@syndew/oluso-auth 0.0.0-stage → 1.30.1

package/fesm2022/syndew-oluso-auth.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"syndew-oluso-auth.mjs","sources":["../../../../libs/auth/src/lib/auth/auth-provider.ts","../../../../libs/auth/src/lib/auth/token-rotation-channel.ts","../../../../libs/auth/src/lib/interceptors/token-refresh-retry.interceptor.ts","../../../../libs/auth/src/lib/auth/renew-aware-auth-provider.ts","../../../../libs/auth/src/lib/auth/remember-me-security-storage.ts","../../../../libs/auth/src/lib/auth/check-auth-renewing.ts","../../../../libs/auth/src/lib/stores/auth.store.ts","../../../../libs/auth/src/lib/services/auth.service.ts","../../../../libs/auth/src/lib/guards/auth.guard.ts","../../../../libs/auth/src/lib/guards/permission.guard.ts","../../../../libs/auth/src/lib/tenant-sso.ts","../../../../libs/auth/src/lib/interceptors/auth.interceptor.ts","../../../../libs/auth/src/lib/interceptors/auth-refresh.interceptor.ts","../../../../libs/auth/src/lib/interceptors/tenant.interceptor.ts","../../../../libs/auth/src/lib/interceptors/ngrok.interceptor.ts","../../../../libs/auth/src/lib/interceptors/error.interceptor.ts","../../../../libs/auth/src/lib/dpop/dpop-key.ts","../../../../libs/auth/src/lib/dpop/dpop-proof.ts","../../../../libs/auth/src/lib/dpop/dpop.interceptor.ts","../../../../libs/auth/src/lib/sdk/http-client-fetch.ts","../../../../libs/auth/src/index.ts","../../../../libs/auth/src/syndew-oluso-auth.ts"],"sourcesContent":["import { Observable, of } from 'rxjs';\nimport { Injectable } from '@angular/core';\n\nexport interface AuthRefreshResult {\n  isAuthenticated: boolean;\n  accessToken: string | null;\n}\n\n/**\n * Implemented by the host app to bridge auth concerns to whatever auth library\n * (angular-auth-oidc-client, MSAL, etc.) is in use. Keeps libs/auth free of\n * library-specific dependencies — swapping providers is a single-file change.\n */\nexport abstract class AuthProvider {\n  abstract readonly isAuthenticated$: Observable<boolean>;\n  abstract getAccessToken(): Observable<string | null>;\n  abstract forceRefreshSession(): Observable<AuthRefreshResult>;\n  /**\n   * Refreshes the session into another tenant: the library's new tokens (access and refresh) are for\n   * `tenantId`, and later refreshes stay there. Errors when the server refuses the tenant (the user has no\n   * access to it); the session stays signed in, where it was.\n   */\n  abstract switchTenant(tenantId: string): Observable<AuthRefreshResult>;\n  abstract authorize(): void;\n}\n\n@Injectable({ providedIn: 'root' })\nexport class NoOpAuthProvider extends AuthProvider {\n  readonly isAuthenticated$ = of(false);\n  getAccessToken(): Observable<string | null> { return of(null); }\n  forceRefreshSession(): Observable<AuthRefreshResult> {\n    return of({ isAuthenticated: false, accessToken: null });\n  }\n  switchTenant(): Observable<AuthRefreshResult> {\n    return of({ isAuthenticated: false, accessToken: null });\n  }\n  authorize(): void { /* no-op */ }\n}\n","import { InjectionToken } from '@angular/core';\n\n/**\n * Tells the app's other tabs when a refresh token has been spent, and hands them what it was exchanged for.\n *\n * Refresh tokens are single use. Tabs can hold the same one: a duplicated tab starts with a copy of its\n * opener's session, and remembered sign-ins share one store across every tab. When one tab redeems it, the\n * others must take the rotated tokens rather than present the spent one, which the server refuses.\n *\n * The tokens travel encrypted under a key derived from the spent refresh token, so only a tab that already\n * held that token can read them; any other tab of the app (another user's session-only sign-in, say) learns\n * nothing. An answer is kept for {@link ROTATION_ANSWER_TTL_MS}, well inside the 120 s the OIDC client\n * allows between an ID token being issued and accepted.\n */\n\n/** The token entries of the OIDC client's stored state, as written after a refresh. */\nexport type RotatedTokens = Record<string, unknown>;\n\nexport const ROTATION_ANSWER_TTL_MS = 60_000;\n\nconst CHANNEL_NAME = 'oluso.token-rotation';\n\ninterface RotationMessage {\n  type: 'rotated';\n  /** Identifies the spent refresh token without revealing it. */\n  id: string;\n  iv: ArrayBuffer;\n  ciphertext: ArrayBuffer;\n}\n\ninterface Answer {\n  readonly iv: ArrayBuffer;\n  readonly ciphertext: ArrayBuffer;\n  readonly at: number;\n}\n\ntype Waiter = () => void;\n\ninterface Publication {\n  readonly done: Promise<void>;\n  readonly resolve: () => void;\n}\n\nexport class TokenRotationChannel {\n  private readonly answers = new Map<string, Answer>();\n  private readonly waiters = new Map<string, Set<Waiter>>();\n  private readonly publications = new Map<string, Publication>();\n  private readonly listeners = new Set<(id: string) => void>();\n  private readonly channel: BroadcastChannel | null;\n\n  constructor(channelName = CHANNEL_NAME) {\n    this.channel = typeof BroadcastChannel === 'undefined' ? null : new BroadcastChannel(channelName);\n    this.channel?.addEventListener('message', (event: MessageEvent<RotationMessage>) => {\n      const message = event.data;\n      if (message?.type !== 'rotated') return;\n      this.remember(message.id, { iv: message.iv, ciphertext: message.ciphertext, at: Date.now() });\n      this.listeners.forEach((listener) => listener(message.id));\n    });\n  }\n\n  /**\n   * Records that `spentRefreshToken` was exchanged for `tokens` and tells the other tabs. Resolves once the\n   * other tabs have been told.\n   */\n  async publish(spentRefreshToken: string, tokens: RotatedTokens): Promise<void> {\n    const id = await rotationId(spentRefreshToken);\n    const key = await rotationKey(spentRefreshToken);\n    const iv = crypto.getRandomValues(new Uint8Array(12)).buffer;\n    const ciphertext = await crypto.subtle.encrypt({ name: 'AES-GCM', iv }, key, new TextEncoder().encode(JSON.stringify(tokens)));\n    this.remember(id, { iv, ciphertext, at: Date.now() });\n    this.channel?.postMessage({ type: 'rotated', id, iv, ciphertext } satisfies RotationMessage);\n    this.publication(spentRefreshToken).resolve();\n  }\n\n  /** Resolves once this tab has published the rotation of `refreshToken`, or after `timeoutMs`. */\n  awaitPublished(refreshToken: string, timeoutMs: number): Promise<void> {\n    return new Promise<void>((resolve) => {\n      const timer = setTimeout(resolve, timeoutMs);\n      void this.publication(refreshToken).done.then(() => { clearTimeout(timer); resolve(); });\n    });\n  }\n\n  /** What `refreshToken` was exchanged for, in this tab or another, while that answer is fresh; else null. */\n  async answerFor(refreshToken: string): Promise<RotatedTokens | null> {\n    const id = await rotationId(refreshToken);\n    const answer = this.answers.get(id);\n    if (!answer || Date.now() - answer.at > ROTATION_ANSWER_TTL_MS) return null;\n    try {\n      const plain = await crypto.subtle.decrypt({ name: 'AES-GCM', iv: answer.iv }, await rotationKey(refreshToken), answer.ciphertext);\n      return JSON.parse(new TextDecoder().decode(plain)) as RotatedTokens;\n    } catch {\n      return null;\n    }\n  }\n\n  /** {@link answerFor}, waiting up to `timeoutMs` for another tab's rotation of `refreshToken` to arrive. */\n  async waitForAnswer(refreshToken: string, timeoutMs: number): Promise<RotatedTokens | null> {\n    const id = await rotationId(refreshToken);\n    if (!this.answers.has(id)) {\n      await new Promise<void>((resolve) => {\n        const waiter = () => { clearTimeout(timer); this.waiters.get(id)?.delete(waiter); resolve(); };\n        const timer = setTimeout(waiter, timeoutMs);\n        const set = this.waiters.get(id) ?? new Set<Waiter>();\n        set.add(waiter);\n        this.waiters.set(id, set);\n      });\n    }\n    return this.answerFor(refreshToken);\n  }\n\n  /** Calls `listener` with the id of every rotation that arrives from another tab. Returns the unsubscribe. */\n  onRotation(listener: (id: string) => void): () => void {\n    this.listeners.add(listener);\n    return () => this.listeners.delete(listener);\n  }\n\n  /** Whether `refreshToken` is the token a rotation with `id` spent. */\n  async isSpentBy(refreshToken: string, id: string): Promise<boolean> {\n    return (await rotationId(refreshToken)) === id;\n  }\n\n  private remember(id: string, answer: Answer): void {\n    this.answers.set(id, answer);\n    setTimeout(() => { if (this.answers.get(id) === answer) this.answers.delete(id); }, ROTATION_ANSWER_TTL_MS);\n    this.waiters.get(id)?.forEach((wake) => wake());\n  }\n\n  private publication(refreshToken: string): Publication {\n    let publication = this.publications.get(refreshToken);\n    if (!publication) {\n      let resolve!: () => void;\n      const done = new Promise<void>((r) => (resolve = r));\n      publication = { done, resolve };\n      this.publications.set(refreshToken, publication);\n      setTimeout(() => this.publications.delete(refreshToken), ROTATION_ANSWER_TTL_MS);\n    }\n    return publication;\n  }\n}\n\n/** The channel the app's token storage and refresh interceptor share. */\nexport const tokenRotationChannel = new TokenRotationChannel();\n\n/** Overrides {@link tokenRotationChannel} for the token storage (tests stand up one per simulated tab). */\nexport const TOKEN_ROTATION_CHANNEL = new InjectionToken<TokenRotationChannel>('TOKEN_ROTATION_CHANNEL');\n\nasync function rotationId(refreshToken: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(`oluso.rotation.id:${refreshToken}`));\n  return Array.from(new Uint8Array(digest), (b) => b.toString(16).padStart(2, '0')).join('');\n}\n\nasync function rotationKey(refreshToken: string): Promise<CryptoKey> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(`oluso.rotation.key:${refreshToken}`));\n  return crypto.subtle.importKey('raw', digest, 'AES-GCM', false, ['encrypt', 'decrypt']);\n}\n","import { HttpErrorResponse, HttpEvent, HttpInterceptorFn, HttpRequest, HttpResponse } from '@angular/common/http';\nimport { Observable, ReplaySubject, catchError, filter, lastValueFrom, throwError, timer } from 'rxjs';\nimport { map, retry } from 'rxjs/operators';\nimport { ROTATION_ANSWER_TTL_MS, tokenRotationChannel, type RotatedTokens, type TokenRotationChannel } from '../auth/token-rotation-channel';\n\n/**\n * Statuses meaning the token endpoint was briefly unavailable — a proxy or load balancer answering while the\n * server restarts or deploys, a gateway timeout, or throttling — rather than refusing the grant.\n */\nconst TRANSIENT_STATUSES = new Set([408, 429, 502, 503, 504]);\n\n/** Longest wait between retries of our own choosing; short, so a renew follows the server back promptly. */\nconst MAX_BACKOFF_MS = 10_000;\n\n/** Longest Retry-After honoured. */\nconst MAX_RETRY_AFTER_MS = 30_000;\n\n/** How long a tab that has just finished a refresh may take to publish its rotation before another tab gives up waiting. */\nconst ROTATION_SETTLE_MS = 500;\n\n/** How long a refresh keeps other tabs waiting for its rotation to be stored and published. */\nconst PUBLISH_TIMEOUT_MS = 10_000;\n\ninterface RefreshExchange {\n  readonly events$: Observable<HttpEvent<unknown>>;\n  receivedAt: number | null;\n}\n\n/** Refresh exchanges in this tab by the refresh token they redeem, while running and for a while after they answer. */\nconst exchanges = new Map<string, RefreshExchange>();\n\n/**\n * Makes each refresh token redeem exactly once across all of the app's tabs, and keeps that redemption alive\n * through a brief server outage.\n *\n * Refresh tokens are single use. Three things would otherwise present one twice:\n * - the OIDC client abandons a renew it considers slow (its periodic check cancels the request every few\n *   seconds) and later starts another with the same token;\n * - in one tab, a 401 and the background renew can both ask for a refresh;\n * - tabs can hold the same token (a duplicated tab copies its opener's session; remembered sessions share one\n *   store), and each renews on its own timer.\n * So one exchange runs per refresh token whether or not its caller still listens, refreshes are taken in turn\n * across tabs under a Web Lock, and a request for a token another exchange already redeemed — here or in\n * another tab ({@link tokenRotationChannel}) — is answered with what it was exchanged for, its lifetime\n * counted from when the server issued it.\n *\n * The client also deletes the session on any HTTP error, so a 502 from the proxy while the API restarts would\n * sign the user out although the refresh token is still good. Transient statuses are retried after the\n * server's Retry-After (up to 30 s), else 1 s doubling to 10 s; a refusal such as invalid_grant still reaches\n * the client.\n */\nexport const tokenRefreshRetryInterceptor: HttpInterceptorFn = (req, next) => {\n  const refreshToken = refreshTokenOf(req);\n  if (refreshToken === null) return next(req);\n\n  if (pendingTenantSwitch !== null) {\n    req = withTenant(req, pendingTenantSwitch);\n    pendingTenantSwitch = null;\n  }\n\n  // A tenant switch is its own request: another exchange of the same refresh token answered for the tenant\n  // the session was in, which is not what the switch asked for.\n  const key = exchangeKey(req, refreshToken);\n  let exchange = exchanges.get(key);\n  if (!exchange) {\n    exchange = startExchange(req, refreshToken, key, (r) => next(r), tokenRotationChannel);\n    exchanges.set(key, exchange);\n  }\n\n  const current = exchange;\n  return current.events$.pipe(\n    map((event) => (event instanceof HttpResponse && current.receivedAt !== null ? aged(event, Date.now() - current.receivedAt) : event))\n  );\n};\n\nfunction startExchange(\n  req: HttpRequest<unknown>,\n  refreshToken: string,\n  key: string,\n  send: (req: HttpRequest<unknown>) => Observable<HttpEvent<unknown>>,\n  rotations: TokenRotationChannel\n): RefreshExchange {\n  const events$ = new ReplaySubject<HttpEvent<unknown>>(1);\n  const exchange: RefreshExchange = { events$, receivedAt: null };\n  const answer = (response: HttpResponse<unknown>) => {\n    exchange.receivedAt = Date.now();\n    events$.next(response);\n    events$.complete();\n  };\n\n  void withRefreshLock(clientIdOf(req), async (waited) => {\n    const handedOver = waited\n      ? await rotations.waitForAnswer(refreshToken, ROTATION_SETTLE_MS)\n      : await rotations.answerFor(refreshToken);\n    let outgoing = req;\n    if (handedOver) {\n      // The refresh token was already redeemed. A plain refresh takes what it was exchanged for; a tenant\n      // switch is made with the refresh token that exchange left, since redeeming a spent one is refused.\n      const rotated = tenantOf(req) ? refreshTokenFrom(handedOver) : null;\n      if (!rotated) {\n        answer(tokenResponseFrom(handedOver));\n        return;\n      }\n      outgoing = withRefreshToken(req, rotated);\n    }\n    const exchangeOnce = (request: HttpRequest<unknown>) =>\n      send(request).pipe(\n        retry({\n          delay: (error, attempt) =>\n            isTransient(error) ? timer(refreshRetryDelayMs(error, attempt)) : throwError(() => error),\n        }),\n        filter((event): event is HttpResponse<unknown> => event instanceof HttpResponse)\n      );\n    // A refused tenant switch leaves the refresh token unspent, so the session refreshes where it is instead:\n    // the client signs the user out on any failed refresh, and a switch that is not allowed must not do that.\n    const response = await lastValueFrom(\n      exchangeOnce(outgoing).pipe(\n        catchError((error: unknown) =>\n          tenantOf(outgoing) && isRefusal(error) ? exchangeOnce(withoutTenant(outgoing)) : throwError(() => error)\n        )\n      )\n    );\n    answer(response);\n    await rotations.awaitPublished(refreshToken, PUBLISH_TIMEOUT_MS);\n  }).then(\n    () => setTimeout(() => exchanges.delete(key), ROTATION_ANSWER_TTL_MS),\n    (error) => {\n      exchanges.delete(key);\n      events$.error(error);\n    }\n  );\n\n  return exchange;\n}\n\n/**\n * Runs `work` holding the app-wide refresh lock for `clientId`, telling it whether it had to wait for another\n * tab. Browsers without Web Locks run it unserialised, which leaves only this tab's own exchanges deduplicated.\n */\nasync function withRefreshLock(clientId: string, work: (waited: boolean) => Promise<void>): Promise<void> {\n  const locks = typeof navigator === 'undefined' ? undefined : navigator.locks;\n  if (!locks) return work(false);\n  const name = `oluso.token-refresh:${clientId}`;\n  const ranImmediately = await locks.request(name, { ifAvailable: true }, async (lock) => {\n    if (!lock) return false;\n    await work(false);\n    return true;\n  });\n  if (!ranImmediately) await locks.request(name, () => work(true));\n}\n\n/** The refresh token a token request redeems, or null for any other request. */\nexport function refreshTokenOf(req: HttpRequest<unknown>): string | null {\n  if (req.method !== 'POST' || typeof req.body !== 'string') return null;\n  const form = new URLSearchParams(req.body);\n  return form.get('grant_type') === 'refresh_token' ? form.get('refresh_token') : null;\n}\n\n/** The tenant the next refresh switches to, set for one request by {@link requestTenantSwitch}. */\nlet pendingTenantSwitch: string | null = null;\n\n/**\n * Makes the next refresh a switch to `tenantId` (the token endpoint's `tenant` parameter), or cancels a switch\n * not yet sent. The parameter rides that one request only: the auth library never holds it, so later refreshes\n * carry none (the refresh token remembers the tenant), and a refused switch never reaches the library as a\n * failure — it is answered by a plain refresh instead.