContentTypes?: string[];\n    /**\n     * Will disable PKCE validation, changing to true will not append to sign in request code_challenge and code_challenge_method. (default: false)\n     */\n    disablePKCE?: boolean;\n    /**\n     * Sets the credentials for fetch requests. (default: \"same-origin\")\n     * Use this if you need to send cookies to the OIDC/OAuth2 provider or if you are using a proxy that requires cookies\n     */\n    fetchRequestCredentials?: RequestCredentials;\n\n    /**\n     * Only scopes in this list will be passed in the token refresh request.\n     */\n    refreshTokenAllowedScope?: string | undefined;\n\n    /**\n     * Defines request timeouts globally across all requests made to the authorisation server\n     */\n    requestTimeoutInSeconds?: number | undefined;\n\n    /**\n     * https://datatracker.ietf.org/doc/html/rfc6749#section-3.3 describes behavior when omitting scopes from sign in requests\n     * If the IDP supports default scopes, this setting will ignore the scopes property passed to the config. (Default: false)\n     */\n    omitScopeWhenRequesting?: boolean;\n}\n\n/**\n * The settings with defaults applied of the {@link OidcClient}.\n *\n * @public\n * @see {@link OidcClientSettings}\n */\nexport class OidcClientSettingsStore {\n    // metadata\n    public readonly authority: string;\n    public readonly metadataUrl: string;\n    public readonly metadata: Partial<OidcMetadata> | undefined;\n    public readonly metadataSeed: Partial<OidcMetadata> | undefined;\n    public readonly signingKeys: SigningKey[] | undefined;\n\n    // client config\n    public readonly client_id: string;\n    public readonly client_secret: string | undefined;\n    public readonly response_type: string;\n    public readonly scope: string;\n    public readonly redirect_uri: string;\n    public readonly post_logout_redirect_uri: string | undefined;\n    public readonly client_authentication: \"client_secret_basic\" | \"client_secret_post\" | \"client_secret_jwt\";\n    public readonly token_endpoint_auth_signing_alg: \"HS256\" | \"HS384\" | \"HS512\";\n\n    // optional protocol params\n    public readonly prompt: string | undefined;\n    public readonly display: string | undefined;\n    public readonly max_age: number | undefined;\n    public readonly ui_locales: string | undefined;\n    public readonly acr_values: string | undefined;\n    public readonly resource: string | string[] | undefined;\n    public readonly response_mode: \"query\" | \"fragment\" | undefined;\n\n    // behavior flags\n    public readonly filterProtocolClaims: boolean | string[];\n    public readonly loadUserInfo: boolean;\n    public readonly staleStateAgeInSeconds: number;\n    public readonly mergeClaimsStrategy: { array: \"replace\" | \"merge\" };\n    public readonly omitScopeWhenRequesting: boolean;\n\n    public readonly stateStore: StateStore;\n\n    // extra\n    public readonly extraQueryParams: Record<string, string | number | boolean>;\n    public readonly extraTokenParams: Record<string, unknown>;\n    public readonly dpop: DPoPSettings | undefined;\n    public readonly extraHeaders: Record<string, ExtraHeader>;\n\n    public readonly revokeTokenAdditionalContentTypes?: string[];\n    public readonly fetchRequestCredentials: RequestCredentials;\n    public readonly refreshTokenAllowedScope: string | undefined;\n    public readonly disablePKCE: boolean;\n    public readonly requestTimeoutInSeconds: number | undefined;\n\n    public constructor({\n        // metadata related\n        authority, metadataUrl, metadata, signingKeys, metadataSeed,\n        // client related\n        client_id, client_secret, response_type = DefaultResponseType, scope = DefaultScope,\n        redirect_uri, post_logout_redirect_uri,\n        client_authentication = DefaultClientAuthentication,\n        token_endpoint_auth_signing_alg = \"HS256\",\n        // optional protocol\n        prompt, display, max_age, ui_locales, acr_values, resource, response_mode,\n        // behavior flags\n        filterProtocolClaims = true,\n        loadUserInfo = false,\n        requestTimeoutInSeconds,\n        staleStateAgeInSeconds = DefaultStaleStateAgeInSeconds,\n        mergeClaimsStrategy = { array: \"replace\" },\n        disablePKCE = false,\n        // other behavior\n        stateStore,\n        revokeTokenAdditionalContentTypes,\n        fetchRequestCredentials,\n        refreshTokenAllowedScope,\n        // extra\n        extraQueryParams = {},\n        extraTokenParams = {},\n        extraHeaders = {},\n        dpop,\n        omitScopeWhenRequesting = false,\n    }: OidcClientSettings) {\n\n        this.authority = authority;\n\n        if (metadataUrl) {\n            this.metadataUrl = metadataUrl;\n        } else {\n            this.metadataUrl = authority;\n            if (authority) {\n                if (!this.metadataUrl.endsWith(\"/\")) {\n                    this.metadataUrl += \"/\";\n                }\n                this.metadataUrl += \".well-known/openid-configuration\";\n            }\n        }\n\n        this.metadata = metadata;\n        this.metadataSeed = metadataSeed;\n        this.signingKeys = signingKeys;\n\n        this.client_id = client_id;\n        this.client_secret = client_secret;\n        this.response_type = response_type;\n        this.scope = scope;\n        this.redirect_uri = redirect_uri;\n        this.post_logout_redirect_uri = post_logout_redirect_uri;\n        this.client_authentication = client_authentication;\n        this.token_endpoint_auth_signing_alg = token_endpoint_auth_signing_alg;\n\n        this.prompt = prompt;\n        this.display = display;\n        this.max_age = max_age;\n        this.ui_locales = ui_locales;\n        this.acr_values = acr_values;\n        this.resource = resource;\n        this.response_mode = response_mode;\n\n        this.filterProtocolClaims = filterProtocolClaims ?? true;\n        this.loadUserInfo = !!loadUserInfo;\n        this.staleStateAgeInSeconds = staleStateAgeInSeconds;\n        this.mergeClaimsStrategy = mergeClaimsStrategy;\n        this.omitScopeWhenRequesting = omitScopeWhenRequesting;\n        this.disablePKCE = !!disablePKCE;\n        this.revokeTokenAdditionalContentTypes = revokeTokenAdditionalContentTypes;\n\n        this.fetchRequestCredentials = fetchRequestCredentials ? fetchRequestCredentials : \"same-origin\";\n        this.requestTimeoutInSeconds = requestTimeoutInSeconds;\n\n        if (stateStore) {\n            this.stateStore = stateStore;\n        }\n        else {\n            const store = typeof window !== \"undefined\" ? window.localStorage : new InMemoryWebStorage();\n            this.stateStore = new WebStorageStateStore({ store });\n        }\n\n        this.refreshTokenAllowedScope = refreshTokenAllowedScope;\n\n        this.extraQueryParams = extraQueryParams;\n        this.extraTokenParams = extraTokenParams;\n        this.extraHeaders = extraHeaders;\n\n        this.dpop = dpop;\n        if (this.dpop && !this.dpop?.store) {\n            throw new Error(\"A DPoPStore is required when dpop is enabled\");\n        }\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, JwtUtils } from \"./utils\";\nimport { JsonService } from \"./JsonService\";\nimport type { MetadataService } from \"./MetadataService\";\nimport type { JwtClaims } from \"./Claims\";\nimport type { OidcClientSettingsStore } from \"./OidcClientSettings\";\n\n/**\n * @internal\n */\nexport class UserInfoService {\n    protected readonly _logger = new Logger(\"UserInfoService\");\n    private readonly _jsonService: JsonService;\n\n    public constructor(private readonly _settings: OidcClientSettingsStore,\n        private readonly _metadataService: MetadataService,\n    ) {\n        this._jsonService = new JsonService(\n            undefined,\n            this._getClaimsFromJwt,\n            this._settings.extraHeaders,\n        );\n    }\n\n    public async getClaims(token: string): Promise<JwtClaims> {\n        const logger = this._logger.create(\"getClaims\");\n        if (!token) {\n            this._logger.throw(new Error(\"No token passed\"));\n        }\n\n        const url = await this._metadataService.getUserInfoEndpoint();\n        logger.debug(\"got userinfo url\", url);\n\n        const claims = await this._jsonService.getJson(url, {\n            token,\n            credentials: this._settings.fetchRequestCredentials,\n            timeoutInSeconds: this._settings.requestTimeoutInSeconds,\n        });\n        logger.debug(\"got claims\", claims);\n\n        return claims;\n    }\n\n    protected _getClaimsFromJwt = async (responseText: string): Promise<JwtClaims> => {\n        const logger = this._logger.create(\"_getClaimsFromJwt\");\n        try {\n            const payload = JwtUtils.decode(responseText);\n            logger.debug(\"JWT decoding successful\");\n\n            return payload;\n        } catch (err) {\n            logger.error(\"Error parsing JWT response\");\n            throw err;\n        }\n    };\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { CryptoUtils, Logger } from \"./utils\";\nimport { JsonService } from \"./JsonService\";\nimport type { MetadataService } from \"./MetadataService\";\nimport type { ExtraHeader, OidcClientSettingsStore } from \"./OidcClientSettings\";\n\n/**\n * @internal\n */\nexport interface ExchangeCodeArgs {\n    client_id?: string;\n    client_secret?: string;\n    redirect_uri?: string;\n\n    grant_type?: string;\n    code: string;\n    code_verifier?: string;\n\n    extraHeaders?: Record<string, ExtraHeader>;\n}\n\n/**\n * @internal\n */\nexport interface ExchangeCredentialsArgs {\n    client_id?: string;\n    client_secret?: string;\n\n    grant_type?: string;\n    scope?: string;\n\n    username: string;\n    password: string;\n}\n\n/**\n * @internal\n */\nexport interface ExchangeRefreshTokenArgs {\n    client_id?: string;\n    client_secret?: string;\n    redirect_uri?: string;\n\n    grant_type?: string;\n    refresh_token: string;\n    scope?: string;\n    resource?: string | string[];\n\n    timeoutInSeconds?: number;\n\n    extraHeaders?: Record<string, ExtraHeader>;\n}\n\n/**\n * @internal\n */\nexport interface RevokeArgs {\n    token: string;\n    token_type_hint?: \"access_token\" | \"refresh_token\";\n}\n\n/**\n * @internal\n */\nexport class TokenClient {\n    private readonly _logger = new Logger(\"TokenClient\");\n    private readonly _jsonService;\n\n    public constructor(\n        private readonly _settings: OidcClientSettingsStore,\n        private readonly _metadataService: MetadataService,\n    ) {\n        this._jsonService = new JsonService(\n            this._settings.revokeTokenAdditionalContentTypes,\n            null,\n            this._settings.extraHeaders,\n        );\n    }\n\n    /**\n     * Exchange code.\n     *\n     * @see https://www.rfc-editor.org/rfc/rfc6749#section-4.1.3\n     */\n    public async exchangeCode({\n        grant_type = \"authorization_code\",\n        redirect_uri = this._settings.redirect_uri,\n        client_id = this._settings.client_id,\n        client_secret = this._settings.client_secret,\n        extraHeaders,\n        ...args\n    }: ExchangeCodeArgs): Promise<Record<string, unknown>> {\n        const logger = this._logger.create(\"exchangeCode\");\n        if (!client_id) {\n            logger.throw(new Error(\"A client_id is required\"));\n        }\n        if (!redirect_uri) {\n            logger.throw(new Error(\"A redirect_uri is required\"));\n        }\n        if (!args.code) {\n            logger.throw(new Error(\"A code is required\"));\n        }\n\n        const params = new URLSearchParams({ grant_type, redirect_uri });\n        for (const [key, value] of Object.entries(args)) {\n            if (value != null) {\n                params.set(key, value);\n            }\n        }\n\n        // Validate client_secret if required before making any external calls\n        if ((this._settings.client_authentication === \"client_secret_basic\" ||\n             this._settings.client_authentication === \"client_secret_jwt\") &&\n            (client_secret === undefined || client_secret === null)) {\n            logger.throw(new Error(\"A client_secret is required\"));\n            // eslint-disable-next-line @typescript-eslint/only-throw-error\n            throw null; // https://github.com/microsoft/TypeScript/issues/46972\n        }\n\n        let basicAuth: string | undefined;\n        const url = await this._metadataService.getTokenEndpoint(false);\n        switch (this._settings.client_authentication) {\n            case \"client_secret_basic\":\n                basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret!);\n                break;\n            case \"client_secret_post\":\n                params.append(\"client_id\", client_id);\n                if (client_secret) {\n                    params.append(\"client_secret\", client_secret);\n                }\n                break;\n            case \"client_secret_jwt\": {\n                const clientAssertion = await CryptoUtils.generateClientAssertionJwt(client_id, client_secret!, url, this._settings.token_endpoint_auth_signing_alg);\n                params.append(\"client_id\", client_id);\n                params.append(\"client_assertion_type\", \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\");\n                params.append(\"client_assertion\", clientAssertion);\n                break;\n            }\n        }\n        logger.debug(\"got token endpoint\");\n\n        const response = await this._jsonService.postForm(url, {\n            body: params,\n            basicAuth,\n            timeoutInSeconds: this._settings.requestTimeoutInSeconds,\n            initCredentials: this._settings.fetchRequestCredentials,\n            extraHeaders,\n        });\n\n        logger.debug(\"got response\");\n\n        return response;\n    }\n\n    /**\n     * Exchange credentials.\n     *\n     * @see https://www.rfc-editor.org/rfc/rfc6749#section-4.3.2\n     */\n    public async exchangeCredentials({\n        grant_type = \"password\",\n        client_id = this._settings.client_id,\n        client_secret = this._settings.client_secret,\n        scope = this._settings.scope,\n        ...args\n    }: ExchangeCredentialsArgs): Promise<Record<string, unknown>> {\n        const logger = this._logger.create(\"exchangeCredentials\");\n\n        if (!client_id) {\n            logger.throw(new Error(\"A client_id is required\"));\n        }\n\n        const params = new URLSearchParams({ grant_type });\n        if (!this._settings.omitScopeWhenRequesting) {\n            params.set(\"scope\", scope);\n        }\n        for (const [key, value] of Object.entries(args)) {\n            if (value != null) {\n                params.set(key, value);\n            }\n        }\n\n        // Validate client_secret if required before making any external calls\n        if ((this._settings.client_authentication === \"client_secret_basic\" ||\n             this._settings.client_authentication === \"client_secret_jwt\") &&\n            (client_secret === undefined || client_secret === null)) {\n            logger.throw(new Error(\"A client_secret is required\"));\n            // eslint-disable-next-line @typescript-eslint/only-throw-error\n            throw null; // https://github.com/microsoft/TypeScript/issues/46972\n        }\n\n        let basicAuth: string | undefined;\n        const url = await this._metadataService.getTokenEndpoint(false);\n        switch (this._settings.client_authentication) {\n            case \"client_secret_basic\":\n                basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret!);\n                break;\n            case \"client_secret_post\":\n                params.append(\"client_id\", client_id);\n                if (client_secret) {\n                    params.append(\"client_secret\", client_secret);\n                }\n                break;\n            case \"client_secret_jwt\": {\n                const clientAssertion = await CryptoUtils.generateClientAssertionJwt(client_id, client_secret!, url, this._settings.token_endpoint_auth_signing_alg);\n                params.append(\"client_id\", client_id);\n                params.append(\"client_assertion_type\", \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\");\n                params.append(\"client_assertion\", clientAssertion);\n                break;\n            }\n        }\n        logger.debug(\"got token endpoint\");\n\n        const response = await this._jsonService.postForm(url, { body: params, basicAuth, timeoutInSeconds: this._settings.requestTimeoutInSeconds, initCredentials: this._settings.fetchRequestCredentials });\n        logger.debug(\"got response\");\n\n        return response;\n    }\n\n    /**\n     * Exchange a refresh token.\n     *\n     * @see https://www.rfc-editor.org/rfc/rfc6749#section-6\n     */\n    public async exchangeRefreshToken({\n        grant_type = \"refresh_token\",\n        client_id = this._settings.client_id,\n        client_secret = this._settings.client_secret,\n        timeoutInSeconds,\n        extraHeaders,\n        ...args\n    }: ExchangeRefreshTokenArgs): Promise<Record<string, unknown>> {\n        const logger = this._logger.create(\"exchangeRefreshToken\");\n        if (!client_id) {\n            logger.throw(new Error(\"A client_id is required\"));\n        }\n        if (!args.refresh_token) {\n            logger.throw(new Error(\"A refresh_token is required\"));\n        }\n\n        const params = new URLSearchParams({ grant_type });\n        for (const [key, value] of Object.entries(args)) {\n            if (Array.isArray(value)) {\n                value.forEach(param => params.append(key, param));\n            }\n            else if (value != null) {\n                params.set(key, value);\n            }\n        }\n\n        // Validate client_secret if required before making any external calls\n        if ((this._settings.client_authentication === \"client_secret_basic\" ||\n             this._settings.client_authentication === \"client_secret_jwt\") &&\n            (client_secret === undefined || client_secret === null)) {\n            logger.throw(new Error(\"A client_secret is required\"));\n            // eslint-disable-next-line @typescript-eslint/only-throw-error\n            throw null; // https://github.com/microsoft/TypeScript/issues/46972\n        }\n\n        let basicAuth: string | undefined;\n        const url = await this._metadataService.getTokenEndpoint(false);\n        switch (this._settings.client_authentication) {\n            case \"client_secret_basic\":\n                basicAuth = CryptoUtils.generateBasicAuth(client_id, client_secret!);\n                break;\n            case \"client_secret_post\":\n                params.append(\"client_id\", client_id);\n                if (client_secret) {\n                    params.append(\"client_secret\", client_secret);\n                }\n                break;\n            case \"client_secret_jwt\": {\n                const clientAssertion = await CryptoUtils.generateClientAssertionJwt(client_id, client_secret!, url, this._settings.token_endpoint_auth_signing_alg);\n                params.append(\"client_id\", client_id);\n                params.append(\"client_assertion_type\", \"urn:ietf:params:oauth:client-assertion-type:jwt-bearer\");\n                params.append(\"client_assertion\", clientAssertion);\n                break;\n            }\n        }\n        logger.debug(\"got token endpoint\");\n\n        const response = await this._jsonService.postForm(url, { body: params, basicAuth, timeoutInSeconds, initCredentials: this._settings.fetchRequestCredentials, extraHeaders });\n        logger.debug(\"got response\");\n\n        return response;\n    }\n\n    /**\n     * Revoke an access or refresh token.\n     *\n     * @see https://datatracker.ietf.org/doc/html/rfc7009#section-2.1\n     */\n    public async revoke(args: RevokeArgs): Promise<void> {\n        const logger = this._logger.create(\"revoke\");\n        if (!args.token) {\n            logger.throw(new Error(\"A token is required\"));\n        }\n\n        const url = await this._metadataService.getRevocationEndpoint(false);\n\n        logger.debug(`got revocation endpoint, revoking ${args.token_type_hint ?? \"default token type\"}`);\n\n        const params = new URLSearchParams();\n        for (const [key, value] of Object.entries(args)) {\n            if (value != null) {\n                params.set(key, value);\n            }\n        }\n        params.set(\"client_id\", this._settings.client_id);\n        if (this._settings.client_secret) {\n            params.set(\"client_secret\", this._settings.client_secret);\n        }\n\n        await this._jsonService.postForm(url, { body: params, timeoutInSeconds: this._settings.requestTimeoutInSeconds });\n        logger.debug(\"got response\");\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, JwtUtils } from \"./utils\";\nimport { ErrorResponse } from \"./errors\";\nimport type { MetadataService } from \"./MetadataService\";\nimport { UserInfoService } from \"./UserInfoService\";\nimport { TokenClient } from \"./TokenClient\";\nimport type { ExtraHeader, OidcClientSettingsStore } from \"./OidcClientSettings\";\nimport type { SigninState } from \"./SigninState\";\nimport type { SigninResponse } from \"./SigninResponse\";\nimport type { State } from \"./State\";\nimport type { SignoutResponse } from \"./SignoutResponse\";\nimport type { UserProfile } from \"./User\";\nimport type { RefreshState } from \"./RefreshState\";\nimport type { IdTokenClaims } from \"./Claims\";\nimport type { ClaimsService } from \"./ClaimsService\";\n\n/**\n * @internal\n */\nexport class ResponseValidator {\n    protected readonly _logger = new Logger(\"ResponseValidator\");\n    protected readonly _userInfoService: UserInfoService;\n    protected readonly _tokenClient: TokenClient;\n\n    public constructor(\n        protected readonly _settings: OidcClientSettingsStore,\n        protected readonly _metadataService: MetadataService,\n        protected readonly _claimsService: ClaimsService,\n    ) {\n        this._userInfoService = new UserInfoService(this._settings, this._metadataService);\n        this._tokenClient = new TokenClient(this._settings, this._metadataService);\n    }\n\n    public async validateSigninResponse(response: SigninResponse, state: SigninState, extraHeaders?: Record<string, ExtraHeader>): Promise<void> {\n        const logger = this._logger.create(\"validateSigninResponse\");\n\n        this._processSigninState(response, state);\n        logger.debug(\"state processed\");\n\n        await this._processCode(response, state, extraHeaders);\n        logger.debug(\"code processed\");\n\n        if (response.isOpenId) {\n            this._validateIdTokenAttributes(response, \"\", state.nonce);\n        }\n        logger.debug(\"tokens validated\");\n\n        await this._processClaims(response, state?.skipUserInfo, response.isOpenId);\n        logger.debug(\"claims processed\");\n    }\n\n    public async validateCredentialsResponse(response: SigninResponse, skipUserInfo: boolean): Promise<void> {\n        const logger = this._logger.create(\"validateCredentialsResponse\");\n        const shouldValidateSubClaim = response.isOpenId && !!response.id_token;\n\n        if (shouldValidateSubClaim) {\n            this._validateIdTokenAttributes(response);\n        }\n        logger.debug(\"tokens validated\");\n\n        await this._processClaims(response, skipUserInfo, shouldValidateSubClaim);\n        logger.debug(\"claims processed\");\n    }\n\n    public async validateRefreshResponse(response: SigninResponse, state: RefreshState): Promise<void> {\n        const logger = this._logger.create(\"validateRefreshResponse\");\n\n        response.userState = state.data;\n        // if there's no session_state on the response, copy over session_state from original request\n        response.session_state ??= state.session_state;\n        // if there's no scope on the response, then assume all scopes granted (per-spec) and copy over scopes from original request\n        response.scope ??= state.scope;\n\n        // OpenID Connect Core 1.0 says that id_token is optional in refresh response:\n        // https://openid.net/specs/openid-connect-core-1_0.html#RefreshTokenResponse\n        if (response.isOpenId && !!response.id_token) {\n            this._validateIdTokenAttributes(response, state.id_token);\n            logger.debug(\"ID Token validated\");\n        }\n\n        if (!response.id_token) {\n            // if there's no id_token on the response, copy over id_token from original request\n            response.id_token = state.id_token;\n            // and decoded part too\n            response.profile = state.profile;\n        }\n\n        const hasIdToken = response.isOpenId && !!response.id_token;\n        await this._processClaims(response, false, hasIdToken);\n        logger.debug(\"claims processed\");\n    }\n\n    public validateSignoutResponse(response: SignoutResponse, state: State): void {\n        const logger = this._logger.create(\"validateSignoutResponse\");\n        if (state.id !== response.state) {\n            logger.throw(new Error(\"State does not match\"));\n        }\n\n        // now that we know the state matches, take the stored data\n        // and set it into the response so callers can get their state\n        // this is important for both success & error outcomes\n        logger.debug(\"state validated\");\n        response.userState = state.data;\n\n        if (response.error) {\n            logger.warn(\"Response was error\", response.error);\n            throw new ErrorResponse(response);\n        }\n    }\n\n    protected _processSigninState(response: SigninResponse, state: SigninState): void {\n        const logger = this._logger.create(\"_processSigninState\");\n        if (state.id !== response.state) {\n            logger.throw(new Error(\"State does not match\"));\n        }\n\n        if (!state.client_id) {\n            logger.throw(new Error(\"No client_id on state\"));\n        }\n\n        if (!state.authority) {\n            logger.throw(new Error(\"No authority on state\"));\n        }\n\n        // ensure we're using the correct authority\n        if (this._settings.authority !== state.authority) {\n            logger.throw(new Error(\"authority mismatch on settings vs. signin state\"));\n        }\n        if (this._settings.client_id && this._settings.client_id !== state.client_id) {\n            logger.throw(new Error(\"client_id mismatch on settings vs. signin state\"));\n        }\n\n        // now that we know the state matches, take the stored data\n        // and set it into the response so callers can get their state\n        // this is important for both success & error outcomes\n        logger.debug(\"state validated\");\n        response.userState = state.data;\n        response.url_state = state.url_state;\n        // if there's no scope on the response, then assume all scopes granted (per-spec) and copy over scopes from original request\n        response.scope ??= state.scope;\n\n        if (response.error) {\n            logger.warn(\"Response was error\", response.error);\n            throw new ErrorResponse(response);\n        }\n\n        if (state.code_verifier && !response.code) {\n            logger.throw(new Error(\"Expected code in response\"));\n        }\n\n    }\n\n    protected async _processClaims(response: SigninResponse, skipUserInfo = false, validateSub = true): Promise<void> {\n        const logger = this._logger.create(\"_processClaims\");\n        response.profile = this._claimsService.filterProtocolClaims(response.profile);\n\n        if (skipUserInfo || !this._settings.loadUserInfo || !response.access_token) {\n            logger.debug(\"not loading user info\");\n            return;\n        }\n\n        logger.debug(\"loading user info\");\n        const claims = await this._userInfoService.getClaims(response.access_token);\n        logger.debug(\"user info claims received from user info endpoint\");\n\n        if (validateSub && claims.sub !