\n */\nexport function requestTenantSwitch(tenantId: string | null): void {\n  pendingTenantSwitch = tenantId;\n}\n\n/** The tenant a refresh asks to switch to (the token endpoint's `tenant` parameter), or null. */\nfunction tenantOf(req: HttpRequest<unknown>): string | null {\n  return new URLSearchParams(req.body as string).get('tenant');\n}\n\nfunction exchangeKey(req: HttpRequest<unknown>, refreshToken: string): string {\n  const tenant = tenantOf(req);\n  return tenant ? `${refreshToken}\\ntenant:${tenant}` : refreshToken;\n}\n\n/** The refresh token another exchange left in storage, from the tokens it handed over. */\nfunction refreshTokenFrom(tokens: RotatedTokens): string | null {\n  const token = (tokens['authnResult'] as { refresh_token?: unknown } | undefined)?.refresh_token;\n  return typeof token === 'string' && token ? token : null;\n}\n\nfunction withTenant(req: HttpRequest<unknown>, tenantId: string): HttpRequest<unknown> {\n  const form = new URLSearchParams(req.body as string);\n  form.set('tenant', tenantId);\n  return req.clone({ body: form.toString() });\n}\n\nfunction withoutTenant(req: HttpRequest<unknown>): HttpRequest<unknown> {\n  const form = new URLSearchParams(req.body as string);\n  form.delete('tenant');\n  return req.clone({ body: form.toString() });\n}\n\n/** The token endpoint turning the request down (invalid_request, access_denied), as opposed to failing. */\nfunction isRefusal(error: unknown): boolean {\n  return error instanceof HttpErrorResponse && error.status === 400;\n}\n\nfunction withRefreshToken(req: HttpRequest<unknown>, refreshToken: string): HttpRequest<unknown> {\n  const form = new URLSearchParams(req.body as string);\n  form.set('refresh_token', refreshToken);\n  return req.clone({ body: form.toString() });\n}\n\nfunction clientIdOf(req: HttpRequest<unknown>): string {\n  return new URLSearchParams(req.body as string).get('client_id') ?? '';\n}\n\n/** Wait before retry number `attempt` (1-based): the server's Retry-After seconds when it sends them (at most\n * 30 s), else 1 s doubling to 10 s. */\nexport function refreshRetryDelayMs(error: HttpErrorResponse, attempt: number): number {\n  const retryAfterSeconds = Number(error.headers?.get('Retry-After'));\n  return Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0\n    ? Math.min(retryAfterSeconds * 1000, MAX_RETRY_AFTER_MS)\n    : Math.min(1000 * 2 ** (attempt - 1), MAX_BACKOFF_MS);\n}\n\n/** The token response a refresh produced, rebuilt from the tokens it left in storage. */\nfunction tokenResponseFrom(tokens: RotatedTokens): HttpResponse<unknown> {\n  const authnResult = (tokens['authnResult'] ?? {}) as Record<string, unknown>;\n  const expiresAt = Number(tokens['access_token_expires_at']);\n  const body = Number.isFinite(expiresAt) && expiresAt > 0\n    ? { ...authnResult, expires_in: Math.max(Math.floor((expiresAt - Date.now()) / 1000), 1) }\n    : authnResult;\n  return new HttpResponse({ status: 200, body });\n}\n\n/** A token response handed out `elapsedMs` after it arrived: its lifetimes count from when the server issued it. */\nfunction aged(response: HttpResponse<unknown>, elapsedMs: number): HttpResponse<unknown> {\n  const body = response.body as { expires_in?: unknown } | null;\n  const elapsedSeconds = Math.floor(elapsedMs / 1000);\n  if (elapsedSeconds <= 0 || !body || typeof body.expires_in !== 'number') return response;\n  return response.clone({ body: { ...body, expires_in: Math.max(body.expires_in - elapsedSeconds, 1) } });\n}\n\nfunction isTransient(error: unknown): error is HttpErrorResponse {\n  return error instanceof HttpErrorResponse && TRANSIENT_STATUSES.has(error.status);\n}\n","import { Observable, defer, of, Subject, throwError } from 'rxjs';\nimport { catchError, finalize, map, switchMap, take, timeout } from 'rxjs/operators';\nimport { AuthProvider, AuthRefreshResult } from './auth-provider';\nimport { requestTenantSwitch } from '../interceptors/token-refresh-retry.interceptor';\n\n/**\n * Serialises token refreshes against the auth library's own background renew.\n *\n * With silent renew on, the library refreshes on a timer. If an API call fails\n * with 401 while that renew is still in flight, a second refresh request is\n * declined by the library, which reports \"no session\" even though the renew is\n * about to succeed. Left alone, the interceptor would treat that as a signed-out\n * user and redirect to login. Instead, wait for the running renew to settle and\n * answer with the token it produced.\n *\n * Library-agnostic: the adapter supplies the \"renew started\" and \"renew settled\"\n * streams and the single-shot refresh call.\n */\nexport abstract class RenewAwareAuthProvider extends AuthProvider {\n  /** How long to wait for a running renew before giving up; matches the library's own timeout. */\n  protected renewWaitMs = 20_000;\n\n  private renewInFlight = false;\n  private readonly settled$ = new Subject<boolean>();\n\n  /** One refresh attempt through the library. Reports unauthenticated when the library declines. */\n  protected abstract refreshOnce(): Observable<AuthRefreshResult>;\n\n  /**\n   * Adapters call this once, in their constructor, with the library's events:\n   * `started$` whenever a background renew begins, `settled$` with true/false\n   * whenever a renew (or any authentication result) completes.\n   */\n  protected trackRenew(started$: Observable<unknown>, settled$: Observable<boolean>): void {\n    started$.subscribe(() => {\n      this.renewInFlight = true;\n    });\n    settled$.subscribe((ok) => {\n      this.renewInFlight = false;\n      this.settled$.next(ok);\n    });\n  }\n\n  forceRefreshSession(): Observable<AuthRefreshResult> {\n    if (this.renewInFlight) {\n      return this.awaitRenew();\n    }\n    return this.refreshOnce().pipe(\n      switchMap((result) => {\n        if (result.isAuthenticated && result.accessToken) {\n          return of(result);\n        }\n        // The library declines a refresh while its own renew is running; if one\n        // started since we checked, its outcome is the answer, not this refusal.\n        return this.renewInFlight ? this.awaitRenew() : of(result);\n      })\n    );\n  }\n\n  /**\n   * A refresh that switches tenant: {@link requestTenantSwitch} adds the token endpoint's `tenant` parameter to\n   * that one refresh request, outside the library, so the library neither keeps it for later refreshes nor sees\n   * a refusal (which it would answer by signing the user out). A renew already running is let finish first, so\n   * the switch redeems the refresh token it leaves behind. Errors unless the new token is for `tenantId`; the\n   * session is left where it was.\n   */\n  switchTenant(tenantId: string): Observable<AuthRefreshResult> {\n    const ready: Observable<unknown> = this.renewInFlight ? this.awaitRenew() : of(null);\n    return ready.pipe(\n      switchMap(() =>\n        defer(() => {\n          requestTenantSwitch(tenantId);\n          return this.refreshOnce();\n        }).pipe(finalize(() => requestTenantSwitch(null)))\n      ),\n      switchMap((result) =>\n        result.isAuthenticated && result.accessToken && tenantOfToken(result.accessToken) === tenantId\n          ? of(result)\n          : throwError(() => new Error(`The session was not switched to tenant ${tenantId}`))\n      )\n    );\n  }\n\n  private awaitRenew(): Observable<AuthRefreshResult> {\n    return this.settled$.pipe(\n      take(1),\n      timeout(this.renewWaitMs),\n      catchError(() => of(false)),\n      switchMap((ok) =>\n        ok\n          ? this.getAccessToken().pipe(\n              take(1),\n              map((token) => ({ isAuthenticated: !!token, accessToken: token ?? null }))\n            )\n          : of({ isAuthenticated: false, accessToken: null })\n      )\n    );\n  }\n}\n\n/** The tenant an access token is for (its `tenant_id` claim), or null when it names none or is not a JWT. */\nexport function tenantOfToken(accessToken: string): string | null {\n  const part = accessToken.split('.')[1];\n  if (!part) return null;\n  try {\n    const json = atob(part.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(part.length / 4) * 4, '='));\n    const tenant = (JSON.parse(json) as { tenant_id?: unknown }).tenant_id;\n    return typeof tenant === 'string' ? tenant : null;\n  } catch {\n    return null;\n  }\n}\n","import { Inject, Injectable, Optional } from '@angular/core';\nimport { TOKEN_ROTATION_CHANNEL, TokenRotationChannel, tokenRotationChannel, type RotatedTokens } from './token-rotation-channel';\n\nconst REMEMBER_ME_CLAIM = 'remember_me';\n\n/** The entries of the stored state a refresh replaces; the rest (flow state, endpoints, keys) stays per tab. */\nconst TOKEN_ENTRIES = ['authnResult', 'authzData', 'access_token_expires_at', 'userData', 'session_state'];\n\n/**\n * The OIDC client stores a refresh result in several writes (the token response first, the access token and\n * its expiry after), so a rotation is published once writes to that state have been quiet this long.\n */\nconst ROTATION_SETTLE_MS = 100;\n\n/**\n * Token storage that follows the user's \"Remember me\" choice at sign-in.\n *\n * The OIDC client hands this one JSON blob per configuration. Until sign-in\n * completes the blob only holds the pending state (nonce, code verifier) and\n * stays in session storage, which the callback in the same tab can read. Once\n * the blob contains a token response, the ID token says whether the sign-in was\n * remembered: remembered sessions move to local storage, so they survive a\n * browser restart and are shared across tabs; session-only sign-ins stay per\n * tab and vanish when it closes. Sign-out removes both copies.\n *\n * Refresh tokens are single use, and tabs can hold the same one (a duplicated\n * tab starts with a copy of its opener's session; remembered sessions share\n * one store). When a write replaces the refresh token, the spent token and the\n * new tokens go to the app's other tabs; a tab still holding the spent token\n * takes the new ones, so it never presents a token the server has retired.\n *\n * Kept free of the OIDC library: it matches the storage contract by shape and\n * is registered by the app's auth provider.\n */\n@Injectable({ providedIn: 'root' })\nexport class RememberMeSecurityStorage {\n  private readonly rotations: TokenRotationChannel;\n  private readonly pendingRotations = new Map<string, { spent: string; timer: ReturnType<typeof setTimeout> }>();\n\n  constructor(@Optional() @Inject(TOKEN_ROTATION_CHANNEL) rotations?: TokenRotationChannel | null) {\n    this.rotations = rotations ?? tokenRotationChannel;\n    this.rotations.onRotation((id) => void this.adoptRotation(id));\n  }\n\n  read(key: string): string | null {\n    return safe(() => localStorage.getItem(key)) ?? safe(() => sessionStorage.getItem(key));\n  }\n\n  write(key: string, value: string): void {\n    const previous = refreshTokenOf(this.read(key));\n    this.store(key, value);\n    const current = refreshTokenOf(value);\n    const pending = this.pendingRotations.get(key);\n    const spent = pending?.spent ?? (previous && current && previous !== current ? previous : null);\n    if (!spent) return;\n    if (pending) clearTimeout(pending.timer);\n    const timer = setTimeout(() => this.publishRotation(key, spent), ROTATION_SETTLE_MS);\n    this.pendingRotations.set(key, { spent, timer });\n  }\n\n  private publishRotation(key: string, spent: string): void {\n    this.pendingRotations.delete(key);\n    const blob = this.read(key);\n    const current = refreshTokenOf(blob);\n    if (blob && current && current !== spent) void this.rotations.publish(spent, tokenEntries(blob));\n  }\n\n  /** Takes the tokens another tab rotated to, for every stored session still holding the token it spent. */\n  private async adoptRotation(id: string): Promise<void> {\n    for (const key of this.authKeys()) {\n      const blob = this.read(key);\n      const held = refreshTokenOf(blob);\n      if (!blob || !held || !(await this.rotations.isSpentBy(held, id))) continue;\n      const tokens = await this.rotations.answerFor(held);\n      if (!tokens || refreshTokenOf(this.read(key)) !== held) continue;\n      this.store(key, JSON.stringify({ ...JSON.parse(blob), ...tokens }));\n    }\n  }\n\n  private authKeys(): string[] {\n    const keys = new Set<string>();\n    for (const store of [safe(() => localStorage), safe(() => sessionStorage)]) {\n      if (!store) continue;\n      for (let i = 0; i < store.length; i++) {\n        const key = store.key(i);\n        if (key && isAuthBlob(store.getItem(key))) keys.add(key);\n      }\n    }\n    return [...keys];\n  }\n\n  private store(key: string, value: string): void {\n    if (isRememberedSession(value)) {\n      safe(() => localStorage.setItem(key, value));\n      safe(() => sessionStorage.removeItem(key));\n    } else {\n      safe(() => sessionStorage.setItem(key, value));\n      safe(() => localStorage.removeItem(key));\n    }\n  }\n\n  remove(key: string): void {\n    safe(() => localStorage.removeItem(key));\n    safe(() => sessionStorage.removeItem(key));\n  }\n\n  clear(): void {\n    // Only our blobs leave local storage; other app preferences live there too.\n    safe(() => {\n      const ours: string[] = [];\n      for (let i = 0; i < localStorage.length; i++) {\n        const key = localStorage.key(i);\n        if (key && isAuthBlob(localStorage.getItem(key))) ours.push(key);\n      }\n      ours.forEach((key) => localStorage.removeItem(key));\n    });\n    safe(() => sessionStorage.clear());\n  }\n}\n\nfunction isRememberedSession(blob: string): boolean {\n  try {\n    const parsed = JSON.parse(blob) as { authnResult?: { id_token?: unknown } } | null;\n    const idToken = parsed?.authnResult?.id_token;\n    if (typeof idToken !== 'string') return false;\n    const payload = decodeJwtPayload(idToken);\n    const flag = payload?.[REMEMBER_ME_CLAIM];\n    return flag === true || flag === 'true';\n  } catch {\n    return false;\n  }\n}\n\nfunction refreshTokenOf(blob: string | null): string | null {\n  if (!blob) return null;\n  try {\n    const token = (JSON.parse(blob) as { authnResult?: { refresh_token?: unknown } } | null)?.authnResult?.refresh_token;\n    return typeof token === 'string' && token ? token : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction tokenEntries(blob: string): RotatedTokens {\n  const parsed = JSON.parse(blob) as Record<string, unknown>;\n  return Object.fromEntries(TOKEN_ENTRIES.filter((k) => k in parsed).map((k) => [k, parsed[k]]));\n}\n\nfunction isAuthBlob(value: string | null): boolean {\n  if (!value) return false;\n  try {\n    const parsed = JSON.parse(value) as Record<string, unknown> | null;\n    return !!parsed && typeof parsed === 'object' && ('authnResult' in parsed || 'authWellKnownEndPoints' in parsed);\n  } catch {\n    return false;\n  }\n}\n\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  const part = token.split('.')[1];\n  if (!part) return null;\n  const base64 = part.replace(/-/g, '+').replace(/_/g, '/');\n  const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);\n  return JSON.parse(atob(padded)) as Record<string, unknown>;\n}\n\nfunction safe<T>(fn: () => T): T | null {\n  try {\n    return fn();\n  } catch {\n    return null;\n  }\n}\n","import { Observable, of } from 'rxjs';\nimport { catchError, switchMap, take } from 'rxjs/operators';\n\n/** The parts of the app's OIDC client the startup check needs; the library's security service fits as is. */\nexport interface StartupAuthClient<R extends { isAuthenticated: boolean }> {\n  /** Validates the stored tokens (or completes a sign-in callback) without calling the server. */\n  checkAuth(): Observable<R>;\n  /** {@link checkAuth}, then, when that finds no valid session, a refresh with the stored refresh token. */\n  checkAuthIncludingServer(): Observable<R>;\n  getRefreshToken(): Observable<string | null | undefined>;\n}\n\nconst CALLBACK_PARAMS = ['code', 'state', 'error'];\n\n/**\n * The app's startup auth check. A stored access token that has expired (or is inside the renew window) makes the\n * plain check report \"signed out\", and the app would send the user through sign-in again although the refresh\n * token is good for days. When a refresh token is stored this renews with it instead, which also restarts the\n * library's background renew. A sign-in callback is completed by the plain check alone, and a refresh the server\n * refuses (refresh token expired or revoked) leaves the user signed out, as before.\n *\n * The refresh goes through the app's HttpClient, so the token-refresh interceptor still coordinates it with the\n * app's other tabs.\n */\nexport function checkAuthRenewingSession<R extends { isAuthenticated: boolean }>(\n  client: StartupAuthClient<R>,\n  url: string = typeof window !== 'undefined' ? window.location.href : ''\n): Observable<R> {\n  return client.checkAuth().pipe(\n    switchMap((result) => {\n      if (result.isAuthenticated || isCallback(url)) return of(result);\n      return client.getRefreshToken().pipe(\n        take(1),\n        switchMap((refreshToken) =>\n          refreshToken ? client.checkAuthIncludingServer().pipe(catchError(() => of(result))) : of(result)\n        )\n      );\n    })\n  );\n}\n\nfunction isCallback(url: string): boolean {\n  if (!url) return false;\n  const params = new URL(url, 'http://localhost').searchParams;\n  return CALLBACK_PARAMS.some((p) => params.has(p));\n}\n","import { Injectable, inject, signal, computed } from '@angular/core';\nimport { toSignal } from '@angular/core/rxjs-interop';\nimport { AuthUser } from '../models/auth-user.model';\nimport { OrganizationContext } from '../models/organization-context.model';\nimport { AuthState } from '../models/auth-state.model';\nimport { AuthProvider } from '../auth/auth-provider';\nimport { tenantOfToken } from '../auth/renew-aware-auth-provider';\n\nconst STORAGE_KEY = 'oluso_auth';\n\n/**\n * Auth Store\n *\n * Signal-based authentication state management.\n * This mirrors the Zustand authSlice from the React codebase.\n *\n * Features:\n * - Persistent state via localStorage\n * - Tenant/organization context\n * - Super admin support\n */\n@Injectable({\n  providedIn: 'root',\n})\nexport class AuthStore {\n  private readonly authProvider = inject(AuthProvider);\n\n  private readonly _user = signal<AuthUser | null>(null);\n  private readonly _accessToken = signal<string | null>(null);\n  private readonly _refreshToken = signal<string | null>(null);\n  private readonly _idToken = signal<string | null>(null);\n  private readonly _isLoading = signal<boolean>(false);\n  private readonly _error = signal<string | null>(null);\n  private readonly _currentTenantId = signal<string | null>(null);\n  /** True once the user has picked a tenant in the UI; only then do requests carry X-Tenant-ID. */\n  private readonly _tenantSwitched = signal<boolean>(false);\n  private readonly _currentOrganization = signal<OrganizationContext | null>(null);\n  private readonly _isSuperAdmin = signal<boolean>(false);\n  private readonly _hasHydrated = signal<boolean>(false);\n\n  /** Read-only computed state */\n  readonly user = this._user.asReadonly();\n  readonly accessToken = this._accessToken.asReadonly();\n  readonly refreshToken = this._refreshToken.asReadonly();\n  readonly idToken = this._idToken.asReadonly();\n  readonly isLoading = this._isLoading.asReadonly();\n  readonly error = this._error.asReadonly();\n  readonly currentTenantId = this._currentTenantId.asReadonly();\n  readonly tenantSwitched = this._tenantSwitched.asReadonly();\n  readonly currentOrganization = this._currentOrganization.asReadonly();\n  readonly isSuperAdmin = this._isSuperAdmin.asReadonly();\n  readonly hasHydrated = this._hasHydrated.asReadonly();\n\n  readonly isAuthenticated = toSignal(this.authProvider.isAuthenticated$, { initialValue: false });\n\n  /** Full state snapshot */\n  readonly state = computed<AuthState>(() => ({\n    user: this._user(),\n    accessToken: this._accessToken(),\n    refreshToken: this._refreshToken(),\n    idToken: this._idToken(),\n    isAuthenticated: this.isAuthenticated(),\n    isLoading: this._isLoading(),\n    error: this._error(),\n    currentTenantId: this._currentTenantId(),\n    currentOrganization: this._currentOrganization(),\n    isSuperAdmin: this._isSuperAdmin(),\n  }));\n\n  constructor() {\n    this.hydrate();\n    // Auth-state clearing is handled explicitly by the host portal:\n    //   - /logout page's ngOnInit (post-redirect cleanup after oidcService.logoff)\n    //   - AdminAuthService.redirectToLogin() (silent-renew failure path)\n    //   - AdminAuthService.initialize() (callback / fresh-load cleanup)\n    // An automatic isAuthenticated$ → logout() subscription used to live here,\n    // but its synchronous 8-signal-write CD cascade fired during\n    // resetAuthorizationData() prevented the browser from committing the\n    // cross-origin redirect to /connect/endsession.