== response.profile.sub) {\n            logger.throw(new Error(\"subject from UserInfo response does not match subject in ID Token\"));\n        }\n\n        response.profile = this._claimsService.mergeClaims(response.profile, this._claimsService.filterProtocolClaims(claims as IdTokenClaims));\n        logger.debug(\"user info claims received, updated profile:\", response.profile);\n    }\n\n    protected async _processCode(response: SigninResponse, state: SigninState, extraHeaders?: Record<string, ExtraHeader>): Promise<void> {\n        const logger = this._logger.create(\"_processCode\");\n        if (response.code) {\n            logger.debug(\"Validating code\");\n            const tokenResponse = await this._tokenClient.exchangeCode({\n                client_id: state.client_id,\n                client_secret: state.client_secret,\n                code: response.code,\n                redirect_uri: state.redirect_uri,\n                code_verifier: state.code_verifier,\n                extraHeaders: extraHeaders,\n                ...state.extraTokenParams,\n            });\n            Object.assign(response, tokenResponse);\n        } else {\n            logger.debug(\"No code to process\");\n        }\n    }\n\n    protected _validateIdTokenAttributes(response: SigninResponse, existingToken?: string, nonce?: string): void {\n        const logger = this._logger.create(\"_validateIdTokenAttributes\");\n\n        logger.debug(\"decoding ID Token JWT\");\n        const incoming = JwtUtils.decode(response.id_token ?? \"\");\n\n        if (!incoming.sub) {\n            logger.throw(new Error(\"ID Token is missing a subject claim\"));\n        }\n\n        if (nonce && incoming.nonce !== nonce) {\n            logger.throw(new Error(\"nonce in id_token does not match nonce in client storage\"));\n        }\n\n        if (existingToken) {\n            const existing = JwtUtils.decode(existingToken);\n            if (incoming.sub !== existing.sub) {\n                logger.throw(new Error(\"sub in id_token does not match current sub\"));\n            }\n            if (incoming.auth_time && incoming.auth_time !== existing.auth_time) {\n                logger.throw(new Error(\"auth_time in id_token does not match original auth_time\"));\n            }\n            if (incoming.azp && incoming.azp !== existing.azp) {\n                logger.throw(new Error(\"azp in id_token does not match original azp\"));\n            }\n            if (!incoming.azp && existing.azp) {\n                logger.throw(new Error(\"azp not in id_token, but present in original id_token\"));\n            }\n        }\n\n        response.profile = incoming as UserProfile;\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, CryptoUtils, Timer } from \"./utils\";\nimport type { StateStore } from \"./StateStore\";\n\n/**\n * @public\n */\nexport class State {\n    public readonly id: string;\n    public readonly created: number;\n    public readonly request_type: string | undefined;\n    public readonly url_state: string | undefined;\n\n    /** custom \"state\", which can be used by a caller to have \"data\" round tripped */\n    public readonly data?: unknown;\n\n    public constructor(args: {\n        id?: string;\n        data?: unknown;\n        created?: number;\n        request_type?: string;\n        url_state?: string;\n    }) {\n        this.id = args.id || CryptoUtils.generateUUIDv4();\n        this.data = args.data;\n\n        if (args.created && args.created > 0) {\n            this.created = args.created;\n        }\n        else {\n            this.created = Timer.getEpochTime();\n        }\n        this.request_type = args.request_type;\n        this.url_state = args.url_state;\n    }\n\n    public toStorageString(): string {\n        new Logger(\"State\").create(\"toStorageString\");\n        return JSON.stringify({\n            id: this.id,\n            data: this.data,\n            created: this.created,\n            request_type: this.request_type,\n            url_state: this.url_state,\n        });\n    }\n\n    public static fromStorageString(storageString: string): Promise<State> {\n        Logger.createStatic(\"State\", \"fromStorageString\");\n        return Promise.resolve(new State(JSON.parse(storageString)));\n    }\n\n    public static async clearStaleState(storage: StateStore, age: number): Promise<void> {\n        const logger = Logger.createStatic(\"State\", \"clearStaleState\");\n        const cutoff = Timer.getEpochTime() - age;\n\n        const keys = await storage.getAllKeys();\n        logger.debug(\"got keys\", keys);\n\n        for (let i = 0; i < keys.length; i++) {\n            const key = keys[i];\n            const item = await storage.get(key);\n            let remove = false;\n\n            if (item) {\n                try {\n                    const state = await State.fromStorageString(item);\n\n                    logger.debug(\"got item from key:\", key, state.created);\n                    if (state.created <= cutoff) {\n                        remove = true;\n                    }\n                }\n                catch (err) {\n                    logger.error(\"Error parsing state for key:\", key, err);\n                    remove = true;\n                }\n            }\n            else {\n                logger.debug(\"no item in storage for key:\", key);\n                remove = true;\n            }\n\n            if (remove) {\n                logger.debug(\"removed item for key:\", key);\n                void storage.remove(key);\n            }\n        }\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, CryptoUtils } from \"./utils\";\nimport { State } from \"./State\";\n\n/** @public */\nexport interface SigninStateArgs {\n    id?: string;\n    data?: unknown;\n    created?: number;\n    request_type?: string;\n\n    code_verifier?: string;\n    code_challenge?: string;\n    authority: string;\n    client_id: string;\n    redirect_uri: string;\n    scope: string;\n    client_secret?: string;\n    extraTokenParams?: Record<string, unknown>;\n    response_mode?: \"query\" | \"fragment\";\n    skipUserInfo?: boolean;\n    url_state?: string;\n    nonce?: string;\n}\n\n/** @public */\nexport type SigninStateCreateArgs = Omit<SigninStateArgs, \"code_verifier\"> & {\n    code_verifier?: string | boolean;\n};\n\n/**\n * @public\n */\nexport class SigninState extends State {\n    // isCode\n    /** The same code_verifier that was used to obtain the authorization_code via PKCE. */\n    public readonly code_verifier: string | undefined;\n    /** Used to secure authorization code grants via Proof Key for Code Exchange (PKCE). */\n    public readonly code_challenge: string | undefined;\n\n    // to ensure state still matches settings\n    /** @see {@link OidcClientSettings.authority} */\n    public readonly authority: string;\n    /** @see {@link OidcClientSettings.client_id} */\n    public readonly client_id: string;\n    /** @see {@link OidcClientSettings.redirect_uri} */\n    public readonly redirect_uri: string;\n    /** @see {@link OidcClientSettings.scope} */\n    public readonly scope: string;\n    /** @see {@link OidcClientSettings.client_secret} */\n    public readonly client_secret: string | undefined;\n    /** @see {@link OidcClientSettings.extraTokenParams} */\n    public readonly extraTokenParams: Record<string, unknown> | undefined;\n    /** @see {@link OidcClientSettings.response_mode} */\n    public readonly response_mode: \"query\" | \"fragment\" | undefined;\n\n    public readonly skipUserInfo: boolean | undefined;\n    /** @see {@link SigninRequestCreateArgs.nonce} */\n    public readonly nonce: string | undefined;\n\n    private constructor(args: SigninStateArgs) {\n        super(args);\n\n        this.code_verifier = args.code_verifier;\n        this.code_challenge = args.code_challenge;\n        this.authority = args.authority;\n        this.client_id = args.client_id;\n        this.redirect_uri = args.redirect_uri;\n        this.scope = args.scope;\n        this.client_secret = args.client_secret;\n        this.extraTokenParams = args.extraTokenParams;\n\n        this.response_mode = args.response_mode;\n        this.skipUserInfo = args.skipUserInfo;\n        this.nonce = args.nonce;\n    }\n\n    public static async create(args: SigninStateCreateArgs): Promise<SigninState> {\n        const code_verifier = args.code_verifier === true ? CryptoUtils.generateCodeVerifier() : (args.code_verifier || undefined);\n        const code_challenge = code_verifier ? (await CryptoUtils.generateCodeChallenge(code_verifier)) : undefined;\n\n        return new SigninState({\n            ...args,\n            code_verifier,\n            code_challenge,\n        });\n    }\n\n    public toStorageString(): string {\n        new Logger(\"SigninState\").create(\"toStorageString\");\n        return JSON.stringify({\n            id: this.id,\n            data: this.data,\n            created: this.created,\n            request_type: this.request_type,\n            url_state: this.url_state,\n\n            code_verifier: this.code_verifier,\n            authority: this.authority,\n            client_id: this.client_id,\n            redirect_uri: this.redirect_uri,\n            scope: this.scope,\n            client_secret: this.client_secret,\n            extraTokenParams : this.extraTokenParams,\n            response_mode: this.response_mode,\n            skipUserInfo: this.skipUserInfo,\n            nonce: this.nonce,\n        });\n    }\n\n    public static fromStorageString(storageString: string): Promise<SigninState> {\n        Logger.createStatic(\"SigninState\", \"fromStorageString\");\n        const data = JSON.parse(storageString);\n        return SigninState.create(data);\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, URL_STATE_DELIMITER } from \"./utils\";\nimport { SigninState } from \"./SigninState\";\n\n/**\n * @public\n * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest\n */\nexport interface SigninRequestCreateArgs {\n    // mandatory\n    url: string;\n    authority: string;\n    client_id: string;\n    redirect_uri: string;\n    response_type: string;\n    scope: string;\n\n    // optional\n    response_mode?: \"query\" | \"fragment\";\n    nonce?: string;\n    display?: string;\n    dpopJkt?: string;\n    prompt?: string;\n    max_age?: number;\n    ui_locales?: string;\n    id_token_hint?: string;\n    login_hint?: string;\n    acr_values?: string;\n\n    // other\n    resource?: string | string[];\n    request?: string;\n    request_uri?: string;\n    request_type?: string;\n    extraQueryParams?: Record<string, string | number | boolean>;\n\n    // special\n    extraTokenParams?: Record<string, unknown>;\n    client_secret?: string;\n    skipUserInfo?: boolean;\n    disablePKCE?: boolean;\n    /** custom \"state\", which can be used by a caller to have \"data\" round tripped */\n    state_data?: unknown;\n    url_state?: string;\n    omitScopeWhenRequesting?: boolean;\n}\n\n/**\n * @public\n */\nexport class SigninRequest {\n    private static readonly _logger = new Logger(\"SigninRequest\");\n\n    public readonly url: string;\n    public readonly state: SigninState;\n\n    private constructor(args: {\n        url: string;\n        state: SigninState;\n    }) {\n        this.url = args.url;\n        this.state = args.state;\n    }\n\n    public static async create({\n        // mandatory\n        url, authority, client_id, redirect_uri, response_type, scope,\n        // optional\n        state_data, response_mode, request_type, client_secret, nonce, url_state,\n        resource,\n        skipUserInfo,\n        extraQueryParams,\n        extraTokenParams,\n        disablePKCE,\n        dpopJkt,\n        omitScopeWhenRequesting,\n        ...optionalParams\n    }: SigninRequestCreateArgs): Promise<SigninRequest> {\n        if (!url) {\n            this._logger.error(\"create: No url passed\");\n            throw new Error(\"url\");\n        }\n        if (!client_id) {\n            this._logger.error(\"create: No client_id passed\");\n            throw new Error(\"client_id\");\n        }\n        if (!redirect_uri) {\n            this._logger.error(\"create: No redirect_uri passed\");\n            throw new Error(\"redirect_uri\");\n        }\n        if (!response_type) {\n            this._logger.error(\"create: No response_type passed\");\n            throw new Error(\"response_type\");\n        }\n        if (!scope) {\n            this._logger.error(\"create: No scope passed\");\n            throw new Error(\"scope\");\n        }\n        if (!authority) {\n            this._logger.error(\"create: No authority passed\");\n            throw new Error(\"authority\");\n        }\n\n        const state = await SigninState.create({\n            data: state_data,\n            request_type,\n            url_state,\n            code_verifier: !disablePKCE,\n            client_id, authority, redirect_uri,\n            response_mode,\n            client_secret, scope, extraTokenParams,\n            skipUserInfo,\n            nonce,\n        });\n\n        const parsedUrl = new URL(url);\n        parsedUrl.searchParams.append(\"client_id\", client_id);\n        parsedUrl.searchParams.append(\"redirect_uri\", redirect_uri);\n        parsedUrl.searchParams.append(\"response_type\", response_type);\n        if (!omitScopeWhenRequesting) {\n            parsedUrl.searchParams.append(\"scope\", scope);\n        }\n        if (nonce) {\n            parsedUrl.searchParams.append(\"nonce\", nonce);\n        }\n\n        if (dpopJkt) {\n            parsedUrl.searchParams.append(\"dpop_jkt\", dpopJkt);\n        }\n\n        let stateParam = state.id;\n        if (url_state) {\n            stateParam = `${stateParam}${URL_STATE_DELIMITER}${url_state}`;\n        }\n        parsedUrl.searchParams.append(\"state\", stateParam);\n        if (state.code_challenge) {\n            parsedUrl.searchParams.append(\"code_challenge\", state.code_challenge);\n            parsedUrl.searchParams.append(\"code_challenge_method\", \"S256\");\n        }\n\n        if (resource) {\n            // https://datatracker.ietf.org/doc/html/rfc8707\n            const resources = Array.isArray(resource) ? resource : [resource];\n            resources\n                .forEach(r => parsedUrl.searchParams.append(\"resource\", r));\n        }\n\n        for (const [key, value] of Object.entries({ response_mode, ...optionalParams, ...extraQueryParams })) {\n            if (value != null) {\n                parsedUrl.searchParams.append(key, value.toString());\n            }\n        }\n\n        return new SigninRequest({\n            url: parsedUrl.href,\n            state,\n        });\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Timer, URL_STATE_DELIMITER } from \"./utils\";\nimport type { UserProfile } from \"./User\";\n\nconst OidcScope = \"openid\";\n\n/**\n * @public\n * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthResponse\n * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthError\n */\nexport class SigninResponse {\n    // props present in the initial callback response regardless of success\n    public readonly state: string | null;\n    /** @see {@link User.session_state} */\n    public session_state: string | null;\n\n    // error props\n    /** @see {@link ErrorResponse.error} */\n    public readonly error: string | null;\n    /** @see {@link ErrorResponse.error_description} */\n    public readonly error_description: string | null;\n    /** @see {@link ErrorResponse.error_uri} */\n    public readonly error_uri: string | null;\n\n    // success props\n    public readonly code: string | null;\n\n    // props set after validation\n    /** @see {@link User.id_token} */\n    public id_token?: string;\n    /** @see {@link User.access_token} */\n    public access_token = \"\";\n    /** @see {@link User.token_type} */\n    public token_type = \"\";\n    /** @see {@link User.refresh_token} */\n    public refresh_token?: string;\n    /** @see {@link User.scope} */\n    public scope?: string;\n    /** @see {@link User.expires_at} */\n    public expires_at?: number;\n\n    /** custom state data set during the initial signin request */\n    public userState: unknown;\n    public url_state?: string;\n\n    /** @see {@link User.profile} */\n    public profile: UserProfile = {} as UserProfile;\n\n    public constructor(params: URLSearchParams) {\n        this.state = params.get(\"state\");\n        this.session_state = params.get(\"session_state\");\n        if (this.state) {\n            const splitState = decodeURIComponent(this.state).split(URL_STATE_DELIMITER);\n            this.state = splitState[0];\n            if (splitState.length > 1) {\n                this.url_state = splitState.slice(1).join(URL_STATE_DELIMITER);\n            }\n        }\n\n        this.error = params.get(\"error\");\n        this.error_description = params.get(\"error_description\");\n        this.error_uri = params.get(\"error_uri\");\n\n        this.code = params.get(\"code\");\n    }\n\n    public get expires_in(): number | undefined {\n        if (this.expires_at === undefined) {\n            return undefined;\n        }\n        return this.expires_at - Timer.getEpochTime();\n    }\n    public set expires_in(value: number | undefined) {\n        // spec expects a number, but normalize here just in case\n        if (typeof value === \"string\") value = Number(value);\n        if (value !== undefined && value >= 0) {\n            this.expires_at = Math.floor(value) + Timer.getEpochTime();\n        }\n    }\n\n    public get isOpenId(): boolean {\n        return this.scope?.split(\" \").includes(OidcScope) || !!this.id_token;\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, URL_STATE_DELIMITER } from \"./utils\";\nimport { State } from \"./State\";\n\n/**\n * @public\n * @see https://openid.net/specs/openid-connect-rpinitiated-1_0.html#RPLogout\n */\nexport interface SignoutRequestArgs {\n    // mandatory\n    url: string;\n\n    // optional\n    id_token_hint?: string;\n    client_id?: string;\n    post_logout_redirect_uri?: string;\n    extraQueryParams?: Record<string, string | number | boolean>;\n\n    // special\n    request_type?: string;\n    /** custom \"state\", which can be used by a caller to have \"data\" round tripped */\n    state_data?: unknown;\n    url_state?: string;\n}\n\n/**\n * @public\n */\nexport class SignoutRequest {\n    private readonly _logger = new Logger(\"SignoutRequest\");\n\n    public readonly url: string;\n    public readonly state?: State;\n\n    public constructor({\n        url,\n        state_data, id_token_hint, post_logout_redirect_uri, extraQueryParams, request_type, client_id, url_state,\n    }: SignoutRequestArgs) {\n        if (!url) {\n            this._logger.error(\"ctor: No url passed\");\n            throw new Error(\"url\");\n        }\n\n        const parsedUrl = new URL(url);\n        if (id_token_hint) {\n            parsedUrl.searchParams.append(\"id_token_hint\", id_token_hint);\n        }\n        if (client_id) {\n            parsedUrl.searchParams.append(\"client_id\", client_id);\n        }\n\n        if (post_logout_redirect_uri) {\n            parsedUrl.searchParams.append(\"post_logout_redirect_uri\", post_logout_redirect_uri);\n\n            // Add state if either data needs to be stored, or url_state set for an intermediate proxy\n            if (state_data || url_state) {\n                this.state = new State({ data: state_data, request_type, url_state });\n\n                let stateParam = this.state.id;\n                if (url_state) {\n                    stateParam = `${stateParam}${URL_STATE_DELIMITER}${url_state}`;\n                }\n                parsedUrl.searchParams.append(\"state\", stateParam);\n            }\n        }\n\n        for (const [key, value] of Object.entries({ ...extraQueryParams })) {\n            if (value != null) {\n                parsedUrl.searchParams.append(key, value.toString());\n            }\n        }\n\n        this.url = parsedUrl.href;\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { URL_STATE_DELIMITER } from \"./utils\";\n\n/**\n * @public\n * @see https://openid.net/specs/openid-connect-core-1_0.html#AuthError\n */\nexport class SignoutResponse {\n    public readonly state: string | null;\n\n    // error props\n    /** @see {@link ErrorResponse.error} */\n    public error: string | null;\n    /** @see {@link ErrorResponse.error_description} */\n    public error_description: string | null;\n    /** @see {@link ErrorResponse.error_uri} */\n    public error_uri: string | null;\n\n    /** custom state data set during the initial signin request */\n    public userState: unknown;\n    public url_state?: string;\n\n    public constructor(params: URLSearchParams) {\n        this.state = params.get(\"state\");\n        if (this.state) {\n            const splitState = decodeURIComponent(this.state).split(URL_STATE_DELIMITER);\n            this.state = splitState[0];\n            if (splitState.length > 1) {\n                this.url_state = splitState.slice(1).join(URL_STATE_DELIMITER);\n            }\n        }\n\n        this.error = params.get(\"error\");\n        this.error_description = params.get(\"error_description\");\n        this.error_uri = params.get(\"error_uri\");\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport type { JwtClaims } from \"./Claims\";\nimport type { OidcClientSettingsStore } from \"./OidcClientSettings\";\nimport type { UserProfile } from \"./User\";\nimport { Logger } from \"./utils\";\n\n/**\n * Protocol claims that could be removed by default from profile.\n * Derived from the following sets of claims:\n * - {@link https://datatracker.ietf.org/doc/html/rfc7519.html#section-4.1}\n * - {@link https://openid.net/specs/openid-connect-core-1_0.html#IDToken}\n * - {@link https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken}\n *\n * @internal\n */\nconst DefaultProtocolClaims = [\n    \"nbf\",\n    \"jti\",\n    \"auth_time\",\n    \"nonce\",\n    \"acr\",\n    \"amr\",\n    \"azp\",\n    \"at_hash\", // https://openid.net/specs/openid-connect-core-1_0.html#CodeIDToken\n] as const;\n\n/**\n * Protocol claims that should never be removed from profile.\n * \"sub\" is needed internally and others should remain required as per the OIDC specs.\n *\n * @internal\n */\nconst InternalRequiredProtocolClaims = [\"sub\", \"iss\", \"aud\", \"exp\", \"iat\"];\n\n/**\n * @internal\n */\nexport class ClaimsService {\n    protected readonly _logger = new Logger(\"ClaimsService\");\n    public constructor(\n        protected readonly _settings: OidcClientSettingsStore,\n    ) {}\n\n    public filterProtocolClaims(claims: UserProfile): UserProfile {\n        const result = { ...claims };\n\n        if (this._settings.filterProtocolClaims) {\n            let protocolClaims;\n            if (Array.isArray(this._settings.filterProtocolClaims)) {\n                protocolClaims = this._settings.filterProtocolClaims;\n            } else {\n                protocolClaims = DefaultProtocolClaims;\n            }\n\n            for (const claim of protocolClaims) {\n                if (!InternalRequiredProtocolClaims.includes(claim)) {\n                    delete result[claim];\n                }\n            }\n        }\n\n        return result;\n    }\n\n    public mergeClaims(claims1: JwtClaims, claims2: JwtClaims): UserProfile;\n    public mergeClaims(claims1: UserProfile, claims2: JwtClaims): UserProfile {\n        const result = { ...claims1 };\n        for (const [claim, values] of Object.entries(claims2)) {\n            if (result[claim] !== values) {\n                if (Array.isArray(result[claim]) || Array.isArray(values)) {\n                    if (this._settings.mergeClaimsStrategy.array == \"replace\") {\n                        result[claim] = values;\n                    } else {\n                        const mergedValues = Array.isArray(result[claim]) ? result[claim] as unknown[] : [result[claim]];\n                        for (const value of Array.isArray(values) ? values : [values]) {\n                            if (!mergedValues.includes(value)) {\n                                mergedValues.push(value);\n                            }\n                        }\n                        result[claim] = mergedValues;\n                    }\n                } else if (typeof result[claim] === \"object\" && typeof values === \"object\") {\n                    result[claim] = this.mergeClaims(result[claim] as JwtClaims, values as JwtClaims);\n                } else {\n                    result[claim] = values;\n                }\n            }\n        }\n\n        return result;\n    }\n}\n", "/**\n * @public\n */\nexport interface DPoPStore {\n    set(key: string, value: DPoPState): Promise<void>;\n    get(key: string): Promise<DPoPState>;\n    remove(key: string): Promise<DPoPState>;\n    getAllKeys(): Promise<string[]>;\n}\n\n/**\n * @public\n */\nexport class DPoPState {\n    public constructor(\n        public readonly keys: CryptoKeyPair,\n        public nonce?: string,\n    ) { }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { CryptoUtils, Logger, UrlUtils } from \"./utils\";\nimport { ErrorResponse } from \"./errors\";\nimport { type ExtraHeader, type OidcClientSettings, OidcClientSettingsStore } from \"./OidcClientSettings\";\nimport { ResponseValidator } from \"./ResponseValidator\";\nimport { MetadataService } from \"./MetadataService\";\nimport type { RefreshState } from \"./RefreshState\";\nimport { SigninRequest, type SigninRequestCreateArgs } from \"./SigninRequest\";\nimport { SigninResponse } from \"./SigninResponse\";\nimport { SignoutRequest, type SignoutRequestArgs } from \"./SignoutRequest\";\nimport { SignoutResponse } from \"./SignoutResponse\";\nimport { SigninState } from \"./SigninState\";\nimport { State } from \"./State\";\nimport { TokenClient } from \"./TokenClient\";\nimport { ClaimsService } from \"./ClaimsService\";\nimport { DPoPState, type DPoPStore } from \"./DPoPStore\";\nimport { ErrorDPoPNonce } from \"./errors/ErrorDPoPNonce\";\n\n/**\n * @public\n */\nexport interface CreateSigninRequestArgs\n    extends Omit<SigninRequestCreateArgs, \"url\" | \"authority\" | \"client_id\" | \"redirect_uri\" | \"response_type\" | \"scope\" | \"state_data\"> {\n    redirect_uri?: string;\n    response_type?: string;\n    scope?: string;\n    dpopJkt?: string;\n\n    /** custom \"state\", which can be used by a caller to have \"data\" round tripped */\n    state?: unknown;\n}\n\n/**\n * @public\n */\nexport interface UseRefreshTokenArgs {\n    redirect_uri?: string;\n    resource?: string | string[];\n    extraTokenParams?: Record<string, unknown>;\n    timeoutInSeconds?: number;\n\n    state: RefreshState;\n\n    extraHeaders?: Record<string, ExtraHeader>;\n}\n\n/**\n * @public\n */\nexport type CreateSignoutRequestArgs = Omit<SignoutRequestArgs, \"url\" | \"state_data\"> & {\n    /** custom \"state\", which can be used by a caller to have \"data\" round tripped */\n    state?: unknown;\n};\n\n/**\n * @public\n */\nexport type ProcessResourceOwnerPasswordCredentialsArgs = {\n    username: string;\n    password: string;\n    skipUserInfo?: boolean;\n    extraTokenParams?: Record<string, unknown>;\n};\n\n/**\n * Provides the raw OIDC/OAuth2 protocol support for the authorization endpoint and the end session endpoint in the\n * authorization server. It provides a bare-bones protocol implementation and is used by the UserManager class.\n * Only use this class if you simply want protocol support without the additional management features of the\n * UserManager class.\n *\n * @public\n */\nexport class OidcClient {\n    public readonly settings: OidcClientSettingsStore;\n    protected readonly _logger = new Logger(\"OidcClient\");\n\n    public readonly metadataService: MetadataService;\n    protected readonly _claimsService: ClaimsService;\n    protected readonly _validator: ResponseValidator;\n    protected readonly _tokenClient: TokenClient;\n\n    public constructor(settings: OidcClientSettings);\n    public constructor(settings: OidcClientSettingsStore, metadataService: MetadataService);\n    public constructor(settings: OidcClientSettings | OidcClientSettingsStore, metadataService?: MetadataService) {\n        this.settings = settings instanceof OidcClientSettingsStore ? settings : new OidcClientSettingsStore(settings);\n\n        this.metadataService = metadataService ?? new MetadataService(this.settings);\n        this._claimsService = new ClaimsService(this.settings);\n        this._validator = new ResponseValidator(this.settings, this.metadataService, this._claimsService);\n        this._tokenClient = new TokenClient(this.settings, this.metadataService);\n    }\n\n    public async createSigninRequest({\n        state,\n        request,\n        request_uri,\n        request_type,\n        id_token_hint,\n        login_hint,\n        skipUserInfo,\n        nonce,\n        url_state,\n        response_type = this.settings.response_type,\n        scope = this.settings.scope,\n        redirect_uri = this.settings.redirect_uri,\n        prompt = this.settings.prompt,\n        display = this.settings.display,\n        max_age = this.settings.max_age,\n        ui_locales = this.settings.ui_locales,\n        acr_values = this.settings.acr_values,\n        resource = this.settings.resource,\n        response_mode = this.settings.response_mode,\n        extraQueryParams = this.settings.extraQueryParams,\n        extraTokenParams = this.settings.extraTokenParams,\n        dpopJkt,\n        omitScopeWhenRequesting = this.settings.omitScopeWhenRequesting,\n    }: CreateSigninRequestArgs): Promise<SigninRequest> {\n        const logger = this._logger.create(\"createSigninRequest\");\n\n        if (response_type !