\n  }\n\n  /**\n   * Set user and tokens after successful login.\n   * Extracts tenant_id from the JWT access token if present.\n   */\n  login(\n    user: AuthUser,\n    accessToken: string,\n    refreshToken?: string,\n    idToken?: string\n  ): void {\n    this._user.set(user);\n    this._accessToken.set(accessToken);\n    this._refreshToken.set(refreshToken ?? null);\n    this._idToken.set(idToken ?? null);\n    this._error.set(null);\n\n    this.alignTenantWithToken(accessToken);\n\n    this.persist();\n  }\n\n  /**\n   * Makes the current tenant the one the token is for. A switch mints a token for its target, so a current\n   * tenant naming any other was left by an earlier session (or another app on the origin): it is replaced, and\n   * the session counts as not switched, so requests carry no X-Tenant-ID.\n   */\n  alignTenantWithToken(accessToken: string): void {\n    const tokenTenantId = tenantOfToken(accessToken);\n    if (this._currentTenantId() !== tokenTenantId) {\n      this._currentTenantId.set(tokenTenantId);\n      this._tenantSwitched.set(false);\n      this.persist();\n    }\n  }\n\n  /**\n   * Clear authentication state on logout\n   */\n  logout(): void {\n    this._user.set(null);\n    this._accessToken.set(null);\n    this._refreshToken.set(null);\n    this._idToken.set(null);\n    this._currentTenantId.set(null);\n    this._tenantSwitched.set(false);\n    this._currentOrganization.set(null);\n    this._isSuperAdmin.set(false);\n    this._error.set(null);\n    this.clearStorage();\n  }\n\n  /**\n   * Update user information\n   */\n  setUser(user: AuthUser | null): void {\n    this._user.set(user);\n    this.persist();\n  }\n\n  /**\n   * Update access token\n   */\n  setAccessToken(token: string | null): void {\n    this._accessToken.set(token);\n    this.persist();\n  }\n\n  /**\n   * Update refresh token\n   */\n  setRefreshToken(token: string | null): void {\n    this._refreshToken.set(token);\n    this.persist();\n  }\n\n  /**\n   * Set current tenant ID (for super admin)\n   */\n  setCurrentTenantId(tenantId: string | null): void {\n    this._currentTenantId.set(tenantId);\n    this._tenantSwitched.set(tenantId !== null);\n    this.persist();\n  }\n\n  /**\n   * Adopt a tenant switch: the new context and the token minted for it.\n   *\n   * Both move together deliberately. Roles and permissions are per-tenant, so a\n   * moment where the header names one tenant and the token carries another\n   * either over-grants or under-grants — and a persist() between the two writes\n   * would make that state survive a reload.\n   */\n  switchTenant(tenantId: string, accessToken: string): void {\n    this._currentTenantId.set(tenantId);\n    this._tenantSwitched.set(true);\n    this._accessToken.set(accessToken);\n    this.persist();\n  }\n\n  /**\n   * Set current organization context\n   */\n  setCurrentOrganization(organization: OrganizationContext | null): void {\n    this._currentOrganization.set(organization);\n    this.persist();\n  }\n\n  /**\n   * Set super admin status\n   */\n  setSuperAdmin(isSuperAdmin: boolean): void {\n    this._isSuperAdmin.set(isSuperAdmin);\n    this.persist();\n  }\n\n  /**\n   * Set loading state\n   */\n  setLoading(isLoading: boolean): void {\n    this._isLoading.set(isLoading);\n  }\n\n  /**\n   * Set error message\n   */\n  setError(error: string | null): void {\n    this._error.set(error);\n  }\n\n  /**\n   * Hydrate state from localStorage\n   */\n  private hydrate(): void {\n    try {\n      const stored = localStorage.getItem(STORAGE_KEY);\n      if (stored) {\n        const data = JSON.parse(stored);\n        this._user.set(data.user ?? null);\n        this._accessToken.set(data.accessToken ?? null);\n        this._refreshToken.set(data.refreshToken ?? null);\n        this._idToken.set(data.idToken ?? null);\n        this._currentTenantId.set(data.currentTenantId ?? null);\n        this._tenantSwitched.set(data.tenantSwitched === true);\n        this._currentOrganization.set(data.currentOrganization ?? null);\n        this._isSuperAdmin.set(data.isSuperAdmin ?? false);\n      }\n    } catch {\n      // Ignore hydration errors\n    } finally {\n      this._hasHydrated.set(true);\n    }\n  }\n\n  /**\n   * Persist state to localStorage\n   */\n  private persist(): void {\n    try {\n      const data = {\n        user: this._user(),\n        accessToken: this._accessToken(),\n        refreshToken: this._refreshToken(),\n        idToken: this._idToken(),\n        currentTenantId: this._currentTenantId(),\n        tenantSwitched: this._tenantSwitched(),\n        currentOrganization: this._currentOrganization(),\n        isSuperAdmin: this._isSuperAdmin(),\n      };\n      localStorage.setItem(STORAGE_KEY, JSON.stringify(data));\n    } catch {\n      // Ignore persistence errors\n    }\n  }\n\n  /**\n   * Clear localStorage\n   */\n  private clearStorage(): void {\n    try {\n      localStorage.removeItem(STORAGE_KEY);\n    } catch {\n      // Ignore errors\n    }\n  }\n}\n","import { Injectable, inject } from '@angular/core';\nimport { HttpClient } from '@angular/common/http';\nimport { Observable, tap, catchError, throwError } from 'rxjs';\nimport { AuthStore } from '../stores/auth.store';\nimport { AuthUser } from '../models/auth-user.model';\nimport { LoginRequest } from '../models/login-request.model';\nimport { LoginResponse } from '../models/login-response.model';\nimport { TokenPayload } from '../models/token-payload.model';\n\n/**\n * Auth Service\n *\n * Handles authentication operations including login, logout, token refresh,\n * and user management.\n *\n * This mirrors the auth services from the React codebase.\n */\n@Injectable({\n  providedIn: 'root',\n})\nexport class AuthService {\n  private readonly http = inject(HttpClient);\n  private readonly authStore = inject(AuthStore);\n\n  private apiBaseUrl = '/api/admin';\n\n  /**\n   * Configure the API base URL\n   */\n  setApiBaseUrl(url: string): void {\n    this.apiBaseUrl = url;\n  }\n\n  /**\n   * Login with email and password\n   */\n  login(request: LoginRequest): Observable<LoginResponse> {\n    this.authStore.setLoading(true);\n    this.authStore.setError(null);\n\n    return this.http.post<LoginResponse>(`${this.apiBaseUrl}/auth/login`, request).pipe(\n      tap((response) => {\n        this.authStore.login(\n          response.user,\n          response.accessToken,\n          response.refreshToken,\n          response.idToken\n        );\n\n        // Set organization context from login response\n        const user = response.user;\n        if (user.organizationIds?.length && user.organizationRoles) {\n          // Pick the first org where user is owner or admin, otherwise first org\n          const adminOrgId = user.organizationIds.find(\n            (id) => user.organizationRoles?.[id] === 'owner' || user.organizationRoles?.[id] === 'admin'\n          ) ?? user.organizationIds[0];\n\n          const role = user.organizationRoles[adminOrgId];\n          this.authStore.setCurrentOrganization({\n            id: adminOrgId,\n            name: adminOrgId, // Will be resolved later if needed\n            role,\n          });\n        }\n      }),\n      catchError((error) => {\n        this.authStore.setError(error.error?.message ?? 'Login failed');\n        this.authStore.setLoading(false);\n        return throwError(() => error);\n      }),\n      tap(() => {\n        this.authStore.setLoading(false);\n      })\n    );\n  }\n\n  /**\n   * Logout the current user\n   */\n  logout(): Observable<void> {\n    const refreshToken = this.authStore.refreshToken();\n\n    return this.http\n      .post<void>(`${this.apiBaseUrl}/auth/logout`, { refreshToken })\n      .pipe(\n        tap(() => {\n          this.authStore.logout();\n        }),\n        catchError((error) => {\n          // Still logout locally even if the API call fails\n          this.authStore.logout();\n          return throwError(() => error);\n        })\n      );\n  }\n\n  /**\n   * Logout locally without API call\n   */\n  logoutLocal(): void {\n    this.authStore.logout();\n  }\n\n  /**\n   * Refresh the access token\n   */\n  refreshToken(): Observable<{ accessToken: string; refreshToken?: string }> {\n    const refreshToken = this.authStore.refreshToken();\n\n    if (!refreshToken) {\n      return throwError(() => new Error('No refresh token available'));\n    }\n\n    return this.http\n      .post<{ accessToken: string; refreshToken?: string }>(\n        `${this.apiBaseUrl}/auth/refresh`,\n        { refreshToken }\n      )\n      .pipe(\n        tap((response) => {\n          this.authStore.setAccessToken(response.accessToken);\n          if (response.refreshToken) {\n            this.authStore.setRefreshToken(response.refreshToken);\n          }\n        }),\n        catchError((error) => {\n          // If refresh fails, logout the user\n          this.authStore.logout();\n          return throwError(() => error);\n        })\n      );\n  }\n\n  /**\n   * Get the current user profile\n   */\n  getProfile(): Observable<AuthUser> {\n    return this.http.get<AuthUser>(`${this.apiBaseUrl}/auth/profile`).pipe(\n      tap((user) => {\n        this.authStore.setUser(user);\n      })\n    );\n  }\n\n  /**\n   * Update the current user profile\n   */\n  updateProfile(data: Partial<AuthUser>): Observable<AuthUser> {\n    return this.http.patch<AuthUser>(`${this.apiBaseUrl}/auth/profile`, data).pipe(\n      tap((user) => {\n        this.authStore.setUser(user);\n      })\n    );\n  }\n\n  /**\n   * Check if the current access token is expired\n   */\n  isTokenExpired(): boolean {\n    const token = this.authStore.accessToken();\n    if (!token) return true;\n\n    try {\n      const payload = this.decodeToken(token);\n      const currentTime = Math.floor(Date.now() / 1000);\n      return payload.exp < currentTime;\n    } catch {\n      return true;\n    }\n  }\n\n  /**\n   * Decode a JWT token\n   */\n  decodeToken(token: string): TokenPayload {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n      throw new Error('Invalid token format');\n    }\n\n    const payload = parts[1];\n    const decoded = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));\n    return JSON.parse(decoded) as TokenPayload;\n  }\n\n  /**\n   * Get the current access token\n   */\n  getAccessToken(): string | null {\n    return this.authStore.accessToken();\n  }\n\n  /**\n   * Check if the user is authenticated\n   */\n  isAuthenticated(): boolean {\n    return this.authStore.isAuthenticated();\n  }\n\n  /**\n   * Get the current user\n   */\n  getUser(): AuthUser | null {\n    return this.authStore.user();\n  }\n\n  /**\n   * Check if the user is a super admin\n   */\n  isSuperAdmin(): boolean {\n    return this.authStore.isSuperAdmin();\n  }\n\n  /**\n   * Get the current tenant ID\n   */\n  getCurrentTenantId(): string | null {\n    return this.authStore.currentTenantId();\n  }\n\n  /**\n   * Set the current tenant ID (for super admin)\n   */\n  setCurrentTenantId(tenantId: string | null): void {\n    this.authStore.setCurrentTenantId(tenantId);\n  }\n}\n","import { inject } from '@angular/core';\nimport { Router, CanActivateFn, ActivatedRouteSnapshot, RouterStateSnapshot } from '@angular/router';\nimport { AuthStore } from '../stores/auth.store';\nimport { PermissionsService } from '@syndew/oluso-ui-core';\n\n/**\n * Auth Guard\n *\n * Protects routes that require authentication.\n * Redirects to login if user is not authenticated.\n */\nexport const authGuard: CanActivateFn = (\n  route: ActivatedRouteSnapshot,\n  state: RouterStateSnapshot\n) => {\n  const authStore = inject(AuthStore);\n  const router = inject(Router);\n\n  if (authStore.isAuthenticated()) {\n    return true;\n  }\n\n  // Store the attempted URL for redirecting after login\n  const returnUrl = state.url;\n\n  // Redirect to the login page with the return url\n  return router.createUrlTree(['/login'], {\n    queryParams: { returnUrl },\n  });\n};\n\n/**\n * Guest Guard\n *\n * Protects routes that should only be accessible to non-authenticated users.\n * Redirects to dashboard if user is already authenticated.\n */\nexport const guestGuard: CanActivateFn = () => {\n  const authStore = inject(AuthStore);\n  const router = inject(Router);\n\n  if (!authStore.isAuthenticated()) {\n    return true;\n  }\n\n  // Redirect to dashboard if already authenticated\n  return router.createUrlTree(['/']);\n};\n\n/**\n * Super Admin Guard\n *\n * Protects routes that require super admin privileges.\n * Checks PermissionsService which is set during login/permission loading.\n */\nexport const superAdminGuard: CanActivateFn = () => {\n  const permissionsService = inject(PermissionsService);\n  const authStore = inject(AuthStore);\n  const router = inject(Router);\n\n  // Check PermissionsService first (set during login), fallback to user roles\n  if (permissionsService.isSuperAdmin()) {\n    return true;\n  }\n\n  // Fallback: check user roles directly\n  const user = authStore.user();\n  if (user?.roles?.some(r => r.toLowerCase() === 'superadmin' || r.toLowerCase() === 'systemadmin')) {\n    return true;\n  }\n\n  // Redirect to dashboard if not super admin\n  return router.createUrlTree(['/']);\n};\n\n/**\n * Org Admin Guard\n *\n * Protects routes that require org admin or super admin privileges.\n * Super admins can also access org admin routes.\n * Requires a valid organization context (currentOrganization) in the auth store.\n */\nexport const orgAdminGuard: CanActivateFn = () => {\n  const permissionsService = inject(PermissionsService);\n  const authStore = inject(AuthStore);\n  const router = inject(Router);\n\n  // Super admins can also access org admin routes\n  if (permissionsService.isSuperAdmin()) return true;\n\n  const user = authStore.user();\n  if (user?.roles?.some(r =>\n    r.toLowerCase() === 'superadmin' || r.toLowerCase() === 'systemadmin'\n  )) return true;\n\n  // Org admin: must have a current organization context set\n  const currentOrg = authStore.currentOrganization();\n  if (currentOrg?.id) return true;\n\n  return router.createUrlTree(['/']);\n};\n","import { InjectionToken, inject } from '@angular/core';\nimport { toObservable } from '@angular/core/rxjs-interop';\nimport { Router, CanActivateFn, ActivatedRouteSnapshot, UrlTree } from '@angular/router';\nimport { Observable, filter, map, of, take, timeout } from 'rxjs';\nimport { PermissionsService } from '@syndew/oluso-ui-core';\n\n/**\n * How long a permission guard waits for the app to load the current user's\n * permissions before denying. Override to tune per app.\n */\nexport const PERMISSION_GUARD_TIMEOUT_MS = new InjectionToken<number>(\n  'PERMISSION_GUARD_TIMEOUT_MS',\n  { providedIn: 'root', factory: () => 15000 }\n);\n\n/**\n * Runs `check` once permissions are authoritative for the current user, and\n * denies (redirect to /unauthorized) if they never arrive, failed to load, or\n * were cleared. Must be called from a guard's injection context.\n */\nfunction decideWhenPermissionsSettle(\n  check: (permissions: PermissionsService) => boolean\n): boolean | UrlTree | Observable<boolean | UrlTree> {\n  const permissionsService = inject(PermissionsService);\n  const router = inject(Router);\n  const waitMs = inject(PERMISSION_GUARD_TIMEOUT_MS);\n\n  const decide = (): boolean | UrlTree =>\n    permissionsService.isAuthoritative() && check(permissionsService)\n      ? true\n      : router.createUrlTree(['/unauthorized']);\n\n  if (permissionsService.isSettled()) {\n    return decide();\n  }\n\n  return toObservable(permissionsService.isSettled).pipe(\n    filter(Boolean),\n    take(1),\n    timeout({ first: waitMs, with: () => of(false) }),\n    map(() => decide())\n  );\n}\n\n/**\n * Permission Guard\n *\n * Protects routes that require specific permissions.\n * Configure the required permission in route data.\n *\n * Usage:\n * ```typescript\n * {\n *   path: 'users',\n *   component: UsersPageComponent,\n *   canActivate: [permissionGuard],\n *   data: { permission: 'users.read' }\n * }\n * ```\n */\nexport const permissionGuard: CanActivateFn = (route: ActivatedRouteSnapshot) => {\n  const permission = route.data['permission'] as string | undefined;\n  const permissions = route.data['permissions'] as string[] | undefined;\n  const requireAll = route.data['requireAll'] as boolean | undefined;\n\n  // No permission required\n  if (!permission && !permissions) {\n    return true;\n  }\n\n  return decideWhenPermissionsSettle((permissionsService) => {\n    if (permission && permissionsService.hasPermission(permission)) {\n      return true;\n    }\n    if (permissions) {\n      return requireAll\n        ? permissionsService.hasAllPermissions(permissions)\n        : permissionsService.hasAnyPermission(permissions);\n    }\n    return false;\n  });\n};\n\n/**\n * Any Permission Guard\n *\n * Allows access if user has any of the specified permissions.\n *\n * Usage:\n * ```typescript\n * {\n *   path: 'resources',\n *   component: ResourcesPageComponent,\n *   canActivate: [anyPermissionGuard],\n *   data: { permissions: ['resources.read', 'resources.write'] }\n * }\n * ```\n */\nexport const anyPermissionGuard: CanActivateFn = (route: ActivatedRouteSnapshot) => {\n  const permissions = route.data['permissions'] as string[] | undefined;\n\n  if (!permissions || permissions.length === 0) {\n    return true;\n  }\n\n  return decideWhenPermissionsSettle((permissionsService) =>\n    permissionsService.hasAnyPermission(permissions)\n  );\n};\n\n/**\n * All Permissions Guard\n *\n * Allows access only if user has all of the specified permissions.\n *\n * Usage:\n * ```typescript\n * {\n *   path: 'admin',\n *   component: AdminPageComponent,\n *   canActivate: [allPermissionsGuard],\n *   data: { permissions: ['admin.read', 'admin.write'] }\n * }\n * ```\n */\nexport const allPermissionsGuard: CanActivateFn = (route: ActivatedRouteSnapshot) => {\n  const permissions = route.data['permissions'] as string[] | undefined;\n\n  if (!permissions || permissions.length === 0) {\n    return true;\n  }\n\n  return decideWhenPermissionsSettle((permissionsService) =>\n    permissionsService.hasAllPermissions(permissions)\n  );\n};\n","/**\n * Helpers for the tenant-aware SSO landing flow shared across host portals.