== \"code\") {\n            throw new Error(\"Only the Authorization Code flow (with PKCE) is supported\");\n        }\n\n        const url = await this.metadataService.getAuthorizationEndpoint();\n        logger.debug(\"Received authorization endpoint\", url);\n\n        const signinRequest = await SigninRequest.create({\n            url,\n            authority: this.settings.authority,\n            client_id: this.settings.client_id,\n            redirect_uri,\n            response_type,\n            scope,\n            state_data: state,\n            url_state,\n            prompt, display, max_age, ui_locales, id_token_hint, login_hint, acr_values, dpopJkt,\n            resource, request, request_uri, extraQueryParams, extraTokenParams, request_type, response_mode,\n            client_secret: this.settings.client_secret,\n            skipUserInfo,\n            nonce,\n            disablePKCE: this.settings.disablePKCE,\n            omitScopeWhenRequesting,\n        });\n\n        // house cleaning\n        await this.clearStaleState();\n\n        const signinState = signinRequest.state;\n        await this.settings.stateStore.set(signinState.id, signinState.toStorageString());\n        return signinRequest;\n    }\n\n    public async readSigninResponseState(url: string, removeState = false): Promise<{ state: SigninState; response: SigninResponse }> {\n        const logger = this._logger.create(\"readSigninResponseState\");\n\n        const response = new SigninResponse(UrlUtils.readParams(url, this.settings.response_mode));\n        if (!response.state) {\n            logger.throw(new Error(\"No state in response\"));\n            // need to throw within this function's body for type narrowing to work\n            // eslint-disable-next-line @typescript-eslint/only-throw-error\n            throw null; // https://github.com/microsoft/TypeScript/issues/46972\n        }\n\n        const storedStateString = await this.settings.stateStore[removeState ? \"remove\" : \"get\"](response.state);\n        if (!storedStateString) {\n            logger.throw(new Error(\"No matching state found in storage\"));\n            // eslint-disable-next-line @typescript-eslint/only-throw-error\n            throw null; // https://github.com/microsoft/TypeScript/issues/46972\n        }\n\n        const state = await SigninState.fromStorageString(storedStateString);\n        return { state, response };\n    }\n\n    public async processSigninResponse(url: string, extraHeaders?: Record<string, ExtraHeader>, removeState = true): Promise<SigninResponse> {\n        const logger = this._logger.create(\"processSigninResponse\");\n\n        const { state, response } = await this.readSigninResponseState(url, removeState);\n        logger.debug(\"received state from storage; validating response\");\n\n        if (this.settings.dpop && this.settings.dpop.store) {\n            const dpopProof = await this.getDpopProof(this.settings.dpop.store);\n            extraHeaders = { ...extraHeaders, \"DPoP\": dpopProof };\n        }\n\n        /**\n         * The DPoP spec describes a method for Authorization Servers to supply a nonce value\n         * in order to limit the lifetime of a given DPoP proof.\n         * See https://datatracker.ietf.org/doc/html/rfc9449#name-authorization-server-provid\n         * This involves the AS returning a 400 bad request with a DPoP-Nonce header containing\n         * the nonce value. The client must then retry the request with a recomputed DPoP proof\n         * containing the supplied nonce value.\n         */\n        try {\n            await this._validator.validateSigninResponse(response, state, extraHeaders);\n        }\n        catch (err) {\n            if (err instanceof ErrorDPoPNonce && this.settings.dpop) {\n                const dpopProof = await this.getDpopProof(this.settings.dpop.store, err.nonce);\n                extraHeaders![\"DPoP\"] = dpopProof;\n                await this._validator.validateSigninResponse(response, state, extraHeaders);\n            } else {\n                throw err;\n            }\n        }\n\n        return response;\n    }\n\n    async getDpopProof(dpopStore: DPoPStore, nonce?: string): Promise<string> {\n        let keyPair: CryptoKeyPair;\n        let dpopState: DPoPState;\n\n        if (!(await dpopStore.getAllKeys()).includes(this.settings.client_id)) {\n            keyPair = await CryptoUtils.generateDPoPKeys();\n            dpopState = new DPoPState(keyPair, nonce);\n            await dpopStore.set(this.settings.client_id, dpopState);\n        } else {\n            dpopState = await dpopStore.get(this.settings.client_id);\n\n            // if the server supplied nonce has changed since the last request, update the nonce\n            if (dpopState.nonce !== nonce && nonce) {\n                dpopState.nonce = nonce;\n                await dpopStore.set(this.settings.client_id, dpopState);\n            }\n        }\n\n        return await CryptoUtils.generateDPoPProof({\n            url: await this.metadataService.getTokenEndpoint(false),\n            httpMethod: \"POST\",\n            keyPair: dpopState.keys,\n            nonce: dpopState.nonce,\n        });\n    }\n\n    public async processResourceOwnerPasswordCredentials({\n        username,\n        password,\n        skipUserInfo = false,\n        extraTokenParams = {},\n    }: ProcessResourceOwnerPasswordCredentialsArgs): Promise<SigninResponse> {\n        const tokenResponse: Record<string, unknown> = await this._tokenClient.exchangeCredentials({ username, password, ...extraTokenParams });\n        const signinResponse: SigninResponse = new SigninResponse(new URLSearchParams());\n        Object.assign(signinResponse, tokenResponse);\n        await this._validator.validateCredentialsResponse(signinResponse, skipUserInfo);\n        return signinResponse;\n    }\n\n    public async useRefreshToken({\n        state,\n        redirect_uri,\n        resource,\n        timeoutInSeconds,\n        extraHeaders,\n        extraTokenParams,\n    }: UseRefreshTokenArgs): Promise<SigninResponse> {\n        const logger = this._logger.create(\"useRefreshToken\");\n\n        // https://github.com/authts/oidc-client-ts/issues/695\n        // In some cases (e.g. AzureAD), not all granted scopes are allowed on token refresh requests.\n        // Therefore, we filter all granted scopes by a list of allowable scopes.\n        let scope;\n        if (this.settings.refreshTokenAllowedScope === undefined) {\n            scope = state.scope;\n        } else {\n            const allowableScopes = this.settings.refreshTokenAllowedScope.split(\" \");\n            const providedScopes = state.scope?.split(\" \") || [];\n\n            scope = providedScopes.filter(s => allowableScopes.includes(s)).join(\" \");\n        }\n\n        if (this.settings.dpop && this.settings.dpop.store) {\n            const dpopProof = await this.getDpopProof(this.settings.dpop.store);\n            extraHeaders = { ...extraHeaders, \"DPoP\": dpopProof };\n        }\n\n        /**\n         * The DPoP spec describes a method for Authorization Servers to supply a nonce value\n         * in order to limit the lifetime of a given DPoP proof.\n         * See https://datatracker.ietf.org/doc/html/rfc9449#name-authorization-server-provid\n         * This involves the AS returning a 400 bad request with a DPoP-Nonce header containing\n         * the nonce value. The client must then retry the request with a recomputed DPoP proof\n         * containing the supplied nonce value.\n         */\n        let result;\n        try {\n            result = await this._tokenClient.exchangeRefreshToken({\n                refresh_token: state.refresh_token,\n                // provide the (possible filtered) scope list\n                scope,\n                redirect_uri,\n                resource,\n                timeoutInSeconds,\n                extraHeaders,\n                ...extraTokenParams,\n            });\n        } catch (err) {\n            if (err instanceof ErrorDPoPNonce && this.settings.dpop) {\n                extraHeaders![\"DPoP\"] = await this.getDpopProof(this.settings.dpop.store, err.nonce);\n                result = await this._tokenClient.exchangeRefreshToken({\n                    refresh_token: state.refresh_token,\n                    // provide the (possible filtered) scope list\n                    scope,\n                    redirect_uri,\n                    resource,\n                    timeoutInSeconds,\n                    extraHeaders,\n                    ...extraTokenParams,\n                });\n            } else {\n                throw err;\n            }\n        }\n\n        const response = new SigninResponse(new URLSearchParams());\n        Object.assign(response, result);\n        logger.debug(\"validating response\", response);\n        await this._validator.validateRefreshResponse(response, {\n            ...state,\n            // override the scope in the state handed over to the validator\n            // so it can set the granted scope to the requested scope in case none is included in the response\n            scope,\n        });\n        return response;\n    }\n\n    public async createSignoutRequest({\n        state,\n        id_token_hint,\n        client_id,\n        request_type,\n        url_state,\n        post_logout_redirect_uri = this.settings.post_logout_redirect_uri,\n        extraQueryParams = this.settings.extraQueryParams,\n    }: CreateSignoutRequestArgs = {}): Promise<SignoutRequest> {\n        const logger = this._logger.create(\"createSignoutRequest\");\n\n        const url = await this.metadataService.getEndSessionEndpoint();\n        if (!url) {\n            logger.throw(new Error(\"No end session endpoint\"));\n            // eslint-disable-next-line @typescript-eslint/only-throw-error\n            throw null; // https://github.com/microsoft/TypeScript/issues/46972\n        }\n\n        logger.debug(\"Received end session endpoint\", url);\n\n        // specify the client identifier when post_logout_redirect_uri is used but id_token_hint is not\n        if (!client_id && post_logout_redirect_uri && !id_token_hint) {\n            client_id = this.settings.client_id;\n        }\n\n        const request = new SignoutRequest({\n            url,\n            id_token_hint,\n            client_id,\n            post_logout_redirect_uri,\n            state_data: state,\n            extraQueryParams,\n            request_type,\n            url_state,\n        });\n\n        // house cleaning\n        await this.clearStaleState();\n\n        const signoutState = request.state;\n        if (signoutState) {\n            logger.debug(\"Signout request has state to persist\");\n            await this.settings.stateStore.set(signoutState.id, signoutState.toStorageString());\n        }\n\n        return request;\n    }\n\n    public async readSignoutResponseState(url: string, removeState = false): Promise<{ state: State | undefined; response: SignoutResponse }> {\n        const logger = this._logger.create(\"readSignoutResponseState\");\n\n        const response = new SignoutResponse(UrlUtils.readParams(url, this.settings.response_mode));\n        if (!response.state) {\n            logger.debug(\"No state in response\");\n\n            if (response.error) {\n                logger.warn(\"Response was error:\", response.error);\n                throw new ErrorResponse(response);\n            }\n\n            return { state: undefined, response };\n        }\n\n        const storedStateString = await this.settings.stateStore[removeState ? \"remove\" : \"get\"](response.state);\n        if (!storedStateString) {\n            logger.throw(new Error(\"No matching state found in storage\"));\n            // eslint-disable-next-line @typescript-eslint/only-throw-error\n            throw null; // https://github.com/microsoft/TypeScript/issues/46972\n        }\n\n        const state = await State.fromStorageString(storedStateString);\n        return { state, response };\n    }\n\n    public async processSignoutResponse(url: string): Promise<SignoutResponse> {\n        const logger = this._logger.create(\"processSignoutResponse\");\n\n        const { state, response } = await this.readSignoutResponseState(url, true);\n        if (state) {\n            logger.debug(\"Received state from storage; validating response\");\n            this._validator.validateSignoutResponse(response, state);\n        } else {\n            logger.debug(\"No state from storage; skipping response validation\");\n        }\n\n        return response;\n    }\n\n    public clearStaleState(): Promise<void> {\n        this._logger.create(\"clearStaleState\");\n        return State.clearStaleState(this.settings.stateStore, this.settings.staleStateAgeInSeconds);\n    }\n\n    public async revokeToken(token: string, type?: \"access_token\" | \"refresh_token\"): Promise<void> {\n        this._logger.create(\"revokeToken\");\n        return await this._tokenClient.revoke({\n            token,\n            token_type_hint: type,\n        });\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"./utils\";\nimport { CheckSessionIFrame } from \"./CheckSessionIFrame\";\nimport type { UserManager } from \"./UserManager\";\nimport type { User } from \"./User\";\n\n/**\n * @public\n */\nexport class SessionMonitor {\n    private readonly _logger = new Logger(\"SessionMonitor\");\n\n    private _sub: string | undefined;\n    private _checkSessionIFrame?: CheckSessionIFrame;\n\n    public constructor(private readonly _userManager: UserManager) {\n        if (!_userManager) {\n            this._logger.throw(new Error(\"No user manager passed\"));\n        }\n\n        this._userManager.events.addUserLoaded(this._start);\n        this._userManager.events.addUserUnloaded(this._stop);\n\n        this._init().catch((err: unknown) => {\n            // catch to suppress errors since we're in a ctor\n            this._logger.error(err);\n        });\n    }\n\n    protected async _init(): Promise<void> {\n        this._logger.create(\"_init\");\n        const user = await this._userManager.getUser();\n        // doing this manually here since calling getUser\n        // doesn't trigger load event.\n        if (user) {\n            void this._start(user);\n        }\n        else if (this._userManager.settings.monitorAnonymousSession) {\n            const session = await this._userManager.querySessionStatus();\n            if (session) {\n                const tmpUser = {\n                    session_state: session.session_state,\n                    profile: session.sub ? {\n                        sub: session.sub,\n                    } : null,\n                };\n                void this._start(tmpUser);\n            }\n        }\n    }\n\n    protected _start = async (\n        user: User | {\n            session_state: string;\n            profile: { sub: string } | null;\n        },\n    ): Promise<void> => {\n        const session_state = user.session_state;\n        if (!session_state) {\n            return;\n        }\n        const logger = this._logger.create(\"_start\");\n\n        if (user.profile) {\n            this._sub = user.profile.sub;\n            logger.debug(\"session_state\", session_state, \", sub\", this._sub);\n        }\n        else {\n            this._sub = undefined;\n            logger.debug(\"session_state\", session_state, \", anonymous user\");\n        }\n\n        if (this._checkSessionIFrame) {\n            this._checkSessionIFrame.start(session_state);\n            return;\n        }\n\n        try {\n            const url = await this._userManager.metadataService.getCheckSessionIframe();\n            if (url) {\n                logger.debug(\"initializing check session iframe\");\n\n                const client_id = this._userManager.settings.client_id;\n                const intervalInSeconds = this._userManager.settings.checkSessionIntervalInSeconds;\n                const stopOnError = this._userManager.settings.stopCheckSessionOnError;\n\n                const checkSessionIFrame = new CheckSessionIFrame(this._callback, client_id, url, intervalInSeconds, stopOnError);\n                await checkSessionIFrame.load();\n                this._checkSessionIFrame = checkSessionIFrame;\n                checkSessionIFrame.start(session_state);\n            }\n            else {\n                logger.warn(\"no check session iframe found in the metadata\");\n            }\n        }\n        catch (err) {\n            // catch to suppress errors since we're in non-promise callback\n            logger.error(\"Error from getCheckSessionIframe:\", err instanceof Error ? err.message : err);\n        }\n    };\n\n    protected _stop = (): void => {\n        const logger = this._logger.create(\"_stop\");\n        this._sub = undefined;\n\n        if (this._checkSessionIFrame) {\n            this._checkSessionIFrame.stop();\n        }\n\n        if (this._userManager.settings.monitorAnonymousSession) {\n            // using a timer to delay re-initialization to avoid race conditions during signout\n            // TODO rewrite to use promise correctly\n            // eslint-disable-next-line @typescript-eslint/no-misused-promises\n            const timerHandle = setInterval(async () => {\n                clearInterval(timerHandle);\n\n                try {\n                    const session = await this._userManager.querySessionStatus();\n                    if (session) {\n                        const tmpUser = {\n                            session_state: session.session_state,\n                            profile: session.sub ? {\n                                sub: session.sub,\n                            } : null,\n                        };\n                        void this._start(tmpUser);\n                    }\n                }\n                catch (err) {\n                    // catch to suppress errors since we're in a callback\n                    logger.error(\"error from querySessionStatus\", err instanceof Error ? err.message : err);\n                }\n            }, 1000);\n        }\n    };\n\n    protected _callback = async (): Promise<void> => {\n        const logger = this._logger.create(\"_callback\");\n        try {\n            const session = await this._userManager.querySessionStatus();\n            let raiseEvent = true;\n\n            if (session && this._checkSessionIFrame) {\n                if (session.sub === this._sub) {\n                    raiseEvent = false;\n                    this._checkSessionIFrame.start(session.session_state);\n\n                    logger.debug(\"same sub still logged in at OP, session state has changed, restarting check session iframe; session_state\", session.session_state);\n                    await this._userManager.events._raiseUserSessionChanged();\n                }\n                else {\n                    logger.debug(\"different subject signed into OP\", session.sub);\n                }\n            }\n            else {\n                logger.debug(\"subject no longer signed into OP\");\n            }\n\n            if (raiseEvent) {\n                if (this._sub) {\n                    await this._userManager.events._raiseUserSignedOut();\n                }\n                else {\n                    await this._userManager.events._raiseUserSignedIn();\n                }\n            } else {\n                logger.debug(\"no change in session detected, no event to raise\");\n            }\n        }\n        catch (err) {\n            if (this._sub) {\n                logger.debug(\"Error calling queryCurrentSigninSession; raising signed out event\", err);\n                await this._userManager.events._raiseUserSignedOut();\n            }\n        }\n    };\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, Timer } from \"./utils\";\nimport type { IdTokenClaims } from \"./Claims\";\n\n/**\n * Holds claims represented by a combination of the `id_token` and the user info endpoint.\n *\n * @public\n */\nexport type UserProfile = IdTokenClaims;\n\n/**\n * @public\n */\nexport class User {\n    /**\n     * A JSON Web Token (JWT). Only provided if `openid` scope was requested.\n     * The application can access the data decoded by using the `profile` property.\n     */\n    public id_token?: string;\n\n    /** The session state value returned from the OIDC provider. */\n    public session_state: string | null;\n\n    /**\n     * The requested access token returned from the OIDC provider. The application can use this token to\n     * authenticate itself to the secured resource.\n     */\n    public access_token: string;\n\n    /**\n     * An OAuth 2.0 refresh token. The app can use this token to acquire additional access tokens after the\n     * current access token expires. Refresh tokens are long-lived and can be used to maintain access to resources\n     * for extended periods of time.\n     */\n    public refresh_token?: string;\n\n    /** Typically \"Bearer\" */\n    public token_type: string;\n\n    /** The scopes that the requested access token is valid for. */\n    public scope?: string;\n\n    /** The claims represented by a combination of the `id_token` and the user info endpoint. */\n    public profile: UserProfile;\n\n    /** The expires at returned from the OIDC provider. */\n    public expires_at?: number;\n\n    /** custom state data set during the initial signin request */\n    public readonly state: unknown;\n    public readonly url_state?: string;\n\n    public constructor(args: {\n        id_token?: string;\n        session_state?: string | null;\n        access_token: string;\n        refresh_token?: string;\n        token_type: string;\n        scope?: string;\n        profile: UserProfile;\n        expires_at?: number;\n        userState?: unknown;\n        url_state?: string;\n    }) {\n        this.id_token = args.id_token;\n        this.session_state = args.session_state ?? null;\n        this.access_token = args.access_token;\n        this.refresh_token = args.refresh_token;\n\n        this.token_type = args.token_type;\n        this.scope = args.scope;\n        this.profile = args.profile;\n        this.expires_at = args.expires_at;\n        this.state = args.userState;\n        this.url_state = args.url_state;\n    }\n\n    /** Computed number of seconds the access token has remaining. */\n    public get expires_in(): number | undefined {\n        if (this.expires_at === undefined) {\n            return undefined;\n        }\n        return this.expires_at - Timer.getEpochTime();\n    }\n\n    public set expires_in(value: number | undefined) {\n        if (value !== undefined) {\n            this.expires_at = Math.floor(value) + Timer.getEpochTime();\n        }\n    }\n\n    /** Computed value indicating if the access token is expired. */\n    public get expired(): boolean | undefined {\n        const expires_in = this.expires_in;\n        if (expires_in === undefined) {\n            return undefined;\n        }\n        return expires_in <= 0;\n    }\n\n    /** Array representing the parsed values from the `scope`. */\n    public get scopes(): string[] {\n        return this.scope?.split(\" \") ?? [];\n    }\n\n    public toStorageString(): string {\n        new Logger(\"User\").create(\"toStorageString\");\n        return JSON.stringify({\n            id_token: this.id_token,\n            session_state: this.session_state,\n            access_token: this.access_token,\n            refresh_token: this.refresh_token,\n            token_type: this.token_type,\n            scope: this.scope,\n            profile: this.profile,\n            expires_at: this.expires_at,\n        });\n    }\n\n    public static fromStorageString(storageString: string): User {\n        Logger.createStatic(\"User\", \"fromStorageString\");\n        return new User(JSON.parse(storageString));\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Event, Logger, UrlUtils } from \"../utils\";\nimport type { IWindow, NavigateParams, NavigateResponse } from \"./IWindow\";\n\nconst messageSource = \"oidc-client\";\n\ninterface MessageData {\n    source: string;\n    url: string;\n    keepOpen: boolean;\n}\n\n/**\n * Window implementation which resolves via communication from a child window\n * via the `Window.postMessage()` interface.\n *\n * @internal\n */\nexport abstract class AbstractChildWindow implements IWindow {\n    protected abstract readonly _logger: Logger;\n    protected readonly _abort = new Event<[reason: Error]>(\"Window navigation aborted\");\n    protected readonly _disposeHandlers = new Set<() => void>();\n\n    protected _window: WindowProxy | null = null;\n\n    public async navigate(params: NavigateParams): Promise<NavigateResponse> {\n        const logger = this._logger.create(\"navigate\");\n        if (!this._window) {\n            throw new Error(\"Attempted to navigate on a disposed window\");\n        }\n\n        logger.debug(\"setting URL in window\");\n        this._window.location.replace(params.url);\n\n        const { url, keepOpen } = await new Promise<MessageData>((resolve, reject) => {\n            const listener = (e: MessageEvent) => {\n                const data: MessageData | undefined = e.data;\n                const origin = params.scriptOrigin ?? window.location.origin;\n                if (e.origin !== origin || data?.source !== messageSource) {\n                    // silently discard events not intended for us\n                    return;\n                }\n                try {\n                    const state = UrlUtils.readParams(data.url, params.response_mode).get(\"state\");\n                    if (!state) {\n                        logger.warn(\"no state found in response url\");\n                    }\n                    if (e.source !== this._window && state !== params.state) {\n                        // MessageEvent source is a relatively modern feature, we can't rely on it\n                        // so we also inspect the payload for a matching state key as an alternative\n                        return;\n                    }\n                }\n                catch {\n                    this._dispose();\n                    reject(new Error(\"Invalid response from window\"));\n                }\n                resolve(data);\n            };\n            window.addEventListener(\"message\", listener, false);\n            this._disposeHandlers.add(() => window.removeEventListener(\"message\", listener, false));\n            const channel = new BroadcastChannel(`oidc-client-popup-${params.state}`);\n            channel.addEventListener(\"message\", listener, false);\n            this._disposeHandlers.add(() => channel.close());\n            this._disposeHandlers.add(this._abort.addHandler((reason) => {\n                this._dispose();\n                reject(reason);\n            }));\n        });\n        logger.debug(\"got response from window\");\n        this._dispose();\n\n        if (!keepOpen) {\n            this.close();\n        }\n\n        return { url };\n    }\n\n    public abstract close(): void;\n\n    private _dispose(): void {\n        this._logger.create(\"_dispose\");\n\n        for (const dispose of this._disposeHandlers) {\n            dispose();\n        }\n        this._disposeHandlers.clear();\n    }\n\n    protected static _notifyParent(parent: Window | null, url: string, keepOpen = false, targetOrigin = window.location.origin): void {\n        const msgData: MessageData = {\n            source: messageSource,\n            url,\n            keepOpen,\n        };\n        const logger = new Logger(\"_notifyParent\");\n        if (parent) {\n            logger.debug(\"With parent. Using parent.postMessage.\");\n            parent.postMessage(msgData, targetOrigin);\n        } else {\n            logger.debug(\"No parent. Using BroadcastChannel.\");\n            const state = new URL(url).searchParams.get(\"state\");\n            if (!state) {\n                throw new Error(\"No parent and no state in URL. Can't complete notification.\");\n            }\n            const channel = new BroadcastChannel(`oidc-client-popup-${state}`);\n            channel.postMessage(msgData);\n            channel.close();\n        }\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { type OidcClientSettings, OidcClientSettingsStore } from \"./OidcClientSettings\";\nimport type { PopupWindowFeatures } from \"./utils/PopupUtils\";\nimport { WebStorageStateStore } from \"./WebStorageStateStore\";\nimport { InMemoryWebStorage } from \"./InMemoryWebStorage\";\nimport type { StateStore } from \"./StateStore\";\n\nexport const DefaultPopupWindowFeatures: PopupWindowFeatures = {\n    location: false,\n    toolbar: false,\n    height: 640,\n    closePopupWindowAfterInSeconds: -1,\n};\nexport const DefaultPopupTarget = \"_blank\";\nconst DefaultAccessTokenExpiringNotificationTimeInSeconds = 60;\nconst DefaultCheckSessionIntervalInSeconds = 2;\nexport const DefaultSilentRequestTimeoutInSeconds = 10;\n\n/**\n * The settings used to configure the {@link UserManager}.