\n *\n * The \"Login with SSO\" affordance on the landing page resolves a tenant by\n * identifier and persists its issuer URI to sessionStorage. The host's OIDC\n * config picks that up at module load (next page navigation) so the OIDC\n * authority points at the tenant's identity-server subdomain instead of the\n * platform default. After resolve + persist, the landing reloads with\n * `pendingAuthorize` set so the post-load handler can call authorize() with\n * the right authority and the tenant's domain_hint / policy / ui_mode.\n */\n\nconst KEY_IDENTIFIER = 'oluso.tenant.identifier';\nconst KEY_ISSUER_URI = 'oluso.tenant.issuerUri';\nconst KEY_DEFAULT_IDP_SCHEME = 'oluso.tenant.defaultIdpScheme';\nconst KEY_DEFAULT_SIGN_IN_POLICY_ID = 'oluso.tenant.defaultSignInPolicyId';\nconst KEY_DEFAULT_SSO_UI_MODE = 'oluso.tenant.defaultSsoUiMode';\nconst KEY_PENDING_AUTHORIZE = 'oluso.tenant.pendingAuthorize';\n\nexport interface TenantSso {\n  identifier: string;\n  issuerUri: string;\n  defaultIdpScheme?: string;\n  defaultSignInPolicyId?: string;\n  defaultSsoUiMode?: 'Journey' | 'Standalone';\n}\n\n/**\n * Extract tenant identifier from hostname subdomain.\n * e.g., \"acme.auth.example.com\" → \"acme\"\n * Returns undefined for localhost, IP addresses, or hostnames with fewer than 3 parts.\n */\nexport function resolveTenantFromHostname(): string | undefined {\n  if (typeof window === 'undefined') return undefined;\n  const host = window.location.hostname;\n  if (host === 'localhost' || host === '127.0.0.1') return undefined;\n  if (/^\\d{1,3}(\\.\\d{1,3}){3}$/.test(host)) return undefined;\n  const parts = host.split('.');\n  if (parts.length < 3) return undefined;\n  return parts[0];\n}\n\n/**\n * Returns the tenant SSO authority persisted in sessionStorage, or the given\n * default. Safe in SSR / non-browser contexts.\n */\nexport function resolveTenantSsoAuthority(defaultAuthority: string): string {\n  if (typeof sessionStorage === 'undefined') return defaultAuthority;\n  return sessionStorage.getItem(KEY_ISSUER_URI) || defaultAuthority;\n}\n\n/**\n * Returns the tenant identifier, issuer URI, and any persisted SSO defaults,\n * or null if none is set.\n */\nexport function readTenantSso(): TenantSso | null {\n  if (typeof sessionStorage === 'undefined') return null;\n  const identifier = sessionStorage.getItem(KEY_IDENTIFIER);\n  const issuerUri = sessionStorage.getItem(KEY_ISSUER_URI);\n  if (!identifier || !issuerUri) return null;\n\n  const uiModeRaw = sessionStorage.getItem(KEY_DEFAULT_SSO_UI_MODE);\n  const uiMode = uiModeRaw === 'Journey' || uiModeRaw === 'Standalone' ? uiModeRaw : undefined;\n\n  return {\n    identifier,\n    issuerUri,\n    defaultIdpScheme: sessionStorage.getItem(KEY_DEFAULT_IDP_SCHEME) ?? undefined,\n    defaultSignInPolicyId: sessionStorage.getItem(KEY_DEFAULT_SIGN_IN_POLICY_ID) ?? undefined,\n    defaultSsoUiMode: uiMode,\n  };\n}\n\n/**\n * Persists the tenant SSO context resolved by the landing page. Set\n * `markPendingAuthorize` so the post-reload landing handler kicks off\n * authorize() with the tenant's authority + the stored hints.\n *\n * Wipes angular-auth-oidc-client's cached well-known + state on the way\n * out — the cache is keyed by config id, not authority, so switching\n * tenants would otherwise reuse the previous authority's discovery doc\n * and throw issuer-mismatch on the next authorize call.\n */\nexport function writeTenantSso(sso: TenantSso, markPendingAuthorize = false): void {\n  if (typeof sessionStorage === 'undefined') return;\n\n  clearOidcLibraryCache();\n\n  sessionStorage.setItem(KEY_IDENTIFIER, sso.identifier);\n  sessionStorage.setItem(KEY_ISSUER_URI, sso.issuerUri);\n\n  if (sso.defaultIdpScheme) {\n    sessionStorage.setItem(KEY_DEFAULT_IDP_SCHEME, sso.defaultIdpScheme);\n  } else {\n    sessionStorage.removeItem(KEY_DEFAULT_IDP_SCHEME);\n  }\n\n  if (sso.defaultSignInPolicyId) {\n    sessionStorage.setItem(KEY_DEFAULT_SIGN_IN_POLICY_ID, sso.defaultSignInPolicyId);\n  } else {\n    sessionStorage.removeItem(KEY_DEFAULT_SIGN_IN_POLICY_ID);\n  }\n\n  if (sso.defaultSsoUiMode) {\n    sessionStorage.setItem(KEY_DEFAULT_SSO_UI_MODE, sso.defaultSsoUiMode);\n  } else {\n    sessionStorage.removeItem(KEY_DEFAULT_SSO_UI_MODE);\n  }\n\n  if (markPendingAuthorize) {\n    sessionStorage.setItem(KEY_PENDING_AUTHORIZE, '1');\n  }\n}\n\nfunction clearOidcLibraryCache(): void {\n  if (typeof sessionStorage === 'undefined') return;\n  // angular-auth-oidc-client bundles a config's entire cache (well-known\n  // endpoints, authn result, in-flight state, user data) into a single\n  // sessionStorage entry keyed \"{configIndex}-{clientId}\" (e.g. \"0-admin-portal\").\n  // Match that shape: leading digits, dash, anything else. App-owned keys\n  // here are namespaced \"oluso.tenant.*\" and never collide.\n  for (const key of Object.keys(sessionStorage)) {\n    if (/^\\d+-/.test(key)) {\n      sessionStorage.removeItem(key);\n    }\n  }\n}\n\n/**\n * Build the customParams object to pass to oidcSecurityService.authorize()\n * from a remembered tenant SSO. Returns undefined if there's nothing worth\n * passing. Callers feed this into the `customParams` field of the authorize\n * call so domain_hint / policy / ui_mode reach /connect/authorize.\n */\nexport function tenantSsoAuthorizeParams(\n  sso: TenantSso,\n): Record<string, string> | undefined {\n  const params: Record<string, string> = {};\n  if (sso.defaultIdpScheme) params['domain_hint'] = sso.defaultIdpScheme;\n  if (sso.defaultSignInPolicyId) params['policy'] = sso.defaultSignInPolicyId;\n  if (sso.defaultSsoUiMode) params['ui_mode'] = sso.defaultSsoUiMode;\n  return Object.keys(params).length ? params : undefined;\n}\n\n/**\n * Returns true (and clears the flag) when a pending authorize call was queued\n * by the landing's SSO submit. Use on landing init to auto-trigger\n * oidcSecurityService.authorize() after a reload picked up the new authority.\n */\nexport function consumePendingAuthorize(): boolean {\n  if (typeof sessionStorage === 'undefined') return false;\n  if (sessionStorage.getItem(KEY_PENDING_AUTHORIZE) !== '1') return false;\n  sessionStorage.removeItem(KEY_PENDING_AUTHORIZE);\n  return true;\n}\n\n/**\n * Removes all persisted tenant SSO state. Call from logout flows and the\n * \"Use a different organisation\" affordance on the landing.\n *\n * Also clears angular-auth-oidc-client's sessionStorage cache (well-known\n * discovery doc, in-flight state) — those entries are keyed by config id,\n * not by authority URL, so without wiping them a previously-cached\n * discovery for a different tenant authority survives the switch and\n * throws an \"issuer mismatch\" on the next authorize call.\n */\nexport function clearTenantSso(): void {\n  if (typeof sessionStorage === 'undefined') return;\n  sessionStorage.removeItem(KEY_IDENTIFIER);\n  sessionStorage.removeItem(KEY_ISSUER_URI);\n  sessionStorage.removeItem(KEY_DEFAULT_IDP_SCHEME);\n  sessionStorage.removeItem(KEY_DEFAULT_SIGN_IN_POLICY_ID);\n  sessionStorage.removeItem(KEY_DEFAULT_SSO_UI_MODE);\n  sessionStorage.removeItem(KEY_PENDING_AUTHORIZE);\n  clearOidcLibraryCache();\n}\n","import { HttpInterceptorFn, HttpRequest, HttpHandlerFn, HttpEvent, HttpErrorResponse } from '@angular/common/http';\nimport { inject } from '@angular/core';\nimport { Router } from '@angular/router';\nimport { Observable, catchError, switchMap, throwError, ReplaySubject, take, timeout } from 'rxjs';\nimport { AuthStore } from '../stores/auth.store';\nimport { AuthService } from '../services/auth.service';\n\nlet isRefreshing = false;\nlet refreshResult$ = new ReplaySubject<string>(1);\n\n/**\n * Auth Interceptor\n *\n * Adds the Authorization header with the access token to outgoing requests.\n * Handles 401 errors by attempting to refresh the token.\n */\nexport const authInterceptor: HttpInterceptorFn = (\n  req: HttpRequest<unknown>,\n  next: HttpHandlerFn\n): Observable<HttpEvent<unknown>> => {\n  const authStore = inject(AuthStore);\n  const authService = inject(AuthService);\n  const router = inject(Router);\n\n  // Skip auth header for login/refresh endpoints\n  if (isAuthEndpoint(req.url)) {\n    return next(req);\n  }\n\n  const token = authStore.accessToken();\n\n  if (token) {\n    req = addAuthHeader(req, token);\n  }\n\n  return next(req).pipe(\n    catchError((error: HttpErrorResponse) => {\n      if (error.status === 401 && token) {\n        return handle401Error(req, next, authService, authStore, router);\n      }\n      return throwError(() => error);\n    })\n  );\n};\n\n/**\n * Check if the request is to an auth endpoint\n */\nfunction isAuthEndpoint(url: string): boolean {\n  const authEndpoints = ['/auth/login', '/auth/refresh', '/auth/logout'];\n  return authEndpoints.some((endpoint) => url.includes(endpoint));\n}\n\n/**\n * Add Authorization header to request\n */\nfunction addAuthHeader(req: HttpRequest<unknown>, token: string): HttpRequest<unknown> {\n  return req.clone({\n    setHeaders: {\n      Authorization: `Bearer ${token}`,\n    },\n  });\n}\n\n/**\n * Handle 401 errors by refreshing the token.\n *\n * Uses a ReplaySubject so that:\n * - On success: all queued requests receive the new token and retry.\n * - On failure: all queued requests receive the error and stop waiting.\n * A timeout prevents indefinite hangs if the refresh endpoint is unresponsive.\n */\nfunction handle401Error(\n  req: HttpRequest<unknown>,\n  next: HttpHandlerFn,\n  authService: AuthService,\n  authStore: AuthStore,\n  router: Router\n): Observable<HttpEvent<unknown>> {\n  // If already logged out, don't attempt refresh — just fail the request\n  if (!authStore.isAuthenticated()) {\n    return throwError(() => new HttpErrorResponse({ status: 401 }));\n  }\n\n  if (!isRefreshing) {\n    isRefreshing = true;\n    refreshResult$ = new ReplaySubject<string>(1);\n\n    return authService.refreshToken().pipe(\n      timeout(15000),\n      switchMap((response) => {\n        isRefreshing = false;\n        refreshResult$.next(response.accessToken);\n        refreshResult$.complete();\n        return next(addAuthHeader(req, response.accessToken));\n      }),\n      catchError((error) => {\n        isRefreshing = false;\n        refreshResult$.error(error);\n        authStore.logout();\n        router.navigate(['/login'], {\n          queryParams: { returnUrl: router.url },\n        });\n        return throwError(() => error);\n      })\n    );\n  }\n\n  // Wait for the current refresh to complete (success or failure)\n  return refreshResult$.pipe(\n    take(1),\n    switchMap((token) => next(addAuthHeader(req, token))),\n    catchError(() => throwError(() => new HttpErrorResponse({ status: 401 })))\n  );\n}\n","import { HttpInterceptorFn, HttpRequest, HttpHandlerFn, HttpEvent, HttpErrorResponse } from '@angular/common/http';\nimport { inject } from '@angular/core';\nimport { Observable, throwError } from 'rxjs';\nimport { switchMap, take, catchError, shareReplay, finalize } from 'rxjs/operators';\nimport { AuthProvider, AuthRefreshResult } from '../auth/auth-provider';\n\nconst RETURN_URL_KEY = 'oluso.returnUrl.active';\n\nlet refreshInFlight: Observable<AuthRefreshResult> | null = null;\n\n/**\n * Token attachment fallback + 401 retry with refresh deduplication. On refresh\n * failure, stashes the current route in sessionStorage under an opaque key so\n * the post-login callback can restore navigation without leaking the route to\n * URL/history/server logs.\n *\n * Skips the OIDC token endpoint to avoid infinite loops if /connect/token 401s.\n */\nexport const authRefreshInterceptor: HttpInterceptorFn = (\n  req: HttpRequest<unknown>,\n  next: HttpHandlerFn\n): Observable<HttpEvent<unknown>> => {\n  const authProvider = inject(AuthProvider);\n\n  if (req.headers.has('Authorization')) {\n    return next(req).pipe(catchError((err) => handle401(err, req, next, authProvider)));\n  }\n\n  return authProvider.getAccessToken().pipe(\n    take(1),\n    switchMap((token) => {\n      const outReq = token ? addToken(req, token) : req;\n      return next(outReq).pipe(catchError((err) => handle401(err, req, next, authProvider)));\n    })\n  );\n};\n\nfunction addToken(req: HttpRequest<unknown>, token: string): HttpRequest<unknown> {\n  return req.clone({\n    setHeaders: { Authorization: `Bearer ${token}` },\n  });\n}\n\nfunction handle401(\n  error: unknown,\n  req: HttpRequest<unknown>,\n  next: HttpHandlerFn,\n  authProvider: AuthProvider\n): Observable<HttpEvent<unknown>> {\n  if (\n    error instanceof HttpErrorResponse &&\n    error.status === 401 &&\n    !error.url?.includes('/connect/token')\n  ) {\n    return sharedRefresh(authProvider).pipe(\n      switchMap((result) => {\n        if (result?.isAuthenticated && result?.accessToken) {\n          return next(addToken(req, result.accessToken));\n        }\n        console.warn('Token refresh returned no valid session — redirecting to login');\n        redirectToLogin(authProvider);\n        return throwError(() => error);\n      }),\n      catchError((refreshError) => {\n        console.warn('Token refresh failed — redirecting to login', refreshError);\n        redirectToLogin(authProvider);\n        return throwError(() => error);\n      })\n    );\n  }\n  return throwError(() => error);\n}\n\nfunction sharedRefresh(authProvider: AuthProvider): Observable<AuthRefreshResult> {\n  if (!refreshInFlight) {\n    refreshInFlight = authProvider.forceRefreshSession().pipe(\n      take(1),\n      finalize(() => { refreshInFlight = null; }),\n      shareReplay({ bufferSize: 1, refCount: false })\n    );\n  }\n  return refreshInFlight;\n}\n\nfunction redirectToLogin(authProvider: AuthProvider): void {\n  rememberReturnUrl();\n  authProvider.authorize();\n}\n\n/**\n * Remembers the page the user is on before a sign-in redirect ends their session, so the callback page can\n * bring them back to it ({@link readAndClearReturnUrl}). The callback, renew and error pages, and the root,\n * are not remembered.\n */\nexport function rememberReturnUrl(): void {\n  try {\n    const currentUrl = window.location.pathname + window.location.search + window.location.hash;\n    if (\n      !currentUrl.startsWith('/callback') &&\n      !currentUrl.startsWith('/silent-renew') &&\n      !currentUrl.startsWith('/error') &&\n      currentUrl !== '/'\n    ) {\n      sessionStorage.setItem(RETURN_URL_KEY, currentUrl);\n    }\n  } catch {\n    /* sessionStorage unavailable */\n  }\n}\n\n/**\n * Helper for callback pages to restore the pre-login route.\n */\nexport function readAndClearReturnUrl(): string | null {\n  try {\n    const url = sessionStorage.getItem(RETURN_URL_KEY);\n    sessionStorage.removeItem(RETURN_URL_KEY);\n    return url;\n  } catch {\n    return null;\n  }\n}\n","import { HttpInterceptorFn, HttpRequest, HttpHandlerFn, HttpEvent } from '@angular/common/http';\nimport { inject } from '@angular/core';\nimport { Observable } from 'rxjs';\nimport { AuthStore } from '../stores/auth.store';\n\n/**\n * Paths that must never carry the X-Tenant-ID header.\n * OIDC endpoints use the global issuer; sending a tenant header\n * can change the resolved issuer/discovery document and break\n * token validation after a tenant switch.\n */\nconst TENANT_HEADER_EXCLUDED_PATHS = [\n  '/connect/',\n  '/.well-known/',\n  '/discovery/',\n  // Action-token links carry their own tenant; a signed-in session's tenant\n  // must not leak into a customer-facing request.\n  '/api/public/',\n];\n\n/**\n * Tenant Interceptor\n *\n * Adds the X-Tenant-ID header to outgoing API requests when the user\n * has selected a tenant context.\n *\n * This is used in the Admin UI to allow super admins to manage\n * resources across different tenants. The backend validates\n * whether the user is authorized to access the specified tenant.\n *\n * OIDC protocol endpoints are excluded — they must always use the\n * global (non-tenant) context so the issuer stays consistent.\n */\nexport const tenantInterceptor: HttpInterceptorFn = (\n  req: HttpRequest<unknown>,\n  next: HttpHandlerFn\n): Observable<HttpEvent<unknown>> => {\n  const authStore = inject(AuthStore);\n\n  // Only a tenant picked in the UI goes out; otherwise the API takes the tenant from the token.\n  const tenantId = authStore.tenantSwitched() ? authStore.currentTenantId() : null;\n\n  // An explicitly-set header wins. The tenant-switch call has to target the\n  // tenant being switched TO while the store still holds the current one —\n  // setHeaders would otherwise overwrite it and switch you back to yourself.\n  if (tenantId && !req.headers.has('X-Tenant-ID')) {\n    // Don't attach tenant header to OIDC protocol endpoints\n    const urlPath = new URL(req.url, window.location.origin).pathname;\n    const isExcluded = TENANT_HEADER_EXCLUDED_PATHS.some(p =>\n      urlPath.includes(p)\n    );\n\n    if (!isExcluded) {\n      req = req.clone({\n        setHeaders: {\n          'X-Tenant-ID': tenantId,\n        },\n      });\n    }\n  }\n\n  return next(req);\n};\n\n/**\n * Organization Interceptor\n *\n * Adds the X-Organization-ID header to outgoing requests when the user\n * has selected an organization context.\n *\n * This is used for multi-tenant applications where users can belong\n * to multiple organizations.\n */\nexport const organizationInterceptor: HttpInterceptorFn = (\n  req: HttpRequest<unknown>,\n  next: HttpHandlerFn\n): Observable<HttpEvent<unknown>> => {\n  const authStore = inject(AuthStore);\n\n  const organization = authStore.currentOrganization();\n\n  if (organization) {\n    req = req.clone({\n      setHeaders: {\n        'X-Organization-ID': organization.id,\n      },\n    });\n  }\n\n  return next(req);\n};\n","import { HttpInterceptorFn, HttpRequest, HttpHandlerFn, HttpEvent } from '@angular/common/http';\nimport { Observable } from 'rxjs';\n\n/**\n * Ngrok Interceptor\n *\n * Adds the ngrok-skip-browser-warning header to skip the ngrok interstitial page.\n * This header is required when making API calls through ngrok tunnels.\n */\nexport const ngrokInterceptor: HttpInterceptorFn = (\n  req: HttpRequest<unknown>,\n  next: HttpHandlerFn\n): Observable<HttpEvent<unknown>> => {\n  // Add ngrok header to skip browser warning\n  const modifiedReq = req.clone({\n    setHeaders: {\n      'ngrok-skip-browser-warning': 'true',\n    },\n  });\n\n  return next(modifiedReq);\n};\n","import { HttpInterceptorFn, HttpRequest, HttpHandlerFn, HttpEvent, HttpErrorResponse } from '@angular/common/http';\nimport { inject } from '@angular/core';\nimport { Observable, catchError, throwError } from 'rxjs';\nimport { ToastService, SKIP_ERROR_TOAST } from '@syndew/oluso-ui-core';\n\n/**\n * Error Interceptor\n *\n * Catches HTTP error responses and displays user-friendly toast notifications.\n * Extracts error messages from backend responses when available.\n * Skips 401 errors (handled by the auth interceptor).\n */\nexport const errorInterceptor: HttpInterceptorFn = (\n  req: HttpRequest<unknown>,\n  next: HttpHandlerFn\n): Observable<HttpEvent<unknown>> => {\n  const toast = inject(ToastService);\n\n  return next(req).pipe(\n    catchError((error: HttpErrorResponse) => {\n      // Skip 401s — the auth interceptor handles token refresh / logout\n      if (error.status === 401) {\n        return throwError(() => error);\n      }\n\n      // Caller opted out of the global toast — it handles this failure itself\n      // (e.g. an optional conversation thread that may 403/404). Still rethrow.\n      if (req.context.get(SKIP_ERROR_TOAST)) {\n        return throwError(() => error);\n      }\n\n      const message = extractMessage(error);\n      toast.error(message);\n\n      return throwError(() => error);\n    })\n  );\n};\n\n/**\n * Extract a human-readable message from the error response.\n * Module controllers return { message: \"...\" }, the admin API returns\n * { error: \"...\" }, and unhandled failures arrive as ProblemDetails.\n */\nfunction extractMessage(error: HttpErrorResponse): string {\n  // Try to get the message from the response body\n  const body = error.error;\n\n  if (body) {\n    // Backend returns { message: \"...\", requiredPermission?: \"...\" }\n    if (typeof body === 'object' && body.message) {\n      if (body.requiredPermission) {\n        return `${body.message} (${body.requiredPermission})`;\n      }\n      return body.message;\n    }\n    // Backend returns { Message: \"...\" } (PascalCase)\n    if (typeof body === 'object' && body.Message) {\n      return body.Message;\n    }\n    // Admin API validation / business errors: { error: \"...\" }\n    if (typeof body === 'object' && typeof body.error === 'string' && body.error) {\n      return body.error;\n    }\n    // ProblemDetails: { title, detail }\n    if (typeof body === 'object' && typeof body.detail === 'string' && body.detail) {\n      return body.detail;\n    }\n    if (typeof body === 'object' && typeof body.title === 'string' && body.title) {\n      return body.title;\n    }\n    // ASP.NET validation errors: { errors: { field: [\"msg\"] } }\n    if (typeof body === 'object' && body.errors) {\n      const firstField = Object.keys(body.errors)[0];\n      if (firstField) {\n        const msgs = body.errors[firstField];\n        if (Array.isArray(msgs) && msgs.length > 0) {\n          return msgs[0];\n        }\n      }\n    }\n    // Plain string body\n    if (typeof body === 'string' && body.length < 200) {\n      return body;\n    }\n  }\n\n  // Fallback based on status code\n  switch (error.status) {\n    // No readable response: the connection dropped, or the browser blocked the response (e.g. CORS on a\n    // cross-origin redirect). Not a server outage; those come back as 502/503/504 below.\n    case 0:\n      return 'The request did not complete. It was blocked by the browser or the connection was lost.';\n    case 400:\n      return 'Invalid request. Please check your input.';\n    case 403:\n      return 'You do not have permission to perform this action.';\n    case 404:\n      return 'The requested resource was not found.';\n    case 409:\n      return 'A conflict occurred. The resource may have been modified.';\n    case 422:\n      return 'The request could not be processed. Please check your input.';\n    case 500:\n      return 'An internal server error occurred. Please try again later.';\n    case 502:\n    case 503:\n    case 504:\n      return 'Unable to reach the server right now. Please try again shortly.';\n    default:\n      return `An error occurred (${error.status}). Please try again.`;\n  }\n}\n","/**\n * The browser's DPoP key (RFC 9449): an ECDSA P-256 key pair whose private half the page can sign with but\n * never read, so a token bound to it cannot be used anywhere else.\n *\n * The pair is kept in IndexedDB, shared by every tab of the app and surviving reloads, because refresh tokens\n * are bound to it: a remembered session's next refresh needs the same key. Where IndexedDB is unavailable the\n * key lives for the page only, and the session ends with it.\n */\n\n/** The public half, as it goes in a proof's <c>jwk</c> header. */\nexport interface DPoPPublicJwk {\n  kty: 'EC';\n  crv: 'P-256';\n  x: string;\n  y: string;\n}\n\nexport interface DPoPKey {\n  readonly privateKey: CryptoKey;\n  readonly publicJwk: DPoPPublicJwk;\n}\n\nconst DATABASE = 'oluso.dpop';\nconst STORE = 'keys';\nconst KEY_ID = 'current';\n\nlet current: Promise<DPoPKey> | null = null;\n\n/** Whether this page can hold a DPoP key: Web Crypto, which browsers offer only in secure contexts. */\nexport function dpopSupported(): boolean {\n  const secure = typeof globalThis.isSecureContext === 'boolean' ? globalThis.isSecureContext : true;\n  return secure && typeof crypto !== 'undefined' && !!crypto.subtle;\n}\n\n/** The app's DPoP key, loaded or created once per page. */\nexport function dpopKey(): Promise<DPoPKey> {\n  current ??= loadOrCreate().catch((error) => {\n    current = null;\n    throw error;\n  });\n  return current;\n}\n\n/** Forgets the key held by this page, so the next {@link dpopKey} reads storage again (tests). */\nexport function resetDPoPKeyForTests(): void {\n  current = null;\n}\n\nasync function loadOrCreate(): Promise<DPoPKey> {\n  const generated = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, false, ['sign', 'verify']);\n  const pair = (await keepFirst(generated)) ?? generated;\n  return { privateKey: pair.privateKey, publicJwk: await publicJwkOf(pair.publicKey) };\n}\n\n/**\n * Stores `candidate` unless a pair is already stored, in one transaction so two tabs creating a key at once\n * agree on a single one. Returns the stored pair, or null when IndexedDB is unavailable.\n */\nfunction keepFirst(candidate: CryptoKeyPair): Promise<CryptoKeyPair | null> {\n  if (typeof indexedDB === 'undefined') return Promise.resolve(null);\n  return new Promise((resolve) => {\n    const open = indexedDB.open(DATABASE, 1);\n    open.onupgradeneeded = () => open.result.createObjectStore(STORE);\n    open.onerror = () => resolve(null);\n    open.onsuccess = () => {\n      const db = open.result;\n      const tx = db.transaction(STORE, 'readwrite');\n      const store = tx.objectStore(STORE);\n      let kept: CryptoKeyPair | null = null;\n      const existing = store.get(KEY_ID);\n      existing.onsuccess = () => {\n        if (existing.result) {\n          kept = existing.result as CryptoKeyPair;\n        } else {\n          store.put(candidate, KEY_ID);\n          kept = candidate;\n        }\n      };\n      tx.oncomplete = () => { db.close(); resolve(kept); };\n      tx.onerror = () => { db.close(); resolve(null); };\n    };\n  });\n}\n\nasync function publicJwkOf(publicKey: CryptoKey): Promise<DPoPPublicJwk> {\n  const jwk = await crypto.subtle.exportKey('jwk', publicKey);\n  return { kty: 'EC', crv: 'P-256', x: jwk.x!, y: jwk.y! };\n}\n","import type { DPoPKey } from './dpop-key';\n\n/** What a DPoP proof (RFC 9449 §4.2) is for: one HTTP request, and the access token it presents if any. */\nexport interface DPoPProofTarget {\n  method: string;\n  url: string;\n  accessToken?: string | null;\n  nonce?: string | null;\n}\n\n/** A DPoP proof JWT signed by `key` for one request. */\nexport async function createDPoPProof(key: DPoPKey, target: DPoPProofTarget): Promise<string> {\n  const header = { typ: 'dpop+jwt', alg: 'ES256', jwk: key.publicJwk };\n  const payload: Record<string, unknown> = {\n    jti: crypto.randomUUID(),\n    htm: target.method.toUpperCase(),\n    htu: proofUri(target.url),\n    iat: Math.floor(Date.now() / 1000),\n  };\n  if (target.accessToken) payload['ath'] = await accessTokenHash(target.accessToken);\n  if (target.nonce) payload['nonce'] = target.nonce;\n\n  const signingInput = `${base64UrlText(JSON.stringify(header))}.${base64UrlText(JSON.stringify(payload))}`;\n  const signature = await crypto.subtle.sign(\n    { name: 'ECDSA', hash: 'SHA-256' }, key.privateKey, new TextEncoder().encode(signingInput));\n  return `${signingInput}.${base64UrlBytes(new Uint8Array(signature))}`;\n}\n\n/** The request URI a proof names: absolute, without query or fragment. */\nexport function proofUri(url: string): string {\n  const base = typeof location !== 'undefined' ? location.href : 'http://localhost/';\n  const absolute = new URL(url, base);\n  return `${absolute.origin}${absolute.pathname}`;\n}\n\n/** The <c>ath</c> claim: the base64url SHA-256 of the access token. */\nexport async function accessTokenHash(accessToken: string): Promise<string> {\n  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(accessToken));\n  return base64UrlBytes(new Uint8Array(digest));\n}\n\nfunction base64UrlText(text: string): string {\n  return base64UrlBytes(new TextEncoder().encode(text));\n}\n\nfunction base64UrlBytes(bytes: Uint8Array): string {\n  let binary = '';\n  bytes.forEach((b) => (binary += String.fromCharCode(b)));\n  return btoa(binary).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '');\n}\n","import { HttpErrorResponse, HttpEvent, HttpHeaders, HttpInterceptorFn, HttpRequest, HttpResponse } from '@angular/common/http';\nimport { Observable, catchError, from, switchMap, tap, throwError } from 'rxjs';\nimport { dpopKey, dpopSupported } from './dpop-key';\nimport { createDPoPProof, proofUri } from './dpop-proof';\n\n/** Nonces servers have asked proofs to carry (RFC 9449 §8), by origin. */\nconst nonces = new Map<string, string>();\n\n/**\n * Sender-constrains the app's tokens with DPoP (RFC 9449).\n *\n * - Token requests (any grant) carry a proof, so the server binds the tokens it issues — access and refresh —\n *   to this browser's key ({@link dpopKey}); a copied token is useless without it.\n * - A request presenting a DPoP-bound access token (one whose <c>cnf.jkt</c> names a key) is sent under the\n *   DPoP scheme with a proof for that request and token instead of as a bearer token, which the server refuses.\n * - When a server asks for a nonce (<c>use_dpop_nonce</c>), the request is retried once with it.\n *\n * Register it after the interceptors that attach the access token, so it sees the final request.\n * Pages without Web Crypto (non-secure contexts) send requests unchanged; their tokens are not bound.\n */\nexport const dpopInterceptor: HttpInterceptorFn = (req, next) => {\n  if (!dpopSupported()) return next(req);\n  // A token request presents no access token. The auth library attaches the session's token to every URL under its\n  // secure routes, the token endpoint included; sent there, the server's resource check consumes the proof's jti and\n  // the token endpoint then refuses the same proof as replayed. Client authentication (Basic) is left alone.\n  if (isTokenRequest(req) && /^(Bearer|DPoP)\\s/i.test(req.headers.get('Authorization') ?? '')) {\n    req = req.clone({ headers: req.headers.delete('Authorization') });\n  }\n  const presented = boundAccessTokenOf(req);\n  if (!presented && !isTokenRequest(req)) return next(req);\n\n  const send = (nonce: string | undefined): Observable<HttpEvent<unknown>> =>\n    from(withProof(req, presented, nonce)).pipe(\n      switchMap((signed) => next(signed)),\n      tap((event) => { if (event instanceof HttpResponse) rememberNonce(req, event.headers); })\n    );\n\n  return send(nonces.get(originOf(req.url))).pipe(\n    catchError((error: unknown) => {\n      if (!(error instanceof HttpErrorResponse)) return throwError(() => error);\n      const nonce = error.headers?.get('DPoP-Nonce');\n      if (nonce) nonces.set(originOf(req.url), nonce);\n      return nonce && asksForNonce(error) ? send(nonce) : throwError(() => error);\n    })\n  );\n};\n\nasync function withProof(req: HttpRequest<unknown>, boundToken: string | null, nonce: string | undefined): Promise<HttpRequest<unknown>> {\n  const proof = await createDPoPProof(await dpopKey(), { method: req.method, url: req.url, accessToken: boundToken, nonce });\n  let headers: HttpHeaders = req.headers.set('DPoP', proof);\n  if (boundToken) headers = headers.set('Authorization', `DPoP ${boundToken}`);\n  return req.clone({ headers });\n}\n\n/** A token endpoint request: a form POST naming a grant. */\nfunction isTokenRequest(req: HttpRequest<unknown>): boolean {\n  return req.method === 'POST' && typeof req.body === 'string' && new URLSearchParams(req.body).has('grant_type');\n}\n\n/** The access token a request presents, when it is bound to a DPoP key; else null. */\nexport function boundAccessTokenOf(req: HttpRequest<unknown>): string | null {\n  const match = /^(?:Bearer|DPoP)\\s+(.+)$/i.exec(req.headers.get('Authorization') ?? '');\n  const token = match?.[1]?.trim();\n  return token && isDPoPBound(token) ? token : null;\n}\n\nlet lastChecked: { token: string; bound: boolean } | null = null;\n\n/** Whether a JWT access token is bound to a DPoP key (has <c>cnf.jkt</c>). */\nexport function isDPoPBound(token: string): boolean {\n  if (lastChecked?.token === token) return lastChecked.bound;\n  let bound = false;\n  const part = token.split('.')[1];\n  if (part) {\n    try {\n      const json = atob(part.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(part.length / 4) * 4, '='));\n      const jkt = (JSON.parse(json) as { cnf?: { jkt?: unknown } })?.cnf?.jkt;\n      bound = typeof jkt === 'string' && jkt.length > 0;\n    } catch {\n      bound = false;\n    }\n  }\n  lastChecked = { token, bound };\n  return bound;\n}\n\n/** A refusal asking for a DPoP nonce: a 401 challenge from an API or a 400 error from the token endpoint. */\nfunction asksForNonce(error: HttpErrorResponse): boolean {\n  if (error.status === 401) return (error.headers?.get('WWW-Authenticate') ?? '').includes('use_dpop_nonce');\n  return error.status === 400 && (error.error as { error?: unknown } | null)?.error === 'use_dpop_nonce';\n}\n\nfunction rememberNonce(req: HttpRequest<unknown>, headers: HttpHeaders): void {\n  const nonce = headers.get('DPoP-Nonce');\n  if (nonce) nonces.set(originOf(req.url), nonce);\n}\n\nfunction originOf(url: string): string {\n  return new URL(proofUri(url)).origin;\n}\n","import { HttpClient, HttpErrorResponse, HttpHeaders, HttpResponse } from '@angular/common/http';\nimport { firstValueFrom } from 'rxjs';\n\n/**\n * A `fetch` that sends through the app's HttpClient, so its interceptors apply: the signed-in user's access token,\n * the tenant, DPoP proofs and the refresh-and-retry on an expired token. Give it to the Oluso SDK\n * (`new OlusoClient({ ..., fetch: httpClientFetch(http) })`) to run journeys the app's backend started for the user.\n * Answers with an error status resolve like fetch's do, so the SDK reads the server's message.\n */\nexport function httpClientFetch(http: HttpClient): typeof fetch {\n  return async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {\n    const url = typeof input === 'string' ? input : input instanceof URL ? input.href : input.url;\n    const method = (init?.method ?? 'GET').toUpperCase();\n\n    let headers = new HttpHeaders();\n    new Headers(init?.headers).forEach((value, name) => {\n      headers = headers.set(name, value);\n    });\n\n    try {\n      const response = await firstValueFrom(\n        http.request(method, url, {\n          body: init?.body ?? null,\n          headers,\n          observe: 'response',\n          responseType: 'text',\n          withCredentials: init?.credentials === 'include',\n        })\n      );\n      return toResponse(response);\n    } catch (error) {\n      if (error instanceof HttpErrorResponse && error.status > 0) return toResponse(error);\n      throw error;\n    }\n  };\n}\n\nfunction toResponse(response: HttpResponse<string> | HttpErrorResponse): Response {\n  const headers = new Headers();\n  response.headers.keys().forEach((name) => {\n    const value = response.headers.get(name);\n    if (value !== null) headers.set(name, value);\n  });\n  const body = response instanceof HttpErrorResponse\n    ? typeof response.error === 'string' ? response.error : JSON.stringify(response.error ?? null)\n    : response.body;\n  const empty = response.status === 204 || response.status === 205 || response.status === 304;\n  return new Response(empty ? null : body, { status: response.status, statusText: response.statusText, headers });\n}\n","// Models\nexport * from './lib/models/index';\n\n// Auth provider abstraction (host app supplies the implementation)\nexport * from './lib/auth/auth-provider';\nexport * from './lib/auth/renew-aware-auth-provider';\nexport * from './lib/auth/remember-me-security-storage';\nexport * from './lib/auth/check-auth-renewing';\n\n// Stores\nexport * from './lib/stores/auth.store';\n\n// Services\nexport * from './lib/services/auth.service';\n\n// Guards\nexport * from './lib/guards/auth.guard';\nexport * from './lib/guards/permission.guard';\n\n// Tenant-aware SSO landing helpers\nexport * from './lib/tenant-sso';\n\n// Interceptors\nexport * from './lib/interceptors/auth.interceptor';\nexport * from './lib/interceptors/auth-refresh.interceptor';\nexport * from './lib/interceptors/token-refresh-retry.interceptor';\nexport * from './lib/interceptors/tenant.interceptor';\nexport * from './lib/interceptors/ngrok.interceptor';\nexport * from './lib/interceptors/error.interceptor';\n\n// DPoP (RFC 9449): the browser's key, proofs, and the interceptor that binds and presents tokens\nexport * from './lib/dpop/dpop-key';\nexport * from './lib/dpop/dpop-proof';\nexport * from './lib/dpop/dpop.interceptor';\n\n// Oluso SDK: run journeys through the app's HttpClient (token, tenant, DPoP)\nexport * from './lib/sdk/http-client-fetch';\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './index';\n"],"names":["ROTATION_SETTLE_MS","refreshTokenOf","catchError","take","timeout","map","switchMap"],"mappings":";;;;;;;;;AAQA;;;;AAIG;MACmB,YAAY,CAAA;AAWjC;AAGK,MAAO,gBAAiB,SAAQ,YAAY,CAAA;AACvC,IAAA,gBAAgB,GAAG,EAAE,CAAC,KAAK,CAAC;IACrC,cAAc,GAAA,EAAgC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,mBAAmB,GAAA;AACjB,QAAA,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1D;IACA,YAAY,GAAA;AACV,QAAA,OAAO,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1D;AACA,IAAA,SAAS,KAAuB;wGATrB,gBAAgB,EAAA,IAAA,EAAA,IAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;AAAhB,IAAA,OAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,gBAAgB,cADH,MAAM,EAAA,CAAA;;4FACnB,gBAAgB,EAAA,UAAA,EAAA,CAAA;kBAD5B,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;;ACR3B,MAAM,sBAAsB,GAAG,MAAM;AAE5C,MAAM,YAAY,GAAG,sBAAsB;MAuB9B,oBAAoB,CAAA;AACd,IAAA,OAAO,GAAG,IAAI,GAAG,EAAkB;AACnC,IAAA,OAAO,GAAG,IAAI,GAAG,EAAuB;AACxC,IAAA,YAAY,GAAG,IAAI,GAAG,EAAuB;AAC7C,IAAA,SAAS,GAAG,IAAI,GAAG,EAAwB;AAC3C,IAAA,OAAO;IAExB,WAAA,CAAY,WAAW,GAAG,YAAY,EAAA;AACpC,QAAA,IAAI,CAAC,OAAO,GAAG,OAAO,gBAAgB,KAAK,WAAW,GAAG,IAAI,GAAG,IAAI,gBAAgB,CAAC,WAAW,CAAC;QACjG,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,SAAS,EAAE,CAAC,KAAoC,KAAI;AACjF,YAAA,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI;AAC1B,YAAA,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS;gBAAE;AACjC,YAAA,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AAC7F,YAAA,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC5D,QAAA,CAAC,CAAC;IACJ;AAEA;;;AAGG;AACH,IAAA,MAAM,OAAO,CAAC,iBAAyB,EAAE,MAAqB,EAAA;AAC5D,QAAA,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,iBAAiB,CAAC;AAC9C,QAAA,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,iBAAiB,CAAC;AAChD,QAAA,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM;AAC5D,QAAA,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9H,QAAA,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;AACrD,QAAA,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,EAAE,UAAU,EAA4B,CAAC;QAC5F,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IAC/C;;IAGA,cAAc,CAAC,YAAoB,EAAE,SAAiB,EAAA;AACpD,QAAA,OAAO,IAAI,OAAO,CAAO,CAAC,OAAO,KAAI;YACnC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC;YAC5C,KAAK,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1F,QAAA,CAAC,CAAC;IACJ;;IAGA,MAAM,SAAS,CAAC,YAAoB,EAAA;AAClC,QAAA,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;AACnC,QAAA,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,sBAAsB;AAAE,YAAA,OAAO,IAAI;AAC3E,QAAA,IAAI;AACF,YAAA,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;AACjI,YAAA,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAkB;QACrE;AAAE,QAAA,MAAM;AACN,YAAA,OAAO,IAAI;QACb;IACF;;AAGA,IAAA,MAAM,aAAa,CAAC,YAAoB,EAAE,SAAiB,EAAA;AACzD,QAAA,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;AACzB,YAAA,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,KAAI;AAClC,gBAAA,MAAM,MAAM,GAAG,MAAK,EAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC9F,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC;AAC3C,gBAAA,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,GAAG,EAAU;AACrD,gBAAA,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;gBACf,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC;AAC3B,YAAA,CAAC,CAAC;QACJ;AACA,QAAA,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC;IACrC;;AAGA,IAAA,UAAU,CAAC,QAA8B,EAAA;AACvC,QAAA,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC5B,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC;IAC9C;;AAGA,IAAA,MAAM,SAAS,CAAC,YAAoB,EAAE,EAAU,EAAA;QAC9C,OAAO,CAAC,MAAM,UAAU,CAAC,YAAY,CAAC,MAAM,EAAE;IAChD;IAEQ,QAAQ,CAAC,EAAU,EAAE,MAAc,EAAA;QACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC;AAC5B,QAAA,UAAU,CAAC,MAAK,EAAG,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,MAAM;AAAE,YAAA,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC;AAC3G,QAAA,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;IACjD;AAEQ,IAAA,WAAW,CAAC,YAAoB,EAAA;QACtC,IAAI,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC;QACrD,IAAI,CAAC,WAAW,EAAE;AAChB,YAAA,IAAI,OAAoB;AACxB,YAAA,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,CAAC,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC;AACpD,YAAA,WAAW,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE;YAC/B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,WAAW,CAAC;AAChD,YAAA,UAAU,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,sBAAsB,CAAC;QAClF;AACA,QAAA,OAAO,WAAW;IACpB;AACD;AAED;AACO,MAAM,oBAAoB,GAAG,IAAI,oBAAoB,EAAE;AAE9D;AACO,MAAM,sBAAsB,GAAG,IAAI,cAAc,CAAuB,wBAAwB,CAAC;AAExG,eAAe,UAAU,CAAC,YAAoB,EAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,qBAAqB,YAAY,CAAA,CAAE,CAAC,CAAC;AACnH,IAAA,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AAC5F;AAEA,eAAe,WAAW,CAAC,YAAoB,EAAA;IAC7C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,sBAAsB,YAAY,CAAA,CAAE,CAAC,CAAC;IACpH,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AACzF;;ACrJA;;;AAGG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAE7D;AACA,MAAM,cAAc,GAAG,MAAM;AAE7B;AACA,MAAM,kBAAkB,GAAG,MAAM;AAEjC;AACA,MAAMA,oBAAkB,GAAG,GAAG;AAE9B;AACA,MAAM,kBAAkB,GAAG,MAAM;AAOjC;AACA,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B;AAEpD;;;;;;;;;;;;;;;;;;;AAmBG;MACU,4BAA4B,GAAsB,CAAC,GAAG,EAAE,IAAI,KAAI;AAC3E,IAAA,MAAM,YAAY,GAAGC,gBAAc,CAAC,GAAG,CAAC;IACxC,IAAI,YAAY,KAAK,IAAI;AAAE,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;AAE3C,IAAA,IAAI,mBAAmB,KAAK,IAAI,EAAE;AAChC,QAAA,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,mBAAmB,CAAC;QAC1C,mBAAmB,GAAG,IAAI;IAC5B;;;IAIA,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,YAAY,CAAC;IAC1C,IAAI,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;IACjC,IAAI,CAAC,QAAQ,EAAE;QACb,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,oBAAoB,CAAC;AACtF,QAAA,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC;IAC9B;IAEA,MAAM,OAAO,GAAG,QAAQ;IACxB,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CACzB,GAAG,CAAC,CAAC,KAAK,MAAM,KAAK,YAAY,YAAY,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,CACtI;AACH;AAEA,SAAS,aAAa,CACpB,GAAyB,EACzB,YAAoB,EACpB,GAAW,EACX,IAAmE,EACnE,SAA+B,EAAA;AAE/B,IAAA,MAAM,OAAO,GAAG,IAAI,aAAa,CAAqB,CAAC,CAAC;IACxD,MAAM,QAAQ,GAAoB,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE;AAC/D,IAAA,MAAM,MAAM,GAAG,CAAC,QAA+B,KAAI;AACjD,QAAA,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE;AAChC,QAAA,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QACtB,OAAO,CAAC,QAAQ,EAAE;AACpB,IAAA,CAAC;IAED,KAAK,eAAe,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,OAAO,MAAM,KAAI;QACrD,MAAM,UAAU,GAAG;cACf,MAAM,SAAS,CAAC,aAAa,CAAC,YAAY,EAAED,oBAAkB;cAC9D,MAAM,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC;QAC3C,IAAI,QAAQ,GAAG,GAAG;QAClB,IAAI,UAAU,EAAE;;;AAGd,YAAA,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,gBAAgB,CAAC,UAAU,CAAC,GAAG,IAAI;YACnE,IAAI,CAAC,OAAO,EAAE;AACZ,gBAAA,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;gBACrC;YACF;AACA,YAAA,QAAQ,GAAG,gBAAgB,CAAC,GAAG,EAAE,OAAO,CAAC;QAC3C;AACA,QAAA,MAAM,YAAY,GAAG,CAAC,OAA6B,KACjD,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAChB,KAAK,CAAC;AACJ,YAAA,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,KACpB,WAAW,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC;AAC5F,SAAA,CAAC,EACF,MAAM,CAAC,CAAC,KAAK,KAAqC,KAAK,YAAY,YAAY,CAAC,CACjF;;;QAGH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAClC,YAAY,CAAC,QAAQ,CAAC,CAAC,IAAI,CACzB,UAAU,CAAC,CAAC,KAAc,KACxB,QAAQ,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC,CACzG,CACF,CACF;QACD,MAAM,CAAC,QAAQ,CAAC;QAChB,MAAM,SAAS,CAAC,cAAc,CAAC,YAAY,EAAE,kBAAkB,CAAC;IAClE,CAAC,CAAC,CAAC,IAAI,CACL,MAAM,UAAU,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,sBAAsB,CAAC,EACrE,CAAC,KAAK,KAAI;AACR,QAAA,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC;AACrB,QAAA,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;AACtB,IAAA,CAAC,CACF;AAED,IAAA,OAAO,QAAQ;AACjB;AAEA;;;AAGG;AACH,eAAe,eAAe,CAAC,QAAgB,EAAE,IAAwC,EAAA;AACvF,IAAA,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC,KAAK;AAC5E,IAAA,IAAI,CAAC,KAAK;AAAE,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC;AAC9B,IAAA,MAAM,IAAI,GAAG,CAAA,oBAAA,EAAuB,QAAQ,EAAE;AAC9C,IAAA,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,OAAO,IAAI,KAAI;AACrF,QAAA,IAAI,CAAC,IAAI;AAAE,YAAA,OAAO,KAAK;AACvB,QAAA,MAAM,IAAI,CAAC,KAAK,CAAC;AACjB,QAAA,OAAO,IAAI;AACb,IAAA,CAAC,CAAC;AACF,IAAA,IAAI,CAAC,cAAc;AAAE,QAAA,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;AAClE;AAEA;AACM,SAAUC,gBAAc,CAAC,GAAyB,EAAA;IACtD,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;AAAE,QAAA,OAAO,IAAI;IACtE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,eAAe,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,IAAI;AACtF;AAEA;AACA,IAAI,mBAAmB,GAAkB,IAAI;AAE7C;;;;;AAKG;AACG,SAAU,mBAAmB,CAAC,QAAuB,EAAA;IACzD,mBAAmB,GAAG,QAAQ;AAChC;AAEA;AACA,SAAS,QAAQ,CAAC,GAAyB,EAAA;AACzC,IAAA,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,IAAc,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC;AAC9D;AAEA,SAAS,WAAW,CAAC,GAAyB,EAAE,YAAoB,EAAA;AAClE,IAAA,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC;AAC5B,IAAA,OAAO,MAAM,GAAG,CAAA,EAAG,YAAY,CAAA,SAAA,EAAY,MAAM,CAAA,CAAE,GAAG,YAAY;AACpE;AAEA;AACA,SAAS,gBAAgB,CAAC,MAAqB,EAAA;IAC7C,MAAM,KAAK,GAAI,MAAM,CAAC,aAAa,CAA6C,EAAE,aAAa;AAC/F,IAAA,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,KAAK,GAAG,IAAI;AAC1D;AAEA,SAAS,UAAU,CAAC,GAAyB,EAAE,QAAgB,EAAA;IAC7D,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAc,CAAC;AACpD,IAAA,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC;AAC5B,IAAA,OAAO,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC7C;AAEA,SAAS,aAAa,CAAC,GAAyB,EAAA;IAC9C,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAc,CAAC;AACpD,IAAA,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;AACrB,IAAA,OAAO,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC7C;AAEA;AACA,SAAS,SAAS,CAAC,KAAc,EAAA;IAC/B,OAAO,KAAK,YAAY,iBAAiB,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;AACnE;AAEA,SAAS,gBAAgB,CAAC,GAAyB,EAAE,YAAoB,EAAA;IACvE,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,IAAc,CAAC;AACpD,IAAA,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC;AACvC,IAAA,OAAO,GAAG,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC7C;AAEA,SAAS,UAAU,CAAC,GAAyB,EAAA;AAC3C,IAAA,OAAO,IAAI,eAAe,CAAC,GAAG,CAAC,IAAc,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE;AACvE;AAEA;AACuC;AACjC,SAAU,mBAAmB,CAAC,KAAwB,EAAE,OAAe,EAAA;AAC3E,IAAA,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,GAAG;UAC7D,IAAI,CAAC,GAAG,CAAC,iBAAiB,GAAG,IAAI,EAAE,kBAAkB;AACvD,UAAE,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,KAAK,OAAO,GAAG,CAAC,CAAC,EAAE,cAAc,CAAC;AACzD;AAEA;AACA,SAAS,iBAAiB,CAAC,MAAqB,EAAA;IAC9C,MAAM,WAAW,IAAI,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,CAA4B;IAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG;AACrD,UAAE,EAAE,GAAG,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC;UACtF,WAAW;IACf,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AAChD;AAEA;AACA,SAAS,IAAI,CAAC,QAA+B,EAAE,SAAiB,EAAA;AAC9D,IAAA,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAuC;IAC7D,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;AACnD,IAAA,IAAI,cAAc,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ;AAAE,QAAA,OAAO,QAAQ;AACxF,IAAA,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;AACzG;AAEA,SAAS,WAAW,CAAC,KAAc,EAAA;AACjC,IAAA,OAAO,KAAK,YAAY,iBAAiB,IAAI,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;AACnF;;AC9OA;;;;;;;;;;;;AAYG;AACG,MAAgB,sBAAuB,SAAQ,YAAY,CAAA;;IAErD,WAAW,GAAG,MAAM;IAEtB,aAAa,GAAG,KAAK;AACZ,IAAA,QAAQ,GAAG,IAAI,OAAO,EAAW;AAKlD;;;;AAIG;IACO,UAAU,CAAC,QAA6B,EAAE,QAA6B,EAAA;AAC/E,QAAA,QAAQ,CAAC,SAAS,CAAC,MAAK;AACtB,YAAA,IAAI,CAAC,aAAa,GAAG,IAAI;AAC3B,QAAA,CAAC,CAAC;AACF,QAAA,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,KAAI;AACxB,YAAA,IAAI,CAAC,aAAa,GAAG,KAAK;AAC1B,YAAA,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AACxB,QAAA,CAAC,CAAC;IACJ;IAEA,mBAAmB,GAAA;AACjB,QAAA,IAAI,IAAI,CAAC,aAAa,EAAE;AACtB,YAAA,OAAO,IAAI,CAAC,UAAU,EAAE;QAC1B;AACA,QAAA,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,CAC5B,SAAS,CAAC,CAAC,MAAM,KAAI;YACnB,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,WAAW,EAAE;AAChD,gBAAA,OAAO,EAAE,CAAC,MAAM,CAAC;YACnB;;;AAGA,YAAA,OAAO,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC;QAC5D,CAAC,CAAC,CACH;IACH;AAEA;;;;;;AAMG;AACH,IAAA,YAAY,CAAC,QAAgB,EAAA;AAC3B,QAAA,MAAM,KAAK,GAAwB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC;AACpF,QAAA,OAAO,KAAK,CAAC,IAAI,CACf,SAAS,CAAC,MACR,KAAK,CAAC,MAAK;YACT,mBAAmB,CAAC,QAAQ,CAAC;AAC7B,YAAA,OAAO,IAAI,CAAC,WAAW,EAAE;AAC3B,QAAA,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CACnD,EACD,SAAS,CAAC,CAAC,MAAM,KACf,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,WAAW,IAAI,aAAa,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK;AACpF,cAAE,EAAE,CAAC,MAAM;AACX,cAAE,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAA,uCAAA,EAA0C,QAAQ,CAAA,CAAE,CAAC,CAAC,CACtF,CACF;IACH;IAEQ,UAAU,GAAA;AAChB,QAAA,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CACvB,IAAI,CAAC,CAAC,CAAC,EACP,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EACzBC,YAAU,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,CAAC,EAC3B,SAAS,CAAC,CAAC,EAAE,KACX;AACE,cAAE,IAAI,CAAC,cAAc,EAAE,CAAC,IAAI,CACxB,IAAI,CAAC,CAAC,CAAC,EACP,GAAG,CAAC,CAAC,KAAK,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,CAAC;AAE9E,cAAE,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CACtD,CACF;IACH;AACD;AAED;AACM,SAAU,aAAa,CAAC,WAAmB,EAAA;IAC/C,MAAM,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtC,IAAA,IAAI,CAAC,IAAI;AAAE,QAAA,OAAO,IAAI;AACtB,IAAA,IAAI;AACF,QAAA,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACzG,MAAM,MAAM,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAA6B,CAAC,SAAS;AACtE,QAAA,OAAO,OAAO,MAAM,KAAK,QAAQ,GAAG,MAAM,GAAG,IAAI;IACnD;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,IAAI;IACb;AACF;;AC5GA,MAAM,iBAAiB,GAAG,aAAa;AAEvC;AACA,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,WAAW,EAAE,yBAAyB,EAAE,UAAU,EAAE,eAAe,CAAC;AAE1G;;;AAGG;AACH,MAAM,kBAAkB,GAAG,GAAG;AAE9B;;;;;;;;;;;;;;;;;;;AAmBG;MAEU,yBAAyB,CAAA;AACnB,IAAA,SAAS;AACT,IAAA,gBAAgB,GAAG,IAAI,GAAG,EAAmE;AAE9G,IAAA,WAAA,CAAwD,SAAuC,EAAA;AAC7F,QAAA,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,oBAAoB;AAClD,QAAA,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IAChE;AAEA,IAAA,IAAI,CAAC,GAAW,EAAA;QACd,OAAO,IAAI,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACzF;IAEA,KAAK,CAAC,GAAW,EAAE,KAAa,EAAA;QAC9B,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,QAAA,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC;AACtB,QAAA,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAC9C,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,KAAK,QAAQ,IAAI,OAAO,IAAI,QAAQ,KAAK,OAAO,GAAG,QAAQ,GAAG,IAAI,CAAC;AAC/F,QAAA,IAAI,CAAC,KAAK;YAAE;AACZ,QAAA,IAAI,OAAO;AAAE,YAAA,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC;AACxC,QAAA,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,kBAAkB,CAAC;AACpF,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAClD;IAEQ,eAAe,CAAC,GAAW,EAAE,KAAa,EAAA;AAChD,QAAA,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC3B,QAAA,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC;AACpC,QAAA,IAAI,IAAI,IAAI,OAAO,IAAI,OAAO,KAAK,KAAK;AAAE,YAAA,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;IAClG;;IAGQ,MAAM,aAAa,CAAC,EAAU,EAAA;QACpC,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE;YACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AAC3B,YAAA,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC;AACjC,YAAA,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAAE;YACnE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC;AACnD,YAAA,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;gBAAE;YACxD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACrE;IACF;IAEQ,QAAQ,GAAA;AACd,QAAA,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU;QAC9B,KAAK,MAAM,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,EAAE,IAAI,CAAC,MAAM,cAAc,CAAC,CAAC,EAAE;AAC1E,YAAA,IAAI,CAAC,KAAK;gBAAE;AACZ,YAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;gBACrC,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAAE,oBAAA,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAC1D;QACF;AACA,QAAA,OAAO,CAAC,GAAG,IAAI,CAAC;IAClB;IAEQ,KAAK,CAAC,GAAW,EAAE,KAAa,EAAA;AACtC,QAAA,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE;AAC9B,YAAA,IAAI,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5C,IAAI,CAAC,MAAM,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC5C;aAAO;AACL,YAAA,IAAI,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QAC1C;IACF;AAEA,IAAA,MAAM,CAAC,GAAW,EAAA;QAChB,IAAI,CAAC,MAAM,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC5C;IAEA,KAAK,GAAA;;QAEH,IAAI,CAAC,MAAK;YACR,MAAM,IAAI,GAAa,EAAE;AACzB,YAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE;gBAC5C,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/B,IAAI,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;AAAE,oBAAA,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YAClE;AACA,YAAA,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,KAAK,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;AACrD,QAAA,CAAC,CAAC;QACF,IAAI,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC;IACpC;AAlFW,IAAA,OAAA,IAAA,GAAA,EAAA,CAAA,kBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,yBAAyB,kBAIJ,sBAAsB,EAAA,QAAA,EAAA,IAAA,EAAA,CAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;AAJ3C,IAAA,OAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,yBAAyB,cADZ,MAAM,EAAA,CAAA;;4FACnB,yBAAyB,EAAA,UAAA,EAAA,CAAA;kBADrC,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE;;0BAKnB;;0BAAY,MAAM;2BAAC,sBAAsB;;AAiFxD,SAAS,mBAAmB,CAAC,IAAY,EAAA;AACvC,IAAA,IAAI;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAoD;AAClF,QAAA,MAAM,OAAO,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;QAC7C,IAAI,OAAO,OAAO,KAAK,QAAQ;AAAE,YAAA,OAAO,KAAK;AAC7C,QAAA,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC;AACzC,QAAA,MAAM,IAAI,GAAG,OAAO,GAAG,iBAAiB,CAAC;AACzC,QAAA,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM;IACzC;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,KAAK;IACd;AACF;AAEA,SAAS,cAAc,CAAC,IAAmB,EAAA;AACzC,IAAA,IAAI,CAAC,IAAI;AAAE,QAAA,OAAO,IAAI;AACtB,IAAA,IAAI;AACF,QAAA,MAAM,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAA0D,EAAE,WAAW,EAAE,aAAa;AACpH,QAAA,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,GAAG,KAAK,GAAG,IAAI;IAC1D;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,IAAI;IACb;AACF;AAEA,SAAS,YAAY,CAAC,IAAY,EAAA;IAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B;AAC1D,IAAA,OAAO,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChG;AAEA,SAAS,UAAU,CAAC,KAAoB,EAAA;AACtC,IAAA,IAAI,CAAC,KAAK;AAAE,QAAA,OAAO,KAAK;AACxB,IAAA,IAAI;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAmC;AAClE,QAAA,OAAO,CAAC,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,KAAK,aAAa,IAAI,MAAM,IAAI,wBAAwB,IAAI,MAAM,CAAC;IAClH;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,KAAK;IACd;AACF;AAEA,SAAS,gBAAgB,CAAC,KAAa,EAAA;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChC,IAAA,IAAI,CAAC,IAAI;AAAE,QAAA,OAAO,IAAI;AACtB,IAAA,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;IACzD,MAAM,MAAM,GAAG,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAA4B;AAC5D;AAEA,SAAS,IAAI,CAAI,EAAW,EAAA;AAC1B,IAAA,IAAI;QACF,OAAO,EAAE,EAAE;IACb;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,IAAI;IACb;AACF;;AChKA,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC;AAElD;;;;;;;;;AASG;AACG,SAAU,wBAAwB,CACtC,MAA4B,EAC5B,GAAA,GAAc,OAAO,MAAM,KAAK,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,EAAE,EAAA;AAEvE,IAAA,OAAO,MAAM,CAAC,SAAS,EAAE,CAAC,IAAI,CAC5B,SAAS,CAAC,CAAC,MAAM,KAAI;AACnB,QAAA,IAAI,MAAM,CAAC,eAAe,IAAI,UAAU,CAAC,GAAG,CAAC;AAAE,YAAA,OAAO,EAAE,CAAC,MAAM,CAAC;QAChE,OAAO,MAAM,CAAC,eAAe,EAAE,CAAC,IAAI,CAClC,IAAI,CAAC,CAAC,CAAC,EACP,SAAS,CAAC,CAAC,YAAY,KACrB,YAAY,GAAG,MAAM,CAAC,wBAAwB,EAAE,CAAC,IAAI,CAACA,YAAU,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CACjG,CACF;IACH,CAAC,CAAC,CACH;AACH;AAEA,SAAS,UAAU,CAAC,GAAW,EAAA;AAC7B,IAAA,IAAI,CAAC,GAAG;AAAE,QAAA,OAAO,KAAK;IACtB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,YAAY;AAC5D,IAAA,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnD;;ACrCA,MAAM,WAAW,GAAG,YAAY;AAEhC;;;;;;;;;;AAUG;MAIU,SAAS,CAAA;AACH,IAAA,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;AAEnC,IAAA,KAAK,GAAG,MAAM,CAAkB,IAAI,4EAAC;AACrC,IAAA,YAAY,GAAG,MAAM,CAAgB,IAAI,mFAAC;AAC1C,IAAA,aAAa,GAAG,MAAM,CAAgB,IAAI,oFAAC;AAC3C,IAAA,QAAQ,GAAG,MAAM,CAAgB,IAAI,+EAAC;AACtC,IAAA,UAAU,GAAG,MAAM,CAAU,KAAK,iFAAC;AACnC,IAAA,MAAM,GAAG,MAAM,CAAgB,IAAI,6EAAC;AACpC,IAAA,gBAAgB,GAAG,MAAM,CAAgB,IAAI,uFAAC;;AAE9C,IAAA,eAAe,GAAG,MAAM,CAAU,KAAK,sFAAC;AACxC,IAAA,oBAAoB,GAAG,MAAM,CAA6B,IAAI,2FAAC;AAC/D,IAAA,aAAa,GAAG,MAAM,CAAU,KAAK,oFAAC;AACtC,IAAA,YAAY,GAAG,MAAM,CAAU,KAAK,mFAAC;;AAG7C,IAAA,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;AAC9B,IAAA,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE;AAC5C,IAAA,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE;AAC9C,IAAA,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE;AACpC,IAAA,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE;AACxC,IAAA,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE;AAChC,IAAA,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC,UAAU,EAAE;AACpD,IAAA,cAAc,GAAG,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE;AAClD,IAAA,mBAAmB,GAAG,IAAI,CAAC,oBAAoB,CAAC,UAAU,EAAE;AAC5D,IAAA,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE;AAC9C,IAAA,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE;AAE5C,IAAA,eAAe,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,gBAAgB,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;;AAGvF,IAAA,KAAK,GAAG,QAAQ,CAAY,OAAO;AAC1C,QAAA,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;AAClB,QAAA,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE;AAChC,QAAA,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE;AAClC,QAAA,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE;AACxB,QAAA,eAAe,EAAE,IAAI,CAAC,eAAe,EAAE;AACvC,QAAA,SAAS,EAAE,IAAI,CAAC,UAAU,EAAE;AAC5B,QAAA,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE;AACpB,QAAA,eAAe,EAAE,IAAI,CAAC,gBAAgB,EAAE;AACxC,QAAA,mBAAmB,EAAE,IAAI,CAAC,oBAAoB,EAAE;AAChD,QAAA,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE;AACnC,KAAA,CAAC,4EAAC;AAEH,IAAA,WAAA,GAAA;QACE,IAAI,CAAC,OAAO,EAAE;;;;;;;;;IAShB;AAEA;;;AAGG;AACH,IAAA,KAAK,CACH,IAAc,EACd,WAAmB,EACnB,YAAqB,EACrB,OAAgB,EAAA;AAEhB,QAAA,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;AACpB,QAAA,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;QAC5C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC;AAClC,QAAA,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;AAErB,QAAA,IAAI,CAAC,oBAAoB,CAAC,WAAW,CAAC;QAEtC,IAAI,CAAC,OAAO,EAAE;IAChB;AAEA;;;;AAIG;AACH,IAAA,oBAAoB,CAAC,WAAmB,EAAA;AACtC,QAAA,MAAM,aAAa,GAAG,aAAa,CAAC,WAAW,CAAC;AAChD,QAAA,IAAI,IAAI,CAAC,gBAAgB,EAAE,KAAK,aAAa,EAAE;AAC7C,YAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC;AACxC,YAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;YAC/B,IAAI,CAAC,OAAO,EAAE;QAChB;IACF;AAEA;;AAEG;IACH,MAAM,GAAA;AACJ,QAAA,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;AACpB,QAAA,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;AAC3B,QAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;AAC5B,QAAA,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;AACvB,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;AAC/B,QAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC;AAC/B,QAAA,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC;AACnC,QAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;AAC7B,QAAA,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;QACrB,IAAI,CAAC,YAAY,EAAE;IACrB;AAEA;;AAEG;AACH,IAAA,OAAO,CAAC,IAAqB,EAAA;AAC3B,QAAA,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;QACpB,IAAI,CAAC,OAAO,EAAE;IAChB;AAEA;;AAEG;AACH,IAAA,cAAc,CAAC,KAAoB,EAAA;AACjC,QAAA,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC;QAC5B,IAAI,CAAC,OAAO,EAAE;IAChB;AAEA;;AAEG;AACH,IAAA,eAAe,CAAC,KAAoB,EAAA;AAClC,QAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC;QAC7B,IAAI,CAAC,OAAO,EAAE;IAChB;AAEA;;AAEG;AACH,IAAA,kBAAkB,CAAC,QAAuB,EAAA;AACxC,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE;IAChB;AAEA;;;;;;;AAOG;IACH,YAAY,CAAC,QAAgB,EAAE,WAAmB,EAAA;AAChD,QAAA,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;AACnC,QAAA,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;AAC9B,QAAA,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;QAClC,IAAI,CAAC,OAAO,EAAE;IAChB;AAEA;;AAEG;AACH,IAAA,sBAAsB,CAAC,YAAwC,EAAA;AAC7D,QAAA,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,YAAY,CAAC;QAC3C,IAAI,CAAC,OAAO,EAAE;IAChB;AAEA;;AAEG;AACH,IAAA,aAAa,CAAC,YAAqB,EAAA;AACjC,QAAA,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,YAAY,CAAC;QACpC,IAAI,CAAC,OAAO,EAAE;IAChB;AAEA;;AAEG;AACH,IAAA,UAAU,CAAC,SAAkB,EAAA;AAC3B,QAAA,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC;IAChC;AAEA;;AAEG;AACH,IAAA,QAAQ,CAAC,KAAoB,EAAA;AAC3B,QAAA,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;IACxB;AAEA;;AAEG;IACK,OAAO,GAAA;AACb,QAAA,IAAI;YACF,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC;YAChD,IAAI,MAAM,EAAE;gBACV,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC/B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;gBACjC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;gBAC/C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;gBACjD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;gBACvC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC;gBACvD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC;gBACtD,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC;gBAC/D,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC;YACpD;QACF;AAAE,QAAA,MAAM;;QAER;gBAAU;AACR,YAAA,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAC7B;IACF;AAEA;;AAEG;IACK,OAAO,GAAA;AACb,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,GAAG;AACX,gBAAA,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE;AAClB,gBAAA,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE;AAChC,gBAAA,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE;AAClC,gBAAA,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE;AACxB,gBAAA,eAAe,EAAE,IAAI,CAAC,gBAAgB,EAAE;AACxC,gBAAA,cAAc,EAAE,IAAI,CAAC,eAAe,EAAE;AACtC,gBAAA,mBAAmB,EAAE,IAAI,CAAC,oBAAoB,EAAE;AAChD,gBAAA,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE;aACnC;AACD,YAAA,YAAY,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACzD;AAAE,QAAA,MAAM;;QAER;IACF;AAEA;;AAEG;IACK,YAAY,GAAA;AAClB,QAAA,IAAI;AACF,YAAA,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC;QACtC;AAAE,QAAA,MAAM;;QAER;IACF;wGAhPW,SAAS,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;AAAT,IAAA,OAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,SAAS,cAFR,MAAM,EAAA,CAAA;;4FAEP,SAAS,EAAA,UAAA,EAAA,CAAA;kBAHrB,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE,MAAM;AACnB,iBAAA;;;ACdD;;;;;;;AAOG;MAIU,WAAW,CAAA;AACL,IAAA,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC;AACzB,IAAA,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAEtC,UAAU,GAAG,YAAY;AAEjC;;AAEG;AACH,IAAA,aAAa,CAAC,GAAW,EAAA;AACvB,QAAA,IAAI,CAAC,UAAU,GAAG,GAAG;IACvB;AAEA;;AAEG;AACH,IAAA,KAAK,CAAC,OAAqB,EAAA;AACzB,QAAA,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;AAC/B,QAAA,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;QAE7B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAgB,CAAA,EAAG,IAAI,CAAC,UAAU,CAAA,WAAA,CAAa,EAAE,OAAO,CAAC,CAAC,IAAI,CACjF,GAAG,CAAC,CAAC,QAAQ,KAAI;YACf,IAAI,CAAC,SAAS,CAAC,KAAK,CAClB,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,WAAW,EACpB,QAAQ,CAAC,YAAY,EACrB,QAAQ,CAAC,OAAO,CACjB;;AAGD,YAAA,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI;YAC1B,IAAI,IAAI,CAAC,eAAe,EAAE,MAAM,IAAI,IAAI,CAAC,iBAAiB,EAAE;;AAE1D,gBAAA,MAAM,UAAU,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAC1C,CAAC,EAAE,KAAK,IAAI,CAAC,iBAAiB,GAAG,EAAE,CAAC,KAAK,OAAO,IAAI,IAAI,CAAC,iBAAiB,GAAG,EAAE,CAAC,KAAK,OAAO,CAC7F,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;gBAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC;AAC/C,gBAAA,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC;AACpC,oBAAA,EAAE,EAAE,UAAU;oBACd,IAAI,EAAE,UAAU;oBAChB,IAAI;AACL,iBAAA,CAAC;YACJ;AACF,QAAA,CAAC,CAAC,EACF,UAAU,CAAC,CAAC,KAAK,KAAI;AACnB,YAAA,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,IAAI,cAAc,CAAC;AAC/D,YAAA,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;AAChC,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;AAChC,QAAA,CAAC,CAAC,EACF,GAAG,CAAC,MAAK;AACP,YAAA,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC;QAClC,CAAC,CAAC,CACH;IACH;AAEA;;AAEG;IACH,MAAM,GAAA;QACJ,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE;QAElD,OAAO,IAAI,CAAC;aACT,IAAI,CAAO,CAAA,EAAG,IAAI,CAAC,UAAU,cAAc,EAAE,EAAE,YAAY,EAAE;AAC7D,aAAA,IAAI,CACH,GAAG,CAAC,MAAK;AACP,YAAA,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;AACzB,QAAA,CAAC,CAAC,EACF,UAAU,CAAC,CAAC,KAAK,KAAI;;AAEnB,YAAA,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;AACvB,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC,CAAC,CAAC,CACH;IACL;AAEA;;AAEG;IACH,WAAW,GAAA;AACT,QAAA,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;IACzB;AAEA;;AAEG;IACH,YAAY,GAAA;QACV,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE;QAElD,IAAI,CAAC,YAAY,EAAE;YACjB,OAAO,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAClE;QAEA,OAAO,IAAI,CAAC;aACT,IAAI,CACH,CAAA,EAAG,IAAI,CAAC,UAAU,eAAe,EACjC,EAAE,YAAY,EAAE;AAEjB,aAAA,IAAI,CACH,GAAG,CAAC,CAAC,QAAQ,KAAI;YACf,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC;AACnD,YAAA,IAAI,QAAQ,CAAC,YAAY,EAAE;gBACzB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,CAAC,YAAY,CAAC;YACvD;AACF,QAAA,CAAC,CAAC,EACF,UAAU,CAAC,CAAC,KAAK,KAAI;;AAEnB,YAAA,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE;AACvB,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC,CAAC,CAAC,CACH;IACL;AAEA;;AAEG;IACH,UAAU,GAAA;QACR,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAW,CAAA,EAAG,IAAI,CAAC,UAAU,eAAe,CAAC,CAAC,IAAI,CACpE,GAAG,CAAC,CAAC,IAAI,KAAI;AACX,YAAA,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,CAAC,CAAC,CACH;IACH;AAEA;;AAEG;AACH,IAAA,aAAa,CAAC,IAAuB,EAAA;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAW,CAAA,EAAG,IAAI,CAAC,UAAU,CAAA,aAAA,CAAe,EAAE,IAAI,CAAC,CAAC,IAAI,CAC5E,GAAG,CAAC,CAAC,IAAI,KAAI;AACX,YAAA,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAC9B,CAAC,CAAC,CACH;IACH;AAEA;;AAEG;IACH,cAAc,GAAA;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;AAC1C,QAAA,IAAI,CAAC,KAAK;AAAE,YAAA,OAAO,IAAI;AAEvB,QAAA,IAAI;YACF,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;AACvC,YAAA,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACjD,YAAA,OAAO,OAAO,CAAC,GAAG,GAAG,WAAW;QAClC;AAAE,QAAA,MAAM;AACN,YAAA,OAAO,IAAI;QACb;IACF;AAEA;;AAEG;AACH,IAAA,WAAW,CAAC,KAAa,EAAA;QACvB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC;AAC9B,QAAA,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;AACtB,YAAA,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC;QACzC;AAEA,QAAA,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACnE,QAAA,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAiB;IAC5C;AAEA;;AAEG;IACH,cAAc,GAAA;AACZ,QAAA,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE;IACrC;AAEA;;AAEG;IACH,eAAe,GAAA;AACb,QAAA,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE;IACzC;AAEA;;AAEG;IACH,OAAO,GAAA;AACL,QAAA,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;IAC9B;AAEA;;AAEG;IACH,YAAY,GAAA;AACV,QAAA,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE;IACtC;AAEA;;AAEG;IACH,kBAAkB,GAAA;AAChB,QAAA,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE;IACzC;AAEA;;AAEG;AACH,IAAA,kBAAkB,CAAC,QAAuB,EAAA;AACxC,QAAA,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,QAAQ,CAAC;IAC7C;wGA7MW,WAAW,EAAA,IAAA,EAAA,EAAA,EAAA,MAAA,EAAA,EAAA,CAAA,eAAA,CAAA,UAAA,EAAA,CAAA;AAAX,IAAA,OAAA,KAAA,GAAA,EAAA,CAAA,qBAAA,CAAA,EAAA,UAAA,EAAA,QAAA,EAAA,OAAA,EAAA,SAAA,EAAA,QAAA,EAAA,EAAA,EAAA,IAAA,EAAA,WAAW,cAFV,MAAM,EAAA,CAAA;;4FAEP,WAAW,EAAA,UAAA,EAAA,CAAA;kBAHvB,UAAU;AAAC,YAAA,IAAA,EAAA,CAAA;AACV,oBAAA,UAAU,EAAE,MAAM;AACnB,iBAAA;;;ACdD;;;;;AAKG;MACU,SAAS,GAAkB,CACtC,KAA6B,EAC7B,KAA0B,KACxB;AACF,IAAA,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;AACnC,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;AAE7B,IAAA,IAAI,SAAS,CAAC,eAAe,EAAE,EAAE;AAC/B,QAAA,OAAO,IAAI;IACb;;AAGA,IAAA,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG;;AAG3B,IAAA,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,EAAE;QACtC,WAAW,EAAE,EAAE,SAAS,EAAE;AAC3B,KAAA,CAAC;AACJ;AAEA;;;;;AAKG;AACI,MAAM,UAAU,GAAkB,MAAK;AAC5C,IAAA,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;AACnC,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;AAE7B,IAAA,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE;AAChC,QAAA,OAAO,IAAI;IACb;;IAGA,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC;AAEA;;;;;AAKG;AACI,MAAM,eAAe,GAAkB,MAAK;AACjD,IAAA,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AACrD,IAAA,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;AACnC,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;;AAG7B,IAAA,IAAI,kBAAkB,CAAC,YAAY,EAAE,EAAE;AACrC,QAAA,OAAO,IAAI;IACb;;AAGA,IAAA,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE;IAC7B,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC,EAAE;AACjG,QAAA,OAAO,IAAI;IACb;;IAGA,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC;AAEA;;;;;;AAMG;AACI,MAAM,aAAa,GAAkB,MAAK;AAC/C,IAAA,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AACrD,IAAA,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;AACnC,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;;IAG7B,IAAI,kBAAkB,CAAC,YAAY,EAAE;AAAE,QAAA,OAAO,IAAI;AAElD,IAAA,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE;IAC7B,IAAI,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,IACrB,CAAC,CAAC,WAAW,EAAE,KAAK,YAAY,IAAI,CAAC,CAAC,WAAW,EAAE,KAAK,aAAa,CACtE;AAAE,QAAA,OAAO,IAAI;;AAGd,IAAA,MAAM,UAAU,GAAG,SAAS,CAAC,mBAAmB,EAAE;IAClD,IAAI,UAAU,EAAE,EAAE;AAAE,QAAA,OAAO,IAAI;IAE/B,OAAO,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC;AACpC;;AC9FA;;;AAGG;MACU,2BAA2B,GAAG,IAAI,cAAc,CAC3D,6BAA6B,EAC7B,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,EAAE;AAG9C;;;;AAIG;AACH,SAAS,2BAA2B,CAClC,KAAmD,EAAA;AAEnD,IAAA,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;AACrD,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;AAC7B,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,2BAA2B,CAAC;AAElD,IAAA,MAAM,MAAM,GAAG,MACb,kBAAkB,CAAC,eAAe,EAAE,IAAI,KAAK,CAAC,kBAAkB;AAC9D,UAAE;UACA,MAAM,CAAC,aAAa,CAAC,CAAC,eAAe,CAAC,CAAC;AAE7C,IAAA,IAAI,kBAAkB,CAAC,SAAS,EAAE,EAAE;QAClC,OAAO,MAAM,EAAE;IACjB;IAEA,OAAO,YAAY,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC,IAAI,CACpD,MAAM,CAAC,OAAO,CAAC,EACfC,MAAI,CAAC,CAAC,CAAC,EACPC,SAAO,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EACjDC,KAAG,CAAC,MAAM,MAAM,EAAE,CAAC,CACpB;AACH;AAEA;;;;;;;;;;;;;;;AAeG;AACI,MAAM,eAAe,GAAkB,CAAC,KAA6B,KAAI;IAC9E,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAuB;IACjE,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAyB;IACrE,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,CAAwB;;AAGlE,IAAA,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE;AAC/B,QAAA,OAAO,IAAI;IACb;AAEA,IAAA,OAAO,2BAA2B,CAAC,CAAC,kBAAkB,KAAI;QACxD,IAAI,UAAU,IAAI,kBAAkB,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE;AAC9D,YAAA,OAAO,IAAI;QACb;QACA,IAAI,WAAW,EAAE;AACf,YAAA,OAAO;AACL,kBAAE,kBAAkB,CAAC,iBAAiB,CAAC,WAAW;AAClD,kBAAE,kBAAkB,CAAC,gBAAgB,CAAC,WAAW,CAAC;QACtD;AACA,QAAA,OAAO,KAAK;AACd,IAAA,CAAC,CAAC;AACJ;AAEA;;;;;;;;;;;;;;AAcG;AACI,MAAM,kBAAkB,GAAkB,CAAC,KAA6B,KAAI;IACjF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAyB;IAErE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;AAC5C,QAAA,OAAO,IAAI;IACb;AAEA,IAAA,OAAO,2BAA2B,CAAC,CAAC,kBAAkB,KACpD,kBAAkB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CACjD;AACH;AAEA;;;;;;;;;;;;;;AAcG;AACI,MAAM,mBAAmB,GAAkB,CAAC,KAA6B,KAAI;IAClF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,aAAa,CAAyB;IAErE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE;AAC5C,QAAA,OAAO,IAAI;IACb;AAEA,IAAA,OAAO,2BAA2B,CAAC,CAAC,kBAAkB,KACpD,kBAAkB,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAClD;AACH;;ACvIA;;;;;;;;;;AAUG;AAEH,MAAM,cAAc,GAAG,yBAAyB;AAChD,MAAM,cAAc,GAAG,wBAAwB;AAC/C,MAAM,sBAAsB,GAAG,+BAA+B;AAC9D,MAAM,6BAA6B,GAAG,oCAAoC;AAC1E,MAAM,uBAAuB,GAAG,+BAA+B;AAC/D,MAAM,qBAAqB,GAAG,+BAA+B;AAU7D;;;;AAIG;SACa,yBAAyB,GAAA;IACvC,IAAI,OAAO,MAAM,KAAK,WAAW;AAAE,QAAA,OAAO,SAAS;AACnD,IAAA,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ;AACrC,IAAA,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW;AAAE,QAAA,OAAO,SAAS;AAClE,IAAA,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC;AAAE,QAAA,OAAO,SAAS;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;AAC7B,IAAA,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;AAAE,QAAA,OAAO,SAAS;AACtC,IAAA,OAAO,KAAK,CAAC,CAAC,CAAC;AACjB;AAEA;;;AAGG;AACG,SAAU,yBAAyB,CAAC,gBAAwB,EAAA;IAChE,IAAI,OAAO,cAAc,KAAK,WAAW;AAAE,QAAA,OAAO,gBAAgB;IAClE,OAAO,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,gBAAgB;AACnE;AAEA;;;AAGG;SACa,aAAa,GAAA;IAC3B,IAAI,OAAO,cAAc,KAAK,WAAW;AAAE,QAAA,OAAO,IAAI;IACtD,MAAM,UAAU,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC;IACzD,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC;AACxD,IAAA,IAAI,CAAC,UAAU,IAAI,CAAC,SAAS;AAAE,QAAA,OAAO,IAAI;IAE1C,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,uBAAuB,CAAC;AACjE,IAAA,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,YAAY,GAAG,SAAS,GAAG,SAAS;IAE5F,OAAO;QACL,UAAU;QACV,SAAS;QACT,gBAAgB,EAAE,cAAc,CAAC,OAAO,CAAC,sBAAsB,CAAC,IAAI,SAAS;QAC7E,qBAAqB,EAAE,cAAc,CAAC,OAAO,CAAC,6BAA6B,CAAC,IAAI,SAAS;AACzF,QAAA,gBAAgB,EAAE,MAAM;KACzB;AACH;AAEA;;;;;;;;;AASG;SACa,cAAc,CAAC,GAAc,EAAE,oBAAoB,GAAG,KAAK,EAAA;IACzE,IAAI,OAAO,cAAc,KAAK,WAAW;QAAE;AAE3C,IAAA,qBAAqB,EAAE;IAEvB,cAAc,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,UAAU,CAAC;IACtD,cAAc,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC,SAAS,CAAC;AAErD,IAAA,IAAI,GAAG,CAAC,gBAAgB,EAAE;QACxB,cAAc,CAAC,OAAO,CAAC,sBAAsB,EAAE,GAAG,CAAC,gBAAgB,CAAC;IACtE;SAAO;AACL,QAAA,cAAc,CAAC,UAAU,CAAC,sBAAsB,CAAC;IACnD;AAEA,IAAA,IAAI,GAAG,CAAC,qBAAqB,EAAE;QAC7B,cAAc,CAAC,OAAO,CAAC,6BAA6B,EAAE,GAAG,CAAC,qBAAqB,CAAC;IAClF;SAAO;AACL,QAAA,cAAc,CAAC,UAAU,CAAC,6BAA6B,CAAC;IAC1D;AAEA,IAAA,IAAI,GAAG,CAAC,gBAAgB,EAAE;QACxB,cAAc,CAAC,OAAO,CAAC,uBAAuB,EAAE,GAAG,CAAC,gBAAgB,CAAC;IACvE;SAAO;AACL,QAAA,cAAc,CAAC,UAAU,CAAC,uBAAuB,CAAC;IACpD;IAEA,IAAI,oBAAoB,EAAE;AACxB,QAAA,cAAc,CAAC,OAAO,CAAC,qBAAqB,EAAE,GAAG,CAAC;IACpD;AACF;AAEA,SAAS,qBAAqB,GAAA;IAC5B,IAAI,OAAO,cAAc,KAAK,WAAW;QAAE;;;;;;IAM3C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE;AAC7C,QAAA,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;AACrB,YAAA,cAAc,CAAC,UAAU,CAAC,GAAG,CAAC;QAChC;IACF;AACF;AAEA;;;;;AAKG;AACG,SAAU,wBAAwB,CACtC,GAAc,EAAA;IAEd,MAAM,MAAM,GAA2B,EAAE;IACzC,IAAI,GAAG,CAAC,gBAAgB;AAAE,QAAA,MAAM,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,gBAAgB;IACtE,IAAI,GAAG,CAAC,qBAAqB;AAAE,QAAA,MAAM,CAAC,QAAQ,CAAC,GAAG,GAAG,CAAC,qBAAqB;IAC3E,IAAI,GAAG,CAAC,gBAAgB;AAAE,QAAA,MAAM,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,gBAAgB;AAClE,IAAA,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,GAAG,SAAS;AACxD;AAEA;;;;AAIG;SACa,uBAAuB,GAAA;IACrC,IAAI,OAAO,cAAc,KAAK,WAAW;AAAE,QAAA,OAAO,KAAK;AACvD,IAAA,IAAI,cAAc,CAAC,OAAO,CAAC,qBAAqB,CAAC,KAAK,GAAG;AAAE,QAAA,OAAO,KAAK;AACvE,IAAA,cAAc,CAAC,UAAU,CAAC,qBAAqB,CAAC;AAChD,IAAA,OAAO,IAAI;AACb;AAEA;;;;;;;;;AASG;SACa,cAAc,GAAA;IAC5B,IAAI,OAAO,cAAc,KAAK,WAAW;QAAE;AAC3C,IAAA,cAAc,CAAC,UAAU,CAAC,cAAc,CAAC;AACzC,IAAA,cAAc,CAAC,UAAU,CAAC,cAAc,CAAC;AACzC,IAAA,cAAc,CAAC,UAAU,CAAC,sBAAsB,CAAC;AACjD,IAAA,cAAc,CAAC,UAAU,CAAC,6BAA6B,CAAC;AACxD,IAAA,cAAc,CAAC,UAAU,CAAC,uBAAuB,CAAC;AAClD,IAAA,cAAc,CAAC,UAAU,CAAC,qBAAqB,CAAC;AAChD,IAAA,qBAAqB,EAAE;AACzB;;ACxKA,IAAI,YAAY,GAAG,KAAK;AACxB,IAAI,cAAc,GAAG,IAAI,aAAa,CAAS,CAAC,CAAC;AAEjD;;