\n *\n * @public\n */\nexport interface UserManagerSettings extends OidcClientSettings {\n    /** The URL for the page containing the call to signinPopupCallback to handle the callback from the OIDC/OAuth2 */\n    popup_redirect_uri?: string;\n    popup_post_logout_redirect_uri?: string;\n    /**\n     * The features parameter to window.open for the popup signin window. By default, the popup is\n     * placed centered in front of the window opener.\n     * (default: \\{ location: false, menubar: false, height: 640, closePopupWindowAfterInSeconds: -1 \\})\n     */\n    popupWindowFeatures?: PopupWindowFeatures;\n    /** The target parameter to window.open for the popup signin window (default: \"_blank\") */\n    popupWindowTarget?: string;\n    /** The methods window.location method used to redirect (default: \"assign\") */\n    redirectMethod?: \"replace\" | \"assign\";\n    /** The methods target window being redirected (default: \"self\") */\n    redirectTarget?: \"top\" | \"self\";\n\n    /** The target to pass while calling postMessage inside iframe for callback (default: window.location.origin) */\n    iframeNotifyParentOrigin?: string;\n\n    /** The script origin to check during 'message' callback execution while performing silent auth via iframe (default: window.location.origin) */\n    iframeScriptOrigin?: string;\n\n    /** The URL for the page containing the code handling the silent renew */\n    silent_redirect_uri?: string;\n    /** Number of seconds to wait for the silent renew to return before assuming it has failed or timed out (default: 10) */\n    silentRequestTimeoutInSeconds?: number;\n    /** Flag to indicate if there should be an automatic attempt to renew the access token prior to its expiration. The automatic renew attempt starts 1 minute before the access token expires (default: true) */\n    automaticSilentRenew?: boolean;\n    /** Flag to validate user.profile.sub in silent renew calls (default: true) */\n    validateSubOnSilentRenew?: boolean;\n    /** Flag to control if id_token is included as id_token_hint in silent renew calls (default: false) */\n    includeIdTokenInSilentRenew?: boolean;\n\n    /** Will raise events for when user has performed a signout at the OP (default: false) */\n    monitorSession?: boolean;\n    monitorAnonymousSession?: boolean;\n    /** Interval in seconds to check the user's session (default: 2) */\n    checkSessionIntervalInSeconds?: number;\n    query_status_response_type?: string;\n    stopCheckSessionOnError?: boolean;\n\n    /**\n     * The `token_type_hint`s to pass to the authority server by default (default: [\"access_token\", \"refresh_token\"])\n     *\n     * Token types will be revoked in the same order as they are given here.\n     */\n    revokeTokenTypes?: (\"access_token\" | \"refresh_token\")[];\n    /** Will invoke the revocation endpoint on signout if there is an access token for the user (default: false) */\n    revokeTokensOnSignout?: boolean;\n    /** Flag to control if id_token is included as id_token_hint in silent signout calls (default: false) */\n    includeIdTokenInSilentSignout?: boolean;\n\n    /** The number of seconds before an access token is to expire to raise the accessTokenExpiring event (default: 60) */\n    accessTokenExpiringNotificationTimeInSeconds?: number;\n\n    /**\n     * Maximum number of timeout retries before raising silentRenewError event.\n     * Set to 0 to fail immediately on timeout.\n     * Undefined means infinite retries (maintains backward compatibility, default behavior).\n     */\n    maxSilentRenewTimeoutRetries?: number;\n\n    /**\n     * Storage object used to persist User for currently authenticated user (default: window.sessionStorage, InMemoryWebStorage iff no window).\n     *  E.g. `userStore: new WebStorageStateStore({ store: window.localStorage })`\n     */\n    userStore?: StateStore;\n}\n\n/**\n * The settings with defaults applied of the {@link UserManager}.\n * @see {@link UserManagerSettings}\n *\n * @public\n */\nexport class UserManagerSettingsStore extends OidcClientSettingsStore {\n    public readonly popup_redirect_uri: string;\n    public readonly popup_post_logout_redirect_uri: string | undefined;\n    public readonly popupWindowFeatures: PopupWindowFeatures;\n    public readonly popupWindowTarget: string;\n    public readonly redirectMethod: \"replace\" | \"assign\";\n    public readonly redirectTarget: \"top\" | \"self\";\n\n    public readonly iframeNotifyParentOrigin: string | undefined;\n    public readonly iframeScriptOrigin: string | undefined;\n\n    public readonly silent_redirect_uri: string;\n    public readonly silentRequestTimeoutInSeconds: number;\n    public readonly automaticSilentRenew: boolean;\n    public readonly validateSubOnSilentRenew: boolean;\n    public readonly includeIdTokenInSilentRenew: boolean;\n\n    public readonly monitorSession: boolean;\n    public readonly monitorAnonymousSession: boolean;\n    public readonly checkSessionIntervalInSeconds: number;\n    public readonly query_status_response_type: string;\n    public readonly stopCheckSessionOnError: boolean;\n\n    public readonly revokeTokenTypes: (\"access_token\" | \"refresh_token\")[];\n    public readonly revokeTokensOnSignout: boolean;\n    public readonly includeIdTokenInSilentSignout: boolean;\n\n    public readonly accessTokenExpiringNotificationTimeInSeconds: number;\n    public readonly maxSilentRenewTimeoutRetries?: number;\n\n    public readonly userStore: StateStore;\n\n    public constructor(args: UserManagerSettings) {\n        const {\n            popup_redirect_uri = args.redirect_uri,\n            popup_post_logout_redirect_uri = args.post_logout_redirect_uri,\n            popupWindowFeatures = DefaultPopupWindowFeatures,\n            popupWindowTarget = DefaultPopupTarget,\n            redirectMethod = \"assign\",\n            redirectTarget = \"self\",\n\n            iframeNotifyParentOrigin = args.iframeNotifyParentOrigin,\n            iframeScriptOrigin = args.iframeScriptOrigin,\n\n            requestTimeoutInSeconds,\n            silent_redirect_uri = args.redirect_uri,\n            silentRequestTimeoutInSeconds,\n            automaticSilentRenew = true,\n            validateSubOnSilentRenew = true,\n            includeIdTokenInSilentRenew = false,\n\n            monitorSession = false,\n            monitorAnonymousSession = false,\n            checkSessionIntervalInSeconds = DefaultCheckSessionIntervalInSeconds,\n            query_status_response_type = \"code\",\n            stopCheckSessionOnError = true,\n\n            revokeTokenTypes = [\"access_token\", \"refresh_token\"],\n            revokeTokensOnSignout = false,\n            includeIdTokenInSilentSignout = false,\n\n            accessTokenExpiringNotificationTimeInSeconds = DefaultAccessTokenExpiringNotificationTimeInSeconds,\n\n            maxSilentRenewTimeoutRetries,\n\n            userStore,\n        } = args;\n\n        super(args);\n\n        this.popup_redirect_uri = popup_redirect_uri;\n        this.popup_post_logout_redirect_uri = popup_post_logout_redirect_uri;\n        this.popupWindowFeatures = popupWindowFeatures;\n        this.popupWindowTarget = popupWindowTarget;\n        this.redirectMethod = redirectMethod;\n        this.redirectTarget = redirectTarget;\n\n        this.iframeNotifyParentOrigin = iframeNotifyParentOrigin;\n        this.iframeScriptOrigin = iframeScriptOrigin;\n\n        this.silent_redirect_uri = silent_redirect_uri;\n        this.silentRequestTimeoutInSeconds = silentRequestTimeoutInSeconds || requestTimeoutInSeconds || DefaultSilentRequestTimeoutInSeconds;\n        this.automaticSilentRenew = automaticSilentRenew;\n        this.validateSubOnSilentRenew = validateSubOnSilentRenew;\n        this.includeIdTokenInSilentRenew = includeIdTokenInSilentRenew;\n\n        this.monitorSession = monitorSession;\n        this.monitorAnonymousSession = monitorAnonymousSession;\n        this.checkSessionIntervalInSeconds = checkSessionIntervalInSeconds;\n        this.stopCheckSessionOnError = stopCheckSessionOnError;\n        this.query_status_response_type = query_status_response_type;\n\n        this.revokeTokenTypes = revokeTokenTypes;\n        this.revokeTokensOnSignout = revokeTokensOnSignout;\n        this.includeIdTokenInSilentSignout = includeIdTokenInSilentSignout;\n\n        this.accessTokenExpiringNotificationTimeInSeconds = accessTokenExpiringNotificationTimeInSeconds;\n        this.maxSilentRenewTimeoutRetries = maxSilentRenewTimeoutRetries;\n\n        if (userStore) {\n            this.userStore = userStore;\n        }\n        else {\n            const store = typeof window !== \"undefined\" ? window.sessionStorage : new InMemoryWebStorage();\n            this.userStore = new WebStorageStateStore({ store });\n        }\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"../utils\";\nimport { ErrorTimeout } from \"../errors\";\nimport type { NavigateParams, NavigateResponse } from \"./IWindow\";\nimport { AbstractChildWindow } from \"./AbstractChildWindow\";\nimport { DefaultSilentRequestTimeoutInSeconds } from \"../UserManagerSettings\";\n\n/**\n * @public\n */\nexport interface IFrameWindowParams {\n    silentRequestTimeoutInSeconds?: number;\n}\n\n/**\n * @internal\n */\nexport class IFrameWindow extends AbstractChildWindow {\n    protected readonly _logger = new Logger(\"IFrameWindow\");\n    private _frame: HTMLIFrameElement | null;\n    private _timeoutInSeconds: number;\n\n    public constructor({\n        silentRequestTimeoutInSeconds = DefaultSilentRequestTimeoutInSeconds,\n    }: IFrameWindowParams) {\n        super();\n        this._timeoutInSeconds = silentRequestTimeoutInSeconds;\n\n        this._frame = IFrameWindow.createHiddenIframe();\n        this._window = this._frame.contentWindow;\n    }\n\n    private static createHiddenIframe(): HTMLIFrameElement {\n        const iframe = window.document.createElement(\"iframe\");\n\n        // shotgun approach\n        iframe.style.visibility = \"hidden\";\n        iframe.style.position = \"fixed\";\n        iframe.style.left = \"-1000px\";\n        iframe.style.top = \"0\";\n        iframe.width = \"0\";\n        iframe.height = \"0\";\n\n        window.document.body.appendChild(iframe);\n        return iframe;\n    }\n\n    public async navigate(params: NavigateParams): Promise<NavigateResponse> {\n        this._logger.debug(\"navigate: Using timeout of:\", this._timeoutInSeconds);\n        const timer = setTimeout(() => void this._abort.raise(new ErrorTimeout(\"IFrame timed out without a response\")), this._timeoutInSeconds * 1000);\n        this._disposeHandlers.add(() => clearTimeout(timer));\n\n        return await super.navigate(params);\n    }\n\n    public close(): void {\n        if (this._frame) {\n            if (this._frame.parentNode) {\n                this._frame.addEventListener(\"load\", (ev) => {\n                    const frame = ev.target as HTMLIFrameElement;\n                    frame.parentNode?.removeChild(frame);\n                    void this._abort.raise(new Error(\"IFrame removed from DOM\"));\n                }, true);\n                this._frame.contentWindow?.location.replace(\"about:blank\");\n            }\n            this._frame = null;\n        }\n        this._window = null;\n    }\n\n    public static notifyParent(url: string, targetOrigin?: string): void {\n        return super._notifyParent(window.parent, url, false, targetOrigin);\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"../utils\";\nimport type { UserManagerSettingsStore } from \"../UserManagerSettings\";\nimport { IFrameWindow, type IFrameWindowParams } from \"./IFrameWindow\";\nimport type { INavigator } from \"./INavigator\";\n\n/**\n * @internal\n */\nexport class IFrameNavigator implements INavigator {\n    private readonly _logger = new Logger(\"IFrameNavigator\");\n\n    constructor(private _settings: UserManagerSettingsStore) {}\n\n    public async prepare({\n        silentRequestTimeoutInSeconds = this._settings.silentRequestTimeoutInSeconds,\n    }: IFrameWindowParams): Promise<IFrameWindow> {\n        return new IFrameWindow({ silentRequestTimeoutInSeconds });\n    }\n\n    public async callback(url: string): Promise<void> {\n        this._logger.create(\"callback\");\n        IFrameWindow.notifyParent(url, this._settings.iframeNotifyParentOrigin);\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, PopupUtils, type PopupWindowFeatures } from \"../utils\";\nimport { DefaultPopupWindowFeatures, DefaultPopupTarget } from \"../UserManagerSettings\";\nimport { AbstractChildWindow } from \"./AbstractChildWindow\";\nimport type { NavigateParams, NavigateResponse } from \"./IWindow\";\n\nconst checkForPopupClosedInterval = 500;\nconst second = 1000;\n\n/**\n * @public\n */\nexport interface PopupWindowParams {\n    popupWindowFeatures?: PopupWindowFeatures;\n    popupWindowTarget?: string;\n    /** An AbortSignal to set request's signal. */\n    popupSignal?: AbortSignal | null;\n    /** Abort navigator when the popup is lost */\n    popupAbortOnClose?: boolean;\n}\n\n/**\n * @internal\n */\nexport class PopupWindow extends AbstractChildWindow {\n    protected readonly _logger = new Logger(\"PopupWindow\");\n\n    protected _window: WindowProxy | null;\n\n    protected abortOnClose: boolean;\n\n    public constructor({\n        popupWindowTarget = DefaultPopupTarget,\n        popupWindowFeatures = {},\n        popupSignal,\n        popupAbortOnClose,\n    }: PopupWindowParams) {\n        super();\n        const centeredPopup = PopupUtils.center({ ...DefaultPopupWindowFeatures, ...popupWindowFeatures });\n        this._window = window.open(undefined, popupWindowTarget, PopupUtils.serialize(centeredPopup));\n        this.abortOnClose = Boolean(popupAbortOnClose);\n\n        if (popupSignal) {\n            popupSignal.addEventListener(\"abort\", () => {\n                void this._abort.raise(new Error(popupSignal.reason ?? \"Popup aborted\"));\n            });\n        }\n\n        if (popupWindowFeatures.closePopupWindowAfterInSeconds && popupWindowFeatures.closePopupWindowAfterInSeconds > 0) {\n            setTimeout(() => {\n                if (!this._window || typeof this._window.closed !== \"boolean\" || this._window.closed) {\n                    void this._abort.raise(new Error(\"Popup blocked by user\"));\n                    return;\n                }\n\n                this.close();\n            }, popupWindowFeatures.closePopupWindowAfterInSeconds * second);\n        }\n    }\n\n    public async navigate(params: NavigateParams): Promise<NavigateResponse> {\n        this._window?.focus();\n\n        const popupClosedInterval = setInterval(() => {\n            if (!this._window || this._window.closed) {\n                this._logger.debug(\"Popup closed by user or isolated by redirect\");\n                clearPopupClosedInterval();\n                this._disposeHandlers.delete(clearPopupClosedInterval);\n                \n                if (this.abortOnClose) {\n                    void this._abort.raise(new Error(\"Popup closed by user\"));\n                }\n            }\n        }, checkForPopupClosedInterval);\n        const clearPopupClosedInterval = () => clearInterval(popupClosedInterval);\n        this._disposeHandlers.add(clearPopupClosedInterval);\n\n        return await super.navigate(params);\n    }\n\n    public close(): void {\n        if (this._window) {\n            if (!this._window.closed) {\n                this._window.close();\n                void this._abort.raise(new Error(\"Popup closed\"));\n            }\n        }\n        this._window = null;\n    }\n\n    public static notifyOpener(url: string, keepOpen: boolean): void {\n        super._notifyParent(window.opener, url, keepOpen);\n        if (!keepOpen && !window.opener) {\n            window.close();\n        }\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"../utils\";\nimport { PopupWindow, type PopupWindowParams } from \"./PopupWindow\";\nimport type { INavigator } from \"./INavigator\";\nimport type { UserManagerSettingsStore } from \"../UserManagerSettings\";\n\n/**\n * @internal\n */\nexport class PopupNavigator implements INavigator {\n    private readonly _logger = new Logger(\"PopupNavigator\");\n\n    constructor(private _settings: UserManagerSettingsStore) { }\n\n    public async prepare({\n        popupWindowFeatures = this._settings.popupWindowFeatures,\n        popupWindowTarget = this._settings.popupWindowTarget,\n        popupSignal,\n        popupAbortOnClose,\n    }: PopupWindowParams): Promise<PopupWindow> {\n        return new PopupWindow({\n            popupWindowFeatures,\n            popupWindowTarget,\n            popupSignal,\n            popupAbortOnClose,\n        });\n    }\n\n    public async callback(url: string, { keepOpen = false }): Promise<void> {\n        this._logger.create(\"callback\");\n\n        PopupWindow.notifyOpener(url, keepOpen);\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger } from \"../utils\";\nimport type { UserManagerSettingsStore } from \"../UserManagerSettings\";\nimport type { INavigator } from \"./INavigator\";\nimport type { IWindow, NavigateResponse } from \"./IWindow\";\n\n/**\n * @public\n */\nexport interface RedirectParams {\n    redirectMethod?: \"replace\" | \"assign\";\n    redirectTarget?: \"top\" | \"self\";\n}\n\n/**\n * @internal\n */\nexport class RedirectNavigator implements INavigator {\n    private readonly _logger = new Logger(\"RedirectNavigator\");\n\n    constructor(private _settings: UserManagerSettingsStore) {}\n\n    public async prepare({\n        redirectMethod = this._settings.redirectMethod,\n        redirectTarget = this._settings.redirectTarget,\n    }: RedirectParams): Promise<IWindow> {\n        this._logger.create(\"prepare\");\n        let targetWindow = window.self as Window;\n\n        if (redirectTarget === \"top\") {\n            targetWindow = window.top ?? window.self;\n        }\n    \n        const redirect = targetWindow.location[redirectMethod].bind(targetWindow.location) as (url: string) => void;\n        let abort: (reason: Error) => void;\n        return {\n            navigate: async (params): Promise<NavigateResponse> => {\n                this._logger.create(\"navigate\");\n                const promise = new Promise((resolve, reject) => {\n                    abort = reject;\n                    window.addEventListener(\"pageshow\", () => resolve(window.location.href));\n                    redirect(params.url);\n                });\n                return await (promise as Promise<NavigateResponse>);\n            },\n            close: () => {\n                this._logger.create(\"close\");\n                abort?.(new Error(\"Redirect aborted\"));\n                targetWindow.stop();\n            },\n        };\n    }\n\n    public async callback(): Promise<void> {\n        return;\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, Event } from \"./utils\";\nimport { AccessTokenEvents } from \"./AccessTokenEvents\";\nimport type { UserManagerSettingsStore } from \"./UserManagerSettings\";\nimport type { User } from \"./User\";\n\n/**\n * @public\n */\nexport type UserLoadedCallback = (user: User) => Promise<void> | void;\n/**\n * @public\n */\nexport type UserUnloadedCallback = () => Promise<void> | void;\n/**\n * @public\n */\nexport type SilentRenewErrorCallback = (error: Error) => Promise<void> | void;\n/**\n * @public\n */\nexport type UserSignedInCallback = () => Promise<void> | void;\n/**\n * @public\n */\nexport type UserSignedOutCallback = () => Promise<void> | void;\n/**\n * @public\n */\nexport type UserSessionChangedCallback = () => Promise<void> | void;\n\n/**\n * @public\n */\nexport class UserManagerEvents extends AccessTokenEvents {\n    protected readonly _logger = new Logger(\"UserManagerEvents\");\n\n    private readonly _userLoaded = new Event<[User]>(\"User loaded\");\n    private readonly _userUnloaded = new Event<[]>(\"User unloaded\");\n    private readonly _silentRenewError = new Event<[Error]>(\"Silent renew error\");\n    private readonly _userSignedIn = new Event<[]>(\"User signed in\");\n    private readonly _userSignedOut = new Event<[]>(\"User signed out\");\n    private readonly _userSessionChanged = new Event<[]>(\"User session changed\");\n\n    public constructor(settings: UserManagerSettingsStore) {\n        super({ expiringNotificationTimeInSeconds: settings.accessTokenExpiringNotificationTimeInSeconds });\n    }\n\n    public async load(user: User, raiseEvent=true): Promise<void> {\n        await super.load(user);\n        if (raiseEvent) {\n            await this._userLoaded.raise(user);\n        }\n    }\n\n    public async unload(): Promise<void> {\n        await super.unload();\n        await this._userUnloaded.raise();\n    }\n\n    /**\n     * Add callback: Raised when a user session has been established (or re-established).\n     */\n    public addUserLoaded(cb: UserLoadedCallback): () => void {\n        return this._userLoaded.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised when a user session has been established (or re-established).\n     */\n    public removeUserLoaded(cb: UserLoadedCallback): void {\n        return this._userLoaded.removeHandler(cb);\n    }\n\n    /**\n     * Add callback: Raised when a user session has been terminated.\n     */\n    public addUserUnloaded(cb: UserUnloadedCallback): () => void {\n        return this._userUnloaded.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised when a user session has been terminated.\n     */\n    public removeUserUnloaded(cb: UserUnloadedCallback): void {\n        return this._userUnloaded.removeHandler(cb);\n    }\n\n    /**\n     * Add callback: Raised when the automatic silent renew has failed.\n     */\n    public addSilentRenewError(cb: SilentRenewErrorCallback): () => void {\n        return this._silentRenewError.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised when the automatic silent renew has failed.\n     */\n    public removeSilentRenewError(cb: SilentRenewErrorCallback): void {\n        return this._silentRenewError.removeHandler(cb);\n    }\n    /**\n     * @internal\n     */\n    public async _raiseSilentRenewError(e: Error): Promise<void> {\n        await this._silentRenewError.raise(e);\n    }\n\n    /**\n     * Add callback: Raised when the user is signed in (when `monitorSession` is set).\n     * @see {@link UserManagerSettings.monitorSession}\n     */\n    public addUserSignedIn(cb: UserSignedInCallback): () => void {\n        return this._userSignedIn.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised when the user is signed in (when `monitorSession` is set).\n     */\n    public removeUserSignedIn(cb: UserSignedInCallback): void {\n        this._userSignedIn.removeHandler(cb);\n    }\n    /**\n     * @internal\n     */\n    public async _raiseUserSignedIn(): Promise<void> {\n        await this._userSignedIn.raise();\n    }\n\n    /**\n     * Add callback: Raised when the user's sign-in status at the OP has changed (when `monitorSession` is set).\n     * @see {@link UserManagerSettings.monitorSession}\n     */\n    public addUserSignedOut(cb: UserSignedOutCallback): () => void {\n        return this._userSignedOut.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised when the user's sign-in status at the OP has changed (when `monitorSession` is set).\n     */\n    public removeUserSignedOut(cb: UserSignedOutCallback): void {\n        this._userSignedOut.removeHandler(cb);\n    }\n    /**\n     * @internal\n     */\n    public async _raiseUserSignedOut(): Promise<void> {\n        await this._userSignedOut.raise();\n    }\n\n    /**\n     * Add callback: Raised when the user session changed (when `monitorSession` is set).\n     * @see {@link UserManagerSettings.monitorSession}\n     */\n    public addUserSessionChanged(cb: UserSessionChangedCallback): () => void {\n        return this._userSessionChanged.addHandler(cb);\n    }\n    /**\n     * Remove callback: Raised when the user session changed (when `monitorSession` is set).\n     */\n    public removeUserSessionChanged(cb: UserSessionChangedCallback): void {\n        this._userSessionChanged.removeHandler(cb);\n    }\n    /**\n     * @internal\n     */\n    public async _raiseUserSessionChanged(): Promise<void> {\n        await this._userSessionChanged.raise();\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { Logger, Timer } from \"./utils\";\nimport { ErrorTimeout } from \"./errors\";\nimport type { UserManager } from \"./UserManager\";\nimport type { AccessTokenCallback } from \"./AccessTokenEvents\";\n\n/**\n * @internal\n */\nexport class SilentRenewService {\n    protected _logger = new Logger(\"SilentRenewService\");\n    private _isStarted = false;\n    private readonly _retryTimer = new Timer(\"Retry Silent Renew\");\n    private _timeoutRetryCount = 0;\n\n    public constructor(private _userManager: UserManager) {}\n\n    public async start(): Promise<void> {\n        const logger = this._logger.create(\"start\");\n        if (!this._isStarted) {\n            this._isStarted = true;\n            this._userManager.events.addAccessTokenExpiring(this._tokenExpiring);\n            this._retryTimer.addHandler(this._tokenExpiring);\n\n            // this will trigger loading of the user so the expiring events can be initialized\n            try {\n                await this._userManager.getUser();\n                // deliberate nop\n            }\n            catch (err) {\n                // catch to suppress errors since we're in a ctor\n                logger.error(\"getUser error\", err);\n            }\n        }\n    }\n\n    public stop(): void {\n        if (this._isStarted) {\n            this._retryTimer.cancel();\n            this._retryTimer.removeHandler(this._tokenExpiring);\n            this._userManager.events.removeAccessTokenExpiring(this._tokenExpiring);\n            this._isStarted = false;\n        }\n    }\n\n    protected _tokenExpiring: AccessTokenCallback = async () => {\n        const logger = this._logger.create(\"_tokenExpiring\");\n        try {\n            await this._userManager.signinSilent();\n            this._timeoutRetryCount = 0;\n            logger.debug(\"silent token renewal successful\");\n        }\n        catch (err) {\n            if (err instanceof ErrorTimeout) {\n                // Increment timeout retry counter\n                this._timeoutRetryCount++;\n\n                // Check if a max timeout retry limit is configured\n                const maxRetries = this._userManager.settings.maxSilentRenewTimeoutRetries;\n                const hasReachedLimit = maxRetries !== undefined && this._timeoutRetryCount > maxRetries;\n\n                if (hasReachedLimit) {\n                    // Limit reached: raise event to notify application and stop retrying\n                    logger.error(\n                        `Timeout retry limit reached (${this._timeoutRetryCount} > ${maxRetries}), ` +\n                        \"raising silentRenewError:\",\n                        err,\n                    );\n                    this._timeoutRetryCount = 0;\n                    await this._userManager.events._raiseSilentRenewError(err as Error);\n                    return;\n                }\n\n                // No limit configured (undefined) or limit not reached: continue retrying\n                // no response from authority server, e.g. IFrame timeout, ...\n                logger.warn(\n                    `ErrorTimeout from signinSilent (attempt ${this._timeoutRetryCount}), retry in 5s:`,\n                    err,\n                );\n                this._retryTimer.init(5);\n                return;\n            }\n\n            // Non-timeout error: reset counter and raise event immediately\n            logger.error(\"Error from signinSilent:\", err);\n            this._timeoutRetryCount = 0;\n            await this._userManager.events._raiseSilentRenewError(err as Error);\n        }\n    };\n}\n", "// Copyright (C) AuthTS Contributors\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport type { UserProfile } from \"./User\";\n\n/**\n * Fake state store implementation necessary for validating refresh token requests.\n *\n * @public\n */\nexport class RefreshState {\n    /** custom \"state\", which can be used by a caller to have \"data\" round tripped */\n    public readonly data?: unknown;\n\n    public readonly refresh_token: string;\n    public readonly id_token?: string;\n    public readonly session_state: string | null;\n    public readonly scope?: string;\n    public readonly profile: UserProfile;\n\n    constructor(args: {\n        refresh_token: string;\n        id_token?: string;\n        session_state: string | null;\n        scope?: string;\n        profile: UserProfile;\n\n        state?: unknown;\n    }) {\n        this.refresh_token = args.refresh_token;\n        this.id_token = args.id_token;\n        this.session_state = args.session_state;\n        this.scope = args.scope;\n        this.profile = args.profile;\n\n        this.data = args.state;\n\n    }\n}\n", "// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.\n// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.\n\nimport { CryptoUtils, Logger } from \"./utils\";\nimport { ErrorResponse } from \"./errors\";\nimport { type NavigateResponse, type PopupWindowParams, type IWindow, type IFrameWindowParams, type RedirectParams, RedirectNavigator, PopupNavigator, IFrameNavigator, type INavigator } from \"./navigators\";\nimport { OidcClient, type CreateSigninRequestArgs, type CreateSignoutRequestArgs, type ProcessResourceOwnerPasswordCredentialsArgs, type UseRefreshTokenArgs } from \"./OidcClient\";\nimport { type UserManagerSettings, UserManagerSettingsStore } from \"./UserManagerSettings\";\nimport { User } from \"./User\";\nimport { UserManagerEvents } from \"./UserManagerEvents\";\nimport { SilentRenewService } from \"./SilentRenewService\";\nimport { SessionMonitor } from \"./SessionMonitor\";\nimport type { SessionStatus } from \"./SessionStatus\";\nimport type { SignoutResponse } from \"./SignoutResponse\";\nimport type { MetadataService } from \"./MetadataService\";\nimport { RefreshState } from \"./RefreshState\";\nimport type { SigninResponse } from \"./SigninResponse\";\nimport type { ExtraHeader, DPoPSettings } from \"./OidcClientSettings\";\nimport { DPoPState } from \"./DPoPStore\";\n\n/**\n * @public\n */\nexport type ExtraSigninRequestArgs = Pick<CreateSigninRequestArgs, \"nonce\" | \"extraQueryParams\" | \"extraTokenParams\" | \"state\" | \"redirect_uri\" | \"prompt\" | \"acr_values\" | \"login_hint\" | \"scope\" | \"max_age\" | \"ui_locales\" | \"resource\" | \"url_state\">;\n/**\n * @public\n */\nexport type ExtraSignoutRequestArgs = Pick<CreateSignoutRequestArgs, \"extraQueryParams\" | \"state\" | \"id_token_hint\" | \"post_logout_redirect_uri\" | \"url_state\">;\n\n/**\n * @public\n */\nexport type RevokeTokensTypes = UserManagerSettings[\"revokeTokenTypes\"];\n\n/**\n * @public\n */\nexport type SigninRedirectArgs = RedirectParams & ExtraSigninRequestArgs;\n\n/**\n * @public\n */\nexport type SigninPopupArgs = PopupWindowParams & ExtraSigninRequestArgs;\n\n/**\n * @public\n */\nexport type ExtraSignInSilentArgs = { \n    // forceIframeAuth bypasses refresh token usage and forces iframe-based silent authentication\n    forceIframeAuth?: boolean;\n};\n\n/**\n * @public\n */\nexport type SigninSilentArgs = IFrameWindowParams & ExtraSigninRequestArgs & ExtraSignInSilentArgs;\n\n/**\n * @public\n */\nexport type SigninResourceOwnerCredentialsArgs = ProcessResourceOwnerPasswordCredentialsArgs;\n\n/**\n * @public\n */\nexport type QuerySessionStatusArgs = IFrameWindowParams & ExtraSigninRequestArgs;\n\n/**\n * @public\n */\nexport type SignoutRedirectArgs = RedirectParams & ExtraSignoutRequestArgs;\n\n/**\n * @public\n */\nexport type SignoutPopupArgs = PopupWindowParams & ExtraSignoutRequestArgs;\n\n/**\n * @public\n */\nexport type SignoutSilentArgs = IFrameWindowParams & ExtraSignoutRequestArgs;\n\n/**\n * Provides a higher level API for signing a user in, signing out, managing the user's claims returned from the identity provider,\n * and managing an access token returned from the identity provider (OAuth2/OIDC).\n *\n * @public\n */\nexport class UserManager {\n    /** Get the settings used to configure the `UserManager`. */\n    public readonly settings: UserManagerSettingsStore;\n    protected readonly _logger = new Logger(\"UserManager\");\n\n    protected readonly _client: OidcClient;\n    protected readonly _redirectNavigator: INavigator;\n    protected readonly _popupNavigator: INavigator;\n    protected readonly _iframeNavigator: INavigator;\n    protected readonly _events: UserManagerEvents;\n    protected readonly _silentRenewService: SilentRenewService;\n    protected readonly _sessionMonitor: SessionMonitor | null;\n\n    public constructor(settings: UserManagerSettings, redirectNavigator?: INavigator, popupNavigator?: INavigator, iframeNavigator?: INavigator) {\n        this.settings = new UserManagerSettingsStore(settings);\n\n        this._client = new OidcClient(settings);\n\n        this._redirectNavigator = redirectNavigator ?? new RedirectNavigator(this.settings);\n        this._popupNavigator = popupNavigator ?? new PopupNavigator(this.settings);\n        this._iframeNavigator = iframeNavigator ?? new IFrameNavigator(this.settings);\n\n        this._events = new UserManagerEvents(this.settings);\n        this._silentRenewService = new SilentRenewService(this);\n\n        // order is important for the following properties; these services depend upon the events.\n        if (this.settings.automaticSilentRenew) {\n            this.startSilentRenew();\n        }\n\n        this._sessionMonitor = null;\n        if (this.settings.monitorSession) {\n            this._sessionMonitor = new SessionMonitor(this);\n        }\n    }\n\n    /**\n     * Get object used to register for events raised by the `UserManager`.\n     */\n    public get events(): UserManagerEvents {\n        return this._events;\n    }\n\n    /**\n     * Get object used to access the metadata configuration of the identity provider.\n     */\n    public get metadataService(): MetadataService {\n        return this._client.metadataService;\n    }\n\n    /**\n     * Load the `User` object for the currently authenticated user.\n     *\n     * @param raiseEvent - If `true`, the `UserLoaded` event will be raised. Defaults to false.\n     * @returns A promise\n     */\n    public async getUser(raiseEvent = false): Promise<User | null> {\n        const logger = this._logger.create(\"getUser\");\n        const user = await this._loadUser();\n        if (user) {\n            logger.info(\"user loaded\");\n            await this._events.load(user, raiseEvent);\n            return user;\n        }\n\n        logger.info(\"user not found in storage\");\n        return null;\n    }\n\n    /**\n     * Remove from any storage the currently authenticated user.\n     *\n     * @returns A promise\n     */\n    public async removeUser(): Promise<void> {\n        const logger = this._logger.create(\"removeUser\");\n        await this.storeUser(null);\n        logger.info(\"user removed from storage\");\n        await this._events.unload();\n    }\n\n    /**\n     * Trigger a redirect of the current window to the authorization endpoint.\n     *\n     * @returns A promise\n     *\n     * @throws `Error` In cases of wrong authentication.\n     */\n    public async signinRedirect(args: SigninRedirectArgs = {}): Promise<void> {\n        this._logger.create(\"signinRedirect\");\n        const {\n            redirectMethod,\n            ...requestArgs\n        } = args;\n\n        let dpopJkt: string | undefined;\n        if (this.settings.dpop?.bind_authorization_code) {\n            dpopJkt = await this.generateDPoPJkt(this.settings.dpop);\n        }\n\n        const handle = await this._redirectNavigator.prepare({ redirectMethod });\n        await this._signinStart({\n            request_type: \"si:r\",\n            dpopJkt,\n            ...requestArgs,\n        }, handle);\n    }\n\n    /**\n     * Process the response (callback) from the authorization endpoint.\n     * It is recommended to use {@link UserManager.signinCallback} instead.\n     *\n     * @returns A promise containing the authenticated `User`.\n     *\n     * @see {@link UserManager.signinCallback}\n     */\n    public async signinRedirectCallback(url = window.location.href): Promise<User> {\n        const logger = this._logger.create(\"signinRedirectCallback\");\n        const user = await this._signinEnd(url);\n        if (user.profile && user.profile.sub) {\n            logger.info(\"success, signed in subject\", user.profile.sub);\n        }\n        else {\n            logger.info(\"no subject\");\n        }\n\n        return user;\n    }\n\n    /**\n     * Trigger the signin with user/password.\n     *\n     * @returns A promise containing the authenticated `User`.\n     * @throws {@link ErrorResponse} In cases of wrong authentication.\n     */\n    public async signinResourceOwnerCredentials({\n        username,\n        password,\n        skipUserInfo = false,\n    }: SigninResourceOwnerCredentialsArgs): Promise<User> {\n        const logger = this._logger.create(\"signinResourceOwnerCredential\");\n\n        const signinResponse = await this._client.processResourceOwnerPasswordCredentials({\n            username,\n            password,\n            skipUserInfo,\n            extraTokenParams: this.settings.extraTokenParams,\n        });\n        logger.debug(\"got signin response\");\n\n        const user = await this._buildUser(signinResponse);\n        if (user.profile && user.profile.sub) {\n            logger.info(\"success, signed in subject\", user.profile.sub);\n        } else {\n            logger.info(\"no subject\");\n        }\n        return user;\n    }\n\n    /**\n     * Trigger a request (via a popup window) to the authorization endpoint.\n     *\n     * @returns A promise containing the authenticated `User`.\n     * @throws `Error` In cases of wrong authentication.\n     */\n    public async signinPopup(args: SigninPopupArgs = {}): Promise<User> {\n        const logger = this._logger.create(\"signinPopup\");\n\n        let dpopJkt: string | undefined;\n        if (this.settings.dpop?.bind_authorization_code) {\n            dpopJkt = await this.generateDPoPJkt(this.settings.dpop);\n        }\n\n        const {\n            popupWindowFeatures,\n            popupWindowTarget,\n            popupSignal,\n            popupAbortOnClose,\n            ...requestArgs\n        } = args;\n        const url = this.settings.popup_redirect_uri;\n        if (!url) {\n            logger.throw(new Error(\"No popup_redirect_uri configured\"));\n        }\n\n        const handle = await this._popupNavigator.prepare({ popupWindowFeatures, popupWindowTarget, popupSignal, popupAbortOnClose });\n        const user = await this._signin({\n            request_type: \"si:p\",\n            redirect_uri: url,\n            display: \"popup\",\n            dpopJkt,\n            ...requestArgs,\n        }, handle);\n        if (user) {\n            if (user.profile && user.profile.sub) {\n                logger.info(\"success, signed in subject\", user.profile.sub);\n            } else {\n                logger.info(\"no subject\");\n            }\n        }\n\n        return user;\n    }\n\n    /**\n     * Notify the opening window of response (callback) from the authorization endpoint.\n     * It is recommended to use {@link UserManager.signinCallback} instead.\n     *\n     * @returns A promise\n     *\n     * @see {@link UserManager.signinCallback}\n     */\n    public async signinPopupCallback(url = window.location.href, keepOpen = false): Promise<void> {\n        const logger = this._logger.create(\"signinPopupCallback\");\n        await this._popupNavigator.callback(url, { keepOpen });\n        logger.info(\"success\");\n    }\n\n    /**\n     * Trigger a silent request (via refresh token or an iframe) to the authorization endpoint.\n     *\n     * @returns A promise that contains the authenticated `User`.\n     */\n    public async signinSilent(args: SigninSilentArgs = {}): Promise<User | null> {\n        const logger = this._logger.create(\"signinSilent\");\n        const {\n            silentRequestTimeoutInSeconds,\n            ...requestArgs\n        } = args;\n        // first determine if we have a refresh token, or need to use iframe\n        let user = await this._loadUser();\n        // use refresh token unless forceIframeAuth is explicitly true\n        if (!args.forceIframeAuth && user?.refresh_token) {\n            logger.debug(\"using refresh token\");\n            const state = new RefreshState(user as Required<User>);\n            return await this._useRefreshToken({\n                state,\n                redirect_uri: requestArgs.redirect_uri,\n                resource: requestArgs.resource,\n                extraTokenParams: requestArgs.extraTokenParams,\n                timeoutInSeconds: silentRequestTimeoutInSeconds,\n            });\n        }\n\n        let dpopJkt: string | undefined;\n        if (this.settings.dpop?.bind_authorization_code) {\n            dpopJkt = await this.generateDPoPJkt(this.settings.dpop);\n        }\n\n        const url = this.settings.silent_redirect_uri;\n        if (!url) {\n            logger.throw(new Error(\"No silent_redirect_uri configured\"));\n        }\n\n        let verifySub: string | undefined;\n        if (user && this.settings.validateSubOnSilentRenew) {\n            logger.debug(\"subject prior to silent renew:\", user.profile.sub);\n            verifySub = user.profile.sub;\n        }\n\n        const handle = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds });\n        user = await this._signin({\n            request_type: \"si:s\",\n            redirect_uri: url,\n            prompt: \"none\",\n            id_token_hint: this.settings.includeIdTokenInSilentRenew ? user?.id_token : undefined,\n            dpopJkt,\n            ...requestArgs,\n        }, handle, verifySub);\n        if (user) {\n            if (user.profile?.sub) {\n                logger.info(\"success, signed in subject\", user.profile.sub);\n            }\n            else {\n                logger.info(\"no subject\");\n            }\n        }\n\n        return user;\n    }\n\n    protected async _useRefreshToken(args: UseRefreshTokenArgs): Promise<User> {\n        const response = await this._client.useRefreshToken({\n            timeoutInSeconds: this.settings.silentRequestTimeoutInSeconds,\n            ...args,\n        });\n        const user = new User({ ...args.state, ...response });\n\n        await this.storeUser(user);\n        await this._events.load(user);\n        return user;\n    }\n\n    /**\n     *\n     * Notify the parent window of response (callback) from the authorization endpoint.\n     * It is recommended to use {@link UserManager.signinCallback} instead.\n     *\n     * @returns A promise\n     *\n     * @see {@link UserManager.signinCallback}\n     */\n    public async signinSilentCallback(url = window.location.href): Promise<void> {\n        const logger = this._logger.create(\"signinSilentCallback\");\n        await this._iframeNavigator.callback(url);\n        logger.info(\"success\");\n    }\n\n    /**\n     * Process any response (callback) from the authorization endpoint, by dispatching the request_type\n     * and executing one of the following functions:\n     * - {@link UserManager.signinRedirectCallback}\n     * - {@link UserManager.signinPopupCallback}\n     * - {@link UserManager.signinSilentCallback}\n     *\n     * @throws `Error` If request_type is unknown or signin cannot be processed.\n     */\n    public async signinCallback(url = window.location.href): Promise<User | undefined> {\n        const { state } = await this._client.readSigninResponseState(url);\n        switch (state.request_type) {\n            case \"si:r\":\n                return await this.signinRedirectCallback(url);\n            case \"si:p\":\n                await this.signinPopupCallback(url);\n                break;\n            case \"si:s\":\n                await this.signinSilentCallback(url);\n                break;\n            default:\n                throw new Error(\"invalid request_type in state\");\n        }\n        return undefined;\n    }\n\n    /**\n     * Process any response (callback) from the end session endpoint, by dispatching the request_type\n     * and executing one of the following functions:\n     * - {@link UserManager.signoutRedirectCallback}\n     * - {@link UserManager.signoutPopupCallback}\n     * - {@link UserManager.signoutSilentCallback}\n     *\n     * @throws `Error` If request_type is unknown or signout cannot be processed.\n     */\n    public async signoutCallback(url = window.location.href, keepOpen = false): Promise<SignoutResponse | undefined> {\n        const { state } = await this._client.readSignoutResponseState(url);\n        if (!state) {\n            return undefined;\n        }\n\n        switch (state.request_type) {\n            case \"so:r\":\n                return await this.signoutRedirectCallback(url);\n            case \"so:p\":\n                await this.signoutPopupCallback(url, keepOpen);\n                break;\n            case \"so:s\":\n                await this.signoutSilentCallback(url);\n                break;\n            default:\n                throw new Error(\"invalid request_type in state\");\n        }\n        return undefined;\n    }\n\n    /**\n     * Query OP for user's current signin status.\n     *\n     * @returns A promise object with session_state and subject identifier.\n     */\n    public async querySessionStatus(args: QuerySessionStatusArgs = {}): Promise<SessionStatus | null> {\n        const logger = this._logger.create(\"querySessionStatus\");\n        const {\n            silentRequestTimeoutInSeconds,\n            ...requestArgs\n        } = args;\n        const url = this.settings.silent_redirect_uri;\n        if (!url) {\n            logger.throw(new Error(\"No silent_redirect_uri configured\"));\n        }\n\n        const user = await this._loadUser();\n        const handle = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds });\n        const navResponse = await this._signinStart({\n            request_type: \"si:s\", // this acts like a signin silent\n            redirect_uri: url,\n            prompt: \"none\",\n            id_token_hint: this.settings.includeIdTokenInSilentRenew ? user?.id_token : undefined,\n            response_type: this.settings.query_status_response_type,\n            scope: \"openid\",\n            skipUserInfo: true,\n            ...requestArgs,\n        }, handle);\n        try {\n            const extraHeaders: Record<string, ExtraHeader> = {};\n            const signinResponse = await this._client.processSigninResponse(navResponse.url, extraHeaders);\n            logger.debug(\"got signin response\");\n\n            if (signinResponse.session_state && signinResponse.profile.sub) {\n                logger.info(\"success for subject\", signinResponse.profile.sub);\n                return {\n                    session_state: signinResponse.session_state,\n                    sub: signinResponse.profile.sub,\n                };\n            }\n\n            logger.info(\"success, user not authenticated\");\n            return null;\n        } catch (err) {\n            if (this.settings.monitorAnonymousSession && err instanceof ErrorResponse) {\n                switch (err.error) {\n                    case \"login_required\":\n                    case \"consent_required\":\n                    case \"interaction_required\":\n                    case \"account_selection_required\":\n                        logger.info(\"success for anonymous user\");\n                        return {\n                            session_state: err.session_state!,\n                        };\n                }\n            }\n            throw err;\n        }\n    }\n\n    protected async _signin(args: CreateSigninRequestArgs, handle: IWindow, verifySub?: string): Promise<User> {\n        const navResponse = await this._signinStart(args, handle);\n        return await this._signinEnd(navResponse.url, verifySub);\n    }\n\n    protected async _signinStart(args: CreateSigninRequestArgs, handle: IWindow): Promise<NavigateResponse> {\n        const logger = this._logger.create(\"_signinStart\");\n\n        try {\n            const signinRequest = await this._client.createSigninRequest(args);\n            logger.debug(\"got signin request\");\n\n            return await handle.navigate({\n                url: signinRequest.url,\n                state: signinRequest.state.id,\n                response_mode: signinRequest.state.response_mode,\n                scriptOrigin: this.settings.iframeScriptOrigin,\n            });\n        } catch (err) {\n            logger.debug(\"error after preparing navigator, closing navigator window\");\n            handle.close();\n            throw err;\n        }\n    }\n\n    protected async _signinEnd(url: string, verifySub?: string): Promise<User> {\n        const logger = this._logger.create(\"_signinEnd\");\n        const extraHeaders: Record<string, ExtraHeader> = {};\n        const signinResponse = await this._client.processSigninResponse(url, extraHeaders);\n        logger.debug(\"got signin response\");\n\n        const user = await this._buildUser(signinResponse, verifySub);\n        return user;\n    }\n\n    protected async _buildUser(signinResponse: SigninResponse, verifySub?: string) {\n        const logger = this._logger.create(\"_buildUser\");\n        const user = new User(signinResponse);\n        if (verifySub) {\n            if (verifySub !== user.profile.sub) {\n                logger.debug(\"current user does not match user returned from signin. sub from signin:\", user.profile.sub);\n                throw new ErrorResponse({ ...signinResponse, error: \"login_required\" });\n            }\n            logger.debug(\"current user matches user returned from signin\");\n        }\n\n        await this.storeUser(user);\n        logger.debug(\"user stored\");\n        await this._events.load(user);\n\n        return user;\n    }\n\n    /**\n     * Trigger a redirect of the current window to the end session endpoint.\n     *\n     * @returns A promise\n     */\n    public async signoutRedirect(args: SignoutRedirectArgs = {}): Promise<void> {\n        const logger = this._logger.create(\"signoutRedirect\");\n        const {\n            redirectMethod,\n            ...requestArgs\n        } = args;\n        const handle = await this._redirectNavigator.prepare({ redirectMethod });\n        await this._signoutStart({\n            request_type: \"so:r\",\n            post_logout_redirect_uri: this.settings.post_logout_redirect_uri,\n            ...requestArgs,\n        }, handle);\n        logger.info(\"success\");\n    }\n\n    /**\n     * Process response (callback) from the end session endpoint.\n     * It is recommended to use {@link UserManager.signoutCallback} instead.\n     *\n     * @returns A promise containing signout response\n     *\n     * @see {@link UserManager.signoutCallback}\n     */\n    public async signoutRedirectCallback(url = window.location.href): Promise<SignoutResponse> {\n        const logger = this._logger.create(\"signoutRedirectCallback\");\n        const response = await this._signoutEnd(url);\n        logger.info(\"success\");\n        return response;\n    }\n\n    /**\n     * Trigger a redirect of a popup window to the end session endpoint.\n     *\n     * @returns A promise\n     */\n    public async signoutPopup(args: SignoutPopupArgs = {}): Promise<void> {\n        const logger = this._logger.create(\"signoutPopup\");\n        const {\n            popupWindowFeatures,\n            popupWindowTarget,\n            popupSignal,\n            ...requestArgs\n        } = args;\n        const url = this.settings.popup_post_logout_redirect_uri;\n\n        const handle = await this._popupNavigator.prepare({ popupWindowFeatures, popupWindowTarget, popupSignal });\n        await this._signout({\n            request_type: \"so:p\",\n            post_logout_redirect_uri: url,\n            // we're putting a dummy entry in here because we\n            // need a unique id from the state for notification\n            // to the parent window, which is necessary if we\n            // plan to return back to the client after signout\n            // and so we can close the popup after signout\n            state: url == null ? undefined : {},\n            ...requestArgs,\n        }, handle);\n        logger.info(\"success\");\n    }\n\n    /**\n     * Process response (callback) from the end session endpoint from a popup window.\n     * It is recommended to use {@link UserManager.signoutCallback} instead.\n     *\n     * @returns A promise\n     *\n     * @see {@link UserManager.signoutCallback}\n     */\n    public async signoutPopupCallback(url = window.location.href, keepOpen = false): Promise<void> {\n        const logger = this._logger.create(\"signoutPopupCallback\");\n        await this._popupNavigator.callback(url, { keepOpen });\n        logger.info(\"success\");\n    }\n\n    protected async _signout(args: CreateSignoutRequestArgs, handle: IWindow): Promise<SignoutResponse> {\n        const navResponse = await this._signoutStart(args, handle);\n        return await this._signoutEnd(navResponse.url);\n    }\n\n    protected async _signoutStart(args: CreateSignoutRequestArgs = {}, handle: IWindow): Promise<NavigateResponse> {\n        const logger = this._logger.create(\"_signoutStart\");\n\n        try {\n            const user = await this._loadUser();\n            logger.debug(\"loaded current user from storage\");\n\n            if (this.settings.revokeTokensOnSignout) {\n                await this._revokeInternal(user);\n            }\n\n            const id_token = args.id_token_hint || user && user.id_token;\n            if (id_token) {\n                logger.debug(\"setting id_token_hint in signout request\");\n                args.id_token_hint = id_token;\n            }\n\n            await this.removeUser();\n            logger.debug(\"user removed, creating signout request\");\n\n            const signoutRequest = await this._client.createSignoutRequest(args);\n            logger.debug(\"got signout request\");\n\n            return await handle.navigate({\n                url: signoutRequest.url,\n                state: signoutRequest.state?.id,\n                scriptOrigin: this.settings.iframeScriptOrigin,\n            });\n        } catch (err) {\n            logger.debug(\"error after preparing navigator, closing navigator window\");\n            handle.close();\n            throw err;\n        }\n    }\n\n    protected async _signoutEnd(url: string): Promise<SignoutResponse> {\n        const logger = this._logger.create(\"_signoutEnd\");\n        const signoutResponse = await this._client.processSignoutResponse(url);\n        logger.debug(\"got signout response\");\n\n        return signoutResponse;\n    }\n\n    /**\n     * Trigger a silent request (via an iframe) to the end session endpoint.\n     *\n     * @returns A promise\n     */\n    public async signoutSilent(args: SignoutSilentArgs = {}): Promise<void> {\n        const logger = this._logger.create(\"signoutSilent\");\n        const {\n            silentRequestTimeoutInSeconds,\n            ...requestArgs\n        } = args;\n\n        const id_token_hint = this.settings.includeIdTokenInSilentSignout\n            ? (await this._loadUser())?.id_token\n            : undefined;\n\n        const url = this.settings.popup_post_logout_redirect_uri;\n        const handle = await this._iframeNavigator.prepare({ silentRequestTimeoutInSeconds });\n        await this._signout({\n            request_type: \"so:s\",\n            post_logout_redirect_uri: url,\n            id_token_hint: id_token_hint,\n            ...requestArgs,\n        }, handle);\n\n        logger.info(\"success\");\n    }\n\n    /**\n     * Notify the parent window of response (callback) from the end session endpoint.\n     * It is recommended to use {@link UserManager.signoutCallback} instead.\n     *\n     * @returns A promise\n     *\n     * @see {@link UserManager.signoutCallback}\n     */\n    public async signoutSilentCallback(url = window.location.href): Promise<void> {\n        const logger = this._logger.create(\"signoutSilentCallback\");\n        await this._iframeNavigator.callback(url);\n        logger.info(\"success\");\n    }\n\n    public async revokeTokens(types?: RevokeTokensTypes): Promise<void> {\n        const user = await this._loadUser();\n        await this._revokeInternal(user, types);\n    }\n\n    protected async _revokeInternal(user: User | null, types = this.settings.revokeTokenTypes): Promise<void> {\n        const logger = this._logger.create(\"_revokeInternal\");\n        if (!user) return;\n\n        const typesPresent = types.filter(type => typeof user[type] === \"string\");\n\n        if (!typesPresent.length) {\n            logger.debug(\"no need to revoke due to no token(s)\");\n            return;\n        }\n\n        // don't Promise.all, order matters\n        for (const type of typesPresent) {\n            await this._client.revokeToken(\n                user[type]!,\n                type,\n            );\n            logger.info(`${type} revoked successfully`);\n            if (type !