;;;AAKG;MACU,eAAe,GAAsB,CAChD,GAAyB,EACzB,IAAmB,KACe;AAClC,IAAA,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;AACnC,IAAA,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;AACvC,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;;AAG7B,IAAA,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;AAC3B,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB;AAEA,IAAA,MAAM,KAAK,GAAG,SAAS,CAAC,WAAW,EAAE;IAErC,IAAI,KAAK,EAAE;AACT,QAAA,GAAG,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC;IACjC;AAEA,IAAA,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,UAAU,CAAC,CAAC,KAAwB,KAAI;QACtC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,EAAE;AACjC,YAAA,OAAO,cAAc,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC;QAClE;AACA,QAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;IAChC,CAAC,CAAC,CACH;AACH;AAEA;;AAEG;AACH,SAAS,cAAc,CAAC,GAAW,EAAA;IACjC,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,eAAe,EAAE,cAAc,CAAC;AACtE,IAAA,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACjE;AAEA;;AAEG;AACH,SAAS,aAAa,CAAC,GAAyB,EAAE,KAAa,EAAA;IAC7D,OAAO,GAAG,CAAC,KAAK,CAAC;AACf,QAAA,UAAU,EAAE;YACV,aAAa,EAAE,CAAA,OAAA,EAAU,KAAK,CAAA,CAAE;AACjC,SAAA;AACF,KAAA,CAAC;AACJ;AAEA;;;;;;;AAOG;AACH,SAAS,cAAc,CACrB,GAAyB,EACzB,IAAmB,EACnB,WAAwB,EACxB,SAAoB,EACpB,MAAc,EAAA;;AAGd,IAAA,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE;AAChC,QAAA,OAAO,UAAU,CAAC,MAAM,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IACjE;IAEA,IAAI,CAAC,YAAY,EAAE;QACjB,YAAY,GAAG,IAAI;AACnB,QAAA,cAAc,GAAG,IAAI,aAAa,CAAS,CAAC,CAAC;AAE7C,QAAA,OAAO,WAAW,CAAC,YAAY,EAAE,CAAC,IAAI,CACpCD,SAAO,CAAC,KAAK,CAAC,EACdE,WAAS,CAAC,CAAC,QAAQ,KAAI;YACrB,YAAY,GAAG,KAAK;AACpB,YAAA,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;YACzC,cAAc,CAAC,QAAQ,EAAE;YACzB,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;AACvD,QAAA,CAAC,CAAC,EACF,UAAU,CAAC,CAAC,KAAK,KAAI;YACnB,YAAY,GAAG,KAAK;AACpB,YAAA,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC;YAC3B,SAAS,CAAC,MAAM,EAAE;AAClB,YAAA,MAAM,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,EAAE;AAC1B,gBAAA,WAAW,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,EAAE;AACvC,aAAA,CAAC;AACF,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC,CAAC,CAAC,CACH;IACH;;IAGA,OAAO,cAAc,CAAC,IAAI,CACxBH,MAAI,CAAC,CAAC,CAAC,EACPG,WAAS,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EACrD,UAAU,CAAC,MAAM,UAAU,CAAC,MAAM,IAAI,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAC3E;AACH;;AC5GA,MAAM,cAAc,GAAG,wBAAwB;AAE/C,IAAI,eAAe,GAAyC,IAAI;AAEhE;;;;;;;AAOG;MACU,sBAAsB,GAAsB,CACvD,GAAyB,EACzB,IAAmB,KACe;AAClC,IAAA,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAEzC,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE;QACpC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAACJ,YAAU,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IACrF;AAEA,IAAA,OAAO,YAAY,CAAC,cAAc,EAAE,CAAC,IAAI,CACvC,IAAI,CAAC,CAAC,CAAC,EACP,SAAS,CAAC,CAAC,KAAK,KAAI;AAClB,QAAA,MAAM,MAAM,GAAG,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,GAAG;QACjD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAACA,YAAU,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC,CACH;AACH;AAEA,SAAS,QAAQ,CAAC,GAAyB,EAAE,KAAa,EAAA;IACxD,OAAO,GAAG,CAAC,KAAK,CAAC;AACf,QAAA,UAAU,EAAE,EAAE,aAAa,EAAE,CAAA,OAAA,EAAU,KAAK,EAAE,EAAE;AACjD,KAAA,CAAC;AACJ;AAEA,SAAS,SAAS,CAChB,KAAc,EACd,GAAyB,EACzB,IAAmB,EACnB,YAA0B,EAAA;IAE1B,IACE,KAAK,YAAY,iBAAiB;QAClC,KAAK,CAAC,MAAM,KAAK,GAAG;QACpB,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EACtC;AACA,QAAA,OAAO,aAAa,CAAC,YAAY,CAAC,CAAC,IAAI,CACrC,SAAS,CAAC,CAAC,MAAM,KAAI;YACnB,IAAI,MAAM,EAAE,eAAe,IAAI,MAAM,EAAE,WAAW,EAAE;gBAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;YAChD;AACA,YAAA,OAAO,CAAC,IAAI,CAAC,gEAAgE,CAAC;YAC9E,eAAe,CAAC,YAAY,CAAC;AAC7B,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;AAChC,QAAA,CAAC,CAAC,EACFA,YAAU,CAAC,CAAC,YAAY,KAAI;AAC1B,YAAA,OAAO,CAAC,IAAI,CAAC,6CAA6C,EAAE,YAAY,CAAC;YACzE,eAAe,CAAC,YAAY,CAAC;AAC7B,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC,CAAC,CAAC,CACH;IACH;AACA,IAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;AAChC;AAEA,SAAS,aAAa,CAAC,YAA0B,EAAA;IAC/C,IAAI,CAAC,eAAe,EAAE;AACpB,QAAA,eAAe,GAAG,YAAY,CAAC,mBAAmB,EAAE,CAAC,IAAI,CACvD,IAAI,CAAC,CAAC,CAAC,EACP,QAAQ,CAAC,MAAK,EAAG,eAAe,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAC3C,WAAW,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAChD;IACH;AACA,IAAA,OAAO,eAAe;AACxB;AAEA,SAAS,eAAe,CAAC,YAA0B,EAAA;AACjD,IAAA,iBAAiB,EAAE;IACnB,YAAY,CAAC,SAAS,EAAE;AAC1B;AAEA;;;;AAIG;SACa,iBAAiB,GAAA;AAC/B,IAAA,IAAI;AACF,QAAA,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI;AAC3F,QAAA,IACE,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,CAAC;AACnC,YAAA,CAAC,UAAU,CAAC,UAAU,CAAC,eAAe,CAAC;AACvC,YAAA,CAAC,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC;YAChC,UAAU,KAAK,GAAG,EAClB;AACA,YAAA,cAAc,CAAC,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC;QACpD;IACF;AAAE,IAAA,MAAM;;IAER;AACF;AAEA;;AAEG;SACa,qBAAqB,GAAA;AACnC,IAAA,IAAI;QACF,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,cAAc,CAAC;AAClD,QAAA,cAAc,CAAC,UAAU,CAAC,cAAc,CAAC;AACzC,QAAA,OAAO,GAAG;IACZ;AAAE,IAAA,MAAM;AACN,QAAA,OAAO,IAAI;IACb;AACF;;ACpHA;;;;;AAKG;AACH,MAAM,4BAA4B,GAAG;IACnC,WAAW;IACX,eAAe;IACf,aAAa;;;IAGb,cAAc;CACf;AAED;;;;;;;;;;;;AAYG;MACU,iBAAiB,GAAsB,CAClD,GAAyB,EACzB,IAAmB,KACe;AAClC,IAAA,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;;AAGnC,IAAA,MAAM,QAAQ,GAAG,SAAS,CAAC,cAAc,EAAE,GAAG,SAAS,CAAC,eAAe,EAAE,GAAG,IAAI;;;;AAKhF,IAAA,IAAI,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE;;AAE/C,QAAA,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ;AACjE,QAAA,MAAM,UAAU,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC,IACpD,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CACpB;QAED,IAAI,CAAC,UAAU,EAAE;AACf,YAAA,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;AACd,gBAAA,UAAU,EAAE;AACV,oBAAA,aAAa,EAAE,QAAQ;AACxB,iBAAA;AACF,aAAA,CAAC;QACJ;IACF;AAEA,IAAA,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB;AAEA;;;;;;;;AAQG;MACU,uBAAuB,GAAsB,CACxD,GAAyB,EACzB,IAAmB,KACe;AAClC,IAAA,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;AAEnC,IAAA,MAAM,YAAY,GAAG,SAAS,CAAC,mBAAmB,EAAE;IAEpD,IAAI,YAAY,EAAE;AAChB,QAAA,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC;AACd,YAAA,UAAU,EAAE;gBACV,mBAAmB,EAAE,YAAY,CAAC,EAAE;AACrC,aAAA;AACF,SAAA,CAAC;IACJ;AAEA,IAAA,OAAO,IAAI,CAAC,GAAG,CAAC;AAClB;;ACvFA;;;;;AAKG;MACU,gBAAgB,GAAsB,CACjD,GAAyB,EACzB,IAAmB,KACe;;AAElC,IAAA,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC;AAC5B,QAAA,UAAU,EAAE;AACV,YAAA,4BAA4B,EAAE,MAAM;AACrC,SAAA;AACF,KAAA,CAAC;AAEF,IAAA,OAAO,IAAI,CAAC,WAAW,CAAC;AAC1B;;AChBA;;;;;;AAMG;MACU,gBAAgB,GAAsB,CACjD,GAAyB,EACzB,IAAmB,KACe;AAClC,IAAA,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC;AAElC,IAAA,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CACnB,UAAU,CAAC,CAAC,KAAwB,KAAI;;AAEtC,QAAA,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE;AACxB,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC;;;QAIA,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE;AACrC,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;QAChC;AAEA,QAAA,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC;AACrC,QAAA,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC;AAEpB,QAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;IAChC,CAAC,CAAC,CACH;AACH;AAEA;;;;AAIG;AACH,SAAS,cAAc,CAAC,KAAwB,EAAA;;AAE9C,IAAA,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK;IAExB,IAAI,IAAI,EAAE;;QAER,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE;AAC5C,YAAA,IAAI,IAAI,CAAC,kBAAkB,EAAE;gBAC3B,OAAO,CAAA,EAAG,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,kBAAkB,CAAA,CAAA,CAAG;YACvD;YACA,OAAO,IAAI,CAAC,OAAO;QACrB;;QAEA,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO,EAAE;YAC5C,OAAO,IAAI,CAAC,OAAO;QACrB;;AAEA,QAAA,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE;YAC5E,OAAO,IAAI,CAAC,KAAK;QACnB;;AAEA,QAAA,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE;YAC9E,OAAO,IAAI,CAAC,MAAM;QACpB;AACA,QAAA,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,EAAE;YAC5E,OAAO,IAAI,CAAC,KAAK;QACnB;;QAEA,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,EAAE;AAC3C,YAAA,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9C,IAAI,UAAU,EAAE;gBACd,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;AACpC,gBAAA,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE;AAC1C,oBAAA,OAAO,IAAI,CAAC,CAAC,CAAC;gBAChB;YACF;QACF;;QAEA,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,GAAG,EAAE;AACjD,YAAA,OAAO,IAAI;QACb;IACF;;AAGA,IAAA,QAAQ,KAAK,CAAC,MAAM;;;AAGlB,QAAA,KAAK,CAAC;AACJ,YAAA,OAAO,yFAAyF;AAClG,QAAA,KAAK,GAAG;AACN,YAAA,OAAO,2CAA2C;AACpD,QAAA,KAAK,GAAG;AACN,YAAA,OAAO,oDAAoD;AAC7D,QAAA,KAAK,GAAG;AACN,YAAA,OAAO,uCAAuC;AAChD,QAAA,KAAK,GAAG;AACN,YAAA,OAAO,2DAA2D;AACpE,QAAA,KAAK,GAAG;AACN,YAAA,OAAO,8DAA8D;AACvE,QAAA,KAAK,GAAG;AACN,YAAA,OAAO,4DAA4D;AACrE,QAAA,KAAK,GAAG;AACR,QAAA,KAAK,GAAG;AACR,QAAA,KAAK,GAAG;AACN,YAAA,OAAO,iEAAiE;AAC1E,QAAA;AACE,YAAA,OAAO,CAAA,mBAAA,EAAsB,KAAK,CAAC,MAAM,sBAAsB;;AAErE;;AChHA;;;;;;;AAOG;AAeH,MAAM,QAAQ,GAAG,YAAY;AAC7B,MAAM,KAAK,GAAG,MAAM;AACpB,MAAM,MAAM,GAAG,SAAS;AAExB,IAAI,OAAO,GAA4B,IAAI;AAE3C;SACgB,aAAa,GAAA;AAC3B,IAAA,MAAM,MAAM,GAAG,OAAO,UAAU,CAAC,eAAe,KAAK,SAAS,GAAG,UAAU,CAAC,eAAe,GAAG,IAAI;AAClG,IAAA,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,WAAW,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM;AACnE;AAEA;SACgB,OAAO,GAAA;IACrB,OAAO,KAAK,YAAY,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,KAAI;QACzC,OAAO,GAAG,IAAI;AACd,QAAA,MAAM,KAAK;AACb,IAAA,CAAC,CAAC;AACF,IAAA,OAAO,OAAO;AAChB;AAEA;SACgB,oBAAoB,GAAA;IAClC,OAAO,GAAG,IAAI;AAChB;AAEA,eAAe,YAAY,GAAA;IACzB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACpH,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,SAAS;AACtD,IAAA,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;AACtF;AAEA;;;AAGG;AACH,SAAS,SAAS,CAAC,SAAwB,EAAA;IACzC,IAAI,OAAO,SAAS,KAAK,WAAW;AAAE,QAAA,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;AAClE,IAAA,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,KAAI;QAC7B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;AACxC,QAAA,IAAI,CAAC,eAAe,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACjE,IAAI,CAAC,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;AAClC,QAAA,IAAI,CAAC,SAAS,GAAG,MAAK;AACpB,YAAA,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM;YACtB,MAAM,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC;YAC7C,MAAM,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC;YACnC,IAAI,IAAI,GAAyB,IAAI;YACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;AAClC,YAAA,QAAQ,CAAC,SAAS,GAAG,MAAK;AACxB,gBAAA,IAAI,QAAQ,CAAC,MAAM,EAAE;AACnB,oBAAA,IAAI,GAAG,QAAQ,CAAC,MAAuB;gBACzC;qBAAO;AACL,oBAAA,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC;oBAC5B,IAAI,GAAG,SAAS;gBAClB;AACF,YAAA,CAAC;AACD,YAAA,EAAE,CAAC,UAAU,GAAG,MAAK,EAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpD,YAAA,EAAE,CAAC,OAAO,GAAG,MAAK,EAAG,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnD,QAAA,CAAC;AACH,IAAA,CAAC,CAAC;AACJ;AAEA,eAAe,WAAW,CAAC,SAAoB,EAAA;AAC7C,IAAA,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC;IAC3D,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAE,EAAE,CAAC,EAAE,GAAG,CAAC,CAAE,EAAE;AAC1D;;AC7EA;AACO,eAAe,eAAe,CAAC,GAAY,EAAE,MAAuB,EAAA;AACzE,IAAA,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE;AACpE,IAAA,MAAM,OAAO,GAA4B;AACvC,QAAA,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;AACxB,QAAA,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE;AAChC,QAAA,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC;QACzB,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;KACnC;IACD,IAAI,MAAM,CAAC,WAAW;QAAE,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC;IAClF,IAAI,MAAM,CAAC,KAAK;AAAE,QAAA,OAAO,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK;IAEjD,MAAM,YAAY,GAAG,CAAA,EAAG,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA,CAAA,EAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAA,CAAE;AACzG,IAAA,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;AAC7F,IAAA,OAAO,CAAA,EAAG,YAAY,CAAA,CAAA,EAAI,cAAc,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA,CAAE;AACvE;AAEA;AACM,SAAU,QAAQ,CAAC,GAAW,EAAA;AAClC,IAAA,MAAM,IAAI,GAAG,OAAO,QAAQ,KAAK,WAAW,GAAG,QAAQ,CAAC,IAAI,GAAG,mBAAmB;IAClF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;IACnC,OAAO,CAAA,EAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAA,CAAE;AACjD;AAEA;AACO,eAAe,eAAe,CAAC,WAAmB,EAAA;IACvD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3F,OAAO,cAAc,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAC/C;AAEA,SAAS,aAAa,CAAC,IAAY,EAAA;IACjC,OAAO,cAAc,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACvD;AAEA,SAAS,cAAc,CAAC,KAAiB,EAAA;IACvC,IAAI,MAAM,GAAG,EAAE;AACf,IAAA,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;AAChF;;AC5CA;AACA,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB;AAExC;;;;;;;;;;;AAWG;MACU,eAAe,GAAsB,CAAC,GAAG,EAAE,IAAI,KAAI;IAC9D,IAAI,CAAC,aAAa,EAAE;AAAE,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;;;;IAItC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,EAAE;AAC3F,QAAA,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;IACnE;AACA,IAAA,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC;AACzC,IAAA,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC;AAAE,QAAA,OAAO,IAAI,CAAC,GAAG,CAAC;IAExD,MAAM,IAAI,GAAG,CAAC,KAAyB,KACrC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CACzCI,WAAS,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC,EACnC,GAAG,CAAC,CAAC,KAAK,OAAO,IAAI,KAAK,YAAY,YAAY;AAAE,QAAA,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAC1F;IAEH,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7C,UAAU,CAAC,CAAC,KAAc,KAAI;AAC5B,QAAA,IAAI,EAAE,KAAK,YAAY,iBAAiB,CAAC;AAAE,YAAA,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC;QACzE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,YAAY,CAAC;AAC9C,QAAA,IAAI,KAAK;AAAE,YAAA,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;QAC/C,OAAO,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,UAAU,CAAC,MAAM,KAAK,CAAC;IAC7E,CAAC,CAAC,CACH;AACH;AAEA,eAAe,SAAS,CAAC,GAAyB,EAAE,UAAyB,EAAE,KAAyB,EAAA;AACtG,IAAA,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC1H,IAAA,IAAI,OAAO,GAAgB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;AACzD,IAAA,IAAI,UAAU;QAAE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAA,KAAA,EAAQ,UAAU,CAAA,CAAE,CAAC;IAC5E,OAAO,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AAC/B;AAEA;AACA,SAAS,cAAc,CAAC,GAAyB,EAAA;IAC/C,OAAO,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;AACjH;AAEA;AACM,SAAU,kBAAkB,CAAC,GAAyB,EAAA;AAC1D,IAAA,MAAM,KAAK,GAAG,2BAA2B,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;IACtF,MAAM,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE;AAChC,IAAA,OAAO,KAAK,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,IAAI;AACnD;AAEA,IAAI,WAAW,GAA6C,IAAI;AAEhE;AACM,SAAU,WAAW,CAAC,KAAa,EAAA;AACvC,IAAA,IAAI,WAAW,EAAE,KAAK,KAAK,KAAK;QAAE,OAAO,WAAW,CAAC,KAAK;IAC1D,IAAI,KAAK,GAAG,KAAK;IACjB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,IAAI,EAAE;AACR,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;AACzG,YAAA,MAAM,GAAG,GAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAiC,EAAE,GAAG,EAAE,GAAG;YACvE,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC;QACnD;AAAE,QAAA,MAAM;YACN,KAAK,GAAG,KAAK;QACf;IACF;AACA,IAAA,WAAW,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;AAC9B,IAAA,OAAO,KAAK;AACd;AAEA;AACA,SAAS,YAAY,CAAC,KAAwB,EAAA;AAC5C,IAAA,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;AAAE,QAAA,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,gBAAgB,CAAC;AAC1G,IAAA,OAAO,KAAK,CAAC,MAAM,KAAK,GAAG,IAAK,KAAK,CAAC,KAAoC,EAAE,KAAK,KAAK,gBAAgB;AACxG;AAEA,SAAS,aAAa,CAAC,GAAyB,EAAE,OAAoB,EAAA;IACpE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;AACvC,IAAA,IAAI,KAAK;AAAE,QAAA,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;AACjD;AAEA,SAAS,QAAQ,CAAC,GAAW,EAAA;IAC3B,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM;AACtC;;AChGA;;;;;AAKG;AACG,SAAU,eAAe,CAAC,IAAgB,EAAA;AAC9C,IAAA,OAAO,OAAO,KAAwB,EAAE,IAAkB,KAAuB;AAC/E,QAAA,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,GAAG,KAAK,GAAG,KAAK,YAAY,GAAG,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG;AAC7F,QAAA,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,KAAK,EAAE,WAAW,EAAE;AAEpD,QAAA,IAAI,OAAO,GAAG,IAAI,WAAW,EAAE;AAC/B,QAAA,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,IAAI,KAAI;YACjD,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;AACpC,QAAA,CAAC,CAAC;AAEF,QAAA,IAAI;AACF,YAAA,MAAM,QAAQ,GAAG,MAAM,cAAc,CACnC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,EAAE;AACxB,gBAAA,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,IAAI;gBACxB,OAAO;AACP,gBAAA,OAAO,EAAE,UAAU;AACnB,gBAAA,YAAY,EAAE,MAAM;AACpB,gBAAA,eAAe,EAAE,IAAI,EAAE,WAAW,KAAK,SAAS;AACjD,aAAA,CAAC,CACH;AACD,YAAA,OAAO,UAAU,CAAC,QAAQ,CAAC;QAC7B;QAAE,OAAO,KAAK,EAAE;YACd,IAAI,KAAK,YAAY,iBAAiB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;AAAE,gBAAA,OAAO,UAAU,CAAC,KAAK,CAAC;AACpF,YAAA,MAAM,KAAK;QACb;AACF,IAAA,CAAC;AACH;AAEA,SAAS,UAAU,CAAC,QAAkD,EAAA;AACpE,IAAA,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE;IAC7B,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,KAAI;QACvC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACxC,IAAI,KAAK,KAAK,IAAI;AAAE,YAAA,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC;AAC9C,IAAA,CAAC,CAAC;AACF,IAAA,MAAM,IAAI,GAAG,QAAQ,YAAY;UAC7B,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ,GAAG,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI;AAC7F,UAAE,QAAQ,CAAC,IAAI;AACjB,IAAA,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;AAC3F,IAAA,OAAO,IAAI,QAAQ,CAAC,KAAK,GAAG,IAAI,GAAG,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC;AACjH;;AChDA;;ACAA;;AAEG;;;;"}

package/package.json

@@ -1,6 +1,50 @@
 {
   "name": "@syndew/oluso-auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "1.30.1",
+  "description": "Angular authentication for apps signing in with Oluso: OIDC auth provider, auth store, guards and the token refresh, tenant and DPoP interceptors.",
+  "keywords": [
+    "angular",
+    "oluso",
+    "oidc",
+    "oauth2",
+    "authentication",
+    "dpop"
+  ],
+  "homepage": "https://github.com/SyndewTech/Oluso/tree/main/src/frontend/libs/auth#readme",
+  "bugs": {
+    "url": "https://github.com/SyndewTech/Oluso/issues"
+  },
+  "license": "SEE LICENSE IN LICENSE",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/SyndewTech/Oluso.git",
+    "directory": "src/frontend/libs/auth"
+  },
+  "peerDependencies": {
+    "@angular/common": "^21.1.0",
+    "@angular/core": "^21.1.0",
+    "@angular/router": "^21.1.0",
+    "rxjs": "^7.8.0",
+    "@syndew/oluso-ui-core": "^1.30.1"
+  },
+  "sideEffects": false,
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "module": "fesm2022/syndew-oluso-auth.mjs",
+  "typings": "types/syndew-oluso-auth.d.ts",
+  "exports": {
+    "./package.json": {
+      "default": "./package.json"
+    },
+    ".": {
+      "types": "./types/syndew-oluso-auth.d.ts",
+      "default": "./fesm2022/syndew-oluso-auth.mjs"
+    }
+  },
+  "type": "module",
+  "dependencies": {
+    "tslib": "^2.3.0"
+  }
 }