== \"access_token\") {\n                user[type] = null as never;\n            }\n        }\n\n        await this.storeUser(user);\n        logger.debug(\"user stored\");\n        await this._events.load(user);\n    }\n\n    /**\n     * Enables silent renew for the `UserManager`.\n     */\n    public startSilentRenew(): void {\n        this._logger.create(\"startSilentRenew\");\n        void this._silentRenewService.start();\n    }\n\n    /**\n     * Disables silent renew for the `UserManager`.\n     */\n    public stopSilentRenew(): void {\n        this._silentRenewService.stop();\n    }\n\n    protected get _userStoreKey(): string {\n        return `user:${this.settings.authority}:${this.settings.client_id}`;\n    }\n\n    protected async _loadUser(): Promise<User | null> {\n        const logger = this._logger.create(\"_loadUser\");\n        const storageString = await this.settings.userStore.get(this._userStoreKey);\n        if (storageString) {\n            logger.debug(\"user storageString loaded\");\n            return User.fromStorageString(storageString);\n        }\n\n        logger.debug(\"no user storageString\");\n        return null;\n    }\n\n    public async storeUser(user: User | null): Promise<void> {\n        const logger = this._logger.create(\"storeUser\");\n        if (user) {\n            logger.debug(\"storing user\");\n            const storageString = user.toStorageString();\n            await this.settings.userStore.set(this._userStoreKey, storageString);\n        } else {\n            this._logger.debug(\"removing user\");\n            await this.settings.userStore.remove(this._userStoreKey);\n            if (this.settings.dpop) {\n                await this.settings.dpop.store.remove(this.settings.client_id);\n            }\n        }\n    }\n\n    /**\n     * Removes stale state entries in storage for incomplete authorize requests.\n     */\n    public async clearStaleState(): Promise<void> {\n        await this._client.clearStaleState();\n    }\n\n    /**\n     * Dynamically generates a DPoP proof for a given user, URL and optional Http method.\n     * This method is useful when you need to make a request to a resource server\n     * with fetch or similar, and you need to include a DPoP proof in a DPoP header.\n     * @param url - The URL to generate the DPoP proof for\n     * @param user - The user to generate the DPoP proof for\n     * @param httpMethod - Optional, defaults to \"GET\"\n     * @param nonce - Optional nonce provided by the resource server\n     *\n     * @returns A promise containing the DPoP proof or undefined if DPoP is not enabled/no user is found.\n     */\n    public async dpopProof(url: string, user: User, httpMethod?: string, nonce?: string): Promise<string | undefined> {\n        const dpopState = await this.settings.dpop?.store?.get(this.settings.client_id);\n        if (dpopState) {\n            return await CryptoUtils.generateDPoPProof({\n                url,\n                accessToken: user?.access_token,\n                httpMethod: httpMethod,\n                keyPair: dpopState.keys,\n                nonce,\n            });\n        }\n        return undefined;\n    }\n\n    async generateDPoPJkt(dpopSettings: DPoPSettings): Promise<string | undefined> {\n        let dpopState = await dpopSettings.store.get(this.settings.client_id);\n        if (!dpopState) {\n            const dpopKeys = await CryptoUtils.generateDPoPKeys();\n            dpopState = new DPoPState(dpopKeys);\n            await dpopSettings.store.set(this.settings.client_id, dpopState);\n        }\n        return await CryptoUtils.generateDPoPJkt(dpopState.keys);\n    }\n}\n", "{\n  \"name\": \"oidc-client-ts\",\n  \"version\": \"3.5.0\",\n  \"description\": \"OpenID Connect (OIDC) & OAuth2 client library\",\n  \"repository\": {\n    \"type\": \"git\",\n    \"url\": \"git+https://github.com/authts/oidc-client-ts.git\"\n  },\n  \"homepage\": \"https://github.com/authts/oidc-client-ts#readme\",\n  \"license\": \"Apache-2.0\",\n  \"main\": \"dist/umd/oidc-client-ts.js\",\n  \"types\": \"dist/types/oidc-client-ts.d.ts\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/types/oidc-client-ts.d.ts\",\n      \"import\": \"./dist/esm/oidc-client-ts.js\",\n      \"require\": \"./dist/umd/oidc-client-ts.js\"\n    },\n    \"./package.json\": \"./package.json\"\n  },\n  \"files\": [\n    \"dist\"\n  ],\n  \"keywords\": [\n    \"authentication\",\n    \"oauth2\",\n    \"oidc\",\n    \"openid\",\n    \"OpenID Connect\"\n  ],\n  \"scripts\": {\n    \"build\": \"node scripts/build.js && npm run build-types\",\n    \"build-types\": \"tsc -p tsconfig.build.json && api-extractor run\",\n    \"clean\": \"git clean -fdX dist lib *.tsbuildinfo\",\n    \"prepack\": \"npm run build\",\n    \"test\": \"tsc && vitest run\",\n    \"typedoc\": \"typedoc\",\n    \"lint\": \"eslint --max-warnings=0 --cache .\",\n    \"prepare\": \"husky\"\n  },\n  \"dependencies\": {\n    \"jwt-decode\": \"^4.0.0\"\n  },\n  \"devDependencies\": {\n    \"@eslint/eslintrc\": \"^3.2.0\",\n    \"@eslint/js\": \"^9.18.0\",\n    \"@microsoft/api-extractor\": \"^7.49.1\",\n    \"@stylistic/eslint-plugin\": \"^2.13.0\",\n    \"@testing-library/jest-dom\": \"^6.6.3\",\n    \"@types/node\": \"^24.10.1\",\n    \"@typescript-eslint/eslint-plugin\": \"^8.20.0\",\n    \"@typescript-eslint/parser\": \"^8.20.0\",\n    \"@vitest/coverage-v8\": \"^4.0.16\",\n    \"esbuild\": \"^0.27.0\",\n    \"eslint\": \"^9.18.0\",\n    \"eslint-plugin-testing-library\": \"^7.1.1\",\n    \"fake-indexeddb\": \"^6.0.0\",\n    \"globals\": \"^17.0.0\",\n    \"http-proxy-middleware\": \"^3.0.3\",\n    \"husky\": \"^9.1.7\",\n    \"jose\": \"^5.9.6\",\n    \"jsdom\": \"^27.3.0\",\n    \"lint-staged\": \"^16.1.0\",\n    \"typedoc\": \"^0.28.0\",\n    \"typescript\": \"~5.8.2\",\n    \"vitest\": \"^4.0.16\",\n    \"yn\": \"^5.0.0\"\n  },\n  \"engines\": {\n    \"node\": \">=18\"\n  },\n  \"lint-staged\": {\n    \"*.{js,jsx,ts,tsx}\": \"eslint --cache --fix\"\n  }\n}\n", "// @ts-expect-error avoid enabling resolveJsonModule to keep build process simple\nimport { version } from \"../package.json\";\n\n/**\n * @public\n */\nexport const Version: string = version;\n", "import { DPoPState, type DPoPStore } from \"./DPoPStore\";\n\n/**\n * Provides a default implementation of the DPoP store using IndexedDB.\n *\n * @public\n */\nexport class IndexedDbDPoPStore implements DPoPStore {\n    readonly _dbName: string = \"oidc\";\n    readonly _storeName: string = \"dpop\";\n\n    public async set(key: string, value: DPoPState): Promise<void> {\n        const store = await this.createStore(this._dbName, this._storeName);\n        await store(\"readwrite\", (str: IDBObjectStore) => {\n            str.put(value, key);\n            return this.promisifyRequest(str.transaction);\n        });\n    }\n\n    public async get(key: string): Promise<DPoPState> {\n        const store = await this.createStore(this._dbName, this._storeName);\n        return await store(\"readonly\", (str) => {\n            return this.promisifyRequest(str.get(key));\n        }) as DPoPState;\n    }\n\n    public async remove(key: string): Promise<DPoPState> {\n        const item = await this.get(key);\n        const store = await this.createStore(this._dbName, this._storeName);\n        await store(\"readwrite\", (str) => {\n            return this.promisifyRequest(str.delete(key));\n        });\n        return item;\n    }\n\n    public async getAllKeys(): Promise<string[]> {\n        const store = await this.createStore(this._dbName, this._storeName);\n        return await store(\"readonly\", (str) => {\n            return this.promisifyRequest(str.getAllKeys());\n        }) as string[];\n    }\n\n    promisifyRequest<T = undefined>(\n        request: IDBRequest<T> | IDBTransaction): Promise<T> {\n        return new Promise<T>((resolve, reject) => {\n            (request as IDBTransaction).oncomplete = (request as IDBRequest<T>).onsuccess = () => resolve((request as IDBRequest<T>).result);\n            (request as IDBTransaction).onabort = (request as IDBRequest<T>).onerror = () => reject((request as IDBRequest<T>).error as Error);\n        });\n    }\n\n    async createStore<T>(\n        dbName: string,\n        storeName: string,\n    ): Promise<(txMode: IDBTransactionMode, callback: (store: IDBObjectStore) => T | PromiseLike<T>) => Promise<T>> {\n        const request = indexedDB.open(dbName);\n        request.onupgradeneeded = () => request.result.createObjectStore(storeName);\n        const db = await this.promisifyRequest<IDBDatabase>(request);\n\n        return async (\n            txMode: IDBTransactionMode,\n            callback: (store: IDBObjectStore) => T | PromiseLike<T>,\n        ) => {\n            const tx = db.transaction(storeName, txMode);\n            const store = tx.objectStore(storeName);\n            return await callback(store);\n        };\n    }\n}\n"],
+  "mappings": "scAAA,IAAAA,GAAA,GAAAC,GAAAD,GAAA,uBAAAE,EAAA,uBAAAC,EAAA,cAAAC,EAAA,kBAAAC,EAAA,iBAAAC,EAAA,uBAAAC,EAAA,uBAAAC,GAAA,QAAAC,EAAA,WAAAC,EAAA,oBAAAC,GAAA,eAAAC,GAAA,4BAAAC,EAAA,mBAAAC,GAAA,mBAAAC,EAAA,gBAAAC,EAAA,oBAAAC,GAAA,UAAAC,EAAA,SAAAC,EAAA,gBAAAC,GAAA,6BAAAC,GAAA,YAAAC,GAAA,yBAAAC,ICeA,IAAMC,GAAqB,CACvB,MAAO,IAAG,GACV,KAAM,IAAG,GACT,KAAM,IAAG,GACT,MAAO,IAAG,EACd,EAEIC,EACAC,EAOQC,OACRA,IAAA,eACAA,IAAA,iBACAA,IAAA,eACAA,IAAA,eACAA,IAAA,iBALQA,OAAA,KAaKA,GAAV,CACI,SAASC,GAAc,CAC1BH,EAAQ,EACRC,EAASF,EACb,CAHOG,EAAS,MAAAC,EAKT,SAASC,EAASC,EAAkB,CACvC,GAAI,EAAE,GAAYA,GAASA,GAAS,GAChC,MAAM,IAAI,MAAM,mBAAmB,EAEvCL,EAAQK,CACZ,CALOH,EAAS,SAAAE,EAOT,SAASE,EAAUD,EAAsB,CAC5CJ,EAASI,CACb,CAFOH,EAAS,UAAAI,IAbHJ,MAAA,KAuBV,IAAMK,EAAN,MAAMC,CAAO,CAET,YAAoBC,EAAe,CAAf,WAAAA,CAAgB,CAGpC,SAASC,EAAuB,CAC/BV,GAAS,GACTC,EAAO,MAAMO,EAAO,QAAQ,KAAK,MAAO,KAAK,OAAO,EAAG,GAAGE,CAAI,CAEtE,CACO,QAAQA,EAAuB,CAC9BV,GAAS,GACTC,EAAO,KAAKO,EAAO,QAAQ,KAAK,MAAO,KAAK,OAAO,EAAG,GAAGE,CAAI,CAErE,CACO,QAAQA,EAAuB,CAC9BV,GAAS,GACTC,EAAO,KAAKO,EAAO,QAAQ,KAAK,MAAO,KAAK,OAAO,EAAG,GAAGE,CAAI,CAErE,CACO,SAASA,EAAuB,CAC/BV,GAAS,GACTC,EAAO,MAAMO,EAAO,QAAQ,KAAK,MAAO,KAAK,OAAO,EAAG,GAAGE,CAAI,CAEtE,CAGO,MAAMC,EAAmB,CAC5B,WAAK,MAAMA,CAAG,EACRA,CACV,CAEO,OAAOC,EAAwB,CAClC,IAAMC,EAAuB,OAAO,OAAO,IAAI,EAC/C,OAAAA,EAAa,QAAUD,EACvBC,EAAa,MAAM,OAAO,EACnBA,CACX,CAEA,OAAc,aAAaC,EAAcC,EAA8B,CACnE,IAAMC,EAAe,IAAIR,EAAO,GAAGM,CAAI,IAAIC,CAAY,EAAE,EACzD,OAAAC,EAAa,MAAM,OAAO,EACnBA,CACX,CAEA,OAAe,QAAQF,EAAcF,EAAiB,CAClD,IAAMK,EAAS,IAAIH,CAAI,IACvB,OAAOF,EAAS,GAAGK,CAAM,IAAIL,CAAM,IAAMK,CAC7C,CAIA,OAAc,MAAMH,KAAiBJ,EAAuB,CACpDV,GAAS,GACTC,EAAO,MAAMO,EAAO,QAAQM,CAAI,EAAG,GAAGJ,CAAI,CAElD,CACA,OAAc,KAAKI,KAAiBJ,EAAuB,CACnDV,GAAS,GACTC,EAAO,KAAKO,EAAO,QAAQM,CAAI,EAAG,GAAGJ,CAAI,CAEjD,CACA,OAAc,KAAKI,KAAiBJ,EAAuB,CACnDV,GAAS,GACTC,EAAO,KAAKO,EAAO,QAAQM,CAAI,EAAG,GAAGJ,CAAI,CAEjD,CACA,OAAc,MAAMI,KAAiBJ,EAAuB,CACpDV,GAAS,GACTC,EAAO,MAAMO,EAAO,QAAQM,CAAI,EAAG,GAAGJ,CAAI,CAElD,CAEJ,EAEAR,EAAI,MAAM,EC7IH,IAAMgB,EAAN,cAAgC,KAAM,CAC7C,EACAA,EAAkB,UAAU,KAAO,oBACnC,SAASC,GAAiBC,EAAK,CAC3B,OAAO,mBAAmB,KAAKA,CAAG,EAAE,QAAQ,OAAQ,CAACC,EAAGC,IAAM,CAC1D,IAAIC,EAAOD,EAAE,WAAW,CAAC,EAAE,SAAS,EAAE,EAAE,YAAY,EACpD,OAAIC,EAAK,OAAS,IACdA,EAAO,IAAMA,GAEV,IAAMA,CACjB,CAAC,CAAC,CACN,CACA,SAASC,GAAgBJ,EAAK,CAC1B,IAAIK,EAASL,EAAI,QAAQ,KAAM,GAAG,EAAE,QAAQ,KAAM,GAAG,EACrD,OAAQK,EAAO,OAAS,EAAG,CACvB,IAAK,GACD,MACJ,IAAK,GACDA,GAAU,KACV,MACJ,IAAK,GACDA,GAAU,IACV,MACJ,QACI,MAAM,IAAI,MAAM,4CAA4C,CACpE,CACA,GAAI,CACA,OAAON,GAAiBM,CAAM,CAClC,MACY,CACR,OAAO,KAAKA,CAAM,CACtB,CACJ,CACO,SAASC,GAAUC,EAAOC,EAAS,CACtC,GAAI,OAAOD,GAAU,SACjB,MAAM,IAAIT,EAAkB,2CAA2C,EAE3EU,IAAYA,EAAU,CAAC,GACvB,IAAMC,EAAMD,EAAQ,SAAW,GAAO,EAAI,EACpCE,EAAOH,EAAM,MAAM,GAAG,EAAEE,CAAG,EACjC,GAAI,OAAOC,GAAS,SAChB,MAAM,IAAIZ,EAAkB,0CAA0CW,EAAM,CAAC,EAAE,EAEnF,IAAIE,EACJ,GAAI,CACAA,EAAUP,GAAgBM,CAAI,CAClC,OACOE,EAAG,CACN,MAAM,IAAId,EAAkB,qDAAqDW,EAAM,CAAC,KAAKG,EAAE,OAAO,GAAG,CAC7G,CACA,GAAI,CACA,OAAO,KAAK,MAAMD,CAAO,CAC7B,OACOC,EAAG,CACN,MAAM,IAAId,EAAkB,mDAAmDW,EAAM,CAAC,KAAKG,EAAE,OAAO,GAAG,CAC3G,CACJ,CC/CO,IAAMC,EAAN,KAAe,CAElB,OAAc,OAAOC,EAA0B,CAC3C,GAAI,CACA,OAAOC,GAAqBD,CAAK,CACrC,OACOE,EAAK,CACR,MAAAC,EAAO,MAAM,kBAAmBD,CAAG,EAC7BA,CACV,CACJ,CAEA,aAAoB,kBAAkBE,EAAgBC,EAAiBC,EAAyC,CAC5G,IAAMC,EAAgBC,EAAY,gBAAgB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAUJ,CAAM,CAAC,CAAC,EAC5FK,EAAiBD,EAAY,gBAAgB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAUH,CAAO,CAAC,CAAC,EAC9FK,EAAe,GAAGH,CAAa,IAAIE,CAAc,GAEjDE,EAAY,MAAM,OAAO,OAAO,OAAO,KACzC,CACI,KAAM,QACN,KAAM,CAAE,KAAM,SAAU,CAC5B,EACAL,EACA,IAAI,YAAY,EAAE,OAAOI,CAAY,CACzC,EAEME,EAAmBJ,EAAY,gBAAgB,IAAI,WAAWG,CAAS,CAAC,EAC9E,MAAO,GAAGD,CAAY,IAAIE,CAAgB,EAC9C,CAEA,aAAoB,0BAA0BR,EAAgBC,EAAiBQ,EAAuC,CAClH,IAAMN,EAAgBC,EAAY,gBAAgB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAUJ,CAAM,CAAC,CAAC,EAC5FK,EAAiBD,EAAY,gBAAgB,IAAI,YAAY,EAAE,OAAO,KAAK,UAAUH,CAAO,CAAC,CAAC,EAC9FK,EAAe,GAAGH,CAAa,IAAIE,CAAc,GAEjDE,EAAY,MAAM,OAAO,OAAO,OAAO,KACzC,OACAE,EACA,IAAI,YAAY,EAAE,OAAOH,CAAY,CACzC,EAEME,EAAmBJ,EAAY,gBAAgB,IAAI,WAAWG,CAAS,CAAC,EAC9E,MAAO,GAAGD,CAAY,IAAIE,CAAgB,EAC9C,CACJ,EC1CA,IAAME,GAAmB,uCAEnBC,GAAYC,GACd,KAAK,CAAC,GAAG,IAAI,WAAWA,CAAG,CAAC,EACvB,IAAKC,GAAQ,OAAO,aAAaA,CAAG,CAAC,EACrC,KAAK,EAAE,CAAC,EAKJC,EAAN,MAAMA,CAAY,CACrB,OAAe,aAAsB,CACjC,IAAMC,EAAM,IAAI,YAAY,CAAC,EAC7B,cAAO,gBAAgBA,CAAG,EACnBA,EAAI,CAAC,CAChB,CAKA,OAAc,gBAAyB,CAInC,OAHaL,GAAiB,QAAQ,SAAUM,IAC3C,CAACA,EAAIF,EAAY,YAAY,EAAI,IAAM,CAACE,EAAI,GAAG,SAAS,EAAE,CAC/D,EACY,QAAQ,KAAM,EAAE,CAChC,CAKA,OAAc,sBAA+B,CACzC,OAAOF,EAAY,eAAe,EAAIA,EAAY,eAAe,EAAIA,EAAY,eAAe,CACpG,CAKA,aAAoB,sBAAsBG,EAAwC,CAC9E,GAAI,CAAC,OAAO,OACR,MAAM,IAAI,MAAM,6DAA6D,EAGjF,GAAI,CAEA,IAAMC,EADU,IAAI,YAAY,EACX,OAAOD,CAAa,EACnCE,EAAS,MAAM,OAAO,OAAO,OAAO,UAAWD,CAAI,EACzD,OAAOP,GAASQ,CAAM,EAAE,QAAQ,MAAO,GAAG,EAAE,QAAQ,MAAO,GAAG,EAAE,QAAQ,MAAO,EAAE,CACrF,OACOC,EAAK,CACR,MAAAC,EAAO,MAAM,oCAAqCD,CAAG,EAC/CA,CACV,CACJ,CAKA,OAAc,kBAAkBE,EAAmBC,EAA+B,CAE9E,IAAML,EADU,IAAI,YAAY,EACX,OAAO,CAACI,EAAWC,CAAa,EAAE,KAAK,GAAG,CAAC,EAChE,OAAOZ,GAASO,CAAI,CACxB,CAOA,aAAoB,KAAKM,EAAaC,EAAuC,CACzE,IAAMC,EAAW,IAAI,YAAY,EAAE,OAAOD,CAAO,EAC3CE,EAAa,MAAM,OAAO,OAAO,OAAOH,EAAKE,CAAQ,EAC3D,OAAO,IAAI,WAAWC,CAAU,CACpC,CAaA,aAAoB,6BAA6BC,EAAkC,CAC/E,IAAIC,EACJ,OAAQD,EAAI,IAAK,CACb,IAAK,MACDC,EAAa,CACT,EAAKD,EAAI,EACT,IAAOA,EAAI,IACX,EAAKA,EAAI,CACb,EACA,MACJ,IAAK,KACDC,EAAa,CACT,IAAOD,EAAI,IACX,IAAOA,EAAI,IACX,EAAKA,EAAI,EACT,EAAKA,EAAI,CACb,EACA,MACJ,IAAK,MACDC,EAAa,CACT,IAAOD,EAAI,IACX,IAAOA,EAAI,IACX,EAAKA,EAAI,CACb,EACA,MACJ,IAAK,MACDC,EAAa,CACT,IAAOD,EAAI,EACX,IAAOA,EAAI,GACf,EACA,MACJ,QACI,MAAM,IAAI,MAAM,kBAAkB,CAC1C,CACA,IAAME,EAAuB,MAAMhB,EAAY,KAAK,UAAW,KAAK,UAAUe,CAAU,CAAC,EACzF,OAAOf,EAAY,gBAAgBgB,CAAoB,CAC3D,CAEA,aAAoB,kBAAkB,CAClC,IAAAC,EACA,YAAAC,EACA,WAAAC,EACA,QAAAC,EACA,MAAAC,CACJ,EAA2C,CACvC,IAAIC,EACAC,EAEEC,EAA2C,CAC7C,IAAO,OAAO,OAAO,WAAW,EAChC,IAAOL,GAAA,KAAAA,EAAc,MACrB,IAAOF,EACP,IAAO,KAAK,MAAM,KAAK,IAAI,EAAI,GAAI,CACvC,EAEIC,IACAI,EAAc,MAAMtB,EAAY,KAAK,UAAWkB,CAAW,EAC3DK,EAAcvB,EAAY,gBAAgBsB,CAAW,EACrDE,EAAQ,IAAMD,GAGdF,IACAG,EAAQ,MAAQH,GAGpB,GAAI,CACA,IAAMI,EAAY,MAAM,OAAO,OAAO,UAAU,MAAOL,EAAQ,SAAS,EAClEM,EAAS,CACX,IAAO,QACP,IAAO,WACP,IAAO,CACH,IAAOD,EAAU,IACjB,IAAOA,EAAU,IACjB,EAAKA,EAAU,EACf,EAAKA,EAAU,CACnB,CACJ,EACA,OAAO,MAAME,EAAS,kBAAkBD,EAAQF,EAASJ,EAAQ,UAAU,CAC/E,OAASd,EAAK,CACV,MAAIA,aAAe,UACT,IAAI,MAAM,oCAAoCA,EAAI,OAAO,EAAE,EAE3DA,CAEd,CACJ,CAEA,aAAoB,gBAAgBc,EAA0C,CAC1E,GAAI,CACA,IAAMK,EAAY,MAAM,OAAO,OAAO,UAAU,MAAOL,EAAQ,SAAS,EACxE,OAAO,MAAMpB,EAAY,6BAA6ByB,CAAS,CACnE,OAASnB,EAAK,CACV,MAAIA,aAAe,UACT,IAAI,MAAM,8CAA8CA,EAAI,OAAO,EAAE,EAErEA,CAEd,CACJ,CAEA,aAAoB,kBAA4C,CAC5D,OAAO,MAAM,OAAO,OAAO,OAAO,YAC9B,CACI,KAAM,QACN,WAAY,OAChB,EACA,GACA,CAAC,OAAQ,QAAQ,CACrB,CACJ,CASA,aAAoB,2BAA2BE,EAAmBC,EAAuBmB,EAAkBC,EAAoB,QAA0B,CACrJ,IAAMC,EAAM,KAAK,MAAM,KAAK,IAAI,EAAI,GAAI,EAElCJ,EAAS,CACX,IAAOG,EACP,IAAO,KACX,EAEML,EAAU,CACZ,IAAOhB,EACP,IAAOA,EACP,IAAOoB,EACP,IAAO5B,EAAY,eAAe,EAClC,IAAO8B,EAAM,IACb,IAAOA,CACX,EAQMC,EANkC,CACpC,MAAS,UACT,MAAS,UACT,MAAS,SACb,EAE6BF,CAAS,EACtC,GAAI,CAACE,EACD,MAAM,IAAI,MAAM,0BAA0BF,CAAS,iDAAiD,EAGxG,IAAMG,EAAU,IAAI,YACdC,EAAY,MAAM,OAAO,OAAO,UAClC,MACAD,EAAQ,OAAOvB,CAAa,EAC5B,CAAE,KAAM,OAAQ,KAAMsB,CAAa,EACnC,GACA,CAAC,MAAM,CACX,EAEA,OAAO,MAAMJ,EAAS,0BAA0BD,EAAQF,EAASS,CAAS,CAC9E,CACJ,EAxOajC,EAmEK,gBAAmBkC,GACtBrC,GAASqC,CAAK,EAAE,QAAQ,KAAM,EAAE,EAAE,QAAQ,MAAO,GAAG,EAAE,QAAQ,MAAO,GAAG,EApEhF,IAAMC,EAANnC,ECRA,IAAMoC,EAAN,KAAyC,CAKrC,YAA+BC,EAAe,CAAf,WAAAA,EAFtC,KAAiB,WAAyC,CAAC,EAGvD,KAAK,QAAU,IAAIC,EAAO,UAAU,KAAK,KAAK,IAAI,CACtD,CAEO,WAAWC,EAAqC,CACnD,YAAK,WAAW,KAAKA,CAAE,EAChB,IAAM,KAAK,cAAcA,CAAE,CACtC,CAEO,cAAcA,EAA+B,CAChD,IAAMC,EAAM,KAAK,WAAW,YAAYD,CAAE,EACtCC,GAAO,GACP,KAAK,WAAW,OAAOA,EAAK,CAAC,CAErC,CAEA,MAAa,SAASC,EAA8B,CAChD,KAAK,QAAQ,MAAM,SAAU,GAAGA,CAAE,EAClC,QAAWF,KAAM,KAAK,WAClB,MAAMA,EAAG,GAAGE,CAAE,CAEtB,CACJ,EClBO,IAAMC,GAAN,KAAiB,CAMpB,OAAO,OAAO,CAAE,GAAGC,CAAS,EAA6C,CA5B7E,IAAAC,EAAAC,EAAAC,EA6BQ,OAAIH,EAAS,OAAS,OAClBA,EAAS,OAAQC,EAAA,CAAC,IAAK,IAAK,IAAK,GAAG,EAAE,KAAKG,GAASA,GAAS,OAAO,WAAa,KAAK,IAArE,KAAAH,EAA0E,MAC/FC,EAAAF,EAAS,OAAT,OAAAA,EAAS,KAAS,KAAK,IAAI,EAAG,KAAK,MAAM,OAAO,SAAW,OAAO,WAAaA,EAAS,OAAS,CAAC,CAAC,GAC/FA,EAAS,QAAU,QACnBG,EAAAH,EAAS,MAAT,OAAAA,EAAS,IAAQ,KAAK,IAAI,EAAG,KAAK,MAAM,OAAO,SAAW,OAAO,YAAcA,EAAS,QAAU,CAAC,CAAC,IACjGA,CACX,CAEA,OAAO,UAAUA,EAAuC,CACpD,OAAO,OAAO,QAAQA,CAAQ,EACzB,OAAO,CAAC,CAAC,CAAEK,CAAK,IAAMA,GAAS,IAAI,EACnC,IAAI,CAAC,CAACC,EAAKD,CAAK,IAAM,GAAGC,CAAG,IAAI,OAAOD,GAAU,UAAYA,EAAkBA,EAAQ,MAAQ,IAAI,EAAE,EACrG,KAAK,GAAG,CACjB,CACJ,EClCO,IAAME,EAAN,MAAMC,UAAcC,CAAc,CAAlC,kCACH,KAAmB,QAAU,IAAIC,EAAO,UAAU,KAAK,KAAK,IAAI,EAChE,KAAQ,aAAsD,KAC9D,KAAQ,YAAc,EAyCtB,KAAU,UAAY,IAAY,CAC9B,IAAMC,EAAO,KAAK,YAAcH,EAAM,aAAa,EACnD,KAAK,QAAQ,MAAM,qBAAsBG,CAAI,EAEzC,KAAK,aAAeH,EAAM,aAAa,IACvC,KAAK,OAAO,EACP,MAAM,MAAM,EAEzB,EA9CA,OAAc,cAAuB,CACjC,OAAO,KAAK,MAAM,KAAK,IAAI,EAAI,GAAI,CACvC,CAEO,KAAKI,EAAiC,CACzC,IAAMC,EAAS,KAAK,QAAQ,OAAO,MAAM,EACzCD,EAAoB,KAAK,IAAI,KAAK,MAAMA,CAAiB,EAAG,CAAC,EAC7D,IAAME,EAAaN,EAAM,aAAa,EAAII,EAC1C,GAAI,KAAK,aAAeE,GAAc,KAAK,aAAc,CAErDD,EAAO,MAAM,uDAAwD,KAAK,UAAU,EACpF,MACJ,CAEA,KAAK,OAAO,EAEZA,EAAO,MAAM,iBAAkBD,CAAiB,EAChD,KAAK,YAAcE,EAKnB,IAAMC,EAAyB,KAAK,IAAIH,EAAmB,CAAC,EAC5D,KAAK,aAAe,YAAY,KAAK,UAAWG,EAAyB,GAAI,CACjF,CAEA,IAAW,YAAqB,CAC5B,OAAO,KAAK,WAChB,CAEO,QAAe,CAClB,KAAK,QAAQ,OAAO,QAAQ,EACxB,KAAK,eACL,cAAc,KAAK,YAAY,EAC/B,KAAK,aAAe,KAE5B,CAWJ,ECxDO,IAAMC,EAAN,KAAe,CAClB,OAAc,WAAWC,EAAaC,EAAqC,QAA0B,CACjG,GAAI,CAACD,EAAK,MAAM,IAAI,UAAU,aAAa,EAG3C,IAAME,EADY,IAAI,IAAIF,EAAK,kBAAkB,EACxBC,IAAiB,WAAa,OAAS,QAAQ,EACxE,OAAO,IAAI,gBAAgBC,EAAO,MAAM,CAAC,CAAC,CAC9C,CACJ,EAKaC,EAAsB,ICR5B,IAAMC,EAAN,cAA4B,KAAM,CAqB9B,YACHC,EAKgBC,EAClB,CAvCN,IAAAC,EAAAC,EAAAC,EAwCQ,MAAMJ,EAAK,mBAAqBA,EAAK,OAAS,EAAE,EAFhC,UAAAC,EAzBpB,KAAgB,KAAe,gBA6BvB,IAACD,EAAK,MACN,MAAAK,EAAO,MAAM,gBAAiB,iBAAiB,EACzC,IAAI,MAAM,iBAAiB,EAGrC,KAAK,MAAQL,EAAK,MAClB,KAAK,mBAAoBE,EAAAF,EAAK,oBAAL,KAAAE,EAA0B,KACnD,KAAK,WAAYC,EAAAH,EAAK,YAAL,KAAAG,EAAkB,KAEnC,KAAK,MAAQH,EAAK,UAClB,KAAK,eAAgBI,EAAAJ,EAAK,gBAAL,KAAAI,EAAsB,KAC3C,KAAK,UAAYJ,EAAK,SAC1B,CACJ,EC/CO,IAAMM,EAAN,cAA2B,KAAM,CAI7B,YAAYC,EAAkB,CACjC,MAAMA,CAAO,EAHjB,KAAgB,KAAe,cAI/B,CACJ,ECDO,IAAMC,EAAN,KAAwB,CAOpB,YAAYC,EAAqD,CANxE,KAAmB,QAAU,IAAIC,EAAO,mBAAmB,EAE3D,KAAiB,eAAiB,IAAIC,EAAM,uBAAuB,EACnE,KAAiB,cAAgB,IAAIA,EAAM,sBAAsB,EAI7D,KAAK,mCAAqCF,EAAK,iCACnD,CAEA,MAAa,KAAKG,EAAgC,CAC9C,IAAMC,EAAS,KAAK,QAAQ,OAAO,MAAM,EAEzC,GAAID,EAAU,cAAgBA,EAAU,aAAe,OAAW,CAC9D,IAAME,EAAWF,EAAU,WAG3B,GAFAC,EAAO,MAAM,4CAA6CC,CAAQ,EAE9DA,EAAW,EAAG,CAEd,IAAIC,EAAWD,EAAW,KAAK,mCAC3BC,GAAY,IACZA,EAAW,GAGfF,EAAO,MAAM,yCAA0CE,EAAU,SAAS,EAC1E,KAAK,eAAe,KAAKA,CAAQ,CACrC,MAEIF,EAAO,MAAM,kEAAkE,EAC/E,KAAK,eAAe,OAAO,EAI/B,IAAMG,EAAUF,EAAW,EAC3BD,EAAO,MAAM,wCAAyCG,EAAS,SAAS,EACxE,KAAK,cAAc,KAAKA,CAAO,CACnC,MAEI,KAAK,eAAe,OAAO,EAC3B,KAAK,cAAc,OAAO,CAElC,CAEA,MAAa,QAAwB,CACjC,KAAK,QAAQ,MAAM,gDAAgD,EACnE,KAAK,eAAe,OAAO,EAC3B,KAAK,cAAc,OAAO,CAC9B,CAKO,uBAAuBC,EAAqC,CAC/D,OAAO,KAAK,eAAe,WAAWA,CAAE,CAC5C,CAIO,0BAA0BA,EAA+B,CAC5D,KAAK,eAAe,cAAcA,CAAE,CACxC,CAKO,sBAAsBA,EAAqC,CAC9D,OAAO,KAAK,cAAc,WAAWA,CAAE,CAC3C,CAIO,yBAAyBA,EAA+B,CAC3D,KAAK,cAAc,cAAcA,CAAE,CACvC,CACJ,ECjFO,IAAMC,EAAN,KAAyB,CAOrB,YACKC,EACAC,EACRC,EACQC,EACAC,EACV,CALU,eAAAJ,EACA,gBAAAC,EAEA,wBAAAE,EACA,kBAAAC,EAXZ,KAAiB,QAAU,IAAIC,EAAO,oBAAoB,EAG1D,KAAQ,OAAgD,KACxD,KAAQ,eAAgC,KAmCxC,KAAQ,SAAY,GAAkC,CAC9C,EAAE,SAAW,KAAK,eAClB,EAAE,SAAW,KAAK,OAAO,gBAErB,EAAE,OAAS,SACX,KAAK,QAAQ,MAAM,4CAA4C,EAC3D,KAAK,cACL,KAAK,KAAK,GAGT,EAAE,OAAS,WAChB,KAAK,QAAQ,MAAM,8CAA8C,EACjE,KAAK,KAAK,EACL,KAAK,UAAU,GAGpB,KAAK,QAAQ,MAAM,EAAE,KAAO,uCAAuC,EAG/E,EA7CI,IAAMC,EAAY,IAAI,IAAIJ,CAAG,EAC7B,KAAK,cAAgBI,EAAU,OAE/B,KAAK,OAAS,OAAO,SAAS,cAAc,QAAQ,EAGpD,KAAK,OAAO,MAAM,WAAa,SAC/B,KAAK,OAAO,MAAM,SAAW,QAC7B,KAAK,OAAO,MAAM,KAAO,UACzB,KAAK,OAAO,MAAM,IAAM,IACxB,KAAK,OAAO,MAAQ,IACpB,KAAK,OAAO,OAAS,IACrB,KAAK,OAAO,IAAMA,EAAU,IAChC,CAEO,MAAsB,CACzB,OAAO,IAAI,QAAeC,GAAY,CAClC,KAAK,OAAO,OAAS,IAAM,CACvBA,EAAQ,CACZ,EAEA,OAAO,SAAS,KAAK,YAAY,KAAK,MAAM,EAC5C,OAAO,iBAAiB,UAAW,KAAK,SAAU,EAAK,CAC3D,CAAC,CACL,CAuBO,MAAMC,EAA6B,CACtC,GAAI,KAAK,iBAAmBA,EACxB,OAGJ,KAAK,QAAQ,OAAO,OAAO,EAE3B,KAAK,KAAK,EAEV,KAAK,eAAiBA,EAEtB,IAAMC,EAAO,IAAM,CACX,CAAC,KAAK,OAAO,eAAiB,CAAC,KAAK,gBAIxC,KAAK,OAAO,cAAc,YAAY,KAAK,WAAa,IAAM,KAAK,eAAgB,KAAK,aAAa,CACzG,EAGAA,EAAK,EAGL,KAAK,OAAS,YAAYA,EAAM,KAAK,mBAAqB,GAAI,CAClE,CAEO,MAAa,CAChB,KAAK,QAAQ,OAAO,MAAM,EAC1B,KAAK,eAAiB,KAElB,KAAK,SAEL,cAAc,KAAK,MAAM,EACzB,KAAK,OAAS,KAEtB,CACJ,ECjGO,IAAMC,EAAN,KAA4C,CAA5C,cACH,KAAiB,QAAU,IAAIC,EAAO,oBAAoB,EAC1D,KAAQ,MAAgC,CAAC,EAElC,OAAc,CACjB,KAAK,QAAQ,OAAO,OAAO,EAC3B,KAAK,MAAQ,CAAC,CAClB,CAEO,QAAQC,EAAqB,CAChC,YAAK,QAAQ,OAAO,YAAYA,CAAG,IAAI,EAChC,KAAK,MAAMA,CAAG,CACzB,CAEO,QAAQA,EAAaC,EAAqB,CAC7C,KAAK,QAAQ,OAAO,YAAYD,CAAG,IAAI,EACvC,KAAK,MAAMA,CAAG,EAAIC,CACtB,CAEO,WAAWD,EAAmB,CACjC,KAAK,QAAQ,OAAO,eAAeA,CAAG,IAAI,EAC1C,OAAO,KAAK,MAAMA,CAAG,CACzB,CAEA,IAAW,QAAiB,CACxB,OAAO,OAAO,oBAAoB,KAAK,KAAK,EAAE,MAClD,CAEO,IAAIE,EAAuB,CAC9B,OAAO,OAAO,oBAAoB,KAAK,KAAK,EAAEA,CAAK,CACvD,CACJ,ECvCO,IAAMC,EAAN,cAA6B,KAAM,CAK/B,YAAYC,EAAeC,EAAkB,CAChD,MAAMA,CAAO,EAJjB,KAAgB,KAAe,iBAK3B,KAAK,MAAQD,CACjB,CACJ,EC2BO,IAAME,EAAN,KAAkB,CAKd,YACHC,EAAmC,CAAC,EAC5BC,EAAiC,KACjCC,EAA6C,CAAC,EACxD,CAFU,iBAAAD,EACA,mBAAAC,EAPZ,KAAiB,QAAU,IAAIC,EAAO,aAAa,EAEnD,KAAQ,cAA0B,CAAC,EAO/B,KAAK,cAAc,KAAK,GAAGH,EAAwB,kBAAkB,EACjEC,GACA,KAAK,cAAc,KAAK,iBAAiB,CAEjD,CAEA,MAAgB,iBAAiBG,EAAoBC,EAAoD,CAAC,EAAG,CACzG,GAAM,CAAE,iBAAAC,EAAkB,GAAGC,CAAU,EAAIF,EAC3C,GAAI,CAACC,EACD,OAAO,MAAM,MAAMF,EAAOG,CAAS,EAGvC,IAAMC,EAAa,IAAI,gBACjBC,EAAY,WAAW,IAAMD,EAAW,MAAM,EAAGF,EAAmB,GAAI,EAE9E,GAAI,CAKA,OAJiB,MAAM,MAAMF,EAAO,CAChC,GAAGC,EACH,OAAQG,EAAW,MACvB,CAAC,CAEL,OACOE,EAAK,CACR,MAAIA,aAAe,cAAgBA,EAAI,OAAS,aACtC,IAAIC,EAAa,mBAAmB,EAExCD,CACV,QACA,CACI,aAAaD,CAAS,CAC1B,CACJ,CAEA,MAAa,QAAQG,EAAa,CAC9B,MAAAC,EACA,YAAAC,EACA,iBAAAR,CACJ,EAAiB,CAAC,EAAqC,CACnD,IAAMS,EAAS,KAAK,QAAQ,OAAO,SAAS,EACtCC,EAAuB,CACzB,OAAU,KAAK,cAAc,KAAK,IAAI,CAC1C,EACIH,IACAE,EAAO,MAAM,4CAA4C,EACzDC,EAAQ,cAAmB,UAAYH,GAG3C,KAAK,oBAAoBG,CAAO,EAEhC,IAAIC,EACJ,GAAI,CACAF,EAAO,MAAM,OAAQH,CAAG,EACxBK,EAAW,MAAM,KAAK,iBAAiBL,EAAK,CAAE,OAAQ,MAAO,QAAAI,EAAS,iBAAAV,EAAkB,YAAAQ,CAAY,CAAC,CACzG,OACOJ,EAAK,CACR,MAAAK,EAAO,MAAM,eAAe,EACtBL,CACV,CAEAK,EAAO,MAAM,iCAAkCE,EAAS,MAAM,EAC9D,IAAMC,EAAcD,EAAS,QAAQ,IAAI,cAAc,EAIvD,GAHIC,GAAe,CAAC,KAAK,cAAc,KAAKC,GAAQD,EAAY,WAAWC,CAAI,CAAC,GAC5EJ,EAAO,MAAM,IAAI,MAAM,kCAAmCG,GAAA,KAAAA,EAAe,WAAY,eAAeN,CAAG,EAAE,CAAC,EAE1GK,EAAS,IAAM,KAAK,cAAeC,GAAA,MAAAA,EAAa,WAAW,oBAC3D,OAAO,MAAM,KAAK,YAAY,MAAMD,EAAS,KAAK,CAAC,EAEvD,IAAIG,EACJ,GAAI,CACAA,EAAO,MAAMH,EAAS,KAAK,CAC/B,OACOP,EAAK,CAER,MADAK,EAAO,MAAM,8BAA+BL,CAAG,EAC3CO,EAAS,GAAUP,EACjB,IAAI,MAAM,GAAGO,EAAS,UAAU,KAAKA,EAAS,MAAM,GAAG,CACjE,CACA,GAAI,CAACA,EAAS,GAEV,MADAF,EAAO,MAAM,qBAAsBK,CAAI,EACnCA,EAAK,MACC,IAAIC,EAAcD,CAAI,EAE1B,IAAI,MAAM,GAAGH,EAAS,UAAU,KAAKA,EAAS,MAAM,MAAM,KAAK,UAAUG,CAAI,CAAC,EAAE,EAE1F,OAAOA,CACX,CAEA,MAAa,SAASR,EAAa,CAC/B,KAAAU,EACA,UAAAC,EACA,iBAAAjB,EACA,gBAAAkB,EACA,aAAAC,CACJ,EAAmD,CAC/C,IAAMV,EAAS,KAAK,QAAQ,OAAO,UAAU,EACvCC,EAAuB,CACzB,OAAU,KAAK,cAAc,KAAK,IAAI,EACtC,eAAgB,oCAChB,GAAGS,CACP,EACIF,IAAc,SACdP,EAAQ,cAAmB,SAAWO,GAG1C,KAAK,oBAAoBP,CAAO,EAEhC,IAAIC,EACJ,GAAI,CACAF,EAAO,MAAM,OAAQH,CAAG,EACxBK,EAAW,MAAM,KAAK,iBAAiBL,EAAK,CAAE,OAAQ,OAAQ,QAAAI,EAAS,KAAAM,EAAM,iBAAAhB,EAAkB,YAAakB,CAAgB,CAAC,CACjI,OACOd,EAAK,CACR,MAAAK,EAAO,MAAM,eAAe,EACtBL,CACV,CAEAK,EAAO,MAAM,iCAAkCE,EAAS,MAAM,EAC9D,IAAMC,EAAcD,EAAS,QAAQ,IAAI,cAAc,EACvD,GAAIC,GAAe,CAAC,KAAK,cAAc,KAAKC,GAAQD,EAAY,WAAWC,CAAI,CAAC,EAC5E,MAAM,IAAI,MAAM,kCAAmCD,GAAA,KAAAA,EAAe,WAAY,eAAeN,CAAG,EAAE,EAGtG,IAAMc,EAAe,MAAMT,EAAS,KAAK,EAErCG,EAAgC,CAAC,EACrC,GAAIM,EACA,GAAI,CACAN,EAAO,KAAK,MAAMM,CAAY,CAClC,OACOhB,EAAK,CAER,MADAK,EAAO,MAAM,8BAA+BL,CAAG,EAC3CO,EAAS,GAAUP,EACjB,IAAI,MAAM,GAAGO,EAAS,UAAU,KAAKA,EAAS,MAAM,GAAG,CACjE,CAGJ,GAAI,CAACA,EAAS,GAAI,CAEd,GADAF,EAAO,MAAM,qBAAsBK,CAAI,EACnCH,EAAS,QAAQ,IAAI,YAAY,EAAG,CACpC,IAAMU,EAAQV,EAAS,QAAQ,IAAI,YAAY,EAC/C,MAAM,IAAIW,EAAeD,EAAO,GAAG,KAAK,UAAUP,CAAI,CAAC,EAAE,CAC7D,CACA,MAAIA,EAAK,MACC,IAAIC,EAAcD,EAAME,CAAI,EAEhC,IAAI,MAAM,GAAGL,EAAS,UAAU,KAAKA,EAAS,MAAM,MAAM,KAAK,UAAUG,CAAI,CAAC,EAAE,CAC1F,CAEA,OAAOA,CACX,CAEQ,oBACJJ,EACI,CACJ,IAAMD,EAAS,KAAK,QAAQ,OAAO,oBAAoB,EACjDc,EAAa,OAAO,KAAK,KAAK,aAAa,EAC3CC,EAAmB,CACrB,SACA,cACJ,EACMC,EAAkB,CACpB,eACJ,EACIF,EAAW,SAAW,GAG1BA,EAAW,QAASG,GAAe,CAC/B,GAAIF,EAAiB,SAASE,EAAW,kBAAkB,CAAC,EAAG,CAC3DjB,EAAO,KAAK,oCAAqCiB,EAAYF,CAAgB,EAC7E,MACJ,CACA,GAAIC,EAAgB,SAASC,EAAW,kBAAkB,CAAC,GACvD,OAAO,KAAKhB,CAAO,EAAE,SAASgB,CAAU,EAAG,CAC3CjB,EAAO,KAAK,iCAAkCiB,EAAYD,CAAe,EACzE,MACJ,CACA,IAAME,EAAW,OAAO,KAAK,cAAcD,CAAU,GAAM,WACtD,KAAK,cAAcA,CAAU,EAAiB,EAC/C,KAAK,cAAcA,CAAU,EAC7BC,GAAWA,IAAY,KACvBjB,EAAQgB,CAAU,EAAIC,EAE9B,CAAC,CACL,CACJ,ECzNO,IAAMC,GAAN,KAAsB,CAUlB,YAA6BC,EAAoC,CAApC,eAAAA,EATpC,KAAiB,QAAU,IAAIC,EAAO,iBAAiB,EAKvD,KAAQ,aAAoC,KAC5C,KAAQ,UAA0C,KAI9C,KAAK,aAAe,KAAK,UAAU,YACnC,KAAK,aAAe,IAAIC,EACpB,CAAC,0BAA0B,EAC3B,KACA,KAAK,UAAU,YACnB,EACI,KAAK,UAAU,cACf,KAAK,QAAQ,MAAM,iCAAiC,EACpD,KAAK,aAAe,KAAK,UAAU,aAGnC,KAAK,UAAU,WACf,KAAK,QAAQ,MAAM,8BAA8B,EACjD,KAAK,UAAY,KAAK,UAAU,UAGhC,KAAK,UAAU,0BACf,KAAK,QAAQ,MAAM,6CAA6C,EAChE,KAAK,yBAA2B,KAAK,UAAU,wBAEvD,CAEO,kBAAyB,CAC5B,KAAK,aAAe,IACxB,CAEA,MAAa,aAA8C,CACvD,IAAMC,EAAS,KAAK,QAAQ,OAAO,aAAa,EAChD,GAAI,KAAK,UACL,OAAAA,EAAO,MAAM,qBAAqB,EAC3B,KAAK,UAGhB,GAAI,CAAC,KAAK,aACN,MAAAA,EAAO,MAAM,IAAI,MAAM,oDAAoD,CAAC,EAEtE,KAGVA,EAAO,MAAM,wBAAyB,KAAK,YAAY,EACvD,IAAMC,EAAW,MAAM,KAAK,aAAa,QAAQ,KAAK,aAAc,CAAE,YAAa,KAAK,yBAA0B,iBAAkB,KAAK,UAAU,uBAAwB,CAAC,EAE5K,OAAAD,EAAO,MAAM,wCAAwC,EACrD,KAAK,UAAY,OAAO,OAAO,CAAC,EAAGC,EAAU,KAAK,UAAU,YAAY,EACjE,KAAK,SAChB,CAEO,WAA6B,CAChC,OAAO,KAAK,qBAAqB,QAAQ,CAC7C,CAEO,0BAA4C,CAC/C,OAAO,KAAK,qBAAqB,wBAAwB,CAC7D,CAEO,qBAAuC,CAC1C,OAAO,KAAK,qBAAqB,mBAAmB,CACxD,CAIO,iBAAiBC,EAAW,GAAmC,CAClE,OAAO,KAAK,qBAAqB,iBAAkBA,CAAQ,CAC/D,CAEO,uBAAqD,CACxD,OAAO,KAAK,qBAAqB,uBAAwB,EAAI,CACjE,CAEO,uBAAqD,CACxD,OAAO,KAAK,qBAAqB,uBAAwB,EAAI,CACjE,CAIO,sBAAsBA,EAAW,GAAmC,CACvE,OAAO,KAAK,qBAAqB,sBAAuBA,CAAQ,CACpE,CAIO,gBAAgBA,EAAW,GAAmC,CACjE,OAAO,KAAK,qBAAqB,WAAYA,CAAQ,CACzD,CAEA,MAAgB,qBAAqBC,EAA0BD,EAAS,GAAyD,CAC7H,IAAMF,EAAS,KAAK,QAAQ,OAAO,yBAAyBG,CAAI,IAAI,EAE9DF,EAAW,MAAM,KAAK,YAAY,EAGxC,GAFAD,EAAO,MAAM,UAAU,EAEnBC,EAASE,CAAI,IAAM,OAAW,CAC9B,GAAID,IAAa,GAAM,CACnBF,EAAO,KAAK,6CAA6C,EACzD,MACJ,CAEAA,EAAO,MAAM,IAAI,MAAM,sCAAwCG,CAAI,CAAC,CACxE,CAEA,OAAOF,EAASE,CAAI,CACxB,CAEA,MAAa,gBAA+C,CACxD,IAAMH,EAAS,KAAK,QAAQ,OAAO,gBAAgB,EACnD,GAAI,KAAK,aACL,OAAAA,EAAO,MAAM,kCAAkC,EACxC,KAAK,aAGhB,IAAMI,EAAW,MAAM,KAAK,gBAAgB,EAAK,EACjDJ,EAAO,MAAM,eAAgBI,CAAQ,EAErC,IAAMC,EAAS,MAAM,KAAK,aAAa,QAAQD,EAAU,CAAE,iBAAkB,KAAK,UAAU,uBAAwB,CAAC,EAGrH,GAFAJ,EAAO,MAAM,cAAeK,CAAM,EAE9B,CAAC,MAAM,QAAQA,EAAO,IAAI,EAC1B,MAAAL,EAAO,MAAM,IAAI,MAAM,wBAAwB,CAAC,EAE1C,KAGV,YAAK,aAAeK,EAAO,KACpB,KAAK,YAChB,CACJ,EC1IO,IAAMC,EAAN,KAAiD,CAM7C,YAAY,CACf,OAAAC,EAAS,QACT,MAAAC,EAAQ,YACZ,EAAyD,CAAC,EAAG,CAR7D,KAAiB,QAAU,IAAIC,EAAO,sBAAsB,EASxD,KAAK,OAASD,EACd,KAAK,QAAUD,CACnB,CAEA,MAAa,IAAIG,EAAaC,EAA8B,CACxD,KAAK,QAAQ,OAAO,QAAQD,CAAG,IAAI,EAEnCA,EAAM,KAAK,QAAUA,EACrB,MAAM,KAAK,OAAO,QAAQA,EAAKC,CAAK,CACxC,CAEA,MAAa,IAAID,EAAqC,CAClD,YAAK,QAAQ,OAAO,QAAQA,CAAG,IAAI,EAEnCA,EAAM,KAAK,QAAUA,EACR,MAAM,KAAK,OAAO,QAAQA,CAAG,CAE9C,CAEA,MAAa,OAAOA,EAAqC,CACrD,KAAK,QAAQ,OAAO,WAAWA,CAAG,IAAI,EAEtCA,EAAM,KAAK,QAAUA,EACrB,IAAME,EAAO,MAAM,KAAK,OAAO,QAAQF,CAAG,EAC1C,aAAM,KAAK,OAAO,WAAWA,CAAG,EACzBE,CACX,CAEA,MAAa,YAAgC,CACzC,KAAK,QAAQ,OAAO,YAAY,EAChC,IAAMC,EAAM,MAAM,KAAK,OAAO,OAExBC,EAAO,CAAC,EACd,QAASC,EAAQ,EAAGA,EAAQF,EAAKE,IAAS,CACtC,IAAML,EAAM,MAAM,KAAK,OAAO,IAAIK,CAAK,EACnCL,GAAOA,EAAI,QAAQ,KAAK,OAAO,IAAM,GACrCI,EAAK,KAAKJ,EAAI,OAAO,KAAK,QAAQ,MAAM,CAAC,CAEjD,CACA,OAAOI,CACX,CACJ,ECpDA,IAAME,GAAsB,OACtBC,GAAe,SACfC,GAA8B,qBAC9BC,GAAgC,IAwKzBC,EAAN,KAA8B,CAgD1B,YAAY,CAEf,UAAAC,EAAW,YAAAC,EAAa,SAAAC,EAAU,YAAAC,EAAa,aAAAC,EAE/C,UAAAC,EAAW,cAAAC,EAAe,cAAAC,EAAgBZ,GAAqB,MAAAa,EAAQZ,GACvE,aAAAa,EAAc,yBAAAC,EACd,sBAAAC,EAAwBd,GACxB,gCAAAe,EAAkC,QAElC,OAAAC,EAAQ,QAAAC,EAAS,QAAAC,EAAS,WAAAC,EAAY,WAAAC,EAAY,SAAAC,EAAU,cAAAC,EAE5D,qBAAAC,EAAuB,GACvB,aAAAC,EAAe,GACf,wBAAAC,EACA,uBAAAC,EAAyBzB,GACzB,oBAAA0B,EAAsB,CAAE,MAAO,SAAU,EACzC,YAAAC,EAAc,GAEd,WAAAC,EACA,kCAAAC,GACA,wBAAAC,GACA,yBAAAC,GAEA,iBAAAC,GAAmB,CAAC,EACpB,iBAAAC,GAAmB,CAAC,EACpB,aAAAC,GAAe,CAAC,EAChB,KAAAC,GACA,wBAAAC,GAA0B,EAC9B,EAAuB,CAhQ3B,IAAAC,GAgTQ,GA9CA,KAAK,UAAYnC,EAEbC,EACA,KAAK,YAAcA,GAEnB,KAAK,YAAcD,EACfA,IACK,KAAK,YAAY,SAAS,GAAG,IAC9B,KAAK,aAAe,KAExB,KAAK,aAAe,qCAI5B,KAAK,SAAWE,EAChB,KAAK,aAAeE,EACpB,KAAK,YAAcD,EAEnB,KAAK,UAAYE,EACjB,KAAK,cAAgBC,EACrB,KAAK,cAAgBC,EACrB,KAAK,MAAQC,EACb,KAAK,aAAeC,EACpB,KAAK,yBAA2BC,EAChC,KAAK,sBAAwBC,EAC7B,KAAK,gCAAkCC,EAEvC,KAAK,OAASC,EACd,KAAK,QAAUC,EACf,KAAK,QAAUC,EACf,KAAK,WAAaC,EAClB,KAAK,WAAaC,EAClB,KAAK,SAAWC,EAChB,KAAK,cAAgBC,EAErB,KAAK,qBAAuBC,GAAA,KAAAA,EAAwB,GACpD,KAAK,aAAe,CAAC,CAACC,EACtB,KAAK,uBAAyBE,EAC9B,KAAK,oBAAsBC,EAC3B,KAAK,wBAA0BU,GAC/B,KAAK,YAAc,CAAC,CAACT,EACrB,KAAK,kCAAoCE,GAEzC,KAAK,wBAA0BC,IAAoD,cACnF,KAAK,wBAA0BN,EAE3BI,EACA,KAAK,WAAaA,MAEjB,CACD,IAAMU,GAAQ,OAAO,QAAW,YAAc,OAAO,aAAe,IAAIC,EACxE,KAAK,WAAa,IAAIC,EAAqB,CAAE,MAAAF,EAAM,CAAC,CACxD,CASA,GAPA,KAAK,yBAA2BP,GAEhC,KAAK,iBAAmBC,GACxB,KAAK,iBAAmBC,GACxB,KAAK,aAAeC,GAEpB,KAAK,KAAOC,GACR,KAAK,MAAQ,GAACE,GAAA,KAAK,OAAL,MAAAA,GAAW,OACzB,MAAM,IAAI,MAAM,8CAA8C,CAEtE,CACJ,ECvTO,IAAMI,GAAN,KAAsB,CAIlB,YAA6BC,EACfC,EACnB,CAFkC,eAAAD,EACf,sBAAAC,EAJrB,KAAmB,QAAU,IAAIC,EAAO,iBAAiB,EAgCzD,KAAU,kBAAoB,MAAOC,GAA6C,CAC9E,IAAMC,EAAS,KAAK,QAAQ,OAAO,mBAAmB,EACtD,GAAI,CACA,IAAMC,EAAUC,EAAS,OAAOH,CAAY,EAC5C,OAAAC,EAAO,MAAM,yBAAyB,EAE/BC,CACX,OAASE,EAAK,CACV,MAAAH,EAAO,MAAM,4BAA4B,EACnCG,CACV,CACJ,EArCI,KAAK,aAAe,IAAIC,EACpB,OACA,KAAK,kBACL,KAAK,UAAU,YACnB,CACJ,CAEA,MAAa,UAAUC,EAAmC,CACtD,IAAML,EAAS,KAAK,QAAQ,OAAO,WAAW,EACzCK,GACD,KAAK,QAAQ,MAAM,IAAI,MAAM,iBAAiB,CAAC,EAGnD,IAAMC,EAAM,MAAM,KAAK,iBAAiB,oBAAoB,EAC5DN,EAAO,MAAM,mBAAoBM,CAAG,EAEpC,IAAMC,EAAS,MAAM,KAAK,aAAa,QAAQD,EAAK,CAChD,MAAAD,EACA,YAAa,KAAK,UAAU,wBAC5B,iBAAkB,KAAK,UAAU,uBACrC,CAAC,EACD,OAAAL,EAAO,MAAM,aAAcO,CAAM,EAE1BA,CACX,CAcJ,ECSO,IAAMC,GAAN,KAAkB,CAId,YACcC,EACAC,EACnB,CAFmB,eAAAD,EACA,sBAAAC,EALrB,KAAiB,QAAU,IAAIC,EAAO,aAAa,EAO/C,KAAK,aAAe,IAAIC,EACpB,KAAK,UAAU,kCACf,KACA,KAAK,UAAU,YACnB,CACJ,CAOA,MAAa,aAAa,CACtB,WAAAC,EAAa,qBACb,aAAAC,EAAe,KAAK,UAAU,aAC9B,UAAAC,EAAY,KAAK,UAAU,UAC3B,cAAAC,EAAgB,KAAK,UAAU,cAC/B,aAAAC,EACA,GAAGC,CACP,EAAuD,CACnD,IAAMC,EAAS,KAAK,QAAQ,OAAO,cAAc,EAC5CJ,GACDI,EAAO,MAAM,IAAI,MAAM,yBAAyB,CAAC,EAEhDL,GACDK,EAAO,MAAM,IAAI,MAAM,4BAA4B,CAAC,EAEnDD,EAAK,MACNC,EAAO,MAAM,IAAI,MAAM,oBAAoB,CAAC,EAGhD,IAAMC,EAAS,IAAI,gBAAgB,CAAE,WAAAP,EAAY,aAAAC,CAAa,CAAC,EAC/D,OAAW,CAACO,EAAKC,CAAK,IAAK,OAAO,QAAQJ,CAAI,EACtCI,GAAS,MACTF,EAAO,IAAIC,EAAKC,CAAK,EAK7B,IAAK,KAAK,UAAU,wBAA0B,uBACzC,KAAK,UAAU,wBAA0B,sBACVN,GAAkB,KAClD,MAAAG,EAAO,MAAM,IAAI,MAAM,6BAA6B,CAAC,EAE/C,KAGV,IAAII,EACEC,EAAM,MAAM,KAAK,iBAAiB,iBAAiB,EAAK,EAC9D,OAAQ,KAAK,UAAU,sBAAuB,CAC1C,IAAK,sBACDD,EAAYE,EAAY,kBAAkBV,EAAWC,CAAc,EACnE,MACJ,IAAK,qBACDI,EAAO,OAAO,YAAaL,CAAS,EAChCC,GACAI,EAAO,OAAO,gBAAiBJ,CAAa,EAEhD,MACJ,IAAK,oBAAqB,CACtB,IAAMU,EAAkB,MAAMD,EAAY,2BAA2BV,EAAWC,EAAgBQ,EAAK,KAAK,UAAU,+BAA+B,EACnJJ,EAAO,OAAO,YAAaL,CAAS,EACpCK,EAAO,OAAO,wBAAyB,wDAAwD,EAC/FA,EAAO,OAAO,mBAAoBM,CAAe,EACjD,KACJ,CACJ,CACAP,EAAO,MAAM,oBAAoB,EAEjC,IAAMQ,EAAW,MAAM,KAAK,aAAa,SAASH,EAAK,CACnD,KAAMJ,EACN,UAAAG,EACA,iBAAkB,KAAK,UAAU,wBACjC,gBAAiB,KAAK,UAAU,wBAChC,aAAAN,CACJ,CAAC,EAED,OAAAE,EAAO,MAAM,cAAc,EAEpBQ,CACX,CAOA,MAAa,oBAAoB,CAC7B,WAAAd,EAAa,WACb,UAAAE,EAAY,KAAK,UAAU,UAC3B,cAAAC,EAAgB,KAAK,UAAU,cAC/B,MAAAY,EAAQ,KAAK,UAAU,MACvB,GAAGV,CACP,EAA8D,CAC1D,IAAMC,EAAS,KAAK,QAAQ,OAAO,qBAAqB,EAEnDJ,GACDI,EAAO,MAAM,IAAI,MAAM,yBAAyB,CAAC,EAGrD,IAAMC,EAAS,IAAI,gBAAgB,CAAE,WAAAP,CAAW,CAAC,EAC5C,KAAK,UAAU,yBAChBO,EAAO,IAAI,QAASQ,CAAK,EAE7B,OAAW,CAACP,EAAKC,CAAK,IAAK,OAAO,QAAQJ,CAAI,EACtCI,GAAS,MACTF,EAAO,IAAIC,EAAKC,CAAK,EAK7B,IAAK,KAAK,UAAU,wBAA0B,uBACzC,KAAK,UAAU,wBAA0B,sBACVN,GAAkB,KAClD,MAAAG,EAAO,MAAM,IAAI,MAAM,6BAA6B,CAAC,EAE/C,KAGV,IAAII,EACEC,EAAM,MAAM,KAAK,iBAAiB,iBAAiB,EAAK,EAC9D,OAAQ,KAAK,UAAU,sBAAuB,CAC1C,IAAK,sBACDD,EAAYE,EAAY,kBAAkBV,EAAWC,CAAc,EACnE,MACJ,IAAK,qBACDI,EAAO,OAAO,YAAaL,CAAS,EAChCC,GACAI,EAAO,OAAO,gBAAiBJ,CAAa,EAEhD,MACJ,IAAK,oBAAqB,CACtB,IAAMU,EAAkB,MAAMD,EAAY,2BAA2BV,EAAWC,EAAgBQ,EAAK,KAAK,UAAU,+BAA+B,EACnJJ,EAAO,OAAO,YAAaL,CAAS,EACpCK,EAAO,OAAO,wBAAyB,wDAAwD,EAC/FA,EAAO,OAAO,mBAAoBM,CAAe,EACjD,KACJ,CACJ,CACAP,EAAO,MAAM,oBAAoB,EAEjC,IAAMQ,EAAW,MAAM,KAAK,aAAa,SAASH,EAAK,CAAE,KAAMJ,EAAQ,UAAAG,EAAW,iBAAkB,KAAK,UAAU,wBAAyB,gBAAiB,KAAK,UAAU,uBAAwB,CAAC,EACrM,OAAAJ,EAAO,MAAM,cAAc,EAEpBQ,CACX,CAOA,MAAa,qBAAqB,CAC9B,WAAAd,EAAa,gBACb,UAAAE,EAAY,KAAK,UAAU,UAC3B,cAAAC,EAAgB,KAAK,UAAU,cAC/B,iBAAAa,EACA,aAAAZ,EACA,GAAGC,CACP,EAA+D,CAC3D,IAAMC,EAAS,KAAK,QAAQ,OAAO,sBAAsB,EACpDJ,GACDI,EAAO,MAAM,IAAI,MAAM,yBAAyB,CAAC,EAEhDD,EAAK,eACNC,EAAO,MAAM,IAAI,MAAM,6BAA6B,CAAC,EAGzD,IAAMC,EAAS,IAAI,gBAAgB,CAAE,WAAAP,CAAW,CAAC,EACjD,OAAW,CAACQ,EAAKC,CAAK,IAAK,OAAO,QAAQJ,CAAI,EACtC,MAAM,QAAQI,CAAK,EACnBA,EAAM,QAAQQ,GAASV,EAAO,OAAOC,EAAKS,CAAK,CAAC,EAE3CR,GAAS,MACdF,EAAO,IAAIC,EAAKC,CAAK,EAK7B,IAAK,KAAK,UAAU,wBAA0B,uBACzC,KAAK,UAAU,wBAA0B,sBACVN,GAAkB,KAClD,MAAAG,EAAO,MAAM,IAAI,MAAM,6BAA6B,CAAC,EAE/C,KAGV,IAAII,EACEC,EAAM,MAAM,KAAK,iBAAiB,iBAAiB,EAAK,EAC9D,OAAQ,KAAK,UAAU,sBAAuB,CAC1C,IAAK,sBACDD,EAAYE,EAAY,kBAAkBV,EAAWC,CAAc,EACnE,MACJ,IAAK,qBACDI,EAAO,OAAO,YAAaL,CAAS,EAChCC,GACAI,EAAO,OAAO,gBAAiBJ,CAAa,EAEhD,MACJ,IAAK,oBAAqB,CACtB,IAAMU,EAAkB,MAAMD,EAAY,2BAA2BV,EAAWC,EAAgBQ,EAAK,KAAK,UAAU,+BAA+B,EACnJJ,EAAO,OAAO,YAAaL,CAAS,EACpCK,EAAO,OAAO,wBAAyB,wDAAwD,EAC/FA,EAAO,OAAO,mBAAoBM,CAAe,EACjD,KACJ,CACJ,CACAP,EAAO,MAAM,oBAAoB,EAEjC,IAAMQ,EAAW,MAAM,KAAK,aAAa,SAASH,EAAK,CAAE,KAAMJ,EAAQ,UAAAG,EAAW,iBAAAM,EAAkB,gBAAiB,KAAK,UAAU,wBAAyB,aAAAZ,CAAa,CAAC,EAC3K,OAAAE,EAAO,MAAM,cAAc,EAEpBQ,CACX,CAOA,MAAa,OAAOT,EAAiC,CAtSzD,IAAAa,EAuSQ,IAAMZ,EAAS,KAAK,QAAQ,OAAO,QAAQ,EACtCD,EAAK,OACNC,EAAO,MAAM,IAAI,MAAM,qBAAqB,CAAC,EAGjD,IAAMK,EAAM,MAAM,KAAK,iBAAiB,sBAAsB,EAAK,EAEnEL,EAAO,MAAM,sCAAqCY,EAAAb,EAAK,kBAAL,KAAAa,EAAwB,oBAAoB,EAAE,EAEhG,IAAMX,EAAS,IAAI,gBACnB,OAAW,CAACC,EAAKC,CAAK,IAAK,OAAO,QAAQJ,CAAI,EACtCI,GAAS,MACTF,EAAO,IAAIC,EAAKC,CAAK,EAG7BF,EAAO,IAAI,YAAa,KAAK,UAAU,SAAS,EAC5C,KAAK,UAAU,eACfA,EAAO,IAAI,gBAAiB,KAAK,UAAU,aAAa,EAG5D,MAAM,KAAK,aAAa,SAASI,EAAK,CAAE,KAAMJ,EAAQ,iBAAkB,KAAK,UAAU,uBAAwB,CAAC,EAChHD,EAAO,MAAM,cAAc,CAC/B,CACJ,ECzSO,IAAMa,GAAN,KAAwB,CAKpB,YACgBC,EACAC,EACAC,EACrB,CAHqB,eAAAF,EACA,sBAAAC,EACA,oBAAAC,EAPvB,KAAmB,QAAU,IAAIC,EAAO,mBAAmB,EASvD,KAAK,iBAAmB,IAAIC,GAAgB,KAAK,UAAW,KAAK,gBAAgB,EACjF,KAAK,aAAe,IAAIC,GAAY,KAAK,UAAW,KAAK,gBAAgB,CAC7E,CAEA,MAAa,uBAAuBC,EAA0BC,EAAoBC,EAA2D,CACzI,IAAMC,EAAS,KAAK,QAAQ,OAAO,wBAAwB,EAE3D,KAAK,oBAAoBH,EAAUC,CAAK,EACxCE,EAAO,MAAM,iBAAiB,EAE9B,MAAM,KAAK,aAAaH,EAAUC,EAAOC,CAAY,EACrDC,EAAO,MAAM,gBAAgB,EAEzBH,EAAS,UACT,KAAK,2BAA2BA,EAAU,GAAIC,EAAM,KAAK,EAE7DE,EAAO,MAAM,kBAAkB,EAE/B,MAAM,KAAK,eAAeH,EAAUC,GAAA,YAAAA,EAAO,aAAcD,EAAS,QAAQ,EAC1EG,EAAO,MAAM,kBAAkB,CACnC,CAEA,MAAa,4BAA4BH,EAA0BI,EAAsC,CACrG,IAAMD,EAAS,KAAK,QAAQ,OAAO,6BAA6B,EAC1DE,EAAyBL,EAAS,UAAY,CAAC,CAACA,EAAS,SAE3DK,GACA,KAAK,2BAA2BL,CAAQ,EAE5CG,EAAO,MAAM,kBAAkB,EAE/B,MAAM,KAAK,eAAeH,EAAUI,EAAcC,CAAsB,EACxEF,EAAO,MAAM,kBAAkB,CACnC,CAEA,MAAa,wBAAwBH,EAA0BC,EAAoC,CAlEvG,IAAAK,EAAAC,EAmEQ,IAAMJ,EAAS,KAAK,QAAQ,OAAO,yBAAyB,EAE5DH,EAAS,UAAYC,EAAM,MAE3BK,EAAAN,EAAS,gBAAT,OAAAA,EAAS,cAAkBC,EAAM,gBAEjCM,EAAAP,EAAS,QAAT,OAAAA,EAAS,MAAUC,EAAM,OAIrBD,EAAS,UAAcA,EAAS,WAChC,KAAK,2BAA2BA,EAAUC,EAAM,QAAQ,EACxDE,EAAO,MAAM,oBAAoB,GAGhCH,EAAS,WAEVA,EAAS,SAAWC,EAAM,SAE1BD,EAAS,QAAUC,EAAM,SAG7B,IAAMO,EAAaR,EAAS,UAAY,CAAC,CAACA,EAAS,SACnD,MAAM,KAAK,eAAeA,EAAU,GAAOQ,CAAU,EACrDL,EAAO,MAAM,kBAAkB,CACnC,CAEO,wBAAwBH,EAA2BC,EAAoB,CAC1E,IAAME,EAAS,KAAK,QAAQ,OAAO,yBAAyB,EAW5D,GAVIF,EAAM,KAAOD,EAAS,OACtBG,EAAO,MAAM,IAAI,MAAM,sBAAsB,CAAC,EAMlDA,EAAO,MAAM,iBAAiB,EAC9BH,EAAS,UAAYC,EAAM,KAEvBD,EAAS,MACT,MAAAG,EAAO,KAAK,qBAAsBH,EAAS,KAAK,EAC1C,IAAIS,EAAcT,CAAQ,CAExC,CAEU,oBAAoBA,EAA0BC,EAA0B,CAhHtF,IAAAK,EAiHQ,IAAMH,EAAS,KAAK,QAAQ,OAAO,qBAAqB,EA8BxD,GA7BIF,EAAM,KAAOD,EAAS,OACtBG,EAAO,MAAM,IAAI,MAAM,sBAAsB,CAAC,EAG7CF,EAAM,WACPE,EAAO,MAAM,IAAI,MAAM,uBAAuB,CAAC,EAG9CF,EAAM,WACPE,EAAO,MAAM,IAAI,MAAM,uBAAuB,CAAC,EAI/C,KAAK,UAAU,YAAcF,EAAM,WACnCE,EAAO,MAAM,IAAI,MAAM,iDAAiD,CAAC,EAEzE,KAAK,UAAU,WAAa,KAAK,UAAU,YAAcF,EAAM,WAC/DE,EAAO,MAAM,IAAI,MAAM,iDAAiD,CAAC,EAM7EA,EAAO,MAAM,iBAAiB,EAC9BH,EAAS,UAAYC,EAAM,KAC3BD,EAAS,UAAYC,EAAM,WAE3BK,EAAAN,EAAS,QAAT,OAAAA,EAAS,MAAUC,EAAM,OAErBD,EAAS,MACT,MAAAG,EAAO,KAAK,qBAAsBH,EAAS,KAAK,EAC1C,IAAIS,EAAcT,CAAQ,EAGhCC,EAAM,eAAiB,CAACD,EAAS,MACjCG,EAAO,MAAM,IAAI,MAAM,2BAA2B,CAAC,CAG3D,CAEA,MAAgB,eAAeH,EAA0BI,EAAe,GAAOM,EAAc,GAAqB,CAC9G,IAAMP,EAAS,KAAK,QAAQ,OAAO,gBAAgB,EAGnD,GAFAH,EAAS,QAAU,KAAK,eAAe,qBAAqBA,EAAS,OAAO,EAExEI,GAAgB,CAAC,KAAK,UAAU,cAAgB,CAACJ,EAAS,aAAc,CACxEG,EAAO,MAAM,uBAAuB,EACpC,MACJ,CAEAA,EAAO,MAAM,mBAAmB,EAChC,IAAMQ,EAAS,MAAM,KAAK,iBAAiB,UAAUX,EAAS,YAAY,EAC1EG,EAAO,MAAM,mDAAmD,EAE5DO,GAAeC,EAAO,MAAQX,EAAS,QAAQ,KAC/CG,EAAO,MAAM,IAAI,MAAM,mEAAmE,CAAC,EAG/FH,EAAS,QAAU,KAAK,eAAe,YAAYA,EAAS,QAAS,KAAK,eAAe,qBAAqBW,CAAuB,CAAC,EACtIR,EAAO,MAAM,8CAA+CH,EAAS,OAAO,CAChF,CAEA,MAAgB,aAAaA,EAA0BC,EAAoBC,EAA2D,CAClI,IAAMC,EAAS,KAAK,QAAQ,OAAO,cAAc,EACjD,GAAIH,EAAS,KAAM,CACfG,EAAO,MAAM,iBAAiB,EAC9B,IAAMS,EAAgB,MAAM,KAAK,aAAa,aAAa,CACvD,UAAWX,EAAM,UACjB,cAAeA,EAAM,cACrB,KAAMD,EAAS,KACf,aAAcC,EAAM,aACpB,cAAeA,EAAM,cACrB,aAAcC,EACd,GAAGD,EAAM,gBACb,CAAC,EACD,OAAO,OAAOD,EAAUY,CAAa,CACzC,MACIT,EAAO,MAAM,oBAAoB,CAEzC,CAEU,2BAA2BH,EAA0Ba,EAAwBC,EAAsB,CAlMjH,IAAAR,EAmMQ,IAAMH,EAAS,KAAK,QAAQ,OAAO,4BAA4B,EAE/DA,EAAO,MAAM,uBAAuB,EACpC,IAAMY,EAAWC,EAAS,QAAOV,EAAAN,EAAS,WAAT,KAAAM,EAAqB,EAAE,EAUxD,GARKS,EAAS,KACVZ,EAAO,MAAM,IAAI,MAAM,qCAAqC,CAAC,EAG7DW,GAASC,EAAS,QAAUD,GAC5BX,EAAO,MAAM,IAAI,MAAM,0DAA0D,CAAC,EAGlFU,EAAe,CACf,IAAMI,EAAWD,EAAS,OAAOH,CAAa,EAC1CE,EAAS,MAAQE,EAAS,KAC1Bd,EAAO,MAAM,IAAI,MAAM,4CAA4C,CAAC,EAEpEY,EAAS,WAAaA,EAAS,YAAcE,EAAS,WACtDd,EAAO,MAAM,IAAI,MAAM,yDAAyD,CAAC,EAEjFY,EAAS,KAAOA,EAAS,MAAQE,EAAS,KAC1Cd,EAAO,MAAM,IAAI,MAAM,6CAA6C,CAAC,EAErE,CAACY,EAAS,KAAOE,EAAS,KAC1Bd,EAAO,MAAM,IAAI,MAAM,uDAAuD,CAAC,CAEvF,CAEAH,EAAS,QAAUe,CACvB,CACJ,ECzNO,IAAMG,EAAN,MAAMC,CAAM,CASR,YAAYC,EAMhB,CACC,KAAK,GAAKA,EAAK,IAAMC,EAAY,eAAe,EAChD,KAAK,KAAOD,EAAK,KAEbA,EAAK,SAAWA,EAAK,QAAU,EAC/B,KAAK,QAAUA,EAAK,QAGpB,KAAK,QAAUE,EAAM,aAAa,EAEtC,KAAK,aAAeF,EAAK,aACzB,KAAK,UAAYA,EAAK,SAC1B,CAEO,iBAA0B,CAC7B,WAAIG,EAAO,OAAO,EAAE,OAAO,iBAAiB,EACrC,KAAK,UAAU,CAClB,GAAI,KAAK,GACT,KAAM,KAAK,KACX,QAAS,KAAK,QACd,aAAc,KAAK,aACnB,UAAW,KAAK,SACpB,CAAC,CACL,CAEA,OAAc,kBAAkBC,EAAuC,CACnE,OAAAD,EAAO,aAAa,QAAS,mBAAmB,EACzC,QAAQ,QAAQ,IAAIJ,EAAM,KAAK,MAAMK,CAAa,CAAC,CAAC,CAC/D,CAEA,aAAoB,gBAAgBC,EAAqBC,EAA4B,CACjF,IAAMC,EAASJ,EAAO,aAAa,QAAS,iBAAiB,EACvDK,EAASN,EAAM,aAAa,EAAII,EAEhCG,EAAO,MAAMJ,EAAQ,WAAW,EACtCE,EAAO,MAAM,WAAYE,CAAI,EAE7B,QAASC,EAAI,EAAGA,EAAID,EAAK,OAAQC,IAAK,CAClC,IAAMC,EAAMF,EAAKC,CAAC,EACZE,EAAO,MAAMP,EAAQ,IAAIM,CAAG,EAC9BE,EAAS,GAEb,GAAID,EACA,GAAI,CACA,IAAME,EAAQ,MAAMf,EAAM,kBAAkBa,CAAI,EAEhDL,EAAO,MAAM,qBAAsBI,EAAKG,EAAM,OAAO,EACjDA,EAAM,SAAWN,IACjBK,EAAS,GAEjB,OACOE,EAAK,CACRR,EAAO,MAAM,+BAAgCI,EAAKI,CAAG,EACrDF,EAAS,EACb,MAGAN,EAAO,MAAM,8BAA+BI,CAAG,EAC/CE,EAAS,GAGTA,IACAN,EAAO,MAAM,wBAAyBI,CAAG,EACpCN,EAAQ,OAAOM,CAAG,EAE/B,CACJ,CACJ,ECxDO,IAAMK,EAAN,MAAMC,UAAoBC,CAAM,CA2B3B,YAAYC,EAAuB,CACvC,MAAMA,CAAI,EAEV,KAAK,cAAgBA,EAAK,cAC1B,KAAK,eAAiBA,EAAK,eAC3B,KAAK,UAAYA,EAAK,UACtB,KAAK,UAAYA,EAAK,UACtB,KAAK,aAAeA,EAAK,aACzB,KAAK,MAAQA,EAAK,MAClB,KAAK,cAAgBA,EAAK,cAC1B,KAAK,iBAAmBA,EAAK,iBAE7B,KAAK,cAAgBA,EAAK,cAC1B,KAAK,aAAeA,EAAK,aACzB,KAAK,MAAQA,EAAK,KACtB,CAEA,aAAoB,OAAOA,EAAmD,CAC1E,IAAMC,EAAgBD,EAAK,gBAAkB,GAAOE,EAAY,qBAAqB,EAAKF,EAAK,eAAiB,OAC1GG,EAAiBF,EAAiB,MAAMC,EAAY,sBAAsBD,CAAa,EAAK,OAElG,OAAO,IAAIH,EAAY,CACnB,GAAGE,EACH,cAAAC,EACA,eAAAE,CACJ,CAAC,CACL,CAEO,iBAA0B,CAC7B,WAAIC,EAAO,aAAa,EAAE,OAAO,iBAAiB,EAC3C,KAAK,UAAU,CAClB,GAAI,KAAK,GACT,KAAM,KAAK,KACX,QAAS,KAAK,QACd,aAAc,KAAK,aACnB,UAAW,KAAK,UAEhB,cAAe,KAAK,cACpB,UAAW,KAAK,UAChB,UAAW,KAAK,UAChB,aAAc,KAAK,aACnB,MAAO,KAAK,MACZ,cAAe,KAAK,cACpB,iBAAmB,KAAK,iBACxB,cAAe,KAAK,cACpB,aAAc,KAAK,aACnB,MAAO,KAAK,KAChB,CAAC,CACL,CAEA,OAAc,kBAAkBC,EAA6C,CACzED,EAAO,aAAa,cAAe,mBAAmB,EACtD,IAAME,EAAO,KAAK,MAAMD,CAAa,EACrC,OAAOP,EAAY,OAAOQ,CAAI,CAClC,CACJ,ECjEO,IAAMC,GAAN,MAAMA,EAAc,CAMf,YAAYC,EAGjB,CACC,KAAK,IAAMA,EAAK,IAChB,KAAK,MAAQA,EAAK,KACtB,CAEA,aAAoB,OAAO,CAEvB,IAAAC,EAAK,UAAAC,EAAW,UAAAC,EAAW,aAAAC,EAAc,cAAAC,EAAe,MAAAC,EAExD,WAAAC,EAAY,cAAAC,EAAe,aAAAC,EAAc,cAAAC,EAAe,MAAAC,EAAO,UAAAC,EAC/D,SAAAC,EACA,aAAAC,EACA,iBAAAC,EACA,iBAAAC,EACA,YAAAC,EACA,QAAAC,EACA,wBAAAC,EACA,GAAGC,CACP,EAAoD,CAChD,GAAI,CAACnB,EACD,WAAK,QAAQ,MAAM,uBAAuB,EACpC,IAAI,MAAM,KAAK,EAEzB,GAAI,CAACE,EACD,WAAK,QAAQ,MAAM,6BAA6B,EAC1C,IAAI,MAAM,WAAW,EAE/B,GAAI,CAACC,EACD,WAAK,QAAQ,MAAM,gCAAgC,EAC7C,IAAI,MAAM,cAAc,EAElC,GAAI,CAACC,EACD,WAAK,QAAQ,MAAM,iCAAiC,EAC9C,IAAI,MAAM,eAAe,EAEnC,GAAI,CAACC,EACD,WAAK,QAAQ,MAAM,yBAAyB,EACtC,IAAI,MAAM,OAAO,EAE3B,GAAI,CAACJ,EACD,WAAK,QAAQ,MAAM,6BAA6B,EAC1C,IAAI,MAAM,WAAW,EAG/B,IAAMmB,EAAQ,MAAMC,EAAY,OAAO,CACnC,KAAMf,EACN,aAAAE,EACA,UAAAG,EACA,cAAe,CAACK,EAChB,UAAAd,EAAW,UAAAD,EAAW,aAAAE,EACtB,cAAAI,EACA,cAAAE,EAAe,MAAAJ,EAAO,iBAAAU,EACtB,aAAAF,EACA,MAAAH,CACJ,CAAC,EAEKY,EAAY,IAAI,IAAItB,CAAG,EAC7BsB,EAAU,aAAa,OAAO,YAAapB,CAAS,EACpDoB,EAAU,aAAa,OAAO,eAAgBnB,CAAY,EAC1DmB,EAAU,aAAa,OAAO,gBAAiBlB,CAAa,EACvDc,GACDI,EAAU,aAAa,OAAO,QAASjB,CAAK,EAE5CK,GACAY,EAAU,aAAa,OAAO,QAASZ,CAAK,EAG5CO,GACAK,EAAU,aAAa,OAAO,WAAYL,CAAO,EAGrD,IAAIM,EAAaH,EAAM,GACnBT,IACAY,EAAa,GAAGA,CAAU,GAAGC,CAAmB,GAAGb,CAAS,IAEhEW,EAAU,aAAa,OAAO,QAASC,CAAU,EAC7CH,EAAM,iBACNE,EAAU,aAAa,OAAO,iBAAkBF,EAAM,cAAc,EACpEE,EAAU,aAAa,OAAO,wBAAyB,MAAM,GAG7DV,IAEkB,MAAM,QAAQA,CAAQ,EAAIA,EAAW,CAACA,CAAQ,GAE3D,QAAQa,GAAKH,EAAU,aAAa,OAAO,WAAYG,CAAC,CAAC,EAGlE,OAAW,CAACC,EAAKC,CAAK,IAAK,OAAO,QAAQ,CAAE,cAAApB,EAAe,GAAGY,EAAgB,GAAGL,CAAiB,CAAC,EAC3Fa,GAAS,MACTL,EAAU,aAAa,OAAOI,EAAKC,EAAM,SAAS,CAAC,EAI3D,OAAO,IAAI7B,GAAc,CACrB,IAAKwB,EAAU,KACf,MAAAF,CACJ,CAAC,CACL,CACJ,EA5GatB,GACe,QAAU,IAAI8B,EAAO,eAAe,EADzD,IAAMC,GAAN/B,GC9CP,IAAMgC,GAAY,SAOLC,EAAN,KAAqB,CAsCjB,YAAYC,EAAyB,CAjB5C,KAAO,aAAe,GAEtB,KAAO,WAAa,GAapB,KAAO,QAAuB,CAAC,EAK3B,GAFA,KAAK,MAAQA,EAAO,IAAI,OAAO,EAC/B,KAAK,cAAgBA,EAAO,IAAI,eAAe,EAC3C,KAAK,MAAO,CACZ,IAAMC,EAAa,mBAAmB,KAAK,KAAK,EAAE,MAAMC,CAAmB,EAC3E,KAAK,MAAQD,EAAW,CAAC,EACrBA,EAAW,OAAS,IACpB,KAAK,UAAYA,EAAW,MAAM,CAAC,EAAE,KAAKC,CAAmB,EAErE,CAEA,KAAK,MAAQF,EAAO,IAAI,OAAO,EAC/B,KAAK,kBAAoBA,EAAO,IAAI,mBAAmB,EACvD,KAAK,UAAYA,EAAO,IAAI,WAAW,EAEvC,KAAK,KAAOA,EAAO,IAAI,MAAM,CACjC,CAEA,IAAW,YAAiC,CACxC,GAAI,KAAK,aAAe,OAGxB,OAAO,KAAK,WAAaG,EAAM,aAAa,CAChD,CACA,IAAW,WAAWC,EAA2B,CAEzC,OAAOA,GAAU,WAAUA,EAAQ,OAAOA,CAAK,GAC/CA,IAAU,QAAaA,GAAS,IAChC,KAAK,WAAa,KAAK,MAAMA,CAAK,EAAID,EAAM,aAAa,EAEjE,CAEA,IAAW,UAAoB,CAnFnC,IAAAE,EAoFQ,QAAOA,EAAA,KAAK,QAAL,YAAAA,EAAY,MAAM,KAAK,SAASP,MAAc,CAAC,CAAC,KAAK,QAChE,CACJ,ECxDO,IAAMQ,GAAN,KAAqB,CAMjB,YAAY,CACf,IAAAC,EACA,WAAAC,EAAY,cAAAC,EAAe,yBAAAC,EAA0B,iBAAAC,EAAkB,aAAAC,EAAc,UAAAC,EAAW,UAAAC,CACpG,EAAuB,CARvB,KAAiB,QAAU,IAAIC,EAAO,gBAAgB,EASlD,GAAI,CAACR,EACD,WAAK,QAAQ,MAAM,qBAAqB,EAClC,IAAI,MAAM,KAAK,EAGzB,IAAMS,EAAY,IAAI,IAAIT,CAAG,EAQ7B,GAPIE,GACAO,EAAU,aAAa,OAAO,gBAAiBP,CAAa,EAE5DI,GACAG,EAAU,aAAa,OAAO,YAAaH,CAAS,EAGpDH,IACAM,EAAU,aAAa,OAAO,2BAA4BN,CAAwB,EAG9EF,GAAcM,GAAW,CACzB,KAAK,MAAQ,IAAIG,EAAM,CAAE,KAAMT,EAAY,aAAAI,EAAc,UAAAE,CAAU,CAAC,EAEpE,IAAII,EAAa,KAAK,MAAM,GACxBJ,IACAI,EAAa,GAAGA,CAAU,GAAGC,CAAmB,GAAGL,CAAS,IAEhEE,EAAU,aAAa,OAAO,QAASE,CAAU,CACrD,CAGJ,OAAW,CAACE,EAAKC,CAAK,IAAK,OAAO,QAAQ,CAAE,GAAGV,CAAiB,CAAC,EACzDU,GAAS,MACTL,EAAU,aAAa,OAAOI,EAAKC,EAAM,SAAS,CAAC,EAI3D,KAAK,IAAML,EAAU,IACzB,CACJ,ECnEO,IAAMM,GAAN,KAAsB,CAelB,YAAYC,EAAyB,CAExC,GADA,KAAK,MAAQA,EAAO,IAAI,OAAO,EAC3B,KAAK,MAAO,CACZ,IAAMC,EAAa,mBAAmB,KAAK,KAAK,EAAE,MAAMC,CAAmB,EAC3E,KAAK,MAAQD,EAAW,CAAC,EACrBA,EAAW,OAAS,IACpB,KAAK,UAAYA,EAAW,MAAM,CAAC,EAAE,KAAKC,CAAmB,EAErE,CAEA,KAAK,MAAQF,EAAO,IAAI,OAAO,EAC/B,KAAK,kBAAoBA,EAAO,IAAI,mBAAmB,EACvD,KAAK,UAAYA,EAAO,IAAI,WAAW,CAC3C,CACJ,ECrBA,IAAMG,GAAwB,CAC1B,MACA,MACA,YACA,QACA,MACA,MACA,MACA,SACJ,EAQMC,GAAiC,CAAC,MAAO,MAAO,MAAO,MAAO,KAAK,EAK5DC,GAAN,KAAoB,CAEhB,YACgBC,EACrB,CADqB,eAAAA,EAFvB,KAAmB,QAAU,IAAIC,EAAO,eAAe,CAGpD,CAEI,qBAAqBC,EAAkC,CAC1D,IAAMC,EAAS,CAAE,GAAGD,CAAO,EAE3B,GAAI,KAAK,UAAU,qBAAsB,CACrC,IAAIE,EACA,MAAM,QAAQ,KAAK,UAAU,oBAAoB,EACjDA,EAAiB,KAAK,UAAU,qBAEhCA,EAAiBP,GAGrB,QAAWQ,KAASD,EACXN,GAA+B,SAASO,CAAK,GAC9C,OAAOF,EAAOE,CAAK,CAG/B,CAEA,OAAOF,CACX,CAGO,YAAYG,EAAsBC,EAAiC,CACtE,IAAMJ,EAAS,CAAE,GAAGG,CAAQ,EAC5B,OAAW,CAACD,EAAOG,CAAM,IAAK,OAAO,QAAQD,CAAO,EAChD,GAAIJ,EAAOE,CAAK,IAAMG,EAClB,GAAI,MAAM,QAAQL,EAAOE,CAAK,CAAC,GAAK,MAAM,QAAQG,CAAM,EACpD,GAAI,KAAK,UAAU,oBAAoB,OAAS,UAC5CL,EAAOE,CAAK,EAAIG,MACb,CACH,IAAMC,EAAe,MAAM,QAAQN,EAAOE,CAAK,CAAC,EAAIF,EAAOE,CAAK,EAAiB,CAACF,EAAOE,CAAK,CAAC,EAC/F,QAAWK,KAAS,MAAM,QAAQF,CAAM,EAAIA,EAAS,CAACA,CAAM,EACnDC,EAAa,SAASC,CAAK,GAC5BD,EAAa,KAAKC,CAAK,EAG/BP,EAAOE,CAAK,EAAII,CACpB,MACO,OAAON,EAAOE,CAAK,GAAM,UAAY,OAAOG,GAAW,SAC9DL,EAAOE,CAAK,EAAI,KAAK,YAAYF,EAAOE,CAAK,EAAgBG,CAAmB,EAEhFL,EAAOE,CAAK,EAAIG,EAK5B,OAAOL,CACX,CACJ,EChFO,IAAMQ,EAAN,KAAgB,CACZ,YACaC,EACTC,EACT,CAFkB,UAAAD,EACT,WAAAC,CACP,CACR,ECwDO,IAAMC,GAAN,KAAiB,CAWb,YAAYC,EAAwDC,EAAmC,CAT9G,KAAmB,QAAU,IAAIC,EAAO,YAAY,EAUhD,KAAK,SAAWF,aAAoBG,EAA0BH,EAAW,IAAIG,EAAwBH,CAAQ,EAE7G,KAAK,gBAAkBC,GAAA,KAAAA,EAAmB,IAAIG,GAAgB,KAAK,QAAQ,EAC3E,KAAK,eAAiB,IAAIC,GAAc,KAAK,QAAQ,EACrD,KAAK,WAAa,IAAIC,GAAkB,KAAK,SAAU,KAAK,gBAAiB,KAAK,cAAc,EAChG,KAAK,aAAe,IAAIC,GAAY,KAAK,SAAU,KAAK,eAAe,CAC3E,CAEA,MAAa,oBAAoB,CAC7B,MAAAC,EACA,QAAAC,EACA,YAAAC,EACA,aAAAC,EACA,cAAAC,EACA,WAAAC,EACA,aAAAC,EACA,MAAAC,EACA,UAAAC,EACA,cAAAC,EAAgB,KAAK,SAAS,cAC9B,MAAAC,EAAQ,KAAK,SAAS,MACtB,aAAAC,EAAe,KAAK,SAAS,aAC7B,OAAAC,EAAS,KAAK,SAAS,OACvB,QAAAC,EAAU,KAAK,SAAS,QACxB,QAAAC,EAAU,KAAK,SAAS,QACxB,WAAAC,EAAa,KAAK,SAAS,WAC3B,WAAAC,EAAa,KAAK,SAAS,WAC3B,SAAAC,EAAW,KAAK,SAAS,SACzB,cAAAC,EAAgB,KAAK,SAAS,cAC9B,iBAAAC,EAAmB,KAAK,SAAS,iBACjC,iBAAAC,EAAmB,KAAK,SAAS,iBACjC,QAAAC,EACA,wBAAAC,EAA0B,KAAK,SAAS,uBAC5C,EAAoD,CAChD,IAAMC,EAAS,KAAK,QAAQ,OAAO,qBAAqB,EAExD,GAAId,IAAkB,OAClB,MAAM,IAAI,MAAM,2DAA2D,EAG/E,IAAMe,EAAM,MAAM,KAAK,gBAAgB,yBAAyB,EAChED,EAAO,MAAM,kCAAmCC,CAAG,EAEnD,IAAMC,EAAgB,MAAMC,GAAc,OAAO,CAC7C,IAAAF,EACA,UAAW,KAAK,SAAS,UACzB,UAAW,KAAK,SAAS,UACzB,aAAAb,EACA,cAAAF,EACA,MAAAC,EACA,WAAYV,EACZ,UAAAQ,EACA,OAAAI,EAAQ,QAAAC,EAAS,QAAAC,EAAS,WAAAC,EAAY,cAAAX,EAAe,WAAAC,EAAY,WAAAW,EAAY,QAAAK,EAC7E,SAAAJ,EAAU,QAAAhB,EAAS,YAAAC,EAAa,iBAAAiB,EAAkB,iBAAAC,EAAkB,aAAAjB,EAAc,cAAAe,EAClF,cAAe,KAAK,SAAS,cAC7B,aAAAZ,EACA,MAAAC,EACA,YAAa,KAAK,SAAS,YAC3B,wBAAAe,CACJ,CAAC,EAGD,MAAM,KAAK,gBAAgB,EAE3B,IAAMK,EAAcF,EAAc,MAClC,aAAM,KAAK,SAAS,WAAW,IAAIE,EAAY,GAAIA,EAAY,gBAAgB,CAAC,EACzEF,CACX,CAEA,MAAa,wBAAwBD,EAAaI,EAAc,GAAkE,CAC9H,IAAML,EAAS,KAAK,QAAQ,OAAO,yBAAyB,EAEtDM,EAAW,IAAIC,EAAeC,EAAS,WAAWP,EAAK,KAAK,SAAS,aAAa,CAAC,EACzF,GAAI,CAACK,EAAS,MACV,MAAAN,EAAO,MAAM,IAAI,MAAM,sBAAsB,CAAC,EAGxC,KAGV,IAAMS,EAAoB,MAAM,KAAK,SAAS,WAAWJ,EAAc,SAAW,KAAK,EAAEC,EAAS,KAAK,EACvG,GAAI,CAACG,EACD,MAAAT,EAAO,MAAM,IAAI,MAAM,oCAAoC,CAAC,EAEtD,KAIV,MAAO,CAAE,MADK,MAAMU,EAAY,kBAAkBD,CAAiB,EACnD,SAAAH,CAAS,CAC7B,CAEA,MAAa,sBAAsBL,EAAaU,EAA4CN,EAAc,GAA+B,CACrI,IAAML,EAAS,KAAK,QAAQ,OAAO,uBAAuB,EAEpD,CAAE,MAAAvB,EAAO,SAAA6B,CAAS,EAAI,MAAM,KAAK,wBAAwBL,EAAKI,CAAW,EAG/E,GAFAL,EAAO,MAAM,kDAAkD,EAE3D,KAAK,SAAS,MAAQ,KAAK,SAAS,KAAK,MAAO,CAChD,IAAMY,EAAY,MAAM,KAAK,aAAa,KAAK,SAAS,KAAK,KAAK,EAClED,EAAe,CAAE,GAAGA,EAAc,KAAQC,CAAU,CACxD,CAUA,GAAI,CACA,MAAM,KAAK,WAAW,uBAAuBN,EAAU7B,EAAOkC,CAAY,CAC9E,OACOE,EAAK,CACR,GAAIA,aAAeC,GAAkB,KAAK,SAAS,KAAM,CACrD,IAAMF,EAAY,MAAM,KAAK,aAAa,KAAK,SAAS,KAAK,MAAOC,EAAI,KAAK,EAC7EF,EAAc,KAAUC,EACxB,MAAM,KAAK,WAAW,uBAAuBN,EAAU7B,EAAOkC,CAAY,CAC9E,KACI,OAAME,CAEd,CAEA,OAAOP,CACX,CAEA,MAAM,aAAaS,EAAsB/B,EAAiC,CACtE,IAAIgC,EACAC,EAEJ,OAAM,MAAMF,EAAU,WAAW,GAAG,SAAS,KAAK,SAAS,SAAS,GAKhEE,EAAY,MAAMF,EAAU,IAAI,KAAK,SAAS,SAAS,EAGnDE,EAAU,QAAUjC,GAASA,IAC7BiC,EAAU,MAAQjC,EAClB,MAAM+B,EAAU,IAAI,KAAK,SAAS,UAAWE,CAAS,KAT1DD,EAAU,MAAME,EAAY,iBAAiB,EAC7CD,EAAY,IAAIE,EAAUH,EAAShC,CAAK,EACxC,MAAM+B,EAAU,IAAI,KAAK,SAAS,UAAWE,CAAS,GAWnD,MAAMC,EAAY,kBAAkB,CACvC,IAAK,MAAM,KAAK,gBAAgB,iBAAiB,EAAK,EACtD,WAAY,OACZ,QAASD,EAAU,KACnB,MAAOA,EAAU,KACrB,CAAC,CACL,CAEA,MAAa,wCAAwC,CACjD,SAAAG,EACA,SAAAC,EACA,aAAAtC,EAAe,GACf,iBAAAc,EAAmB,CAAC,CACxB,EAAyE,CACrE,IAAMyB,EAAyC,MAAM,KAAK,aAAa,oBAAoB,CAAE,SAAAF,EAAU,SAAAC,EAAU,GAAGxB,CAAiB,CAAC,EAChI0B,EAAiC,IAAIhB,EAAe,IAAI,eAAiB,EAC/E,cAAO,OAAOgB,EAAgBD,CAAa,EAC3C,MAAM,KAAK,WAAW,4BAA4BC,EAAgBxC,CAAY,EACvEwC,CACX,CAEA,MAAa,gBAAgB,CACzB,MAAA9C,EACA,aAAAW,EACA,SAAAM,EACA,iBAAA8B,EACA,aAAAb,EACA,iBAAAd,CACJ,EAAiD,CAjQrD,IAAA4B,EAkQQ,IAAMzB,EAAS,KAAK,QAAQ,OAAO,iBAAiB,EAKhDb,EACJ,GAAI,KAAK,SAAS,2BAA6B,OAC3CA,EAAQV,EAAM,UACX,CACH,IAAMiD,EAAkB,KAAK,SAAS,yBAAyB,MAAM,GAAG,EAGxEvC,KAFuBsC,EAAAhD,EAAM,QAAN,YAAAgD,EAAa,MAAM,OAAQ,CAAC,GAE5B,OAAOE,GAAKD,EAAgB,SAASC,CAAC,CAAC,EAAE,KAAK,GAAG,CAC5E,CAEA,GAAI,KAAK,SAAS,MAAQ,KAAK,SAAS,KAAK,MAAO,CAChD,IAAMf,EAAY,MAAM,KAAK,aAAa,KAAK,SAAS,KAAK,KAAK,EAClED,EAAe,CAAE,GAAGA,EAAc,KAAQC,CAAU,CACxD,CAUA,IAAIgB,EACJ,GAAI,CACAA,EAAS,MAAM,KAAK,aAAa,qBAAqB,CAClD,cAAenD,EAAM,cAErB,MAAAU,EACA,aAAAC,EACA,SAAAM,EACA,iBAAA8B,EACA,aAAAb,EACA,GAAGd,CACP,CAAC,CACL,OAASgB,EAAK,CACV,GAAIA,aAAeC,GAAkB,KAAK,SAAS,KAC/CH,EAAc,KAAU,MAAM,KAAK,aAAa,KAAK,SAAS,KAAK,MAAOE,EAAI,KAAK,EACnFe,EAAS,MAAM,KAAK,aAAa,qBAAqB,CAClD,cAAenD,EAAM,cAErB,MAAAU,EACA,aAAAC,EACA,SAAAM,EACA,iBAAA8B,EACA,aAAAb,EACA,GAAGd,CACP,CAAC,MAED,OAAMgB,CAEd,CAEA,IAAMP,EAAW,IAAIC,EAAe,IAAI,eAAiB,EACzD,cAAO,OAAOD,EAAUsB,CAAM,EAC9B5B,EAAO,MAAM,sBAAuBM,CAAQ,EAC5C,MAAM,KAAK,WAAW,wBAAwBA,EAAU,CACpD,GAAG7B,EAGH,MAAAU,CACJ,CAAC,EACMmB,CACX,CAEA,MAAa,qBAAqB,CAC9B,MAAA7B,EACA,cAAAI,EACA,UAAAgD,EACA,aAAAjD,EACA,UAAAK,EACA,yBAAA6C,EAA2B,KAAK,SAAS,yBACzC,iBAAAlC,EAAmB,KAAK,SAAS,gBACrC,EAA8B,CAAC,EAA4B,CACvD,IAAMI,EAAS,KAAK,QAAQ,OAAO,sBAAsB,EAEnDC,EAAM,MAAM,KAAK,gBAAgB,sBAAsB,EAC7D,GAAI,CAACA,EACD,MAAAD,EAAO,MAAM,IAAI,MAAM,yBAAyB,CAAC,EAE3C,KAGVA,EAAO,MAAM,gCAAiCC,CAAG,EAG7C,CAAC4B,GAAaC,GAA4B,CAACjD,IAC3CgD,EAAY,KAAK,SAAS,WAG9B,IAAMnD,EAAU,IAAIqD,GAAe,CAC/B,IAAA9B,EACA,cAAApB,EACA,UAAAgD,EACA,yBAAAC,EACA,WAAYrD,EACZ,iBAAAmB,EACA,aAAAhB,EACA,UAAAK,CACJ,CAAC,EAGD,MAAM,KAAK,gBAAgB,EAE3B,IAAM+C,EAAetD,EAAQ,MAC7B,OAAIsD,IACAhC,EAAO,MAAM,sCAAsC,EACnD,MAAM,KAAK,SAAS,WAAW,IAAIgC,EAAa,GAAIA,EAAa,gBAAgB,CAAC,GAG/EtD,CACX,CAEA,MAAa,yBAAyBuB,EAAaI,EAAc,GAAyE,CACtI,IAAML,EAAS,KAAK,QAAQ,OAAO,0BAA0B,EAEvDM,EAAW,IAAI2B,GAAgBzB,EAAS,WAAWP,EAAK,KAAK,SAAS,aAAa,CAAC,EAC1F,GAAI,CAACK,EAAS,MAAO,CAGjB,GAFAN,EAAO,MAAM,sBAAsB,EAE/BM,EAAS,MACT,MAAAN,EAAO,KAAK,sBAAuBM,EAAS,KAAK,EAC3C,IAAI4B,EAAc5B,CAAQ,EAGpC,MAAO,CAAE,MAAO,OAAW,SAAAA,CAAS,CACxC,CAEA,IAAMG,EAAoB,MAAM,KAAK,SAAS,WAAWJ,EAAc,SAAW,KAAK,EAAEC,EAAS,KAAK,EACvG,GAAI,CAACG,EACD,MAAAT,EAAO,MAAM,IAAI,MAAM,oCAAoC,CAAC,EAEtD,KAIV,MAAO,CAAE,MADK,MAAMmC,EAAM,kBAAkB1B,CAAiB,EAC7C,SAAAH,CAAS,CAC7B,CAEA,MAAa,uBAAuBL,EAAuC,CACvE,IAAMD,EAAS,KAAK,QAAQ,OAAO,wBAAwB,EAErD,CAAE,MAAAvB,EAAO,SAAA6B,CAAS,EAAI,MAAM,KAAK,yBAAyBL,EAAK,EAAI,EACzE,OAAIxB,GACAuB,EAAO,MAAM,kDAAkD,EAC/D,KAAK,WAAW,wBAAwBM,EAAU7B,CAAK,GAEvDuB,EAAO,MAAM,qDAAqD,EAG/DM,CACX,CAEO,iBAAiC,CACpC,YAAK,QAAQ,OAAO,iBAAiB,EAC9B6B,EAAM,gBAAgB,KAAK,SAAS,WAAY,KAAK,SAAS,sBAAsB,CAC/F,CAEA,MAAa,YAAYC,EAAeC,EAAwD,CAC5F,YAAK,QAAQ,OAAO,aAAa,EAC1B,MAAM,KAAK,aAAa,OAAO,CAClC,MAAAD,EACA,gBAAiBC,CACrB,CAAC,CACL,CACJ,ECjaO,IAAMC,GAAN,KAAqB,CAMjB,YAA6BC,EAA2B,CAA3B,kBAAAA,EALpC,KAAiB,QAAU,IAAIC,EAAO,gBAAgB,EAyCtD,KAAU,OAAS,MACfC,GAIgB,CAChB,IAAMC,EAAgBD,EAAK,cAC3B,GAAI,CAACC,EACD,OAEJ,IAAMC,EAAS,KAAK,QAAQ,OAAO,QAAQ,EAW3C,GATIF,EAAK,SACL,KAAK,KAAOA,EAAK,QAAQ,IACzBE,EAAO,MAAM,gBAAiBD,EAAe,QAAS,KAAK,IAAI,IAG/D,KAAK,KAAO,OACZC,EAAO,MAAM,gBAAiBD,EAAe,kBAAkB,GAG/D,KAAK,oBAAqB,CAC1B,KAAK,oBAAoB,MAAMA,CAAa,EAC5C,MACJ,CAEA,GAAI,CACA,IAAME,EAAM,MAAM,KAAK,aAAa,gBAAgB,sBAAsB,EAC1E,GAAIA,EAAK,CACLD,EAAO,MAAM,mCAAmC,EAEhD,IAAME,EAAY,KAAK,aAAa,SAAS,UACvCC,EAAoB,KAAK,aAAa,SAAS,8BAC/CC,EAAc,KAAK,aAAa,SAAS,wBAEzCC,EAAqB,IAAIC,EAAmB,KAAK,UAAWJ,EAAWD,EAAKE,EAAmBC,CAAW,EAChH,MAAMC,EAAmB,KAAK,EAC9B,KAAK,oBAAsBA,EAC3BA,EAAmB,MAAMN,CAAa,CAC1C,MAEIC,EAAO,KAAK,+CAA+C,CAEnE,OACOO,EAAK,CAERP,EAAO,MAAM,oCAAqCO,aAAe,MAAQA,EAAI,QAAUA,CAAG,CAC9F,CACJ,EAEA,KAAU,MAAQ,IAAY,CAC1B,IAAMP,EAAS,KAAK,QAAQ,OAAO,OAAO,EAO1C,GANA,KAAK,KAAO,OAER,KAAK,qBACL,KAAK,oBAAoB,KAAK,EAG9B,KAAK,aAAa,SAAS,wBAAyB,CAIpD,IAAMQ,EAAc,YAAY,SAAY,CACxC,cAAcA,CAAW,EAEzB,GAAI,CACA,IAAMC,EAAU,MAAM,KAAK,aAAa,mBAAmB,EAC3D,GAAIA,EAAS,CACT,IAAMC,EAAU,CACZ,cAAeD,EAAQ,cACvB,QAASA,EAAQ,IAAM,CACnB,IAAKA,EAAQ,GACjB,EAAI,IACR,EACK,KAAK,OAAOC,CAAO,CAC5B,CACJ,OACOH,EAAK,CAERP,EAAO,MAAM,gCAAiCO,aAAe,MAAQA,EAAI,QAAUA,CAAG,CAC1F,CACJ,EAAG,GAAI,CACX,CACJ,EAEA,KAAU,UAAY,SAA2B,CAC7C,IAAMP,EAAS,KAAK,QAAQ,OAAO,WAAW,EAC9C,GAAI,CACA,IAAMS,EAAU,MAAM,KAAK,aAAa,mBAAmB,EACvDE,EAAa,GAEbF,GAAW,KAAK,oBACZA,EAAQ,MAAQ,KAAK,MACrBE,EAAa,GACb,KAAK,oBAAoB,MAAMF,EAAQ,aAAa,EAEpDT,EAAO,MAAM,4GAA6GS,EAAQ,aAAa,EAC/I,MAAM,KAAK,aAAa,OAAO,yBAAyB,GAGxDT,EAAO,MAAM,mCAAoCS,EAAQ,GAAG,EAIhET,EAAO,MAAM,kCAAkC,EAG/CW,EACI,KAAK,KACL,MAAM,KAAK,aAAa,OAAO,oBAAoB,EAGnD,MAAM,KAAK,aAAa,OAAO,mBAAmB,EAGtDX,EAAO,MAAM,kDAAkD,CAEvE,OACOO,EAAK,CACJ,KAAK,OACLP,EAAO,MAAM,oEAAqEO,CAAG,EACrF,MAAM,KAAK,aAAa,OAAO,oBAAoB,EAE3D,CACJ,EA/JSX,GACD,KAAK,QAAQ,MAAM,IAAI,MAAM,wBAAwB,CAAC,EAG1D,KAAK,aAAa,OAAO,cAAc,KAAK,MAAM,EAClD,KAAK,aAAa,OAAO,gBAAgB,KAAK,KAAK,EAEnD,KAAK,MAAM,EAAE,MAAOW,GAAiB,CAEjC,KAAK,QAAQ,MAAMA,CAAG,CAC1B,CAAC,CACL,CAEA,MAAgB,OAAuB,CACnC,KAAK,QAAQ,OAAO,OAAO,EAC3B,IAAMT,EAAO,MAAM,KAAK,aAAa,QAAQ,EAG7C,GAAIA,EACK,KAAK,OAAOA,CAAI,UAEhB,KAAK,aAAa,SAAS,wBAAyB,CACzD,IAAMW,EAAU,MAAM,KAAK,aAAa,mBAAmB,EAC3D,GAAIA,EAAS,CACT,IAAMC,EAAU,CACZ,cAAeD,EAAQ,cACvB,QAASA,EAAQ,IAAM,CACnB,IAAKA,EAAQ,GACjB,EAAI,IACR,EACK,KAAK,OAAOC,CAAO,CAC5B,CACJ,CACJ,CA+HJ,EClKO,IAAME,EAAN,MAAMC,CAAK,CAuCP,YAAYC,EAWhB,CAlEP,IAAAC,EAmEQ,KAAK,SAAWD,EAAK,SACrB,KAAK,eAAgBC,EAAAD,EAAK,gBAAL,KAAAC,EAAsB,KAC3C,KAAK,aAAeD,EAAK,aACzB,KAAK,cAAgBA,EAAK,cAE1B,KAAK,WAAaA,EAAK,WACvB,KAAK,MAAQA,EAAK,MAClB,KAAK,QAAUA,EAAK,QACpB,KAAK,WAAaA,EAAK,WACvB,KAAK,MAAQA,EAAK,UAClB,KAAK,UAAYA,EAAK,SAC1B,CAGA,IAAW,YAAiC,CACxC,GAAI,KAAK,aAAe,OAGxB,OAAO,KAAK,WAAaE,EAAM,aAAa,CAChD,CAEA,IAAW,WAAWC,EAA2B,CACzCA,IAAU,SACV,KAAK,WAAa,KAAK,MAAMA,CAAK,EAAID,EAAM,aAAa,EAEjE,CAGA,IAAW,SAA+B,CACtC,IAAME,EAAa,KAAK,WACxB,GAAIA,IAAe,OAGnB,OAAOA,GAAc,CACzB,CAGA,IAAW,QAAmB,CAxGlC,IAAAH,EAAAI,EAyGQ,OAAOA,GAAAJ,EAAA,KAAK,QAAL,YAAAA,EAAY,MAAM,OAAlB,KAAAI,EAA0B,CAAC,CACtC,CAEO,iBAA0B,CAC7B,WAAIC,EAAO,MAAM,EAAE,OAAO,iBAAiB,EACpC,KAAK,UAAU,CAClB,SAAU,KAAK,SACf,cAAe,KAAK,cACpB,aAAc,KAAK,aACnB,cAAe,KAAK,cACpB,WAAY,KAAK,WACjB,MAAO,KAAK,MACZ,QAAS,KAAK,QACd,WAAY,KAAK,UACrB,CAAC,CACL,CAEA,OAAc,kBAAkBC,EAA6B,CACzD,OAAAD,EAAO,aAAa,OAAQ,mBAAmB,EACxC,IAAIP,EAAK,KAAK,MAAMQ,CAAa,CAAC,CAC7C,CACJ,ECxHA,IAAMC,GAAgB,cAcAC,GAAf,KAAsD,CAAtD,cAEH,KAAmB,OAAS,IAAIC,EAAuB,2BAA2B,EAClF,KAAmB,iBAAmB,IAAI,IAE1C,KAAU,QAA8B,KAExC,MAAa,SAASC,EAAmD,CACrE,IAAMC,EAAS,KAAK,QAAQ,OAAO,UAAU,EAC7C,GAAI,CAAC,KAAK,QACN,MAAM,IAAI,MAAM,4CAA4C,EAGhEA,EAAO,MAAM,uBAAuB,EACpC,KAAK,QAAQ,SAAS,QAAQD,EAAO,GAAG,EAExC,GAAM,CAAE,IAAAE,EAAK,SAAAC,CAAS,EAAI,MAAM,IAAI,QAAqB,CAACC,EAASC,IAAW,CAC1E,IAAMC,EAAYC,GAAoB,CArClD,IAAAC,EAsCgB,IAAMC,EAAgCF,EAAE,KAClCG,GAASF,EAAAR,EAAO,eAAP,KAAAQ,EAAuB,OAAO,SAAS,OACtD,GAAI,EAAAD,EAAE,SAAWG,IAAUD,GAAA,YAAAA,EAAM,UAAWZ,IAI5C,IAAI,CACA,IAAMc,EAAQC,EAAS,WAAWH,EAAK,IAAKT,EAAO,aAAa,EAAE,IAAI,OAAO,EAI7E,GAHKW,GACDV,EAAO,KAAK,gCAAgC,EAE5CM,EAAE,SAAW,KAAK,SAAWI,IAAUX,EAAO,MAG9C,MAER,MACM,CACF,KAAK,SAAS,EACdK,EAAO,IAAI,MAAM,8BAA8B,CAAC,CACpD,CACAD,EAAQK,CAAI,EAChB,EACA,OAAO,iBAAiB,UAAWH,EAAU,EAAK,EAClD,KAAK,iBAAiB,IAAI,IAAM,OAAO,oBAAoB,UAAWA,EAAU,EAAK,CAAC,EACtF,IAAMO,EAAU,IAAI,iBAAiB,qBAAqBb,EAAO,KAAK,EAAE,EACxEa,EAAQ,iBAAiB,UAAWP,EAAU,EAAK,EACnD,KAAK,iBAAiB,IAAI,IAAMO,EAAQ,MAAM,CAAC,EAC/C,KAAK,iBAAiB,IAAI,KAAK,OAAO,WAAYC,GAAW,CACzD,KAAK,SAAS,EACdT,EAAOS,CAAM,CACjB,CAAC,CAAC,CACN,CAAC,EACD,OAAAb,EAAO,MAAM,0BAA0B,EACvC,KAAK,SAAS,EAETE,GACD,KAAK,MAAM,EAGR,CAAE,IAAAD,CAAI,CACjB,CAIQ,UAAiB,CACrB,KAAK,QAAQ,OAAO,UAAU,EAE9B,QAAWa,KAAW,KAAK,iBACvBA,EAAQ,EAEZ,KAAK,iBAAiB,MAAM,CAChC,CAEA,OAAiB,cAAcC,EAAuBd,EAAaC,EAAW,GAAOc,EAAe,OAAO,SAAS,OAAc,CAC9H,IAAMC,EAAuB,CACzB,OAAQrB,GACR,IAAAK,EACA,SAAAC,CACJ,EACMF,EAAS,IAAIkB,EAAO,eAAe,EACzC,GAAIH,EACAf,EAAO,MAAM,wCAAwC,EACrDe,EAAO,YAAYE,EAASD,CAAY,MACrC,CACHhB,EAAO,MAAM,oCAAoC,EACjD,IAAMU,EAAQ,IAAI,IAAIT,CAAG,EAAE,aAAa,IAAI,OAAO,EACnD,GAAI,CAACS,EACD,MAAM,IAAI,MAAM,6DAA6D,EAEjF,IAAME,EAAU,IAAI,iBAAiB,qBAAqBF,CAAK,EAAE,EACjEE,EAAQ,YAAYK,CAAO,EAC3BL,EAAQ,MAAM,CAClB,CACJ,CACJ,ECxGO,IAAMO,GAAkD,CAC3D,SAAU,GACV,QAAS,GACT,OAAQ,IACR,+BAAgC,EACpC,EACaC,GAAqB,SAC5BC,GAAsD,GACtDC,GAAuC,EAChCC,GAAuC,GAmFvCC,GAAN,cAAuCC,CAAwB,CAgC3D,YAAYC,EAA2B,CAC1C,GAAM,CACF,mBAAAC,EAAqBD,EAAK,aAC1B,+BAAAE,EAAiCF,EAAK,yBACtC,oBAAAG,EAAsBV,GACtB,kBAAAW,EAAoBV,GACpB,eAAAW,EAAiB,SACjB,eAAAC,EAAiB,OAEjB,yBAAAC,EAA2BP,EAAK,yBAChC,mBAAAQ,EAAqBR,EAAK,mBAE1B,wBAAAS,EACA,oBAAAC,EAAsBV,EAAK,aAC3B,8BAAAW,EACA,qBAAAC,EAAuB,GACvB,yBAAAC,EAA2B,GAC3B,4BAAAC,EAA8B,GAE9B,eAAAC,EAAiB,GACjB,wBAAAC,EAA0B,GAC1B,8BAAAC,EAAgCrB,GAChC,2BAAAsB,EAA6B,OAC7B,wBAAAC,EAA0B,GAE1B,iBAAAC,EAAmB,CAAC,eAAgB,eAAe,EACnD,sBAAAC,EAAwB,GACxB,8BAAAC,EAAgC,GAEhC,6CAAAC,EAA+C5B,GAE/C,6BAAA6B,EAEA,UAAAC,CACJ,EAAIzB,EAiCJ,GA/BA,MAAMA,CAAI,EAEV,KAAK,mBAAqBC,EAC1B,KAAK,+BAAiCC,EACtC,KAAK,oBAAsBC,EAC3B,KAAK,kBAAoBC,EACzB,KAAK,eAAiBC,EACtB,KAAK,eAAiBC,EAEtB,KAAK,yBAA2BC,EAChC,KAAK,mBAAqBC,EAE1B,KAAK,oBAAsBE,EAC3B,KAAK,8BAAgCC,GAAiCF,GAA2BZ,GACjG,KAAK,qBAAuBe,EAC5B,KAAK,yBAA2BC,EAChC,KAAK,4BAA8BC,EAEnC,KAAK,eAAiBC,EACtB,KAAK,wBAA0BC,EAC/B,KAAK,8BAAgCC,EACrC,KAAK,wBAA0BE,EAC/B,KAAK,2BAA6BD,EAElC,KAAK,iBAAmBE,EACxB,KAAK,sBAAwBC,EAC7B,KAAK,8BAAgCC,EAErC,KAAK,6CAA+CC,EACpD,KAAK,6BAA+BC,EAEhCC,EACA,KAAK,UAAYA,MAEhB,CACD,IAAMC,EAAQ,OAAO,QAAW,YAAc,OAAO,eAAiB,IAAIC,EAC1E,KAAK,UAAY,IAAIC,EAAqB,CAAE,MAAAF,CAAM,CAAC,CACvD,CACJ,CACJ,EC7LO,IAAMG,GAAN,MAAMC,UAAqBC,EAAoB,CAK3C,YAAY,CACf,8BAAAC,EAAgCC,EACpC,EAAuB,CACnB,MAAM,EAPV,KAAmB,QAAU,IAAIC,EAAO,cAAc,EAQlD,KAAK,kBAAoBF,EAEzB,KAAK,OAASF,EAAa,mBAAmB,EAC9C,KAAK,QAAU,KAAK,OAAO,aAC/B,CAEA,OAAe,oBAAwC,CACnD,IAAMK,EAAS,OAAO,SAAS,cAAc,QAAQ,EAGrD,OAAAA,EAAO,MAAM,WAAa,SAC1BA,EAAO,MAAM,SAAW,QACxBA,EAAO,MAAM,KAAO,UACpBA,EAAO,MAAM,IAAM,IACnBA,EAAO,MAAQ,IACfA,EAAO,OAAS,IAEhB,OAAO,SAAS,KAAK,YAAYA,CAAM,EAChCA,CACX,CAEA,MAAa,SAASC,EAAmD,CACrE,KAAK,QAAQ,MAAM,8BAA+B,KAAK,iBAAiB,EACxE,IAAMC,EAAQ,WAAW,IAAG,CAAQ,KAAK,OAAO,MAAM,IAAIC,EAAa,qCAAqC,CAAC,GAAG,KAAK,kBAAoB,GAAI,EAC7I,YAAK,iBAAiB,IAAI,IAAM,aAAaD,CAAK,CAAC,EAE5C,MAAM,MAAM,SAASD,CAAM,CACtC,CAEO,OAAc,CAzDzB,IAAAG,EA0DY,KAAK,SACD,KAAK,OAAO,aACZ,KAAK,OAAO,iBAAiB,OAASC,GAAO,CA5D7D,IAAAD,EA6DoB,IAAME,EAAQD,EAAG,QACjBD,EAAAE,EAAM,aAAN,MAAAF,EAAkB,YAAYE,GACzB,KAAK,OAAO,MAAM,IAAI,MAAM,yBAAyB,CAAC,CAC/D,EAAG,EAAI,GACPF,EAAA,KAAK,OAAO,gBAAZ,MAAAA,EAA2B,SAAS,QAAQ,gBAEhD,KAAK,OAAS,MAElB,KAAK,QAAU,IACnB,CAEA,OAAc,aAAaG,EAAaC,EAA6B,CACjE,OAAO,MAAM,cAAc,OAAO,OAAQD,EAAK,GAAOC,CAAY,CACtE,CACJ,EChEO,IAAMC,GAAN,KAA4C,CAG/C,YAAoBC,EAAqC,CAArC,eAAAA,EAFpB,KAAiB,QAAU,IAAIC,EAAO,iBAAiB,CAEG,CAE1D,MAAa,QAAQ,CACjB,8BAAAC,EAAgC,KAAK,UAAU,6BACnD,EAA8C,CAC1C,OAAO,IAAIC,GAAa,CAAE,8BAAAD,CAA8B,CAAC,CAC7D,CAEA,MAAa,SAASE,EAA4B,CAC9C,KAAK,QAAQ,OAAO,UAAU,EAC9BD,GAAa,aAAaC,EAAK,KAAK,UAAU,wBAAwB,CAC1E,CACJ,EClBA,IAAMC,GAA8B,IAC9BC,GAAS,IAiBFC,GAAN,cAA0BC,EAAoB,CAO1C,YAAY,CACf,kBAAAC,EAAoBC,GACpB,oBAAAC,EAAsB,CAAC,EACvB,YAAAC,EACA,kBAAAC,CACJ,EAAsB,CAClB,MAAM,EAZV,KAAmB,QAAU,IAAIC,EAAO,aAAa,EAajD,IAAMC,EAAgBC,GAAW,OAAO,CAAE,GAAGC,GAA4B,GAAGN,CAAoB,CAAC,EACjG,KAAK,QAAU,OAAO,KAAK,OAAWF,EAAmBO,GAAW,UAAUD,CAAa,CAAC,EAC5F,KAAK,aAAe,EAAQF,EAExBD,GACAA,EAAY,iBAAiB,QAAS,IAAM,CA7CxD,IAAAM,EA8CqB,KAAK,OAAO,MAAM,IAAI,OAAMA,EAAAN,EAAY,SAAZ,KAAAM,EAAsB,eAAe,CAAC,CAC3E,CAAC,EAGDP,EAAoB,gCAAkCA,EAAoB,+BAAiC,GAC3G,WAAW,IAAM,CACb,GAAI,CAAC,KAAK,SAAW,OAAO,KAAK,QAAQ,QAAW,WAAa,KAAK,QAAQ,OAAQ,CAC7E,KAAK,OAAO,MAAM,IAAI,MAAM,uBAAuB,CAAC,EACzD,MACJ,CAEA,KAAK,MAAM,CACf,EAAGA,EAAoB,+BAAiCL,EAAM,CAEtE,CAEA,MAAa,SAASa,EAAmD,CA9D7E,IAAAD,GA+DQA,EAAA,KAAK,UAAL,MAAAA,EAAc,QAEd,IAAME,EAAsB,YAAY,IAAM,EACtC,CAAC,KAAK,SAAW,KAAK,QAAQ,UAC9B,KAAK,QAAQ,MAAM,8CAA8C,EACjEC,EAAyB,EACzB,KAAK,iBAAiB,OAAOA,CAAwB,EAEjD,KAAK,cACA,KAAK,OAAO,MAAM,IAAI,MAAM,sBAAsB,CAAC,EAGpE,EAAGhB,EAA2B,EACxBgB,EAA2B,IAAM,cAAcD,CAAmB,EACxE,YAAK,iBAAiB,IAAIC,CAAwB,EAE3C,MAAM,MAAM,SAASF,CAAM,CACtC,CAEO,OAAc,CACb,KAAK,UACA,KAAK,QAAQ,SACd,KAAK,QAAQ,MAAM,EACd,KAAK,OAAO,MAAM,IAAI,MAAM,cAAc,CAAC,IAGxD,KAAK,QAAU,IACnB,CAEA,OAAc,aAAaG,EAAaC,EAAyB,CAC7D,MAAM,cAAc,OAAO,OAAQD,EAAKC,CAAQ,EAC5C,CAACA,GAAY,CAAC,OAAO,QACrB,OAAO,MAAM,CAErB,CACJ,ECvFO,IAAMC,GAAN,KAA2C,CAG9C,YAAoBC,EAAqC,CAArC,eAAAA,EAFpB,KAAiB,QAAU,IAAIC,EAAO,gBAAgB,CAEK,CAE3D,MAAa,QAAQ,CACjB,oBAAAC,EAAsB,KAAK,UAAU,oBACrC,kBAAAC,EAAoB,KAAK,UAAU,kBACnC,YAAAC,EACA,kBAAAC,CACJ,EAA4C,CACxC,OAAO,IAAIC,GAAY,CACnB,oBAAAJ,EACA,kBAAAC,EACA,YAAAC,EACA,kBAAAC,CACJ,CAAC,CACL,CAEA,MAAa,SAASE,EAAa,CAAE,SAAAC,EAAW,EAAM,EAAkB,CACpE,KAAK,QAAQ,OAAO,UAAU,EAE9BF,GAAY,aAAaC,EAAKC,CAAQ,CAC1C,CACJ,EChBO,IAAMC,GAAN,KAA8C,CAGjD,YAAoBC,EAAqC,CAArC,eAAAA,EAFpB,KAAiB,QAAU,IAAIC,EAAO,mBAAmB,CAEC,CAE1D,MAAa,QAAQ,CACjB,eAAAC,EAAiB,KAAK,UAAU,eAChC,eAAAC,EAAiB,KAAK,UAAU,cACpC,EAAqC,CA3BzC,IAAAC,EA4BQ,KAAK,QAAQ,OAAO,SAAS,EAC7B,IAAIC,EAAe,OAAO,KAEtBF,IAAmB,QACnBE,GAAeD,EAAA,OAAO,MAAP,KAAAA,EAAc,OAAO,MAGxC,IAAME,EAAWD,EAAa,SAASH,CAAc,EAAE,KAAKG,EAAa,QAAQ,EAC7EE,EACJ,MAAO,CACH,SAAU,MAAOC,IACb,KAAK,QAAQ,OAAO,UAAU,EAMvB,MALS,IAAI,QAAQ,CAACC,EAASC,IAAW,CAC7CH,EAAQG,EACR,OAAO,iBAAiB,WAAY,IAAMD,EAAQ,OAAO,SAAS,IAAI,CAAC,EACvEH,EAASE,EAAO,GAAG,CACvB,CAAC,GAGL,MAAO,IAAM,CACT,KAAK,QAAQ,OAAO,OAAO,EAC3BD,GAAA,MAAAA,EAAQ,IAAI,MAAM,kBAAkB,GACpCF,EAAa,KAAK,CACtB,CACJ,CACJ,CAEA,MAAa,UAA0B,CAEvC,CACJ,ECtBO,IAAMM,GAAN,cAAgCC,CAAkB,CAU9C,YAAYC,EAAoC,CACnD,MAAM,CAAE,kCAAmCA,EAAS,4CAA6C,CAAC,EAVtG,KAAmB,QAAU,IAAIC,EAAO,mBAAmB,EAE3D,KAAiB,YAAc,IAAIC,EAAc,aAAa,EAC9D,KAAiB,cAAgB,IAAIA,EAAU,eAAe,EAC9D,KAAiB,kBAAoB,IAAIA,EAAe,oBAAoB,EAC5E,KAAiB,cAAgB,IAAIA,EAAU,gBAAgB,EAC/D,KAAiB,eAAiB,IAAIA,EAAU,iBAAiB,EACjE,KAAiB,oBAAsB,IAAIA,EAAU,sBAAsB,CAI3E,CAEA,MAAa,KAAKC,EAAYC,EAAW,GAAqB,CAC1D,MAAM,MAAM,KAAKD,CAAI,EACjBC,GACA,MAAM,KAAK,YAAY,MAAMD,CAAI,CAEzC,CAEA,MAAa,QAAwB,CACjC,MAAM,MAAM,OAAO,EACnB,MAAM,KAAK,cAAc,MAAM,CACnC,CAKO,cAAcE,EAAoC,CACrD,OAAO,KAAK,YAAY,WAAWA,CAAE,CACzC,CAIO,iBAAiBA,EAA8B,CAClD,OAAO,KAAK,YAAY,cAAcA,CAAE,CAC5C,CAKO,gBAAgBA,EAAsC,CACzD,OAAO,KAAK,cAAc,WAAWA,CAAE,CAC3C,CAIO,mBAAmBA,EAAgC,CACtD,OAAO,KAAK,cAAc,cAAcA,CAAE,CAC9C,CAKO,oBAAoBA,EAA0C,CACjE,OAAO,KAAK,kBAAkB,WAAWA,CAAE,CAC/C,CAIO,uBAAuBA,EAAoC,CAC9D,OAAO,KAAK,kBAAkB,cAAcA,CAAE,CAClD,CAIA,MAAa,uBAAuBC,EAAyB,CACzD,MAAM,KAAK,kBAAkB,MAAMA,CAAC,CACxC,CAMO,gBAAgBD,EAAsC,CACzD,OAAO,KAAK,cAAc,WAAWA,CAAE,CAC3C,CAIO,mBAAmBA,EAAgC,CACtD,KAAK,cAAc,cAAcA,CAAE,CACvC,CAIA,MAAa,oBAAoC,CAC7C,MAAM,KAAK,cAAc,MAAM,CACnC,CAMO,iBAAiBA,EAAuC,CAC3D,OAAO,KAAK,eAAe,WAAWA,CAAE,CAC5C,CAIO,oBAAoBA,EAAiC,CACxD,KAAK,eAAe,cAAcA,CAAE,CACxC,CAIA,MAAa,qBAAqC,CAC9C,MAAM,KAAK,eAAe,MAAM,CACpC,CAMO,sBAAsBA,EAA4C,CACrE,OAAO,KAAK,oBAAoB,WAAWA,CAAE,CACjD,CAIO,yBAAyBA,EAAsC,CAClE,KAAK,oBAAoB,cAAcA,CAAE,CAC7C,CAIA,MAAa,0BAA0C,CACnD,MAAM,KAAK,oBAAoB,MAAM,CACzC,CACJ,EC3JO,IAAME,GAAN,KAAyB,CAMrB,YAAoBC,EAA2B,CAA3B,kBAAAA,EAL3B,KAAU,QAAU,IAAIC,EAAO,oBAAoB,EACnD,KAAQ,WAAa,GACrB,KAAiB,YAAc,IAAIC,EAAM,oBAAoB,EAC7D,KAAQ,mBAAqB,EAgC7B,KAAU,eAAsC,SAAY,CACxD,IAAMC,EAAS,KAAK,QAAQ,OAAO,gBAAgB,EACnD,GAAI,CACA,MAAM,KAAK,aAAa,aAAa,EACrC,KAAK,mBAAqB,EAC1BA,EAAO,MAAM,iCAAiC,CAClD,OACOC,EAAK,CACR,GAAIA,aAAeC,EAAc,CAE7B,KAAK,qBAGL,IAAMC,EAAa,KAAK,aAAa,SAAS,6BAG9C,GAFwBA,IAAe,QAAa,KAAK,mBAAqBA,EAEzD,CAEjBH,EAAO,MACH,gCAAgC,KAAK,kBAAkB,MAAMG,CAAU,+BAEvEF,CACJ,EACA,KAAK,mBAAqB,EAC1B,MAAM,KAAK,aAAa,OAAO,uBAAuBA,CAAY,EAClE,MACJ,CAIAD,EAAO,KACH,2CAA2C,KAAK,kBAAkB,kBAClEC,CACJ,EACA,KAAK,YAAY,KAAK,CAAC,EACvB,MACJ,CAGAD,EAAO,MAAM,2BAA4BC,CAAG,EAC5C,KAAK,mBAAqB,EAC1B,MAAM,KAAK,aAAa,OAAO,uBAAuBA,CAAY,CACtE,CACJ,CAzEuD,CAEvD,MAAa,OAAuB,CAChC,IAAMD,EAAS,KAAK,QAAQ,OAAO,OAAO,EAC1C,GAAI,CAAC,KAAK,WAAY,CAClB,KAAK,WAAa,GAClB,KAAK,aAAa,OAAO,uBAAuB,KAAK,cAAc,EACnE,KAAK,YAAY,WAAW,KAAK,cAAc,EAG/C,GAAI,CACA,MAAM,KAAK,aAAa,QAAQ,CAEpC,OACOC,EAAK,CAERD,EAAO,MAAM,gBAAiBC,CAAG,CACrC,CACJ,CACJ,CAEO,MAAa,CACZ,KAAK,aACL,KAAK,YAAY,OAAO,EACxB,KAAK,YAAY,cAAc,KAAK,cAAc,EAClD,KAAK,aAAa,OAAO,0BAA0B,KAAK,cAAc,EACtE,KAAK,WAAa,GAE1B,CA8CJ,ECjFO,IAAMG,GAAN,KAAmB,CAUtB,YAAYC,EAQT,CACC,KAAK,cAAgBA,EAAK,cAC1B,KAAK,SAAWA,EAAK,SACrB,KAAK,cAAgBA,EAAK,cAC1B,KAAK,MAAQA,EAAK,MAClB,KAAK,QAAUA,EAAK,QAEpB,KAAK,KAAOA,EAAK,KAErB,CACJ,ECkDO,IAAMC,GAAN,KAAkB,CAad,YAAYC,EAA+BC,EAAgCC,EAA6BC,EAA8B,CAV7I,KAAmB,QAAU,IAAIC,EAAO,aAAa,EAWjD,KAAK,SAAW,IAAIC,GAAyBL,CAAQ,EAErD,KAAK,QAAU,IAAIM,GAAWN,CAAQ,EAEtC,KAAK,mBAAqBC,GAAA,KAAAA,EAAqB,IAAIM,GAAkB,KAAK,QAAQ,EAClF,KAAK,gBAAkBL,GAAA,KAAAA,EAAkB,IAAIM,GAAe,KAAK,QAAQ,EACzE,KAAK,iBAAmBL,GAAA,KAAAA,EAAmB,IAAIM,GAAgB,KAAK,QAAQ,EAE5E,KAAK,QAAU,IAAIC,GAAkB,KAAK,QAAQ,EAClD,KAAK,oBAAsB,IAAIC,GAAmB,IAAI,EAGlD,KAAK,SAAS,sBACd,KAAK,iBAAiB,EAG1B,KAAK,gBAAkB,KACnB,KAAK,SAAS,iBACd,KAAK,gBAAkB,IAAIC,GAAe,IAAI,EAEtD,CAKA,IAAW,QAA4B,CACnC,OAAO,KAAK,OAChB,CAKA,IAAW,iBAAmC,CAC1C,OAAO,KAAK,QAAQ,eACxB,CAQA,MAAa,QAAQC,EAAa,GAA6B,CAC3D,IAAMC,EAAS,KAAK,QAAQ,OAAO,SAAS,EACtCC,EAAO,MAAM,KAAK,UAAU,EAClC,OAAIA,GACAD,EAAO,KAAK,aAAa,EACzB,MAAM,KAAK,QAAQ,KAAKC,EAAMF,CAAU,EACjCE,IAGXD,EAAO,KAAK,2BAA2B,EAChC,KACX,CAOA,MAAa,YAA4B,CACrC,IAAMA,EAAS,KAAK,QAAQ,OAAO,YAAY,EAC/C,MAAM,KAAK,UAAU,IAAI,EACzBA,EAAO,KAAK,2BAA2B,EACvC,MAAM,KAAK,QAAQ,OAAO,CAC9B,CASA,MAAa,eAAeE,EAA2B,CAAC,EAAkB,CAhL9E,IAAAC,EAiLQ,KAAK,QAAQ,OAAO,gBAAgB,EACpC,GAAM,CACF,eAAAC,EACA,GAAGC,CACP,EAAIH,EAEAI,GACAH,EAAA,KAAK,SAAS,OAAd,MAAAA,EAAoB,0BACpBG,EAAU,MAAM,KAAK,gBAAgB,KAAK,SAAS,IAAI,GAG3D,IAAMC,EAAS,MAAM,KAAK,mBAAmB,QAAQ,CAAE,eAAAH,CAAe,CAAC,EACvE,MAAM,KAAK,aAAa,CACpB,aAAc,OACd,QAAAE,EACA,GAAGD,CACP,EAAGE,CAAM,CACb,CAUA,MAAa,uBAAuBC,EAAM,OAAO,SAAS,KAAqB,CAC3E,IAAMR,EAAS,KAAK,QAAQ,OAAO,wBAAwB,EACrDC,EAAO,MAAM,KAAK,WAAWO,CAAG,EACtC,OAAIP,EAAK,SAAWA,EAAK,QAAQ,IAC7BD,EAAO,KAAK,6BAA8BC,EAAK,QAAQ,GAAG,EAG1DD,EAAO,KAAK,YAAY,EAGrBC,CACX,CAQA,MAAa,+BAA+B,CACxC,SAAAQ,EACA,SAAAC,EACA,aAAAC,EAAe,EACnB,EAAsD,CAClD,IAAMX,EAAS,KAAK,QAAQ,OAAO,+BAA+B,EAE5DY,EAAiB,MAAM,KAAK,QAAQ,wCAAwC,CAC9E,SAAAH,EACA,SAAAC,EACA,aAAAC,EACA,iBAAkB,KAAK,SAAS,gBACpC,CAAC,EACDX,EAAO,MAAM,qBAAqB,EAElC,IAAMC,EAAO,MAAM,KAAK,WAAWW,CAAc,EACjD,OAAIX,EAAK,SAAWA,EAAK,QAAQ,IAC7BD,EAAO,KAAK,6BAA8BC,EAAK,QAAQ,GAAG,EAE1DD,EAAO,KAAK,YAAY,EAErBC,CACX,CAQA,MAAa,YAAYC,EAAwB,CAAC,EAAkB,CA7PxE,IAAAC,EA8PQ,IAAMH,EAAS,KAAK,QAAQ,OAAO,aAAa,EAE5CM,GACAH,EAAA,KAAK,SAAS,OAAd,MAAAA,EAAoB,0BACpBG,EAAU,MAAM,KAAK,gBAAgB,KAAK,SAAS,IAAI,GAG3D,GAAM,CACF,oBAAAO,EACA,kBAAAC,EACA,YAAAC,EACA,kBAAAC,EACA,GAAGX,CACP,EAAIH,EACEM,EAAM,KAAK,SAAS,mBACrBA,GACDR,EAAO,MAAM,IAAI,MAAM,kCAAkC,CAAC,EAG9D,IAAMO,EAAS,MAAM,KAAK,gBAAgB,QAAQ,CAAE,oBAAAM,EAAqB,kBAAAC,EAAmB,YAAAC,EAAa,kBAAAC,CAAkB,CAAC,EACtHf,EAAO,MAAM,KAAK,QAAQ,CAC5B,aAAc,OACd,aAAcO,EACd,QAAS,QACT,QAAAF,EACA,GAAGD,CACP,EAAGE,CAAM,EACT,OAAIN,IACIA,EAAK,SAAWA,EAAK,QAAQ,IAC7BD,EAAO,KAAK,6BAA8BC,EAAK,QAAQ,GAAG,EAE1DD,EAAO,KAAK,YAAY,GAIzBC,CACX,CAUA,MAAa,oBAAoBO,EAAM,OAAO,SAAS,KAAMS,EAAW,GAAsB,CAC1F,IAAMjB,EAAS,KAAK,QAAQ,OAAO,qBAAqB,EACxD,MAAM,KAAK,gBAAgB,SAASQ,EAAK,CAAE,SAAAS,CAAS,CAAC,EACrDjB,EAAO,KAAK,SAAS,CACzB,CAOA,MAAa,aAAaE,EAAyB,CAAC,EAAyB,CAvTjF,IAAAC,EAAAe,EAwTQ,IAAMlB,EAAS,KAAK,QAAQ,OAAO,cAAc,EAC3C,CACF,8BAAAmB,EACA,GAAGd,CACP,EAAIH,EAEAD,EAAO,MAAM,KAAK,UAAU,EAEhC,GAAI,CAACC,EAAK,kBAAmBD,GAAA,MAAAA,EAAM,eAAe,CAC9CD,EAAO,MAAM,qBAAqB,EAClC,IAAMoB,EAAQ,IAAIC,GAAapB,CAAsB,EACrD,OAAO,MAAM,KAAK,iBAAiB,CAC/B,MAAAmB,EACA,aAAcf,EAAY,aAC1B,SAAUA,EAAY,SACtB,iBAAkBA,EAAY,iBAC9B,iBAAkBc,CACtB,CAAC,CACL,CAEA,IAAIb,GACAH,EAAA,KAAK,SAAS,OAAd,MAAAA,EAAoB,0BACpBG,EAAU,MAAM,KAAK,gBAAgB,KAAK,SAAS,IAAI,GAG3D,IAAME,EAAM,KAAK,SAAS,oBACrBA,GACDR,EAAO,MAAM,IAAI,MAAM,mCAAmC,CAAC,EAG/D,IAAIsB,EACArB,GAAQ,KAAK,SAAS,2BACtBD,EAAO,MAAM,iCAAkCC,EAAK,QAAQ,GAAG,EAC/DqB,EAAYrB,EAAK,QAAQ,KAG7B,IAAMM,EAAS,MAAM,KAAK,iBAAiB,QAAQ,CAAE,8BAAAY,CAA8B,CAAC,EACpF,OAAAlB,EAAO,MAAM,KAAK,QAAQ,CACtB,aAAc,OACd,aAAcO,EACd,OAAQ,OACR,cAAe,KAAK,SAAS,4BAA8BP,GAAA,YAAAA,EAAM,SAAW,OAC5E,QAAAK,EACA,GAAGD,CACP,EAAGE,EAAQe,CAAS,EAChBrB,KACIiB,EAAAjB,EAAK,UAAL,MAAAiB,EAAc,IACdlB,EAAO,KAAK,6BAA8BC,EAAK,QAAQ,GAAG,EAG1DD,EAAO,KAAK,YAAY,GAIzBC,CACX,CAEA,MAAgB,iBAAiBC,EAA0C,CACvE,IAAMqB,EAAW,MAAM,KAAK,QAAQ,gBAAgB,CAChD,iBAAkB,KAAK,SAAS,8BAChC,GAAGrB,CACP,CAAC,EACKD,EAAO,IAAIuB,EAAK,CAAE,GAAGtB,EAAK,MAAO,GAAGqB,CAAS,CAAC,EAEpD,aAAM,KAAK,UAAUtB,CAAI,EACzB,MAAM,KAAK,QAAQ,KAAKA,CAAI,EACrBA,CACX,CAWA,MAAa,qBAAqBO,EAAM,OAAO,SAAS,KAAqB,CACzE,IAAMR,EAAS,KAAK,QAAQ,OAAO,sBAAsB,EACzD,MAAM,KAAK,iBAAiB,SAASQ,CAAG,EACxCR,EAAO,KAAK,SAAS,CACzB,CAWA,MAAa,eAAeQ,EAAM,OAAO,SAAS,KAAiC,CAC/E,GAAM,CAAE,MAAAY,CAAM,EAAI,MAAM,KAAK,QAAQ,wBAAwBZ,CAAG,EAChE,OAAQY,EAAM,aAAc,CACxB,IAAK,OACD,OAAO,MAAM,KAAK,uBAAuBZ,CAAG,EAChD,IAAK,OACD,MAAM,KAAK,oBAAoBA,CAAG,EAClC,MACJ,IAAK,OACD,MAAM,KAAK,qBAAqBA,CAAG,EACnC,MACJ,QACI,MAAM,IAAI,MAAM,+BAA+B,CACvD,CAEJ,CAWA,MAAa,gBAAgBA,EAAM,OAAO,SAAS,KAAMS,EAAW,GAA6C,CAC7G,GAAM,CAAE,MAAAG,CAAM,EAAI,MAAM,KAAK,QAAQ,yBAAyBZ,CAAG,EACjE,GAAKY,EAIL,OAAQA,EAAM,aAAc,CACxB,IAAK,OACD,OAAO,MAAM,KAAK,wBAAwBZ,CAAG,EACjD,IAAK,OACD,MAAM,KAAK,qBAAqBA,EAAKS,CAAQ,EAC7C,MACJ,IAAK,OACD,MAAM,KAAK,sBAAsBT,CAAG,EACpC,MACJ,QACI,MAAM,IAAI,MAAM,+BAA+B,CACvD,CAEJ,CAOA,MAAa,mBAAmBN,EAA+B,CAAC,EAAkC,CAC9F,IAAMF,EAAS,KAAK,QAAQ,OAAO,oBAAoB,EACjD,CACF,8BAAAmB,EACA,GAAGd,CACP,EAAIH,EACEM,EAAM,KAAK,SAAS,oBACrBA,GACDR,EAAO,MAAM,IAAI,MAAM,mCAAmC,CAAC,EAG/D,IAAMC,EAAO,MAAM,KAAK,UAAU,EAC5BM,EAAS,MAAM,KAAK,iBAAiB,QAAQ,CAAE,8BAAAY,CAA8B,CAAC,EAC9EM,EAAc,MAAM,KAAK,aAAa,CACxC,aAAc,OACd,aAAcjB,EACd,OAAQ,OACR,cAAe,KAAK,SAAS,4BAA8BP,GAAA,YAAAA,EAAM,SAAW,OAC5E,cAAe,KAAK,SAAS,2BAC7B,MAAO,SACP,aAAc,GACd,GAAGI,CACP,EAAGE,CAAM,EACT,GAAI,CACA,IAAMmB,EAA4C,CAAC,EAC7Cd,EAAiB,MAAM,KAAK,QAAQ,sBAAsBa,EAAY,IAAKC,CAAY,EAG7F,OAFA1B,EAAO,MAAM,qBAAqB,EAE9BY,EAAe,eAAiBA,EAAe,QAAQ,KACvDZ,EAAO,KAAK,sBAAuBY,EAAe,QAAQ,GAAG,EACtD,CACH,cAAeA,EAAe,cAC9B,IAAKA,EAAe,QAAQ,GAChC,IAGJZ,EAAO,KAAK,iCAAiC,EACtC,KACX,OAAS2B,EAAK,CACV,GAAI,KAAK,SAAS,yBAA2BA,aAAeC,EACxD,OAAQD,EAAI,MAAO,CACf,IAAK,iBACL,IAAK,mBACL,IAAK,uBACL,IAAK,6BACD,OAAA3B,EAAO,KAAK,4BAA4B,EACjC,CACH,cAAe2B,EAAI,aACvB,CACR,CAEJ,MAAMA,CACV,CACJ,CAEA,MAAgB,QAAQzB,EAA+BK,EAAiBe,EAAmC,CACvG,IAAMG,EAAc,MAAM,KAAK,aAAavB,EAAMK,CAAM,EACxD,OAAO,MAAM,KAAK,WAAWkB,EAAY,IAAKH,CAAS,CAC3D,CAEA,MAAgB,aAAapB,EAA+BK,EAA4C,CACpG,IAAMP,EAAS,KAAK,QAAQ,OAAO,cAAc,EAEjD,GAAI,CACA,IAAM6B,EAAgB,MAAM,KAAK,QAAQ,oBAAoB3B,CAAI,EACjE,OAAAF,EAAO,MAAM,oBAAoB,EAE1B,MAAMO,EAAO,SAAS,CACzB,IAAKsB,EAAc,IACnB,MAAOA,EAAc,MAAM,GAC3B,cAAeA,EAAc,MAAM,cACnC,aAAc,KAAK,SAAS,kBAChC,CAAC,CACL,OAASF,EAAK,CACV,MAAA3B,EAAO,MAAM,2DAA2D,EACxEO,EAAO,MAAM,EACPoB,CACV,CACJ,CAEA,MAAgB,WAAWnB,EAAac,EAAmC,CACvE,IAAMtB,EAAS,KAAK,QAAQ,OAAO,YAAY,EACzC0B,EAA4C,CAAC,EAC7Cd,EAAiB,MAAM,KAAK,QAAQ,sBAAsBJ,EAAKkB,CAAY,EACjF,OAAA1B,EAAO,MAAM,qBAAqB,EAErB,MAAM,KAAK,WAAWY,EAAgBU,CAAS,CAEhE,CAEA,MAAgB,WAAWV,EAAgCU,EAAoB,CAC3E,IAAMtB,EAAS,KAAK,QAAQ,OAAO,YAAY,EACzCC,EAAO,IAAIuB,EAAKZ,CAAc,EACpC,GAAIU,EAAW,CACX,GAAIA,IAAcrB,EAAK,QAAQ,IAC3B,MAAAD,EAAO,MAAM,0EAA2EC,EAAK,QAAQ,GAAG,EAClG,IAAI2B,EAAc,CAAE,GAAGhB,EAAgB,MAAO,gBAAiB,CAAC,EAE1EZ,EAAO,MAAM,gDAAgD,CACjE,CAEA,aAAM,KAAK,UAAUC,CAAI,EACzBD,EAAO,MAAM,aAAa,EAC1B,MAAM,KAAK,QAAQ,KAAKC,CAAI,EAErBA,CACX,CAOA,MAAa,gBAAgBC,EAA4B,CAAC,EAAkB,CACxE,IAAMF,EAAS,KAAK,QAAQ,OAAO,iBAAiB,EAC9C,CACF,eAAAI,EACA,GAAGC,CACP,EAAIH,EACEK,EAAS,MAAM,KAAK,mBAAmB,QAAQ,CAAE,eAAAH,CAAe,CAAC,EACvE,MAAM,KAAK,cAAc,CACrB,aAAc,OACd,yBAA0B,KAAK,SAAS,yBACxC,GAAGC,CACP,EAAGE,CAAM,EACTP,EAAO,KAAK,SAAS,CACzB,CAUA,MAAa,wBAAwBQ,EAAM,OAAO,SAAS,KAAgC,CACvF,IAAMR,EAAS,KAAK,QAAQ,OAAO,yBAAyB,EACtDuB,EAAW,MAAM,KAAK,YAAYf,CAAG,EAC3C,OAAAR,EAAO,KAAK,SAAS,EACduB,CACX,CAOA,MAAa,aAAarB,EAAyB,CAAC,EAAkB,CAClE,IAAMF,EAAS,KAAK,QAAQ,OAAO,cAAc,EAC3C,CACF,oBAAAa,EACA,kBAAAC,EACA,YAAAC,EACA,GAAGV,CACP,EAAIH,EACEM,EAAM,KAAK,SAAS,+BAEpBD,EAAS,MAAM,KAAK,gBAAgB,QAAQ,CAAE,oBAAAM,EAAqB,kBAAAC,EAAmB,YAAAC,CAAY,CAAC,EACzG,MAAM,KAAK,SAAS,CAChB,aAAc,OACd,yBAA0BP,EAM1B,MAAOA,GAAO,KAAO,OAAY,CAAC,EAClC,GAAGH,CACP,EAAGE,CAAM,EACTP,EAAO,KAAK,SAAS,CACzB,CAUA,MAAa,qBAAqBQ,EAAM,OAAO,SAAS,KAAMS,EAAW,GAAsB,CAC3F,IAAMjB,EAAS,KAAK,QAAQ,OAAO,sBAAsB,EACzD,MAAM,KAAK,gBAAgB,SAASQ,EAAK,CAAE,SAAAS,CAAS,CAAC,EACrDjB,EAAO,KAAK,SAAS,CACzB,CAEA,MAAgB,SAASE,EAAgCK,EAA2C,CAChG,IAAMkB,EAAc,MAAM,KAAK,cAAcvB,EAAMK,CAAM,EACzD,OAAO,MAAM,KAAK,YAAYkB,EAAY,GAAG,CACjD,CAEA,MAAgB,cAAcvB,EAAiC,CAAC,EAAGK,EAA4C,CAzoBnH,IAAAJ,EA0oBQ,IAAMH,EAAS,KAAK,QAAQ,OAAO,eAAe,EAElD,GAAI,CACA,IAAMC,EAAO,MAAM,KAAK,UAAU,EAClCD,EAAO,MAAM,kCAAkC,EAE3C,KAAK,SAAS,uBACd,MAAM,KAAK,gBAAgBC,CAAI,EAGnC,IAAM6B,EAAW5B,EAAK,eAAiBD,GAAQA,EAAK,SAChD6B,IACA9B,EAAO,MAAM,0CAA0C,EACvDE,EAAK,cAAgB4B,GAGzB,MAAM,KAAK,WAAW,EACtB9B,EAAO,MAAM,wCAAwC,EAErD,IAAM+B,EAAiB,MAAM,KAAK,QAAQ,qBAAqB7B,CAAI,EACnE,OAAAF,EAAO,MAAM,qBAAqB,EAE3B,MAAMO,EAAO,SAAS,CACzB,IAAKwB,EAAe,IACpB,OAAO5B,EAAA4B,EAAe,QAAf,YAAA5B,EAAsB,GAC7B,aAAc,KAAK,SAAS,kBAChC,CAAC,CACL,OAASwB,EAAK,CACV,MAAA3B,EAAO,MAAM,2DAA2D,EACxEO,EAAO,MAAM,EACPoB,CACV,CACJ,CAEA,MAAgB,YAAYnB,EAAuC,CAC/D,IAAMR,EAAS,KAAK,QAAQ,OAAO,aAAa,EAC1CgC,EAAkB,MAAM,KAAK,QAAQ,uBAAuBxB,CAAG,EACrE,OAAAR,EAAO,MAAM,sBAAsB,EAE5BgC,CACX,CAOA,MAAa,cAAc9B,EAA0B,CAAC,EAAkB,CAzrB5E,IAAAC,EA0rBQ,IAAMH,EAAS,KAAK,QAAQ,OAAO,eAAe,EAC5C,CACF,8BAAAmB,EACA,GAAGd,CACP,EAAIH,EAEE+B,EAAgB,KAAK,SAAS,+BAC7B9B,EAAA,MAAM,KAAK,UAAU,IAArB,YAAAA,EAAyB,SAC1B,OAEAK,EAAM,KAAK,SAAS,+BACpBD,EAAS,MAAM,KAAK,iBAAiB,QAAQ,CAAE,8BAAAY,CAA8B,CAAC,EACpF,MAAM,KAAK,SAAS,CAChB,aAAc,OACd,yBAA0BX,EAC1B,cAAeyB,EACf,GAAG5B,CACP,EAAGE,CAAM,EAETP,EAAO,KAAK,SAAS,CACzB,CAUA,MAAa,sBAAsBQ,EAAM,OAAO,SAAS,KAAqB,CAC1E,IAAMR,EAAS,KAAK,QAAQ,OAAO,uBAAuB,EAC1D,MAAM,KAAK,iBAAiB,SAASQ,CAAG,EACxCR,EAAO,KAAK,SAAS,CACzB,CAEA,MAAa,aAAakC,EAA0C,CAChE,IAAMjC,EAAO,MAAM,KAAK,UAAU,EAClC,MAAM,KAAK,gBAAgBA,EAAMiC,CAAK,CAC1C,CAEA,MAAgB,gBAAgBjC,EAAmBiC,EAAQ,KAAK,SAAS,iBAAiC,CACtG,IAAMlC,EAAS,KAAK,QAAQ,OAAO,iBAAiB,EACpD,GAAI,CAACC,EAAM,OAEX,IAAMkC,EAAeD,EAAM,OAAOE,GAAQ,OAAOnC,EAAKmC,CAAI,GAAM,QAAQ,EAExE,GAAI,CAACD,EAAa,OAAQ,CACtBnC,EAAO,MAAM,sCAAsC,EACnD,MACJ,CAGA,QAAWoC,KAAQD,EACf,MAAM,KAAK,QAAQ,YACflC,EAAKmC,CAAI,EACTA,CACJ,EACApC,EAAO,KAAK,GAAGoC,CAAI,uBAAuB,EACtCA,IAAS,iBACTnC,EAAKmC,CAAI,EAAI,MAIrB,MAAM,KAAK,UAAUnC,CAAI,EACzBD,EAAO,MAAM,aAAa,EAC1B,MAAM,KAAK,QAAQ,KAAKC,CAAI,CAChC,CAKO,kBAAyB,CAC5B,KAAK,QAAQ,OAAO,kBAAkB,EACjC,KAAK,oBAAoB,MAAM,CACxC,CAKO,iBAAwB,CAC3B,KAAK,oBAAoB,KAAK,CAClC,CAEA,IAAc,eAAwB,CAClC,MAAO,QAAQ,KAAK,SAAS,SAAS,IAAI,KAAK,SAAS,SAAS,EACrE,CAEA,MAAgB,WAAkC,CAC9C,IAAMD,EAAS,KAAK,QAAQ,OAAO,WAAW,EACxCqC,EAAgB,MAAM,KAAK,SAAS,UAAU,IAAI,KAAK,aAAa,EAC1E,OAAIA,GACArC,EAAO,MAAM,2BAA2B,EACjCwB,EAAK,kBAAkBa,CAAa,IAG/CrC,EAAO,MAAM,uBAAuB,EAC7B,KACX,CAEA,MAAa,UAAUC,EAAkC,CACrD,IAAMD,EAAS,KAAK,QAAQ,OAAO,WAAW,EAC9C,GAAIC,EAAM,CACND,EAAO,MAAM,cAAc,EAC3B,IAAMqC,EAAgBpC,EAAK,gBAAgB,EAC3C,MAAM,KAAK,SAAS,UAAU,IAAI,KAAK,cAAeoC,CAAa,CACvE,MACI,KAAK,QAAQ,MAAM,eAAe,EAClC,MAAM,KAAK,SAAS,UAAU,OAAO,KAAK,aAAa,EACnD,KAAK,SAAS,MACd,MAAM,KAAK,SAAS,KAAK,MAAM,OAAO,KAAK,SAAS,SAAS,CAGzE,CAKA,MAAa,iBAAiC,CAC1C,MAAM,KAAK,QAAQ,gBAAgB,CACvC,CAaA,MAAa,UAAU7B,EAAaP,EAAYqC,EAAqBC,EAA6C,CA/zBtH,IAAApC,EAAAe,EAg0BQ,IAAMsB,EAAY,OAAMtB,GAAAf,EAAA,KAAK,SAAS,OAAd,YAAAA,EAAoB,QAApB,YAAAe,EAA2B,IAAI,KAAK,SAAS,YACrE,GAAIsB,EACA,OAAO,MAAMC,EAAY,kBAAkB,CACvC,IAAAjC,EACA,YAAaP,GAAA,YAAAA,EAAM,aACnB,WAAYqC,EACZ,QAASE,EAAU,KACnB,MAAAD,CACJ,CAAC,CAGT,CAEA,MAAM,gBAAgBG,EAAyD,CAC3E,IAAIF,EAAY,MAAME,EAAa,MAAM,IAAI,KAAK,SAAS,SAAS,EACpE,GAAI,CAACF,EAAW,CACZ,IAAMG,EAAW,MAAMF,EAAY,iBAAiB,EACpDD,EAAY,IAAII,EAAUD,CAAQ,EAClC,MAAMD,EAAa,MAAM,IAAI,KAAK,SAAS,UAAWF,CAAS,CACnE,CACA,OAAO,MAAMC,EAAY,gBAAgBD,EAAU,IAAI,CAC3D,CACJ,ECp1BE,IAAAK,GAAW,QCIN,IAAMC,GAAkBC,GCCxB,IAAMC,GAAN,KAA8C,CAA9C,cACH,KAAS,QAAkB,OAC3B,KAAS,WAAqB,OAE9B,MAAa,IAAIC,EAAaC,EAAiC,CAE3D,MADc,MAAM,KAAK,YAAY,KAAK,QAAS,KAAK,UAAU,GACtD,YAAcC,IACtBA,EAAI,IAAID,EAAOD,CAAG,EACX,KAAK,iBAAiBE,EAAI,WAAW,EAC/C,CACL,CAEA,MAAa,IAAIF,EAAiC,CAE9C,OAAO,MADO,MAAM,KAAK,YAAY,KAAK,QAAS,KAAK,UAAU,GAC/C,WAAaE,GACrB,KAAK,iBAAiBA,EAAI,IAAIF,CAAG,CAAC,CAC5C,CACL,CAEA,MAAa,OAAOA,EAAiC,CACjD,IAAMG,EAAO,MAAM,KAAK,IAAIH,CAAG,EAE/B,aADc,MAAM,KAAK,YAAY,KAAK,QAAS,KAAK,UAAU,GACtD,YAAcE,GACf,KAAK,iBAAiBA,EAAI,OAAOF,CAAG,CAAC,CAC/C,EACMG,CACX,CAEA,MAAa,YAAgC,CAEzC,OAAO,MADO,MAAM,KAAK,YAAY,KAAK,QAAS,KAAK,UAAU,GAC/C,WAAaD,GACrB,KAAK,iBAAiBA,EAAI,WAAW,CAAC,CAChD,CACL,CAEA,iBACIE,EAAqD,CACrD,OAAO,IAAI,QAAW,CAACC,EAASC,IAAW,CACtCF,EAA2B,WAAcA,EAA0B,UAAY,IAAMC,EAASD,EAA0B,MAAM,EAC9HA,EAA2B,QAAWA,EAA0B,QAAU,IAAME,EAAQF,EAA0B,KAAc,CACrI,CAAC,CACL,CAEA,MAAM,YACFG,EACAC,EAC4G,CAC5G,IAAMJ,EAAU,UAAU,KAAKG,CAAM,EACrCH,EAAQ,gBAAkB,IAAMA,EAAQ,OAAO,kBAAkBI,CAAS,EAC1E,IAAMC,EAAK,MAAM,KAAK,iBAA8BL,CAAO,EAE3D,MAAO,OACHM,EACAC,IACC,CAED,IAAMC,EADKH,EAAG,YAAYD,EAAWE,CAAM,EAC1B,YAAYF,CAAS,EACtC,OAAO,MAAMG,EAASC,CAAK,CAC/B,CACJ,CACJ",
+  "names": ["index_exports", "__export", "AccessTokenEvents", "CheckSessionIFrame", "DPoPState", "ErrorResponse", "ErrorTimeout", "InMemoryWebStorage", "IndexedDbDPoPStore", "Log", "Logger", "MetadataService", "OidcClient", "OidcClientSettingsStore", "SessionMonitor", "SigninResponse", "SigninState", "SignoutResponse", "State", "User", "UserManager", "UserManagerSettingsStore", "Version", "WebStorageStateStore", "nopLogger", "level", "logger", "Log", "reset", "setLevel", "value", "setLogger", "Logger", "_Logger", "_name", "args", "err", "method", "methodLogger", "name", "staticMethod", "staticLogger", "prefix", "InvalidTokenError", "b64DecodeUnicode", "str", "m", "p", "code", "base64UrlDecode", "output", "jwtDecode", "token", "options", "pos", "part", "decoded", "e", "JwtUtils", "token", "jwtDecode", "err", "Logger", "header", "payload", "privateKey", "encodedHeader", "CryptoUtils", "encodedPayload", "encodedToken", "signature", "encodedSignature", "secretKey", "UUID_V4_TEMPLATE", "toBase64", "val", "chr", "_CryptoUtils", "arr", "c", "code_verifier", "data", "hashed", "err", "Logger", "client_id", "client_secret", "alg", "message", "msgUint8", "hashBuffer", "jwk", "jsonObject", "utf8encodedAndHashed", "url", "accessToken", "httpMethod", "keyPair", "nonce", "hashedToken", "encodedHash", "payload", "publicJwk", "header", "JwtUtils", "audience", "algorithm", "now", "hashFunction", "encoder", "secretKey", "input", "CryptoUtils", "Event", "_name", "Logger", "cb", "idx", "ev", "PopupUtils", "features", "_a", "_b", "_c", "width", "value", "key", "Timer", "_Timer", "Event", "Logger", "diff", "durationInSeconds", "logger", "expiration", "timerDurationInSeconds", "UrlUtils", "url", "responseMode", "params", "URL_STATE_DELIMITER", "ErrorResponse", "args", "form", "_a", "_b", "_c", "Logger", "ErrorTimeout", "message", "AccessTokenEvents", "args", "Logger", "Timer", "container", "logger", "duration", "expiring", "expired", "cb", "CheckSessionIFrame", "_callback", "_client_id", "url", "_intervalInSeconds", "_stopOnError", "Logger", "parsedUrl", "resolve", "session_state", "send", "InMemoryWebStorage", "Logger", "key", "value", "index", "ErrorDPoPNonce", "nonce", "message", "JsonService", "additionalContentTypes", "_jwtHandler", "_extraHeaders", "Logger", "input", "init", "timeoutInSeconds", "initFetch", "controller", "timeoutId", "err", "ErrorTimeout", "url", "token", "credentials", "logger", "headers", "response", "contentType", "item", "json", "ErrorResponse", "body", "basicAuth", "initCredentials", "extraHeaders", "responseText", "nonce", "ErrorDPoPNonce", "customKeys", "protectedHeaders", "preventOverride", "headerName", "content", "MetadataService", "_settings", "Logger", "JsonService", "logger", "metadata", "optional", "name", "jwks_uri", "keySet", "WebStorageStateStore", "prefix", "store", "Logger", "key", "value", "item", "len", "keys", "index", "DefaultResponseType", "DefaultScope", "DefaultClientAuthentication", "DefaultStaleStateAgeInSeconds", "OidcClientSettingsStore", "authority", "metadataUrl", "metadata", "signingKeys", "metadataSeed", "client_id", "client_secret", "response_type", "scope", "redirect_uri", "post_logout_redirect_uri", "client_authentication", "token_endpoint_auth_signing_alg", "prompt", "display", "max_age", "ui_locales", "acr_values", "resource", "response_mode", "filterProtocolClaims", "loadUserInfo", "requestTimeoutInSeconds", "staleStateAgeInSeconds", "mergeClaimsStrategy", "disablePKCE", "stateStore", "revokeTokenAdditionalContentTypes", "fetchRequestCredentials", "refreshTokenAllowedScope", "extraQueryParams", "extraTokenParams", "extraHeaders", "dpop", "omitScopeWhenRequesting", "_a", "store", "InMemoryWebStorage", "WebStorageStateStore", "UserInfoService", "_settings", "_metadataService", "Logger", "responseText", "logger", "payload", "JwtUtils", "err", "JsonService", "token", "url", "claims", "TokenClient", "_settings", "_metadataService", "Logger", "JsonService", "grant_type", "redirect_uri", "client_id", "client_secret", "extraHeaders", "args", "logger", "params", "key", "value", "basicAuth", "url", "CryptoUtils", "clientAssertion", "response", "scope", "timeoutInSeconds", "param", "_a", "ResponseValidator", "_settings", "_metadataService", "_claimsService", "Logger", "UserInfoService", "TokenClient", "response", "state", "extraHeaders", "logger", "skipUserInfo", "shouldValidateSubClaim", "_a", "_b", "hasIdToken", "ErrorResponse", "validateSub", "claims", "tokenResponse", "existingToken", "nonce", "incoming", "JwtUtils", "existing", "State", "_State", "args", "CryptoUtils", "Timer", "Logger", "storageString", "storage", "age", "logger", "cutoff", "keys", "i", "key", "item", "remove", "state", "err", "SigninState", "_SigninState", "State", "args", "code_verifier", "CryptoUtils", "code_challenge", "Logger", "storageString", "data", "_SigninRequest", "args", "url", "authority", "client_id", "redirect_uri", "response_type", "scope", "state_data", "response_mode", "request_type", "client_secret", "nonce", "url_state", "resource", "skipUserInfo", "extraQueryParams", "extraTokenParams", "disablePKCE", "dpopJkt", "omitScopeWhenRequesting", "optionalParams", "state", "SigninState", "parsedUrl", "stateParam", "URL_STATE_DELIMITER", "r", "key", "value", "Logger", "SigninRequest", "OidcScope", "SigninResponse", "params", "splitState", "URL_STATE_DELIMITER", "Timer", "value", "_a", "SignoutRequest", "url", "state_data", "id_token_hint", "post_logout_redirect_uri", "extraQueryParams", "request_type", "client_id", "url_state", "Logger", "parsedUrl", "State", "stateParam", "URL_STATE_DELIMITER", "key", "value", "SignoutResponse", "params", "splitState", "URL_STATE_DELIMITER", "DefaultProtocolClaims", "InternalRequiredProtocolClaims", "ClaimsService", "_settings", "Logger", "claims", "result", "protocolClaims", "claim", "claims1", "claims2", "values", "mergedValues", "value", "DPoPState", "keys", "nonce", "OidcClient", "settings", "metadataService", "Logger", "OidcClientSettingsStore", "MetadataService", "ClaimsService", "ResponseValidator", "TokenClient", "state", "request", "request_uri", "request_type", "id_token_hint", "login_hint", "skipUserInfo", "nonce", "url_state", "response_type", "scope", "redirect_uri", "prompt", "display", "max_age", "ui_locales", "acr_values", "resource", "response_mode", "extraQueryParams", "extraTokenParams", "dpopJkt", "omitScopeWhenRequesting", "logger", "url", "signinRequest", "SigninRequest", "signinState", "removeState", "response", "SigninResponse", "UrlUtils", "storedStateString", "SigninState", "extraHeaders", "dpopProof", "err", "ErrorDPoPNonce", "dpopStore", "keyPair", "dpopState", "CryptoUtils", "DPoPState", "username", "password", "tokenResponse", "signinResponse", "timeoutInSeconds", "_a", "allowableScopes", "s", "result", "client_id", "post_logout_redirect_uri", "SignoutRequest", "signoutState", "SignoutResponse", "ErrorResponse", "State", "token", "type", "SessionMonitor", "_userManager", "Logger", "user", "session_state", "logger", "url", "client_id", "intervalInSeconds", "stopOnError", "checkSessionIFrame", "CheckSessionIFrame", "err", "timerHandle", "session", "tmpUser", "raiseEvent", "User", "_User", "args", "_a", "Timer", "value", "expires_in", "_b", "Logger", "storageString", "messageSource", "AbstractChildWindow", "Event", "params", "logger", "url", "keepOpen", "resolve", "reject", "listener", "e", "_a", "data", "origin", "state", "UrlUtils", "channel", "reason", "dispose", "parent", "targetOrigin", "msgData", "Logger", "DefaultPopupWindowFeatures", "DefaultPopupTarget", "DefaultAccessTokenExpiringNotificationTimeInSeconds", "DefaultCheckSessionIntervalInSeconds", "DefaultSilentRequestTimeoutInSeconds", "UserManagerSettingsStore", "OidcClientSettingsStore", "args", "popup_redirect_uri", "popup_post_logout_redirect_uri", "popupWindowFeatures", "popupWindowTarget", "redirectMethod", "redirectTarget", "iframeNotifyParentOrigin", "iframeScriptOrigin", "requestTimeoutInSeconds", "silent_redirect_uri", "silentRequestTimeoutInSeconds", "automaticSilentRenew", "validateSubOnSilentRenew", "includeIdTokenInSilentRenew", "monitorSession", "monitorAnonymousSession", "checkSessionIntervalInSeconds", "query_status_response_type", "stopCheckSessionOnError", "revokeTokenTypes", "revokeTokensOnSignout", "includeIdTokenInSilentSignout", "accessTokenExpiringNotificationTimeInSeconds", "maxSilentRenewTimeoutRetries", "userStore", "store", "InMemoryWebStorage", "WebStorageStateStore", "IFrameWindow", "_IFrameWindow", "AbstractChildWindow", "silentRequestTimeoutInSeconds", "DefaultSilentRequestTimeoutInSeconds", "Logger", "iframe", "params", "timer", "ErrorTimeout", "_a", "ev", "frame", "url", "targetOrigin", "IFrameNavigator", "_settings", "Logger", "silentRequestTimeoutInSeconds", "IFrameWindow", "url", "checkForPopupClosedInterval", "second", "PopupWindow", "AbstractChildWindow", "popupWindowTarget", "DefaultPopupTarget", "popupWindowFeatures", "popupSignal", "popupAbortOnClose", "Logger", "centeredPopup", "PopupUtils", "DefaultPopupWindowFeatures", "_a", "params", "popupClosedInterval", "clearPopupClosedInterval", "url", "keepOpen", "PopupNavigator", "_settings", "Logger", "popupWindowFeatures", "popupWindowTarget", "popupSignal", "popupAbortOnClose", "PopupWindow", "url", "keepOpen", "RedirectNavigator", "_settings", "Logger", "redirectMethod", "redirectTarget", "_a", "targetWindow", "redirect", "abort", "params", "resolve", "reject", "UserManagerEvents", "AccessTokenEvents", "settings", "Logger", "Event", "user", "raiseEvent", "cb", "e", "SilentRenewService", "_userManager", "Logger", "Timer", "logger", "err", "ErrorTimeout", "maxRetries", "RefreshState", "args", "UserManager", "settings", "redirectNavigator", "popupNavigator", "iframeNavigator", "Logger", "UserManagerSettingsStore", "OidcClient", "RedirectNavigator", "PopupNavigator", "IFrameNavigator", "UserManagerEvents", "SilentRenewService", "SessionMonitor", "raiseEvent", "logger", "user", "args", "_a", "redirectMethod", "requestArgs", "dpopJkt", "handle", "url", "username", "password", "skipUserInfo", "signinResponse", "popupWindowFeatures", "popupWindowTarget", "popupSignal", "popupAbortOnClose", "keepOpen", "_b", "silentRequestTimeoutInSeconds", "state", "RefreshState", "verifySub", "response", "User", "navResponse", "extraHeaders", "err", "ErrorResponse", "signinRequest", "id_token", "signoutRequest", "signoutResponse", "id_token_hint", "types", "typesPresent", "type", "storageString", "httpMethod", "nonce", "dpopState", "CryptoUtils", "dpopSettings", "dpopKeys", "DPoPState", "version", "Version", "version", "IndexedDbDPoPStore", "key", "value", "str", "item", "request", "resolve", "reject", "dbName", "storeName", "db", "txMode", "callback", "store"]
+}